docs: update README.md 2

This commit is contained in:
qi4L
2024-09-15 18:12:15 +08:00
parent 5c2c1a86db
commit f892540164
7 changed files with 152 additions and 104 deletions
-1
View File
@@ -1,5 +1,4 @@
.idea/ .idea/
.gradle/ .gradle/
out/ out/
gradle/
.DS_Store .DS_Store
+1 -1
View File
@@ -15,7 +15,7 @@
✔ 下载最新版本的[Releases](https://github.com/qi4L/JYso/releases)。 ✔ 下载最新版本的[Releases](https://github.com/qi4L/JYso/releases)。
## 👍 功能特性 ## 👍 特点
+ JNDI 账号密码启动 + JNDI 账号密码启动
+ JNDI 路由隐藏或加密 + JNDI 路由隐藏或加密
-91
View File
@@ -1,91 +0,0 @@
# 🐦‍⬛JYso
![](https://img.shields.io/badge/JDK-1.6+-orange)
![](https://img.shields.io/badge/gradle-8.7-blue)
![](https://img.shields.io/badge/SDL-Groovy-green)
👊**JYso** is a tool that can be used as both ysoserial and JNDIExploit. It also has bypass functions of multiple JNDI high versions, WAF, and RASP.
# 🚀 Getting Started Guide
📢 Please be sure to take a moment to read this document, which will help you quickly become familiar with JYso!
🧐 Use documentation [Wiki](https://github.com/qi4L/JYso/wiki).
✔ Download the latest version of [Releases](https://github.com/qi4L/JYso/releases).
# 🐲Features
+ JNDI account activation
+ JNDI routing hidden or encrypted
+ JNDI high version Bypass
+ 12 available echo classes
+ 18 available memshell classes, and supports modifying the memshell path, password, authentication HTTP header and value
+ 76 available Gadgets and provide multiple ways to use them
+ Memory horse supports [No file landing Agent entry](https://xz.aliyun.com/t/10075?time__1311=mq%2BxBD9QDQe4yDBkPoN%2BuDAO%3DnB5x&alichlgref=https%3A%2F%2Fxz.aliyun.com%2Fsearch%3Fkeyword%3Drebeyond)
+ write the memshell to JRE or environment variable to hide
+ Serialized data plus dirty data
+ [Serialized data is encoded in UTF-8 corresponding to 3 bytes](https://whoopsunix.com/docs/PPPYSO/advance/UTFMIX/)
+ Secondary deserialization of SignedObject, which can be used to bypass TemplatesImpl blacklist, CC countless groups and blacklists that often appear in CTF, etc.
+ To solve the problem that the Shiro Header header is too long, obtain the value of the specified parameter from the request for class loading.
+ Dynamically generate obfuscated class names
+ MSF/CS online
+ Code execution via JDBC
If you have any other great ideas be sure to let me know! 😎
# 🐯Compile
Download gradle8.7+ and configure it in the global environment variable, execute it in the project root directory
```shell
./gradlew shadowJar
```
# 🌲Directory structure
For more information, see [Directory Structure Description](docs/directory_structure.md).
# ⌛ Follow-up plan
- [ ] Continuous optimization and improvement of each module
- [ ] Add more Bypass functions
- [ ] Optimize the traversal effect through machine learning and graph theory
# 🙏Contribute
We warmly welcome all of you to work together to improve this project!
# ✨404StarLink 2.0 - Galaxy
JYso is a part of 404Team [404StarLink 2.0](https://github.com/knownsec/404StarLink). If you have questions about JYso or want to find a partner to communicate, you can refer to the Starlink group project.
+ https://github.com/knownsec/404StarLink2.0-Galaxy#community
# 📜 Disclaimer
This tool can only be used in the security construction of enterprises that have obtained sufficient legal authorization. When using this tool, you should ensure that all your actions comply with local laws and regulations.
If you commit any illegal behavior while using this tool, you will bear all the consequences yourself. All developers and contributors of this tool do not assume any legal and joint liability.
Please do not install and use this tool unless you have fully read, fully understood and accepted all the terms of this agreement.
Your usage behavior or your acceptance of this Agreement in any other express or implicit manner shall be deemed to have read and agreed to be bound by this Agreement.
# 📷reference project
- https://github.com/veracode-research/rogue-jndi
- https://github.com/welk1n/JNDI-Injection-Exploit
- https://github.com/welk1n/JNDI-Injection-Bypass
- https://github.com/WhiteHSBG/JNDIExploit
- https://github.com/su18/ysoserial
- https://github.com/rebeyond/Behinder
- https://t.zsxq.com/17LkqCzk8
- https://mp.weixin.qq.com/s/fcuKNfLXiFxWrIYQPq7OCg
- https://xz.aliyun.com/t/11640?time__1311=mqmx0DBDuDnQ340vo4%2BxCwg%3DQai%3DYzaq4D&alichlgref=https%3A%2F%2Fxz.aliyun.com%2Fu%2F8697
- https://archive.conference.hitb.org/hitbsecconf2021sin/sessions/make-jdbc-attacks-brilliant-again/
- https://tttang.com/archive/1405/#toc_0x03-jdbc-rce
- https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoYg0%3DDR0HG8KeD&alichlgref=https%3A%2F%2Ftttang.com%2F#toc-7
- https://whoopsunix.com/docs/PPPYSO/advance/UTFMIX/
- https://github.com/Whoopsunix/utf-8-overlong-encoding
- https://tttang.com/archive/1405/#toc_groovyclassloader
- https://xz.aliyun.com/t/10656?time__1311=mq%2BxBDy7G%3DLOD%2FD0DoY4AKqiKD%3DOQjqx&alichlgref=https%3A%2F%2Ftttang.com%2F
- https://www.leavesongs.com/PENETRATION/use-tls-proxy-to-exploit-ldaps.html
+12 -11
View File
@@ -25,8 +25,6 @@ shadowJar {
} }
dependencies { dependencies {
implementation files('libs/jai-core-1.1.3.jar')
implementation files('libs/weblogic-server.jar')
api libs.io.projectreactor.reactor.core api libs.io.projectreactor.reactor.core
api libs.com.ibm.websphere.appserver.api.com.ibm.websphere.appserver.api.wsoc api libs.com.ibm.websphere.appserver.api.com.ibm.websphere.appserver.api.wsoc
api libs.org.glassfish.tyrus.tyrus.server api libs.org.glassfish.tyrus.tyrus.server
@@ -86,20 +84,23 @@ dependencies {
api libs.org.apache.click.click.nodeps api libs.org.apache.click.click.nodeps
api libs.org.clojure.clojure api libs.org.clojure.clojure
api libs.cn.hutool.hutool.all api libs.cn.hutool.hutool.all
// api libs.commons.beanutils.commons.beanutils
api libs.javax.websocket.javax.websocket.api api libs.javax.websocket.javax.websocket.api
api libs.com.caucho.resin api libs.com.caucho.resin
api libs.com.rometools.rome
api libs.org.apache.xbean.xbean.naming
api libs.com.thoughtworks.xstream
api libs.commons.configuration
api libs.com.esotericsoftware.kryo
api libs.org.jyaml.jyaml
api libs.com.cedarsoftware.json.io
api libs.org.codehaus.castor.castor.xml
implementation files('libs/jai-core-1.1.3.jar')
implementation files('libs/weblogic-server.jar')
implementation 'org.codehaus.castor:castor-xml:1.4.1'
implementation 'com.cedarsoftware:json-io:4.9.1'
implementation 'org.jyaml:jyaml:1.3'
implementation 'com.esotericsoftware:kryo:4.0.0'
implementation 'commons-configuration:commons-configuration:1.10'
implementation 'com.thoughtworks.xstream:xstream:1.4.9'
implementation 'org.apache.xbean:xbean-naming:4.5'
implementation 'com.rometools:rome:1.7.0'
implementation 'net.sf.json-lib:json-lib:2.4:jdk15' implementation 'net.sf.json-lib:json-lib:2.4:jdk15'
implementation 'org.apache.directory.server:apacheds-xdbm-partition:2.0.0.AM26' implementation 'org.apache.directory.server:apacheds-xdbm-partition:2.0.0.AM26'
runtimeOnly libs.org.aspectj.aspectjweaver runtimeOnly libs.org.aspectj.aspectjweaver
compileOnly libs.org.apache.tomcat.tomcat.websocket compileOnly libs.org.apache.tomcat.tomcat.websocket
} }
+132
View File
@@ -0,0 +1,132 @@
# This file was generated by the Gradle 'init' task.
# https://docs.gradle.org/current/userguide/platforms.html#sub::toml-dependencies-format
[versions]
cn-hutool-hutool-all = "5.7.7"
com-alibaba-fastjson = "1.2.83"
com-alibaba-fastjson2-fastjson2 = "2.0.26"
com-beust-jcommander = "1.78"
com-caucho-resin = "4.0.65"
com-fasterxml-jackson-core-jackson-databind = "2.11.3"
com-ibm-websphere-appserver-api-com-ibm-websphere-appserver-api-wsoc = "1.0.10"
com-mchange-c3p0 = "0.9.5.5"
com-nqzero-permit-reflect = "0.3"
com-teradata-jdbc-terajdbc = "20.00.00.06"
com-unboundid-unboundid-ldapsdk = "4.0.9"
com-vaadin-vaadin-server = "7.7.14"
commons-cli-commons-cli = "1.5.0"
commons-collections-commons-collections = "3.2.1"
io-projectreactor-reactor-core = "3.4.26"
io-undertow-undertow-core = "2.2.2.Final"
io-undertow-undertow-servlet = "2.2.2.Final"
javax-servlet-javax-servlet-api = "4.0.1"
javax-websocket-javax-websocket-api = "1.1"
jboss-jboss-serialization = "4.2.2.GA"
net-jodah-expiringmap = "0.5.9"
org-apache-click-click-nodeps = "2.3.0"
org-apache-commons-commons-collections4 = "4.0"
org-apache-commons-commons-lang3 = "3.12.0"
org-apache-commons-commons-text = "1.8"
org-apache-logging-log4j-log4j-core = "2.14.1"
org-apache-maven-plugins-maven-assembly-plugin = "3.0.0"
org-apache-myfaces-core-myfaces-impl = "2.2.9"
org-apache-tomcat-embed-tomcat-embed-core = "8.5.58"
org-apache-tomcat-tomcat-websocket = "9.0.62"
org-apache-wicket-wicket-util = "6.23.0"
org-aspectj-aspectjweaver = "1.9.7"
org-beanshell-bsh = "2.0b5"
org-clojure-clojure = "1.8.0"
org-codehaus-groovy-groovy = "2.4.5"
org-eclipse-jetty-jetty-ant = "11.0.7"
org-fusesource-jansi-jansi = "2.4.0"
org-glassfish-tyrus-tyrus-server = "2.0.0"
org-hibernate-hibernate-core = "4.3.11.Final"
org-javassist-javassist = "3.29.2-GA"
org-jboss-interceptor-jboss-interceptor-core = "2.0.0.Final"
org-jboss-interceptor-jboss-interceptor-spi = "2.0.0.Final"
org-jboss-remoting-jboss-remoting = "4.0.19.Final"
org-jboss-remotingjmx-remoting-jmx = "2.0.1.Final"
org-jboss-spec-javax-security-jacc-jboss-jacc-api-v1-v4-spec = "1.0.3.Final"
org-jboss-weld-weld-core = "1.1.33.Final"
org-jenkins-ci-main-remoting = "2.55"
org-ow2-asm-asm = "8.0.1"
org-python-jython-standalone = "2.5.2"
org-reflections-reflections = "0.9.10"
org-springframework-spring-aop = "5.2.3.RELEASE"
org-springframework-spring-beans = "5.2.3.RELEASE"
org-springframework-spring-context-support = "5.2.3.RELEASE"
org-springframework-spring-core = "5.2.3.RELEASE"
org-springframework-spring-jdbc = "5.2.3.RELEASE"
org-springframework-spring-oxm = "5.2.3.RELEASE"
org-springframework-spring-test = "5.2.3.RELEASE"
org-springframework-spring-tx = "5.2.3.RELEASE"
org-springframework-spring-web = "5.2.3.RELEASE"
org-springframework-spring-webmvc = "5.2.3.RELEASE"
rhino-js = "1.7R2"
rome-rome = "1.0"
xerces-xercesimpl = "2.12.0"
[libraries]
cn-hutool-hutool-all = { module = "cn.hutool:hutool-all", version.ref = "cn-hutool-hutool-all" }
com-alibaba-fastjson = { module = "com.alibaba:fastjson", version.ref = "com-alibaba-fastjson" }
com-alibaba-fastjson2-fastjson2 = { module = "com.alibaba.fastjson2:fastjson2", version.ref = "com-alibaba-fastjson2-fastjson2" }
com-beust-jcommander = { module = "com.beust:jcommander", version.ref = "com-beust-jcommander" }
com-caucho-resin = { module = "com.caucho:resin", version.ref = "com-caucho-resin" }
com-fasterxml-jackson-core-jackson-databind = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "com-fasterxml-jackson-core-jackson-databind" }
com-ibm-websphere-appserver-api-com-ibm-websphere-appserver-api-wsoc = { module = "com.ibm.websphere.appserver.api:com.ibm.websphere.appserver.api.wsoc", version.ref = "com-ibm-websphere-appserver-api-com-ibm-websphere-appserver-api-wsoc" }
com-mchange-c3p0 = { module = "com.mchange:c3p0", version.ref = "com-mchange-c3p0" }
com-nqzero-permit-reflect = { module = "com.nqzero:permit-reflect", version.ref = "com-nqzero-permit-reflect" }
com-teradata-jdbc-terajdbc = { module = "com.teradata.jdbc:terajdbc", version.ref = "com-teradata-jdbc-terajdbc" }
com-unboundid-unboundid-ldapsdk = { module = "com.unboundid:unboundid-ldapsdk", version.ref = "com-unboundid-unboundid-ldapsdk" }
com-vaadin-vaadin-server = { module = "com.vaadin:vaadin-server", version.ref = "com-vaadin-vaadin-server" }
commons-cli-commons-cli = { module = "commons-cli:commons-cli", version.ref = "commons-cli-commons-cli" }
commons-collections-commons-collections = { module = "commons-collections:commons-collections", version.ref = "commons-collections-commons-collections" }
io-projectreactor-reactor-core = { module = "io.projectreactor:reactor-core", version.ref = "io-projectreactor-reactor-core" }
io-undertow-undertow-core = { module = "io.undertow:undertow-core", version.ref = "io-undertow-undertow-core" }
io-undertow-undertow-servlet = { module = "io.undertow:undertow-servlet", version.ref = "io-undertow-undertow-servlet" }
javax-servlet-javax-servlet-api = { module = "javax.servlet:javax.servlet-api", version.ref = "javax-servlet-javax-servlet-api" }
javax-websocket-javax-websocket-api = { module = "javax.websocket:javax.websocket-api", version.ref = "javax-websocket-javax-websocket-api" }
jboss-jboss-serialization = { module = "jboss:jboss-serialization", version.ref = "jboss-jboss-serialization" }
net-jodah-expiringmap = { module = "net.jodah:expiringmap", version.ref = "net-jodah-expiringmap" }
org-apache-click-click-nodeps = { module = "org.apache.click:click-nodeps", version.ref = "org-apache-click-click-nodeps" }
org-apache-commons-commons-collections4 = { module = "org.apache.commons:commons-collections4", version.ref = "org-apache-commons-commons-collections4" }
org-apache-commons-commons-lang3 = { module = "org.apache.commons:commons-lang3", version.ref = "org-apache-commons-commons-lang3" }
org-apache-commons-commons-text = { module = "org.apache.commons:commons-text", version.ref = "org-apache-commons-commons-text" }
org-apache-logging-log4j-log4j-core = { module = "org.apache.logging.log4j:log4j-core", version.ref = "org-apache-logging-log4j-log4j-core" }
org-apache-maven-plugins-maven-assembly-plugin = { module = "org.apache.maven.plugins:maven-assembly-plugin", version.ref = "org-apache-maven-plugins-maven-assembly-plugin" }
org-apache-myfaces-core-myfaces-impl = { module = "org.apache.myfaces.core:myfaces-impl", version.ref = "org-apache-myfaces-core-myfaces-impl" }
org-apache-tomcat-embed-tomcat-embed-core = { module = "org.apache.tomcat.embed:tomcat-embed-core", version.ref = "org-apache-tomcat-embed-tomcat-embed-core" }
org-apache-tomcat-tomcat-websocket = { module = "org.apache.tomcat:tomcat-websocket", version.ref = "org-apache-tomcat-tomcat-websocket" }
org-apache-wicket-wicket-util = { module = "org.apache.wicket:wicket-util", version.ref = "org-apache-wicket-wicket-util" }
org-aspectj-aspectjweaver = { module = "org.aspectj:aspectjweaver", version.ref = "org-aspectj-aspectjweaver" }
org-beanshell-bsh = { module = "org.beanshell:bsh", version.ref = "org-beanshell-bsh" }
org-clojure-clojure = { module = "org.clojure:clojure", version.ref = "org-clojure-clojure" }
org-codehaus-groovy-groovy = { module = "org.codehaus.groovy:groovy", version.ref = "org-codehaus-groovy-groovy" }
org-eclipse-jetty-jetty-ant = { module = "org.eclipse.jetty:jetty-ant", version.ref = "org-eclipse-jetty-jetty-ant" }
org-fusesource-jansi-jansi = { module = "org.fusesource.jansi:jansi", version.ref = "org-fusesource-jansi-jansi" }
org-glassfish-tyrus-tyrus-server = { module = "org.glassfish.tyrus:tyrus-server", version.ref = "org-glassfish-tyrus-tyrus-server" }
org-hibernate-hibernate-core = { module = "org.hibernate:hibernate-core", version.ref = "org-hibernate-hibernate-core" }
org-javassist-javassist = { module = "org.javassist:javassist", version.ref = "org-javassist-javassist" }
org-jboss-interceptor-jboss-interceptor-core = { module = "org.jboss.interceptor:jboss-interceptor-core", version.ref = "org-jboss-interceptor-jboss-interceptor-core" }
org-jboss-interceptor-jboss-interceptor-spi = { module = "org.jboss.interceptor:jboss-interceptor-spi", version.ref = "org-jboss-interceptor-jboss-interceptor-spi" }
org-jboss-remoting-jboss-remoting = { module = "org.jboss.remoting:jboss-remoting", version.ref = "org-jboss-remoting-jboss-remoting" }
org-jboss-remotingjmx-remoting-jmx = { module = "org.jboss.remotingjmx:remoting-jmx", version.ref = "org-jboss-remotingjmx-remoting-jmx" }
org-jboss-spec-javax-security-jacc-jboss-jacc-api-v1-v4-spec = { module = "org.jboss.spec.javax.security.jacc:jboss-jacc-api_1.4_spec", version.ref = "org-jboss-spec-javax-security-jacc-jboss-jacc-api-v1-v4-spec" }
org-jboss-weld-weld-core = { module = "org.jboss.weld:weld-core", version.ref = "org-jboss-weld-weld-core" }
org-jenkins-ci-main-remoting = { module = "org.jenkins-ci.main:remoting", version.ref = "org-jenkins-ci-main-remoting" }
org-ow2-asm-asm = { module = "org.ow2.asm:asm", version.ref = "org-ow2-asm-asm" }
org-python-jython-standalone = { module = "org.python:jython-standalone", version.ref = "org-python-jython-standalone" }
org-reflections-reflections = { module = "org.reflections:reflections", version.ref = "org-reflections-reflections" }
org-springframework-spring-aop = { module = "org.springframework:spring-aop", version.ref = "org-springframework-spring-aop" }
org-springframework-spring-beans = { module = "org.springframework:spring-beans", version.ref = "org-springframework-spring-beans" }
org-springframework-spring-context-support = { module = "org.springframework:spring-context-support", version.ref = "org-springframework-spring-context-support" }
org-springframework-spring-core = { module = "org.springframework:spring-core", version.ref = "org-springframework-spring-core" }
org-springframework-spring-jdbc = { module = "org.springframework:spring-jdbc", version.ref = "org-springframework-spring-jdbc" }
org-springframework-spring-oxm = { module = "org.springframework:spring-oxm", version.ref = "org-springframework-spring-oxm" }
org-springframework-spring-test = { module = "org.springframework:spring-test", version.ref = "org-springframework-spring-test" }
org-springframework-spring-tx = { module = "org.springframework:spring-tx", version.ref = "org-springframework-spring-tx" }
org-springframework-spring-web = { module = "org.springframework:spring-web", version.ref = "org-springframework-spring-web" }
org-springframework-spring-webmvc = { module = "org.springframework:spring-webmvc", version.ref = "org-springframework-spring-webmvc" }
rhino-js = { module = "rhino:js", version.ref = "rhino-js" }
rome-rome = { module = "rome:rome", version.ref = "rome-rome" }
xerces-xercesimpl = { module = "xerces:xercesImpl", version.ref = "xerces-xercesimpl" }
Binary file not shown.
+7
View File
@@ -0,0 +1,7 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists