From 3f10fbad643332a33f57db9a3c460c01166f4150 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=82=81?= <75202638+qi4L@users.noreply.github.com>
Date: Thu, 26 Mar 2026 20:15:30 +0800
Subject: [PATCH] =?UTF-8?q?Updated=206=E3=80=81Gadget=20(markdown)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
6、Gadget.md | 279 +++++++++++++++++++++------------------------------
1 file changed, 113 insertions(+), 166 deletions(-)
diff --git a/6、Gadget.md b/6、Gadget.md
index 1e20386..0f459ef 100644
--- a/6、Gadget.md
+++ b/6、Gadget.md
@@ -1,109 +1,111 @@
# 使用参数和链子
```text7
-[root]#~ Usage: java -jar JYso-[version].jar -y -g [payload] -p [command] [options]
[root]#~ Available payload types:
- Payload Authors Dependencies
- ------- ------- ------------
- AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
- AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
- BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
- BeanShell2 @killer bsh:2.0b1
- BindingEnumeration
- C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
- C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
- C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
- C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
- C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
- C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
- C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
- C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
- C3P0RefDataSource
- C3P0WrapperConnPool
- Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
- Clojure @JackOfMostTrades clojure:1.8.0
- cb160 commons-beanutils:1.6.0
- cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
- cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X
- cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X
- cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X
- CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
- CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2
- CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2
- CommonsBeanutilsJNDI commons-beanutils:1.9.2, commons-collections:3.1
- CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
- CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10
- CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
- CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2
- cc1 @frohoff commons-collections:3.1
- cc2 @frohoff commons-collections4:4.0
- cc3 @frohoff commons-collections:3.1
- cc4 @frohoff commons-collections4:4.0
- cc4_17
- cc5 @matthias_kaiser, @jasinner commons-collections:3.1
- cc6 @matthias_kaiser commons-collections:3.1
- cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
- cc8 @navalorenzo commons-collections4:4.0
- cc9 @梅子酒 commons-collections:3.2.1
- cc10 commons-collections:3.2.1
- cc11
- cc12 @Jayl1n commons-collections:3.2.1
- cc13 @Unam4 commons-collections:3.1
- ccK1 commons-collections:3.1
- ccK2 commons-collections:4.0
- ccK3 @matthias_kaiser commons-collections:3.1
- ccK4 @matthias_kaiser commons-collections:4.0
- Fastjson1
- Fastjson2
- FileUpload1
- Groovy
- Groovy1 @frohoff groovy:2.3.9
- Groovy2 @Unam4 groovy <2.4.3
- Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
- Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
- Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
- ImageIO
- JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
- JRE8u20 @frohoff
- JRE8u20_2
- JRMPClient @mbechler
- JRMPClient_Activator @mbechler
- JRMPClient_Obj @mbechler
- JRMPListener @mbechler
+ Payload Authors Dependencies
+ ------- ------- ------------
+ AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
+ AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
+ BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
+ BeanShell2 @killer bsh:2.0b1
+ BindingEnumeration
+ C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
+ C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
+ C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
+ C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
+ C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
+ C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
+ C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
+ C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
+ C3P0RefDataSource
+ C3P0WrapperConnPool
+ Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
+ Clojure @JackOfMostTrades clojure:1.8.0
+ CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
+ CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2
+ CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2
+ CommonsBeanutilsJNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1
+ CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
+ CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10
+ CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
+ CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2
+ Fastjson1
+ Fastjson2
+ FileUpload1
+ Groovy
+ Groovy1 @frohoff groovy:2.3.9
+ Groovy2 @Unam4 groovy <2.4.3
+ Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
+ Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
+ Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
+ ImageIO
+ JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+ JRE8u20 @frohoff
+ JRE8u20_2
+ JRMPClient @mbechler
+ JRMPClient_Activator @mbechler
+ JRMPClient_Obj @mbechler
+ JRMPListener @mbechler
JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
- Jackson1
- Jackson2
- Jackson3
- Jackson4
- JacksonLdapAttr
- JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
- JdbcRowSet
- Jdk7u21 @frohoff
- Jdk7u21variant @potats0
- Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
- LazySearchEnumeration
- MozillaRhino1 @matthias_kaiser js:1.7R2
- MozillaRhino2 @_tint0 js:1.7R2
- Myfaces1 @mbechler
- Myfaces2
- ROME @mbechler rome:1.0
- ROME2 rome:1.0
- ROME3 @Firebasky rome:1.0
- ROMEJDBC
- RenderedImage jai-codec-1.1.3
- Resin
- ServiceLoader
- SignedObject
- Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
- Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
- Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
- SpringAbstractBeanFactoryPointcutAdvisor
- SpringPartiallyComparableAdvisorHolder
- SpringPropertyPathFactory
- URLDNS @gebl
- Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
- Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
- Xbean
+ Jackson1
+ Jackson2
+ Jackson3 @jsjcw 6.2.10
+ Jackson4 @QI4L 6.2.10
+ JacksonLdapAttr
+ JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
+ JdbcRowSet
+ Jdk7u21 @frohoff
+ Jdk7u21variant @potats0
+ Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
+ LazySearchEnumeration
+ MozillaRhino1 @matthias_kaiser js:1.7R2
+ MozillaRhino2 @_tint0 js:1.7R2
+ Myfaces1 @mbechler
+ Myfaces2
+ ROME @mbechler rome:1.0
+ ROME2 rome:1.0
+ ROME3 @Firebasky rome:1.0
+ ROMEJDBC
+ RenderedImage jai-codec-1.1.3
+ Resin
+ ServiceLoader
+ SignedObject
+ Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
+ Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
+ Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
+ SpringAbstractBeanFactoryPointcutAdvisor
+ SpringPartiallyComparableAdvisorHolder
+ SpringPropertyPathFactory
+ URLDNS @gebl
+ UnixPrintService
+ UnixPrintServiceLookup
+ Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
+ Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
+ Xbean
+ cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X
+ cb160 commons-beanutils:1.6.0
+ cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
+ cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X
+ cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X
+ cc1 @frohoff commons-collections:3.1
+ cc10 commons-collections:3.2.1
+ cc11
+ cc12 @Jayl1n commons-collections:3.2.1
+ cc13 @Unam4 commons-collections:3.1
+ cc2 @frohoff commons-collections4:4.0
+ cc3 @frohoff commons-collections:3.1
+ cc4 @frohoff commons-collections4:4.0
+ cc4_17 @jiecub3
+ cc5 @matthias_kaiser, @jasinner commons-collections:3.1
+ cc6 @matthias_kaiser commons-collections:3.1
+ cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
+ cc8 @navalorenzo commons-collections4:4.0
+ cc9 @梅子酒 commons-collections:3.2.1
+ cck1 commons-collections:3.1
+ cck2 commons-collections:4.0
+ cck3 @matthias_kaiser commons-collections:3.1
+ cck4 @matthias_kaiser commons-collections:4.0
+ springFs
@@ -234,70 +236,7 @@ java -jar JYso-[version].jar -y -g cc3 -p LF-/tmp/evil.class -f cc3.ser
# URLDNS 探测目标类
-为了解决有反序列化利用点但是无链可用的状态，本项目提供了基于 URLDNS 探测目标类的功能。这条链会根据目标环境中不同的类是否存在来判断系统环境、依赖版本，主要包含如下表格中的内容：
-
-| DNSLOG 关键字 | 对应链 | 关键类 | 备注 |
-|---------------------------------------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------|
-| cc31or321
cc322 | CommonsCollections13567 | org.apache.commons.collections.functors.ChainedTransformer
org.apache.commons.collections.ExtendedProperties$1 | CommonsCollections1/3/5/6/7
需要<=3.2.1版本 |
-| cc40
cc41 | CommonsCollections24 | org.apache.commons.collections4.functors.ChainedTransformer
org.apache.commons.collections4.FluentIterable | CommonsCollections2/4链
需要4-4.0版本 |
-| cb17
cb18x
cb19x | CommonsBeanutils2 | org.apache.commons.beanutils.MappedPropertyDescriptor\$1
org.apache.commons.beanutils.DynaBeanMapDecorator\$MapEntry
org.apache.commons.beanutils.BeanIntrospectionData | 1.7x-1.8x为-3490850999041592962
1.9x为-2044202215314119608 |
-| c3p092x
c3p095x | C3P0 | com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase
com.mchange.v2.c3p0.test.AlwaysFailDataSource | 0.9.2pre2-0.9.5pre8为7387108436934414104
0.9.5pre9-0.9.5.5为7387108436934414104 |
-| ajw | AspectJWeaver | org.aspectj.weaver.tools.cache.SimpleCache | AspectJWeaver,需要cc31 |
-| bsh20b4
bsh20b5
bsh20b6 | bsh | bsh.CollectionManager\$1
bsh.engine.BshScriptEngine
bsh.collection.CollectionIterator\$1 | 2.0b4为4949939576606791809
2.0b5为4041428789013517368
2.0.b6无法反序列化 |
-| groovy1702311
groovy24x
groovy244 | Groovy | org.codehaus.groovy.reflection.ClassInfo\$ClassInfoSet
groovy.lang.Tuple2
org.codehaus.groovy.runtime.dgm\$1170 | 2.4.x为-8137949907733646644
2.3.x为1228988487386910280 |
-| becl | Becl | com.sun.org.apache.bcel.internal.util.ClassLoader | JDK<8u251 |
-| Jdk7u21 | Jdk7u21 | com.sun.corba.se.impl.orbutil.ORBClassLoader | JDK<=7u21 |
-| JRE8u20 | JRE8u20 | javax.swing.plaf.metal.MetalFileChooserUI\$DirectoryComboBoxModel\$1 | 7u25<=JDK<=8u20
这个检测不完美,8u25版本以及JDK<=7u21会误报
可综合Jdk7u21来看 |
-| linux
windows | winlinux | sun.awt.X11.AwtGraphicsConfigData
sun.awt.windows.WButtonPeer | windows/linux版本判断 |
-| jackson2100 | jackson | com.fasterxml.jackson.databind.node.NodeSerialization | |
-| ROME | ROME | com.sun.syndication.feed.impl.ToStringBean
com.rometools.rome.feed.impl.ObjectBean | |
-| SpringAOP | fastjon
jackson | org.springframework.aop.target.HotSwappableTargetSource.HotSwappableTargetSource | |
-| fastjson | fastjon | com.alibaba.fastjson.JSONArray | |
-| jdk17_22 | | jdk.internal.util.random.RandomSupport | |
-| jdk9_22 | | jdk.internal.misc.Unsafe | |
-| jdk6_8 | | sun.misc.BASE64Decoder | |
-| jdk6_11 | | com.sun.awt.SecurityWarning | |
-| jdk9_10 | | jdk.incubator.http.HttpClient | |
-| | all | | 全部检测 |
-| | jndiall | | |
-
-| jndiall 关键类 | 说明 |
-|------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
-| org.apache.naming.factory.BeanFactory | 最经典的ObjectFactory,有它+低版本tomcat意味着可以执行单String方法 |
-| org.apache.catalina.filters.
CsrfPreventionFilter$NonceCache | tomcat9.0.63/8.5.79高版本才有的类,有这个代表无法再用BeanFactory的forceString |
-| javax.el.ELProcessor | 和BeanFactory最经典的配合 |
-| org.yaml.snakeyaml.Yaml | 知名YAML序列化,可以跟BeanFactory配合 |
-| com.thoughtworks.xstream.XStream | 知名XML序列化,可以跟BeanFactory配合 |
-| org.mvel2.sh.ShellSession | mvel语法,可以跟BeanFactory配合 |
-| org.apache.tomcat.jdbc.naming.
GenericNamingResourcesFactory | 高版本tomcat和低版本tomcat没有forceString时的替代类,和BeanFactory一样只能调setter,但BeanFactory会检测setter所对应的属性 |
-| org.apache.commons.configuration.
SystemConfiguration | 配合GenericNamingResourcesFactory可以篡改jdk环境变量 |
-| org.apache.commons.configuration2.
SystemConfiguration | 配合GenericNamingResourcesFactory可以篡改jdk环境变量 |
-| org.apache.groovy.util.SystemUtil | groovy >= 3.0才有,配合GenericNamingResourcesFactory可以篡改jdk环境变量 |
-| org.apache.batik.swing.JSVGCanvas | 远程加载svg造成XSS,XXE,RCE |
-| org.apache.catalina.users.
MemoryUserDatabaseFactory | 配合UserDatabase可以XXE,写文件 |
-| org.apache.catalina.UserDatabase | 配合MemoryUserDatabaseFactory可以XXE,写文件 |
-| org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory | 以下均为DataSourceFactory,可以造成jdbc |
-| org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory | |
-| org.apache.commons.dbcp.BasicDataSourceFactory | |
-| org.apache.commons.dbcp2.BasicDataSourceFactory | |
-| org.apache.tomcat.jdbc.pool.DataSourceFactory | |
-| com.alibaba.druid.pool.DruidDataSourceFactory | |
-| com.zaxxer.hikari.HikariJNDIFactory | |
-| org.h2.Driver | h2 jdbc,可以RCE |
-| org.postgresql.Driver | postgresql,可以远程加载XML执行SPEL,可以写文件 |
-| org.springframework.context.support.
ClassPathXmlApplicationContext | postgresql RCE依赖spring环境 |
-| com.mysql.jdbc.Driver | mysql,可以二次反序列化,可以读文件,可以XXE |
-| com.mysql.cj.jdbc.Driver | |
-| com.mysql.fabric.jdbc.FabricMySQLDriver | |
-| oracle.jdbc.driver.OracleDriver | oracle,可以带出机器用户名 |
-| com.ibm.db2.jcc.DB2Driver | db2,可以写文件 |
-| COM.ibm.db2.jcc.DB2Driver | |
-| com.ibm.ws.webservices.engine.client.
ServiceFactory | WebSphere的ObjectFactory,可以远程加载jar,很少用到 |
-| com.ibm.ws.client.applicationclient.
ClientJ2CCFFactory | |
-| oracle.ucp.jdbc.PoolDataSourceImpl | 反序列化转getter(getConnection)转jdbc(h2)转所需要的DataSource中转类,weblogic依赖 |
-| org.hibernate.service.jdbc.connections.
internal.DriverManagerConnectionProviderImpl | hibernate-core-4.x,比较低版本才有的类 |
-
-本项目参考了 kezibei 师傅的 URLDNS 项目，实际情况可能有如下几种情况导致问题：
+为了解决有反序列化利用点但是无链可用的状态，本项目提供了基于 URLDNS 探测目标类的功能。这条链会根据目标环境中不同的类是否存在来判断系统环境、依赖版本：
- 反序列时遇到黑名单，可能导致后面的类的 dnslog 出不来；
- 反序列化流程中由于种种情况报错可能导致出不来。
@@ -305,7 +244,15 @@ java -jar JYso-[version].jar -y -g cc3 -p LF-/tmp/evil.class -f cc3.ser
因此这里还是提供了 all/common/指定类 三种探测方式：
- all：探测全部的类；
-- common：探测不常在黑名单中的 CommonsBeanutils2/C3P0/AspectJWeaver/bsh/winlinux；
+- os: 探测系统
+- cc: 探测cc链
+- cb: 探测cb链
+- db: 探测数据库Driver
+- jndiAttack: 探测JNDI可利用的类
+- datasource: 探测数据源工厂类, 适用于JNDI中BeanFactory无法使用的场景
+- jdk: 探测jdk版本以及jdk自带的链
+- web: 探测中间件
+- other: 探测其他
- 指定类：使用对应链中的关键字 cc4:xxxx.dns.log 。
示例：`all:xxx.dns.log`