Skip to content

Commit 5b19bcc

Browse files
committed
rm bin
1 parent 68d4dee commit 5b19bcc

File tree

3 files changed

+10
-15
lines changed

3 files changed

+10
-15
lines changed

README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ For example, this is a Fastjson vul-poc:
1616

1717
We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit-Plus to test vulnerability.
1818

19-
What's more, you can also use JNDI-Injection-Exploit-Plus to **generate binary/base64/hex type of payloads** like [ysoserial](https://github.com/frohoff/ysoserial)
19+
What's more, you can also use JNDI-Injection-Exploit-Plus to **generate base64/hex type of payloads** like [ysoserial](https://github.com/frohoff/ysoserial)
2020

2121
## More than [JNDI-Injection-Exploit](https://github.com/welk1n/JNDI-Injection-Exploit)
2222

@@ -110,7 +110,7 @@ WildFly1 :arrow_up: |@hugow |org.wildfly:wildfly
110110

111111
Like [ysoserial](https://github.com/frohoff/ysoserial).
112112

113-
You can generate the deserialization payloads with Binary, Base64 or HEX type of output
113+
You can generate the deserialization payloads with Base64 or HEX type of output
114114

115115
#### 5. Wrapper
116116

@@ -183,7 +183,7 @@ Points for attention:
183183
Run as
184184

185185
```shell
186-
$ java -jar JNDI-Injection-Exploit-Plus-2.0-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64/hex]
186+
$ java -jar JNDI-Injection-Exploit-Plus-2.0-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
187187
```
188188

189189
where:
@@ -192,7 +192,7 @@ where:
192192
(optional , default command is "open /Applications/Calculator.app")
193193

194194
- **-D** - The deserial Gadget payload name.
195-
- **-O** - (Optional) The deserial output type, default is binary
195+
- **-O** - (Optional) The deserial output type, default is base64
196196

197197
## Deserialization Exploits
198198

README_zh.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ class Test{
6464
#### 使用方法
6565

6666
```
67-
$ java -jar JNDI-Injection-Exploit-Plus-2.0-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [bin/base64]
67+
$ java -jar JNDI-Injection-Exploit-Plus-2.0-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
6868
```
6969

7070
#### 参数说明
@@ -76,7 +76,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.0-SNAPSHOT-all.jar [-C] [command] [-D]
7676
7777
-D - 要生成的反序列化链名字,见Github列表.
7878
79-
-O - (可选) 输出格式,base64或二进制, 默认是二进制
79+
-O - (可选) 输出格式,base64或16进制, 默认是16进制
8080
```
8181

8282
#### 示例

src/main/java/run/ServerStart.java

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public static void main(String[] args) throws Exception{
4949
String[] cmdArray = {"open","/Applications/Calculator.app"};
5050
String deserial = "";
5151
String wrapper = null;
52-
String deserialOutput = "bin";
52+
String deserialOutput = "base64";
5353

5454

5555
try{
@@ -78,8 +78,8 @@ public static void main(String[] args) throws Exception{
7878
}
7979
if (cmd.hasOption("O")) {
8080
deserialOutput = cmd.getOptionValue('O');
81-
if(!(deserialOutput.equals("bin") || deserialOutput.equals("base64") || deserialOutput.equals("hex"))){
82-
System.out.println("Error in param -O, you can only select bin / base64 / hex");
81+
if(!(deserialOutput.equals("base64") || deserialOutput.equals("hex"))){
82+
System.out.println("Error in param -O, you can only select base64 / hex");
8383
return;
8484
}
8585
}
@@ -112,12 +112,7 @@ public static void main(String[] args) throws Exception{
112112
printDeserialUsage();
113113
return;
114114
}
115-
if (deserialOutput.equals("bin")) {
116-
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
117-
byteArrayOutputStream.write(deserialBytes);
118-
new PrintStream(System.out).print(byteArrayOutputStream);
119-
}
120-
else if (deserialOutput.equals("base64")){
115+
if (deserialOutput.equals("base64")){
121116
System.out.print(Base64.getEncoder().encodeToString(deserialBytes));
122117
}
123118
else if (deserialOutput.equals("hex")){

0 commit comments

Comments
 (0)