Skip to content
This repository was archived by the owner on Jul 25, 2024. It is now read-only.

Commit ebcd603

Browse files
SummerSecSummerSec
committed
漏洞环境探测功能
1 parent d4d27fa commit ebcd603

16 files changed

Lines changed: 331 additions & 206 deletions

‎src/main/java/com/drops/exp/H2DatabaseConsoleJNDIRCEEXP.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@ public static boolean hasH2DatabaseConsoleJNDIRCE(String target,String vps, Stri
3232
}
3333
}
3434
}
35-
36-
3735
return false;
3836
}
3937
}

‎src/main/java/com/drops/exp/SnakeYAMLRCEEXP.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
package com.drops.exp;
2+
3+
/**
4+
* @ClassName: SnakeYAMLRCEEXP
5+
* @Description: TODO
6+
* @Author: Summer
7+
* @Date: 2021/8/2 16:40
8+
* @Version: v1.0.0
9+
* @Description:
10+
**/
11+
public class SnakeYAMLRCEEXP {
12+
}

‎src/main/java/com/drops/main/AttackService.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
package com.drops.main;
2+
3+
import com.drops.entity.ControllersFactory;
4+
import com.drops.ui.MainController;
5+
import com.drops.utils.Utils;
6+
7+
/**
8+
* @ClassName: AttackService
9+
* @Description: TODO
10+
* @Author: Summer
11+
* @Date: 2021/8/2 15:38
12+
* @Version: v1.0.0
13+
* @Description:
14+
**/
15+
public class AttackService {
16+
String target ;
17+
String time;
18+
MainController mainController ;
19+
20+
public AttackService(String targetAddressText, String httpTimeoutText) {
21+
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
22+
this.time = httpTimeoutText;
23+
this.target = targetAddressText;
24+
25+
}
26+
27+
public boolean gadgetSend(String target, String vps, String gadget, String echo){
28+
boolean flag = false;
29+
try {
30+
31+
}catch (Exception e){
32+
this.mainController.logTextArea.appendText(Utils.log(e.getMessage()));
33+
}
34+
35+
return false;
36+
}
37+
38+
39+
}

‎src/main/java/com/drops/main/Main.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ public static void main(String[] args) {
1616
public void start(Stage primaryStage) throws Exception {
1717

1818
Parent root = FXMLLoader.load(getClass().getResource("/a.fxml"));
19-
primaryStage.setTitle("Spring Boot Vul Exploit by Drops");
19+
primaryStage.setTitle("Spring Boot Vul Exploit by Drops Lab ");
2020
Scene scene = new Scene(root);
2121
primaryStage.setScene(scene);
2222
primaryStage.show();

‎src/main/java/com/drops/poc/EurekaXstreamRCEPOC.java‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
package com.drops.poc;
22

3+
import com.drops.entity.ControllersFactory;
4+
import com.drops.ui.MainController;
35
import com.drops.utils.HTTPUtils;
46
import com.drops.utils.ReUtil;
7+
import com.drops.utils.Utils;
58

69
/**
710
* @ClassName: EurekaXstream
@@ -13,33 +16,40 @@
1316
**/
1417
public class EurekaXstreamRCEPOC {
1518

19+
private final MainController mainController;
20+
21+
public EurekaXstreamRCEPOC() {
22+
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
23+
24+
}
25+
1626
/**
1727
* @param target
1828
* @Description: 判断是否存在spring-boot-starter-actuator
1929
* eureka-client < 1.8.7（通常包含在 spring-cloud-starter-netflix-eureka-client 依赖中）
2030
* @return:
2131
*/
22-
public static boolean hasEurekaXstreamRCE(String target) {
32+
public boolean hasEurekaXstreamRCE(String target) {
2333
String regex = "eureka-client([A-Za-z0-9.-]+).jar";
2434
String context = HTTPUtils.getRequest(target).body();
2535
String version = "eureka-client-1.8.7";
26-
System.out.println("正在验证是否存在依赖spring-boot-starter-actuator以及 eureka-client 版本 < 1.8.7！");
36+
this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖spring-boot-starter-actuator以及 eureka-client 版本 < 1.8.7！"));
2737
if (context.contains("spring-boot-starter-actuator")){
28-
System.out.println("存在依赖：spring-boot-starter-actuator");
38+
this.mainController.logTextArea.appendText(Utils.log("存在依赖：spring-boot-starter-actuator"));
2939
String result = ReUtil.hasVersion(context,regex);
3040
if (result != null){
3141
if (result.compareToIgnoreCase(version) >= 0){
32-
System.out.println("依赖版本不符合，版本为：" + result);
42+
this.mainController.logTextArea.appendText(Utils.log("依赖版本不符合，版本为：" + result));
3343
}else {
34-
System.out.println("依赖版本：" + result);
44+
this.mainController.logTextArea.appendText(Utils.log("依赖版本：" + result));
3545
return true;
3646
}
3747
}else {
38-
System.out.println("eureka-client 依赖不存在！");
48+
this.mainController.logTextArea.appendText(Utils.log("eureka-client 依赖不存在！"));
3949
}
4050

4151
}else{
42-
System.out.println("spring-boot-starter-actuator 依赖不存在！");
52+
this.mainController.logTextArea.appendText(Utils.log("spring-boot-starter-actuator 依赖不存在！"));
4353
return false;
4454
}
4555
return false;

‎src/main/java/com/drops/poc/JolokiaLogbackRCEPOC.java‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
package com.drops.poc;
22

3+
import com.drops.entity.ControllersFactory;
4+
import com.drops.ui.MainController;
35
import com.drops.utils.HTTPUtils;
6+
import com.drops.utils.Utils;
47

58
/**
69
* @ClassName: JolokiaLogbackRCEPOC
@@ -12,12 +15,20 @@
1215
**/
1316
public class JolokiaLogbackRCEPOC {
1417

15-
public static boolean hasJolokiaLogbackRCE(String target){
18+
19+
private final MainController mainController;
20+
21+
public JolokiaLogbackRCEPOC() {
22+
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
23+
24+
}
25+
26+
public boolean hasJolokiaLogbackRCE(String target){
1627
String regex = "jolokia-core";
1728
String context = HTTPUtils.getRequest(target).body();
18-
System.out.println("正在验证是否存在依赖jolokia-core");
29+
this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖jolokia-core"));
1930
if (context.contains(regex)){
20-
System.out.println("存在依赖jolokia-core");
31+
this.mainController.logTextArea.appendText(Utils.log("存在依赖jolokia-core"));
2132
return true;
2233
}
2334
return false;

src/main/java/com/drops/poc/poc.java renamed to src/main/java/com/drops/poc/POC.java

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
package com.drops.poc;
22

3+
import com.drops.utils.HTTPUtils;
4+
import com.drops.utils.URLUtil;
5+
36
import java.net.MalformedURLException;
47

58
/**
@@ -10,13 +13,11 @@
1013
* @Version: v1.0.0
1114
* @Description:
1215
**/
13-
public class poc {
16+
public class POC {
1417
public static void main(String[] args) {
15-
String url = "http://127.0.0.1:9093";
16-
try {
17-
SpringBootInfo.doCheck(url);
18-
} catch (MalformedURLException e) {
19-
e.printStackTrace();
20-
}
18+
String url = "http://127.0.0.1:9093/enc";
19+
System.out.println(URLUtil.normalizeURL(url));
20+
2121
}
22+
2223
}

‎src/main/java/com/drops/poc/SnakeYAMLRCEPOC.java‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
package com.drops.poc;
22

3+
import com.drops.entity.ControllersFactory;
4+
import com.drops.ui.MainController;
35
import com.drops.utils.HTTPUtils;
46
import com.drops.utils.ReUtil;
7+
import com.drops.utils.Utils;
58

69
/**
710
* @ClassName: SnakeYAMLRCE
@@ -13,6 +16,12 @@
1316
**/
1417
public class SnakeYAMLRCEPOC {
1518

19+
public final MainController mainController;
20+
21+
public SnakeYAMLRCEPOC() {
22+
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
23+
24+
}
1625

1726
/**
1827
* @Description: 判断是否存在依赖spring-boot-starter-actuator
@@ -21,27 +30,27 @@ public class SnakeYAMLRCEPOC {
2130
*
2231
* @return:
2332
*/
24-
public static boolean hasSnakeYAMLRCE(String target){
33+
public boolean hasSnakeYAMLRCE(String target){
2534
String regex = "spring-cloud-starter-([A-Za-z0-9.-]+).jar";
2635
String context = HTTPUtils.getRequest(target).body();
2736
String version = "spring-cloud-starter-1.3.0";
28-
System.out.println("正在验证是否存在依赖spring-boot-starter-actuator以及 spring-cloud-starter 版本 < 1.3.0！");
37+
this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖spring-boot-starter-actuator以及 spring-cloud-starter 版本 < 1.3.0！"));
2938
if (context.contains("spring-boot-starter-actuator")){
30-
System.out.println("存在依赖：spring-boot-starter-actuator");
39+
this.mainController.logTextArea.appendText(Utils.log("存在依赖：spring-boot-starter-actuator"));
3140
String result = ReUtil.hasVersion(context,regex);
3241
if (result != null){
3342
if (result.compareToIgnoreCase(version) >= 0){
34-
System.out.println("依赖版本不符合，版本为：" + result);
43+
this.mainController.logTextArea.appendText(Utils.log("依赖版本不符合，版本为：" + result));
3544
}else {
36-
System.out.println("依赖版本：" + result);
45+
this.mainController.logTextArea.appendText(Utils.log("依赖版本：" + result));
3746
return true;
3847
}
3948
}else {
40-
System.out.println("spring-cloud-starte 依赖不存在！");
49+
this.mainController.logTextArea.appendText(Utils.log("spring-cloud-starte 依赖不存在！"));
4150
}
4251

4352
}else{
44-
System.out.println("spring-boot-starter-actuator 依赖不存在！");
53+
this.mainController.logTextArea.appendText(Utils.log("spring-boot-starter-actuator 依赖不存在！"));
4554
return false;
4655
}
4756
return false;

‎src/main/java/com/drops/poc/SpringBootEnvInfo.java‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
package com.drops.poc;
22

3+
import com.drops.entity.ControllersFactory;
4+
import com.drops.ui.MainController;
35
import com.drops.utils.HTTPUtils;
46
import com.drops.utils.ReUtil;
7+
import com.drops.utils.Utils;
58

69
import java.util.HashMap;
710

@@ -15,29 +18,30 @@
1518
**/
1619
public class SpringBootEnvInfo {
1720
HashMap resultMap = new HashMap();
21+
MainController mainController ;
1822

19-
private static void EnvInfo(String target){
23+
public SpringBootEnvInfo(HashMap resultMap, MainController mainController) {
24+
this.resultMap = resultMap;
25+
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
26+
}
27+
28+
29+
private void EnvInfo(String target){
2030
String result = HTTPUtils.getRequest(target).body();
2131
if (result.contains("spring-boot-starter-actuator")){
22-
System.out.println("存在依赖：spring-boot-starter-actuator");
32+
this.mainController.logTextArea.appendText(Utils.log("存在依赖：spring-boot-starter-actuator"));
33+
// mainController.logTextArea.appendText(Utils.log());
2334
String re = ReUtil.hasVersion(result,result);
2435
if (!re.isEmpty()){
25-
System.out.println("存在依赖： " + re);
36+
this.mainController.logTextArea.appendText(Utils.log("存在依赖： " + re));
2637
}else {
2738

28-
2939
}
30-
31-
System.out.println(result);
40+
this.mainController.logTextArea.appendText(Utils.log(result));
3241
}
3342

3443
}
3544

36-
public static void main(String[] args) {
37-
String target = "http://127.0.0.1:9093/env";
38-
SnakeYAMLRCEPOC.hasSnakeYAMLRCE(target);
39-
EurekaXstreamRCEPOC.hasEurekaXstreamRCE(target);
40-
}
4145

4246

4347

0 commit comments

Comments
 (0)