qi4L / JYso

JNDIExploit or a ysoserial.
GNU General Public License v3.0
1.56k stars 188 forks source link

latest 1.2.9 Error while generating or serializing payload #40

Closed passwa11 closed 6 months ago

passwa11 commented 6 months ago
➜  JYso java -version                                                                         
openjdk version "11.0.22" 2024-01-16

➜  JYso java -jar JYso-1.2.9.jar -y -g CommonsBeanutils5 -p 'EX-TomcatEcho' -ch 'cmd' -utf|hex
Error while generating or serializing payload
java.lang.NullPointerException
        at java.base/java.lang.String.<init>(String.java:614)
        at com.qi4l.jndi.gadgets.utils.Utils.base64Decode(Utils.java:63)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertCMD(ClassMethodHandler.java:220)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertKeyMethodByClassName(ClassMethodHandler.java:40)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:105)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:64)
        at com.qi4l.jndi.gadgets.utils.Gadgets.createTemplatesImpl(Gadgets.java:96)
        at com.qi4l.jndi.gadgets.CommonsBeanutils5.getObject(CommonsBeanutils5.java:22)
        at com.qi4l.jndi.controllers.ysoserial.ysoserial(ysoserial.java:134)
        at com.qi4l.jndi.Starter.main(Starter.java:29)
passwa11 commented 6 months ago
➜  JYso java -jar JYso-1.2.9.jar -y -g CommonsBeanutils4 -p 'EX-TomcatEcho'
Error while generating or serializing payload
java.lang.Exception: Command format is: [rmi|ldap]://host:port/obj
        at com.qi4l.jndi.gadgets.CommonsBeanutils4.getObject(CommonsBeanutils4.java:18)
        at com.qi4l.jndi.controllers.ysoserial.ysoserial(ysoserial.java:134)
        at com.qi4l.jndi.Starter.main(Starter.java:29)
➜  JYso java -jar JYso-1.2.9.jar -y -g CommonsBeanutils2 -p 'EX-TomcatEcho'
Error while generating or serializing payload
java.lang.NullPointerException
        at java.base/java.lang.String.<init>(String.java:614)
        at com.qi4l.jndi.gadgets.utils.Utils.base64Decode(Utils.java:63)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertCMD(ClassMethodHandler.java:220)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertKeyMethodByClassName(ClassMethodHandler.java:40)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:105)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:64)
        at com.qi4l.jndi.gadgets.utils.Gadgets.createTemplatesImpl(Gadgets.java:96)
        at com.qi4l.jndi.gadgets.CommonsBeanutils2.getObject(CommonsBeanutils2.java:29)
        at com.qi4l.jndi.controllers.ysoserial.ysoserial(ysoserial.java:134)
        at com.qi4l.jndi.Starter.main(Starter.java:29)
➜  JYso java -jar JYso-1.2.9.jar -y -g CommonsBeanutils1 -p 'EX-TomcatEcho'
Error while generating or serializing payload
java.lang.NullPointerException
        at java.base/java.lang.String.<init>(String.java:614)
        at com.qi4l.jndi.gadgets.utils.Utils.base64Decode(Utils.java:63)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertCMD(ClassMethodHandler.java:220)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertKeyMethodByClassName(ClassMethodHandler.java:40)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:105)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:64)
        at com.qi4l.jndi.gadgets.utils.Gadgets.createTemplatesImpl(Gadgets.java:96)
        at com.qi4l.jndi.gadgets.CommonsBeanutils1.getObject(CommonsBeanutils1.java:17)
        at com.qi4l.jndi.controllers.ysoserial.ysoserial(ysoserial.java:134)
        at com.qi4l.jndi.Starter.main(Starter.java:29)
➜  JYso java -jar JYso-1.2.9.jar -y -g CommonsCollections10 -p 'EX-TomcatEcho'
Error while generating or serializing payload
java.lang.NullPointerException
        at java.base/java.lang.String.<init>(String.java:614)
        at com.qi4l.jndi.gadgets.utils.Utils.base64Decode(Utils.java:63)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertCMD(ClassMethodHandler.java:220)
        at com.qi4l.jndi.gadgets.utils.handle.ClassMethodHandler.insertKeyMethodByClassName(ClassMethodHandler.java:40)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:105)
        at com.qi4l.jndi.gadgets.utils.handle.GlassHandler.generateClass(GlassHandler.java:64)
        at com.qi4l.jndi.gadgets.utils.Gadgets.createTemplatesImpl(Gadgets.java:96)
        at com.qi4l.jndi.gadgets.CommonsCollections10.getObject(CommonsCollections10.java:24)
        at com.qi4l.jndi.controllers.ysoserial.ysoserial(ysoserial.java:134)
        at com.qi4l.jndi.Starter.main(Starter.java:29)

maybe change pro to maven will easy add an action yaml to auto test every release will be a well way to aviod this error ?

qi4L commented 6 months ago

image I haven't encountered any issues when using it locally. Please ensure that your JDK version is 1.8.

passwa11 commented 6 months ago

wow! dude I can run it with Java 8! I thought it would take some time to get your response, but I didn't expect it to be so quick. Thank you for your answer. Does it mean the project doesn't support Java 11?

qi4L commented 6 months ago

In order to adapt to more extreme environments, I have lowered the compilation level to 1.6, but I'm not sure about the exceptions that may occur with JDK versions other than 1.6 and 1.8.

passwa11 commented 6 months ago

tha't all. thanks your work!