Skip to content

Commit d8b6e7c

Browse files
whgojpwhgojp
committed
add dos module
1 parent 97ccb62 commit d8b6e7c

29 files changed

Lines changed: 643 additions & 222 deletions

File tree

‎pom.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,18 @@
289289
</plugins>
290290
</build>
291291
<repositories>
292+
<repository>
293+
<id>central</id>
294+
<url>https://repo.maven.apache.org/maven2</url>
295+
</repository>
296+
<repository>
297+
<id>spring-milestone</id>
298+
<url>https://repo.spring.io/milestone</url>
299+
</repository>
300+
<repository>
301+
<id>spring-release</id>
302+
<url>https://repo.spring.io/release</url>
303+
</repository>
292304
<repository>
293305
<id>acfunnexus</id>
294306
<url>https://maven.aliyun.com/repository/public/</url>

‎src/main/java/top/whgojp/Application.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
import org.springframework.boot.SpringApplication;
55
import org.springframework.boot.autoconfigure.SpringBootApplication;
66

7-
87
import java.io.IOException;
98

109

‎src/main/java/top/whgojp/common/config/WebConfig.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,12 @@
33
import lombok.SneakyThrows;
44
import lombok.extern.slf4j.Slf4j;
55
import org.springframework.beans.factory.annotation.Autowired;
6-
import org.springframework.context.annotation.ComponentScan;
76
import org.springframework.context.annotation.Configuration;
87
import org.springframework.web.servlet.config.annotation.*;
98
import top.whgojp.common.constant.SysConstant;
109

1110
/**
12-
* @description <功能描述>
11+
* @description 自定义静态资源的访问路径、文件映射
1312
* @author: whgojp
1413
* @email: whgojp@foxmail.com
1514
* @Date: 2024/5/23 18:58

‎src/main/java/top/whgojp/modules/components/jackson/controller/JacksonController.java‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -28,39 +28,37 @@ public String jackson() {
2828
return "vul/components/jackson";
2929
}
3030

31-
@PostMapping("/vul")
32-
@ResponseBody
33-
public String vulJackson(@RequestBody String content) {
31+
@RequestMapping("/vul")
32+
public String vul(@RequestBody String content) {
3433
try {
35-
return new ObjectMapper()
36-
.enableDefaultTyping()
37-
.writeValueAsString(
38-
new ObjectMapper().enableDefaultTyping().readValue(content, Object.class)
39-
);
34+
ObjectMapper mapper = new ObjectMapper();
35+
mapper.enableDefaultTyping(); // 启用多态类型处理
36+
37+
// 反序列化接收的JSON数据，触发漏洞
38+
Object obj = mapper.readValue(content, Object.class);
39+
return "[+]Jackson 反序列化: " + obj.toString();
4040
} catch (Exception e) {
41-
return "Jackson RCE Error";
41+
e.printStackTrace();
42+
return "[-]Jackson反序列化失败";
4243
}
4344
}
4445

4546

4647
@PostMapping("/safe")
4748
@ResponseBody
48-
public String safeJackson(@RequestBody String content) {
49+
public String safeJackson(@RequestBody String payload) {
4950
try {
50-
// 使用安全的 ObjectMapper 配置
5151
ObjectMapper mapper = new ObjectMapper();
52-
// 禁用潜在的危险功能
53-
mapper.disableDefaultTyping();
54-
// 安全配置：只允许反序列化指定类型（如自定义的类或简单数据类型）
52+
53+
// 启用安全的类型验证
5554
mapper.activateDefaultTyping(
5655
LaissezFaireSubTypeValidator.instance,
5756
ObjectMapper.DefaultTyping.NON_FINAL
5857
);
59-
// 示例：仅允许特定的受信任类反序列化（可以根据需求自定义）
6058
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);
6159

62-
// 将 JSON 字符串安全地反序列化为指定的 POJO 类型
63-
Map<String, Object> safePayload = mapper.readValue(content, new TypeReference<Map<String, Object>>() {});
60+
// 反序列化传入的JSON数据
61+
Map<String, Object> safePayload = mapper.readValue(payload, Map.class);
6462
return mapper.writeValueAsString(safePayload);
6563
} catch (Exception e) {
6664
e.printStackTrace();
@@ -69,7 +67,6 @@ public String safeJackson(@RequestBody String content) {
6967
}
7068

7169

72-
7370
/**
7471
* CVE-2020-35728
7572
* com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool组件库存在不安全的反序列化

‎src/main/java/top/whgojp/modules/deserialize/readobject/controller/ReadObjectController.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ public String readObject(){
3030
return "vul/deserialize/readObject";
3131
}
3232

33-
@RequestMapping("/vulReadObject")
33+
@RequestMapping("/vul")
3434
@ResponseBody
35-
public R vulReadObject(String payload) {
35+
public R vul(String payload) {
3636
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
3737
log.info("Java反序列化："+payload);
3838
try {
@@ -47,9 +47,9 @@ public R vulReadObject(String payload) {
4747
return R.error("[-]请输入正确的Payload！\n"+e.getMessage());
4848
}
4949
}
50-
@RequestMapping("/safeReadObject1")
50+
@RequestMapping("/safe1")
5151
@ResponseBody
52-
public R safeReadObject1(String payload) {
52+
public R safe1(String payload) {
5353
// 安全措施：禁用不安全的反序列化
5454
System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "false");
5555
log.info("Java反序列化："+payload);
@@ -65,9 +65,9 @@ public R safeReadObject1(String payload) {
6565
return R.error("[-]请输入正确的Payload！\n"+e.getMessage());
6666
}
6767
}
68-
@RequestMapping("/safeReadObject2")
68+
@RequestMapping("/safe2")
6969
@ResponseBody
70-
public R safeReadObject2(String payload) {
70+
public R safe2(String payload) {
7171
log.info("Java反序列化："+payload);
7272
try {
7373
payload = payload.replace(" ", "+");

‎src/main/java/top/whgojp/modules/deserialize/snakeyaml/controller/controller/SnakeYamlController.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,21 @@ public String snakeYaml(){
2929
return "vul/deserialize/snakeYaml";
3030
}
3131

32-
@RequestMapping("/vulSnakeYaml")
32+
@RequestMapping("/vul")
3333
@ResponseBody
34-
public R vulSnakeYaml(String payload) {
34+
public R vul(String payload) {
3535
Yaml y = new Yaml();
3636
y.load(payload);
3737
return R.ok("[+]Java反序列化：SnakeYaml原生漏洞");
3838
}
3939

40-
@PostMapping("/safeSnakeYaml")
41-
public R safeSnakeYaml(String payload) {
40+
@PostMapping("/safe")
41+
@ResponseBody
42+
public R safe(String payload) {
4243
try {
4344
Yaml y = new Yaml(new SafeConstructor());
4445
y.load(payload);
45-
return R.ok("[-]Java反序列化：SnakeYaml安全构造");
46+
return R.ok("[+]Java反序列化：SnakeYaml安全构造");
4647
} catch (Exception e) {
4748
return R.error("[-]Java反序列化：SnakeYaml反序列化失败");
4849
}

‎src/main/java/top/whgojp/modules/deserialize/xmldecoder/controller/XMLDecoderController.java‎

Lines changed: 84 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,22 @@
11
package top.whgojp.modules.deserialize.xmldecoder.controller;
22

33
import io.swagger.annotations.Api;
4-
import io.swagger.annotations.ApiOperation;
4+
55
import lombok.extern.slf4j.Slf4j;
66
import org.springframework.stereotype.Controller;
7-
import org.springframework.ui.Model;
8-
import org.springframework.web.bind.annotation.CrossOrigin;
9-
import org.springframework.web.bind.annotation.GetMapping;
10-
import org.springframework.web.bind.annotation.RequestMapping;
11-
import org.springframework.web.bind.annotation.ResponseBody;
7+
import org.springframework.web.bind.annotation.*;
128
import top.whgojp.common.utils.R;
139

14-
import java.beans.XMLDecoder;
15-
import java.beans.XMLEncoder;
16-
import java.io.*;
10+
import javax.xml.parsers.SAXParser;
11+
import javax.xml.parsers.SAXParserFactory;
12+
import java.io.ByteArrayInputStream;
1713
import java.nio.charset.StandardCharsets;
18-
import java.util.HashMap;
14+
import java.util.ArrayList;
15+
import java.util.List;
16+
import org.xml.sax.InputSource;
17+
import org.xml.sax.Attributes;
18+
import org.xml.sax.SAXException;
19+
import org.xml.sax.helpers.DefaultHandler;
1920

2021
/**
2122
* @description 反序列化 - XMLDecoder
@@ -34,9 +35,9 @@ public String xmlDecoder() {
3435
return "vul/deserialize/xmlDecoder";
3536
}
3637

37-
@RequestMapping("/vulXmlDecoder")
38+
@RequestMapping("/vul")
3839
@ResponseBody
39-
public R vulXmlDecoder(String payload) {
40+
public R vul(String payload) {
4041
String[] strCmd = payload.split(" ");
4142
StringBuilder xml = new StringBuilder()
4243
.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>")
@@ -51,11 +52,80 @@ public R vulXmlDecoder(String payload) {
5152
try {
5253
new java.beans.XMLDecoder(new ByteArrayInputStream(xml.toString().getBytes(StandardCharsets.UTF_8)))
5354
.readObject().toString();
54-
return R.ok("命令执行成功");
55+
return R.ok("[+]命令执行成功");
5556
} catch (Exception e) {
56-
return R.error("命令执行失败: " + e.getMessage());
57+
return R.error("[-]命令执行失败: " + e.getMessage());
5758
}
5859
}
5960

6061

62+
@RequestMapping("/safe")
63+
@ResponseBody
64+
public R safe(@RequestParam String payload) {
65+
try {
66+
// 构建 XML 字符串
67+
StringBuilder xml = new StringBuilder()
68+
.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>")
69+
.append("<java version=\"1.8.0_151\" class=\"java.beans.XMLDecoder\">")
70+
.append("<object class=\"java.lang.ProcessBuilder\">")
71+
.append("<array class=\"java.lang.String\" length=\"").append(payload.split(" ").length).append("\">");
72+
73+
for (int i = 0; i < payload.split(" ").length; i++) {
74+
xml.append("<void index=\"").append(i).append("\"><string>")
75+
.append(payload.split(" ")[i]).append("</string></void>");
76+
}
77+
78+
xml.append("</array><void method=\"start\" /></object></java>");
79+
80+
// 使用 SAX 解析器解析 XML
81+
SAXParserFactory factory = SAXParserFactory.newInstance();
82+
SAXParser saxParser = factory.newSAXParser();
83+
CommandHandler handler = new CommandHandler();
84+
85+
// 将 ByteArrayInputStream 包装成 InputSource
86+
InputSource inputSource = new InputSource(new ByteArrayInputStream(xml.toString().getBytes(StandardCharsets.UTF_8)));
87+
saxParser.parse(inputSource, handler);
88+
89+
// 获取解析后的命令参数
90+
List<String> args = handler.getArgs();
91+
92+
// 处理解析后的命令参数
93+
System.out.println("Parsed command: " + String.join(" ", args));
94+
95+
return R.ok("[+]命令解析成功:"+String.join(" ", args));
96+
} catch (Exception e) {
97+
return R.error("[-]命令解析失败: " + e.getMessage());
98+
}
99+
}
100+
101+
// SAX 处理器
102+
static class CommandHandler extends DefaultHandler {
103+
private List<String> args = new ArrayList<>();
104+
private boolean inString = false;
105+
106+
@Override
107+
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
108+
if ("string".equals(qName)) {
109+
inString = true;
110+
}
111+
}
112+
113+
@Override
114+
public void characters(char[] ch, int start, int length) throws SAXException {
115+
if (inString) {
116+
args.add(new String(ch, start, length));
117+
}
118+
}
119+
120+
@Override
121+
public void endElement(String uri, String localName, String qName) throws SAXException {
122+
if ("string".equals(qName)) {
123+
inString = false;
124+
}
125+
}
126+
127+
public List<String> getArgs() {
128+
return args;
129+
}
130+
}
61131
}

‎src/main/java/top/whgojp/modules/other/controller/DosController.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
package top.whgojp.modules.other.controller;
2+
3+
import cn.hutool.captcha.CaptchaUtil;
4+
import cn.hutool.captcha.ShearCaptcha;
5+
import io.swagger.annotations.Api;
6+
import io.swagger.annotations.ApiOperation;
7+
import lombok.extern.slf4j.Slf4j;
8+
import org.springframework.stereotype.Controller;
9+
import org.springframework.web.bind.annotation.CrossOrigin;
10+
import org.springframework.web.bind.annotation.RequestMapping;
11+
import org.springframework.web.bind.annotation.RequestParam;
12+
13+
import javax.imageio.ImageIO;
14+
import javax.servlet.http.HttpServletResponse;
15+
import java.awt.*;
16+
import java.awt.image.BufferedImage;
17+
import java.io.ByteArrayOutputStream;
18+
import java.io.IOException;
19+
20+
/**
21+
* @description 其他漏洞-Dos攻击
22+
* @author: whgojp
23+
* @email: whgojp@foxmail.com
24+
* @Date: 2024/10/28 23:04
25+
*/
26+
@Slf4j
27+
@Api(value = "DosController", tags = "其他漏洞-Dos攻击")
28+
@Controller
29+
@CrossOrigin(origins = "*")
30+
@RequestMapping("/other/dos")
31+
public class DosController {
32+
@RequestMapping("")
33+
public String dos() {
34+
return "vul/other/dos";
35+
}
36+
37+
@RequestMapping("/vul")
38+
public void vul(@RequestParam Integer width, @RequestParam Integer height, HttpServletResponse response) throws IOException {
39+
response.setContentType("image/jpeg");
40+
response.setHeader("Pragma", "no-cache");
41+
response.setHeader("Cache-Control", "no-cache");
42+
// 验证码参数可控 造成拒绝服务攻击
43+
ShearCaptcha shearCaptcha = CaptchaUtil.createShearCaptcha(width, height,4,3);
44+
try {
45+
shearCaptcha.write(response.getOutputStream());
46+
} catch (IOException e) {
47+
throw new RuntimeException(e);
48+
}
49+
}
50+
@RequestMapping("/vul2")
51+
public String vul2() {
52+
53+
return "";
54+
}
55+
56+
}

‎src/main/java/top/whgojp/modules/spel/controller/SPELController.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ public String spel() {
3636
@ResponseBody
3737
@ApiImplicitParam(name = "ex", value = "表达式", dataType = "String", paramType = "query", dataTypeClass = String.class)
3838
@GetMapping("/vul-raw")
39-
public R spelVul(@ApiParam(name = "ex", value = "表达式", required = true) @RequestParam String ex) {
39+
public R vul(@ApiParam(name = "ex", value = "表达式", required = true) @RequestParam String ex) {
4040
// 创建SpEL解析器，ExpressionParser接口用于表示解析器，SpelExpressionParser为默认实现
4141
ExpressionParser parser = new SpelExpressionParser();
4242
// Expression expression = parser.parseExpression(ex);
@@ -47,20 +47,20 @@ public R spelVul(@ApiParam(name = "ex", value = "表达式", required = true) @R
4747
Expression exp = parser.parseExpression(ex);
4848
// 通过上下文计算表达式的值，并将结果转换为字符串
4949
String result = exp.getValue(evaluationContext).toString();
50-
log.info("[漏洞代码]SPEL表达式注入："+ex);
50+
log.info("[+]SPEL表达式注入："+ex);
5151
return R.ok(result);
5252
}
5353

5454
@ResponseBody
5555
@ApiImplicitParam(name = "ex", value = "表达式", dataType = "String", paramType = "query", dataTypeClass = String.class)
5656
@GetMapping("/safe")
57-
public R spelSafe(@ApiParam(name = "ex", value = "表达式", required = true) @RequestParam String ex) {
57+
public R safe(@ApiParam(name = "ex", value = "表达式", required = true) @RequestParam String ex) {
5858
// 使用 SimpleEvaluationContext 限制表达式功能(Java类型引用、构造函数调用、Bean引用)，防止危险的操作
5959
ExpressionParser parser = new SpelExpressionParser();
6060
EvaluationContext simpleContext = SimpleEvaluationContext.forReadOnlyDataBinding().build();
6161
Expression exp = parser.parseExpression(ex);
6262
String result = exp.getValue(simpleContext).toString();
63-
log.info("[安全代码]SPEL表达式注入："+ex);
63+
log.info("[-]SPEL表达式注入："+ex);
6464
return R.ok(result);
6565
}
6666

0 commit comments

Comments
 (0)