Skip to content

Commit 46657b5

Browse files
j3ers3j3ers3
committed
🍺 Java Sec
1 parent 9dab4f6 commit 46657b5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+3240
-1023
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ FROM java:8
22

33
VOLUME /tmp
44

5-
ADD hello-1.0.0-SNAPSHOT.jar app.jar
5+
ADD javasec.jar app.jar
66

77
EXPOSE 8888
88

‎README.md‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# ☕️ Hello Java Sec ![Stage](https://img.shields.io/badge/Release-DEV-brightgreen.svg)
2-
> Java漏洞平台，结合漏洞代码和安全编码，帮助研发同学理解和减少漏洞
2+
> Java漏洞平台，结合漏洞代码和安全编码，帮助研发同学理解和减少漏洞，代码仅供参考
33
44
![](media/16304933749187.jpg)
55

@@ -22,7 +22,10 @@
2222
- [x] Actuator
2323
- [x] Fastjson
2424
- [x] Xstream
25-
- [ ] 越权
25+
- [x] Log4shell
26+
- [x] JNDI
27+
- [x] 越权
28+
- [x] Dos
2629
- [ ] more
2730

2831
![](media/16304936834843.jpg)
@@ -44,6 +47,10 @@ mvn clean package -DskipTests
4447
java -jar target/hello-1.0.0-SNAPSHOT.jar
4548
```
4649

50+
### Docker
51+
```
52+
bash deploy.sh
53+
```
4754

4855
## 技术架构
4956
- Java 1.8

‎deploy.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
docker build -t javasec . && docker run -d -p 80:8888 -v /opt/javasec/logs:/logs javasec

‎hello.iml‎

Lines changed: 35 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-to-slf4j:2.13.3" level="project" />
3434
<orderEntry type="library" name="Maven: org.slf4j:jul-to-slf4j:1.7.30" level="project" />
3535
<orderEntry type="library" name="Maven: jakarta.annotation:jakarta.annotation-api:1.3.5" level="project" />
36-
<orderEntry type="library" name="Maven: org.yaml:snakeyaml:1.27" level="project" />
3736
<orderEntry type="library" name="Maven: com.zaxxer:HikariCP:3.4.5" level="project" />
3837
<orderEntry type="library" name="Maven: org.springframework:spring-jdbc:5.3.2" level="project" />
3938
<orderEntry type="library" name="Maven: org.springframework:spring-beans:5.3.2" level="project" />
@@ -94,7 +93,6 @@
9493
<orderEntry type="library" name="Maven: org.springframework:spring-web:5.3.2" level="project" />
9594
<orderEntry type="library" name="Maven: org.springframework:spring-webmvc:5.3.2" level="project" />
9695
<orderEntry type="library" name="Maven: org.springframework:spring-aop:5.3.2" level="project" />
97-
<orderEntry type="library" name="Maven: org.springframework:spring-context:5.3.2" level="project" />
9896
<orderEntry type="library" name="Maven: org.springframework:spring-expression:5.3.2" level="project" />
9997
<orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.24" level="project" />
10098
<orderEntry type="library" name="Maven: com.thoughtworks.xstream:xstream:1.4.10" level="project" />
@@ -111,8 +109,6 @@
111109
<orderEntry type="library" scope="RUNTIME" name="Maven: org.latencyutils:LatencyUtils:2.0.3" level="project" />
112110
<orderEntry type="library" name="Maven: org.jolokia:jolokia-core:1.4.0" level="project" />
113111
<orderEntry type="library" name="Maven: com.googlecode.json-simple:json-simple:1.1.1" level="project" />
114-
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.13.3" level="project" />
115-
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.13.3" level="project" />
116112
<orderEntry type="library" name="Maven: org.codehaus.groovy:groovy:2.5.14" level="project" />
117113
<orderEntry type="library" name="Maven: org.codehaus.groovy:groovy-ant:2.5.14" level="project" />
118114
<orderEntry type="library" name="Maven: org.apache.ant:ant:1.9.15" level="project" />
@@ -174,10 +170,44 @@
174170
<orderEntry type="library" name="Maven: commons-io:commons-io:2.11.0" level="project" />
175171
<orderEntry type="library" name="Maven: org.apache.shiro:shiro-spring:1.2.4" level="project" />
176172
<orderEntry type="library" name="Maven: org.apache.shiro:shiro-core:1.2.4" level="project" />
177-
<orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.8.3" level="project" />
178173
<orderEntry type="library" name="Maven: org.apache.shiro:shiro-web:1.2.4" level="project" />
179174
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-databind:2.11.0" level="project" />
180175
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.11.0" level="project" />
181176
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.11.0" level="project" />
177+
<orderEntry type="library" name="Maven: org.yaml:snakeyaml:1.17" level="project" />
178+
<orderEntry type="library" name="Maven: org.owasp.esapi:esapi:2.2.0.0" level="project" />
179+
<orderEntry type="library" name="Maven: com.io7m.xom:xom:1.2.10" level="project" />
180+
<orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.3" level="project" />
181+
<orderEntry type="library" name="Maven: commons-logging:commons-logging:1.2" level="project" />
182+
<orderEntry type="library" name="Maven: commons-configuration:commons-configuration:1.10" level="project" />
183+
<orderEntry type="library" name="Maven: commons-fileupload:commons-fileupload:1.3.3" level="project" />
184+
<orderEntry type="library" name="Maven: log4j:log4j:1.2.17" level="project" />
185+
<orderEntry type="library" name="Maven: org.apache.commons:commons-collections4:4.2" level="project" />
186+
<orderEntry type="library" name="Maven: org.apache-extras.beanshell:bsh:2.0b6" level="project" />
187+
<orderEntry type="library" name="Maven: org.owasp.antisamy:antisamy:1.5.8" level="project" />
188+
<orderEntry type="library" name="Maven: net.sourceforge.nekohtml:nekohtml:1.9.22" level="project" />
189+
<orderEntry type="library" name="Maven: org.apache.httpcomponents:httpclient:4.5.13" level="project" />
190+
<orderEntry type="library" name="Maven: org.apache.httpcomponents:httpcore:4.4.14" level="project" />
191+
<orderEntry type="library" name="Maven: commons-codec:commons-codec:1.15" level="project" />
192+
<orderEntry type="library" name="Maven: org.apache.xmlgraphics:batik-css:1.11" level="project" />
193+
<orderEntry type="library" name="Maven: org.apache.xmlgraphics:batik-util:1.11" level="project" />
194+
<orderEntry type="library" name="Maven: org.apache.xmlgraphics:batik-constants:1.11" level="project" />
195+
<orderEntry type="library" name="Maven: org.apache.xmlgraphics:batik-i18n:1.11" level="project" />
196+
<orderEntry type="library" name="Maven: org.apache.xmlgraphics:xmlgraphics-commons:2.3" level="project" />
197+
<orderEntry type="library" name="Maven: xml-apis:xml-apis-ext:1.3.04" level="project" />
198+
<orderEntry type="library" name="Maven: xalan:xalan:2.7.2" level="project" />
199+
<orderEntry type="library" name="Maven: xalan:serializer:2.7.2" level="project" />
200+
<orderEntry type="library" name="Maven: xerces:xercesImpl:2.12.0" level="project" />
201+
<orderEntry type="library" name="Maven: xml-apis:xml-apis:1.4.01" level="project" />
202+
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.8.2" level="project" />
203+
<orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.8.2" level="project" />
204+
<orderEntry type="library" name="Maven: org.projectlombok:lombok:1.18.22" level="project" />
205+
<orderEntry type="library" name="Maven: org.apache.dubbo:dubbo:2.7.3" level="project" />
206+
<orderEntry type="library" name="Maven: org.springframework:spring-context:5.3.2" level="project" />
207+
<orderEntry type="library" name="Maven: org.javassist:javassist:3.20.0-GA" level="project" />
208+
<orderEntry type="library" name="Maven: io.netty:netty-all:4.1.55.Final" level="project" />
209+
<orderEntry type="library" name="Maven: com.google.code.gson:gson:2.8.6" level="project" />
210+
<orderEntry type="library" name="Maven: com.google.re2j:re2j:1.6" level="project" />
211+
<orderEntry type="library" name="Maven: com.github.whvcse:easy-captcha:1.6.2" level="project" />
182212
</component>
183213
</module>

‎pom.xml‎

Lines changed: 94 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@
1010
</parent>
1111

1212
<groupId>com.best</groupId>
13-
<artifactId>hello</artifactId>
14-
<version>1.0.2</version>
13+
<artifactId>javasec</artifactId>
14+
<version>1.7</version>
1515
<name>hello java sec</name>
1616
<description>Java Sec</description>
1717
<packaging>jar</packaging>
@@ -46,14 +46,14 @@
4646
<version>2.1.4</version>
4747
</dependency>
4848

49-
<!-- mysql -->
49+
<!-- mysql驱动 -->
5050
<dependency>
5151
<groupId>mysql</groupId>
5252
<artifactId>mysql-connector-java</artifactId>
5353
<scope>runtime</scope>
5454
</dependency>
5555

56-
<!-- spring boot-->
56+
<!-- spring boot Junit-->
5757
<dependency>
5858
<groupId>org.springframework.boot</groupId>
5959
<artifactId>spring-boot-starter-test</artifactId>
@@ -65,14 +65,14 @@
6565
<artifactId>spring-boot-starter-web</artifactId>
6666
</dependency>
6767

68-
<!-- 处理json数据, Fastjson 1.2.24存在rce漏洞 -->
68+
<!-- Fastjson 1.2.24存在rce漏洞 -->
6969
<dependency>
7070
<groupId>com.alibaba</groupId>
7171
<artifactId>fastjson</artifactId>
7272
<version>1.2.24</version>
7373
</dependency>
7474

75-
<!-- 多个rce漏洞-->
75+
<!-- xstream多个rce -->
7676
<dependency>
7777
<groupId>com.thoughtworks.xstream</groupId>
7878
<artifactId>xstream</artifactId>
@@ -98,11 +98,6 @@
9898
<version>1.4.0</version>
9999
</dependency>
100100

101-
<dependency>
102-
<groupId>org.apache.logging.log4j</groupId>
103-
<artifactId>log4j-core</artifactId>
104-
</dependency>
105-
106101
<!-- 引入groovy 来执行命令 -->
107102
<dependency>
108103
<groupId>org.codehaus.groovy</groupId>
@@ -186,27 +181,110 @@
186181
<version>2.11.0</version>
187182
</dependency>
188183

189-
<!-- AMF RCE
184+
<!-- webservice -->
185+
<!--
190186
<dependency>
191-
<groupId>org.apache.flex.blazeds</groupId>
192-
<artifactId>flex-messaging-common</artifactId>
193-
<version>4.7.2</version>
187+
<groupId>org.apache.cxf</groupId>
188+
<artifactId>cxf-spring-boot-starter-jaxws</artifactId>
189+
<version>3.2.5</version>
194190
</dependency>
195191
-->
196192

193+
<!-- snakeyaml rce-->
194+
<dependency>
195+
<groupId>org.yaml</groupId>
196+
<artifactId>snakeyaml</artifactId>
197+
<version>1.17</version>
198+
</dependency>
199+
200+
<!-- 高版本会报错! -->
201+
<dependency>
202+
<groupId>org.owasp.esapi</groupId>
203+
<artifactId>esapi</artifactId>
204+
<version>2.2.0.0</version>
205+
</dependency>
206+
207+
<!-- log4j 远程代码执行 2.15.0依赖已修复 -->
208+
<dependency>
209+
<groupId>org.apache.logging.log4j</groupId>
210+
<artifactId>log4j-core</artifactId>
211+
<version>2.8.2</version>
212+
</dependency>
197213

198-
<!-- Spring Security -->
214+
<dependency>
215+
<groupId>org.apache.logging.log4j</groupId>
216+
<artifactId>log4j-api</artifactId>
217+
<version>2.8.2</version>
218+
</dependency>
219+
220+
<dependency>
221+
<groupId>org.projectlombok</groupId>
222+
<artifactId>lombok</artifactId>
223+
<version>1.18.22</version>
224+
</dependency>
225+
226+
<dependency>
227+
<groupId>org.apache.dubbo</groupId>
228+
<artifactId>dubbo</artifactId>
229+
<version>2.7.3</version>
230+
</dependency>
231+
232+
<dependency>
233+
<groupId>com.google.re2j</groupId>
234+
<artifactId>re2j</artifactId>
235+
<version>1.6</version>
236+
237+
</dependency>
238+
239+
<dependency>
240+
<groupId>com.github.whvcse</groupId>
241+
<artifactId>easy-captcha</artifactId>
242+
<version>1.6.2</version>
243+
</dependency>
199244

200245

201246
</dependencies>
202247

248+
203249
<build>
204250
<plugins>
205251
<!-- 用于maven构建 -->
206252
<plugin>
207253
<groupId>org.springframework.boot</groupId>
208254
<artifactId>spring-boot-maven-plugin</artifactId>
255+
<version>2.5.3</version>
256+
</plugin>
257+
258+
<plugin>
259+
<groupId>org.owasp</groupId>
260+
<artifactId>dependency-check-maven</artifactId>
261+
<version>6.5.3</version>
262+
263+
<executions>
264+
<execution>
265+
<goals>
266+
<goal>check</goal>
267+
</goals>
268+
</execution>
269+
</executions>
209270
</plugin>
271+
272+
<plugin>
273+
<groupId>org.cyclonedx</groupId>
274+
<artifactId>cyclonedx-maven-plugin</artifactId>
275+
<executions>
276+
<execution>
277+
<phase>compile</phase>
278+
<goals>
279+
<goal>makeAggregateBom</goal>
280+
</goals>
281+
</execution>
282+
</executions>
283+
<configuration>
284+
<outputFormat>xml</outputFormat>
285+
</configuration>
286+
</plugin>
287+
210288
</plugins>
211289
</build>
212290

‎src/main/java/com/best/hello/config/LoginHandlerInterceptor.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
public class LoginHandlerInterceptor implements HandlerInterceptor {
99
@Override
1010
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
11-
// 用户登录成功后获取session
1211
Object session = request.getSession().getAttribute("LoginUser");
1312
if (session == null) {
1413
request.setAttribute("msg", "请先登录");

‎src/main/java/com/best/hello/config/MvcConfig.java‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,11 @@
55
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
66
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
77

8-
/**
9-
* 视图跳转
10-
*/
118
@Configuration
129
public class MvcConfig implements WebMvcConfigurer {
1310
@Override
1411
public void addViewControllers(ViewControllerRegistry registry) {
15-
// 路由 -> 视图.html
16-
registry.addViewController("/").setViewName("login");
12+
registry.addViewController("/").setViewName("index");
1713
registry.addViewController("/login").setViewName("login");
1814
registry.addViewController("/index").setViewName("index");
1915
registry.addViewController("/index/xss").setViewName("xss");
@@ -33,17 +29,24 @@ public void addViewControllers(ViewControllerRegistry registry) {
3329
registry.addViewController("/index/password").setViewName("password");
3430
registry.addViewController("/index/xstream").setViewName("xstream");
3531
registry.addViewController("/index/fastjson").setViewName("fastjson");
32+
registry.addViewController("/index/admin").setViewName("logs");
33+
registry.addViewController("/index/xff").setViewName("xff");
34+
registry.addViewController("/index/unauth").setViewName("unauth");
35+
registry.addViewController("/index/jackson").setViewName("jackson");
36+
registry.addViewController("/index/log4j").setViewName("log4j");
37+
registry.addViewController("/index/jndi").setViewName("jndi");
38+
registry.addViewController("/index/csrf").setViewName("csrf");
39+
registry.addViewController("/index/dos").setViewName("dos");
40+
registry.addViewController("/index/cors").setViewName("cors");
41+
registry.addViewController("/index/captcha").setViewName("captcha_vul");
3642

3743
}
3844

39-
/**
40-
* 拦截器，判断是否登录成功
41-
* todo
42-
*/
45+
4346
@Override
4447
public void addInterceptors(InterceptorRegistry registry) {
4548
registry.addInterceptor(new LoginHandlerInterceptor())
4649
.addPathPatterns("/**")
47-
.excludePathPatterns("/user/login", "/login", "/", "/css/**", "/js/**", "/img/**");
50+
.excludePathPatterns("/user/login", "/user/ldap", "/login", "/css/**", "/js/**", "/img/**", "/Unauth/**", "/captcha");
4851
}
4952
}

‎src/main/java/com/best/hello/controller/Admin.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
package com.best.hello.controller;
2+
3+
import com.alibaba.fastjson.JSON;
4+
import io.swagger.annotations.ApiOperation;
5+
import lombok.extern.slf4j.Slf4j;
6+
import org.apache.catalina.util.ServerInfo;
7+
8+
import org.springframework.stereotype.Controller;
9+
10+
import org.springframework.web.bind.annotation.*;
11+
12+
import java.util.HashMap;
13+
import java.util.Map;
14+
15+
16+
@Slf4j
17+
@Controller
18+
@RequestMapping("/admin")
19+
public class Admin {
20+
21+
22+
@ApiOperation(value = "查询系统基本信息")
23+
@GetMapping("/info")
24+
@ResponseBody
25+
public String sysInfo() {
26+
Map<String, String> m = new HashMap<>();
27+
28+
m.put("app", "Hello Java SEC");
29+
m.put("author", "nul1");
30+
m.put("tomcat_version", ServerInfo.getServerInfo());
31+
m.put("java_version", System.getProperty("java.version"));
32+
m.put("fastjson_version", JSON.VERSION);
33+
34+
return JSON.toJSONString(m);
35+
}
36+
37+
}

0 commit comments

Comments
 (0)