MCPcopy Index your code
hub / github.com/bmth666/Yongyou-Unserialize-plus

github.com/bmth666/Yongyou-Unserialize-plus @2024.10.11

Chat with this repo
repository ↗ · DeepWiki ↗ · release 2024.10.11 ↗ · + Follow
43 symbols 95 edges 16 files 0 documented · 0%
What it actually does AI analysis from the code graph — generated when you open this
loading…
README

Yongyou-Unserialize-plus

2023年分析用友的一些反序列化链子以及1day，二开了一下工具

绕waf：

https://mp.weixin.qq.com/s/fcuKNfLXiFxWrIYQPq7OCg

https://vidar-team.feishu.cn/docx/LJN4dzu1QoEHt4x3SQncYagpnGd

套一下Whoopsunix师傅写的 UTF8OverlongObjectOutputStream.java 就可以了

用友nc反序列化利用工具

YongYouNc.jar，二开的：https://github.com/wgpsec/YongYouNcTool，jdk1.8启动

  1. 增加脏数据以及UTF-8 Overlong Encoding

image-20241004191550499

  1. 将内存马改为字节码加载，方便加载自定义的字节码

image-20240916235641186

使用JMG生成tomcat内存马即可

  1. 增加反序列化利用链，以及多个poc

支持检测漏洞：

BshServlet rce jsInvoke rce DeleteServlet 反序列化 DownloadServlet 反序列化 FileReceiveServlet 反序列化 FileReceiveServlet 文件上传 DownloadServlet 反序列化 MonitorServlet 反序列化 MxServlet 反序列化 monitorservlet 反序列化 UploadServlet 反序列化 NCMessageServlet 反序列化 JiuQiClientReqDispatch 反序列化 FileParserServlet 反序列化 FileUploadServlet 反序列化 DcUpdateRESTService 反序列化 ECFileManageServlet 反序列化 OAContactsFuzzySearchServlet 反序列化 LoggingConfigServlet 反序列化 ConfigResourceServlet 反序列化 ModelHandleServlet 反序列化 ContactsQueryServiceServlet 反序列化 ContactsFuzzySearchServlet 反序列化 UserQueryServiceServlet 反序列化 UserSynchronizationServlet 反序列化 UserAuthenticationServlet 反序列化 ResourceManagerServlet 反序列化 XbrlPersistenceServlet 反序列化 NCFindWeb 文件读取/列目录

image-20240917000608279

另外推荐一个工具：YONYOU-TOOL，很实用

Core symbols most depended-on inside this repo

setAccessible
called by 15
nc6.5/src/main/java/payload/BeanShell.java
setFieldValue
called by 6
nc6.5/src/main/java/payload/CommonCollections.java
setFieldValue
called by 5
u8cloud/src/main/java/exp/CommonBeanutils.java
setFieldValue
called by 4
nc6.5/src/main/java/payload/BeanShell.java
setAccessible
called by 4
nc6.5/src/main/java/payload/AspectJWeaver.java
getField
called by 3
nc6.5/src/main/java/payload/BeanShell.java
exec
called by 2
nc6.5/src/main/java/payload/BeanShell.java
CC6_TemplatesImpl
called by 2
nc6.5/src/main/java/payload/CommonCollections.java

Shape

Method 27
Class 16

Languages

Java100%

Modules by API surface

nc6.5/src/main/java/payload/BeanShell.java6 symbols
nc6.5/src/main/java/payload/CommonCollections.java5 symbols
nc6.5/src/main/java/payload/AspectJWeaver.java4 symbols
u8cloud/src/main/java/exp/CommonBeanutils.java3 symbols
nc6.5/src/main/java/exp/Main.java3 symbols
nc6.5/src/main/java/exp/ActionInvokeService.java3 symbols
u8cloud/src/main/java/exp/ServiceDispatcherServlet.java2 symbols
nc6.5/src/main/java/tools/TomcatEcho.java2 symbols
nc6.5/src/main/java/tools/Evil_main.java2 symbols
nc6.5/src/main/java/tools/Evil.java2 symbols
nc6.5/src/main/java/payload/urldns.java2 symbols
nc6.5/src/main/java/exp/Test.java2 symbols

For agents

$ claude mcp add Yongyou-Unserialize-plus \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact

Ask about this repo answers extend the page