feat: support servletNameFilter for UndertowFilterProbe

This commit is contained in:
ReaJason
2026-01-12 02:12:34 +08:00
parent 80f91f9d6f
commit 12f9dbe432
9 changed files with 144 additions and 88 deletions
@@ -13,51 +13,82 @@ public class UndertowFilterProbe {
@Override @Override
public String toString() { public String toString() {
String msg = ""; StringBuilder msg = new StringBuilder();
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>(); Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
Set<Object> contexts = null; Set<Object> contexts = null;
try { try {
contexts = getContext(); contexts = getContext();
} catch (Throwable throwable) { } catch (Throwable throwable) {
msg += "context error: " + getErrorMessage(throwable); msg.append("context error: ").append(getErrorMessage(throwable));
} }
if (contexts == null || contexts.isEmpty()) { if (contexts == null || contexts.isEmpty()) {
msg += "context not found\n"; msg.append("context not found\n");
} else { } else {
for (Object context : contexts) { for (Object context : contexts) {
String contextRoot = getContextRoot(context); String contextRoot = getContextRoot(context);
List<Map<String, String>> filters = collectFiltersData(context); try {
allFiltersData.put(contextRoot, filters); List<Map<String, String>> filters = collectFiltersData(context);
allFiltersData.put(contextRoot, filters);
} catch (Throwable e) {
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
}
} }
msg += formatFiltersData(allFiltersData); msg.append(formatFiltersData(allFiltersData));
} }
return msg; return msg.toString();
} }
private List<Map<String, String>> collectFiltersData(Object context) { @SuppressWarnings("unchecked")
List<Map<String, String>> result = new ArrayList<>(); private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
try { Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
Object deploymentInfo = getFieldValue(context, "deploymentInfo"); Object deploymentInfo = getFieldValue(context, "deploymentInfo");
if (deploymentInfo == null) return Collections.emptyList(); Map<String, Object> filters = (Map<String, Object>) getFieldValue(deploymentInfo, "filters");
List<Object> filterUrlMappings = (List<Object>) getFieldValue(deploymentInfo, "filterUrlMappings");
Map<String, Object> filters = (Map<String, Object>) getFieldValue(deploymentInfo, "filters"); List<Object> filterServletNameMappings = (List<Object>) getFieldValue(deploymentInfo, "filterServletNameMappings");
for (Object filterUrlMapping : filterUrlMappings) {
if (filters == null || filters.isEmpty()) return Collections.emptyList(); String filterName = (String) getFieldValue(filterUrlMapping, "filterName");
Class<?> filterClass = (Class<?>) getFieldValue(filters.get(filterName), "filterClass");
List<Object> filterUrlMappings = (List<Object>) getFieldValue(deploymentInfo, "filterUrlMappings"); if (aggregatedData.get(filterName) == null) {
// List<Object> filterServletNameMappings = (List<Object>) getFieldValue(deploymentInfo, "filterServletNameMappings"); Map<String, Object> info = new HashMap<>();
for (Object filterUrlMapping : filterUrlMappings) {
Map<String, String> info = new HashMap<>();
String filterName = (String) getFieldValue(filterUrlMapping, "filterName");
String urlPattern = (String) getFieldValue(filterUrlMapping, "mapping");
Class<?> filterClass = (Class<?>) getFieldValue(filters.get(filterName), "filterClass");
info.put("filterName", filterName); info.put("filterName", filterName);
info.put("urlPatterns", urlPattern);
info.put("filterClass", filterClass.getName()); info.put("filterClass", filterClass.getName());
result.add(info); info.put("urlPatterns", new LinkedHashSet<String>());
info.put("servletNames", new LinkedHashSet<String>());
aggregatedData.put(filterName, info);
} }
} catch (Exception ignored) { Map<String, Object> info = aggregatedData.get(filterName);
String urlPattern = (String) getFieldValue(filterUrlMapping, "mapping");
if (urlPattern != null) {
((Set<String>) info.get("urlPatterns")).add(urlPattern);
}
}
for (Object filterServletNameMapping : filterServletNameMappings) {
String filterName = (String) getFieldValue(filterServletNameMapping, "filterName");
Class<?> filterClass = (Class<?>) getFieldValue(filters.get(filterName), "filterClass");
if (aggregatedData.get(filterName) == null) {
Map<String, Object> info = new HashMap<>();
info.put("filterName", filterName);
info.put("filterClass", filterClass.getName());
info.put("urlPatterns", new LinkedHashSet<String>());
info.put("servletNames", new LinkedHashSet<String>());
aggregatedData.put(filterName, info);
}
Map<String, Object> info = aggregatedData.get(filterName);
String servletNames = (String) getFieldValue(filterServletNameMapping, "mapping");
if (servletNames != null) {
((Set<String>) info.get("servletNames")).add(servletNames);
}
}
List<Map<String, String>> result = new ArrayList<>();
for (Map<String, Object> entry : aggregatedData.values()) {
Map<String, String> finalInfo = new HashMap<>();
finalInfo.put("filterName", (String) entry.get("filterName"));
finalInfo.put("filterClass", (String) entry.get("filterClass"));
Set<?> urls = (Set<?>) entry.get("urlPatterns");
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
Set<?> servletNames = (Set<?>) entry.get("servletNames");
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
result.add(finalInfo);
} }
return result; return result;
} }
@@ -77,7 +108,8 @@ public class UndertowFilterProbe {
for (Map<String, String> info : filters) { for (Map<String, String> info : filters) {
appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, "", info.get("filterName"), "");
appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), "");
appendIfPresent(output, " -> URL:[", info.get("urlPatterns"), "]"); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
output.append("\n"); output.append("\n");
} }
} }
@@ -2,8 +2,14 @@ package com.reajason.javaweb.integration.probe.jbosseap;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -15,9 +21,11 @@ import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files; import java.nio.file.Files;
import java.nio.file.Paths; import java.nio.file.Paths;
import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrl; import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
/** /**
@@ -69,4 +77,21 @@ public class JbossEap6ContainerTest {
String url = getUrl(container); String url = getUrl(container);
ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6); ProbeAssertion.responseBytecodeIsOk(url, Server.JBoss, Opcodes.V1_6);
} }
@Test
void testFilterProbe() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.JBoss));
ShellAssertion.assertFilterProbeIsRight(data);
}
@Test
void testFilterFirstInject() {
String url = getUrl(container);
MemShellResult memShellResult = shellInjectIsOk(url, Server.JBoss, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Tomcat));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertEquals(filterName, memShellResult.getShellClassName());
}
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.jbosseap;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.AfterAll;
@@ -87,20 +90,17 @@ public class JbossEap7ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.jbosseap;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -20,10 +23,9 @@ import java.nio.file.Files;
import java.nio.file.Paths; import java.nio.file.Paths;
import java.util.List; import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.*; import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.*;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
/** /**
@@ -80,20 +82,17 @@ public class JbossEap81ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -80,20 +83,17 @@ public class Wildfly18ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -80,20 +83,17 @@ public class Wildfly23ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -80,20 +83,17 @@ public class Wildfly30ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -80,20 +83,17 @@ public class Wildfly36ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.JAKARTA_FILTER, ShellTool.Command, Opcodes.V17, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.wildfly;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
@@ -83,20 +86,17 @@ public class Wildfly9ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Undertow, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getUndertowFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Undertow));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("io.undertow.servlet.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }