mirror of
https://github.com/ReaJason/MemShellParty.git
synced 2026-09-21 22:50:42 +08:00
feat: support servletNameFilter
Dev Deploy / Build Jar (ubuntu-latest) (push) Has been cancelled
Dev Deploy / Build Jar (windows-latest) (push) Has been cancelled
Dev Deploy / Docker Push (push) Has been cancelled
Dev Deploy / Deploy to Maven Central (push) Has been cancelled
Dev Deploy / Deploy to Northflank (push) Has been cancelled
Probe IntegrationTest / springwebmvc (push) Has been cancelled
Probe IntegrationTest / struct2 (push) Has been cancelled
Probe IntegrationTest / tomcat (push) Has been cancelled
Probe IntegrationTest / glassfish (push) Has been cancelled
Probe IntegrationTest / jbosseap (push) Has been cancelled
Probe IntegrationTest / jetty (push) Has been cancelled
Probe IntegrationTest / payara (push) Has been cancelled
Probe IntegrationTest / wildfly (push) Has been cancelled
Probe IntegrationTest / jbossas (push) Has been cancelled
Probe IntegrationTest / resin (push) Has been cancelled
Probe IntegrationTest / weblogic (push) Has been cancelled
Probe IntegrationTest / websphere7 (push) Has been cancelled
Probe IntegrationTest / websphere (push) Has been cancelled
Unit-Test / UniteTest (push) Has been cancelled
Dev Deploy / Build Jar (ubuntu-latest) (push) Has been cancelled
Dev Deploy / Build Jar (windows-latest) (push) Has been cancelled
Dev Deploy / Docker Push (push) Has been cancelled
Dev Deploy / Deploy to Maven Central (push) Has been cancelled
Dev Deploy / Deploy to Northflank (push) Has been cancelled
Probe IntegrationTest / springwebmvc (push) Has been cancelled
Probe IntegrationTest / struct2 (push) Has been cancelled
Probe IntegrationTest / tomcat (push) Has been cancelled
Probe IntegrationTest / glassfish (push) Has been cancelled
Probe IntegrationTest / jbosseap (push) Has been cancelled
Probe IntegrationTest / jetty (push) Has been cancelled
Probe IntegrationTest / payara (push) Has been cancelled
Probe IntegrationTest / wildfly (push) Has been cancelled
Probe IntegrationTest / jbossas (push) Has been cancelled
Probe IntegrationTest / resin (push) Has been cancelled
Probe IntegrationTest / weblogic (push) Has been cancelled
Probe IntegrationTest / websphere7 (push) Has been cancelled
Probe IntegrationTest / websphere (push) Has been cancelled
Unit-Test / UniteTest (push) Has been cancelled
This commit is contained in:
@@ -45,6 +45,8 @@ public class FilterProbeFactory {
|
|||||||
return WebLogicFilterProbe.class;
|
return WebLogicFilterProbe.class;
|
||||||
case Server.Undertow:
|
case Server.Undertow:
|
||||||
return UndertowFilterProbe.class;
|
return UndertowFilterProbe.class;
|
||||||
|
case Server.Resin:
|
||||||
|
return ResinFilterProbe.class;
|
||||||
default:
|
default:
|
||||||
throw new GenerationException("filterProbe not supported for server: " + server);
|
throw new GenerationException("filterProbe not supported for server: " + server);
|
||||||
}
|
}
|
||||||
|
|||||||
+57
-66
@@ -13,73 +13,58 @@ public class ApusicFilterProbe {
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
public String toString() {
|
public String toString() {
|
||||||
String msg = "";
|
StringBuilder msg = new StringBuilder();
|
||||||
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
|
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
|
||||||
Set<Object> contexts = null;
|
Set<Object> contexts = null;
|
||||||
try {
|
try {
|
||||||
contexts = getContext();
|
contexts = getContext();
|
||||||
} catch (Throwable throwable) {
|
} catch (Throwable throwable) {
|
||||||
msg += "context error: " + getErrorMessage(throwable);
|
msg.append("context error: ").append(getErrorMessage(throwable));
|
||||||
}
|
}
|
||||||
if (contexts == null || contexts.isEmpty()) {
|
if (contexts == null || contexts.isEmpty()) {
|
||||||
msg += "context not found\n";
|
msg.append("context not found\n");
|
||||||
} else {
|
} else {
|
||||||
for (Object context : contexts) {
|
for (Object context : contexts) {
|
||||||
String contextRoot = getContextRoot(context);
|
String contextRoot = getContextRoot(context);
|
||||||
List<Map<String, String>> filters = collectFiltersData(context);
|
try {
|
||||||
allFiltersData.put(contextRoot, filters);
|
List<Map<String, String>> filters = collectFiltersData(context);
|
||||||
|
allFiltersData.put(contextRoot, filters);
|
||||||
|
} catch (Throwable e) {
|
||||||
|
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
|
||||||
|
}
|
||||||
}
|
}
|
||||||
msg += formatFiltersData(allFiltersData);
|
msg.append(formatFiltersData(allFiltersData));
|
||||||
}
|
}
|
||||||
return msg;
|
return msg.toString();
|
||||||
}
|
}
|
||||||
|
|
||||||
@SuppressWarnings("all")
|
@SuppressWarnings("all")
|
||||||
private List<Map<String, String>> collectFiltersData(Object context) {
|
private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
|
||||||
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
|
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
|
||||||
|
Object webModule = getFieldValue(context, "webapp");
|
||||||
|
Object[] filterMappings = (Object[]) invokeMethod(webModule, "getAllFilterMappings");
|
||||||
|
Map<String, String> filterClassMap = new HashMap<>();
|
||||||
|
|
||||||
try {
|
for (Object fm : filterMappings) {
|
||||||
Object webModule = getFieldValue(context, "webapp");
|
String name = (String) invokeMethod(fm, "getFilterName");
|
||||||
if (webModule == null) {
|
if (!aggregatedData.containsKey(name)) {
|
||||||
return Collections.emptyList();
|
Map<String, Object> info = new HashMap<>();
|
||||||
|
Object filterModel = invokeMethod(webModule, "getFilter", new Class[]{String.class}, new Object[]{name});
|
||||||
|
info.put("filterName", name);
|
||||||
|
info.put("filterClass", invokeMethod(filterModel, "getFilterClass"));
|
||||||
|
info.put("urlPatterns", new LinkedHashSet<String>());
|
||||||
|
info.put("servletNames", new LinkedHashSet<String>());
|
||||||
|
aggregatedData.put(name, info);
|
||||||
}
|
}
|
||||||
|
Map<String, Object> info = aggregatedData.get(name);
|
||||||
Object[] filterMappings = (Object[]) invokeMethod(webModule, "getAllFilterMappings");
|
String urlPattern = (String) invokeMethod(fm, "getUrlPattern");
|
||||||
if (filterMappings == null || filterMappings.length == 0) {
|
if (urlPattern != null) {
|
||||||
return Collections.emptyList();
|
((Set<String>) info.get("urlPatterns")).add(urlPattern);
|
||||||
}
|
}
|
||||||
|
String servletName = (String) invokeMethod(fm, "getServletName");
|
||||||
Object[] filters = (Object[]) invokeMethod(webModule, "getFilterList");
|
if (servletName != null) {
|
||||||
Map<String, String> filterClassMap = new HashMap<>();
|
((Set<String>) info.get("servletNames")).add(servletName);
|
||||||
if (filters != null) {
|
|
||||||
for (Object filter : filters) {
|
|
||||||
String name = (String) invokeMethod(filter, "getName");
|
|
||||||
String className = (String) invokeMethod(filter, "getFilterClass");
|
|
||||||
if (name != null && className != null) {
|
|
||||||
filterClassMap.put(name, className);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
for (Object fm : filterMappings) {
|
|
||||||
String name = (String) invokeMethod(fm, "getFilterName");
|
|
||||||
if (name == null) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
if (!aggregatedData.containsKey(name)) {
|
|
||||||
Map<String, Object> info = new HashMap<>();
|
|
||||||
info.put("filterName", name);
|
|
||||||
info.put("filterClass", filterClassMap.getOrDefault(name, "N/A"));
|
|
||||||
info.put("urlPatterns", new LinkedHashSet<String>());
|
|
||||||
aggregatedData.put(name, info);
|
|
||||||
}
|
|
||||||
Map<String, Object> info = aggregatedData.get(name);
|
|
||||||
String urlPattern = (String) invokeMethod(fm, "getUrlPattern");
|
|
||||||
if (urlPattern != null) {
|
|
||||||
((Set<String>) info.get("urlPatterns")).add(urlPattern);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} catch (Exception ignored) {
|
|
||||||
}
|
}
|
||||||
|
|
||||||
List<Map<String, String>> result = new ArrayList<>();
|
List<Map<String, String>> result = new ArrayList<>();
|
||||||
@@ -89,6 +74,8 @@ public class ApusicFilterProbe {
|
|||||||
finalInfo.put("filterClass", (String) entry.get("filterClass"));
|
finalInfo.put("filterClass", (String) entry.get("filterClass"));
|
||||||
Set<?> urls = (Set<?>) entry.get("urlPatterns");
|
Set<?> urls = (Set<?>) entry.get("urlPatterns");
|
||||||
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
|
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
|
||||||
|
Set<?> servletNames = (Set<?>) entry.get("servletNames");
|
||||||
|
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
|
||||||
result.add(finalInfo);
|
result.add(finalInfo);
|
||||||
}
|
}
|
||||||
return result;
|
return result;
|
||||||
@@ -108,6 +95,7 @@ public class ApusicFilterProbe {
|
|||||||
appendIfPresent(output, "", info.get("filterName"), "");
|
appendIfPresent(output, "", info.get("filterName"), "");
|
||||||
appendIfPresent(output, " -> ", info.get("filterClass"), "");
|
appendIfPresent(output, " -> ", info.get("filterClass"), "");
|
||||||
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
|
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
|
||||||
|
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
|
||||||
output.append("\n");
|
output.append("\n");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -176,27 +164,30 @@ public class ApusicFilterProbe {
|
|||||||
throw new NoSuchFieldException(fieldName + " for " + obj.getClass().getName());
|
throw new NoSuchFieldException(fieldName + " for " + obj.getClass().getName());
|
||||||
}
|
}
|
||||||
|
|
||||||
@SuppressWarnings("all")
|
public static Object invokeMethod(Object obj, String methodName) throws Exception {
|
||||||
public static Object invokeMethod(Object obj, String methodName) {
|
return invokeMethod(obj, methodName, null, null);
|
||||||
try {
|
}
|
||||||
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
|
|
||||||
Method method = null;
|
|
||||||
while (clazz != null && method == null) {
|
|
||||||
try {
|
|
||||||
method = clazz.getDeclaredMethod(methodName);
|
|
||||||
} catch (NoSuchMethodException e) {
|
|
||||||
clazz = clazz.getSuperclass();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (method == null) {
|
|
||||||
throw new NoSuchMethodException("Method not found: " + methodName);
|
|
||||||
}
|
|
||||||
|
|
||||||
method.setAccessible(true);
|
@SuppressWarnings("all")
|
||||||
return method.invoke(obj instanceof Class ? null : obj);
|
public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
|
||||||
} catch (Exception e) {
|
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
|
||||||
throw new RuntimeException("Error invoking method: " + methodName, e);
|
Method method = null;
|
||||||
|
while (clazz != null && method == null) {
|
||||||
|
try {
|
||||||
|
if (paramClazz == null) {
|
||||||
|
method = clazz.getDeclaredMethod(methodName);
|
||||||
|
} else {
|
||||||
|
method = clazz.getDeclaredMethod(methodName, paramClazz);
|
||||||
|
}
|
||||||
|
} catch (NoSuchMethodException e) {
|
||||||
|
clazz = clazz.getSuperclass();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
if (method == null) {
|
||||||
|
throw new NoSuchMethodException("Method not found: " + methodName);
|
||||||
|
}
|
||||||
|
method.setAccessible(true);
|
||||||
|
return method.invoke(obj instanceof Class ? null : obj, param);
|
||||||
}
|
}
|
||||||
|
|
||||||
@SuppressWarnings("all")
|
@SuppressWarnings("all")
|
||||||
|
|||||||
+64
-43
@@ -13,73 +13,93 @@ public class ResinFilterProbe {
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
public String toString() {
|
public String toString() {
|
||||||
String msg = "";
|
StringBuilder msg = new StringBuilder();
|
||||||
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
|
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
|
||||||
Set<Object> contexts = null;
|
Set<Object> contexts = null;
|
||||||
try {
|
try {
|
||||||
contexts = getContext();
|
contexts = getContext();
|
||||||
} catch (Throwable throwable) {
|
} catch (Throwable throwable) {
|
||||||
msg += "context error: " + getErrorMessage(throwable);
|
msg.append("context error: ").append(getErrorMessage(throwable));
|
||||||
}
|
}
|
||||||
if (contexts == null || contexts.isEmpty()) {
|
if (contexts == null || contexts.isEmpty()) {
|
||||||
msg += "context not found\n";
|
msg.append("context not found\n");
|
||||||
} else {
|
} else {
|
||||||
for (Object context : contexts) {
|
for (Object context : contexts) {
|
||||||
String contextRoot = getContextRoot(context);
|
String contextRoot = getContextRoot(context);
|
||||||
List<Map<String, String>> filters = collectFiltersData(context);
|
try {
|
||||||
allFiltersData.put(contextRoot, filters);
|
List<Map<String, String>> filters = collectFiltersData(context);
|
||||||
|
allFiltersData.put(contextRoot, filters);
|
||||||
|
} catch (Throwable e) {
|
||||||
|
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
|
||||||
|
}
|
||||||
}
|
}
|
||||||
msg += formatFiltersData(allFiltersData);
|
msg.append(formatFiltersData(allFiltersData));
|
||||||
}
|
}
|
||||||
return msg;
|
return msg.toString();
|
||||||
}
|
}
|
||||||
|
|
||||||
private List<Map<String, String>> collectFiltersData(Object context) {
|
@SuppressWarnings("unchecked")
|
||||||
List<Map<String, String>> result = new ArrayList<>();
|
private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
|
||||||
try {
|
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
|
||||||
Object filterMapper = getFieldValue(context, "_filterMapper");
|
Object filterMapper = getFieldValue(context, "_filterMapper");
|
||||||
Object filterManager = getFieldValue(context, "_filterManager");
|
Object filterManager = getFieldValue(context, "_filterManager");
|
||||||
if (filterMapper == null) return Collections.emptyList();
|
if (filterMapper == null) return Collections.emptyList();
|
||||||
ArrayList<Object> filterMappings = (ArrayList<Object>) getFieldValue(filterMapper, "_filterMap");
|
ArrayList<Object> filterMappings = (ArrayList<Object>) getFieldValue(filterMapper, "_filterMap");
|
||||||
for (Object filterMapping : filterMappings) {
|
for (Object filterMapping : filterMappings) {
|
||||||
Map<String, String> info = new HashMap<>();
|
String filterName = (String) invokeMethod(filterMapping, "getFilterName", null, null);
|
||||||
String filterName = (String) invokeMethod(filterMapping, "getFilterName", null, null);
|
if (aggregatedData.get(filterName) == null) {
|
||||||
|
Map<String, Object> info = new HashMap<>();
|
||||||
info.put("filterName", filterName);
|
info.put("filterName", filterName);
|
||||||
String filterClassName = (String) invokeMethod(filterMapping, "getFilterClassName", null, null);
|
String filterClassName = (String) invokeMethod(filterMapping, "getFilterClassName", null, null);
|
||||||
try {
|
if (filterClassName == null) {
|
||||||
if (filterClassName == null) {
|
Class<?> filterClass = (Class<?>) invokeMethod(filterMapping, "getFilterClass", null, null);
|
||||||
Class<?> filterClass = (Class<?>) invokeMethod(filterMapping, "getFilterClass", null, null);
|
if (filterClass != null) {
|
||||||
if (filterClass != null) {
|
filterClassName = filterClass.getName();
|
||||||
filterClassName = filterClass.getName();
|
} else {
|
||||||
} else {
|
Object filter = ((Map<String, Object>) getFieldValue(filterManager, "_instances")).get(filterName);
|
||||||
Object filter = ((Map<String, Object>) getFieldValue(filterManager, "_instances")).get(filterName);
|
if (filter != null) {
|
||||||
if (filter != null) {
|
filterClassName = filter.getClass().getName();
|
||||||
filterClassName = filter.getClass().getName();
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} catch (Exception ignored) {
|
|
||||||
}
|
}
|
||||||
info.put("filterClass", filterClassName != null ? filterClassName : "N/A");
|
info.put("filterClass", filterClassName != null ? filterClassName : "N/A");
|
||||||
|
info.put("urlPatterns", new LinkedHashSet<String>());
|
||||||
List<String> urlPatterns = new ArrayList<>();
|
info.put("servletNames", new LinkedHashSet<String>());
|
||||||
String urlPattern = invokeMethod(filterMapping, "getURLPattern", null, null).toString();
|
aggregatedData.put(filterName, info);
|
||||||
if (urlPattern == null || urlPattern.isEmpty()) {
|
}
|
||||||
List<Object> matchList = (List<Object>) getFieldValue(filterMapping, "_matchList");
|
Map<String, Object> info = aggregatedData.get(filterName);
|
||||||
if (matchList != null && !matchList.isEmpty()) {
|
List<String> urlPatterns = new ArrayList<>();
|
||||||
for (Object match : matchList) {
|
String urlPattern = (String) invokeMethod(filterMapping, "getURLPattern", null, null);
|
||||||
if (((Integer) getFieldValue(match, "_value")) == 1) {
|
if (urlPattern == null || urlPattern.isEmpty()) {
|
||||||
urlPatterns.add(getFieldValue(match, "_regex").toString());
|
List<Object> matchList = (List<Object>) getFieldValue(filterMapping, "_matchList");
|
||||||
}
|
if (matchList != null && !matchList.isEmpty()) {
|
||||||
|
for (Object match : matchList) {
|
||||||
|
if (((Integer) getFieldValue(match, "_value")) == 1) {
|
||||||
|
urlPatterns.add(getFieldValue(match, "_regex").toString());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} else {
|
|
||||||
urlPatterns.add(urlPattern);
|
|
||||||
}
|
}
|
||||||
info.put("urlPatterns", Arrays.toString(urlPatterns.toArray()));
|
} else {
|
||||||
result.add(info);
|
urlPatterns.add(urlPattern);
|
||||||
}
|
}
|
||||||
} catch (Exception ignored) {
|
if (!urlPatterns.isEmpty()) {
|
||||||
|
((Set) info.get("urlPatterns")).addAll(urlPatterns);
|
||||||
|
}
|
||||||
|
List<String> servletNames = (List<String>) getFieldValue(filterMapping, "_servletNames");
|
||||||
|
if (servletNames != null && !servletNames.isEmpty()) {
|
||||||
|
((Set) info.get("servletNames")).addAll(servletNames);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
List<Map<String, String>> result = new ArrayList<>();
|
||||||
|
for (Map<String, Object> entry : aggregatedData.values()) {
|
||||||
|
Map<String, String> finalInfo = new HashMap<>();
|
||||||
|
finalInfo.put("filterName", (String) entry.get("filterName"));
|
||||||
|
finalInfo.put("filterClass", (String) entry.get("filterClass"));
|
||||||
|
Set<?> urls = (Set<?>) entry.get("urlPatterns");
|
||||||
|
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
|
||||||
|
Set<?> servletNames = (Set<?>) entry.get("servletNames");
|
||||||
|
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
|
||||||
|
result.add(finalInfo);
|
||||||
}
|
}
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
@@ -100,6 +120,7 @@ public class ResinFilterProbe {
|
|||||||
appendIfPresent(output, "", info.get("filterName"), "");
|
appendIfPresent(output, "", info.get("filterName"), "");
|
||||||
appendIfPresent(output, " -> ", info.get("filterClass"), "");
|
appendIfPresent(output, " -> ", info.get("filterClass"), "");
|
||||||
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
|
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
|
||||||
|
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
|
||||||
output.append("\n");
|
output.append("\n");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+73
-41
@@ -13,89 +13,114 @@ public class WebSphereFilterProbe {
|
|||||||
|
|
||||||
@Override
|
@Override
|
||||||
public String toString() {
|
public String toString() {
|
||||||
String msg = "";
|
StringBuilder msg = new StringBuilder();
|
||||||
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
|
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
|
||||||
Set<Object> contexts = null;
|
Set<Object> contexts = null;
|
||||||
try {
|
try {
|
||||||
contexts = getContext();
|
contexts = getContext();
|
||||||
} catch (Throwable throwable) {
|
} catch (Throwable throwable) {
|
||||||
msg += "context error: " + getErrorMessage(throwable);
|
msg.append("context error: ").append(getErrorMessage(throwable));
|
||||||
}
|
}
|
||||||
if (contexts == null || contexts.isEmpty()) {
|
if (contexts == null || contexts.isEmpty()) {
|
||||||
msg += "context not found\n";
|
msg.append("context not found\n");
|
||||||
} else {
|
} else {
|
||||||
for (Object context : contexts) {
|
for (Object context : contexts) {
|
||||||
String contextRoot = getContextRoot(context);
|
String contextRoot = getContextRoot(context);
|
||||||
List<Map<String, String>> filters = collectFiltersData(context);
|
try {
|
||||||
allFiltersData.put(contextRoot, filters);
|
List<Map<String, String>> filters = collectFiltersData(context);
|
||||||
|
allFiltersData.put(contextRoot, filters);
|
||||||
|
} catch (Throwable e) {
|
||||||
|
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
|
||||||
|
}
|
||||||
}
|
}
|
||||||
msg += formatFiltersData(allFiltersData);
|
msg.append(formatFiltersData(allFiltersData));
|
||||||
}
|
}
|
||||||
return msg;
|
return msg.toString();
|
||||||
}
|
}
|
||||||
|
|
||||||
private List<Map<String, String>> collectFiltersData(Object context) {
|
private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
|
||||||
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
|
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
|
||||||
try {
|
try {
|
||||||
Object filterManager = getFieldValue(context, "filterManager");
|
Object filterManager = getFieldValue(context, "filterManager");
|
||||||
Object webAppConfig = getFieldValue(context, "config");
|
Object webAppConfig = getFieldValue(context, "config");
|
||||||
try {
|
try {
|
||||||
List uriFilterMappingInfos = (List) getFieldValue(webAppConfig, "uriFilterMappingInfos");
|
List uriFilterMappingInfos = (List) getFieldValue(webAppConfig, "uriFilterMappingInfos");
|
||||||
if (uriFilterMappingInfos == null || uriFilterMappingInfos.isEmpty()) {
|
|
||||||
return Collections.emptyList();
|
|
||||||
}
|
|
||||||
for (Object uriFilterMappingInfo : uriFilterMappingInfos) {
|
for (Object uriFilterMappingInfo : uriFilterMappingInfos) {
|
||||||
Object filterConfig = getFieldValue(uriFilterMappingInfo, "filterConfig");
|
Object filterConfig = getFieldValue(uriFilterMappingInfo, "filterConfig");
|
||||||
String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null);
|
String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null);
|
||||||
Collection urlPatternMappings = (Collection) invokeMethod(filterConfig, "getUrlPatternMappings", null, null);
|
|
||||||
String urlPattern = (String) invokeMethod(uriFilterMappingInfo, "getUrlPattern", null, null);
|
|
||||||
if (!aggregatedData.containsKey(filterName)) {
|
if (!aggregatedData.containsKey(filterName)) {
|
||||||
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
|
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
|
||||||
Map<String, Object> info = new HashMap<>();
|
Map<String, Object> info = new HashMap<>();
|
||||||
info.put("filterName", filterName);
|
info.put("filterName", filterName);
|
||||||
info.put("filterClass", filterClassName);
|
info.put("filterClass", filterClassName);
|
||||||
LinkedHashSet<String> urlPatterns = new LinkedHashSet<>();
|
info.put("urlPatterns", new LinkedHashSet<>());
|
||||||
if (urlPattern != null && !urlPattern.isEmpty()) {
|
info.put("servletNames", new LinkedHashSet<>());
|
||||||
urlPatterns.add(urlPattern);
|
|
||||||
}
|
|
||||||
if (urlPatternMappings != null) {
|
|
||||||
urlPatterns.addAll(urlPatternMappings);
|
|
||||||
}
|
|
||||||
info.put("urlPatterns", urlPatterns);
|
|
||||||
aggregatedData.put(filterName, info);
|
aggregatedData.put(filterName, info);
|
||||||
} else {
|
}
|
||||||
Set urlPatterns = (Set) aggregatedData.get(filterName).get("urlPatterns");
|
Map<String, Object> info = aggregatedData.get(filterName);
|
||||||
if (urlPattern != null && !urlPattern.isEmpty()) {
|
String urlPattern = (String) invokeMethod(uriFilterMappingInfo, "getUrlPattern", null, null);
|
||||||
urlPatterns.add(urlPattern);
|
if (urlPattern != null && !urlPattern.isEmpty()) {
|
||||||
}
|
((Set) info.get("urlPatterns")).add(urlPattern);
|
||||||
if (urlPatternMappings != null) {
|
}
|
||||||
urlPatterns.addAll(urlPatternMappings);
|
}
|
||||||
}
|
|
||||||
|
List servletFilterMappingInfos = (List) getFieldValue(webAppConfig, "servletFilterMappingInfos");
|
||||||
|
for (Object servletFilterMappingInfo : servletFilterMappingInfos) {
|
||||||
|
Object filterConfig = getFieldValue(servletFilterMappingInfo, "filterConfig");
|
||||||
|
String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null);
|
||||||
|
if (!aggregatedData.containsKey(filterName)) {
|
||||||
|
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
|
||||||
|
Map<String, Object> info = new HashMap<>();
|
||||||
|
info.put("filterName", filterName);
|
||||||
|
info.put("filterClass", filterClassName);
|
||||||
|
info.put("urlPatterns", new LinkedHashSet<>());
|
||||||
|
info.put("servletNames", new LinkedHashSet<>());
|
||||||
|
aggregatedData.put(filterName, info);
|
||||||
|
}
|
||||||
|
Map<String, Object> info = aggregatedData.get(filterName);
|
||||||
|
String servletName = (String) invokeMethod(invokeMethod(servletFilterMappingInfo, "getServletConfig"), "getServletName");
|
||||||
|
if (servletName != null && !servletName.isEmpty()) {
|
||||||
|
((Set) info.get("servletNames")).add(servletName);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} catch (Throwable throwable) {
|
} catch (Throwable throwable) {
|
||||||
throwable.printStackTrace();
|
|
||||||
// WebLogic 10.3.6
|
// WebLogic 10.3.6
|
||||||
List uriFilterMappings = (List) getFieldValue(filterManager, "_uriFilterMappings");
|
List uriFilterMappings = (List) getFieldValue(filterManager, "_uriFilterMappings");
|
||||||
for (Object uriFilterMapping : uriFilterMappings) {
|
for (Object uriFilterMapping : uriFilterMappings) {
|
||||||
String filterName = (String) getFieldValue(uriFilterMapping, "_filterName");
|
String filterName = (String) getFieldValue(uriFilterMapping, "_filterName");
|
||||||
String urlPattern = (String) getFieldValue(uriFilterMapping, "_filterURI");
|
|
||||||
if (!aggregatedData.containsKey(filterName)) {
|
if (!aggregatedData.containsKey(filterName)) {
|
||||||
Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName});
|
Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName});
|
||||||
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
|
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
|
||||||
Map<String, Object> info = new HashMap<>();
|
Map<String, Object> info = new HashMap<>();
|
||||||
info.put("filterName", filterName);
|
info.put("filterName", filterName);
|
||||||
info.put("filterClass", filterClassName);
|
info.put("filterClass", filterClassName);
|
||||||
LinkedHashSet<String> urlPatterns = new LinkedHashSet<>();
|
info.put("urlPatterns", new LinkedHashSet<>());
|
||||||
if (urlPattern != null && !urlPattern.isEmpty()) {
|
info.put("servletNames", new LinkedHashSet<>());
|
||||||
urlPatterns.add(urlPattern);
|
|
||||||
}
|
|
||||||
info.put("urlPatterns", urlPatterns);
|
|
||||||
aggregatedData.put(filterName, info);
|
aggregatedData.put(filterName, info);
|
||||||
} else {
|
}
|
||||||
if (urlPattern != null && !urlPattern.isEmpty()) {
|
Map<String, Object> info = aggregatedData.get(filterName);
|
||||||
((Set) aggregatedData.get(filterName).get("urlPatterns")).add(urlPattern);
|
String urlPattern = (String) getFieldValue(uriFilterMapping, "_filterURI");
|
||||||
}
|
if (urlPattern != null && !urlPattern.isEmpty()) {
|
||||||
|
((Set) info.get("urlPatterns")).add(urlPattern);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
List servletFilterMappings = (List) getFieldValue(filterManager, "_servletFilterMappings");
|
||||||
|
for (Object servletFilterMapping : servletFilterMappings) {
|
||||||
|
String filterName = (String) getFieldValue(servletFilterMapping, "_filterName");
|
||||||
|
if (!aggregatedData.containsKey(filterName)) {
|
||||||
|
Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName});
|
||||||
|
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
|
||||||
|
Map<String, Object> info = new HashMap<>();
|
||||||
|
info.put("filterName", filterName);
|
||||||
|
info.put("filterClass", filterClassName);
|
||||||
|
info.put("urlPatterns", new LinkedHashSet<>());
|
||||||
|
info.put("servletNames", new LinkedHashSet<>());
|
||||||
|
aggregatedData.put(filterName, info);
|
||||||
|
}
|
||||||
|
Map<String, Object> info = aggregatedData.get(filterName);
|
||||||
|
String servletName = (String) getFieldValue(servletFilterMapping, "_filterServlet");
|
||||||
|
if (servletName != null && !servletName.isEmpty()) {
|
||||||
|
((Set) info.get("servletNames")).add(servletName);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -108,7 +133,9 @@ public class WebSphereFilterProbe {
|
|||||||
finalInfo.put("filterName", (String) entry.get("filterName"));
|
finalInfo.put("filterName", (String) entry.get("filterName"));
|
||||||
finalInfo.put("filterClass", (String) entry.get("filterClass"));
|
finalInfo.put("filterClass", (String) entry.get("filterClass"));
|
||||||
Set<?> urls = (Set<?>) entry.get("urlPatterns");
|
Set<?> urls = (Set<?>) entry.get("urlPatterns");
|
||||||
finalInfo.put("urlPatterns", urls.isEmpty() ? "[/*]" : Arrays.toString(urls.toArray()));
|
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
|
||||||
|
Set<?> servletNames = (Set<?>) entry.get("servletNames");
|
||||||
|
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
|
||||||
result.add(finalInfo);
|
result.add(finalInfo);
|
||||||
}
|
}
|
||||||
return result;
|
return result;
|
||||||
@@ -130,6 +157,7 @@ public class WebSphereFilterProbe {
|
|||||||
appendIfPresent(output, "", info.get("filterName"), "");
|
appendIfPresent(output, "", info.get("filterName"), "");
|
||||||
appendIfPresent(output, " -> ", info.get("filterClass"), "");
|
appendIfPresent(output, " -> ", info.get("filterClass"), "");
|
||||||
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
|
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
|
||||||
|
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
|
||||||
output.append("\n");
|
output.append("\n");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -208,6 +236,10 @@ public class WebSphereFilterProbe {
|
|||||||
return contexts;
|
return contexts;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public static Object invokeMethod(Object obj, String methodName) {
|
||||||
|
return invokeMethod(obj, methodName, null, null);
|
||||||
|
}
|
||||||
|
|
||||||
@SuppressWarnings("all")
|
@SuppressWarnings("all")
|
||||||
public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
|
public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
|
||||||
try {
|
try {
|
||||||
|
|||||||
-20
@@ -34,24 +34,4 @@ public class DetectionTool {
|
|||||||
public static String getServerDetection() {
|
public static String getServerDetection() {
|
||||||
return getBase64Class(ServerProbe.class);
|
return getBase64Class(ServerProbe.class);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static String getResinFilterProbe() {
|
|
||||||
return getBase64Class(ResinFilterProbe.class);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static String getUndertowFilterProbe() {
|
|
||||||
return getBase64Class(UndertowFilterProbe.class);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static String getApusicFilterProbe() {
|
|
||||||
return getBase64Class(ApusicFilterProbe.class);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static String getWebLogicFilterProbe() {
|
|
||||||
return getBase64Class(WebLogicFilterProbe.class);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static String getWebSphereFilterProbe() {
|
|
||||||
return getBase64Class(WebSphereFilterProbe.class);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
+8
-8
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
@@ -81,20 +84,17 @@ public class Resin3116ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers")));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
+8
-8
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
@@ -86,20 +89,17 @@ public class Resin318ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers")));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
+8
-8
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
@@ -80,20 +83,17 @@ public class Resin4058ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers")));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
+8
-8
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
@@ -80,20 +83,17 @@ public class Resin4067ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrl(container);
|
String url = getUrl(container);
|
||||||
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers")));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
+8
-13
@@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
import org.junit.jupiter.api.AfterAll;
|
import org.junit.jupiter.api.AfterAll;
|
||||||
import org.junit.jupiter.api.Test;
|
import org.junit.jupiter.api.Test;
|
||||||
import org.testcontainers.containers.BindMode;
|
|
||||||
import org.testcontainers.containers.GenericContainer;
|
import org.testcontainers.containers.GenericContainer;
|
||||||
import org.testcontainers.containers.wait.strategy.Wait;
|
import org.testcontainers.containers.wait.strategy.Wait;
|
||||||
import org.testcontainers.junit.jupiter.Container;
|
import org.testcontainers.junit.jupiter.Container;
|
||||||
@@ -27,8 +28,6 @@ import java.util.List;
|
|||||||
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
||||||
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
||||||
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
||||||
import static org.hamcrest.CoreMatchers.*;
|
|
||||||
import static org.hamcrest.MatcherAssert.assertThat;
|
|
||||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -91,21 +90,17 @@ public class OpenLiberty18ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+8
-12
@@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
import org.junit.jupiter.api.AfterAll;
|
import org.junit.jupiter.api.AfterAll;
|
||||||
import org.junit.jupiter.api.Test;
|
import org.junit.jupiter.api.Test;
|
||||||
import org.testcontainers.containers.BindMode;
|
|
||||||
import org.testcontainers.containers.GenericContainer;
|
import org.testcontainers.containers.GenericContainer;
|
||||||
import org.testcontainers.containers.wait.strategy.Wait;
|
import org.testcontainers.containers.wait.strategy.Wait;
|
||||||
import org.testcontainers.junit.jupiter.Container;
|
import org.testcontainers.junit.jupiter.Container;
|
||||||
@@ -27,8 +28,6 @@ import java.util.List;
|
|||||||
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
||||||
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
||||||
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
||||||
import static org.hamcrest.CoreMatchers.*;
|
|
||||||
import static org.hamcrest.MatcherAssert.assertThat;
|
|
||||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -91,21 +90,18 @@ public class OpenLiberty20ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
log.info(data);
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+8
-13
@@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import net.bytebuddy.jar.asm.Opcodes;
|
import net.bytebuddy.jar.asm.Opcodes;
|
||||||
import org.junit.jupiter.api.AfterAll;
|
import org.junit.jupiter.api.AfterAll;
|
||||||
import org.junit.jupiter.api.Test;
|
import org.junit.jupiter.api.Test;
|
||||||
import org.testcontainers.containers.BindMode;
|
|
||||||
import org.testcontainers.containers.GenericContainer;
|
import org.testcontainers.containers.GenericContainer;
|
||||||
import org.testcontainers.containers.wait.strategy.Wait;
|
import org.testcontainers.containers.wait.strategy.Wait;
|
||||||
import org.testcontainers.junit.jupiter.Container;
|
import org.testcontainers.junit.jupiter.Container;
|
||||||
@@ -27,8 +28,6 @@ import java.util.List;
|
|||||||
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
||||||
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
||||||
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
||||||
import static org.hamcrest.CoreMatchers.*;
|
|
||||||
import static org.hamcrest.MatcherAssert.assertThat;
|
|
||||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -91,21 +90,17 @@ public class OpenLiberty22ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+8
-9
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.utils.CommonUtil;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
@@ -91,21 +94,17 @@ public class OpenLiberty25ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+10
-10
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.utils.CommonUtil;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
@@ -26,7 +29,8 @@ import java.util.List;
|
|||||||
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
|
||||||
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
import static com.reajason.javaweb.integration.ContainerTool.warFile;
|
||||||
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
|
||||||
import static org.hamcrest.CoreMatchers.*;
|
import static org.hamcrest.CoreMatchers.anyOf;
|
||||||
|
import static org.hamcrest.CoreMatchers.startsWith;
|
||||||
import static org.hamcrest.MatcherAssert.assertThat;
|
import static org.hamcrest.MatcherAssert.assertThat;
|
||||||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||||||
|
|
||||||
@@ -89,21 +93,17 @@ public class WebSphere855ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+8
-9
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.utils.CommonUtil;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
@@ -85,21 +88,17 @@ public class WebSphere905ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
+9
-9
@@ -2,15 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere7;
|
|||||||
|
|
||||||
import com.reajason.javaweb.Server;
|
import com.reajason.javaweb.Server;
|
||||||
import com.reajason.javaweb.integration.ProbeAssertion;
|
import com.reajason.javaweb.integration.ProbeAssertion;
|
||||||
|
import com.reajason.javaweb.integration.ShellAssertion;
|
||||||
import com.reajason.javaweb.integration.VulTool;
|
import com.reajason.javaweb.integration.VulTool;
|
||||||
import com.reajason.javaweb.integration.probe.DetectionTool;
|
import com.reajason.javaweb.integration.probe.DetectionTool;
|
||||||
|
import com.reajason.javaweb.memshell.MemShellResult;
|
||||||
import com.reajason.javaweb.memshell.ShellTool;
|
import com.reajason.javaweb.memshell.ShellTool;
|
||||||
import com.reajason.javaweb.memshell.ShellType;
|
import com.reajason.javaweb.memshell.ShellType;
|
||||||
import com.reajason.javaweb.packer.Packers;
|
import com.reajason.javaweb.packer.Packers;
|
||||||
|
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
|
||||||
import com.reajason.javaweb.utils.CommonUtil;
|
import com.reajason.javaweb.utils.CommonUtil;
|
||||||
import lombok.SneakyThrows;
|
import lombok.SneakyThrows;
|
||||||
import lombok.extern.slf4j.Slf4j;
|
import lombok.extern.slf4j.Slf4j;
|
||||||
import org.junit.jupiter.api.Test;
|
import org.junit.jupiter.api.Test;
|
||||||
|
import org.objectweb.asm.Opcodes;
|
||||||
import org.testcontainers.containers.BindMode;
|
import org.testcontainers.containers.BindMode;
|
||||||
import org.testcontainers.containers.GenericContainer;
|
import org.testcontainers.containers.GenericContainer;
|
||||||
import org.testcontainers.containers.wait.strategy.Wait;
|
import org.testcontainers.containers.wait.strategy.Wait;
|
||||||
@@ -70,21 +74,17 @@ public class WebSphere700ContainerTest {
|
|||||||
@Test
|
@Test
|
||||||
void testFilterProbe() {
|
void testFilterProbe() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
System.out.println(data);
|
ShellAssertion.assertFilterProbeIsRight(data);
|
||||||
assertThat(data, anyOf(
|
|
||||||
containsString("Context: ")
|
|
||||||
));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
void testFilterFirstInject() {
|
void testFilterFirstInject() {
|
||||||
String url = getUrlFromWAS(container);
|
String url = getUrlFromWAS(container);
|
||||||
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
|
MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
|
||||||
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe());
|
String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
|
||||||
log.info(data);
|
|
||||||
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
|
||||||
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
String filterName = ProbeAssertion.extractFilterName(filter.get(0));
|
||||||
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere))));
|
assertEquals(filterName, memShellResult.getShellClassName());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user