test: add CB4 multi version gadgets integration test

2026-09-22 15:10:43 +08:00 · 2025-02-19 22:21:17 +08:00
parent 7d567beba9
commit 41d2ea5c6d
22 changed files with 429 additions and 1 deletions
@@ -0,0 +1,51 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.*;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.Base64;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public abstract class BaseDeserializeServlet extends HttpServlet {
+
+    abstract List<String> getDependentPaths();
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        try {
+            String libPath = getServletContext().getRealPath("/WEB-INF/dep");
+            URL[] urls = getDependentPaths().stream().map(path -> {
+                try {
+                    return new File(libPath + File.separator + path).toURI().toURL();
+                } catch (MalformedURLException e) {
+                    throw new RuntimeException(e);
+                }
+            }).toArray(URL[]::new);
+
+            final URLClassLoader classLoader = new URLClassLoader(urls);
+
+            String data = req.getParameter("data");
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(Base64.getDecoder().decode(data));
+            ObjectInputStream bis = new ObjectInputStream(inputStream) {
+                @Override
+                protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
+                    return Class.forName(desc.getName(), false, classLoader);
+                }
+            };
+            bis.readObject();
+            bis.close();
+        } catch (Exception e) {
+            if (e.getMessage().contains("InvocationTargetException")) {
+                return;
+            }
+            throw new RuntimeException(e);
+        }
+    }
+}
@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb110")
+public class JavaReadObCB110jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.10.0.jar", "commons-collections-3.2.2.jar", "commons-logging-1.3.4.jar");
+    }
+
+}
@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb161")
+public class JavaReadObCB161jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.6.1.jar", "commons-collections-2.0.jar", "commons-logging-1.0.jar");
+    }
+
+}
@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb170")
+public class JavaReadObCB170jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.7.0.jar", "commons-logging-1.0.3.jar");
+    }
+
+}
@@ -0,0 +1,17 @@
+import javax.servlet.annotation.WebServlet;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb183")
+public class JavaReadObCB183jServlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.8.3.jar", "commons-logging-1.1.1.jar");
+    }
+
+}
@@ -0,0 +1,24 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+@WebServlet("/java_deserialize/cb194")
+public class JavaReadObjCB194Servlet extends BaseDeserializeServlet {
+
+    @Override
+    List<String> getDependentPaths() {
+        return Arrays.asList("commons-beanutils-1.9.4.jar", "commons-logging-1.2.jar");
+    }
+}
@@ -0,0 +1,22 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+@WebServlet("/test")
+public class TestServlet extends HttpServlet {
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+    }
+}
@@ -0,0 +1,9 @@
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
+		 http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
+         version="3.1">
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
+</web-app>
@@ -0,0 +1 @@
+<h1>hello</h1>