archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support more expression packer

Browse Source
This commit is contained in:
ReaJason
2025-01-29 22:05:25 +08:00
parent 828b7b8400
commit 84b884a3d8
19 changed files with 400 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vul/vul-webapp-expression/build.gradle
+14 -2
View File
@@ -9,8 +9,8 @@ java {
toolchain {
languageVersion = JavaLanguageVersion.of(8)
}
sourceCompatibility = JavaVersion.VERSION_1_6
targetCompatibility = JavaVersion.VERSION_1_6
sourceCompatibility = JavaVersion.VERSION_1_8
targetCompatibility = JavaVersion.VERSION_1_8
}
dependencies {
@@ -22,7 +22,19 @@ dependencies {
implementation 'org.apache.velocity:velocity:1.7'
implementation 'ognl:ognl:2.7.3'
implementation 'org.mvel:mvel2:2.4.7.Final'
implementation 'org.apache.commons:commons-jexl:2.1.1'
implementation 'org.apache.commons:commons-jexl3:3.2.1'
implementation 'commons-jxpath:commons-jxpath:1.3'
implementation 'com.googlecode.aviator:aviator:5.2.7'
implementation 'org.codehaus.groovy:groovy:3.0.6'
implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
providedCompile 'de.odysseus.juel:juel-api:2.2.7'
providedCompile "javax.servlet:servlet-api:2.5"
testImplementation platform('org.junit:junit-bom:5.11.4')
testImplementation 'org.junit.jupiter:junit-jupiter'
}
test {
useJUnitPlatform()
}
vul/vul-webapp-expression/src/main/java/AviatorServlet.java
+22
View File
@@ -0,0 +1,22 @@
import com.googlecode.aviator.AviatorEvaluator;
import com.googlecode.aviator.AviatorEvaluatorInstance;
import groovy.lang.GroovyShell;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class AviatorServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
AviatorEvaluatorInstance evaluator = AviatorEvaluator.newInstance();
resp.getWriter().println(evaluator.execute(data));
}
}
vul/vul-webapp-expression/src/main/java/GroovyServlet.java
+20
View File
@@ -0,0 +1,20 @@
import groovy.lang.GroovyShell;
import ognl.OgnlContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class GroovyServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
resp.getWriter().println(new GroovyShell().evaluate(data));
}
}
vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java
+24
View File
@@ -0,0 +1,24 @@
import org.apache.commons.jexl2.Expression;
import org.apache.commons.jexl2.JexlEngine;
import org.apache.commons.jexl2.MapContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class JEXL2Servlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
JexlEngine jexl = new JexlEngine();
Expression e = jexl.createExpression(data);
MapContext jc = new MapContext();
resp.getWriter().println(e.evaluate(jc));
}
}
vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java
+26
View File
@@ -0,0 +1,26 @@
import org.apache.commons.jexl3.JexlBuilder;
import org.apache.commons.jexl3.JexlEngine;
import org.apache.commons.jexl3.JexlExpression;
import org.apache.commons.jexl3.MapContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class JEXL3Servlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
JexlEngine jexl = new JexlBuilder().create();
JexlExpression e = jexl.createExpression(data);
MapContext jc = new MapContext();
resp.getWriter().println(e.evaluate(jc));
}
}
vul/vul-webapp-expression/src/main/java/JXPathServlet.java
+21
View File
@@ -0,0 +1,21 @@
import groovy.lang.GroovyShell;
import org.apache.commons.jxpath.JXPathContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/14
*/
public class JXPathServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
JXPathContext context = JXPathContext.newContext(null);
resp.getWriter().println(context.getValue(data ));
}
}
vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml
+45
View File
@@ -81,6 +81,51 @@
<url-pattern>/mvel</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>groovy</servlet-name>
<servlet-class>GroovyServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>groovy</servlet-name>
<url-pattern>/groovy</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>jexl2</servlet-name>
<servlet-class>JEXL2Servlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>jexl2</servlet-name>
<url-pattern>/jexl2</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>jexl3</servlet-name>
<servlet-class>JEXL3Servlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>jexl3</servlet-name>
<url-pattern>/jexl3</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>jxpath</servlet-name>
<servlet-class>JXPathServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>jxpath</servlet-name>
<url-pattern>/jxpath</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>aviator</servlet-name>
<servlet-class>AviatorServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>aviator</servlet-name>
<url-pattern>/aviator</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>velocity</servlet-name>
<servlet-class>VelocityServlet</servlet-class>
vul/vul-webapp-expression/src/test/java/AviatorServletTest.java
+18
View File
@@ -0,0 +1,18 @@
import com.googlecode.aviator.AviatorEvaluator;
import com.googlecode.aviator.AviatorEvaluatorInstance;
import org.junit.jupiter.api.Test;
import org.springframework.util.ClassUtils;
/**
* @author ReaJason
* @since 2025/1/29
*/
class AviatorServletTest {
@Test
void test() {
String exp = "use org.springframework.cglib.core.*;use org.springframework.util.*;ReflectionUtils.invokeMethod(ClassUtils.getMethod(Class.forName('java.lang.Thread'), 'getContextClassLoader', nil), Thread.currentThread())";
AviatorEvaluatorInstance evaluator = AviatorEvaluator.newInstance();
System.out.println(evaluator.execute(exp));
}
}
vul/vul-webapp-expression/src/test/java/GroovyServletTest.java
+16
View File
File diff suppressed because one or more lines are too long
vul/vul-webapp-expression/src/test/java/JEXL2ServletTest.java
+18
View File
@@ -0,0 +1,18 @@
import org.apache.commons.jexl2.Expression;
import org.junit.jupiter.api.Test;
/**
* @author ReaJason
* @since 2025/1/29
*/
class JEXL2ServletTest {
@Test
void test() {
System.out.println(System.getProperty("java.version"));
org.apache.commons.jexl2.JexlEngine jexl = new org.apache.commons.jexl2.JexlEngine();
Expression e = jexl.createExpression("''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js')");
org.apache.commons.jexl2.MapContext jc = new org.apache.commons.jexl2.MapContext();
System.out.println(e.evaluate(jc));
}
}
vul/vul-webapp-expression/src/test/java/JEXL3ServletTest.java
+19
View File
@@ -0,0 +1,19 @@
import org.apache.commons.jexl2.Expression;
import org.apache.commons.jexl3.*;
import org.junit.jupiter.api.Test;
/**
* @author ReaJason
* @since 2025/1/29
*/
class JEXL3ServletTest {
@Test
void test() {
System.out.println(System.getProperty("java.version"));
JexlEngine jexl = new JexlBuilder().create();
JexlExpression e = jexl.createExpression("''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js')");
JexlContext jc = new MapContext();
System.out.println(e.evaluate(jc));
}
}