archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-21 22:50:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support more expression packer

Browse Source
This commit is contained in:
ReaJason
2025-01-29 22:05:25 +08:00
parent 410ee1eff7
commit c808a52d4e
19 changed files with 400 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java
+4
View File
@@ -147,6 +147,10 @@ public class ShellAssertionTool {
case SpEL -> VulTool.postData(url + "/spel", content);
case OGNL -> VulTool.postData(url + "/ognl", content);
case MVEL -> VulTool.postData(url + "/mvel", content);
case JXPath -> VulTool.postData(url + "/jxpath", content);
case JEXL -> VulTool.postData(url + "/jexl2", content);
case Aviator -> VulTool.postData(url + "/aviator", content);
case Groovy -> VulTool.postData(url + "/groovy", content);
case Freemarker -> VulTool.postData(url + "/freemarker", content);
case Velocity -> VulTool.postData(url + "/velocity", content);
case Deserialize -> VulTool.postData(url + "/java_deserialize", content);
integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java
+1 -7
View File
@@ -34,7 +34,7 @@ public class Tomcat8ContainerTest {
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warExpressionFile, "/usr/local/tomcat/webapps/app.war")
.withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war")
.withCopyToContainer(jattachFile, "/jattach")
.withCopyToContainer(tomcatPid, "/fetch_pid.sh")
.waitingFor(Wait.forHttp("/app"))
@@ -78,12 +78,6 @@ public class Tomcat8ContainerTest {
arguments(imageName, Constants.VALVE, ShellTool.Command, Packers.JSP),
arguments(imageName, Constants.VALVE, ShellTool.Command, Packers.ScriptEngine),
arguments(imageName, Constants.VALVE, ShellTool.Command, Packers.Deserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.EL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.OGNL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.SpEL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.MVEL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Freemarker),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Velocity),
arguments(imageName, Constants.AGENT_FILTER_CHAIN, ShellTool.Command, Packers.AgentJar),
arguments(imageName, Constants.AGENT_FILTER_CHAIN, ShellTool.Godzilla, Packers.AgentJar),
arguments(imageName, Constants.AGENT_FILTER_CHAIN, ShellTool.Behinder, Packers.AgentJar),
integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ExpressionContainerTest.java
+69
View File
@@ -0,0 +1,69 @@
package com.reajason.javaweb.integration.tomcat;
import com.reajason.javaweb.memshell.config.Constants;
import com.reajason.javaweb.memshell.config.Server;
import com.reajason.javaweb.memshell.config.ShellTool;
import com.reajason.javaweb.memshell.packer.Packers;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.util.stream.Stream;
import static com.reajason.javaweb.integration.ContainerTool.*;
import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.params.provider.Arguments.arguments;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Tomcat8ExpressionContainerTest {
public static final String imageName = "tomcat:8-jre8";
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(warExpressionFile, "/usr/local/tomcat/webapps/app.war")
.withCopyToContainer(jattachFile, "/jattach")
.withCopyToContainer(tomcatPid, "/fetch_pid.sh")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
static Stream<Arguments> casesProvider() {
return Stream.of(
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.EL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.OGNL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.MVEL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.SpEL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JEXL),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JXPath),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Aviator),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Groovy),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Freemarker),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Velocity)
);
}
@AfterAll
static void tearDown() {
String logs = container.getLogs();
assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
}
@ParameterizedTest(name = "{0}-expression|{1}{2}|{3}")
@MethodSource("casesProvider")
void test(String imageName, String shellType, ShellTool shellTool, Packers packer) {
testShellInjectAssertOk(getUrl(container), Server.Tomcat, shellType, shellTool, Opcodes.V1_8, packer, container);
}
}