revert: obfuscation (#13)

bom/build.gradle

@@ -6,7 +6,6 @@ dependencies {
     constraints {
         api 'net.bytebuddy:byte-buddy:1.17.5'
         api 'org.ow2.asm:asm-commons:9.7.1'
-        api 'com.github.jar-analyzer:class-obf:1.5.0'
 
         api 'javax.servlet:javax.servlet-api:3.0.1'
         api 'jakarta.servlet:jakarta.servlet-api:6.0.0'

build.gradle

@@ -12,6 +12,10 @@ allprojects {
             implementation platform(project(':bom'))
         }
     }
+
+    repositories {
+        mavenCentral()
+    }
 }
 
 idea {

generator/build.gradle

@@ -40,7 +40,6 @@ dependencies {
     implementation project(":memshell-java8")
     implementation 'net.bytebuddy:byte-buddy'
     implementation 'org.ow2.asm:asm-commons'
-    implementation 'com.github.jar-analyzer:class-obf'
 
     implementation 'javax.servlet:javax.servlet-api'
     implementation 'javax.websocket:javax.websocket-api'

generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java

@@ -4,8 +4,6 @@ import com.reajason.javaweb.memshell.config.*;
 import com.reajason.javaweb.memshell.generator.*;
 import com.reajason.javaweb.memshell.server.AbstractShell;
 import com.reajason.javaweb.memshell.utils.CommonUtil;
-import me.n1ar4.clazz.obfuscator.api.ClassObf;
-import me.n1ar4.clazz.obfuscator.config.BaseConfig;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
 
@@ -48,39 +46,12 @@ public class MemShellGenerator {
 
         byte[] shellBytes = generateShellBytes(shellConfig, shellToolConfig);
 
-        if (shellConfig.isObfuscate()) {
-            BaseConfig config = BaseConfig.Default();
-            config.setIgnorePublic(true);
-            config.setEnableMethodName(false);
-            config.setEnableFieldName(false);
-            config.setEnableAES(false);
-            config.setEnableAdvanceString(false);
-            config.setQuiet(true);
-
-            ClassObf classObf = new ClassObf(config);
-            shellBytes = classObf.run(shellBytes).getData();
-        }
-
         injectorConfig.setInjectorClass(injectorClass);
         injectorConfig.setShellClassName(shellToolConfig.getShellClassName());
         injectorConfig.setShellClassBytes(shellBytes);
 
         InjectorGenerator injectorGenerator = new InjectorGenerator(shellConfig, injectorConfig);
         byte[] injectorBytes = injectorGenerator.generate();
-
-        if (shellConfig.isObfuscate()) {
-            BaseConfig config = BaseConfig.Default();
-            config.setIgnorePublic(true);
-            config.setEnableMethodName(false);
-            config.setEnableFieldName(false);
-            config.setEnableAES(false);
-            config.setEnableAdvanceString(false);
-            config.setQuiet(true);
-
-            ClassObf classObf = new ClassObf(config);
-            injectorBytes = classObf.run(injectorBytes).getData();
-        }
-
         Map<String, byte[]> innerClassBytes = injectorGenerator.getInnerClassBytes();
 
         return GenerateResult.builder()

generator/src/main/java/com/reajason/javaweb/memshell/config/ShellConfig.java

@@ -45,12 +45,6 @@ public class ShellConfig {
     @Builder.Default
     private boolean byPassJavaModule = false;
 
-    /**
-     * 是否开启混淆
-     */
-    @Builder.Default
-    private boolean obfuscate = false;
-
     /**
      * 是否开启调试
      */

generator/src/test/java/com/reajason/javaweb/memshell/shelltool/command/CommandFilterChainASMTest.java

@@ -6,9 +6,6 @@ import com.reajason.javaweb.memshell.shelltool.FilterChainInterface;
 import com.reajason.javaweb.memshell.shelltool.TestFilterChain;
 import com.reajason.javaweb.util.ClassUtils;
 import lombok.SneakyThrows;
-import me.n1ar4.clazz.obfuscator.api.ClassObf;
-import me.n1ar4.clazz.obfuscator.api.Result;
-import me.n1ar4.clazz.obfuscator.config.BaseConfig;
 import org.apache.commons.io.IOUtils;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -65,15 +62,6 @@ public class CommandFilterChainASMTest {
         };
         cr.accept(cv, ClassReader.EXPAND_FRAMES);
         byte[] bytes2 = ClassRenameUtils.renameClass(cw.toByteArray(), TestFilterChain.class.getName() + "Asm");
-        BaseConfig config = BaseConfig.Default();
-        config.setIgnorePublic(true);
-        config.setEnableMethodName(false);
-        config.setEnableParamName(false);
-        config.setEnableAES(false);
-        config.setEnableAdvanceString(false);
-        ClassObf classObf = new ClassObf(config);
-        Result run = classObf.run(bytes2);
-        bytes2 = run.getData();
         IOUtils.write(bytes2, new FileOutputStream(new File("godzilla2.class")));
         Class<?> clazz = ClassUtils.defineClass(bytes2);
         instance = spy(clazz.newInstance());

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -232,16 +232,8 @@ public class ShellAssertionTool {
                 .targetJreVersion(targetJdkVersion)
                 .debug(true)
                 .shrink(true)
-                .obfuscate(true)
                 .build();
 
-        if (ShellTool.NeoreGeorg.equals(shellTool)) {
-            shellConfig.setObfuscate(false);
-        }
-        if (Server.Jetty.equals(server) && ShellType.FILTER.equals(shellType) && ShellTool.Suo5.equals(shellTool)) {
-            shellConfig.setObfuscate(false);
-        }
-
         ShellToolConfig shellToolConfig = null;
         String uniqueName = shellTool + RandomStringUtils.randomAlphabetic(5) + shellType + RandomStringUtils.randomAlphabetic(5) + packer.name();
         switch (shellTool) {
@@ -332,8 +324,6 @@ public class ShellAssertionTool {
             case JavaCommonsBeanutils18 -> VulTool.postData(url + "/java_deserialize/cb183", content);
             case JavaCommonsBeanutils19 -> VulTool.postData(url + "/java_deserialize/cb194", content);
             case JavaCommonsBeanutils110 -> VulTool.postData(url + "/java_deserialize/cb110", content);
-            case JavaCommonsCollections3 -> VulTool.postData(url + "/java_deserialize/cc321", content);
-            case JavaCommonsCollections4 -> VulTool.postData(url + "/java_deserialize/cc40", content);
             case HessianDeserialize -> VulTool.postData(url + "/hessian", content);
             case Hessian2Deserialize -> VulTool.postData(url + "/hessian2", content);
             case Base64 -> VulTool.postData(url + "/b64", content);

memshell-agent/memshell-agent-asm/build.gradle

@@ -6,6 +6,10 @@ plugins {
 group = 'com.reajason.javaweb'
 version = '1.0.0'
 
+repositories {
+    mavenCentral()
+}
+
 java {
     toolchain {
         languageVersion = JavaLanguageVersion.of(8)

settings.gradle

@@ -2,14 +2,6 @@ plugins {
     id 'org.gradle.toolchains.foojay-resolver-convention' version '0.9.0'
 }
 
-dependencyResolutionManagement {
-    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
-    repositories {
-        mavenCentral()
-        maven { url 'https://jitpack.io' }
-    }
-}
-
 rootProject.name = 'MemShellParty'
 
 include 'bom'

vul/vul-springboot1/build.gradle

@@ -8,6 +8,10 @@ java {
     sourceCompatibility = JavaVersion.VERSION_1_8
 }
 
+repositories {
+    mavenCentral()
+}
+
 configurations {
     providedRuntime
 }

vul/vul-springboot2/build.gradle

@@ -9,6 +9,10 @@ java {
     sourceCompatibility = JavaVersion.VERSION_1_8
 }
 
+repositories {
+    mavenCentral()
+}
+
 dependencies {
     implementation 'org.springframework.boot:spring-boot-starter-web'
     implementation 'commons-io:commons-io:2.+'

web/src/components/main-config-card.tsx

@@ -287,18 +287,6 @@ export function MainConfigCard({
                 </FormItem>
               )}
             />
-            <FormField
-              control={form.control}
-              name="obfuscate"
-              render={({ field }) => (
-                <FormItem className="flex items-center space-x-2 space-y-0">
-                  <FormControl>
-                    <Switch id="obfuscate" checked={field.value} onCheckedChange={field.onChange} />
-                  </FormControl>
-                  <Label htmlFor="obfuscate">{t("mainConfig.obfuscate")}</Label>
-                </FormItem>
-              )}
-            />
           </div>
         </CardContent>
       </Card>

web/src/i18n/en.json

@@ -37,8 +37,7 @@
     "shellMountType": "Shell Mount Type",
     "shellTool": "Shell Tool",
     "shrink": "Shrink Bytecode",
-    "urlPattern": "URL Pattern",
+    "urlPattern": "URL Pattern"
-    "obfuscate": "Obfuscate"
   },
   "optional": "(Optional)",
   "packageConfig": {
@@ -131,9 +130,7 @@
     "targetServerRequest": "Request",
     "try-to-use-shell": "Try to use the memory shell",
     "waitingForGeneration": "// Waiting for generation...",
-    "customShellClass": "Custom shell class is required, base64 or classfile",
+    "customShellClass": "Custom shell class is required, base64 or classfile"
-    "neoreGeorgObfuscate": "Do not support obfuscate for NeoreGeorg",
-    "jettyFilter": "Do not support obfuscate for Jetty Filter Suo5"
   },
   "version": {
     "updateAvailable": "Update Available",

web/src/i18n/zh-CN.json

@@ -37,8 +37,7 @@
     "shellMountType": "内存马挂载类型",
     "shellTool": "内存马功能",
     "shrink": "缩小字节码",
-    "urlPattern": "请求路径",
+    "urlPattern": "请求路径"
-    "obfuscate": "代码混淆"
   },
   "optional": "(可选)",
   "packageConfig": {
@@ -131,9 +130,7 @@
     "targetServerRequest": "请求适配",
     "try-to-use-shell": "尝试利用内存马",
     "waitingForGeneration": "// 等待填写参数生成中...",
-    "customShellClass": "请输入自定义内存马类，base64 或类文件",
+    "customShellClass": "请输入自定义内存马类，base64 或类文件"
-    "neoreGeorgObfuscate": "NeoreGeorg 目前不支持代码混淆",
-    "jettyFilter": "Jetty Filter Suo5 暂时不支持代码混淆"
   },
   "version": {
     "updateAvailable": "有可用升级",

web/src/routes/index.tsx

@@ -87,16 +87,6 @@ function IndexComponent() {
       toast.warning(t("tips.customShellClass"));
       return false;
     }
-
-    if (values.obfuscate && values.shellTool === ShellToolType.NeoreGeorg) {
-      toast.warning(t("tips.neoreGeorgObfuscate"));
-      return false;
-    }
-
-    if (values.obfuscate && values.server === "Jetty" && values.shellType === "Filter") {
-      toast.warning(t("tips.jettyFilter"));
-      return false;
-    }
     return true;
   }
 

web/src/types/schema.ts

@@ -19,7 +19,6 @@ export const formSchema = z.object({
   injectorClassName: z.optional(z.string()),
   packingMethod: z.string().min(1),
   shrink: z.optional(z.boolean()),
-  obfuscate: z.optional(z.boolean()),
   shellClassBase64: z.optional(z.string()),
 });
 

web/src/utils/transformer.ts

@@ -10,7 +10,6 @@ export function transformToPostData(formValue: FormSchema) {
     targetJreVersion: formValue.targetJdkVersion,
     byPassJavaModule: formValue.bypassJavaModule,
     shrink: formValue.shrink,
-    obfuscate: formValue.obfuscate,
   };
   const shellToolConfig: ShellToolConfig = {
     shellClassName: formValue.shellClassName,