archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 23:11:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support struct2 memshell and probeshell

Browse Source
This commit is contained in:
ReaJason
2025-12-10 02:09:13 +08:00
parent e41f8347c6
commit d7a67b3056
32 changed files with 2270 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/ContainerTool.java
+1
View File
@@ -16,6 +16,7 @@ public class ContainerTool {
public static final MountableFile warExpressionFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-webapp-expression", "build", "libs", "vul-webapp-expression.war").toAbsolutePath());
public static final MountableFile warDeserializeFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-webapp-deserialize", "build", "libs", "vul-webapp-deserialize.war").toAbsolutePath());
public static final MountableFile warFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-webapp", "build", "libs", "vul-webapp.war").toAbsolutePath());
public static final MountableFile struct2WarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-struct2", "build", "libs", "vul-struct2.war").toAbsolutePath());
public static final MountableFile springBoot2WarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot2", "build", "libs", "vul-springboot2.war").toAbsolutePath());
public static final Path neoGeorgDockerfile = Path.of("..", "asserts", "neoreg", "Dockerfile").toAbsolutePath();
public static final Path springBoot1Dockerfile = Path.of("..", "vul", "vul-springboot1", "Dockerfile").toAbsolutePath();
integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java
+3 -2
View File
@@ -14,7 +14,6 @@ import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.packer.jar.*;
import com.reajason.javaweb.packer.translet.XalanAbstractTransletPacker;
import com.reajason.javaweb.suo5.Suo5Manager;
import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
@@ -71,6 +70,7 @@ public class ShellAssertion {
|| shellType.endsWith(ShellType.SPRING_WEBMVC_CONTROLLER_HANDLER)
|| shellType.equals(ShellType.SPRING_WEBFLUX_HANDLER_METHOD)
|| shellType.equals(ShellType.SPRING_WEBFLUX_HANDLER_FUNCTION)
|| shellType.equals(ShellType.ACTION)
) {
urlPattern = "/" + shellTool + shellType + packer.name();
shellUrl = url + urlPattern;
@@ -480,7 +480,8 @@ public class ShellAssertion {
assertThat(res, anyOf(
Matchers.containsString("context: "),
Matchers.containsString("server: "),
Matchers.containsString("channel: ")
Matchers.containsString("channel: "),
Matchers.containsString("namespace: ")
));
ShellAssertion.commandIsOk(shellUrl, shellType, paramName, "id");
integration-test/src/test/java/com/reajason/javaweb/integration/memshell/struct2/Struct2ContainerTest.java
+81
View File
@@ -0,0 +1,81 @@
package com.reajason.javaweb.integration.memshell.struct2;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.TestCasesProvider;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
import org.junit.jupiter.params.provider.ValueSource;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.Network;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.images.builder.ImageFromDockerfile;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.util.List;
import java.util.stream.Stream;
import static com.reajason.javaweb.integration.ContainerTool.*;
import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.MatcherAssert.assertThat;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Struct2ContainerTest {
public static final String imageName = "tomcat:8-jre8";
static Network network = Network.newNetwork();
@Container
public final static GenericContainer<?> python = new GenericContainer<>(new ImageFromDockerfile()
.withDockerfile(neoGeorgDockerfile))
.withNetwork(network);
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(struct2WarFile, "/usr/local/tomcat/webapps/app.war")
.withCopyToContainer(jattachFile, "/jattach")
.withCopyToContainer(tomcatPid, "/fetch_pid.sh")
.withNetwork(network)
.withNetworkAliases("app")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
static Stream<Arguments> casesProvider() {
String server = Server.Struct2;
List<String> supportedShellTypes = List.of(ShellType.ACTION);
List<Packers> testPackers = List.of(Packers.ScriptEngine);
return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
}
@AfterAll
static void tearDown() {
String logs = container.getLogs();
log.info(logs);
assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
}
@ParameterizedTest(name = "{0}|{1}{2}|{3}")
@MethodSource("casesProvider")
void test(String imageName, String shellType, String shellTool, Packers packer) {
shellInjectIsOk(getUrl(container), Server.Struct2, shellType, shellTool, Opcodes.V1_8, packer, container, python);
}
@ParameterizedTest
@ValueSource(strings = {ShellType.ACTION})
void testProbeInject(String shellType) {
String url = getUrl(container);
ShellAssertion.testProbeInject(url, Server.Struct2, shellType, Opcodes.V1_8);
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/struct2/Struct2ContainerTest.java
+73
View File
@@ -0,0 +1,73 @@
package com.reajason.javaweb.integration.probe.struct2;
import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;
import java.nio.file.Files;
import java.nio.file.Paths;
import static com.reajason.javaweb.integration.ContainerTool.getUrl;
import static com.reajason.javaweb.integration.ContainerTool.struct2WarFile;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/12/4
*/
@Slf4j
@Testcontainers
public class Struct2ContainerTest {
public static final String imageName = "tomcat:8-jre8";
@Container
public final static GenericContainer<?> container = new GenericContainer<>(imageName)
.withCopyToContainer(struct2WarFile, "/usr/local/tomcat/webapps/app.war")
.waitingFor(Wait.forHttp("/app"))
.withExposedPorts(8080);
@Test
void testJDK() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getJdkDetection());
assertEquals("JRE|1.8.0_402|52", data);
}
@Test
@SneakyThrows
void testBasicInfo() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getBasicInfoPrinter());
Files.writeString(Paths.get("src", "test", "resources", "infos", this.getClass().getSimpleName() + "BasicInfo.txt"), data);
}
@Test
void testServerDetection() {
String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getServerDetection());
assertEquals(Server.Tomcat, data);
}
@Test
@SneakyThrows
void testCommandReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseCommandIsOk(url, Server.Struct2, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Struct2, Opcodes.V1_8);
}
}