feat: support tomcat cmd shell and jsp packer

This commit is contained in:
ReaJason
2024-11-27 00:35:35 +08:00
parent a530d77351
commit e718af7440
32 changed files with 867 additions and 74 deletions
File diff suppressed because one or more lines are too long
@@ -18,8 +18,6 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @since 2024/11/23
*/
class GodzillaGeneratorTest {
GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
String pass = "pass";
String key = "key";
String headerName = "User-Agent";
@@ -29,7 +27,7 @@ class GodzillaGeneratorTest {
@Disabled("just for generate")
void testGenerate() throws IOException {
String className = "org.apache.utils.CommonFilter";
byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
byte[] bytes = GodzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
IOUtils.write(bytes, Files.newOutputStream(Paths.get("CommonFilter.class")));
}
}
@@ -0,0 +1,23 @@
package com.reajason.javaweb.memsell.packer;
import com.reajason.javaweb.config.GenerateResult;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertTrue;
/**
* @author ReaJason
* @since 2024/11/26
*/
class JspPackerTest {
@Test
void pack() {
GenerateResult generateResult = GenerateResult.builder()
.injectorClassName("hehe")
.injectorBytesBase64Str("hehe").build();
String jspContent = new String(new JspPacker().pack(generateResult));
assertTrue(jspContent.contains("String className = \"hehe\";"));
assertTrue(jspContent.contains("String base64Str = \"hehe\";"));
}
}
@@ -0,0 +1,26 @@
package com.reajason.javaweb.memsell.tomcat.command;
import com.reajason.javaweb.memsell.CommandGenerator;
import com.reajason.javaweb.util.ClassUtils;
import org.apache.commons.codec.binary.Base64;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2024/11/24
*/
class CommandFilterTest {
@Test
void testGenerate() {
String className = "org.command.CommandFilter";
String headerName = "cmd";
byte[] bytes = CommandGenerator.generate(CommandFilter.class, className, headerName);
Object obj = ClassUtils.newInstance(bytes);
assertEquals(className, obj.getClass().getName());
assertEquals(headerName, ClassUtils.getFieldValue(obj, "headerName"));
System.out.println(Base64.encodeBase64String(bytes));
}
}
@@ -18,8 +18,6 @@ import static org.junit.jupiter.api.Assertions.*;
* @since 2024/11/24
*/
class GodzillaFilterTest {
GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
String pass = "pass";
String key = "key";
String headerName = "User-Agent";
@@ -28,7 +26,7 @@ class GodzillaFilterTest {
@Test
void generate() {
String className = "org.apache.utils.CommonFilter";
byte[] bytes = godzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
byte[] bytes = GodzillaGenerator.generate(GodzillaFilter.class, className, pass, key, headerName, headerValue);
Object obj = ClassUtils.newInstance(bytes);
assertEquals(className, obj.getClass().getName());
assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
@@ -12,8 +12,6 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @since 2024/11/24
*/
class GodzillaJakartaFilterTest {
GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
String pass = "pass";
String key = "key";
String headerName = "User-Agent";
@@ -22,7 +20,7 @@ class GodzillaJakartaFilterTest {
@Test
void generate() {
String className = "org.apache.utils.CommonJakartaFilter";
byte[] bytes = godzillaGenerator.generate(GodzillaJakartaFilter.class, className, pass, key, headerName, headerValue);
byte[] bytes = GodzillaGenerator.generate(GodzillaJakartaFilter.class, className, pass, key, headerName, headerValue);
Object obj = ClassUtils.newInstance(bytes);
assertEquals(className, obj.getClass().getName());
assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
@@ -12,8 +12,6 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @since 2024/11/24
*/
class GodzillaJakartaListenerTest {
GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
String pass = "pass";
String key = "key";
String headerName = "User-Agent";
@@ -22,7 +20,7 @@ class GodzillaJakartaListenerTest {
@Test
void generate() {
String className = "org.apache.utils.CommonJakartaListener";
byte[] bytes = godzillaGenerator.generate(GodzillaJakartaListener.class, className, pass, key, headerName, headerValue);
byte[] bytes = GodzillaGenerator.generate(GodzillaJakartaListener.class, className, pass, key, headerName, headerValue);
Object obj = ClassUtils.newInstance(bytes);
assertEquals(className, obj.getClass().getName());
assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
@@ -12,8 +12,6 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
* @since 2024/11/24
*/
class GodzillaListenerTest {
GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
String pass = "pass";
String key = "key";
String headerName = "User-Agent";
@@ -22,7 +20,7 @@ class GodzillaListenerTest {
@Test
void generate() {
String className = "org.apache.utils.CommonListener";
byte[] bytes = godzillaGenerator.generate(GodzillaListener.class, className, pass, key, headerName, headerValue);
byte[] bytes = GodzillaGenerator.generate(GodzillaListener.class, className, pass, key, headerName, headerValue);
Object obj = ClassUtils.newInstance(bytes);
assertEquals(className, obj.getClass().getName());
assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
@@ -12,7 +12,6 @@ import static org.junit.jupiter.api.Assertions.*;
* @since 2024/11/24
*/
class GodzillaValveTest {
GodzillaGenerator godzillaGenerator = new GodzillaGenerator();
String pass = "pass";
String key = "key";
String headerName = "User-Agent";
@@ -21,7 +20,7 @@ class GodzillaValveTest {
@Test
void generate() {
String className = "org.apache.utils.CommonValve";
byte[] bytes = godzillaGenerator.generate(GodzillaValve.class, className, pass, key, headerName, headerValue);
byte[] bytes = GodzillaGenerator.generate(GodzillaValve.class, className, pass, key, headerName, headerValue);
Object obj = ClassUtils.newInstance(bytes);
assertEquals(className, obj.getClass().getName());
assertEquals(pass, ClassUtils.getFieldValue(obj, "pass"));
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long