Skip to content
Merged

2.7.1 #145

Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/memshell-integration-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -43,13 +43,13 @@ jobs:
- middleware: "weblogic"
depend_tasks: ":vul:vul-webapp:war"
- middleware: "springwebmvc"
depend_tasks: ":vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar"
depend_tasks: ":vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar :vul:vul-springboot359:bootJar"
- middleware: "springwebflux"
depend_tasks: ":vul:vul-springboot2-webflux:bootJar :vul:vul-springboot3-webflux:bootJar"
- middleware: "xxljob"
depend_tasks: ""
- middleware: "struct2"
depend_tasks: ":vul:vul-struct2:war"
- middleware: "struts2"
depend_tasks: ":vul:vul-struts2:war"
runs-on: ubuntu-22.04
name: ${{ matrix.cases.middleware }}
steps:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/probe-integration-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,9 @@ jobs:
- middleware: "weblogic"
depend_tasks: ":vul:vul-webapp:war"
- middleware: "springwebmvc"
depend_tasks: ":vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar"
- middleware: "struct2"
depend_tasks: ":vul:vul-struct2:war"
depend_tasks: ":vul:vul-springboot1:bootJar :vul:vul-springboot2:bootJar :vul:vul-springboot2-jetty:bootJar :vul:vul-springboot2-undertow:bootJar :vul:vul-springboot2:bootWar :vul:vul-springboot3:bootJar :vul:vul-springboot359:bootJar"
- middleware: "struts2"
depend_tasks: ":vul:vul-struts2:war"
runs-on: ubuntu-22.04
name: ${{ matrix.cases.middleware }}
steps:
Expand Down
2 changes: 1 addition & 1 deletion build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ idea {
}
}

version = "2.7.0"
version = "2.7.1-SNAPSHOT"

tasks.register("publishAllToMavenCentral") {
dependsOn(":memshell-party-common:publishToMavenCentral")
Expand Down
2 changes: 1 addition & 1 deletion generator/src/main/java/com/reajason/javaweb/Server.java
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@ public class Server {
public static final String SpringWebMvc = "SpringWebMvc";
public static final String SpringWebFlux = "SpringWebFlux";
public static final String XXLJOB = "XXLJOB";
public static final String Struct2 = "Struct2";
public static final String Struts2 = "Struts2";
public static final String Dubbo = "Dubbo";
}
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ public class ServerFactory {
register(Server.SpringWebMvc, SpringWebMvc::new);
register(Server.SpringWebFlux, SpringWebFlux::new);
register(Server.XXLJOB, XxlJob::new);
register(Server.Struct2, Struct2::new);
register(Server.Struts2, Struts2::new);
register(Server.Dubbo, Dubbo::new);

addToolMapping(ShellTool.Godzilla, ToolMapping.builder()
Expand Down Expand Up @@ -82,7 +82,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, GodzillaUndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Godzilla.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, Godzilla.class)
.addShellClass(ACTION, GodzillaStruct2Action.class)
.addShellClass(ACTION, GodzillaStruts2Action.class)
.build());

addToolMapping(ShellTool.Behinder, ToolMapping.builder()
Expand All @@ -107,7 +107,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, BehinderUndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Behinder.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, Behinder.class)
.addShellClass(ACTION, BehinderStruct2Action.class)
.addShellClass(ACTION, BehinderStruts2Action.class)
.build());

addToolMapping(ShellTool.AntSword, ToolMapping.builder()
Expand All @@ -125,7 +125,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, AntSwordUndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, AntSword.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, AntSword.class)
.addShellClass(ACTION, AntSwordStruct2Action.class)
.addShellClass(ACTION, AntSwordStruts2Action.class)
.build());

addToolMapping(ShellTool.Command, ToolMapping.builder()
Expand Down Expand Up @@ -162,7 +162,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, CommandUndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Command.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, Command.class)
.addShellClass(ACTION, CommandStruct2Action.class)
.addShellClass(ACTION, CommandStruts2Action.class)
.addShellClass(ALIBABA_DUBBO_SERVICE, CommandDubboService.class)
.addShellClass(APACHE_DUBBO_SERVICE, CommandDubboService.class)
.build());
Expand Down Expand Up @@ -190,7 +190,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, Suo5UndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Suo5.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, Suo5.class)
.addShellClass(ACTION, Suo5Struct2Action.class)
.addShellClass(ACTION, Suo5Struts2Action.class)
.build());

addToolMapping(ShellTool.Suo5v2, ToolMapping.builder()
Expand All @@ -215,7 +215,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, Suo5v2UndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, Suo5v2.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, Suo5v2.class)
.addShellClass(ACTION, Suo5v2Struct2Action.class)
.addShellClass(ACTION, Suo5v2Struts2Action.class)
.addShellClass(CUSTOMIZER, Suo5v2JettyCustomizer.class)
.build());

Expand All @@ -241,7 +241,7 @@ public class ServerFactory {
.addShellClass(UNDERTOW_AGENT_SERVLET_HANDLER, NeoreGeorgUndertowServletHandler.class)
.addShellClass(WEBLOGIC_AGENT_SERVLET_CONTEXT, NeoreGeorg.class)
.addShellClass(WAS_AGENT_FILTER_MANAGER, NeoreGeorg.class)
.addShellClass(ACTION, NeoreGeorgStruct2Action.class)
.addShellClass(ACTION, NeoreGeorgStruts2Action.class)
.build());

addToolMapping(ShellTool.Proxy, ToolMapping.builder()
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
package com.reajason.javaweb.memshell.injector.struct2;
package com.reajason.javaweb.memshell.injector.struts2;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
Expand All @@ -15,7 +15,7 @@
* @author ReaJason
* @since 2025/12/8
*/
public class Struct2ActionInjector {
public class Struts2ActionInjector {

private static String msg = "";
private static boolean ok = false;
Expand All @@ -32,7 +32,7 @@ public String getBase64String() throws IOException {
return "{{base64Str}}";
}

public Struct2ActionInjector() {
public Struts2ActionInjector() {
if (ok) {
return;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,11 @@ public Class<?> getListenerInterceptor() {
public InjectorMapping getShellInjectorMapping() {
return InjectorMapping.builder()
.addInjector(LISTENER, BesListenerInjector.class)
.addInjector(JAKARTA_LISTENER, BesListenerInjector.class)
.addInjector(FILTER, BesFilterInjector.class)
.addInjector(JAKARTA_FILTER, BesFilterInjector.class)
.addInjector(VALVE, BesValveInjector.class)
.addInjector(JAKARTA_VALVE, BesValveInjector.class)
.addInjector(AGENT_FILTER_CHAIN, BesFilterChainAgentInjector.class)
.addInjector(CATALINA_AGENT_CONTEXT_VALVE, BesContextValveAgentInjector.class)
.build();
Expand Down
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
package com.reajason.javaweb.memshell.server;

import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.memshell.injector.struct2.Struct2ActionInjector;
import com.reajason.javaweb.memshell.injector.struts2.Struts2ActionInjector;

/**
* @author ReaJason
* @since 2025/12/8
*/
public class Struct2 extends AbstractServer {
public class Struts2 extends AbstractServer {

@Override
public InjectorMapping getShellInjectorMapping() {
return InjectorMapping.builder()
.addInjector(ShellType.ACTION, Struct2ActionInjector.class)
.addInjector(ShellType.ACTION, Struts2ActionInjector.class)
.build();
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
* @author ReaJason
* @since 2025/02/18
*/
public class AntSwordStruct2Action {
public class AntSwordStruts2Action {

public static String pass;
public static String headerName;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
/**
* @author ReaJason
*/
public class BehinderStruct2Action {
public class BehinderStruts2Action {
public static String pass;
public static String headerName;
public static String headerValue;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
* @author ReaJason
* @since 2025/12/8
*/
public class CommandStruct2Action {
public class CommandStruts2Action {
private static String paramName;

public String execute() throws Exception {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
* @author ReaJason
* @since 2024/12/15
*/
public class GodzillaStruct2Action {
public class GodzillaStruts2Action {
private static String key;
private static String pass;
private static String md5;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
* <p>
* key: key
*/
public class NeoreGeorgStruct2Action {
public class NeoreGeorgStruts2Action {
public static String headerName;
public static String headerValue;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* @author ReaJason
* @since 2024/12/15
*/
public class Suo5Struct2Action implements Runnable, HostnameVerifier, X509TrustManager {
public class Suo5Struts2Action implements Runnable, HostnameVerifier, X509TrustManager {
public static String headerName;
public static String headerValue;
public static HashMap addrs = collectAddr();
Expand All @@ -25,10 +25,10 @@ public class Suo5Struct2Action implements Runnable, HostnameVerifier, X509TrustM
InputStream gInStream;
OutputStream gOutStream;

public Suo5Struct2Action() {
public Suo5Struts2Action() {
}

public Suo5Struct2Action(InputStream in, OutputStream out) {
public Suo5Struts2Action(InputStream in, OutputStream out) {
this.gInStream = in;
this.gOutStream = out;
}
Expand Down Expand Up @@ -268,7 +268,7 @@ private void processDataBio(HttpServletRequest request, HttpServletResponse resp

Thread t = null;
try {
Suo5Struct2Action p = new Suo5Struct2Action(scInStream, respOutStream);
Suo5Struts2Action p = new Suo5Struts2Action(scInStream, respOutStream);
t = new Thread(p);
t.start();
readReq(reqInputStream, scOutStream);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@
* @author ReaJason
* @since 2025/12/9
*/
public class Suo5v2Struct2Action {
public class Suo5v2Struts2Action {
private static Class<?> suo5V2Class;
private static String suo5V2GZipBase64;

public Suo5v2Struct2Action() {
public Suo5v2Struts2Action() {
}

public void execute() throws Exception {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -106,8 +106,8 @@ private Class<?> getWriterClass() {
return WebLogicWriter.class;
case Server.Apusic:
return ApusicWriter.class;
case Server.Struct2:
return Struct2Writer.class;
case Server.Struts2:
return Struts2Writer.class;
default:
throw new GenerationException("responseBody not supported for server: " + probeContentConfig.getServer());
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
* HTTP 服务类型识别,主要识别 Servlet 容器实现,例如 WildFly 识别为 Undertow,Payara 识别为 GlassFish
* 很多国产中间件都是基于 GlassFish 改的,都会识别为 GlassFish
* 额外需要注意:
* 1. 不会识别 SpringWebMVC Struct2 这种框架,只识别其提供 HTTP 服务的 Servlet 容器类型
* 1. 不会识别 SpringWebMVC Struts2 这种框架,只识别其提供 HTTP 服务的 Servlet 容器类型
* 2. 识别的顺序很重要,部分类型的识别单独拿出来是不准确的,没有测试的情况下,不要以下的 if 判断顺序
*
* @author ReaJason
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@
* @author ReaJason
* @since 2025/12/8
*/
public class Struct2Writer {
public class Struts2Writer {
private static boolean ok = false;

public Struct2Writer() {
public Struts2Writer() {
if (ok) {
return;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,11 @@ public TomcatWriter() {
try {
requestGroupInfo = getFieldValue(getFieldValue(getFieldValue(target, "this$0"), "handler"), "global");
} catch (NoSuchFieldException ignored) {
continue;
try {
requestGroupInfo = getFieldValue(getFieldValue(getFieldValue(target, "endpoint"), "handler"), "global");
}catch (NoSuchFieldException ignored2) {
continue;
}
}
} else if (target.getClass().getName().contains("ThreadPool$ControlRunnable")) {
// Tomcat5 http-8080-Processor23 <-> org.apache.tomcat.util.threads.ThreadPool$ControlRunnable
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,15 @@ public TongWebWriter() {
String threadName = thread.getName();
if (threadName.contains("Poller") // TongWeb6
|| threadName.contains("Acceptor") // TongWeb7
|| threadName.contains("AsyncTimeout") // TongWeb 7.0.4.9
) {
try {
Object requestGroupInfo = getFieldValue(getFieldValue(getFieldValue(poller, "this$0"), "handler"), "global");
Object requestGroupInfo = null;
try {
requestGroupInfo = getFieldValue(getFieldValue(getFieldValue(poller, "this$0"), "handler"), "global");
} catch (NoSuchFieldException ignored1) {
requestGroupInfo = getFieldValue(getFieldValue(getFieldValue(poller, "endpoint"), "handler"), "global");
}
List<?> processors = (List<?>) getFieldValue(requestGroupInfo, "processors");
for (Object processor : processors) {
String workerThreadName = (String) getFieldValue(processor, "workerThreadName");
Expand Down
20 changes: 10 additions & 10 deletions gradle/libs.versions.toml
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
[versions]
asm = "9.9.1"
asm = "9.10" # https://mvnrepository.com/artifact/org.ow2.asm/asm
jna = "5.13.0" # 为适配 JDK6+ 这个不可修改
bcel = "5.2"
javax-servlet-api = "3.0.1"
Expand All @@ -15,21 +15,21 @@ alibaba-dubbo = "2.6.12"
apache-dubbo = "2.7.6"
tomcat = "8.5.85"

byte-buddy = "1.18.5" # https://mvnrepository.com/artifact/net.bytebuddy/byte-buddy
commons-io = "2.21.0" # https://mvnrepository.com/artifact/commons-io/commons-io
byte-buddy = "1.18.8" # https://mvnrepository.com/artifact/net.bytebuddy/byte-buddy
commons-io = "2.22.0" # https://mvnrepository.com/artifact/commons-io/commons-io
commons-lang3 = "3.20.0" # https://mvnrepository.com/artifact/org.apache.commons/commons-lang3
commons-codec = "1.21.0" # https://mvnrepository.com/artifact/commons-codec/commons-codec
commons-codec = "1.22.0" # https://mvnrepository.com/artifact/commons-codec/commons-codec
logback = "1.5.32" # https://mvnrepository.com/artifact/ch.qos.logback/logback-classic
okhttp3 = "5.3.2" # https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp
fastjson2 = "2.0.61" # https://mvnrepository.com/artifact/com.alibaba.fastjson2/fastjson2
fastjson2 = "2.0.62" # https://mvnrepository.com/artifact/com.alibaba.fastjson2/fastjson2
java-websocket = "1.6.0" # https://mvnrepository.com/artifact/org.java-websocket/Java-WebSocket

mockito = "5.21.0"
hamcrest = "3.0"
junit-jupiter = "5.14.3" # https://mvnrepository.com/artifact/org.junit.jupiter/junit-jupiter
junit-jupiter = "5.14.4" # https://mvnrepository.com/artifact/org.junit.jupiter/junit-jupiter
junit-pioneer = "2.3.0"
junit-platform = "1.14.3" # https://mvnrepository.com/artifact/org.junit.platform/junit-platform-launcher
testcontainers = "2.0.4" # https://mvnrepository.com/artifact/org.testcontainers/testcontainers
junit-platform = "1.14.4" # https://mvnrepository.com/artifact/org.junit.platform/junit-platform-launcher
testcontainers = "2.0.5" # https://mvnrepository.com/artifact/org.testcontainers/testcontainers

[libraries]
alibaba-dubbo = { module = "com.alibaba:dubbo", version.ref = "alibaba-dubbo" }
Expand Down Expand Up @@ -74,5 +74,5 @@ mockito = ["mockito-core", "mockito-junit-jupiter"]
testcontainers = ["testcontainers", "testcontainers-junit-jupiter"]

[plugins]
lombok = { id = "io.freefair.lombok", version = "9.2.0" }
shadow = { id = "com.gradleup.shadow", version = "9.3.1" }
lombok = { id = "io.freefair.lombok", version = "9.5.0" } # https://plugins.gradle.org/plugin/io.freefair.lombok
shadow = { id = "com.gradleup.shadow", version = "9.4.1" } # https://plugins.gradle.org/plugin/com.gradleup.shadow
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ public class ContainerTool {
public static final MountableFile warExpressionFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-webapp-expression", "build", "libs", "vul-webapp-expression.war").toAbsolutePath());
public static final MountableFile warDeserializeFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-webapp-deserialize", "build", "libs", "vul-webapp-deserialize.war").toAbsolutePath());
public static final MountableFile warFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-webapp", "build", "libs", "vul-webapp.war").toAbsolutePath(), 0666);
public static final MountableFile struct2WarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-struct2", "build", "libs", "vul-struct2.war").toAbsolutePath());
public static final MountableFile struts2WarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-struts2", "build", "libs", "vul-struts2.war").toAbsolutePath());
public static final MountableFile springBoot2WarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot2", "build", "libs", "vul-springboot2.war").toAbsolutePath());

public static final MountableFile springBoot1JarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot1", "build", "libs", "vul-springboot1.jar").toAbsolutePath());
Expand All @@ -25,6 +25,7 @@ public class ContainerTool {
public static final MountableFile springBoot2UndertowJarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot2-undertow", "build", "libs", "vul-springboot2-undertow.jar").toAbsolutePath());
public static final MountableFile springBoot2WebfluxJarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot2-webflux", "build", "libs", "vul-springboot2-webflux.jar").toAbsolutePath());
public static final MountableFile springBoot3JarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot3", "build", "libs", "vul-springboot3.jar").toAbsolutePath());
public static final MountableFile springBoot359JarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot359", "build", "libs", "vul-springboot359.jar").toAbsolutePath());
public static final MountableFile springBoot3WebfluxJarFile = MountableFile.forHostPath(Path.of("..", "vul", "vul-springboot3-webflux", "build", "libs", "vul-springboot3-webflux.jar").toAbsolutePath());

public static final Path neoGeorgDockerfile = Path.of("..", "assets", "neoreg", "Dockerfile").toAbsolutePath();
Expand Down
Loading
Loading