-
Notifications
You must be signed in to change notification settings - Fork 121
Closed
Labels
enhancementNew feature or requestNew feature or requestgood first issueGood for newcomersGood for newcomers
Description
适配范围
Describe the scope you want to adapt to
Base64 流量对于 WAF 来说是很敏感的,虽然 BigInteger 的编码方式可能也进了规则库,但是部分工具支持 BigInteger 所以可以支持一下。
参考 pen4uin/java-memshell-generator/BigIntegerFormater.java 实现
代码和靶场实现
- fork 本仓库并打开 GitHub Actions(用于集成测试)
- 在 packer 模块中参考 BCELPacker 进行 BigIntegerPacker 的实现,并在 Packers 中注册,放在 BCEL 上面。
- 在 vul/vul-webapp 和 vul/vul-webapp-jakarta 模块中,参考 Base64ClassLoaderServlet 编写 BigIntegerClassLaoderServlet 的靶场,请求的路径为
/biginteger,解析 BigInteger 并 defineClass 触发 RCE。 - 参考 base64 的靶场请求方式在以下代码中添加
/biginteger的请求发送方式。MemShellParty/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java
Lines 309 to 353 in 4e505d6
public static void injectIsOk(String url, String shellType, ShellTool shellTool, String content, Packers packer, GenericContainer<?> container) { switch (packer) { case JSP, ClassLoaderJSP, DefineClassJSP -> { String uploadEntry = url + "/upload"; String filename = shellType + shellTool + packer + ".jsp"; String shellUrl = url + "/" + filename; VulTool.uploadJspFileToServer(uploadEntry, filename, content); VulTool.urlIsOk(shellUrl); } case JSPX -> { String uploadEntry = url + "/upload"; String filename = shellType + shellTool + ".jspx"; String shellUrl = url + "/" + filename; VulTool.uploadJspFileToServer(uploadEntry, filename, content); VulTool.urlIsOk(shellUrl); } case ScriptEngine -> VulTool.postIsOk(url + "/js", content); case EL -> VulTool.postIsOk(url + "/el", content); case SpEL, SpELSpringIOUtils, SpELScriptEngine, SpELSpringUtils -> VulTool.postIsOk(url + "/spel", content); case OGNL, OGNLSpringIOUtils, OGNLScriptEngine, OGNLSpringUtils -> VulTool.postIsOk(url + "/ognl", content); case MVEL -> VulTool.postIsOk(url + "/mvel", content); case JXPath -> VulTool.postIsOk(url + "/jxpath", content); case JEXL -> VulTool.postIsOk(url + "/jexl2", content); case Aviator -> VulTool.postIsOk(url + "/aviator", content); case Groovy -> VulTool.postIsOk(url + "/groovy", content); case Rhino -> VulTool.postIsOk(url + "/rhino", content); case BeanShell -> VulTool.postIsOk(url + "/bsh", content); case JinJava -> VulTool.postIsOk(url + "/jinjava", content); case Freemarker -> VulTool.postIsOk(url + "/freemarker", content); case Velocity -> VulTool.postIsOk(url + "/velocity", content); case JavaDeserialize -> VulTool.postIsOk(url + "/java_deserialize", content); case JavaCommonsBeanutils16 -> VulTool.postIsOk(url + "/java_deserialize/cb161", content); case JavaCommonsBeanutils17 -> VulTool.postIsOk(url + "/java_deserialize/cb170", content); case JavaCommonsBeanutils18 -> VulTool.postIsOk(url + "/java_deserialize/cb183", content); case JavaCommonsBeanutils19 -> VulTool.postIsOk(url + "/java_deserialize/cb194", content); case JavaCommonsBeanutils110 -> VulTool.postIsOk(url + "/java_deserialize/cb110", content); case JavaCommonsCollections3 -> VulTool.postIsOk(url + "/java_deserialize/cc321", content); case JavaCommonsCollections4 -> VulTool.postIsOk(url + "/java_deserialize/cc40", content); case HessianDeserialize -> VulTool.postIsOk(url + "/hessian", content); case Hessian2Deserialize -> VulTool.postIsOk(url + "/hessian2", content); case XMLDecoderScriptEngine, XMLDecoderDefineClass -> VulTool.postIsOk(url + "/xmlDecoder", content); case Base64 -> VulTool.postIsOk(url + "/b64", content); case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content); case H2, H2JS, H2Javac -> VulTool.postIsOk(url + "/jdbc", content); default -> throw new IllegalStateException("Unexpected value: " + packer);
集成测试
- 为 Tomcat 的内存马集成测试添加 BigInteger 的打包测试方法, 添加范围为以下,在以下代码文件中的 testPackers 中新增 BigInteger 的 Packers enum。
- 直接 push 由 GitHub Actions 进行集成测试(确保开启 fork 仓库的 GitHub Actions 功能),留意测试结果,可能部分环境不兼容,需要特别留意,尽可能进行兼容。
- 如果集成测试通过可直接 PR
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or requestgood first issueGood for newcomersGood for newcomers