Tomcat Filter之動態注入

CN_Simo發表於2020-07-04

TomcatFilter

前言

最近，看到好多不錯的關於“無檔案Webshell”的文章，對其中利用上下文動態的注入Filter的技術做了一下簡單驗證，寫一下測試總結，不依賴任何框架，僅想學習一下tomcat的filter。

先放幾篇大佬的文章：

Filter介紹

詳細介紹略，簡單記錄一下我的理解：

過濾器（Filter）：用來對指定的URL進行過濾處理，類似.net core裡的中介軟體，例如登入驗證過濾器可以用來限制資源的未授權訪問；
過濾鏈（FilterChain）：通過URL匹配動態將所有符合URL規則的過濾器共同組成一個過濾鏈，順序有先後，類似.net core的管道，不過區別在於過濾鏈是單向的，管道是雙向；

同Servlet，一般Filter的配置方式：

web.xml
@WebFilter修飾

Filter註冊呼叫流程

新建一個登入驗證的Filter: SessionFilter.java

package com.reinject.MyFilter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.annotation.WebInitParam;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;

/**
 *    判斷使用者是否登入,未登入則退出系統
 */
@WebFilter(filterName = "SessionFilter", urlPatterns = "/*",
        initParams = {@WebInitParam(name = "logonStrings", value = "index.jsp;addFilter.jsp"),
                @WebInitParam(name = "includeStrings", value = ".jsp"),
                @WebInitParam(name = "redirectPath", value = "/index.jsp"),
                @WebInitParam(name = "disabletestfilter", value = "N")})
public class SessionFilter implements Filter {

    public FilterConfig config;

    public void destroy() {
        this.config = null;
    }

    public static boolean isContains(String container, String[] regx) {
        boolean result = false;

        for (int i = 0; i < regx.length; i++) {
            if (container.indexOf(regx[i]) != -1) {
                return true;
            }
        }
        return result;
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest hrequest = (HttpServletRequest)request;
        HttpServletResponseWrapper wrapper = new HttpServletResponseWrapper((HttpServletResponse) response);

        String logonStrings = config.getInitParameter("logonStrings");        // 登入登陸頁面
        String includeStrings = config.getInitParameter("includeStrings");    // 過濾資源字尾引數
        String redirectPath = hrequest.getContextPath() + config.getInitParameter("redirectPath");// 沒有登陸轉向頁面
        String disabletestfilter = config.getInitParameter("disabletestfilter");// 過濾器是否有效

        if (disabletestfilter.toUpperCase().equals("Y")) {    // 過濾無效
            chain.doFilter(request, response);
            return;
        }
        String[] logonList = logonStrings.split(";");
        String[] includeList = includeStrings.split(";");

        if (!this.isContains(hrequest.getRequestURI(), includeList)) {// 只對指定過濾引數字尾進行過濾
            chain.doFilter(request, response);
            return;
        }

        if (this.isContains(hrequest.getRequestURI(), logonList)) {// 對登入頁面不進行過濾
            chain.doFilter(request, response);
            return;
        }

        String user = ( String ) hrequest.getSession().getAttribute("useronly");//判斷使用者是否登入
        if (user == null) {
            wrapper.sendRedirect(redirectPath);
            return;
        }else {
            chain.doFilter(request, response);
            return;
        }
    }

    public void init(FilterConfig filterConfig) throws ServletException {
        config = filterConfig;
    }
}

觀察一個正常請求的函式棧：

_jspService:14, index_jsp (org.apache.jsp)
service:70, HttpJspBase (org.apache.jasper.runtime)
service:731, HttpServlet (javax.servlet.http)
service:439, JspServletWrapper (org.apache.jasper.servlet)
serviceJspFile:395, JspServlet (org.apache.jasper.servlet)
service:339, JspServlet (org.apache.jasper.servlet)
service:731, HttpServlet (javax.servlet.http)
internalDoFilter:303, ApplicationFilterChain (org.apache.catalina.core)
doFilter:208, ApplicationFilterChain (org.apache.catalina.core)
doFilter:52, WsFilter (org.apache.tomcat.websocket.server)
internalDoFilter:241, ApplicationFilterChain (org.apache.catalina.core)
doFilter:208, ApplicationFilterChain (org.apache.catalina.core)
doFilter:66, SessionFilter (com.reinject.MyFilter)
internalDoFilter:241, ApplicationFilterChain (org.apache.catalina.core)
doFilter:208, ApplicationFilterChain (org.apache.catalina.core)
invoke:218, StandardWrapperValve (org.apache.catalina.core)
invoke:122, StandardContextValve (org.apache.catalina.core)
invoke:505, AuthenticatorBase (org.apache.catalina.authenticator)
invoke:169, StandardHostValve (org.apache.catalina.core)
invoke:103, ErrorReportValve (org.apache.catalina.valves)
invoke:956, AccessLogValve (org.apache.catalina.valves)
invoke:116, StandardEngineValve (org.apache.catalina.core)
service:442, CoyoteAdapter (org.apache.catalina.connector)
process:1082, AbstractHttp11Processor (org.apache.coyote.http11)
process:623, AbstractProtocol$AbstractConnectionHandler (org.apache.coyote)
run:316, JIoEndpoint$SocketProcessor (org.apache.tomcat.util.net)
runWorker:1149, ThreadPoolExecutor (java.util.concurrent)
run:624, ThreadPoolExecutor$Worker (java.util.concurrent)
run:61, TaskThread$WrappingRunnable (org.apache.tomcat.util.threads)
run:748, Thread (java.lang)

找到最開始的ApplicationFilterChain位置，呼叫者是StandardWrapperValve的invoke，再觀察invoke程式碼不難看出是用ApplicationFilterFactory動態生成的ApplicationFilterChain：

// Create the filter chain for this request
ApplicationFilterFactory factory =
    ApplicationFilterFactory.getInstance();
ApplicationFilterChain filterChain =
    factory.createFilterChain(request, wrapper, servlet);

createFilterChain根據xml配置動態生成一個過濾鏈，部分程式碼如下：

// Acquire the filter mappings for this Context
StandardContext context = (StandardContext) wrapper.getParent();
FilterMap filterMaps[] = context.findFilterMaps();

// If there are no filter mappings, we are done
if ((filterMaps == null) || (filterMaps.length == 0))
    return (filterChain);

// Acquire the information we will need to match filter mappings
String servletName = wrapper.getName();

// Add the relevant path-mapped filters to this filter chain
for (int i = 0; i < filterMaps.length; i++) {
    if (!matchDispatcher(filterMaps[i] ,dispatcher)) {
        continue;
    }
    if (!matchFiltersURL(filterMaps[i], requestPath))
        continue;
    ApplicationFilterConfig filterConfig = (ApplicationFilterConfig)
        context.findFilterConfig(filterMaps[i].getFilterName());
    if (filterConfig == null) {
        // FIXME - log configuration problem
        continue;
    }
    boolean isCometFilter = false;
    if (comet) {
        try {
            isCometFilter = filterConfig.getFilter() instanceof CometFilter;
        } catch (Exception e) {
            // Note: The try catch is there because getFilter has a lot of 
            // declared exceptions. However, the filter is allocated much
            // earlier
            Throwable t = ExceptionUtils.unwrapInvocationTargetException(e);
            ExceptionUtils.handleThrowable(t);
        }
        if (isCometFilter) {
            filterChain.addFilter(filterConfig);
        }
    } else {
        filterChain.addFilter(filterConfig);
    }
}

所有的filter可以通過context.findFilterMaps()方法獲取，FilterMap結構如下：

FilterMap中存放了所有filter相關的資訊包括filterName和urlPattern。

有了這些之後，使用matchFiltersURL函式將每個filter和當前URL進行匹配，匹配成功的通過context.findFilterConfig獲取filterConfig，filterConfig結構如下：

之後將filterConfig新增到filterChain中，最後回到StandardWrapperValve中呼叫doFilter進入過濾階段。

這個圖（@寬位元組安全）能夠很清晰的看到整個filter流程：

通過上面的流程，可知所有的filter資訊都是從context（StandardContext）獲取到的，所以假如可以獲取到這個context就可以通過反射的方式修改filterMap和filterConfig從而達到動態註冊filter的目的。

獲取context

開啟jconsole，獲取tomcat的Mbean:

感覺其中好多地方都可以獲取到context，比如RequestProcessor、Resource、ProtocolHandler、WebappClassLoader、Value。

Value獲取

程式碼：

MBeanServer mBeanServer = Registry.getRegistry(null, null).getMBeanServer();
// 獲取mbsInterceptor
Field field = Class.forName("com.sun.jmx.mbeanserver.JmxMBeanServer").getDeclaredField("mbsInterceptor");
field.setAccessible(true);
Object mbsInterceptor = field.get(mBeanServer);
// 獲取repository
field = Class.forName("com.sun.jmx.interceptor.DefaultMBeanServerInterceptor").getDeclaredField("repository");
field.setAccessible(true);
Object repository = field.get(mbsInterceptor);
// 獲取domainTb
field = Class.forName("com.sun.jmx.mbeanserver.Repository").getDeclaredField("domainTb");
field.setAccessible(true);
HashMap<String, Map<String, NamedObject>> domainTb = (HashMap<String,Map<String,NamedObject>>)field.get(repository);
// 獲取domain
NamedObject nonLoginAuthenticator = domainTb.get("Catalina").get("context=/,host=localhost,name=NonLoginAuthenticator,type=Valve");
field = Class.forName("com.sun.jmx.mbeanserver.NamedObject").getDeclaredField("object");
field.setAccessible(true);
Object object = field.get(nonLoginAuthenticator);
// 獲取resource
field = Class.forName("org.apache.tomcat.util.modeler.BaseModelMBean").getDeclaredField("resource");
field.setAccessible(true);
Object resource = field.get(object);
// 獲取context
field = Class.forName("org.apache.catalina.authenticator.AuthenticatorBase").getDeclaredField("context");
field.setAccessible(true);
StandardContext standardContext = (StandardContext) field.get(resource);

反射弧：mBeanServer->mbsInterceptor->repository->domainTb->nonLoginAuthenticator->resource->context。

通過StandardContext註冊filter

通過filter流程分析可知，註冊filter需要兩步：

修改filterConfigs；
將filter插到filterMaps的0位置；

在此之前，先看一下我們比較關心的context中三個成員變數：

filterConfigs：filterConfig的陣列
filterRefs：filterRef的陣列
filterMaps：filterMap的陣列

filterConfig的結構之前看過，filterConfig.filterRef實際和context.filterRef指向的地址一樣：

Expression: ((StandardContext) context).filterConfigs.get("SessionFilter").filterDef == ((StandardContext) context).filterDefs.get("SessionFilter");

從StandardContext類的方法看，可以呼叫StandardContext.addFilterDef()修改filterRefs，然後呼叫StandardContext.filterStart()函式會自動根據filterDefs重新生成filterConfigs：

filterConfigs.clear();
for (Entry<String, FilterDef> entry : filterDefs.entrySet()) {
    String name = entry.getKey();
    if (getLogger().isDebugEnabled())
        getLogger().debug(" Starting filter '" + name + "'");
    ApplicationFilterConfig filterConfig = null;
    try {
        filterConfig =
            new ApplicationFilterConfig(this, entry.getValue());
        filterConfigs.put(name, filterConfig);
    } catch (Throwable t) {
        t = ExceptionUtils.unwrapInvocationTargetException(t);
        ExceptionUtils.handleThrowable(t);
        getLogger().error
            (sm.getString("standardContext.filterStart", name), t);
        ok = false;
    }
}

綜上，修改filterRefs和filterConfigs的程式碼如下：

// Gen filterDef
filterDef = new FilterDef();
filterDef.setFilterName(filterName);
filterDef.setFilterClass(filter.getClass().getName());
filterDef.setFilter(filter);
// Add filterDef
context.addFilterDef(filterDef);
// Refresh filterConfigs
context.filterStart();

改filterMaps就簡單了，新增上去改一下順序加到0位置：

// filterMap
filterMap.setFilterName(filterName);
filterMap.setDispatcher(String.valueOf(DispatcherType.REQUEST));
filterMap.addURLPattern(filterUrlPatern);
context.addFilterMap(filterMap);
// Order
Object[] filterMaps = context.findFilterMaps();
Object[] tmpFilterMaps = new Object[filterMaps.length];
int index = 1;
for (int i = 0; i < filterMaps.length; i++)
{
    FilterMap f = (FilterMap) filterMaps[i];
    if (f.getFilterName().equalsIgnoreCase(filterName)) {
        tmpFilterMaps[0] = f;
    } else {
        tmpFilterMaps[index++] = f;
    }
}
for (int i = 0; i < filterMaps.length; i++) {
    filterMaps[i] = tmpFilterMaps[i];
}

通過ApplicationContext註冊filter

多次除錯發現有多處context，上面一直用的都是StandardContext，觀察該結構發現還有一個私有變數context，型別為ApplicationContext，通過他的定義發現其實就是一個ServletContext：

public class ApplicationContext implements ServletContext {
}

該結構中也有一些filter操作的方法：

public Map<String, ? extends FilterRegistration> getFilterRegistrations() {}
public FilterRegistration getFilterRegistration(String filterName) {}
public FilterRegistration.Dynamic addFilter(String filterName, Filter filter) {}

這三個函式返回值都是FilterRegistration，看一下結構：

public class ApplicationFilterRegistration implements FilterRegistration.Dynamic {
    public void addMappingForServletNames(EnumSet<DispatcherType> dispatcherTypes, boolean isMatchAfter, String... servletNames) {}
    public void addMappingForUrlPatterns(EnumSet<DispatcherType> dispatcherTypes, boolean isMatchAfter, String... urlPatterns) {}
    public Collection<String> getServletNameMappings() {}
    public Collection<String> getUrlPatternMappings() {}
    public String getClassName() {}
    public String getInitParameter(String name) {}
    public Map<String, String> getInitParameters() {}
    public String getName() {}
    public boolean setInitParameter(String name, String value) {}
    public Set<String> setInitParameters(Map<String, String> initParameters) {}
    public void setAsyncSupported(boolean asyncSupported) {}
}

很明顯打包了一些常用的註冊Filter的函式，所以可以使用ApplicationContext和FilterRegistration進行註冊，測試程式碼如下：

// Define
ApplicationContext applicationContext = new ApplicationContext(standardContext);
Filter filter = new TestApplicationContextAddFilter();
// Registe Filter
FilterRegistration.Dynamic filterRegistration = applicationContext.addFilter(filterName, filter);
// Create Map for urlPattern
filterRegistration.addMappingForUrlPatterns(EnumSet.of(javax.servlet.DispatcherType.REQUEST), false, new String[]{urlPatern});
// Order
Object[] filterMaps = standardContext.findFilterMaps();
Object[] tmpFilterMaps = new Object[filterMaps.length];
int index = 1;
for (int i = 0; i < filterMaps.length; i++)
{
    FilterMap f = (FilterMap) filterMaps[i];
    if (f.getFilterName().equalsIgnoreCase(filterName)) {
        tmpFilterMaps[0] = f;
    } else {
        tmpFilterMaps[index++] = f;
    }
}
for (int i = 0; i < filterMaps.length; i++) {
    filterMaps[i] = tmpFilterMaps[i];
}

很不幸，有IllegalStateException異常：

嚴重: Servlet.service() for servlet [HelloWorldServlet] in context with path [] threw exception [Servlet execution threw an exception] with root cause
java.lang.IllegalStateException: Filters can not be added to context  as the context has been initialised
	at org.apache.catalina.core.ApplicationContext.addFilter(ApplicationContext.java:1005)
	at org.apache.catalina.core.ApplicationContext.addFilter(ApplicationContext.java:970)
	at com.reinject.test.TestApplicationContextAddFilter.<clinit>(TestApplicationContextAddFilter.java:61)
	at com.reinject.MyServlet.HelloWorldServlet.doGet(HelloWorldServlet.java:50)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)

通過觀察AddFilter報錯的位置，發現是對standardContext的state校驗的時候不達標丟擲的異常：

if (!context.getState().equals(LifecycleState.STARTING_PREP)) {
    //TODO Spec breaking enhancement to ignore this restriction
    throw new IllegalStateException(
            sm.getString("applicationContext.addFilter.ise",
                    getContextPath()));
}

那麼可以先修改一下state為LifecycleState.STARTING_PREP:

java.lang.reflect.Field stateField = org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, org.apache.catalina.LifecycleState.STARTING_PREP);

再執行正常：

不過測試發現如果state不改回來，之後訪問所有頁面都會503：

綜上：

// Fix State
java.lang.reflect.Field stateField = org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, org.apache.catalina.LifecycleState.STARTING_PREP);
// Define
ApplicationContext applicationContext = new ApplicationContext(standardContext);
Filter filter = new TestApplicationContextAddFilter();
// Registe Filter
FilterRegistration.Dynamic filterRegistration = applicationContext.addFilter(filterName, filter);
// Create Map for urlPattern
filterRegistration.addMappingForUrlPatterns(EnumSet.of(javax.servlet.DispatcherType.REQUEST), false, new String[]{urlPatern});
// Restore State
stateField = org.apache.catalina.util.LifecycleBase.class.getDeclaredField("state");
stateField.setAccessible(true);
stateField.set(standardContext, org.apache.catalina.LifecycleState.STARTED);
// Order
Object[] filterMaps = standardContext.findFilterMaps();
Object[] tmpFilterMaps = new Object[filterMaps.length];
int index = 1;
for (int i = 0; i < filterMaps.length; i++)
{
    FilterMap f = (FilterMap) filterMaps[i];
    if (f.getFilterName().equalsIgnoreCase(filterName)) {
        tmpFilterMaps[0] = f;
    } else {
        tmpFilterMaps[index++] = f;
    }
}
for (int i = 0; i < filterMaps.length; i++) {
    filterMaps[i] = tmpFilterMaps[i];
}

實驗過程中的程式碼

獲取方式，git clone https://github.com/cnsimo/TomcatFilterInject.git

部署方式，idea + tomcat7.0.70。

新增tomcat7.0.70/lib為依賴。

Tomcat和Resin中的Filter
2004-10-19
TomcatFilter
小程式骨架屏動態注入元件
2018-12-05
元件
Java安全之基於Tomcat的Filter型記憶體馬
2021-11-21
JavaTomcatFilter記憶體
linux動態注入(含視訊演示)
2018-09-26
Linux
隨手記：Bruno動態注入Header
2024-07-16
Header
動態執行緒池（DynamicTp）之動態調整Tomcat、Jetty、Undertow執行緒池引數篇
2022-03-10
執行緒TomcatJetty
Tomcat深入淺出——Filter與Listener(五)
2022-07-10
TomcatFilter
Tomcat 記憶體馬（二）Filter型
2021-11-06
Tomcat記憶體Filter
sql注入之union注入
2020-12-13
SQL
程式注入之DLL注入
2018-04-17
AngularJS之Filter
2021-09-09
AngularJSFilter
oracle全文索引之FILTER_4_PROCEDURE_FILTER
2009-05-18
Oracle索引Filter
oracle全文索引之FILTER_1_NULL_FILTER
2009-05-18
Oracle索引FilterNull
【免殺技術】Tomcat記憶體馬-Filter
2022-02-04
Tomcat記憶體Filter
spring的filter與tomcat的get和post
2008-02-18
SpringFilterTomcat
反射，註解，動態代理，依賴注入控制反轉
2018-06-07
反射依賴注入
nginx+tomcat動靜態資源分離
2016-05-20
NginxTomcat
sql注入之堆疊注入及waf繞過注入
2021-08-03
SQL
AOP之動態代理
2016-11-19
JavaWeb之動態代理
2017-01-05
JavaWeb
自動注入
2024-04-27
sql注入之型別及提交注入
2021-07-30
SQL型別
spring+groovy實現動態程式碼注入執行
2018-11-07
Spring
iOS安全攻防（十二）：iOS7的動態庫注入
2014-02-13
iOS
oracle全文索引之FILTER_2_INSO_FILTER
2009-05-18
Oracle索引Filter
Java之JNDI注入
2021-11-10
Java
javaweb之Filter詳解(轉)
2013-08-23
JavaWebFilter
oracle procedure plsql 動態sql之動態傳遞表
2013-02-25
OracleSQL
Java開發學習(七)----DI依賴注入之自動裝配與集合注入
2022-07-04
Java依賴注入
echarts之靜態與動態地圖
2020-11-13
Echarts地圖
AOP之靜態代理VS動態代理
2018-03-30
IOC注入技術之編譯時注入
2020-12-13
編譯
PHP 反射之動態代理
2019-09-22
PHP反射
Java Web之動態代理
2017-12-13
JavaWeb
Nginx 動態模組 nginx-mod-http-image-filter 載入失敗解決
2022-01-22
NginxHTTPFilter
Tomcat學習筆記—-本地部署servlet動態資源
2018-06-07
Tomcat筆記Servlet
SpringBootApplication是如何啟動Tomcat的？ | 破解SpringBoot Tomcat啟動之謎！
2020-04-07
Spring BootAPPTomcat
Java Web之tomcat開機後臺啟動
2017-12-13
JavaWebTomcat