fix shiro filter memshell

bytedance · Dec 21, 2023 · 414cf65 · 414cf65
1 parent d3c4d83
commit 414cf65
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 8 deletions.
diff --git a/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbe.java b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbe.java
@@ -310,6 +310,7 @@ private void checkClassFilter(ClassLoader loader, String className, byte[] class
 
                 client.write(Operate.SCANCLASS, classFilter);
                 SmithLogger.logger.info("send metadata: " + classFilter.toString());
+                Thread.sleep(1000);
                 sendByte(classfileBuffer, classFilter.getTransId());
             }
         } catch(Exception e) {

diff --git a/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbeProxy.java b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/SmithProbeProxy.java
@@ -46,6 +46,13 @@ protected Object initialValue() {
         }
     };
 
+    public static InheritableThreadLocal<Object> needFoundfilterDef = new InheritableThreadLocal<Object>() {
+        @Override
+        protected Object initialValue() {
+            return null;
+        }
+    };
+
     public SmithProbeProxy() {
          quotas = Stream.generate(() -> new AtomicIntegerArray(METHOD_MAX_ID)).limit(CLASS_MAX_ID).toArray(AtomicIntegerArray[]::new);
     }
@@ -183,6 +190,9 @@ private Class<?> getFilterFromLoader(Object context, String filterName) {
 
     public void checkAddFilterPre(int classID, int methodID, Object[] args) {
         SmithLogger.logger.info("checkAddFilter pre_hook call success");
+        if (args.length < 2) {
+            return;
+        }
         try {
             Object filterdef = args[1];
             Object filter = null;
@@ -222,6 +232,8 @@ public void checkAddFilterPre(int classID, int methodID, Object[] args) {
                             SmithProbe.getInstance().sendClass(filter.getClass(), classFilter.getTransId());
                         }
                     }
+                } else {
+                    needFoundfilterDef.set(filterdef);
                 }
             }
         } catch (Exception e) {
@@ -236,10 +248,29 @@ public void checkFilterConfigPost(int classID, int methodID, Object[] args, Obje
         try {
             localfilterConfig.set(ret);
             localfilterDef.set(args[1]);
+
+            // shiro filter check
+            if (needFoundfilterDef != null && needFoundfilterDef.get() == args[1]) {
+                Object filter = getFilterFromConfig(ret);
+                if (filter != null) {
+                    ClassFilter classFilter = new ClassFilter();
+                        SmithHandler.queryClassFilter(filter.getClass(), classFilter);
+
+                        classFilter.setTransId();
+
+                        classFilter.setRuleId(-1);
+                        classFilter.setStackTrace(Thread.currentThread().getStackTrace());
+                        if (client != null) {
+                            client.write(Operate.SCANCLASS, classFilter);
+                            SmithLogger.logger.info("send metadata: " + classFilter.toString());
+
+                            SmithProbe.getInstance().sendClass(filter.getClass(), classFilter.getTransId());
+                        }
+                }  
+            }
         } catch(Exception e) {
             SmithLogger.exception(e);
         }
-
     }
 
     public void checkAddValvePre(int classID, int methodID, Object[] args) {

diff --git a/rasp/jvm/JVMProbe/src/main/java/com/security/smith/client/Client.java b/rasp/jvm/JVMProbe/src/main/java/com/security/smith/client/Client.java
@@ -86,14 +86,14 @@ public void write(Operate operate, Object object) {
 
         Message message = new Message();
 
-        try {
-            if (operate == Operate.CLASSUPLOAD) {
-                Thread.sleep(1000);
-            }
+        // try {
+        //     if (operate == Operate.CLASSUPLOAD) {
+        //         Thread.sleep(1000);
+        //     }
 
-        } catch (Exception e) {
-            // TODO: handle exception
-        }
+        // } catch (Exception e) {
+        //     // TODO: handle exception
+        // }
 
         message.setOperate(operate);
         message.setData(objectMapper.valueToTree(object));