Filter/Servlet型内存马的扫描抓捕与查杀

request.getSession().getServletContext() {ApplicationContextFacade}  -> context {ApplicationContext}     -> context {StandardContext}      * filterDefs      * filterMaps      * children      * servletMappings

Filter/Servlet名匹配路径Class名ClassLoaderClass文件存储路径。内存中Class字节码（方便反编译审计其是否存在恶意代码）该Class是否有对应的磁盘文件（判断内存马的重要指标）

byte[] classBytes = Repository.lookupClass(Class.forName("me.gv7.Memshell")).getBytes();

//org.apache.catalina.core.StandardContext#removeFilterDefpublic void removeFilterDef(FilterDef filterDef) {    synchronized(this.filterDefs) {        this.filterDefs.remove(filterDef.getFilterName());    }    this.fireContainerEvent("removeFilterDef", filterDef);}//org.apache.catalina.core.StandardContext#removeFilterMappublic void removeFilterMap(FilterMap filterMap) {    this.filterMaps.remove(filterMap);    this.fireContainerEvent("removeFilterMap", filterMap);}

public synchronized void deleteFilter(HttpServletRequest request,String filterName) throws Exception{    Object standardContext = getStandardContext(request);    // org.apache.catalina.core.StandardContext#removeFilterDef    HashMap<String,Object> filterConfig = getFilterConfig(request);    Object appFilterConfig = filterConfig.get(filterName);    Field _filterDef = appFilterConfig.getClass().getDeclaredField("filterDef");    _filterDef.setAccessible(true);    Object filterDef = _filterDef.get(appFilterConfig);    Method removeFilterDef = standardContext.getClass().getDeclaredMethod("removeFilterDef", new Class[]{org.apache.tomcat.util.descriptor.web.FilterDef.class});    removeFilterDef.setAccessible(true);    removeFilterDef.invoke(standardContext,filterDef);    // org.apache.catalina.core.StandardContext#removeFilterMap    Object[] filterMaps = getFilterMaps(request);    for(Object filterMap:filterMaps){        Field _filterName = filterMap.getClass().getDeclaredField("filterName");        _filterName.setAccessible(true);        String filterName0 = (String)_filterName.get(filterMap);        if(filterName0.equals(filterName)){            Method removeFilterMap = standardContext.getClass().getDeclaredMethod("removeFilterMap", new Class[]{org.apache.catalina.deploy.FilterMap.class});            removeFilterDef.setAccessible(true);            removeFilterMap.invoke(standardContext,filterMap);        }    }}

//org.apache.catalina.core.StandardContext#removeServletMappingpublic void removeServletMapping(String pattern) {    String name = null;    synchronized(this.servletMappingsLock) {        name = (String)this.servletMappings.remove(pattern);    }    Wrapper wrapper = (Wrapper)this.findChild(name);    if (wrapper != null) {        wrapper.removeMapping(pattern);    }    this.fireContainerEvent("removeServletMapping", pattern);}//org.apache.catalina.core.StandardContext#removeChildpublic void removeChild(Container child) {    if (!(child instanceof Wrapper)) {        throw new IllegalArgumentException(sm.getString("standardContext.notWrapper"));    } else {        super.removeChild(child);    }}

public synchronized void deleteServlet(HttpServletRequest request,String servletName) throws Exception{    HashMap<String,Object> childs = getChildren(request);    Object objChild = childs.get(servletName);    String urlPattern = null;    HashMap<String,String> servletMaps = getServletMaps(request);    for(Map.Entry<String,String> servletMap:servletMaps.entrySet()){        if(servletMap.getValue().equals(servletName)){            urlPattern = servletMap.getKey();            break;        }    }    if(urlPattern != null) {        // 反射调用 org.apache.catalina.core.StandardContext#removeServletMapping        Object standardContext = getStandardContext(request);        Method removeServletMapping = standardContext.getClass().getDeclaredMethod("removeServletMapping", new Class[]{String.class});        removeServletMapping.setAccessible(true);        removeServletMapping.invoke(standardContext, urlPattern);        // Tomcat 6必须removeChild 789可以不用        // 反射调用 org.apache.catalina.core.StandardContext#removeChild        Method removeChild = standardContext.getClass().getDeclaredMethod("removeChild", new Class[]{org.apache.catalina.Container.class});        removeChild.setAccessible(true);        removeChild.invoke(standardContext, objChild);    }}

原文链接：https://gv7.me/articles/2020/filter-servlet-type-memshell-scan-capture-and-kill/