总结

Java内存马如何获得Context

Tomcat获得

<%
    // 一个小路径快速获得StandardContext
    Field reqF = request.getClass().getDeclaredField("request");
    reqF.setAccessible(true);
    Request req = (Request) reqF.get(request);
    StandardContext stdcontext = (StandardContext) req.getContext();
%>

另一种

<%
    final String name = "yang_99";
    ServletContext servletContext = request.getSession().getServletContext();
    Field appctx = servletContext.getClass().getDeclaredField("context");
    appctx.setAccessible(true);
    ApplicationContext applicationContext = (ApplicationContext) appctx.get(servletContext);
    Field stdctx = applicationContext.getClass().getDeclaredField("context");
    stdctx.setAccessible(true);
    StandardContext standardContext = (StandardContext) stdctx.get(applicationContext);
%>

spring获得

https://www.anquanke.com/post/id/198886#h3-7

参考

https://github.com/Stakcery/JavaSec/blob/main/5.内存马学习/Tomcat/Tomcat-Servlet型内存马/Tomcat-Servlet型内存马.md

https://www.yuque.com/tianxiadamutou/zcfd4v/tdvszq

https://y4er.com/post/javaagent-tomcat-memshell/

https://xz.aliyun.com/t/9450

https://www.cnblogs.com/rickiyang/p/11368932.html

内存马总结文章

https://githubmemory.com/repo/bitterzzZZ/MemoryShellLearn