archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-23 07:21:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support hessian packer (#36)

Browse Source
This commit is contained in:
ReaJason
2025-02-20 22:28:34 +08:00
parent 3e40763724
commit 18aa8ed60d
22 changed files with 349 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java
+3
View File
@@ -78,6 +78,7 @@ public class ShellAssertionTool {
} else {
content = packer.getInstance().pack(generateResult);
assertInjectIsOk(url, shellType, shellTool, content, packer, container);
log.info("send inject payload successfully");
}
switch (shellTool) {
@@ -247,6 +248,8 @@ public class ShellAssertionTool {
case JavaCommonsBeanutils18 -> VulTool.postData(url + "/java_deserialize/cb183", content);
case JavaCommonsBeanutils19 -> VulTool.postData(url + "/java_deserialize/cb194", content);
case JavaCommonsBeanutils110 -> VulTool.postData(url + "/java_deserialize/cb110", content);
case HessianDeserialize -> VulTool.postData(url + "/hessian", content);
case Hessian2Deserialize -> VulTool.postData(url + "/hessian2", content);
case Base64 -> VulTool.postData(url + "/b64", content);
case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
default -> throw new IllegalStateException("Unexpected value: " + packer);
integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8DeserializeContainerTest.java
+3 -1
View File
@@ -46,7 +46,9 @@ public class Tomcat8DeserializeContainerTest {
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils17),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils18),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils19),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110)
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.HessianDeserialize),
arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Hessian2Deserialize)
);
}