feat: support deserialize packer (but only CB4)

vul-webapp/src/main/java/JavaReadObjServlet.java

@@ -0,0 +1,38 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.ObjectInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+public class JavaReadObjServlet extends HttpServlet {
+    byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        try {
+            String data = req.getParameter("data");
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(decodeBase64(data));
+            ObjectInputStream bis = new ObjectInputStream(inputStream);
+            bis.readObject();
+            bis.close();
+        } catch (Exception ignored) {
+
+        }
+    }
+}

vul-webapp/src/main/java/ScriptEngineServlet.java

@@ -13,9 +13,9 @@ import java.io.IOException;
 public class ScriptEngineServlet extends HttpServlet {
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
-        String js = req.getParameter("js");
+        String data = req.getParameter("data");
         try {
-            Object eval = new ScriptEngineManager().getEngineByName("js").eval(js);
+            Object eval = new ScriptEngineManager().getEngineByName("js").eval(data);
             resp.getWriter().println(eval.toString());
         } catch (ScriptException e) {
             throw new RuntimeException(e);

vul-webapp/src/main/webapp/WEB-INF/web.xml

@@ -35,6 +35,15 @@
         <url-pattern>/js</url-pattern>
     </servlet-mapping>
 
+    <!-- 用于测试 Java 反序列化 -->
+    <servlet>
+        <servlet-name>java-deserialize</servlet-name>
+        <servlet-class>JavaReadObjServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>java-deserialize</servlet-name>
+        <url-pattern>/java_deserialize</url-pattern>
+    </servlet-mapping>
 
     <!-- 测试 listener 内存马 -->
     <!--    <listener>-->