feat: support JDK8 ScriptEngine packer

This commit is contained in:
ReaJason
2024-12-04 03:14:08 +08:00
parent bddeb4fbaf
commit 9864c3da32
13 changed files with 267 additions and 63 deletions
@@ -32,7 +32,7 @@ public class GeneratorMain {
System.out.println(shellConfig.getShellClassName() + " : " + shellBytesBase64Str);
System.out.println(shellConfig.getInjectorClassName() + " : " + injectorBytesBase64Str);
System.out.println(shellConfig);
Files.write(Paths.get(shellConfig.getShellClassName() + ".class"), generateResult.getShellBytes());
Files.write(Paths.get(shellConfig.getInjectorClassName() + ".class"), generateResult.getInjectorBytes());
JspPacker jspPacker = new JspPacker();
String jspContent = new String(jspPacker.pack(generateResult));
System.out.println(jspContent);
@@ -1,11 +1,39 @@
package com.reajason.javaweb.memsell.packer;
import com.reajason.javaweb.config.GenerateResult;
import lombok.Getter;
/**
* @author ReaJason
* @since 2024/11/26
*/
public interface Packer {
/**
* 将生成的内存马打包成指定格式
*
* @param generateResult 生成的内存马信息
* @return 指定格式字节数组
*/
byte[] pack(GenerateResult generateResult);
@Getter
static enum INSTANCE {
/**
* JSP 打包器
*/
JSP(new JspPacker()),
/**
* 脚本引擎打包器
*/
ScriptEngine(new ScriptEnginePacker());
private final Packer packer;
INSTANCE(Packer packer) {
this.packer = packer;
}
}
}
@@ -0,0 +1,23 @@
package com.reajason.javaweb.memsell.packer;
import com.reajason.javaweb.config.GenerateResult;
import lombok.SneakyThrows;
import org.apache.commons.io.IOUtils;
import java.nio.charset.Charset;
import java.util.Objects;
/**
* @author ReaJason
* @since 2024/12/3
*/
public class ScriptEnginePacker implements Packer {
@Override
@SneakyThrows
public byte[] pack(GenerateResult generateResult) {
String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
String injectorClassName = generateResult.getInjectorClassName();
String jsTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.js")), Charset.defaultCharset());
return jsTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str).getBytes();
}
}