feat: support JDK8 ScriptEngine packer

vul-webapp/src/main/java/ScriptEngineServlet.java

@@ -0,0 +1,26 @@
+import javax.script.ScriptEngineFactory;
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.bind.DatatypeConverter;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+public class ScriptEngineServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String js = req.getParameter("js");
+        try {
+            Object eval = new ScriptEngineManager().getEngineByName("js").eval(js);
+            resp.getWriter().println(eval.toString());
+        } catch (ScriptException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

vul-webapp/src/main/webapp/WEB-INF/web.xml

@@ -15,6 +15,7 @@
         <url-pattern>/test</url-pattern>
     </servlet-mapping>
 
+    <!-- 用于 JSP 文件上传-->
     <servlet>
         <servlet-name>upload</servlet-name>
         <servlet-class>UploadServlet</servlet-class>
@@ -24,10 +25,23 @@
         <url-pattern>/upload</url-pattern>
     </servlet-mapping>
 
-    <listener>
-        <listener-class>ErrorListener</listener-class>
-    </listener>
+    <!-- 用于脚本引擎执行 JS -->
+    <servlet>
+        <servlet-name>js</servlet-name>
+        <servlet-class>ScriptEngineServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>js</servlet-name>
+        <url-pattern>/js</url-pattern>
+    </servlet-mapping>
 
+
+    <!-- 测试 listener 内存马 -->
+    <!--    <listener>-->
+    <!--        <listener-class>ErrorListener</listener-class>-->
+    <!--    </listener>-->
+
+    <!-- 测试 filter 内存马 -->
     <!--    <filter>-->
     <!--        <filter-name>godzilla</filter-name>-->
     <!--        <filter-class>ErrorHandler</filter-class>-->