feat: support struct2 memshell and probeshell

2026-09-23 07:21:53 +08:00 · 2025-12-10 02:09:13 +08:00
parent 6628a74daa
commit 9bfa58cbd4
32 changed files with 2270 additions and 6 deletions
@@ -0,0 +1,52 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.ServletActionContext;
+
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/24
+ */
+public class Base64ClassLoaderAction extends ActionSupport {
+
+    private String data;
+
+    static byte[] decodeBase64(String base64Str) throws Exception {
+        try {
+            Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception var4) {
+            Class<?> decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+
+    public String execute() throws Exception {
+        try {
+            byte[] bytes = decodeBase64(data);
+            Object obj = reflectionDefineClass(bytes).newInstance();
+            ServletActionContext.getResponse().getWriter().print(obj);
+            return null;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+}
@@ -0,0 +1,37 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.ServletActionContext;
+
+import javax.servlet.http.HttpServletRequest;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+/**
+ * @author Wans
+ * @since 2025/08/25
+ */
+public class BigIntegerClassLoaderAction extends ActionSupport {
+    static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
+        Class<?> decoderClass = Class.forName("java.math.BigInteger");
+        return (byte[]) decoderClass.getMethod("toByteArray").invoke(decoderClass.getConstructor(String.class, int.class).newInstance(bigIntegerStr, Character.MAX_RADIX));
+    }
+
+    public String execute() throws Exception {
+        try {
+            HttpServletRequest request = ServletActionContext.getRequest();
+            String data = request.getParameter("data");
+            byte[] bytes = decodeBigInteger(data);
+            reflectionDefineClass(bytes).newInstance();
+            return ActionSupport.SUCCESS;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+}
@@ -0,0 +1,46 @@
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.io.ByteArrayInputStream;
+import java.io.ObjectInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+public class JavaReadObjAction extends ActionSupport {
+
+    private String data;
+
+    byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    @Override
+    public String execute() throws Exception {
+        try {
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(decodeBase64(data));
+            ObjectInputStream bis = new ObjectInputStream(inputStream);
+            bis.readObject();
+            bis.close();
+        } catch (Exception ignored) {
+
+        }
+        return SUCCESS;
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+}
@@ -0,0 +1,32 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.ServletActionContext;
+
+import javax.script.ScriptEngineManager;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+public class ScriptEngineAction extends ActionSupport {
+
+    private String data;
+
+    @Override
+    public String execute() throws Exception {
+        try {
+            Object eval = new ScriptEngineManager().getEngineByName("js").eval(data);
+            ServletActionContext.getResponse().getWriter().println(eval.toString());
+            return SUCCESS;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+}
@@ -0,0 +1,13 @@
+import com.opensymphony.xwork2.ActionSupport;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/7
+ */
+public class TestAction extends ActionSupport {
+
+    @Override
+    public String execute() throws Exception {
+        return SUCCESS;
+    }
+}
@@ -0,0 +1,62 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.commons.io.FileUtils;
+import org.apache.struts2.ServletActionContext;
+
+import java.io.File;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/26
+ */
+public class UploadAction extends ActionSupport {
+
+    private File upload;
+    private String uploadFileName;
+    private String uploadContentType;
+
+    private static final String UPLOAD_DIRECTORY = "/";
+
+    @Override
+    public String execute() throws Exception {
+        try {
+            if (upload != null) {
+                String uploadFolder = ServletActionContext.getServletContext().getRealPath(UPLOAD_DIRECTORY);
+                if (!uploadFolder.endsWith(File.separator)) {
+                    uploadFolder += File.separator;
+                }
+                String uploadPath = uploadFolder + uploadFileName;
+                File destFile = new File(uploadPath);
+                FileUtils.copyFile(upload, destFile);
+                ServletActionContext.getResponse().getWriter().println("file upload success: " + uploadPath);
+            }
+            return SUCCESS;
+        } catch (Exception e) {
+            ServletActionContext.getResponse().getWriter().println("file upload failed: " + e.getMessage());
+            return ERROR;
+        }
+    }
+
+    public File getUpload() {
+        return upload;
+    }
+
+    public void setUpload(File upload) {
+        this.upload = upload;
+    }
+
+    public String getUploadFileName() {
+        return uploadFileName;
+    }
+
+    public void setUploadFileName(String uploadFileName) {
+        this.uploadFileName = uploadFileName;
+    }
+
+    public String getUploadContentType() {
+        return uploadContentType;
+    }
+
+    public void setUploadContentType(String uploadContentType) {
+        this.uploadContentType = uploadContentType;
+    }
+}