feat: support BigInteger packer

vul/vul-webapp-jakarta/src/main/java/jakarta/BigIntegerClassLaoderServlet.java

@@ -0,0 +1,51 @@
+package jakarta;
+
+import jakarta.servlet.*;
+
+import java.io.IOException;
+
+/**
+ * @author Wans
+ * @since 2025/08/25
+ */
+public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet {
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+
+    }
+
+    @Override
+    public ServletConfig getServletConfig() {
+        return null;
+    }
+
+    @Override
+    public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        try {
+            byte[] bytes = decodeBigInteger(data);
+            Object obj = defineClass(null, bytes, 0, bytes.length).newInstance();
+            res.getWriter().print(obj);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
+        Class<?> decoderClass = Class.forName("java.math.BigInteger");
+        java.lang.reflect.Constructor<?> ctor = decoderClass.getConstructor(String.class, int.class);
+        Object bigInt = ctor.newInstance(bigIntegerStr, 36);
+        return (byte[]) decoderClass.getMethod("toByteArray").invoke(bigInt);
+    }
+
+    @Override
+    public String getServletInfo() {
+        return "";
+    }
+
+    @Override
+    public void destroy() {
+
+    }
+}

vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml

@@ -45,6 +45,15 @@
         <url-pattern>/b64</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>biginteger</servlet-name>
+        <servlet-class>jakarta.BigIntegerClassLaoderServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>biginteger</servlet-name>
+        <url-pattern>/biginteger</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>js</servlet-name>
         <servlet-class>jakarta.ScriptEngineServlet</servlet-class>

vul/vul-webapp/src/main/java/BigIntegerClassLaoderServlet.java

@@ -0,0 +1,48 @@
+import javax.servlet.*;
+import java.io.IOException;
+
+/**
+ * @author Wans
+ * @since 2025/08/25
+ */
+public class BigIntegerClassLaoderServlet extends ClassLoader implements Servlet {
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+
+    }
+
+    @Override
+    public ServletConfig getServletConfig() {
+        return null;
+    }
+
+    @Override
+    public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        try {
+            byte[] bytes = decodeBigInteger(data);
+            Object obj = defineClass(null, bytes, 0, bytes.length).newInstance();
+            res.getWriter().print(obj);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
+        Class<?> decoderClass = Class.forName("java.math.BigInteger");
+        java.lang.reflect.Constructor<?> ctor = decoderClass.getConstructor(String.class, int.class);
+        Object bigInt = ctor.newInstance(bigIntegerStr, 36);
+        return (byte[]) decoderClass.getMethod("toByteArray").invoke(bigInt);
+    }
+
+    @Override
+    public String getServletInfo() {
+        return "";
+    }
+
+    @Override
+    public void destroy() {
+
+    }
+}

vul/vul-webapp/src/main/webapp/WEB-INF/web.xml

@@ -55,6 +55,16 @@
         <url-pattern>/b64</url-pattern>
     </servlet-mapping>
 
+    <!-- 用于测试 Java 反序列化 -->
+    <servlet>
+        <servlet-name>biginteger</servlet-name>
+        <servlet-class>BigIntegerClassLaoderServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>biginteger</servlet-name>
+        <url-pattern>/biginteger</url-pattern>
+    </servlet-mapping>
+
     <filter>
         <filter-name>godzilla</filter-name>
         <filter-class>EmptyFilter</filter-class>