shiro工具学习

如果反序列化流中包含非 Java 自身的数组,则会出现无法加载类的错误

总结下来,这可能还是类加载器的问题。网上多篇文章中都给出了此问题的两个解决方案:

点击查看代码
import java.io.BufferedOutputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.regex.Matcher;
import java.util.regex.Pattern;


public class ChangeKey {
    public static void main(String[] args) throws IOException {

        String result = new String(Files.readAllBytes(Paths.get("src/main/java/com/govuln/shiroattack/Evil.java")), StandardCharsets.UTF_8);
        String reg = "key = \"(.*?)\";";
        String key = "12";

        StringBuilder operatorStr=new StringBuilder(result);
        Pattern p = Pattern.compile(reg);
        Matcher m = p.matcher(operatorStr);
        if (m.find()){
            operatorStr.replace(m.start(1),m.end(1),key);
        }
        System.out.println(operatorStr.toString());

        BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream("src/main/java/com/govuln/shiroattack/Evil.java")) ;

        bos.write("".getBytes(StandardCharsets.UTF_8));
        bos.write(operatorStr.toString().getBytes(StandardCharsets.UTF_8));

        bos.close();

    }
}

posted @ 2022-11-29 10:59  W3w  阅读(89)  评论(0)    收藏  举报