远程命令执行--RuntimeExec
代码:
public class RuntimeExec { @RequestMapping("/runtime") public String RuntimeExec(String cmd, Model model) { StringBuilder sb = new StringBuilder(); String line; try { Process proc = Runtime.getRuntime().exec(cmd); InputStream fis = proc.getInputStream(); InputStreamReader isr = new InputStreamReader(fis, "GBK"); BufferedReader br = new BufferedReader(isr); while ((line = br.readLine()) != null) { sb.append(line).append(System.lineSeparator()); } } catch (IOException e) { e.printStackTrace(); sb.append(e); } model.addAttribute("results", sb.toString()); return "basevul/rce/runtime"; } }
解析:使用注解接收cmd参数之后使用runtime包进行命令执行
远程代码执行--Groovy
代码:
public class GroovyExec { @GetMapping("/groovy") public String groovyExec(String cmd, Model model) { GroovyShell shell = new GroovyShell(); try { shell.evaluate(cmd); model.addAttribute("results", "执行成功!!!"); } catch (Exception e) { e.printStackTrace(); model.addAttribute("results", e.toString()); } return "basevul/rce/groovy"; } }
解析:使用"calc".execute()触发计算器,双引号内为执行的shell命令
远程代码执行--ProcessBuilder
远程代码执行--ProcessImpl