java常用的代码执行

远程命令执行--RuntimeExec

代码:

public class RuntimeExec {
    @RequestMapping("/runtime")
    public String RuntimeExec(String cmd, Model model) {
        StringBuilder sb = new StringBuilder();
        String line;

        try {
            Process proc = Runtime.getRuntime().exec(cmd);

            InputStream fis = proc.getInputStream();
            InputStreamReader isr = new InputStreamReader(fis, "GBK");
            BufferedReader br = new BufferedReader(isr);
            while ((line = br.readLine()) != null) {
                sb.append(line).append(System.lineSeparator());
            }

        } catch (IOException e) {
            e.printStackTrace();
            sb.append(e);
        }
        model.addAttribute("results", sb.toString());
        return "basevul/rce/runtime";
    }
}

解析:使用注解接收cmd参数之后使用runtime包进行命令执行

 

 

 

远程代码执行--Groovy

代码:

public class GroovyExec {

    @GetMapping("/groovy")
    public String groovyExec(String cmd, Model model) {
        GroovyShell shell = new GroovyShell();
        try {
            shell.evaluate(cmd);
            model.addAttribute("results", "执行成功!!!");
        } catch (Exception e) {
            e.printStackTrace();
            model.addAttribute("results", e.toString());
        }
        return "basevul/rce/groovy";
    }
}

解析:使用"calc".execute()触发计算器,双引号内为执行的shell命令

 

远程代码执行--ProcessBuilder

 

远程代码执行--ProcessImpl

 

发表回复

电子邮件地址不会被公开。必填项已用 * 标注