第四课-系统学习代码审计：命令执行漏洞讲解

public static void main(String[] args) throws IOException {//        ProcessBuilder pb = new ProcessBuilder("cmd", "/c", "calc");        ProcessBuilder pb = new ProcessBuilder("cmd", "/c", "dir && calc");        Process p = pb.start();        // 输出结果        // 命令正常执行的输出        InputStream inputStream = p.getInputStream();        // 命令执行失败的输出        InputStream errorStream = p.getErrorStream();        BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream,"GBK"));        String line = null;        // 如果命令正确，输出结果        if (inputStream != null){            while ((line = bufferedReader.readLine()) != null) {                System.out.println(line);            }        }        // 如果命令失败，输出结果        if (errorStream != null){            BufferedReader errorReader = new BufferedReader(new InputStreamReader(errorStream,"GBK"));            while ((line = errorReader.readLine()) != null) {                System.out.println(line);            }        }        bufferedReader.close();        inputStream.close();        p.destroy();        System.out.println("执行完毕");    }

@GetMapping("/ping")    public Map ping(String ip) throws Exception {//        ProcessBuilder pb = new ProcessBuilder("ping" ,ip);        ProcessBuilder pb = new ProcessBuilder("cmd","/c","ping" ,ip);        Process p = pb.start();        InputStream inputStream = p.getInputStream();        // 命令执行失败的输出        InputStream errorStream = p.getErrorStream();        // 封装返回结果        HashMap hashMap = new HashMap();        BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream,"GBK"));        String line = null;        StringBuilder result = new StringBuilder();        // 如果命令正确，输出结果        if (inputStream != null){            while ((line = bufferedReader.readLine()) != null) {                System.out.println(line);                result.append(line + "<hr/>");            }        }        // 如果命令失败，输出结果        if (errorStream != null){            BufferedReader errorReader = new BufferedReader(new InputStreamReader(errorStream,"GBK"));            while ((line = errorReader.readLine()) != null) {                System.out.println(line);                result.append(line + "<hr/>");            }        }        bufferedReader.close();        inputStream.close();//        p.destroy();        System.out.println("执行完毕");        hashMap.put("data",result);        return hashMap;    }

| 操作系统 | 符号  | 示例               | 说明                                               ||----------|-------|--------------------|----------------------------------------------------|| Windows  | `&`   | `cmd1 & cmd2`      | 先执行`cmd1`，再执行`cmd2`。|| Windows  | `&&`  | `cmd1 && cmd2`     | 先执行`cmd1`，如果成功则执行`cmd2`。|| Windows  | `||`  | `cmd1 || cmd2`     | 先执行`cmd1`，如果失败则执行`cmd2`。|| Windows  | `|`   | `cmd1 | cmd2`      | 将`cmd1`的输出作为`cmd2`的输入。|| Linux    | `;`   | `cmd1; cmd2`       | 先执行`cmd1`，再执行`cmd2`。|| Linux    | `&&`  | `cmd1 && cmd2`     | 先执行`cmd1`，如果成功则执行`cmd2`。|| Linux    | `||`  | `cmd1 || cmd2`     | 先执行`cmd1`，如果失败则执行`cmd2`。|| Linux    | `|`   | `cmd1 | cmd2`      | 将`cmd1`的输出作为`cmd2`的输入。|| Linux    | `&`   | `cmd1 & cmd2`      | 将`cmd1`放入后台执行，然后立即执行`cmd2`。|

//执行指定的字符串命令。exec(String command)//执行由字符串数组指定的命令和参数。exec(String[] cmdArray)//执行指定的字符串命令，并在指定的环境变量下。exec(String command, String[] envp)//执行由字符串数组指定的命令和参数，并在指定的环境变量下。exec(String[] cmdArray, String[] envp)//在指定的工作目录下执行指定的字符串命令，并在指定的环境变量下。exec(String command, String[] envp, File dir)//在指定的工作目录下执行由字符串数组指定的命令和参数，并在指定的环境变量下。exec(String[] cmdArray, String[] envp, File dir)

// ====== 获取执行引擎// 创建一个 ScriptEngineManager 实例ScriptEngineManager manager = new ScriptEngineManager();// 通过 ScriptEngineManager 获取一个 JavaScript 引擎实例ScriptEngine engine = manager.getEngineByName("JavaScript");// 检查是否成功获取引擎if (engine != null) {    System.out.println("JavaScript 引擎已成功加载。");} else {    System.out.println("未能加载 JavaScript 引擎。");}// ==================== 执行JS代码===========ScriptEngineManager manager = new ScriptEngineManager();    ScriptEngine engine = manager.getEngineByName("JavaScript");    try {        // 执行简单的 JavaScript 表达式        engine.eval("print('Hello, World!');");        // 执行带有变量的 JavaScript 代码        engine.eval("var x = 10; var y = 20; var sum = x + y; print('Sum: ' + sum);");        // 从 Java 调用 JavaScript 函数        String script = "function greet(name) { return 'Hello, ' + name; }";        engine.eval(script);        Object result = engine.eval("greet('Alice');");        System.out.println(result); // 输出：Hello, Alice    } catch (ScriptException e) {        e.printStackTrace();    }}// ========================= 传递 Java 对象到 JavaScript    ==================ScriptEngineManager manager = new ScriptEngineManager();    ScriptEngine engine = manager.getEngineByName("JavaScript");    try {        // 创建一个 Java 对象        Person person = new Person("John", 30);        // 将 Java 对象绑定到脚本引擎的上下文中        engine.put("person", person);        // 在 JavaScript 中访问和修改 Java 对象的属性        engine.eval("print('Name: ' + person.getName());");        engine.eval("person.setName('Jane');");        engine.eval("print('New Name: ' + person.getName());");    } catch (ScriptException e) {        e.printStackTrace();    }}// ================= 执行外部的 JavaScript 文件============ScriptEngineManager manager = new ScriptEngineManager();ScriptEngine engine = manager.getEngineByName("JavaScript");try (FileReader reader = new FileReader("path/to/your/script.js")) {    // 执行外部 JavaScript 文件    engine.eval(reader);} catch (ScriptException | IOException e) {    e.printStackTrace();}

try {    String test = "var a = mainOutput(); function mainOutput() { var x=java.lang.Runtime.getRuntime().exec("calc"); };";    engine.eval(test);}catch (Exception e){}