Web安全-命令执行漏洞

<?php     $arg =$_GET['cmd'];if ($arg) {        system(“$arg”);     }?>

public class Employee implements java.io.Serializable{public String name;public String identify;public void mailCheck(){      System.out.println("This is the "+this.identify+" of our company");   }}

//反序列化所需类在io包中import java.io.*;public class SerializeDemo{public static void main(String [] args)   {      Employee e = new Employee();      e.name = "员工甲";      e.identify = "General staff";try      {// 打开一个文件输入流         FileOutputStream fileOut =new FileOutputStream("D:\Task\employee1.db");// 建立对象输入流         ObjectOutputStream out = new ObjectOutputStream(fileOut);//输出反序列化对象out.writeObject(e);out.close();         fileOut.close();         System.out.printf("Serialized data is saved in D:\Task\employee1.db");      }catch(IOException i)      {          i.printStackTrace();      }   }}

import java.io.*;public class SerializeDemo{public static void main(String [] args)   {      Employee e = null;try      {// 打开一个文件输入流         FileInputStream fileIn = new FileInputStream("D:\Task\employee1.db");// 建立对象输入流         ObjectInputStream in = new ObjectInputStream(fileIn);// 读取对象         e = (Employee) in.readObject();in.close();         fileIn.close();      }catch(IOException i)      {         i.printStackTrace();return;      }catch(ClassNotFoundException c)      {         System.out.println("Employee class not found");         c.printStackTrace();return;      }      System.out.println("Deserialized Employee...");      System.out.println("Name: " + e.name);      System.out.println("This is the "+e.identify+" of our company");    }}

//反序列化所需类在io包中import java.io.*;public class test{public static void main(String args[]) throws Exception{        UnsafeClass Unsafe = new UnsafeClass();        Unsafe.name = "hacked by ph0rse";        FileOutputStream fos = new FileOutputStream("object");        ObjectOutputStream os = new ObjectOutputStream(fos);//writeObject()方法将Unsafe对象写入object文件        os.writeObject(Unsafe);        os.close();//从文件中反序列化obj对象        FileInputStream fis = new FileInputStream("object");        ObjectInputStream ois = new ObjectInputStream(fis);//恢复对象        UnsafeClass objectFromDisk = (UnsafeClass)ois.readObject();        System.out.println(objectFromDisk.name);        ois.close();    }}class UnsafeClass implements Serializable{public String name;//重写readObject()方法private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException{//执行默认的readObject()方法        in.defaultReadObject();//执行命令        Runtime.getRuntime().exec("calc.exe");    }}

<?phpif( isset( $_POST[ 'Submit' ]  ) ) {// Get input    $target = $_REQUEST[ 'ip' ];// Determine OS and execute the ping command.if( stristr( php_uname( 's' ), 'Windows NT' ) ) {// Windows        $cmd = shell_exec( 'ping  ' . $target );    }else {// *nix        $cmd = shell_exec( 'ping  -c 4 ' . $target );    }// Feedback for the end userecho "<pre>{$cmd}</pre>"; }?>

Medium<?phpif( isset( $_POST[ 'Submit' ]  ) ) {// Get input    $target = $_REQUEST[ 'ip' ];// Set blacklist    $substitutions = array('&&' => '',';'  => '',    );// Remove any of the charactars in the array (blacklist).    $target = str_replace( array_keys( $substitutions ), $substitutions, $target );// Determine OS and execute the ping command.if( stristr( php_uname( 's' ), 'Windows NT' ) ) {// Windows        $cmd = shell_exec( 'ping  ' . $target );    }else {// *nix        $cmd = shell_exec( 'ping  -c 4 ' . $target );    }// Feedback for the end userecho "<pre>{$cmd}</pre>";  }?>

<?phpif( isset( $_POST[ 'Submit' ]  ) ) {// Get input    $target = trim($_REQUEST[ 'ip' ]);// Set blacklist    $substitutions = array('&'  => '',';'  => '','| ' => '','-'  => '','$'  => '','('  => '',')'  => '','`'  => '','||' => '',    );// Remove any of the charactars in the array (blacklist).    $target = str_replace( array_keys( $substitutions ), $substitutions, $target );// Determine OS and execute the ping command.if( stristr( php_uname( 's' ), 'Windows NT' ) ) {// Windows        $cmd = shell_exec( 'ping  ' . $target );    }else {// *nix        $cmd = shell_exec( 'ping  -c 4 ' . $target );    }// Feedback for the end userecho "<pre>{$cmd}</pre>";  }?>

<?phpif( isset( $_POST[ 'Submit' ]  ) ) {// Check Anti-CSRF token    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );// Get input    $target = $_REQUEST[ 'ip' ];    $target = stripslashes( $target );// Split the IP into 4 octects    $octet = explode( ".", $target );// Check IF each octet is an integerif( ( is_numeric( $octet[0] ) ) && ( is_numeric( $octet[1] ) ) && ( is_numeric( $octet[2] ) ) && ( is_numeric( $octet[3] ) ) && ( sizeof( $octet ) == 4 ) ) {// If all 4 octets are int's put the IP back together.        $target = $octet[0] . '.' . $octet[1] . '.' . $octet[2] . '.' . $octet[3];// Determine OS and execute the ping command.if( stristr( php_uname( 's' ), 'Windows NT' ) ) {// Windows            $cmd = shell_exec( 'ping  ' . $target );        }else {// *nix            $cmd = shell_exec( 'ping  -c 4 ' . $target );        }// Feedback for the end userecho "<pre>{$cmd}</pre>";    }else {// Ops. Let the user name theres a mistakeecho '<pre>ERROR: You have entered an invalid IP.</pre>';    }}// Generate Anti-CSRF tokengenerateSessionToken();?>

版权声明：本文为CSDN博主「Tr0e」原文链接：https://blog.csdn.net/weixin_39190897/article/details/86761882公众号排版：系统安全运维