-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path018-loadlibrary.jsp
62 lines (50 loc) · 1.5 KB
/
018-loadlibrary.jsp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
<%@page import="java.io.*" %>
<%@page import="java.util.*" %>
<%@page import="java.net.*" %>
<%@page import="net.sf.json.*" %>
<%@ page contentType="text/html; charset=UTF-8" %>
<html>
<head>
<meta charset="UTF-8"/>
<title>018 - 类库加载</title>
</head>
<body>
<h1>018 - 类库加载</h1>
<p>目前 loadLibrary hook 点不检查文件是否存在，下面的案例只是用于触发插件调用</p>
<%!
String encodeValue(String value)
{
try {
return URLEncoder.encode(value, "UTF-8");
} catch (UnsupportedEncodingException ex) {
throw new RuntimeException(ex.getCause());
}
}
%>
<%
String lib = request.getParameter("lib");
String unc = "?lib=" + encodeValue("\\\\8.8.8.8\\test.ext");
String local_win = "?lib=" + encodeValue("c:\\windows\\system32\\calc.exe");
String local_lin = "?lib=/bin/ls";
if (lib != null) {
try {
System.load(lib);
} catch (Exception e) {
out.print("<pre>");
e.printStackTrace(response.getWriter());
out.print("</pre>");
}
}
else {
%>
<p>UNC 加载: </p>
<p>curl '<a href="<%=request.getRequestURL()+unc%>" target="_blank"><%=request.getRequestURL() + unc%></a>'</p>
<p>Windows 本地加载: </p>
<p>curl '<a href="<%=request.getRequestURL()+local_win%>" target="_blank"><%=request.getRequestURL() + local_win%></a>'</p>
<p>Linux/Mac 本地加载: </p>
<p>curl '<a href="<%=request.getRequestURL()+local_lin%>" target="_blank"><%=request.getRequestURL() + local_lin%></a>'</p>
<%
}
%>
</body>
</html>