Java代码审计rce漏洞

最新推荐文章于 2024-09-14 14:24:20 发布

诡墨佯

最新推荐文章于 2024-09-14 14:24:20 发布

阅读量885

点赞数 2

分类专栏： Java安全文章标签： java

本文链接：https://blog.csdn.net/m0_55772907/article/details/127865056

版权

本文详细探讨了Java中的RCE漏洞，包括Runtime.exec()、反射Runtime、ProcessBuilder及其命令执行方式，以及ScriptEngine和YAML命令执行。通过具体代码示例，展示了审计时需要注意的点，并提到了Groovy语言的潜在风险。

摘要由CSDN通过智能技术生成

Runtime

Runtime.exec("command")

public class LocalRuntime extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        String cmd = req.getParameter("cmd");
        InputStream ins = Runtime.getRuntime().exec(cmd).getInputStream();
        ServletOutputStream sos = resp.getOutputStream();
        int len;
        byte[] bytes = new byte[1024];
        while ((len = ins.read(bytes))!=-1){
            sos.write(bytes, 0, len);
        }

    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        super.doGet(req, resp);
    }
}

反射Runtime

1、反射获取Runtime的class对象

2、获取Runtime构造方法

3、newInstance一个新Runtime的实例对象

4、获取exec方法

5、invoke激活执行

public class ReflactRuntime extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
        String cmd = req.getParameter("cmd");
        try {
            Class cls = Class.forName("java.lang.Runtime");
            Constructor constructor = cls.getDeclaredConstructor();
            constructor.setAccessible(true);
            Object runtime = constructor.newInstance();
            Method exec = cls.getMethod("exec", String.class);
            Process process = (Process) exec.invoke(runtime, cmd);

            InputStream ins = process.getInputStream();
            int len;
            byte[] bytes = new byte[1024];
            ServletOutputStream sos = resp.getOutputStream();
            while ((len = ins.read(bytes)) != -1){
                sos.write(bytes, 0, len);
            }

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        super.doGet(req, resp);
    }
}