Skip to content

Commit 40cf83b

Browse files
JoyChou93JoyChou93
committed
add command inject
1 parent ea74d17 commit 40cf83b

File tree

12 files changed

+127
-41
lines changed

12 files changed

+127
-41
lines changed

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@ other-vuls/
55
docker/
66
poc/
77
src/main/java/org/joychou/test/
8-
*.iml
8+
*.iml
9+
docker_jdk_build.sh

‎README.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,12 @@ Each vulnerability type code has a security vulnerability by default unless ther
1313

1414
[Online demo](http://118.25.15.216:8080)
1515

16+
Login username & password:
1617

17-
18+
```
19+
admin/admin123
20+
joychou/joychou123
21+
```
1822

1923

2024
## Vulnerability Code

‎README_zh.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@
1212

1313
[在线Demo](http://118.25.15.216:8080)
1414

15+
登录用户名密码：
16+
17+
```
18+
admin/admin123
19+
joychou/joychou123
20+
```
1521

1622
## 漏洞代码
1723

‎src/main/java/org/joychou/controller/CommandInject.java

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
package org.joychou.controller;
2+
3+
import org.joychou.security.SecurityUtil;
4+
import org.joychou.utils.Tools;
5+
import org.slf4j.Logger;
6+
import org.slf4j.LoggerFactory;
7+
import org.springframework.web.bind.annotation.GetMapping;
8+
import org.springframework.web.bind.annotation.RestController;
9+
10+
import javax.servlet.http.HttpServletRequest;
11+
import java.io.IOException;
12+
13+
@RestController
14+
public class CommandInject {
15+
16+
protected final Logger logger = LoggerFactory.getLogger(this.getClass());
17+
18+
/**
19+
* http://localhost:8080/codeinject?filepath=/tmp;pwd
20+
*
21+
* @param filepath filepath
22+
* @return result
23+
*/
24+
@GetMapping("/codeinject")
25+
public static String codeInject(String filepath) throws IOException {
26+
27+
String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath};
28+
ProcessBuilder builder = new ProcessBuilder(cmdList);
29+
builder.redirectErrorStream(true);
30+
Process process = builder.start();
31+
return Tools.convertStreamToString(process.getInputStream());
32+
}
33+
34+
/**
35+
* Host Injection
36+
* host: Host: hacked by joychou;curl ssrf.http.joychou.org
37+
* http://localhost:8080/codeinject/host
38+
*
39+
*/
40+
@GetMapping("/codeinject/host")
41+
public String codeInjectHost(HttpServletRequest request) throws IOException {
42+
43+
String host = request.getHeader("host");
44+
logger.info(host);
45+
String[] cmdList = new String[]{"sh", "-c", "curl " + host};
46+
ProcessBuilder builder = new ProcessBuilder(cmdList);
47+
builder.redirectErrorStream(true);
48+
Process process = builder.start();
49+
return Tools.convertStreamToString(process.getInputStream());
50+
}
51+
52+
@GetMapping("/codeinject/sec")
53+
public static String codeInjectSec(String filepath) throws IOException {
54+
String filterFilePath = SecurityUtil.cmdFilter(filepath);
55+
if (null == filterFilePath) {
56+
return "Bad boy. I got u.";
57+
}
58+
String[] cmdList = new String[]{"sh", "-c", "ls -la " + filterFilePath};
59+
ProcessBuilder builder = new ProcessBuilder(cmdList);
60+
builder.redirectErrorStream(true);
61+
Process process = builder.start();
62+
return Tools.convertStreamToString(process.getInputStream());
63+
}
64+
}

‎src/main/java/org/joychou/controller/SQLI.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
public class SQLI {
2222

2323
private static String driver = "com.mysql.jdbc.Driver";
24-
private static String url = "jdbc:mysql://127.0.0.1:3306/java_sec_code";
24+
private static String url = "jdbc:mysql://localhost:3306/java_sec_code";
2525
private static String user = "root";
2626
private static String password = "woshishujukumima";
2727

‎src/main/java/org/joychou/controller/XStreamRce.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public class XStreamRce {
2222
*/
2323
@PostMapping("/xstream")
2424
public String parseXml(HttpServletRequest request) throws Exception{
25-
String xml = Tools.getBody(request);
25+
String xml = Tools.getRequestBody(request);
2626
XStream xstream = new XStream(new DomDriver());
2727
xstream.fromXML(xml);
2828
return "xstream";

‎src/main/java/org/joychou/controller/XXE.java

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ public class XXE {
3434
@RequestMapping(value = "/xmlReader", method = RequestMethod.POST)
3535
public String xxe_xmlReader(HttpServletRequest request) {
3636
try {
37-
String xml_con = Tools.getBody(request);
37+
String xml_con = Tools.getRequestBody(request);
3838
System.out.println(xml_con);
3939
XMLReader xmlReader = XMLReaderFactory.createXMLReader();
4040
xmlReader.parse( new InputSource(new StringReader(xml_con)) ); // parse xml
@@ -49,7 +49,7 @@ public String xxe_xmlReader(HttpServletRequest request) {
4949
@RequestMapping(value = "/xmlReader_fix", method = RequestMethod.POST)
5050
public String xxe_xmlReader_fix(HttpServletRequest request) {
5151
try {
52-
String xml_con = Tools.getBody(request);
52+
String xml_con = Tools.getRequestBody(request);
5353
System.out.println(xml_con);
5454

5555
XMLReader xmlReader = XMLReaderFactory.createXMLReader();
@@ -71,7 +71,7 @@ public String xxe_xmlReader_fix(HttpServletRequest request) {
7171
@RequestMapping(value = "/SAXBuilder", method = RequestMethod.POST)
7272
public String xxe_SAXBuilder(HttpServletRequest request) {
7373
try {
74-
String xml_con = Tools.getBody(request);
74+
String xml_con = Tools.getRequestBody(request);
7575
System.out.println(xml_con);
7676

7777
SAXBuilder builder = new SAXBuilder();
@@ -86,7 +86,7 @@ public String xxe_SAXBuilder(HttpServletRequest request) {
8686
@RequestMapping(value = "/SAXBuilder_fix", method = RequestMethod.POST)
8787
public String xxe_SAXBuilder_fix(HttpServletRequest request) {
8888
try {
89-
String xml_con = Tools.getBody(request);
89+
String xml_con = Tools.getRequestBody(request);
9090
System.out.println(xml_con);
9191

9292
SAXBuilder builder = new SAXBuilder();
@@ -104,7 +104,7 @@ public String xxe_SAXBuilder_fix(HttpServletRequest request) {
104104
@RequestMapping(value = "/SAXReader", method = RequestMethod.POST)
105105
public String xxe_SAXReader(HttpServletRequest request) {
106106
try {
107-
String xml_con = Tools.getBody(request);
107+
String xml_con = Tools.getRequestBody(request);
108108
System.out.println(xml_con);
109109

110110
SAXReader reader = new SAXReader();
@@ -120,7 +120,7 @@ public String xxe_SAXReader(HttpServletRequest request) {
120120
@RequestMapping(value = "/SAXReader_fix", method = RequestMethod.POST)
121121
public String xxe_SAXReader_fix(HttpServletRequest request) {
122122
try {
123-
String xml_con = Tools.getBody(request);
123+
String xml_con = Tools.getRequestBody(request);
124124
System.out.println(xml_con);
125125

126126
SAXReader reader = new SAXReader();
@@ -139,7 +139,7 @@ public String xxe_SAXReader_fix(HttpServletRequest request) {
139139
@RequestMapping(value = "/SAXParser", method = RequestMethod.POST)
140140
public String xxe_SAXParser(HttpServletRequest request) {
141141
try {
142-
String xml_con = Tools.getBody(request);
142+
String xml_con = Tools.getRequestBody(request);
143143
System.out.println(xml_con);
144144

145145
SAXParserFactory spf = SAXParserFactory.newInstance();
@@ -157,7 +157,7 @@ public String xxe_SAXParser(HttpServletRequest request) {
157157
@RequestMapping(value = "/SAXParser_fix", method = RequestMethod.POST)
158158
public String xxe_SAXParser_fix(HttpServletRequest request) {
159159
try {
160-
String xml_con = Tools.getBody(request);
160+
String xml_con = Tools.getRequestBody(request);
161161
System.out.println(xml_con);
162162

163163
SAXParserFactory spf = SAXParserFactory.newInstance();
@@ -177,7 +177,7 @@ public String xxe_SAXParser_fix(HttpServletRequest request) {
177177
@RequestMapping(value = "/Digester", method = RequestMethod.POST)
178178
public String xxe_Digester(HttpServletRequest request) {
179179
try {
180-
String xml_con = Tools.getBody(request);
180+
String xml_con = Tools.getRequestBody(request);
181181
System.out.println(xml_con);
182182

183183
Digester digester = new Digester();
@@ -193,7 +193,7 @@ public String xxe_Digester(HttpServletRequest request) {
193193
@RequestMapping(value = "/Digester_fix", method = RequestMethod.POST)
194194
public String xxe_Digester_fix(HttpServletRequest request) {
195195
try {
196-
String xml_con = Tools.getBody(request);
196+
String xml_con = Tools.getRequestBody(request);
197197
System.out.println(xml_con);
198198

199199
Digester digester = new Digester();
@@ -214,7 +214,7 @@ public String xxe_Digester_fix(HttpServletRequest request) {
214214
@RequestMapping(value = "/DocumentBuilder_return", method = RequestMethod.POST)
215215
public String xxeDocumentBuilderReturn(HttpServletRequest request) {
216216
try {
217-
String xml_con = Tools.getBody(request);
217+
String xml_con = Tools.getRequestBody(request);
218218
System.out.println(xml_con);
219219

220220
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
@@ -247,7 +247,7 @@ public String xxeDocumentBuilderReturn(HttpServletRequest request) {
247247
@RequestMapping(value = "/DocumentBuilder", method = RequestMethod.POST)
248248
public String DocumentBuilder(HttpServletRequest request) {
249249
try {
250-
String xml_con = Tools.getBody(request);
250+
String xml_con = Tools.getRequestBody(request);
251251
System.out.println(xml_con);
252252

253253
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
@@ -283,7 +283,7 @@ public String DocumentBuilder(HttpServletRequest request) {
283283
@RequestMapping(value = "/DocumentBuilder_fix", method = RequestMethod.POST)
284284
public String xxe_DocumentBuilder_fix(HttpServletRequest request) {
285285
try {
286-
String xml_con = Tools.getBody(request);
286+
String xml_con = Tools.getRequestBody(request);
287287
System.out.println(xml_con);
288288

289289
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
@@ -307,7 +307,7 @@ public String xxe_DocumentBuilder_fix(HttpServletRequest request) {
307307
@RequestMapping(value = "/DocumentBuilder_xinclude", method = RequestMethod.POST)
308308
public String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
309309
try {
310-
String xml_con = Tools.getBody(request);
310+
String xml_con = Tools.getRequestBody(request);
311311
System.out.println(xml_con);
312312

313313
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
@@ -343,7 +343,7 @@ public String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
343343
@RequestMapping(value = "/DocumentBuilder_xinclude_fix", method = RequestMethod.POST)
344344
public String xxe_xinclude_DocumentBuilder_fix(HttpServletRequest request) {
345345
try {
346-
String xml_con = Tools.getBody(request);
346+
String xml_con = Tools.getRequestBody(request);
347347
System.out.println(xml_con);
348348
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
349349

@@ -382,7 +382,7 @@ public String xxe_xinclude_DocumentBuilder_fix(HttpServletRequest request) {
382382
@PostMapping("/XMLReader/vul")
383383
public String XMLReaderVul(HttpServletRequest request) {
384384
try {
385-
String xml_con = Tools.getBody(request);
385+
String xml_con = Tools.getRequestBody(request);
386386
System.out.println(xml_con);
387387
SAXParserFactory spf = SAXParserFactory.newInstance();
388388
SAXParser saxParser = spf.newSAXParser();
@@ -399,7 +399,7 @@ public String XMLReaderVul(HttpServletRequest request) {
399399
@PostMapping("/XMLReader/fixed")
400400
public String XMLReaderSec(HttpServletRequest request) {
401401
try {
402-
String xml_con = Tools.getBody(request);
402+
String xml_con = Tools.getRequestBody(request);
403403
System.out.println(xml_con);
404404
SAXParserFactory spf = SAXParserFactory.newInstance();
405405
SAXParser saxParser = spf.newSAXParser();
@@ -415,4 +415,4 @@ public String XMLReaderSec(HttpServletRequest request) {
415415
}
416416
}
417417

418-
}
418+
}

‎src/main/java/org/joychou/controller/jsonp/JSONP.java

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
import org.joychou.security.SecurityUtil;
77
import org.springframework.http.MediaType;
88
import org.springframework.security.web.csrf.CsrfToken;
9-
import org.springframework.stereotype.Controller;
109
import org.springframework.web.bind.annotation.*;
1110

1211
import javax.servlet.http.HttpServletRequest;

‎src/main/java/org/joychou/security/SecurityUtil.java

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,12 @@
66
import java.io.UnsupportedEncodingException;
77
import java.net.URI;
88
import java.net.URLDecoder;
9+
import java.util.regex.Pattern;
910

1011
public class SecurityUtil {
1112

13+
private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$") ;
14+
1215
protected static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
1316
/**
1417
* 通过endsWith判断URL是否合法
@@ -106,4 +109,13 @@ public static String pathFilter(String filepath) {
106109

107110
return filepath;
108111
}
112+
113+
114+
public static String cmdFilter(String input) {
115+
if (!FILTER_PATTERN.matcher(input).matches()) {
116+
return null;
117+
}
118+
119+
return input;
120+
}
109121
}

‎src/main/java/org/joychou/utils/Tools.java

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,20 @@
11
package org.joychou.utils;
22

33
import javax.servlet.http.HttpServletRequest;
4-
import java.io.BufferedReader;
54
import java.io.IOException;
65
import java.io.InputStream;
7-
import java.io.InputStreamReader;
86

97
public class Tools {
108

11-
// get body
12-
public static String getBody(HttpServletRequest request) throws IOException {
9+
// Get request body.
10+
public static String getRequestBody(HttpServletRequest request) throws IOException {
1311
InputStream in = request.getInputStream();
14-
BufferedReader br = new BufferedReader(new InputStreamReader(in));
15-
StringBuffer sb = new StringBuffer("");
16-
String temp;
17-
while ((temp = br.readLine()) != null) {
18-
sb.append(temp);
19-
}
20-
if (in != null) {
21-
in.close();
22-
}
23-
if (br != null) {
24-
br.close();
25-
}
26-
return sb.toString();
12+
return convertStreamToString(in);
2713
}
2814

15+
// https://stackoverflow.com/questions/309424/how-do-i-read-convert-an-inputstream-into-a-string-in-java
16+
public static String convertStreamToString(java.io.InputStream is) {
17+
java.util.Scanner s = new java.util.Scanner(is).useDelimiter("\\A");
18+
return s.hasNext() ? s.next() : "";
19+
}
2920
}

‎src/main/resources/application.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/java_sec_code?useUnicode=true&characterEncoding=utf8&AllowPublicKeyRetrieval=true&useSSL=false&serverTimezone=GMT%2B8
2+
spring.datasource.url=jdbc:mysql://localhost:3306/java_sec_code?AllowPublicKeyRetrieval=true&useSSL=false
33
spring.datasource.username=root
44
spring.datasource.password=woshishujukumima
55
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver

‎src/main/resources/templates/index.html

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,15 @@
77
<body>
88
<p>Hello <span th:text="${user}"></span>.</p>
99
<p>Welcome to login java-sec-code application. <a th:href="@{/appInfo}">Application Infomation</a></p>
10+
<p>
11+
<a th:href="@{/codeinject?filepath=/tmp;pwd}">CmdInject</a>&nbsp;&nbsp;
12+
<a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
13+
<a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
14+
<a th:href="@{/sqli/jdbc/vul?username=joychou}">SqlInject</a>&nbsp;&nbsp;
15+
<a th:href="@{/ssrf/urlConnection?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
16+
<a th:href="@{/rce/exec?cmd=whoami}">RCE</a>
17+
</p>
18+
<p>...</p>
1019
<a th:href="@{/logout}">logout</a>
1120
</body>
1221
</html>

0 commit comments

Comments
 (0)