Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit b6bc32e

Browse files
committed
Add new rce tricks
关注项目的人好像不少,更新几个 RCE 方法
1 parent a509ecd commit b6bc32e

File tree

6 files changed

+784
-169
lines changed

6 files changed

+784
-169
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33

44
**/target/**
55
**/.idea/**
6+
*.iml

‎README.md

Lines changed: 654 additions & 169 deletions
Large diffs are not rendered by default.
Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>org.example</groupId>
8+
<artifactId>springboot-restart-rce</artifactId>
9+
<version>1.0-SNAPSHOT</version>
10+
<parent>
11+
<groupId>org.springframework.boot</groupId>
12+
<artifactId>spring-boot-starter-parent</artifactId>
13+
<version>2.2.1.RELEASE</version>
14+
</parent>
15+
16+
<properties>
17+
<java.version>1.8</java.version>
18+
</properties>
19+
20+
<dependencies>
21+
<dependency>
22+
<groupId>org.springframework.boot</groupId>
23+
<artifactId>spring-boot-starter-web</artifactId>
24+
</dependency>
25+
26+
<dependency>
27+
<groupId>org.springframework.boot</groupId>
28+
<artifactId>spring-boot-starter-actuator</artifactId>
29+
</dependency>
30+
31+
<dependency>
32+
<groupId>org.springframework.cloud</groupId>
33+
<artifactId>spring-cloud-starter-config</artifactId>
34+
</dependency>
35+
36+
<dependency>
37+
<groupId>org.springframework.boot</groupId>
38+
<artifactId>spring-boot-starter-data-jpa</artifactId>
39+
</dependency>
40+
41+
<dependency>
42+
<groupId>com.h2database</groupId>
43+
<artifactId>h2</artifactId>
44+
</dependency>
45+
46+
<dependency>
47+
<groupId>org.codehaus.groovy</groupId>
48+
<artifactId>groovy</artifactId>
49+
<version>2.5.8</version>
50+
</dependency>
51+
52+
</dependencies>
53+
54+
<dependencyManagement>
55+
<dependencies>
56+
<dependency>
57+
<groupId>org.springframework.cloud</groupId>
58+
<artifactId>spring-cloud-dependencies</artifactId>
59+
<version>Hoxton.SR1</version>
60+
<type>pom</type>
61+
<scope>import</scope>
62+
</dependency>
63+
</dependencies>
64+
</dependencyManagement>
65+
66+
<build>
67+
<plugins>
68+
<plugin>
69+
<groupId>org.springframework.boot</groupId>
70+
<artifactId>spring-boot-maven-plugin</artifactId>
71+
</plugin>
72+
</plugins>
73+
</build>
74+
75+
</project>
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package code.landgrey;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class Application {
8+
public static void main(String[] args){
9+
SpringApplication.run(Application.class,args);
10+
}
11+
}
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package code.landgrey.controller;
2+
3+
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
4+
import org.springframework.web.bind.annotation.RequestMapping;
5+
import org.springframework.web.bind.annotation.RestController;
6+
7+
@RestController
8+
@EnableAutoConfiguration
9+
public class Article {
10+
@RequestMapping("/article")
11+
public String hello(String id){
12+
int total = 100;
13+
String message = String.format("You've read %s books, and there are %d left", id, total - Integer.valueOf(id));
14+
return message;
15+
}
16+
}
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
server.port=9098
2+
server.address=127.0.0.1
3+
4+
5+
# vulnerable configuration set 0: spring boot 1.0 - 1.4
6+
# all spring boot versions 1.0 - 1.4 expose actuators by default without any parameters
7+
# no configuration required to expose them
8+
9+
# safe configuration set 0: spring boot 1.0 - 1.4
10+
#management.security.enabled=true
11+
12+
# vulnerable configuration set 1: spring boot 1.5+
13+
# spring boot 1.5+ requires management.security.enabled=false to expose sensitive actuators
14+
#management.security.enabled=false
15+
16+
# safe configuration set 1: spring boot 1.5+
17+
# when 'management.security.enabled=false' but all sensitive actuators explicitly disabled
18+
#management.security.enabled=false
19+
20+
## vulnerable configuration set 2: spring boot 2+
21+
#management.security.enabled=false
22+
#management.endpoint.refresh.enabled=true
23+
management.endpoints.web.exposure.include=env,restart,refresh
24+
#management.endpoints.web.exposure.include=*
25+
management.endpoint.restart.enabled=true
26+
27+
spring.datasource.data

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /