引言

在网络安全领域，远程调用命令（Remote Command Execution，简称RCE）是一种常见的攻击手段。通过RCE，攻击者可以在远程服务器上执行任意命令，从而实现提权、获取敏感信息等恶意目的。本文将揭秘远程调用CMD的技巧，帮助读者了解如何轻松实现日目标站的提权。

一、远程调用CMD概述

远程调用CMD是指攻击者通过特定的漏洞，在远程服务器上执行系统命令。这种攻击方式通常利用服务器软件的漏洞，如Apache Struts2、PHPStudy等。攻击者通过构造特定的HTTP请求，触发RCE漏洞，进而执行系统命令。

二、远程调用CMD的原理

远程调用CMD的原理主要基于以下几个步骤：

  1. 漏洞利用：攻击者首先需要找到目标服务器上的RCE漏洞。
  2. 构造请求：根据漏洞特点，构造一个包含恶意命令的HTTP请求。
  3. 执行命令：服务器接收到请求后，执行其中的命令。
  4. 获取结果：攻击者获取命令执行结果，实现提权等目的。

三、远程调用CMD的技巧

以下是一些常见的远程调用CMD技巧：

1. 利用Apache Struts2漏洞

Apache Struts2是一款流行的Java Web框架，曾经存在多个RCE漏洞。以下是一个利用Apache Struts2漏洞的示例：

”`java // 构造恶意请求 String payload = “%{(#n%).(#memberAccess(%{(#_memberAccess%3Ajava.util.concurrent.ConcurrentHashMap%2Cnull%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22%2C%22%23_memberAccess%22%2C%22%23context%22%2C%22java.util.ArrayList%22%2C%22java.util.ArrayList%22%2C0%2C1%2C%22get%22%2C%22add%22