Java 任意文件下载漏洞

主要的知识点：

1、headers头的设定 resp.setHeader("content-disposition", "attachment; fileName=" + URLEncoder.encode(filename,"UTF-8"));

2、io流的使用

public class DownServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        String DownPath = req.getSession().getServletContext().getRealPath("/") + req.getParameter("file");

        String filename = DownPath.substring(DownPath.lastIndexOf("\\") +1);
        resp.setHeader("content-disposition", "attachment; fileName=" + URLEncoder.encode(filename,"UTF-8"));

        System.out.println(DownPath);
        FileInputStream fileInputStream = new FileInputStream(DownPath);
        ServletOutputStream servletOutputStream = resp.getOutputStream();

        byte[] bytes = new byte[1024];
        int iReadSize;
        while((iReadSize = fileInputStream.read(bytes)) != -1){
            servletOutputStream.write(bytes, 0, iReadSize);
        }

        fileInputStream.close();
        servletOutputStream.close();
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

    <!--下载Servlet-->
    <servlet-mapping>
        <servlet-name>DownServlet</servlet-name>
        <url-pattern>/download</url-pattern>
    </servlet-mapping>
    <servlet>
        <servlet-name>DownServlet</servlet-name>
        <servlet-class>com.zpchcbd.servlet.DownServlet</servlet-class>
    </servlet>

模拟真实环境，将其打包为war包，然后部署到tomcat中，当tomcat启动，会自动解压war包为相同名称的文件夹，如下所示

直接访问：http://127.0.0.1:8080/smbms/download?file=1.jpg

一般来说war包都会在上一层目录，所以我们在得到了相关的网站目录名称之后，可以直接访问上一层目录来对war进行下载分析

访问：http://127.0.0.1:8080/s1/myresp?file=../smbms.war

然后可以通过反编译工具直接进行编译了！