mirror of
https://github.com/pen4uin/java-memshell-generator.git
synced 2026-09-22 01:30:43 +08:00
This commit is contained in:
@@ -410,6 +410,26 @@ public class AbstractConfig {
|
|||||||
|
|
||||||
private String jarClassName;
|
private String jarClassName;
|
||||||
|
|
||||||
|
public byte[] getBytesInLoader() {
|
||||||
|
return bytesInLoader;
|
||||||
|
}
|
||||||
|
|
||||||
|
public void setBytesInLoader(byte[] bytesInLoader) {
|
||||||
|
this.bytesInLoader = bytesInLoader;
|
||||||
|
}
|
||||||
|
|
||||||
|
private byte[] bytesInLoader;
|
||||||
|
|
||||||
|
public String getClassNameInLoader() {
|
||||||
|
return classNameInLoader;
|
||||||
|
}
|
||||||
|
|
||||||
|
public void setClassNameInLoader(String classNameInLoader) {
|
||||||
|
this.classNameInLoader = classNameInLoader;
|
||||||
|
}
|
||||||
|
|
||||||
|
private String classNameInLoader;
|
||||||
|
|
||||||
public void build() {
|
public void build() {
|
||||||
// 检查 serverType、modelType、formatType 是否已设置
|
// 检查 serverType、modelType、formatType 是否已设置
|
||||||
if (this.toolType == null || this.serverType == null || this.shellType == null || this.outputFormat == null || this.gadgetType == null) {
|
if (this.toolType == null || this.serverType == null || this.shellType == null || this.outputFormat == null || this.gadgetType == null) {
|
||||||
@@ -429,8 +449,6 @@ public class AbstractConfig {
|
|||||||
this.setShellClassName(ClassNameUtil.getRandomShellClassName(this.getShellType()));
|
this.setShellClassName(ClassNameUtil.getRandomShellClassName(this.getShellType()));
|
||||||
if (this.getShellSimpleClassName() == null)
|
if (this.getShellSimpleClassName() == null)
|
||||||
this.setShellSimpleClassName(CommonUtil.getSimpleName(this.getShellClassName()));
|
this.setShellSimpleClassName(CommonUtil.getSimpleName(this.getShellClassName()));
|
||||||
if (this.getOutputFormat().contains(Constants.FORMAT_BCEL))
|
|
||||||
this.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
|
|
||||||
this.setSavePath(CommonUtil.getFileOutputPath(this.getOutputFormat(), this.getInjectorSimpleClassName(), this.getSavePath()));
|
this.setSavePath(CommonUtil.getFileOutputPath(this.getOutputFormat(), this.getInjectorSimpleClassName(), this.getSavePath()));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,6 +1,7 @@
|
|||||||
package jmg.core.format;
|
package jmg.core.format;
|
||||||
|
|
||||||
import jmg.core.config.AbstractConfig;
|
import jmg.core.config.AbstractConfig;
|
||||||
|
import jmg.core.util.ClassNameUtil;
|
||||||
import me.gv7.woodpecker.bcel.HackBCELs;
|
import me.gv7.woodpecker.bcel.HackBCELs;
|
||||||
|
|
||||||
import java.io.IOException;
|
import java.io.IOException;
|
||||||
@@ -9,7 +10,15 @@ public class BCELFormater implements IFormater {
|
|||||||
|
|
||||||
|
|
||||||
public byte[] transform(byte[] clazzbyte, AbstractConfig config) throws IOException {
|
public byte[] transform(byte[] clazzbyte, AbstractConfig config) throws IOException {
|
||||||
// 解决 BCEL 的classloader 的问题
|
// 解决 BCEL ClassLoader 带来的问题
|
||||||
|
if (config.isEnabledExtender()){
|
||||||
|
config.setBytesInLoader(config.getExtenderBytes());
|
||||||
|
config.setClassNameInLoader(config.getExtenderClassName());
|
||||||
|
}else{
|
||||||
|
config.setBytesInLoader(config.getInjectorBytes());
|
||||||
|
config.setClassNameInLoader(config.getInjectorClassName());
|
||||||
|
}
|
||||||
|
config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
|
||||||
byte[] bcelClzBytes = BCELoaderGenerator.generatorBCELoaderClass(config);
|
byte[] bcelClzBytes = BCELoaderGenerator.generatorBCELoaderClass(config);
|
||||||
return HackBCELs.encode(bcelClzBytes).getBytes();
|
return HackBCELs.encode(bcelClzBytes).getBytes();
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -17,9 +17,9 @@ public class BCELoaderGenerator {
|
|||||||
ctClass.setName(config.getLoaderClassName());
|
ctClass.setName(config.getLoaderClassName());
|
||||||
ctClass.getClassFile().setVersionToJava5();
|
ctClass.getClassFile().setVersionToJava5();
|
||||||
CtMethod getClassName = ctClass.getDeclaredMethod("getClassName");
|
CtMethod getClassName = ctClass.getDeclaredMethod("getClassName");
|
||||||
getClassName.setBody(String.format("{return \"%s\";}", config.getInjectorClassName()));
|
getClassName.setBody(String.format("{return \"%s\";}", config.getClassNameInLoader()));
|
||||||
CtMethod getBase64String = ctClass.getDeclaredMethod("getBase64String");
|
CtMethod getBase64String = ctClass.getDeclaredMethod("getBase64String");
|
||||||
String base64ClassString = encodeToBase64(config.getInjectorBytes()).replace(System.lineSeparator(), "");
|
String base64ClassString = encodeToBase64(config.getBytesInLoader()).replaceAll("[\\s*\t\n\r]", "");
|
||||||
String[] parts = splitChunks(base64ClassString, 40000);
|
String[] parts = splitChunks(base64ClassString, 40000);
|
||||||
StringBuilder result = new StringBuilder();
|
StringBuilder result = new StringBuilder();
|
||||||
for (int i = 0; i < parts.length; i++) {
|
for (int i = 0; i < parts.length; i++) {
|
||||||
|
|||||||
@@ -382,8 +382,6 @@ public class jMGForm {
|
|||||||
config.setUrlPattern("/*");
|
config.setUrlPattern("/*");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if (config.getOutputFormat().contains(Constants.FORMAT_BCEL))
|
|
||||||
config.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName());
|
|
||||||
config.setInjectorSimpleClassName(CommonUtil.getSimpleName(config.getInjectorClassName()));
|
config.setInjectorSimpleClassName(CommonUtil.getSimpleName(config.getInjectorClassName()));
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user