diff --git a/README.md b/README.md index 2e42d9c..2ce3769 100644 --- a/README.md +++ b/README.md @@ -20,16 +20,20 @@ ## 功能 -| 中间件 | 框架 | 工具 (测试版本) | 内存马类型 | 输出格式 | 辅助模块 | -|-----------|---------------|------------------------------------------------------------------|---------------|------------|---------| -| Tomcat | SpringMVC | [AntSword](https://github.com/AntSwordProject/antSword) (2.1.15) | Listener | BASE64 | 专项漏洞封装 | -| Resin | SpringWebFlux | [Behinder](https://github.com/rebeyond/Behinder) (4.0.7) | Filter | BCEL | 表达式语句封装 | -| WebLogic | | [Godzilla](https://github.com/BeichenDream/Godzilla) (4.0.1) | Interceptor | BIGINTEGER | | -| Jetty | | [Neo-reGeorg](https://github.com/L-codes/Neo-reGeorg) (5.1.0) | HandlerMethod | CLASS | | -| WebSphere | | [Suo5](https://github.com/zema1/suo5) (0.9.0) | TomcatValve | JAR | | -| Undertow | | Custom | | JAR_AGENT | | -| GlassFish | | | | JS | | -| | | | | JSP | | +| 中间件 | 框架 | 工具 (测试版本) | 内存马类型 | 输出格式 | 辅助模块 | +| ------------------ | ------------- | ------------------------------------------------------------ | ------------- | ---------- | -------------- | +| Tomcat | SpringMVC | [AntSword](https://github.com/AntSwordProject/antSword) (2.1.15) | Listener | BASE64 | 专项漏洞封装 | +| Resin | SpringWebFlux | [Behinder](https://github.com/rebeyond/Behinder) (4.0.7) | Filter | BCEL | 表达式语句封装 | +| WebLogic | | [Godzilla](https://github.com/BeichenDream/Godzilla) (4.0.1) | Interceptor | BIGINTEGER | | +| Jetty | | [Neo-reGeorg](https://github.com/L-codes/Neo-reGeorg) (5.1.0) | HandlerMethod | CLASS | | +| WebSphere | | [Suo5](https://github.com/zema1/suo5) (0.9.0) | TomcatValve | JAR | | +| Undertow | | Custom | | JAR_AGENT | | +| GlassFish | | | | JS | | +| Apusic（金蝶） | | | | JSP | | +| BES（宝兰德） | | | | | | +| InforSuite（中创） | | | | | | +| TongWeb（东方通） | | | | | | +| | | | | | | ## 编译 diff --git a/jmg-cli/src/main/java/jmg/cli/Console.java b/jmg-cli/src/main/java/jmg/cli/Console.java index 332ef45..01e4467 100644 --- a/jmg-cli/src/main/java/jmg/cli/Console.java +++ b/jmg-cli/src/main/java/jmg/cli/Console.java @@ -27,7 +27,11 @@ public class Console { Constants.SERVER_WEBSPHERE, Constants.SERVER_UNDERTOW, Constants.SERVER_GLASSFISH, - Constants.SERVER_JBOSS); + Constants.SERVER_JBOSS, + Constants.SERVER_TONGWEB, + Constants.SERVER_APUSIC, + Constants.SERVER_BES, + Constants.SERVER_INFORSUITE); private static final List TOOL_TYPES = Arrays.asList( Constants.TOOL_GODZILLA, Constants.TOOL_BEHINDER, diff --git a/jmg-core/src/main/java/jmg/core/config/Constants.java b/jmg-core/src/main/java/jmg/core/config/Constants.java index 71027b2..a0158ea 100644 --- a/jmg-core/src/main/java/jmg/core/config/Constants.java +++ b/jmg-core/src/main/java/jmg/core/config/Constants.java @@ -2,7 +2,7 @@ package jmg.core.config; public class Constants { - public static final String JMG_VERSION = "1.0.8_240914"; + public static final String JMG_VERSION = "1.0.9_250101"; public static final String JMG_NAME = "java-memshell-generator"; public static final String JMG_DESCRIPTION = "Java 内存马生成器"; @@ -22,6 +22,11 @@ public class Constants { public static final String SERVER_JBOSS = "JBoss"; + public static final String SERVER_TONGWEB = "Tongweb"; + public static final String SERVER_APUSIC = "Apusic"; + public static final String SERVER_INFORSUITE = "Inforsuite"; + public static final String SERVER_BES = "BES"; + public static final String SHELL_LISTENER = "Listener"; public static final String SHELL_FILTER = "Filter"; diff --git a/jmg-core/src/main/java/jmg/core/util/InjectorUtil.java b/jmg-core/src/main/java/jmg/core/util/InjectorUtil.java index 0458f66..3207e86 100644 --- a/jmg-core/src/main/java/jmg/core/util/InjectorUtil.java +++ b/jmg-core/src/main/java/jmg/core/util/InjectorUtil.java @@ -31,6 +31,32 @@ public class InjectorUtil { static { + INJECTOR_CLASSNAME_MAP.put("ApusicListenerInjector", ApusicListenerInjectorTpl.class.getName()); + INJECTOR_CLASSNAME_MAP.put("ApusicFilterInjector", ApusicFilterInjectorTpl.class.getName()); + Map apusicMap = new HashMap(); + apusicMap.put(Constants.SHELL_LISTENER, "ApusicListenerInjector"); + apusicMap.put(Constants.SHELL_FILTER, "ApusicFilterInjector"); + classMap.put(Constants.SERVER_APUSIC, apusicMap); + + INJECTOR_CLASSNAME_MAP.put("BESListenerInjector", BESListenerInjectorTpl.class.getName()); + INJECTOR_CLASSNAME_MAP.put("BESFilterInjector", BESFilterInjectorTpl.class.getName()); + Map besMap = new HashMap(); + besMap.put(Constants.SHELL_LISTENER, "BESListenerInjector"); + besMap.put(Constants.SHELL_FILTER, "BESFilterInjector"); + classMap.put(Constants.SERVER_BES, besMap); + + INJECTOR_CLASSNAME_MAP.put("InforSuiteListenerInjector", InforSuiteListenerInjectorTpl.class.getName()); + INJECTOR_CLASSNAME_MAP.put("InforSuiteFilterInjector", InforSuiteFilterInjectorTpl.class.getName()); + Map inforsuiteMap = new HashMap(); + inforsuiteMap.put(Constants.SHELL_LISTENER, "InforSuiteListenerInjector"); + inforsuiteMap.put(Constants.SHELL_FILTER, "InforSuiteFilterInjector"); + classMap.put(Constants.SERVER_INFORSUITE, inforsuiteMap); + + INJECTOR_CLASSNAME_MAP.put("TongWebListenerInjector", TongWebListenerInjectorTpl.class.getName()); + Map tongwebMap = new HashMap(); + tongwebMap.put(Constants.SHELL_LISTENER, "TongWebListenerInjector"); + classMap.put(Constants.SERVER_TONGWEB, tongwebMap); + INJECTOR_CLASSNAME_MAP.put("GlassfishListenerInjector", GlassFishListenerInjectorTpl.class.getName()); INJECTOR_CLASSNAME_MAP.put("GlassfishFilterInjector", GlassFishFilterInjectorTpl.class.getName()); @@ -56,13 +82,13 @@ public class InjectorUtil { INJECTOR_CLASSNAME_MAP.put("TomcatListenerInjector", TomcatListenerInjectorTpl.class.getName()); INJECTOR_CLASSNAME_MAP.put("TomcatFilterInjector", TomcatFilterInjectorTpl.class.getName()); - INJECTOR_CLASSNAME_MAP.put("TomcatValveInjector",TomcatValveInjectorTpl.class.getName()); + INJECTOR_CLASSNAME_MAP.put("TomcatValveInjector", TomcatValveInjectorTpl.class.getName()); Map tomcatMap = new HashMap(); tomcatMap.put(Constants.SHELL_LISTENER, "TomcatListenerInjector"); tomcatMap.put(Constants.SHELL_FILTER, "TomcatFilterInjector"); tomcatMap.put(Constants.SHELL_JAKARTA_LISTENER, "TomcatListenerInjector"); tomcatMap.put(Constants.SHELL_JAKARTA_FILTER, "TomcatFilterInjector"); - tomcatMap.put(Constants.SHELL_VALVE,"TomcatValveInjector"); + tomcatMap.put(Constants.SHELL_VALVE, "TomcatValveInjector"); classMap.put(Constants.SERVER_TOMCAT, tomcatMap); diff --git a/jmg-core/src/main/java/jmg/core/util/ResponseUtil.java b/jmg-core/src/main/java/jmg/core/util/ResponseUtil.java index 9635209..fe15952 100644 --- a/jmg-core/src/main/java/jmg/core/util/ResponseUtil.java +++ b/jmg-core/src/main/java/jmg/core/util/ResponseUtil.java @@ -17,6 +17,10 @@ public class ResponseUtil { METHOD_BODY_MAP.put("jetty", getJettyMethodBody()); METHOD_BODY_MAP.put("websphere", getWebsphereMethodBody()); METHOD_BODY_MAP.put("undertow", getUndertowMethodBody()); + METHOD_BODY_MAP.put("inforsuite", getCommonMethodBody()); + METHOD_BODY_MAP.put("bes", getCommonMethodBody()); + METHOD_BODY_MAP.put("tongweb", getTongwebMethodBody()); + METHOD_BODY_MAP.put("apusic", getApusicMethodBody()); } public static String getMethodBody(String serverType) { @@ -73,4 +77,24 @@ public class ResponseUtil { "return response;}"; } + + private static String getTongwebMethodBody() { + return "{javax.servlet.http.HttpServletResponse response = null;" + + " try {" + + " response = (javax.servlet.http.HttpServletResponse) getFV(getFV($1, \"request\"), \"response\");" + + " } catch (Exception ex) {" + + " try {" + + " response = (javax.servlet.http.HttpServletResponse) getFV($1, \"response\");" + + " } catch (Exception ex1) {" + + " }" + + " }\n" + + " return response;}"; + } + + private static String getApusicMethodBody() { + return "{javax.servlet.http.HttpServletResponse response;" + + " response = (javax.servlet.http.HttpServletResponse) getFV(getFV($1, \"http\"),\"response\");" + + " return response;}"; + } + } diff --git a/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java b/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java index ef1a384..26242d5 100644 --- a/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java +++ b/jmg-gui/src/main/java/jmg/gui/form/jMGForm.java @@ -112,7 +112,8 @@ public class jMGForm { ArrayList servletApiServerBox = new ArrayList<>(Arrays.asList( Constants.SERVER_TOMCAT, Constants.SERVER_RESIN, Constants.SERVER_WEBLOGIC, Constants.SERVER_WEBSPHERE, - Constants.SERVER_JETTY, Constants.SERVER_UNDERTOW, Constants.SERVER_GLASSFISH, Constants.SERVER_JBOSS + Constants.SERVER_JETTY, Constants.SERVER_UNDERTOW, Constants.SERVER_GLASSFISH, Constants.SERVER_JBOSS, + Constants.SERVER_TONGWEB, Constants.SERVER_APUSIC, Constants.SERVER_BES, Constants.SERVER_INFORSUITE )); ArrayList interceptorServerBox = new ArrayList<>(Arrays.asList(Constants.SERVER_SPRING_MVC)); diff --git a/jmg-woodpecker/src/main/java/me/gv7/woodpecker/helper/ShellHelper.java b/jmg-woodpecker/src/main/java/me/gv7/woodpecker/helper/ShellHelper.java index 120651e..e69caa4 100644 --- a/jmg-woodpecker/src/main/java/me/gv7/woodpecker/helper/ShellHelper.java +++ b/jmg-woodpecker/src/main/java/me/gv7/woodpecker/helper/ShellHelper.java @@ -36,6 +36,10 @@ public class ShellHelper implements IHelper { enumServerType.add(Constants.SERVER_UNDERTOW); enumServerType.add(Constants.SERVER_GLASSFISH); enumServerType.add(Constants.SERVER_JBOSS); + enumServerType.add(Constants.SERVER_TONGWEB); + enumServerType.add(Constants.SERVER_APUSIC); + enumServerType.add(Constants.SERVER_BES); + enumServerType.add(Constants.SERVER_INFORSUITE); server_type.setEnumValue(enumServerType); server_type.setDefaultValue(Constants.SERVER_TOMCAT); server_type.setRequired(true);