jMG (Java Memshell Generator) 是一款支持高度自定义的 Java 内存马生成工具,提供常见中间件的内存马注入支持。不仅可作为 woodpecker 的插件使用,也可以作为独立的 GUI 工具进行使用,文档详见公众号文章。
![image](https://private-user-images.githubusercontent.com/55024146/244065025-1b07d338-5cd9-4035-8566-be2d4ae914d4.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0NDU3MDUsIm5iZiI6MTcyNTQ0NTQwNSwicGF0aCI6Ii81NTAyNDE0Ni8yNDQwNjUwMjUtMWIwN2QzMzgtNWNkOS00MDM1LTg1NjYtYmUyZDRhZTkxNGQ0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA0VDEwMjMyNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTA5MDRmZjdlZTZmMWVjMzllZDJkYjEzNjdlMzFhMTNjYjU1NjY5OWI1ODk5NTk1NzE5YjJjNTllZGNmMmQ3OGMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.AroIDUPD2zZWz-M60w4T6Heg3wIQfyP0KBi2KvsnvOU)
![image-20230610110205993](https://private-user-images.githubusercontent.com/55024146/244844434-4b79a767-9327-4d2a-bd89-7f1386560a9d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0NDU3MDUsIm5iZiI6MTcyNTQ0NTQwNSwicGF0aCI6Ii81NTAyNDE0Ni8yNDQ4NDQ0MzQtNGI3OWE3NjctOTMyNy00ZDJhLWJkODktN2YxMzg2NTYwYTlkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA0VDEwMjMyNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWI2NDcxMDYzZjdhMGI0ZWZkZDM3MThmNjM3OTVjZDU4MGQwZDMxZmY3MGQzNjQ3ZDQ4MDg0MzZjNTY1M2VlYWYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.M5OvUKFuXkXv7diQIW93ARGUVdi371i3-BplW1A4bnw)
listener | filter | |
---|---|---|
tomcat 9.0.39 | ✅ | ✅ |
tomcat 8.5.53 | ✅ | ✅ |
tomcat 7.0.59 | ✅ | ✅ |
tomcat 6.0.48 | ✅ | ✅ |
tomcat 5.5.36 | ✅ | ✅ |
jetty 9.4.43 | ✅ | ✅ |
jetty 8.2.0 | ✅ | ✅ |
jetty 7.6.0 | ✅ | ✅ |
resin 4.0.66 | ✅ | ✅ |
resin 3.1.15 | ✅ | ✅ |
weblogic 10.3.6 | ✅ | ✅ |
weblogic 12.1.3 | ✅ | ✅ |
weblogic 14.1.1 | ✅ | ✅ |
websphere 7.x | ✅ | ✅ |
websphere 8.5.5 | ✅ | ✅ |
websphere 9.0.0 | ✅ | ✅ |
undertow 1.4.26 | ✅ | ✅ |
glassfish 5.0.0 | ✅ | ✅ |
interceptor | action | |
---|---|---|
spring mvc | ✅ | |
strust2 |
SGLAB of Legendsec at Qi'anxin Group
免责声明
该工具仅适用于在授权环境/测试环境进行使用,请勿用于生产环境。
技术交流
如果遇到 bug / 建议 / 实战场景需求,欢迎提 issue 交流。
引用项目
https://github.com/woodpecker-framework/
https://github.com/woodpecker-appstore/jexpr-encoder-utils
参考项目
https://github.com/feihong-cs/memShell
https://github.com/su18/MemoryShell
https://github.com/BeichenDream/GodzillaMemoryShellProject