jMG (Java Memshell Generator) 是一款支持高度自定义的 Java 内存马生成工具,提供常见中间件的内存马注入支持。不仅可作为 woodpecker 的插件使用,也可以作为独立的 GUI 工具进行使用,文档详见公众号文章。
![image](https://private-user-images.githubusercontent.com/55024146/244065025-1b07d338-5cd9-4035-8566-be2d4ae914d4.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQyOTA3OTYsIm5iZiI6MTcyNDI5MDQ5NiwicGF0aCI6Ii81NTAyNDE0Ni8yNDQwNjUwMjUtMWIwN2QzMzgtNWNkOS00MDM1LTg1NjYtYmUyZDRhZTkxNGQ0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIyVDAxMzQ1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFjMzE1ZDEwNWEzYzFjNDQ1NDE1NzNiODljMDdhYzRmYWZjN2U2ZDM4YzQwNGViNTEwYmRhYTQ1MThiNmM1ZGEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.L71ePHen-iTrALQYZBZJHP1c0OQfxY3RsRT74eIWCMI)
![image-20230610110205993](https://private-user-images.githubusercontent.com/55024146/244844434-4b79a767-9327-4d2a-bd89-7f1386560a9d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQyOTA3OTYsIm5iZiI6MTcyNDI5MDQ5NiwicGF0aCI6Ii81NTAyNDE0Ni8yNDQ4NDQ0MzQtNGI3OWE3NjctOTMyNy00ZDJhLWJkODktN2YxMzg2NTYwYTlkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODIyVDAxMzQ1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTBiMmQyZDdmMjQ1OGNmZDFkYWNhYmM5MzNjYjgxMWQ3YWY0N2I1NDBmYTQxYTMzM2I4ODg2Njg5N2JkNDQ2ZDAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.81XP6BIG4gkovjmQloP8INKAzcfZclq5Xvs6DC3Pdow)
listener | filter | |
---|---|---|
tomcat 9.0.39 | ✅ | ✅ |
tomcat 8.5.53 | ✅ | ✅ |
tomcat 7.0.59 | ✅ | ✅ |
tomcat 6.0.48 | ✅ | ✅ |
tomcat 5.5.36 | ✅ | ✅ |
jetty 9.4.43 | ✅ | ✅ |
jetty 8.2.0 | ✅ | ✅ |
jetty 7.6.0 | ✅ | ✅ |
resin 4.0.66 | ✅ | ✅ |
resin 3.1.15 | ✅ | ✅ |
weblogic 10.3.6 | ✅ | ✅ |
weblogic 12.1.3 | ✅ | ✅ |
weblogic 14.1.1 | ✅ | ✅ |
websphere 7.x | ✅ | ✅ |
websphere 8.5.5 | ✅ | ✅ |
websphere 9.0.0 | ✅ | ✅ |
undertow 1.4.26 | ✅ | ✅ |
glassfish 5.0.0 | ✅ | ✅ |
interceptor | action | |
---|---|---|
spring mvc | ✅ | |
strust2 |
SGLAB of Legendsec at Qi'anxin Group
免责声明
该工具仅适用于在授权环境/测试环境进行使用,请勿用于生产环境。
技术交流
如果遇到 bug / 建议 / 实战场景需求,欢迎提 issue 交流。
引用项目
https://github.com/woodpecker-framework/
https://github.com/woodpecker-appstore/jexpr-encoder-utils
参考项目
https://github.com/feihong-cs/memShell
https://github.com/su18/MemoryShell
https://github.com/BeichenDream/GodzillaMemoryShellProject