Giter VIP home page Giter VIP logo

addmemshellsjsp's Introduction

addMemShellsJSP

通过jsp注入valve内存马，可以忽略框架影响，通用tomcat789

说明

  • tomcat6无法通过addValve方法注入，所以不适用

  • tomcat10因为包名替换，注入冰蝎内存马无法获取密钥，只能执行cmd

使用

  • 将jsp上传并访问

image-20211029104308957

  • 执行命令，这个test.jsp可以换成任意请求路径，valve内存马对请求路径无要求，所以即使是spring框架也可以直接使用任意路径访问内存马。

image-20211029104405204

  • 连接冰蝎，需要同时输入ifconflag和rebeyond两个密码才能正确连接。

image-20211029105442670

image-20211029105615353

修改

  • 注入的内存马主要在ValveImpl类当中

image-20211029105735136

  • 修改完成之后需要一步一步将java文件重新变成字节码然后逐渐替换addValve类和addMemShell类。

image-20211029105940614

image-20211029110019698

image-20211029110111869

参考

Java内存马：一种Tomcat全版本获取StandardContext的新方法

addmemshellsjsp's People

Contributors

ghost2097221 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.