Skip to content

Conversation

@Marc-andreLabonte
Copy link

Greetings, jdwp-shellifier will still happily hand over shell in 2021 although Python 2 is getting harder to find. I managed to get system info and commands executed under Python 3.9 and while breaking on default java.net.ServerSocket.accept method.

Copy link
Contributor

@hugsy hugsy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great stuff, some things to change before merge

def runtime_exec(jdwp, args):
print ("[+] Targeting '%s:%d'" % (args.target, args.port))
print ("[+] Reading settings for '%s'" % jdwp.version)
print(("[+] Targeting '%s:%d'" % (args.target, args.port)))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Double parenthesis, also if we jump to Py 3.9 might as well use more goodies: here f-strings

Suggested change
print(("[+] Targeting '%s:%d'" % (args.target, args.port)))
print(f"[+] Targeting '{args.target}:{args.port}'")

print ("[+] Targeting '%s:%d'" % (args.target, args.port))
print ("[+] Reading settings for '%s'" % jdwp.version)
print(("[+] Targeting '%s:%d'" % (args.target, args.port)))
print(("[+] Reading settings for '%s'" % jdwp.version))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[+] Reading settings for '%s'" % jdwp.version))
print(f"[+] Reading settings for '{jdwp.version}'")

print ("[-] Cannot find method Runtime.getRuntime()")
return False
print ("[+] Found Runtime.getRuntime(): id=%x" % getRuntimeMeth["methodId"])
print(("[+] Found Runtime.getRuntime(): id=%x" % getRuntimeMeth["methodId"]))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[+] Found Runtime.getRuntime(): id=%x" % getRuntimeMeth["methodId"]))
print("[+] Found Runtime.getRuntime(): id={getRuntimeMeth['methodId']:x}")

c = jdwp.get_class_by_name( args.break_on_class )
if c is None:
print("[-] Could not access class '%s'" % args.break_on_class)
print(("[-] Could not access class '%s'" % args.break_on_class))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[-] Could not access class '%s'" % args.break_on_class))
print(f"[-] Could not access class '{args.break_on_class}'")

m = jdwp.get_method_by_name( args.break_on_method )
if m is None:
print("[-] Could not access method '%s'" % args.break_on)
print(("[-] Could not access method '%s'" % args.break_on))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[-] Could not access method '%s'" % args.break_on))
print(f"[-] Could not access method '{args.break_on}'")

print("[-] Failed to invoke Runtime.getRuntime()")
return False
print ("[+] Runtime.getRuntime() returned context id:%#x" % rt)
print(("[+] Runtime.getRuntime() returned context id:%#x" % rt))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[+] Runtime.getRuntime() returned context id:%#x" % rt))
print(f"[+] Runtime.getRuntime() returned context id:{rt:#x}")

print ("[-] Cannot find method Runtime.exec()")
return False
print ("[+] found Runtime.exec(): id=%x" % execMeth["methodId"])
print(("[+] found Runtime.exec(): id=%x" % execMeth["methodId"]))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[+] found Runtime.exec(): id=%x" % execMeth["methodId"]))
print(f"[+] found Runtime.exec(): id={execMeth['methodId']:x}")


retId = jdwp.unformat(jdwp.objectIDSize, buf[1:1+jdwp.objectIDSize])
print ("[+] Runtime.exec() successful, retId=%x" % retId)
print(("[+] Runtime.exec() successful, retId=%x" % retId))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[+] Runtime.exec() successful, retId=%x" % retId))
print(f"[+] Runtime.exec() successful, retId={retId:x}")

except Exception as e:
print ("[-] Exception: %s" % e)
traceback.print_exc()
print(("[-] Exception: %s" % e))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
print(("[-] Exception: %s" % e))
print(f"[-] Exception: {str(e)}")

# JDWP protocol variables
#
HANDSHAKE = "JDWP-Handshake"
HANDSHAKE = b"JDWP-Handshake"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also edit the README too to mention the script requires Python3 (tested on Python 3.9)?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants