memshell-party-cli 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memshell-party-cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Command-line client and MCP server for MemShellParty (party.mem.mk) — generate Java memory shells and probes from the terminal.",
   "keywords": [
     "memshell",
@@ -17,6 +17,7 @@
   },
   "files": [
     "dist",
+    "resources",
     "skills",
     "README.md",
     "README.en.md",

package/skills/memshell-party/SKILL.md

@@ -224,9 +224,11 @@ paths are on the machine running the MCP server.
 
 `mimic` is a demo protocol that shapes shell traffic after the target site's own pages:
 requests are browser-style form POSTs; responses are real site pages with the ciphertext
-hidden in a per-shell-unique JS variable (`var Re<md5(pass+key)[0:5]>_config="..."`).
-**You write the site profile — the CLI does not crawl.** That is the point: you can judge
-which page makes believable cover; a regex crawler cannot.
+hidden in a per-shell-unique marker (a JS variable or an HTML comment). The wire codec is
+selectable per profile (`cipher` section: AES/ECB, AES/CBC with random IV, or XOR; base64 /
+base64url / hex; optional key-derived junk tail). **You write the site profile — the CLI
+does not crawl.** That is the point: you can judge which page makes believable cover; a
+regex crawler cannot.
 
 ### Workflow
 
@@ -268,6 +270,20 @@ which page makes believable cover; a regex crawler cannot.
      `{{hex:N}}` (N hex), `{{b64:N}}` (N base64url), `{{uuid}}`, `{{ts}}` (unix seconds),
      `{{int:A:B}}`. Never ship the default `pass=<cipher>` single-field body — a lone
      `pass=` parameter is a textbook webshell signature.
+   - `cipher` (optional): the wire codec. Fields (all optional, defaults = the legacy
+     format `aes-ecb` + `base64` + `js-var` + no tail):
+     - `algorithm`: `"aes-ecb"` (fixed blocks — same plaintext ⇒ same ciphertext),
+       `"aes-cbc"` (random IV per message — same command encrypts differently every
+       time, the strongest default), `"xor"` (no JCE needed).
+     - `encoding`: `"base64"` | `"base64url"` | `"hex"`.
+     - `padTail`: `true` appends key-derived-length (0-15) random alnum garbage after
+       the encoded ciphertext — Behinder's `aes_with_magic` trick against length
+       signatures. Costs nothing, turn it on.
+     - `marker`: `"js-var"` (`var Re<md5(pass+key)[0:5]>_config="..."`) or
+       `"html-comment"` (`<!--Re..._config:...-->`) — pick whichever looks more at
+       home in the cover page.
+     ⚠️ The cipher is **baked into the filter at build time**. Editing `cipher` in the
+     profile afterwards desynchronizes client and server — rebuild + re-inject.
 4. **Use it:**
 
    ```bash
@@ -337,49 +353,55 @@ documents dominate; no SPA).
 
 ### What mimic handles vs. what you decide
 
-- Automatic: AES/ECB (key = md5(key)[0:16]), per-shell derived response delimiters,
-  form-body encoding, browser-consistent request headers, credential round-trip on `connect`.
+- Automatic: the selected codec (key = md5(key)[0:16] for every algorithm), per-shell
+  derived response delimiters, form-body encoding, browser-consistent request headers,
+  credential round-trip on `connect`.
 - Yours: the template page, the path vocabulary, the request pacing. Filter/listener-type
   memory shells answer on any path, which is what makes `--dynamic-path` legitimate — for a
   fixed-URL shell just omit the flag.
 - Limits: exec only (no upload/download); request timing/method mix is fixed, so pace your
   commands like a patient human.
 
-### Server side (Java filter memshell)
-
-The reference server is a servlet Filter, not a JSP — the repo keeps it in
-`scratch/mimic-java/`:
-
-- `mimic/MimicFilter.java` — the protocol server: mapped to `/*` at chain position 0, it
-  answers any form POST whose carrier (one of the profile's secretFields, baked in by the
-  generator — form field, URL parameter or header) decrypts, and passes everything else
-  through. Two rules keep it invisible: **detection uses `getParameter()`/`getHeader()` only
-  and never reads the body stream** (a second filter shell behind it keeps working), and
-  **an undecryptable value means chain-through, not a cover page** — so a legit form that
-  happens to use the same field name (e.g. the console's own login POST with `verCode`) is
-  never hijacked.
-- `mimic/MimicInject.java` — the registration injector (adapted from MemShellParty's
-  TongWeb injector): its `<clinit>` embeds the filter's class bytes (gzip+base64), defines
-  them in the webapp classloader, and registers the filter into every running context.
-- `../gen-mimic-filter.mjs` — the generator: reads the profile from
-  `~/.memparty/profiles/`, embeds **all** its templates (the filter picks one at random per
-  response — that's the rotation), and emits `MimicFilter<V>.class` + `MimicInject<V>.class`
-  (`javac --release 8`). Swap templates, re-run, re-inject. **Pass a fresh version suffix
-  on every re-injection** (`node gen-mimic-filter.mjs V3`): a running JVM can't re-define a
-  class, and the injector skips registration when the filter name already exists.
-
-Deployment needs any channel that can `defineClass` + instantiate in the target JVM (a
-deserialization RCE, an agent loader, another shell that evaluates scripts, …). The filter
-is memory-resident and dies on restart — same as any memory shell.
-
-Two deployment truths learned on a real TongWeb console:
-
-- **Dynamic path is conditional on the target app's own filters.** The console's
-  loginfilter answers `/console/*` itself (except `/console/service`), so `--dynamic-path`
-  fails there even with the filter on `/*` — probe before relying on it, fall back to the
-  fixed working path.
-- The cover page must be one the target actually serves; a beautiful but foreign template
-  is a fingerprint.
+### Server side — `memparty custom build`
+
+The server half is a plain `javax.servlet.Filter` generated FROM the profile and compiled
+locally — one command does the whole chain:
+
+```bash
+memparty custom build --profile acme --server Tomcat
+```
+
+What happens inside:
+
+1. renders `MimicFilter<rand>.java` from the profile (templates, carrier fields, **the
+   `cipher` section is baked in here**) + random `pass`/`key` (or `--pass/--key`);
+2. compiles it with the local JDK (`javac` on PATH, servlet API jar bundled — no other
+   dependency);
+3. submits the class to the MemShellParty backend as `shellTool=Custom`, which wraps it
+   with the injector for `--server` (any server from `memparty config tools` — the filter
+   itself has zero middleware specifics) and packs it with `--packer`
+   (default `DefaultBase64`);
+4. writes an output dir (default `<profile>-build/`): the `.java`/`.class`, one
+   `payload-*.txt` per pack variant, and **`manifest.json`** — the single source of truth
+   for the follow-up (credentials, cipher, class names, ready-made connect command).
+
+Then: inject the payload through your foothold (deserialization RCE `defineClass`, an
+existing shell that evaluates scripts, an agent loader…), and connect with the printed
+command — a successful `connect` auto-saves the target, afterwards
+`memparty exec <host>/mimic --cmd "id"` needs no flags.
+
+Notes that matter:
+
+- **Random class name every build** (`--out` keeps builds apart): a running JVM can't
+  re-define a class, so re-injection NEEDS the fresh name — never reuse one.
+- The printed `--pass/--key` are random per build unless you pin them; they're in
+  `manifest.json`, not in your shell history if you use `--json`.
+- The filter probes carriers with `getParameter()`/`getHeader()` only (never reads the
+  body stream), passes undecryptable values through `chain.doFilter`, and answers errors
+  with the plain cover page — it coexists with the site's real forms and other shells.
+- Filter-type deployment truth learned on a real console: **dynamic path is conditional
+  on the target app's own filters** — probe a random path first, fall back to the fixed
+  working path when the app answers everything itself.
 
 ### Reality check before relying on it