MemoryShellHunter

Java Agent memory horse scanner combined with Call Graph modus

About

MemoryShellHunter is a memory shell Scanner/Killer tool that combines dynamic Building Call Graph. It supports Agent and Attach modes for detection, addressing the issue that conventional memory shell detection tools require manual verification of WebSocket memory shells.

The MemoryShellHunter project uses a reverse topological algorithm to accurately capture the call behavior of malicious methods. This compensates for the difficulties in detecting SpringBoot memory shells and the fact that new WebSocket memory shells cannot be judged based on whether the Class file lands on the disk. It features lower performance impact compared to general RASP detection, is a lightweight Agent, and has minimal intrusion into business code.

How to used

java -javaagent:./MemoryShellHunter.jar -jar SpringBootRunner.jar

VirtualMachine vmObj = VirtualMachine.attach(targetJvmPid);//targetJvmPid为目标JVM的进程ID  
vmObj.loadAgent(agentJarPath, cfg);  // agentJarPath为MemoryShellHunter jar包的路径，cfg为传递给agent的参数  

Supported middleware

1.2 Version:

• Add gRPC memory shell check algorithm

1.1 Version:

• Add Controller memory shell check algorithm

1.0 Version:

• Add WebSocket memory shell check/delete algorithm

Show results

WebSocket Memory Shell Test Report

Controller Memory Shell Test Report

gRPC Memory Shell Test Report