java内存马应急排查指南

2026-05-27 05:23:43 网络安全文章来源：ZONE.CI 全球网 0 阅读模式
文章总结： 本文提供Java内存马应急排查指南，适用于Linux环境下的Tomcat、SpringBoot等JavaWeb应用。文档包含快速决策流程、已知内存马特征速查表、常见框架白名单及分阶段排查命令，重点指导如何通过进程检查、磁盘注入器定位和Arthas工具检测恶意类。关键发现包括冰蝎、哥斯拉等工具的类名特征，以及通过codeSource判断注入类型（磁盘持久化或远程漏洞注入），建议根据排查结果选择删除注入器重启或直接重启清除。 综合评分： 87 文章分类： 应急响应,漏洞分析,恶意软件,WEB安全,安全工具
java内存马应急排查指南
Xluo Xluo
摸鱼划水
2026年5月25日%2014:58 云南
在小说阅读器读本章
去阅读
本文转载至Xluo大佬写java内存马应急排查指南
================================================================================&nbsp;%20内存马应急排查手册%20v2.0%20&nbsp;|%20&nbsp;更新日期:%202026-05&nbsp;%20场景:%20安全演练期间服务器被植入内存马，上机应急定位与清除&nbsp;%20适用环境:%20Linux%20(x86_64/ARM64),%20Java%20Web%20(Tomcat%20/%20Spring%20Boot%20/%20Resin)&nbsp;%20使用方式:%20逐条复制到终端执行，观察输出结果================================================================================
命令标记说明:&nbsp;%20[必]%20必须执行%20&nbsp;[荐]%20强烈建议%20&nbsp;[选]%20视情况执行
================================================================================〇、快速决策流程================================================================================
&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20┌─────────────────┐&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20&nbsp;上机排查内存马%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20└────────┬────────┘&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20┌────────────▼────────────┐&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20[1-3]%20确认Java进程信息%20&nbsp;%20│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20检查%20-javaagent%20等可疑参数│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20└────────────┬────────────┘&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20┌──────────────────┼──────────────────┐&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20┌─────────▼─────────┐%20&nbsp;┌────▼─────┐%20&nbsp;┌────────▼────────┐&nbsp;%20&nbsp;%20│[6-13]%20找磁盘注入器%20│%20&nbsp;│[14-18]%20&nbsp;%20│%20&nbsp;│[19-22]%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20│%20可疑JSP/class文件%20&nbsp;│%20&nbsp;│配置篡改%20&nbsp;%20│%20&nbsp;│网络连接排查%20&nbsp;%20&nbsp;%20│&nbsp;%20&nbsp;%20└─────────┬─────────┘%20&nbsp;└────┬─────┘%20&nbsp;└────────┬────────┘&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20└──────────────────┼──────────────────┘&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20┌────────────▼────────────┐&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20[23-37]%20Arthas内存马检测%20│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20sc%20-d%20查恶意类%20+%20codeSource│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20└────────────┬────────────┘&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20┌────────────▼────────────┐&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20&nbsp;%20&nbsp;判断%20codeSource%20&nbsp;%20&nbsp;%20&nbsp;%20│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20└─┬─────────────────────┬─┘&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20指向JSP/jar路径%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;为空/null&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20┌─▼──────────────┐%20&nbsp;%20┌──────▼──────────┐&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│磁盘有注入器%20&nbsp;%20&nbsp;%20│%20&nbsp;%20│远程漏洞一次性注入%20│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│删注入器+重启%20&nbsp;%20&nbsp;│%20&nbsp;%20│重启即清除,查日志%20&nbsp;│&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20└────────────────┘%20&nbsp;%20└─────────────────┘
紧急场景:%20直接跳到「快速排查6步法」(第60-65条)

================================================================================一、已知内存马特征速查表================================================================================
┌──────────┬──────────────────────────────────┬──────────────────────────────┐│%20工具%20&nbsp;%20&nbsp;%20&nbsp;│%20已知类名/特征%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20类型%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│├──────────┼──────────────────────────────────┼──────────────────────────────┤│%20冰蝎%20&nbsp;%20&nbsp;%20&nbsp;│%20EdwardsiidaeFilter%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20Filter型%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20EdwardsiidaeServlet%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Servlet型%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│├──────────┼──────────────────────────────────┼──────────────────────────────┤│%20哥斯拉%20&nbsp;%20&nbsp;│%20PlasmodesmaFilter%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20WebSocket%20Filter型%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Alginv8I58akMMnCA7T0A%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20载荷组件(随机类名变种)%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Eutropic%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20载荷组件%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Poliorcetic%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20载荷组件%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20LithoprintxCVIGnPE53kMja9q%20&nbsp;%20&nbsp;%20&nbsp;%20│%20载荷组件%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Zygosporangium%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20载荷组件%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│├──────────┼──────────────────────────────────┼──────────────────────────────┤│%20代理隧道马│%20Prepupa%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Runnable代理线程%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│├──────────┼──────────────────────────────────┼──────────────────────────────┤│%20通用特征%20&nbsp;│%20类名为生僻英文词+Filter/Servlet%20&nbsp;%20│%20动态注册型%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20/Listener/Runnable%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20无包名或包名异常的Filter/Servlet%20&nbsp;│%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20$$Lambda$%20结尾的Filter%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20Lambda表达式伪装%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20││%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│%20-javaagent:指向非APM的jar%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20│%20Agent型%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;│└──────────┴──────────────────────────────────┴──────────────────────────────┘
注入器磁盘特征关键词:&nbsp;%20defineClass%20/%20Unsafe%20/%20Base64.decode%20/%20Runtime.getRuntime%20/%20ProcessBuilder&nbsp;%20/%20ScriptEngine%20/%20ClassLoader

================================================================================二、常见框架Filter/Listener白名单（防误判）================================================================================
以下为常见框架正常注册的Filter/Servlet，排查时可跳过:
&nbsp;%20Spring框架:%20&nbsp;CharacterEncodingFilter,%20hiddenHttpMethodFilter,&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20httpPutFormContentFilter,%20requestContextFilter,&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20DelegatingFilterProxy,%20FilterChainProxy,&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20SpringSecurityFilterChain,%20MultipartFilter
&nbsp;%20Shiro:%20&nbsp;%20&nbsp;%20&nbsp;SpringShiroFilter,%20InvalidRequestFilter
&nbsp;%20Druid:%20&nbsp;%20&nbsp;%20&nbsp;DruidWebStatFilter,%20DruidStatViewServlet
&nbsp;%20Tomcat:%20&nbsp;%20&nbsp;%20CorsFilter,%20CsrfPreventionFilter,%20ExpiresFilter,&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20RemoteAddrFilter,%20RemoteHostFilter,%20RemoteIpFilter,&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20SetCharacterEncodingFilter,%20WebdavFixFilter
&nbsp;%20Resin:%20&nbsp;%20&nbsp;%20&nbsp;ServletConfigImpl,%20WebApp,%20ConfigContext
&nbsp;%20其他:%20&nbsp;%20&nbsp;%20&nbsp;%20CasFilter,%20XssFilter,%20LogFilter,%20UrlRewriteFilter
判断原则:%20堆栈顶部全是框架自身类(catalina/spring/caucho/shiro)%20→%20大概率误报&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;堆栈顶部出现生僻词+Filter/Servlet/Listener%20→%20真内存马

================================================================================三、分阶段排查命令================================================================================
--------------------------------------------------------------------------------第一阶段:%20确认Java进程和基本信息--------------------------------------------------------------------------------
[1][必]%20查看Java进程信息&nbsp;%20&nbsp;%20ps%20aux%20|%20grep%20java
&nbsp;%20&nbsp;%20>>%20看什么:%20找到目标Java进程，记录PID&nbsp;%20&nbsp;%20>>%20重点:%20启动命令中是否包含%20-javaagent、-Xbootclasspath%20等异常参数&nbsp;%20&nbsp;%20>>%20说明:&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;-javaagent:xxx.jar%20→%20Agent型内存马，可修改任意类字节码&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;-Xbootclasspath%20&nbsp;%20→%20替换引导类加载器路径，植入底层恶意代码
[2][必]%20查看Java进程详细启动参数&nbsp;%20&nbsp;&nbsp;cat&nbsp;/proc/$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)/cmdline%20|&nbsp;tr&nbsp;'\0'&nbsp;'\n'
&nbsp;%20&nbsp;%20>>%20看什么:%20逐行显示JVM启动参数，检查是否有%20-javaagent%20或可疑%20-classpath&nbsp;%20&nbsp;%20>>%20如果看到%20-javaagent:xxx.jar，记录该jar路径，可能是恶意Agent
[3][荐]%20查看Java进程环境变量&nbsp;%20&nbsp;&nbsp;cat&nbsp;/proc/$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)/environ%20|&nbsp;tr&nbsp;'\0'&nbsp;'\n'&nbsp;|%20grep%20-i&nbsp;"java\|agent\|tool\|opts"
&nbsp;%20&nbsp;%20>>%20看什么:%20检查%20JAVA_TOOL_OPTIONS、JAVA_OPTS%20等是否被注入恶意参数&nbsp;%20&nbsp;%20>>%20示例:%20JAVA_TOOL_OPTIONS=-javaagent:/tmp/evil.jar%20即为恶意注入
[4][荐]%20确认应用工作目录&nbsp;%20&nbsp;&nbsp;ls&nbsp;-la%20/proc/$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)/cwd
&nbsp;%20&nbsp;%20>>%20看什么:%20查看Java进程工作目录（如%20/opt/tomcat），确定应用安装路径
[5][选]%20查看进程打开的文件描述符&nbsp;%20&nbsp;&nbsp;ls&nbsp;-la%20/proc/$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)/fd/%20|&nbsp;head&nbsp;-50
&nbsp;%20&nbsp;%20>>%20看什么:%20可能发现可疑的jar/class文件，或被删除但仍被进程占用的文件&nbsp;%20&nbsp;%20>>%20标记:%20显示%20(deleted)%20的文件表示已被删但进程仍持有句柄
--------------------------------------------------------------------------------第二阶段:%20查找磁盘注入器%20(最关键!)--------------------------------------------------------------------------------
【说明】内存马驻留JVM内存中，重启即消失。但多数内存马借助磁盘上的JSP注入器实现持久化——应用重启后JSP被访问即重新加载恶意类。找到注入器是切断重复感染的关键。
[6][必]%20定位应用部署路径&nbsp;%20&nbsp;%20find%20/%20-name&nbsp;"webapps"&nbsp;-type&nbsp;d%202>/dev/null&nbsp;%20&nbsp;%20find%20/%20-name&nbsp;"catalina.sh"&nbsp;2>/dev/null&nbsp;%20&nbsp;%20find%20/%20-name&nbsp;"application.properties"&nbsp;-o%20-name&nbsp;"application.yml"&nbsp;2>/dev/null&nbsp;%20&nbsp;%20find%20/%20-name&nbsp;"resin.xml"&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20>>%20看什么:%20确定%20Tomcat%20webapps%20/%20Spring%20Boot%20配置%20/%20Resin%20配置路径&nbsp;%20&nbsp;%20>>%20说明:%20后续搜索建议限定在此路径下，全盘搜索太慢
&nbsp;%20&nbsp;&nbsp;#%20设定搜索根目录变量（后续命令可用）&nbsp;%20&nbsp;%20APP_ROOT=/opt/tomcat%20&nbsp;%20&nbsp;#%20←%20替换为实际发现的路径
[7][必]%20查找近期修改的JSP文件%20(30天)&nbsp;%20&nbsp;%20find&nbsp;${APP_ROOT:-/}&nbsp;-name&nbsp;"*.jsp"&nbsp;-mtime%20-30%20-ls&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20>>%20看什么:%2030天内修改过的JSP，重点关注非业务目录下的JSP&nbsp;%20&nbsp;%20>>%20重点:%20文件名随机(如%20aB3x.jsp)、路径异常、修改时间与入侵时间吻合
[8][必]%20查找近期新增的JSP文件%20(7天，范围更小)&nbsp;%20&nbsp;%20find&nbsp;${APP_ROOT:-/}&nbsp;-name&nbsp;"*.jsp"&nbsp;-mtime%20-7%20-ls&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20>>%20看什么:%207天内新增的JSP，更容易定位
[9][必]%20查找包含危险代码的JSP文件&nbsp;%20&nbsp;%20grep%20-rl&nbsp;"Runtime.getRuntime\|ProcessBuilder\|defineClass\|ClassLoader\|ScriptEngine"&nbsp;\&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;&nbsp;${APP_ROOT:-/}&nbsp;--include="*.jsp"&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20>>%20看什么:%20包含命令执行/类加载等危险函数的JSP，极大概率是注入器&nbsp;%20&nbsp;%20>>%20注意:%20全盘搜索较慢，建议用%20APP_ROOT%20限定范围
[10][荐]%20查找Base64解码+类加载的JSP%20(内存马注入器典型特征)&nbsp;%20&nbsp;%20&nbsp;grep%20-rl&nbsp;"Base64\|decodeBuffer\|defineClass\|Unsafe"&nbsp;\&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;${APP_ROOT:-/}&nbsp;--include="*.jsp"&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20Base64解码后%20defineClass%20是内存马注入的标准手法
[11][荐]%20查找近期修改的class文件%20(非jar包内的)&nbsp;%20&nbsp;%20&nbsp;find&nbsp;${APP_ROOT:-/}&nbsp;-name&nbsp;"*.class"&nbsp;-mtime%20-30%20\&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;-not%20-path&nbsp;"*/lib/*"&nbsp;-not%20-path&nbsp;"*/WEB-INF/lib/*"&nbsp;-ls&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20正常类都在%20lib/*.jar%20或%20WEB-INF/lib/*.jar%20中，&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20不在这些目录下的%20.class%20文件非常可疑
[12][荐]%20查找Tomcat%20work目录下JSP编译的Java文件&nbsp;%20&nbsp;%20&nbsp;find%20/%20-path&nbsp;"*/work/Catalina/*"&nbsp;-name&nbsp;"*.java"&nbsp;-mtime%20-30%20-ls&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20JSP被访问后Tomcat会编译成Java文件存于%20work/Catalina/%20下&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20如果发现%20EdwardsiidaeFilter、PlasmodesmaFilter%20等类名，就是注入器
[13][选]%20查找隐藏文件&nbsp;%20&nbsp;%20&nbsp;find&nbsp;${APP_ROOT:-/}&nbsp;-path&nbsp;"*/webapps/*"&nbsp;-name&nbsp;".*"&nbsp;\&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;-not%20-name&nbsp;"."&nbsp;-not%20-name&nbsp;".."&nbsp;-ls&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20以%20.%20开头的文件在普通&nbsp;ls&nbsp;中不可见，攻击者可能命名为%20.malicious.jsp
[14][选]%20Spring%20Boot专项:%20检查fat%20jar内部是否被篡改&nbsp;%20&nbsp;%20&nbsp;#%20找到Spring%20Boot%20jar包&nbsp;%20&nbsp;%20&nbsp;SPRING_JAR=$(find%20/%20-name&nbsp;"*.jar"&nbsp;-path&nbsp;"*/opt/*"&nbsp;-mtime%20-30%202>/dev/null%20|&nbsp;head&nbsp;-5)&nbsp;%20&nbsp;%20&nbsp;echo&nbsp;"$SPRING_JAR"&nbsp;%20&nbsp;%20&nbsp;#%20检查jar中是否有可疑的Filter/Servlet类&nbsp;%20&nbsp;%20&nbsp;for&nbsp;jar&nbsp;in&nbsp;$SPRING_JAR;&nbsp;do&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;echo&nbsp;"===&nbsp;$jar&nbsp;==="&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;jar%20tf&nbsp;"$jar"&nbsp;2>/dev/null%20|%20grep%20-iE&nbsp;"filter|servlet|listener"&nbsp;|%20grep%20-viE&nbsp;"spring|shiro|druid|tomcat|log4j|slf4j"&nbsp;%20&nbsp;%20&nbsp;done
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20Spring%20Boot%20fat%20jar%20中出现不属于框架的%20Filter/Servlet%20类即为可疑
--------------------------------------------------------------------------------第三阶段:%20检查配置文件篡改--------------------------------------------------------------------------------
【说明】高版本Tomcat(8+)下内存马可通过动态API注册，但也可能直接篡改web.xml来持久化注册Filter/Listener。重启后配置被读取，内存马自动生效。
[15][必]%20查找web.xml文件&nbsp;%20&nbsp;%20&nbsp;find%20/%20-name&nbsp;"web.xml"&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20找到所有web.xml，后续检查内容
[16][必]%20检查web.xml中的Filter注册&nbsp;%20&nbsp;%20&nbsp;for&nbsp;f&nbsp;in&nbsp;$(find%20/%20-name&nbsp;"web.xml"&nbsp;2>/dev/null);&nbsp;do&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;echo&nbsp;"===&nbsp;$f&nbsp;==="&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;grep%20-A2&nbsp;"<filter-class>"&nbsp;"$f"&nbsp;2>/dev/null&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;echo&nbsp;""&nbsp;%20&nbsp;%20&nbsp;done
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20抓取%20<filter-class>%20内容，检查是否有可疑Filter注册&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20EdwardsiidaeFilter(冰蝎)、PlasmodesmaFilter(哥斯拉)%20等类名&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20不在白名单中的Filter类名也需要排查
[17][荐]%20检查web.xml中的Listener注册&nbsp;%20&nbsp;%20&nbsp;for&nbsp;f&nbsp;in&nbsp;$(find%20/%20-name&nbsp;"web.xml"&nbsp;2>/dev/null);&nbsp;do&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;echo&nbsp;"===&nbsp;$f&nbsp;==="&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;grep%20-A2&nbsp;"<listener-class>"&nbsp;"$f"&nbsp;2>/dev/null&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;echo&nbsp;""&nbsp;%20&nbsp;%20&nbsp;done
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20Listener型内存马也很常见，检查是否有可疑Listener
[18][荐]%20检查web.xml和server.xml修改时间&nbsp;%20&nbsp;%20&nbsp;find%20/%20-name&nbsp;"web.xml"&nbsp;-ls&nbsp;2>/dev/null&nbsp;%20&nbsp;%20&nbsp;find%20/%20-name&nbsp;"server.xml"&nbsp;-ls&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20近期被修改过的配置文件，可能被注入了恶意Filter/Listener/Valve/Realm
[19][选]%20Resin专项:%20检查resin.xml和resin-web.xml&nbsp;%20&nbsp;%20&nbsp;find%20/%20-name&nbsp;"resin.xml"&nbsp;-o%20-name&nbsp;"resin-web.xml"&nbsp;2>/dev/null%20|%20xargs&nbsp;ls&nbsp;-la&nbsp;%20&nbsp;%20&nbsp;find%20/%20-name&nbsp;"resin.xml"&nbsp;-o%20-name&nbsp;"resin-web.xml"&nbsp;2>/dev/null%20|%20xargs&nbsp;cat&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20Resin中间件的配置文件，检查是否有可疑的servlet/filter映射
--------------------------------------------------------------------------------第四阶段:%20网络连接排查%20(代理隧道)--------------------------------------------------------------------------------
[20][必]%20查看所有网络连接&nbsp;%20&nbsp;%20&nbsp;netstat%20-antlp%202>/dev/null%20||%20ss%20-antlp
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20所有TCP连接和监听端口&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20ESTABLISHED连接中，OA服务器主动连出去的异常IP和端口&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20Prepupa代理马会建立Socket连接到内网其他主机
[21][必]%20查看可疑的外联连接%20(排除常见业务端口)&nbsp;%20&nbsp;%20&nbsp;netstat%20-antp%202>/dev/null%20|%20grep%20ESTABLISHED%20|%20grep%20-v%20-E&nbsp;":80%20|:443%20|:8080%20|:8443%20|:22%20"
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20排除常见业务端口后，剩余ESTABLISHED连接都需排查&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20到内网其他主机的非业务端口连接，可能是代理隧道&nbsp;%20&nbsp;%20&nbsp;>>%20判断:%20连接长时间ESTABLISHED且进程为Java，但目标IP/端口无法解释%20→%20可疑
[22][荐]%20查看Java进程的网络连接&nbsp;%20&nbsp;%20&nbsp;lsof%20-i%20-a%20-p%20$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)%202>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20锁定Java进程的网络连接，更精准
[23][荐]%20查看监听端口&nbsp;%20&nbsp;%20&nbsp;netstat%20-tlnp%202>/dev/null%20||%20ss%20-tlnp
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20检查是否有异常监听端口，可能是反向Shell或SOCKS代理
--------------------------------------------------------------------------------第五阶段:%20Arthas检测内存马%20(最精准)--------------------------------------------------------------------------------
【说明】Arthas是阿里开源的Java诊断工具，可直接在运行中的JVM里查找内存马。断网环境下需用U盘拷入%20arthas-boot.jar，不要尝试%20curl%20下载。
[24][必]%20启动Arthas连接到目标Java进程&nbsp;%20&nbsp;%20&nbsp;java%20-jar%20arthas-boot.jar
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20会列出所有Java进程，选择目标进程编号&nbsp;%20&nbsp;%20&nbsp;>>%20进入Arthas交互界面后执行后续命令
[25][必]%20查找冰蝎内存马类&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*EdwardsiidaeFilter*
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20有输出则冰蝎内存马存在&nbsp;%20&nbsp;%20&nbsp;>>%20记录%20classLoaderHash%20和%20codeSource&nbsp;%20&nbsp;%20&nbsp;>>%20codeSource%20为%20file:/.../shell.jsp%20→%20注入器位置已明
[26][必]%20查找哥斯拉WebSocket内存马类&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*PlasmodesmaFilter*
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20有输出则哥斯拉内存马存在
[27][必]%20查找代理隧道马类&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Prepupa*
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20有输出则代理隧道马存在
[28][荐]%20查找哥斯拉全部载荷组件&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Alginv8I58akMMnCA7T0A*&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Eutropic*&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Poliorcetic*&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*LithoprintxCVIGnPE53kMja9q*&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Zygosporangium*
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20逐个检查哥斯拉的5个载荷组件(类名为随机生成变种)
[29][必]%20查找所有Filter类%20(发现未知内存马)&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Filter*
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20列出所有Filter类，检查是否有不属于OA系统的Filter&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20类名奇怪、无包名、$$Lambda$结尾的Filter
[30][荐]%20查找所有Listener类&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Listener*
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20检查是否有可疑的Listener型内存马
[31][必]%20查看FilterChain注册顺序%20(Tomcat环境)&nbsp;%20&nbsp;%20&nbsp;ognl&nbsp;'#context=@org.apache.catalina.core.ApplicationApplicationContextFacade@getContext(),#filterDefs=#context.getFilterDefs(),#filterDefs.{?%20#this.name%20!=%20null}.{#this.name%20+%20"%20->%20"%20+%20#this.filterClass}'
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20列出所有已注册Filter，动态注册的内存马会直接出现在列表中&nbsp;%20&nbsp;%20&nbsp;>>%20输出格式如:%20MaliciousFilterName%20->%20org.evil.FilterClass&nbsp;%20&nbsp;%20&nbsp;>>%20如果报错，尝试下一条替代命令
[32][选]%20查看Filter注册%20(Spring%20Boot环境)&nbsp;%20&nbsp;%20&nbsp;ognl&nbsp;'@org.springframework.web.context.support.WebApplicationContextUtils@getWebApplicationContext(@org.springframework.web.context.ContextLoader@getCurrentWebApplicationContext().getServletContext())'
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20获取Spring上下文，查看注册的Filter
[33][荐]%20查看当前活跃线程%20(找代理线程)&nbsp;%20&nbsp;%20&nbsp;thread
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20代理马通常创建名为%20Thread-x%20的守护线程处理Socket&nbsp;%20&nbsp;%20&nbsp;>>%20堆栈中出现%20Prepupa%20或%20Socket.connect%20特征即为代理线程
[34][荐]%20查看可疑线程详情&nbsp;%20&nbsp;%20&nbsp;thread%20<线程ID>
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20查看线程堆栈，包含%20Prepupa/Socket%20等关键词即为代理线程
[35][荐]%20反编译可疑类确认源码&nbsp;%20&nbsp;%20&nbsp;jad%20<完整类名>
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20反编译内存马类，确认是否为恶意代码&nbsp;%20&nbsp;%20&nbsp;>>%20注意:%20如果类名含特殊字符，先用%20sc%20查到完整类名再%20jad
[36][必]%20查看类加载器信息%20(定位注入来源，最关键!)&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20<恶意类名>%20|%20grep%20-i&nbsp;"classloader\|codeSource"
&nbsp;%20&nbsp;%20&nbsp;>>%20判断依据:&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20codeSource%20为%20JSP路径%20&nbsp;→%20磁盘上有注入器JSP，删掉它再重启&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20codeSource%20为空/null%20&nbsp;%20→%20通过反序列化/漏洞直接注入，重启即清除&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20classLoader%20为%20JasperLoader%20&nbsp;%20&nbsp;%20&nbsp;→%20JSP编译加载，一定有注入器JSP&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20classLoader%20为%20LaunchedURLClassLoader%20→%20Spring%20Boot%20fat%20jar加载&nbsp;%20&nbsp;%20&nbsp;%20&nbsp;%20classLoader%20为自定义类加载器%20&nbsp;%20&nbsp;%20&nbsp;→%20可能是Agent或反序列化链
[37][荐]%20Agent型内存马专项检查&nbsp;%20&nbsp;%20&nbsp;#%20查看已加载的Instrumentation相关类&nbsp;%20&nbsp;%20&nbsp;sc%20-d%20*Instrumentation*&nbsp;%20&nbsp;%20&nbsp;#%20查看所有javaagent加载的类&nbsp;%20&nbsp;%20&nbsp;vmtool%20--action%20getInstances%20--className%20java.lang.instrument.Instrumentation
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20如果发现非APM工具的Instrumentation实例，可能是Agent型内存马
[38][选]%20监控defineClass调用%20(清除后监控是否被重新注入)&nbsp;%20&nbsp;%20&nbsp;watch%20java.lang.ClassLoader%20defineClass&nbsp;'{params,returnObj,throwExp}'&nbsp;-n%20100
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20实时监控类加载，当内存马被注入时会捕获到
--------------------------------------------------------------------------------第六阶段:%20JDK自带工具检测%20(Arthas不可用时的替代方案)--------------------------------------------------------------------------------
【说明】如果无法传入Arthas，可用JDK自带工具做基础排查。
[39][荐]%20查看JVM进程&nbsp;%20&nbsp;%20&nbsp;jps%20-lv
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20列出所有Java进程及启动参数，检查%20-javaagent
[40][荐]%20查看类的直方图%20(找可疑类数量异常)&nbsp;%20&nbsp;%20&nbsp;jmap%20-histo%20$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)%20|%20grep%20-iE&nbsp;"filter|servlet|listener"&nbsp;|&nbsp;head&nbsp;-30
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20查看JVM中Filter/Servlet/Listener类的实例数量&nbsp;%20&nbsp;%20&nbsp;>>%20重点:%20实例数异常多的或类名可疑的
[41][荐]%20查看线程堆栈%20(找代理线程)&nbsp;%20&nbsp;%20&nbsp;jstack%20$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)%20|%20grep%20-A5%20-iE&nbsp;"Prepupa|Edwardsiidae|Plasmodesma"
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20直接在线程堆栈中搜索已知恶意类名
[42][选]%20导出堆栈全量分析&nbsp;%20&nbsp;%20&nbsp;jstack%20$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)%20>%20/tmp/jstack_$(date&nbsp;+%s).txt&nbsp;%20&nbsp;%20&nbsp;#%20然后搜索可疑特征&nbsp;%20&nbsp;%20&nbsp;grep%20-iE&nbsp;"defineClass|Base64|Runtime"&nbsp;/tmp/jstack_*.txt
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20导出完整线程堆栈后离线分析
[43][选]%20使用jcmd查看JVM信息&nbsp;%20&nbsp;%20&nbsp;jcmd%20$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)%20VM.command_line&nbsp;%20&nbsp;%20&nbsp;jcmd%20$(pgrep%20-f%20java%20|&nbsp;head&nbsp;-1)%20VM.system_properties
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20查看JVM启动命令和系统属性，检查是否被注入
--------------------------------------------------------------------------------第七阶段:%20日志定位入侵时间--------------------------------------------------------------------------------
[44][荐]%20查找Tomcat访问日志&nbsp;%20&nbsp;%20&nbsp;find%20/%20-name&nbsp;"localhost_access_log*"&nbsp;-o%20-name&nbsp;"access_log*"&nbsp;-o%20-name&nbsp;"catalina.out"&nbsp;2>/dev/null
&nbsp;%20&nbsp;%20&nbsp;>>%20看什么:%20找到访问日志文件路径
[45][荐]%20查看访问日志中的POST请求%20(可能包含注入请求)&nbsp;%20&nbsp;%20&nbsp;LOG_PATH=$(find%20/%20-name&nbsp;"access_log*"&nbsp;-o%20-name&nbsp;"localhost_access_log*"&nbsp;2>/dev/null%20|&nbsp;head&nbsp;-1)&nbsp;%20&nbsp;%20&nbsp;grep&nbsp;"POST"&nbsp;"$LOG_PATH"&nbsp;|%20grep%20-v%20-E&nbsp;"\.js|\.css|\.png|\.jpg|\.gif|\.ico"&nbsp;|&nbsp;tail&nbsp;-200
&nbsp; &nbsp; &nbsp;>> 看什么: 非静态资源的POST请求，可能是注入内存马的请求&nbsp; &nbsp; &nbsp;>> 重点: 参数为Base64字符串、访问路径可疑的请求
[46][荐] 查看WebSocket升级请求&nbsp; &nbsp; &nbsp;LOG_PATH=$(find / -name&nbsp;"access_log*"&nbsp;-o -name&nbsp;"localhost_access_log*"&nbsp;2>/dev/null |&nbsp;head&nbsp;-1)&nbsp; &nbsp; &nbsp;grep -i&nbsp;"upgrade\|websocket"&nbsp;"$LOG_PATH"&nbsp;|&nbsp;tail&nbsp;-50
&nbsp; &nbsp; &nbsp;>> 看什么: 哥斯拉WebSocket内存马会有 HTTP Upgrade: websocket 头
[47][选] 查看catalina.out日志中的异常&nbsp; &nbsp; &nbsp;CAT_PATH=$(find / -name&nbsp;"catalina.out"&nbsp;2>/dev/null |&nbsp;head&nbsp;-1)&nbsp; &nbsp; &nbsp;grep -i&nbsp;"error\|exception\|defineClass\|ClassLoader"&nbsp;"$CAT_PATH"&nbsp;|&nbsp;tail&nbsp;-100
&nbsp; &nbsp; &nbsp;>> 看什么: 应用日志中的异常，可能有注入时的错误信息
[48][选] 查看日志文件修改时间 (定位入侵时间窗口)&nbsp; &nbsp; &nbsp;LOG_DIR=$(find / -name&nbsp;"catalina.out"&nbsp;2>/dev/null |&nbsp;head&nbsp;-1 | xargs&nbsp;dirname)&nbsp; &nbsp; &nbsp;ls&nbsp;-lt&nbsp;"$LOG_DIR"/ |&nbsp;head&nbsp;-10
&nbsp; &nbsp; &nbsp;>> 看什么: 日志文件的修改时间，确定入侵时间范围
--------------------------------------------------------------------------------第八阶段: 定时任务和启动项--------------------------------------------------------------------------------
[49][荐] 查看root的crontab&nbsp; &nbsp; &nbsp;crontab -l
[50][荐] 查看系统crontab&nbsp; &nbsp; &nbsp;cat&nbsp;/etc/crontab&nbsp; &nbsp; &nbsp;ls&nbsp;-la /etc/cron.d/
[51][选] 查看所有用户的crontab&nbsp; &nbsp; &nbsp;for&nbsp;user&nbsp;in&nbsp;$(cut&nbsp;-d: -f1 /etc/passwd);&nbsp;do&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;echo&nbsp;"===&nbsp;$user&nbsp;==="&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;crontab -u&nbsp;"$user"&nbsp;-l 2>/dev/null&nbsp; &nbsp; &nbsp;done
[52][选] 查看systemd服务&nbsp; &nbsp; &nbsp;systemctl list-units --type=service --state=running | grep -v -E&nbsp;"ssh|network|cron|dbus|systemd|rsyslog|serial|login|user@"
&nbsp; &nbsp; &nbsp;>> 看什么: 排除常见系统服务，检查是否有可疑自定义服务
[53][选] 查看rc.local启动项&nbsp; &nbsp; &nbsp;cat&nbsp;/etc/rc.local 2>/dev/null
--------------------------------------------------------------------------------第九阶段: 可疑文件和用户--------------------------------------------------------------------------------
[54][荐] 查找近期修改的jar包 (非webapps目录)&nbsp; &nbsp; &nbsp;find / -name&nbsp;"*.jar"&nbsp;-mtime -30 -ls&nbsp;2>/dev/null | grep -v&nbsp;"webapps\|WEB-INF"
&nbsp; &nbsp; &nbsp;>> 看什么: 非webapps目录下近期修改的jar包，可能是恶意Agent
[55][荐] 检查Tomcat启动脚本是否被修改&nbsp; &nbsp; &nbsp;find / -name&nbsp;"setenv.sh"&nbsp;-o -name&nbsp;"catalina.sh"&nbsp;2>/dev/null | xargs&nbsp;ls&nbsp;-la&nbsp; &nbsp; &nbsp;find / -name&nbsp;"setenv.sh"&nbsp;2>/dev/null | xargs&nbsp;cat&nbsp;2>/dev/null
&nbsp; &nbsp; &nbsp;>> 看什么: 启动脚本近期被修改可能被注入了 -javaagent 等参数
[56][选] 检查SSH授权密钥&nbsp; &nbsp; &nbsp;find / -name&nbsp;"authorized_keys"&nbsp;2>/dev/null | xargs&nbsp;cat&nbsp;2>/dev/null
&nbsp; &nbsp; &nbsp;>> 看什么: 是否有攻击者添加的SSH公钥
[57][选] 检查最近登录记录&nbsp; &nbsp; &nbsp;last -20&nbsp; &nbsp; &nbsp;lastb -20 2>/dev/null
&nbsp; &nbsp; &nbsp;>> 看什么: 最近的成功和失败登录，是否有异常IP
[58][选] 查找具有SUID权限的可疑文件&nbsp; &nbsp; &nbsp;find / -perm -4000 -type&nbsp;f 2>/dev/null | grep -v -E&nbsp;"^/usr/bin/|^/usr/sbin/|^/bin/|^/sbin/"
&nbsp; &nbsp; &nbsp;>> 看什么: 非标准目录下的SUID文件，可能用于提权

================================================================================四、内存马清除操作================================================================================
【原则】先删注入器 → 再清配置 → 最后重启 → 重启后验证
[59][必] 第1步: 删除磁盘上的注入器JSP文件&nbsp; &nbsp; &nbsp;rm&nbsp;-f /path/to/malicious.jsp
&nbsp; &nbsp; &nbsp;>> 重要: 必须先删除注入器，否则重启后还会被重新注入&nbsp; &nbsp; &nbsp;>> 替换为实际发现的注入器路径
[60][必] 第2步: 恢复被篡改的web.xml&nbsp; &nbsp; &nbsp;# 先备份&nbsp; &nbsp; &nbsp;cp&nbsp;/path/to/web.xml /path/to/web.xml.bak&nbsp; &nbsp; &nbsp;# 编辑删除恶意Filter/Listener注册&nbsp; &nbsp; &nbsp;vi /path/to/web.xml
&nbsp; &nbsp; &nbsp;>> 看什么: 删除web.xml中恶意Filter/Listener的 <filter> 和 <filter-mapping> 配置
[61][必] 第3步: 清除Agent型内存马的持久化&nbsp; &nbsp; &nbsp;# 从启动脚本中删除 -javaagent 参数&nbsp; &nbsp; &nbsp;vi /path/to/setenv.sh &nbsp;&nbsp;# 或 catalina.sh&nbsp; &nbsp; &nbsp;# 删除恶意agent jar包&nbsp; &nbsp; &nbsp;rm&nbsp;-f /path/to/evil-agent.jar
[62][必] 第4步: Arthas热清除 - 查看Filter注册详情&nbsp; &nbsp; &nbsp;ognl&nbsp;'#[email protected]@getContext(),#filterDefs=#context.getFilterDefs(),#filterDefs.{? #this.name != null}.{#this.name + " -> " + #this.filterClass}'
&nbsp; &nbsp; &nbsp;>> 看什么: 列出所有Filter，找到恶意Filter的名称
[63][必] 第5步: Arthas热清除 - 移除恶意Filter (分步操作)
&nbsp; &nbsp; &nbsp;# 5a. 先获取恶意FilterDef对象&nbsp; &nbsp; &nbsp;ognl&nbsp;'#[email protected]@getContext(),#filterDefs=#context.getFilterDefs(),#filterDefs.{? #this.filterClass.contains("Edwardsiidae")}.{#this.name + " | " + #this.filterClass}'
&nbsp; &nbsp; &nbsp;# 5b. 确认名称后，移除FilterDef&nbsp; &nbsp; &nbsp;ognl&nbsp;'#[email protected]@getContext(),#filterDefs=#context.getFilterDefs(),#filterConfigs=#context.getFilterConfigs(),#def removeFilter=#context.getClass().getDeclaredMethod("removeFilterDef",#forName("org.apache.tomcat.util.descriptor.web.FilterDef")),#removeFilter.setAccessible(true),#f=#filterDefs.{? #this.filterClass.contains("Edwardsiidae")}.get(0),#removeFilter.invoke(#context,{#f})'
&nbsp; &nbsp; &nbsp;# 5c. 移除FilterMap&nbsp; &nbsp; &nbsp;ognl&nbsp;'#[email protected]@getContext(),#filterMaps=#context.getFilterMaps(),#def removeFilterMap=#context.getClass().getDeclaredMethod("removeFilterMap",#forName("org.apache.tomcat.util.descriptor.web.FilterMap")),#removeFilterMap.setAccessible(true),#fm=#filterMaps.{? #this.getFilterName().contains("恶意Filter名")}.get(0),#removeFilterMap.invoke(#context,{#fm})'
&nbsp; &nbsp; &nbsp;>> 注意: OGNL表达式需根据实际环境调整，如果报错请根据报错信息修改&nbsp; &nbsp; &nbsp;>> 替换&nbsp;"Edwardsiidae"&nbsp;和&nbsp;"恶意Filter名"&nbsp;为实际发现的类名/Filter名
[64][必] 第6步: 重启应用 (最彻底的清除方式)&nbsp; &nbsp; &nbsp;# 找到启动脚本&nbsp; &nbsp; &nbsp;find / -name&nbsp;"startup.sh"&nbsp;-path&nbsp;"*/tomcat*"&nbsp;2>/dev/null&nbsp; &nbsp; &nbsp;find / -name&nbsp;"catalina.sh"&nbsp;2>/dev/null&nbsp; &nbsp; &nbsp;# 先停止&nbsp; &nbsp; &nbsp;/path/to/shutdown.sh&nbsp; &nbsp; &nbsp;# 确认进程已停止&nbsp; &nbsp; &nbsp;ps aux | grep java&nbsp; &nbsp; &nbsp;# 如果没停掉，强制kill&nbsp; &nbsp; &nbsp;kill&nbsp;-9 $(pgrep -f java)&nbsp; &nbsp; &nbsp;# 再启动&nbsp; &nbsp; &nbsp;/path/to/startup.sh
&nbsp; &nbsp; &nbsp;>> 重要: 重启前确保已删除注入器文件和恢复web.xml
[65][必] 第7步: 重启后立即验证&nbsp; &nbsp; &nbsp;# 重新连接Arthas&nbsp; &nbsp; &nbsp;java -jar arthas-boot.jar&nbsp; &nbsp; &nbsp;# 检查恶意类是否还存在&nbsp; &nbsp; &nbsp;sc -d *EdwardsiidaeFilter*&nbsp; &nbsp; &nbsp;sc -d *PlasmodesmaFilter*&nbsp; &nbsp; &nbsp;sc -d *Prepupa*
&nbsp; &nbsp; &nbsp;>> 看什么: 没有输出 → 内存马已清除&nbsp; &nbsp; &nbsp;>> 如果还有输出 → 持久化机制未清除干净，需继续排查

================================================================================五、快速排查6步法（紧急场景）================================================================================
【说明】时间有限时，只执行以下6步即可快速定位内存马
[66] 第1步: 找Java进程和PID&nbsp; &nbsp; &nbsp;ps aux | grep java
[67] 第2步: 找可疑JSP文件&nbsp; &nbsp; &nbsp;find / -name&nbsp;"*.jsp"&nbsp;-mtime -7 -ls&nbsp;2>/dev/null
[68] 第3步: 找包含危险代码的JSP&nbsp; &nbsp; &nbsp;grep -rl&nbsp;"defineClass\|Runtime.getRuntime"&nbsp;/ --include="*.jsp"&nbsp;2>/dev/null
[69] 第4步: 查看网络连接&nbsp; &nbsp; &nbsp;netstat -antp 2>/dev/null | grep ESTABLISHED
[70] 第5步: 用Arthas查找恶意类&nbsp; &nbsp; &nbsp;java -jar arthas-boot.jar&nbsp; &nbsp; &nbsp;# 进入Arthas后执行:&nbsp; &nbsp; &nbsp;sc -d *EdwardsiidaeFilter*&nbsp; &nbsp; &nbsp;sc -d *PlasmodesmaFilter*&nbsp; &nbsp; &nbsp;sc -d *Prepupa*&nbsp; &nbsp; &nbsp;sc -d *Filter*
[71] 第6步: 查看恶意类的加载来源&nbsp; &nbsp; &nbsp;# 在Arthas中执行 (替换为实际发现的类名):&nbsp; &nbsp; &nbsp;sc -d <类名> | grep -i&nbsp;"classloader\|codeSource"
&nbsp; &nbsp; &nbsp;>> 判断:&nbsp; &nbsp; &nbsp; &nbsp; codeSource 显示JSP路径 &nbsp;→ 磁盘上有注入器JSP，删掉它&nbsp; &nbsp; &nbsp; &nbsp; codeSource 为空 &nbsp; &nbsp; &nbsp; &nbsp; → 通过漏洞直接注入，需查日志&nbsp; &nbsp; &nbsp; &nbsp; JasperLoader &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;→ JSP编译加载，一定有注入器JSP&nbsp; &nbsp; &nbsp; &nbsp; URLClassLoader &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;→ 可能通过jar包加载

================================================================================六、排查结果判断指南================================================================================
【场景1】找到了可疑JSP文件&nbsp; → 该JSP就是内存马注入器&nbsp; → 查看其内容:&nbsp;cat&nbsp;/path/to/suspicious.jsp&nbsp; → 删除该JSP:&nbsp;rm&nbsp;-f /path/to/suspicious.jsp&nbsp; → 重启应用&nbsp; → 重启后用Arthas确认内存马已清除
【场景2】web.xml中有可疑Filter/Listener&nbsp; → 攻击者修改了web.xml注册恶意组件&nbsp; → 备份后编辑web.xml删除恶意注册&nbsp; → 重启应用
【场景3】JVM启动参数有 -javaagent&nbsp; → 攻击者通过Java Agent注入&nbsp; → 找到agent jar包路径&nbsp; → 从启动脚本(setenv.sh/catalina.sh)中删除 -javaagent 参数&nbsp; → 删除恶意agent jar包&nbsp; → 重启应用
【场景4】磁盘上没有找到任何可疑文件&nbsp; → 内存马可能是通过远程漏洞(反序列化/文件上传)一次性注入&nbsp; → 没有持久化机制，重启即可清除&nbsp; → 但必须排查入侵漏洞，否则还会被注入&nbsp; → 检查日志找到入侵时间点的请求，定位漏洞入口
【场景5】Arthas中 sc -d 找不到恶意类&nbsp; → 内存马可能已被清除，或类名不同&nbsp; → 尝试更宽泛的搜索: sc -d *Filter* 和 sc -d *Lambda*&nbsp; → 检查所有Filter是否有不属于OA系统的&nbsp; → 用 jstack 导出线程堆栈全量分析

================================================================================附篇: 内存马告警快速研判指南================================================================================
【适用场景】收到内存马告警后，快速研判是真马还是误报【核心】看堆栈 + 看进程参数 + 看告警时间
一、看堆栈：有没有恶意类名（最核心）
&nbsp; 真内存马堆栈特征:&nbsp; &nbsp; EdwardsiidaeFilter.doFilter() &nbsp; &nbsp; &nbsp; &nbsp;← 生僻词+Filter，冰蝎&nbsp; &nbsp; PlasmodesmaFilter.doFilter() &nbsp; &nbsp; &nbsp; &nbsp; ← 生僻词+Filter，哥斯拉&nbsp; &nbsp; Prepupa.run() &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;← 生僻词+Runnable，代理马&nbsp; &nbsp; org.apache.catalina.core.ApplicationFilterChain.internalDoFilter()
&nbsp; 误报堆栈特征:&nbsp; &nbsp; ServletConfigImpl.<init>() &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ← 框架类，正常&nbsp; &nbsp; WebApp.createServlet() &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ← 框架类，正常&nbsp; &nbsp; ConfigContext.configureAttribute() &nbsp; &nbsp;← 框架类，正常
&nbsp; 判断规则:&nbsp; &nbsp; 堆栈顶部类名含 生僻词+Filter/Servlet/Listener → 真内存马&nbsp; &nbsp; 堆栈顶部全是 框架自身类(catalina/spring/caucho) → 大概率误报&nbsp; &nbsp; 堆栈中出现 $$Lambda$ → 需进一步看Lambda具体是什么
二、看进程启动参数：中间件和路径
&nbsp; 正常示例:&nbsp; &nbsp; /srv/thinkive/software/resin-pro-3.1.10/ &nbsp; &nbsp; ← Resin中间件&nbsp; &nbsp; -conf /srv/thinkive/app/fxc-stkkh-dzt-web/resin.xml &nbsp;← 正常业务配置&nbsp; &nbsp; com.caucho.server.resin.Resin &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ← Resin主类
&nbsp; 判断规则:&nbsp; &nbsp; 启动参数路径正常、用户正常 → 误报概率高&nbsp; &nbsp; 看到 -javaagent:可疑路径 → 高度可疑
三、看告警时间和数量
&nbsp; 判断规则:&nbsp; &nbsp; 同一秒多条相同堆栈 → 应用启动/重部署触发，批量误报&nbsp; &nbsp; 单条、零散出现 → 更可能是真实注入
总结: 堆栈顶部有没有"生僻词+Servlet组件"的类名，有就是真内存马，&nbsp; &nbsp; &nbsp;全是框架自身类就是误报。

================================================================================附录: ARM架构注意事项================================================================================
1. Arthas支持ARM64架构，正常使用即可2. 断网环境: 用U盘拷入 arthas-boot.jar，不要尝试在线下载3. 国产化OA特殊目录:&nbsp; &nbsp;- 致远: /opt/seeyon/ 或 /usr/local/seeyon/&nbsp; &nbsp;- 泛微: /opt/weaver/ 或 /usr/local/weaver/&nbsp; &nbsp;- 蓝凌: /opt/landray/ 或 /usr/local/landray/4. Spring Boot fat jar: webapps目录不存在，需检查jar包内部5. ARM架构Java路径可能是 /usr/lib/jvm/aarch64-linux-gnu/
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：摸鱼划水 Xluo Xluo《java内存马应急排查指南》