Skip to content

Commit b3ef3a0

Browse files
authored
Update README.md
1 parent 632ed7c commit b3ef3a0

File tree

1 file changed

+13
-13
lines changed

1 file changed

+13
-13
lines changed

README.md

+13-13
Original file line numberDiff line numberDiff line change
@@ -47,33 +47,33 @@ upload directory : /opt/zimbra/jetty\_base/webapps/zimbra/public/
4747

4848
**2.Access 'inject.jsp' to inject a memory backdoor into the system. After injecting, delete 'inject.jsp,' but the backdoor will still persist.**
4949

50-
![图片](./images/1.png)
50+
![图片](./XPost-ReadMe/images/1.png)
5151

5252
Successfully removed 'inject.jsp' and established a connection to the memory backdoor.
5353

54-
![图片](./images/22.png)
54+
![图片](./XPost-ReadMe/images/22.png)
5555

5656
**3.Backdoor Persistence**
5757

5858
Prevent the memory-resident backdoor from being cleared upon restart by replacing the zimbra-license.jar plugin. Substitute the malicious zimbra-license-success.jar for the original system jar file to achieve backdoor persistence.
5959

60-
![图片](./images/3.png)
60+
![图片](./XPost-ReadMe/images/3.png)
6161

6262
**4.Clearing logs**
6363

6464
Utilize the 'zimbraplugin ClearLog' function to erase logs of malicious JSP access.
6565

66-
![图片](./images/4.png)
66+
![图片](./XPost-ReadMe/images/4.png)
6767

6868
**5.Functional payload**
6969

7070
Utilize specific functionalities as needed. Upon clicking the corresponding function, the payload will be sent to the server backdoor, and the corresponding payload will be executed in memory.
7171

72-
![图片](./images/5.png)
72+
![图片](./XPost-ReadMe/images/5.png)
7373

7474
**6.Traffic**
7575

76-
![图片](./images/6.png)
76+
![图片](./XPost-ReadMe/images/6.png)
7777

7878
**7.Test Version**
7979

@@ -83,7 +83,7 @@ Utilize specific functionalities as needed. Upon clicking the corresponding func
8383

8484
**1.Upload shell.jar to inject a backdoor into the target system at runtime**
8585

86-
![图片](./images/7.png)
86+
![图片](./XPost-ReadMe/images/7.png)
8787

8888
The backdoor has been successfully injected; delete shell.jar.
8989

@@ -93,11 +93,11 @@ To prevent the loss of the backdoor upon system restart, modify the startup logi
9393

9494
**3.Functional payload**
9595

96-
![图片](./images/8.png)
96+
![图片](./XPost-ReadMe/images/8.png)
9797

9898
**4.Traffic**
9999

100-
![图片](./images/9.png)
100+
![图片](./XPost-ReadMe/images/9.png)
101101

102102
**5.Test Version**
103103

@@ -111,18 +111,18 @@ Upload path: /opt/atlassian/confluence/synchrony-proxy/
111111

112112
**2.Access inject.jsp to inject a memory backdoor.**
113113

114-
![图片](./images/10.png)
114+
![图片](./XPost-ReadMe/images/10.png)
115115

116116
After successfully injecting the backdoor, delete inject.jsp.
117117

118118
**3.Functional payload**
119119

120-
![图片](./images/11.png)
120+
![图片](./XPost-ReadMe/images/11.png)
121121

122122
**4.Traffic**
123123

124-
![图片](./images/12.png)
124+
![图片](./XPost-ReadMe/images/12.png)
125125

126126
**5.Test Version**
127127

128-
![图片](./images/13.png)
128+
![图片](./XPost-ReadMe/images/13.png)

0 commit comments

Comments
 (0)