Research on the Implementation and Detection of Tomcat Filter-based MemShell

With the large-scale deployment of web application services, memory shells (MemShells) have become a significant threat to server security due to their fileless nature and high concealment. This paper takes the Apache Tomcat server as the research target and conducts an in-depth analysis of the dynamic registration methods of Filter-based MemShells. A memory persistence injection technique based on Java reflection is proposed. By constructing a vulnerability testing environment, we verify that Filter-based MemShells can remain hidden for long periods without relying on disk files, while still achieving remote command execution (RCE). In response to their strong stealth and detection difficulty, we design a dynamic detection and automatic defense mechanism based on memory behavior analysis. Experiments are conducted to evaluate both the detection accuracy and system performance. The results show that the proposed method can effectively identify and eliminate Filterbased MemShells, thereby enhancing the security protection capability of Tomcat servers.