############################################################################
Created by Scoperchiatore - http://scoperchiatore.netsons.org

This program is free software; you can redistribute it andor modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version. See the COPYING file for details
############################################################################

WSH Help Page / User Guide

******************************* DISCLAIMER *******************************
Use this software only if authorized.
You may use this application in many ways, and some of them are illegal,
so be extremely careful.
 The purpose of wsh is to help Ethical Hackers during the
execution of so-called "Security Assessment" or "Penetration Tests".
Such activities are usually known and authorized.

If you find this application installed on your server, and you are not aware of any
security assessment running on your machine, you should investigate if such
assessment is tacking place.
If not, you should remove/undeploy this application, because it can let anyone
access critical data on this server!

The author can not be responsable of any unauthorized use of this tool
***************************************************************************


WSH is Web-SHell written in Java to be used in Java environments. A Web Shell is a Web Application that acts like a shell to let you execute commands on a target. Actually, this is a little more than a webshell, because it gives you an user friendly "File Manager" to examinate file systems, and a way to open a backdoor on a taget.

You should use this utility uploading the war file through the Application Server management console (Tomcat Manager, Weblogic Console, SunAS console, etc...) and then visiting the deploy page. If you are reading this web-help on a web page, and not by cat on you filesystem, you did everything correctly.
The application consist in a single web page you can reach in various way, but mainly go to http(s)://[the_server_you_uploaded_into]:[the_server_port]/wsh/ to start

As you can see, there are two frames in this page (you can easily resize one of them to "conceal" it and use only the other one):
  1. The upper one, referred as the "Web Shell"
  2. The lower one, referred as the "File Manager"
If characters are too small to you, remember that your browser should have a built-in zoom function (CTRL+Mouse Wheel in Firefox)-
The File Manager
I think it's very clear what anyone can do using the lower side functions: you can navigate the whole filesystem quickly, reading text (and no-text) files, seeing images, and so on... Only an important note: DON NOT CLICK/VISUALIZE/cat A UNIX/LINUX DEVICE. If you don't know what this can cause, perhaps you should not use this software. You will display the flow of the device content and the whole application will probably hang; you may seriously harm the server, at least from a prestational point of view. In addition, you won't be able to stop the process if you did not use the "Max time execution" function (see down)

If your target is a Windows SO, you should pay attention to a couple of things; please refer to Known Bugs for details.
The Web Shell
Through this frame, you can execute commands; just type the command after the $ and press Enter or click the Exec button. As you can see, before the command input field, you may see the username the application server runs with, that is the user you have on the server, the server name and the path where you are on the machine: it is very useful, to me, to know all those information while doing something.

An interesting thing this shell can do is to manage path and path modification through the use of quite any kind of cd command. You can execute cd .. cd / or cd /the/path/you/want/to/reach to reach it. As you may figure out, the path management is simulated, so you may find something "strange" during the use: if this happens, reload the default page manually from the browser, and everything should go back to a stable state.

If your target is a Windows SO, you should pay attention to a couple of things; please refer to Known Bugs for details.

The web shell has many functionality, divided into columns of a big table on the upper side of the screen. Reading them from left to right:
Please remember this is an application written to support ethical hackers, not to show how to write secure applications! It has many bugs, many parameters are not sanitized, and requests/sessions are not built to resist users manipulation. If you find a security hole, i will not fix it: the application itself is intended to be an enourmus security hole!!
The application is not W3C compliant, not validated against any HTTP DTD/XmlSchema; this is done on purpose, because such standards have no sense if applied on an extremely dedicated and particular contest like this.

Always read Known Bugs before using any function
Please read Future Works for a list of planned upgrades