What is the purpose of the webshell described in the article and how does it handle NTLM authentication?

The article presents a [webshell implementation](/news/penetration-basics-implementation-of-webshell-supporting-ntlm-over-http-protocol) that works on web servers requiring NTLM authentication via the NTLM Over HTTP protocol, such as Exchange and SharePoint. It consists of two parts: an ASPX page (`execCmd.aspx`) that receives and executes commands after verifying a Base64-encoded Auth Key, and a Python script (`aspxCmdNTLM.py`) that performs NTLM handshake from the command line, supporting both plaintext and hash-based login methods. This design allows penetration testers to execute cmd commands without a browser, similar to techniques covered in [obtaining Net-NTLM hash via HTTP](/news/penetration-techniques-obtaining-net-ntlm-hash-via-http-protocol).