What is the purpose of the webshell described in the article and how does it handle NTLM authentication?
The article presents a webshell implementation that works on web servers requiring NTLM authentication via the NTLM Over HTTP protocol, such as Exchange and SharePoint. It consists of two parts: an ASPX page (`execCmd.aspx`) that receives and executes commands after verifying a Base64-encoded Auth Key, and a Python script (`aspxCmdNTLM.py`) that performs NTLM handshake from the command line, supporting both plaintext and hash-based login methods. This design allows penetration testers to execute cmd commands without a browser, similar to techniques covered in obtaining Net-NTLM hash via HTTP.
webshellNTLM Over HTTPExchangeSharePointcommand-lineauthentication