2024CISCN初赛
ezjava
JDBC-Attack-SQLite加载恶意so文件

分析JdbcController,com.example.jdbctest.controller.JdbcController#connect
1 2 3 4 5 6 7 8 9 10
| @RequestMapping({"/connect"}) @ResponseBody public ResultBean connect(@RequestBody JdbcBean jdbcBean) { try { return new ResultBean(1, String.join(",", this.datasourceServiceImpl.testDatasourceConnectionAble(jdbcBean))); } catch (Exception var3) { return new ResultBean(0, "连接失败"); } }
|
实例化连接测试,跟进com.example.jdbctest.services.datasourceServiceImpl#testDatasourceConnectionAble
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
| public String[] testDatasourceConnectionAble(JdbcBean jdbcBean) throws ClassNotFoundException, SQLException { DatasourceLoadConfig var10000 = this.datasourceLoadConfig; Map<String, String> config = DatasourceLoadConfig.getConfig(); switch (jdbcBean.getType()) { case 1: Class.forName((String)config.get("JDBC-MYSQL")); MysqlDatasourceConnector mysqlDatasourceConnector = new MysqlDatasourceConnector(DriverManager.getConnection(jdbcBean.getUrl())); if (jdbcBean.getTableName() != null) { return mysqlDatasourceConnector.getTableContent(jdbcBean.getTableName()); }
return mysqlDatasourceConnector.getTables(); case 2: Class.forName((String)config.get("JDBC-POSTGRES")); PostgresDatasourceConnector postgresDatasourceConnector = new PostgresDatasourceConnector(DriverManager.getConnection(jdbcBean.getUrl())); if (jdbcBean.getTableName() != null) { return postgresDatasourceConnector.getTableContent(jdbcBean.getTableName()); }
return postgresDatasourceConnector.getTables(); case 3: SqliteDatasourceConnector sqliteDatasourceConnector = new SqliteDatasourceConnector(jdbcBean.getUrl()); if (jdbcBean.getTableName() != null) { return sqliteDatasourceConnector.getTableContent(jdbcBean.getTableName()); }
return sqliteDatasourceConnector.getTables(); case 4: Class.forName((String)config.get("JDBC-SQLITE")); return new String[]{""}; default: return new String[]{""}; } }
|
根据sqliteDatasourceConnector.getTableContent
,跟进到com.example.jdbctest.services.DatasourceServiceImpl#getTableContent
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
| public String[] getTableContent(String tableName) { String sql = "select * from " + tableName;
try { Statement statement = this.connection.createStatement(); Throwable var4 = null;
try { ResultSet resultSet = statement.executeQuery(sql); Throwable var6 = null;
} } return new String[0]; }
|
Read More