| 1 | /******************************************************************************* | |
| 2 | * Copyhacked (H) 2012-2025. | |
| 3 | * This program and the accompanying materials | |
| 4 | * are made available under no term at all, use it like | |
| 5 | * you want, but share and discuss it | |
| 6 | * every time possible with every body. | |
| 7 | * | |
| 8 | * Contributors: | |
| 9 | * ron190 at ymail dot com - initial implementation | |
| 10 | ******************************************************************************/ | |
| 11 | package com.jsql.view.swing.manager; | |
| 12 | ||
| 13 | import com.formdev.flatlaf.util.SystemFileChooser; | |
| 14 | import com.jsql.model.accessible.ExploitMode; | |
| 15 | import com.jsql.model.exception.JSqlException; | |
| 16 | import com.jsql.model.injection.vendor.model.Vendor; | |
| 17 | import com.jsql.util.I18nUtil; | |
| 18 | import com.jsql.util.LogLevelUtil; | |
| 19 | import com.jsql.view.swing.manager.util.*; | |
| 20 | import com.jsql.view.swing.text.JPasswordFieldPlaceholder; | |
| 21 | import com.jsql.view.swing.text.JPopupTextField; | |
| 22 | import com.jsql.view.swing.text.JTextFieldPlaceholder; | |
| 23 | import com.jsql.view.swing.text.JToolTipI18n; | |
| 24 | import com.jsql.view.swing.util.I18nViewUtil; | |
| 25 | import com.jsql.view.swing.util.MediatorHelper; | |
| 26 | import org.apache.commons.lang3.StringUtils; | |
| 27 | import org.apache.logging.log4j.LogManager; | |
| 28 | import org.apache.logging.log4j.Logger; | |
| 29 | ||
| 30 | import javax.swing.*; | |
| 31 | import java.awt.*; | |
| 32 | import java.awt.event.ActionEvent; | |
| 33 | import java.awt.event.ActionListener; | |
| 34 | import java.awt.event.ItemEvent; | |
| 35 | import java.awt.event.ItemListener; | |
| 36 | import java.io.File; | |
| 37 | import java.net.URI; | |
| 38 | import java.net.URISyntaxException; | |
| 39 | import java.util.Arrays; | |
| 40 | import java.util.List; | |
| 41 | import java.util.Objects; | |
| 42 | import java.util.concurrent.atomic.AtomicReference; | |
| 43 | ||
| 44 | /** | |
| 45 | * Manager for uploading PHP SQL shell to the host and send queries. | |
| 46 | */ | |
| 47 | public class ManagerExploit extends AbstractManagerList { | |
| 48 | ||
| 49 | private static final Logger LOGGER = LogManager.getRootLogger(); | |
| 50 | public static final String SHELL_URL_TOOLTIP = "SHELL_URL_TOOLTIP"; | |
| 51 | ||
| 52 | private final AtomicReference<JTextField> username = new AtomicReference<>(); | |
| 53 | private final AtomicReference<JTextField> password = new AtomicReference<>(); | |
| 54 | private final AtomicReference<JTextField> netshare = new AtomicReference<>(); | |
| 55 | protected final JTextField textfieldUrlShell; | |
| 56 | ||
| 57 | public static final String EXPLOIT_UDF = "EXPLOIT_UDF"; | |
| 58 | public static final String EXPLOIT_WEB = "EXPLOIT_WEB"; | |
| 59 | public static final String EXPLOIT_SQL = "EXPLOIT_SQL"; | |
| 60 | public static final String EXPLOIT_UPLOAD = "EXPLOIT_UPLOAD"; | |
| 61 | ||
| 62 | private final JComboBox<Object> comboBoxExploitTypes = new JComboBox<>(new Object[]{ | |
| 63 | new ModelItemType(ManagerExploit.EXPLOIT_UDF, "EXPLOIT_UDF_TOOLTIP"), | |
| 64 | ComboBoxMethodRenderer.SEPARATOR, | |
| 65 | new ModelItemType(ManagerExploit.EXPLOIT_WEB, "EXPLOIT_WEB_TOOLTIP"), | |
| 66 | new ModelItemType(ManagerExploit.EXPLOIT_SQL, "EXPLOIT_SQL_TOOLTIP"), | |
| 67 | new ModelItemType(ManagerExploit.EXPLOIT_UPLOAD, "EXPLOIT_UPLOAD_TOOLTIP"), | |
| 68 | }); | |
| 69 | ||
| 70 | private final JComboBox<Object> comboBoxExploitModes = new JComboBox<>(new Object[]{ | |
| 71 | ExploitMode.AUTO, | |
| 72 | ComboBoxMethodRenderer.SEPARATOR, | |
| 73 | ExploitMode.QUERY_BODY, | |
| 74 | ExploitMode.TEMP_TABLE, | |
| 75 | ComboBoxMethodRenderer.SEPARATOR, | |
| 76 | ExploitMode.NETSHARE | |
| 77 | }); | |
| 78 | ||
| 79 | public ManagerExploit() { | |
| 80 | super("swing/list/payload.txt"); | |
| 81 | ||
| 82 | var tooltipShellUrl = new AtomicReference<>(new JToolTipI18n(I18nUtil.valueByKey(ManagerExploit.SHELL_URL_TOOLTIP))); | |
| 83 | var placeholderResult = new JTextFieldPlaceholder(I18nUtil.valueByKey("SHELL_URL_LABEL")) { | |
| 84 | @Override | |
| 85 | public JToolTip createToolTip() { | |
| 86 |
1
1. createToolTip : replaced return value with null for com/jsql/view/swing/manager/ManagerExploit$1::createToolTip → NO_COVERAGE |
return tooltipShellUrl.get(); |
| 87 | } | |
| 88 | }; | |
| 89 | this.textfieldUrlShell = new JPopupTextField(placeholderResult).getProxy(); | |
| 90 |
1
1. <init> : removed call to com/jsql/view/swing/util/I18nViewUtil::addComponentForKey → NO_COVERAGE |
I18nViewUtil.addComponentForKey("SHELL_URL_LABEL", this.textfieldUrlShell); |
| 91 |
1
1. <init> : removed call to com/jsql/view/swing/util/I18nViewUtil::addComponentForKey → NO_COVERAGE |
I18nViewUtil.addComponentForKey(ManagerExploit.SHELL_URL_TOOLTIP, tooltipShellUrl.get()); |
| 92 |
1
1. <init> : removed call to javax/swing/JTextField::setToolTipText → NO_COVERAGE |
this.textfieldUrlShell.setToolTipText(I18nUtil.valueByKey(ManagerExploit.SHELL_URL_TOOLTIP)); |
| 93 | ||
| 94 |
1
1. <init> : removed call to com/jsql/view/swing/manager/ManagerExploit::buildRunButton → NO_COVERAGE |
this.buildRunButton("SHELL_RUN_BUTTON_LABEL", "SHELL_RUN_BUTTON_TOOLTIP"); |
| 95 |
1
1. <init> : removed call to com/jsql/view/swing/manager/util/JButtonStateful::setEnabled → NO_COVERAGE |
this.run.setEnabled(false); |
| 96 |
1
1. <init> : removed call to com/jsql/view/swing/manager/ManagerExploit::buildPrivilege → NO_COVERAGE |
this.buildPrivilege(); |
| 97 | ||
| 98 | var southPanel = new JPanel(); | |
| 99 |
1
1. <init> : removed call to javax/swing/JPanel::setLayout → NO_COVERAGE |
southPanel.setLayout(new BoxLayout(southPanel, BoxLayout.Y_AXIS)); |
| 100 | southPanel.add(this.textfieldUrlShell); | |
| 101 | southPanel.add(this.lastLine); | |
| 102 |
1
1. <init> : removed call to com/jsql/view/swing/manager/ManagerExploit::add → NO_COVERAGE |
this.add(southPanel, BorderLayout.SOUTH); |
| 103 | ||
| 104 | var userPassPanel = new JPanel(); | |
| 105 | var groupLayout = new GroupLayout(userPassPanel); | |
| 106 |
1
1. <init> : removed call to javax/swing/JPanel::setLayout → NO_COVERAGE |
userPassPanel.setLayout(groupLayout); |
| 107 | ||
| 108 |
1
1. <init> : removed call to com/jsql/view/swing/manager/util/JButtonStateful::addActionListener → NO_COVERAGE |
this.run.addActionListener(new ActionExploit(this.comboBoxExploitTypes)); |
| 109 | ||
| 110 | Arrays.asList( | |
| 111 | new ModelExploit(this.netshare, "EXPLOIT_NETSHARE_LABEL", "EXPLOIT_NETSHARE_TOOLTIP"), | |
| 112 | new ModelExploit(this.username, "SQL_SHELL_USERNAME_LABEL", "SQL_SHELL_USERNAME_TOOLTIP"), | |
| 113 | new ModelExploit(this.password, "SQL_SHELL_PASSWORD_LABEL", "SQL_SHELL_PASSWORD_TOOLTIP", true) | |
| 114 |
1
1. <init> : removed call to java/util/List::forEach → NO_COVERAGE |
).forEach(model -> { |
| 115 | var tooltip = new AtomicReference<>(new JToolTipI18n(I18nUtil.valueByKey(model.tooltipI18n))); | |
| 116 |
1
1. lambda$new$0 : negated conditional → NO_COVERAGE |
if (model.isPassword) { |
| 117 |
1
1. lambda$new$0 : removed call to java/util/concurrent/atomic/AtomicReference::set → NO_COVERAGE |
model.textfield.set(new JPopupTextField(new JPasswordFieldPlaceholder(I18nUtil.valueByKey(model.labelI18n)) { |
| 118 | @Override | |
| 119 | public JToolTip createToolTip() { | |
| 120 |
1
1. createToolTip : replaced return value with null for com/jsql/view/swing/manager/ManagerExploit$2::createToolTip → NO_COVERAGE |
return tooltip.get(); |
| 121 | } | |
| 122 | }).getProxy()); | |
| 123 | } else { | |
| 124 |
1
1. lambda$new$0 : removed call to java/util/concurrent/atomic/AtomicReference::set → NO_COVERAGE |
model.textfield.set(new JPopupTextField(new JTextFieldPlaceholder(I18nUtil.valueByKey(model.labelI18n)) { |
| 125 | @Override | |
| 126 | public JToolTip createToolTip() { | |
| 127 |
1
1. createToolTip : replaced return value with null for com/jsql/view/swing/manager/ManagerExploit$3::createToolTip → NO_COVERAGE |
return tooltip.get(); |
| 128 | } | |
| 129 | }).getProxy()); | |
| 130 | } | |
| 131 |
1
1. lambda$new$0 : removed call to com/jsql/view/swing/util/I18nViewUtil::addComponentForKey → NO_COVERAGE |
I18nViewUtil.addComponentForKey(model.labelI18n, model.textfield.get()); |
| 132 |
1
1. lambda$new$0 : removed call to com/jsql/view/swing/util/I18nViewUtil::addComponentForKey → NO_COVERAGE |
I18nViewUtil.addComponentForKey(model.tooltipI18n, tooltip.get()); |
| 133 |
1
1. lambda$new$0 : removed call to javax/swing/JTextField::setToolTipText → NO_COVERAGE |
model.textfield.get().setToolTipText(I18nUtil.valueByKey(model.tooltipI18n)); |
| 134 | }); | |
| 135 | ||
| 136 | Arrays.asList(this.username.get(), this.password.get(), this.scrollListPaths, this.textfieldUrlShell, this.netshare.get()) | |
| 137 |
2
1. <init> : removed call to java/util/List::forEach → NO_COVERAGE 2. lambda$new$1 : removed call to javax/swing/JComponent::setVisible → NO_COVERAGE |
.forEach(component -> component.setVisible(false)); |
| 138 | ||
| 139 |
1
1. <init> : removed call to javax/swing/JComboBox::setRenderer → NO_COVERAGE |
this.comboBoxExploitTypes.setRenderer(new ComboBoxTypeRenderer()); |
| 140 |
1
1. <init> : removed call to javax/swing/JComboBox::addActionListener → NO_COVERAGE |
this.comboBoxExploitTypes.addActionListener(new SeparatorListener(this.comboBoxExploitTypes)); |
| 141 |
1
1. <init> : removed call to javax/swing/JComboBox::addItemListener → NO_COVERAGE |
this.comboBoxExploitTypes.addItemListener(this.getTypesItemListener()); |
| 142 |
1
1. <init> : removed call to javax/swing/JComboBox::addItemListener → NO_COVERAGE |
this.comboBoxExploitModes.addItemListener(this.getModesItemListener()); |
| 143 | ||
| 144 |
1
1. <init> : removed call to javax/swing/JComboBox::setRenderer → NO_COVERAGE |
this.comboBoxExploitModes.setRenderer(new ComboBoxMethodRenderer()); |
| 145 |
1
1. <init> : removed call to javax/swing/JComboBox::addActionListener → NO_COVERAGE |
this.comboBoxExploitModes.addActionListener(new SeparatorListener(this.comboBoxExploitModes)); |
| 146 | var labelUsing = new JLabel("via"); | |
| 147 |
1
1. <init> : removed call to javax/swing/JLabel::setBorder → NO_COVERAGE |
labelUsing.setBorder(BorderFactory.createEmptyBorder(5, 0, 5, 0)); |
| 148 |
1
1. <init> : removed call to javax/swing/GroupLayout::setHorizontalGroup → NO_COVERAGE |
groupLayout.setHorizontalGroup( |
| 149 | groupLayout | |
| 150 | .createParallelGroup() | |
| 151 | .addGroup( | |
| 152 | groupLayout | |
| 153 | .createSequentialGroup() | |
| 154 | .addComponent(this.comboBoxExploitTypes) | |
| 155 | .addComponent(labelUsing, GroupLayout.PREFERRED_SIZE, GroupLayout.PREFERRED_SIZE, GroupLayout.PREFERRED_SIZE) | |
| 156 | .addComponent(this.comboBoxExploitModes, GroupLayout.PREFERRED_SIZE, GroupLayout.PREFERRED_SIZE, GroupLayout.PREFERRED_SIZE) | |
| 157 | ) | |
| 158 | .addGroup( | |
| 159 | groupLayout.createParallelGroup() | |
| 160 | .addComponent(this.netshare.get()) | |
| 161 | .addComponent(this.username.get()) | |
| 162 | .addComponent(this.password.get()) | |
| 163 | ) | |
| 164 | ); | |
| 165 | ||
| 166 |
1
1. <init> : removed call to javax/swing/GroupLayout::setVerticalGroup → NO_COVERAGE |
groupLayout.setVerticalGroup( |
| 167 | groupLayout | |
| 168 | .createSequentialGroup() | |
| 169 | .addGroup( | |
| 170 | groupLayout | |
| 171 | .createParallelGroup(GroupLayout.Alignment.BASELINE) | |
| 172 | .addComponent(this.comboBoxExploitTypes) | |
| 173 | .addComponent(labelUsing) | |
| 174 | .addComponent(this.comboBoxExploitModes) | |
| 175 | ) | |
| 176 | .addGroup( | |
| 177 | groupLayout | |
| 178 | .createParallelGroup() | |
| 179 | .addComponent(this.netshare.get()) | |
| 180 | ) | |
| 181 | .addGroup( | |
| 182 | groupLayout | |
| 183 | .createParallelGroup() | |
| 184 | .addComponent(this.username.get()) | |
| 185 | ) | |
| 186 | .addGroup( | |
| 187 | groupLayout | |
| 188 | .createParallelGroup() | |
| 189 | .addComponent(this.password.get()) | |
| 190 | ) | |
| 191 | ); | |
| 192 | | |
| 193 |
1
1. <init> : removed call to com/jsql/view/swing/manager/ManagerExploit::add → NO_COVERAGE |
this.add(userPassPanel, BorderLayout.NORTH); |
| 194 | } | |
| 195 | ||
| 196 | private ItemListener getModesItemListener() { | |
| 197 |
1
1. getModesItemListener : replaced return value with null for com/jsql/view/swing/manager/ManagerExploit::getModesItemListener → NO_COVERAGE |
return itemEvent -> { |
| 198 |
2
1. lambda$getModesItemListener$2 : negated conditional → NO_COVERAGE 2. lambda$getModesItemListener$2 : negated conditional → NO_COVERAGE |
if (itemEvent.getStateChange() == ItemEvent.SELECTED && itemEvent.getItem() instanceof ExploitMode) { |
| 199 | ExploitMode selectedItem = (ExploitMode) itemEvent.getItem(); | |
| 200 |
1
1. lambda$getModesItemListener$2 : removed call to javax/swing/JTextField::setVisible → NO_COVERAGE |
this.netshare.get().setVisible(false); |
| 201 |
1
1. lambda$getModesItemListener$2 : negated conditional → NO_COVERAGE |
if (selectedItem.equals(ExploitMode.NETSHARE)) { |
| 202 |
1
1. lambda$getModesItemListener$2 : removed call to javax/swing/JTextField::setVisible → NO_COVERAGE |
this.netshare.get().setVisible(true); |
| 203 | } | |
| 204 |
1
1. lambda$getModesItemListener$2 : removed call to com/jsql/view/swing/manager/ManagerExploit::updateUI → NO_COVERAGE |
this.updateUI(); // required to adapt panel |
| 205 | } | |
| 206 | }; | |
| 207 | } | |
| 208 | ||
| 209 | private ItemListener getTypesItemListener() { | |
| 210 |
1
1. getTypesItemListener : replaced return value with null for com/jsql/view/swing/manager/ManagerExploit::getTypesItemListener → NO_COVERAGE |
return itemEvent -> { |
| 211 |
2
1. lambda$getTypesItemListener$4 : negated conditional → NO_COVERAGE 2. lambda$getTypesItemListener$4 : negated conditional → NO_COVERAGE |
if (itemEvent.getStateChange() != ItemEvent.SELECTED || itemEvent.getItem() == ComboBoxMethodRenderer.SEPARATOR) { |
| 212 | return; | |
| 213 | } | |
| 214 | Arrays.asList( | |
| 215 | this.username.get(), this.password.get(), this.scrollListPaths, this.textfieldUrlShell | |
| 216 |
2
1. lambda$getTypesItemListener$4 : removed call to java/util/List::forEach → NO_COVERAGE 2. lambda$getTypesItemListener$3 : removed call to javax/swing/JComponent::setVisible → NO_COVERAGE |
).forEach(component -> component.setVisible(false)); |
| 217 | ModelItemType selectedItem = (ModelItemType) itemEvent.getItem(); | |
| 218 |
1
1. lambda$getTypesItemListener$4 : negated conditional → NO_COVERAGE |
if (!ManagerExploit.EXPLOIT_UDF.equals(selectedItem.getKeyLabel())) { |
| 219 |
1
1. lambda$getTypesItemListener$4 : removed call to javax/swing/JScrollPane::setVisible → NO_COVERAGE |
this.scrollListPaths.setVisible(true); |
| 220 |
1
1. lambda$getTypesItemListener$4 : removed call to javax/swing/JTextField::setVisible → NO_COVERAGE |
this.textfieldUrlShell.setVisible(true); |
| 221 |
1
1. lambda$getTypesItemListener$4 : negated conditional → NO_COVERAGE |
if (ManagerExploit.EXPLOIT_SQL.equals(selectedItem.getKeyLabel())) { |
| 222 |
1
1. lambda$getTypesItemListener$4 : removed call to javax/swing/JTextField::setVisible → NO_COVERAGE |
this.username.get().setVisible(true); |
| 223 |
1
1. lambda$getTypesItemListener$4 : removed call to javax/swing/JTextField::setVisible → NO_COVERAGE |
this.password.get().setVisible(true); |
| 224 | } | |
| 225 | } | |
| 226 |
1
1. lambda$getTypesItemListener$4 : removed call to com/jsql/view/swing/manager/ManagerExploit::updateUI → NO_COVERAGE |
this.updateUI(); // required to adapt panel |
| 227 | }; | |
| 228 | } | |
| 229 | ||
| 230 | protected class ActionExploit implements ActionListener { | |
| 231 | private final JComboBox<Object> comboBoxExploitTypes; | |
| 232 | ||
| 233 | public ActionExploit(JComboBox<Object> comboBoxExploitTypes) { | |
| 234 | this.comboBoxExploitTypes = comboBoxExploitTypes; | |
| 235 | } | |
| 236 | ||
| 237 | @Override | |
| 238 | public void actionPerformed(ActionEvent evt) { | |
| 239 | var modelSelectItem = (ModelItemType) this.comboBoxExploitTypes.getSelectedItem(); | |
| 240 | var labelSelectItem = Objects.requireNonNull(modelSelectItem).getKeyLabel(); | |
| 241 |
1
1. actionPerformed : negated conditional → NO_COVERAGE |
if (!ManagerExploit.isValid(labelSelectItem)) { |
| 242 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Currently unsupported for [{}], contribute and share exploit method on GitHub to improve the app", MediatorHelper.model().getMediatorVendor().getVendor()); | |
| 243 | return; | |
| 244 | } | |
| 245 |
1
1. actionPerformed : negated conditional → NO_COVERAGE |
if (ManagerExploit.EXPLOIT_UDF.equals(labelSelectItem)) { |
| 246 | new SwingWorker<>() { | |
| 247 | @Override | |
| 248 |
1
1. doInBackground : removed call to java/lang/Thread::setName → NO_COVERAGE |
protected Object doInBackground() { Thread.currentThread().setName("SwingWorkerExploit"); |
| 249 |
1
1. doInBackground : removed call to com/jsql/view/swing/manager/ManagerExploit$ActionExploit::start → NO_COVERAGE |
ActionExploit.this.start(null, null, null); |
| 250 | return null; | |
| 251 | } | |
| 252 |
1
1. actionPerformed : removed call to com/jsql/view/swing/manager/ManagerExploit$ActionExploit$1::execute → NO_COVERAGE |
}.execute(); |
| 253 | return; | |
| 254 | } | |
| 255 | if ( | |
| 256 |
1
1. actionPerformed : negated conditional → NO_COVERAGE |
ManagerExploit.EXPLOIT_SQL.equals(labelSelectItem) |
| 257 |
2
1. actionPerformed : negated conditional → NO_COVERAGE 2. actionPerformed : negated conditional → NO_COVERAGE |
&& (ManagerExploit.this.password.get().getText().isEmpty() || ManagerExploit.this.username.get().getText().isEmpty()) |
| 258 | ) { | |
| 259 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Missing credentials (tips: search and read file containing hardcoded credentials)"); | |
| 260 | return; | |
| 261 | } | |
| 262 |
1
1. actionPerformed : negated conditional → NO_COVERAGE |
if (ManagerExploit.this.listPaths.getSelectedValuesList().isEmpty()) { |
| 263 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Select at least one directory in the list"); | |
| 264 | return; | |
| 265 | } | |
| 266 | ||
| 267 | String urlShell = this.validateAndNormalizeUrlShell(); | |
| 268 |
1
1. actionPerformed : negated conditional → NO_COVERAGE |
if (urlShell == null) { |
| 269 | return; | |
| 270 | } | |
| 271 | AtomicReference<File> fileToUpload = new AtomicReference<>(); | |
| 272 |
1
1. actionPerformed : negated conditional → NO_COVERAGE |
if (this.validateFileSelection(labelSelectItem, fileToUpload)) { |
| 273 | return; | |
| 274 | } | |
| 275 | ||
| 276 | new SwingWorker<>() { | |
| 277 | @Override | |
| 278 |
1
1. doInBackground : removed call to java/lang/Thread::setName → NO_COVERAGE |
protected Object doInBackground() { Thread.currentThread().setName("SwingWorkerExploitNonUdf"); |
| 279 |
1
1. doInBackground : removed call to java/awt/Component::setVisible → NO_COVERAGE |
ManagerExploit.this.horizontalGlue.setVisible(false); |
| 280 |
1
1. doInBackground : removed call to javax/swing/JProgressBar::setVisible → NO_COVERAGE |
ManagerExploit.this.progressBar.setVisible(true); |
| 281 |
1
1. doInBackground : removed call to java/util/List::forEach → NO_COVERAGE |
ManagerExploit.this.listPaths.getSelectedValuesList().forEach(pathExploit -> { |
| 282 | LOGGER.log(LogLevelUtil.CONSOLE_DEFAULT, String.format("Checking path [%s]...", pathExploit)); | |
| 283 |
1
1. lambda$doInBackground$0 : removed call to com/jsql/view/swing/manager/ManagerExploit$ActionExploit::start → NO_COVERAGE |
ActionExploit.this.start(pathExploit.toString(), urlShell, fileToUpload.get()); |
| 284 | }); | |
| 285 |
1
1. doInBackground : removed call to com/jsql/view/swing/manager/ManagerExploit::endProcess → NO_COVERAGE |
ManagerExploit.this.endProcess(); |
| 286 | return null; | |
| 287 | } | |
| 288 |
1
1. actionPerformed : removed call to com/jsql/view/swing/manager/ManagerExploit$ActionExploit$2::execute → NO_COVERAGE |
}.execute(); |
| 289 | } | |
| 290 | ||
| 291 | private boolean validateFileSelection(String labelSelectItem, AtomicReference<File> fileToUpload) { | |
| 292 |
1
1. validateFileSelection : negated conditional → NO_COVERAGE |
if (ManagerExploit.EXPLOIT_UPLOAD.equals(labelSelectItem)) { |
| 293 |
1
1. validateFileSelection : removed call to java/util/concurrent/atomic/AtomicReference::set → NO_COVERAGE |
fileToUpload.set(ManagerExploit.chooseFile()); |
| 294 |
1
1. validateFileSelection : negated conditional → NO_COVERAGE |
if (fileToUpload.get() == null) { |
| 295 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Missing file, upload cancelled"); | |
| 296 |
1
1. validateFileSelection : replaced boolean return with false for com/jsql/view/swing/manager/ManagerExploit$ActionExploit::validateFileSelection → NO_COVERAGE |
return true; |
| 297 | } | |
| 298 | } | |
| 299 |
1
1. validateFileSelection : replaced boolean return with true for com/jsql/view/swing/manager/ManagerExploit$ActionExploit::validateFileSelection → NO_COVERAGE |
return false; |
| 300 | } | |
| 301 | ||
| 302 | private String validateAndNormalizeUrlShell() { | |
| 303 | String urlShell = ManagerExploit.this.textfieldUrlShell.getText(); | |
| 304 |
2
1. validateAndNormalizeUrlShell : negated conditional → NO_COVERAGE 2. validateAndNormalizeUrlShell : negated conditional → NO_COVERAGE |
if (!urlShell.isEmpty() && !urlShell.matches("(?i)^https?://.*")) { |
| 305 |
1
1. validateAndNormalizeUrlShell : negated conditional → NO_COVERAGE |
if (!urlShell.matches("(?i)^\\w+://.*")) { |
| 306 | LOGGER.log(LogLevelUtil.CONSOLE_INFORM, "Undefined shell URL protocol, forcing to [https://]"); | |
| 307 | urlShell = "https://"+ urlShell; | |
| 308 | } else { | |
| 309 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Unknown URL protocol"); | |
| 310 |
1
1. validateAndNormalizeUrlShell : replaced return value with "" for com/jsql/view/swing/manager/ManagerExploit$ActionExploit::validateAndNormalizeUrlShell → NO_COVERAGE |
return null; |
| 311 | } | |
| 312 | } | |
| 313 |
1
1. validateAndNormalizeUrlShell : negated conditional → NO_COVERAGE |
if (StringUtils.isNotEmpty(urlShell)) { |
| 314 | try { | |
| 315 | new URI(urlShell); | |
| 316 | } catch (URISyntaxException e) { | |
| 317 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, String.format("Incorrect URL: %s", e.getMessage())); | |
| 318 |
1
1. validateAndNormalizeUrlShell : replaced return value with "" for com/jsql/view/swing/manager/ManagerExploit$ActionExploit::validateAndNormalizeUrlShell → NO_COVERAGE |
return null; |
| 319 | } | |
| 320 | } | |
| 321 |
1
1. validateAndNormalizeUrlShell : replaced return value with "" for com/jsql/view/swing/manager/ManagerExploit$ActionExploit::validateAndNormalizeUrlShell → NO_COVERAGE |
return urlShell; |
| 322 | } | |
| 323 | ||
| 324 | private void start(String pathExploit, String urlShellFinal, File fileToUpload) { | |
| 325 | try { | |
| 326 |
1
1. start : removed call to com/jsql/view/swing/manager/ManagerExploit::createPayload → NO_COVERAGE |
ManagerExploit.this.createPayload(pathExploit, urlShellFinal, fileToUpload); |
| 327 | } catch (JSqlException | IllegalArgumentException e) { | |
| 328 | LOGGER.log(LogLevelUtil.CONSOLE_ERROR, String.format("Payload creation failure: %s", e.getMessage())); | |
| 329 | } | |
| 330 | } | |
| 331 | } | |
| 332 | ||
| 333 | private static boolean isValid(String labelSelectItem) { | |
| 334 |
1
1. isValid : replaced boolean return with true for com/jsql/view/swing/manager/ManagerExploit::isValid → NO_COVERAGE |
return |
| 335 |
1
1. isValid : negated conditional → NO_COVERAGE |
ManagerExploit.EXPLOIT_UDF.equals(labelSelectItem) && Arrays.asList( |
| 336 | MediatorHelper.model().getMediatorVendor().getSqlite(), | |
| 337 | MediatorHelper.model().getMediatorVendor().getMysql(), | |
| 338 | MediatorHelper.model().getMediatorVendor().getPostgres(), | |
| 339 | MediatorHelper.model().getMediatorVendor().getH2() | |
| 340 |
1
1. isValid : negated conditional → NO_COVERAGE |
).contains(MediatorHelper.model().getMediatorVendor().getVendor()) |
| 341 |
1
1. isValid : negated conditional → NO_COVERAGE |
|| Arrays.asList(ManagerExploit.EXPLOIT_WEB, ManagerExploit.EXPLOIT_UPLOAD).contains(labelSelectItem) && Arrays.asList( |
| 342 | MediatorHelper.model().getMediatorVendor().getDerby(), | |
| 343 | MediatorHelper.model().getMediatorVendor().getHsqldb(), | |
| 344 | MediatorHelper.model().getMediatorVendor().getH2(), | |
| 345 | MediatorHelper.model().getMediatorVendor().getSqlite(), | |
| 346 | MediatorHelper.model().getMediatorVendor().getMysql(), | |
| 347 | MediatorHelper.model().getMediatorVendor().getPostgres() | |
| 348 |
1
1. isValid : negated conditional → NO_COVERAGE |
).contains(MediatorHelper.model().getMediatorVendor().getVendor()) |
| 349 |
1
1. isValid : negated conditional → NO_COVERAGE |
|| List.of(ManagerExploit.EXPLOIT_SQL).contains(labelSelectItem) && Arrays.asList( |
| 350 | MediatorHelper.model().getMediatorVendor().getMysql(), | |
| 351 | MediatorHelper.model().getMediatorVendor().getPostgres() | |
| 352 |
1
1. isValid : negated conditional → NO_COVERAGE |
).contains(MediatorHelper.model().getMediatorVendor().getVendor()); |
| 353 | } | |
| 354 | ||
| 355 | private static File chooseFile() { | |
| 356 | var filechooser = new SystemFileChooser(MediatorHelper.model().getMediatorUtils().getPreferencesUtil().getPathFile()); | |
| 357 |
1
1. chooseFile : removed call to com/formdev/flatlaf/util/SystemFileChooser::setDialogTitle → NO_COVERAGE |
filechooser.setDialogTitle(I18nUtil.valueByKey("UPLOAD_DIALOG_TEXT")); |
| 358 | int returnVal = filechooser.showOpenDialog(MediatorHelper.frame()); | |
| 359 |
1
1. chooseFile : negated conditional → NO_COVERAGE |
if (returnVal == JFileChooser.APPROVE_OPTION) { |
| 360 |
1
1. chooseFile : replaced return value with null for com/jsql/view/swing/manager/ManagerExploit::chooseFile → NO_COVERAGE |
return filechooser.getSelectedFile(); |
| 361 | } | |
| 362 | return null; | |
| 363 | } | |
| 364 | ||
| 365 | protected void createPayload(String pathExploit, String urlShell, File fileToUpload) throws JSqlException { | |
| 366 | var exploitMethod = ExploitMode.forName( | |
| 367 | Objects.requireNonNull(this.comboBoxExploitModes.getSelectedItem()).toString() | |
| 368 | ).orElse(ExploitMode.AUTO); | |
| 369 | ||
| 370 | String pathExploitFixed = pathExploit; | |
| 371 |
2
1. createPayload : negated conditional → NO_COVERAGE 2. createPayload : negated conditional → NO_COVERAGE |
if (pathExploitFixed != null && !pathExploitFixed.endsWith("/")) { |
| 372 | pathExploitFixed += "/"; | |
| 373 | } | |
| 374 | String pathNetshare = this.netshare.get().getText(); | |
| 375 |
2
1. createPayload : negated conditional → NO_COVERAGE 2. createPayload : negated conditional → NO_COVERAGE |
if (exploitMethod == ExploitMode.NETSHARE && !pathNetshare.endsWith("\\")) { |
| 376 | pathNetshare += "\\"; | |
| 377 | } | |
| 378 | ||
| 379 | var modelItemType = (ModelItemType) Objects.requireNonNull(this.comboBoxExploitTypes.getSelectedItem()); | |
| 380 | var keyLabel = modelItemType.getKeyLabel(); | |
| 381 | var vendor = MediatorHelper.model().getMediatorVendor().getVendor(); | |
| 382 | ||
| 383 |
1
1. createPayload : negated conditional → NO_COVERAGE |
if (ManagerExploit.EXPLOIT_UDF.equals(keyLabel)) { |
| 384 |
1
1. createPayload : removed call to com/jsql/view/swing/manager/ManagerExploit::handleUdfExploit → NO_COVERAGE |
ManagerExploit.handleUdfExploit(vendor, pathNetshare, exploitMethod); |
| 385 |
1
1. createPayload : negated conditional → NO_COVERAGE |
} else if (ManagerExploit.EXPLOIT_WEB.equals(keyLabel)) { |
| 386 |
1
1. createPayload : removed call to com/jsql/view/swing/manager/ManagerExploit::handleWebExploit → NO_COVERAGE |
ManagerExploit.handleWebExploit(pathExploitFixed, urlShell, vendor, pathNetshare, exploitMethod); |
| 387 |
1
1. createPayload : negated conditional → NO_COVERAGE |
} else if (ManagerExploit.EXPLOIT_SQL.equals(keyLabel)) { |
| 388 |
1
1. createPayload : removed call to com/jsql/view/swing/manager/ManagerExploit::handleSqlExploit → NO_COVERAGE |
this.handleSqlExploit(pathExploitFixed, urlShell, vendor, pathNetshare, exploitMethod); |
| 389 |
1
1. createPayload : negated conditional → NO_COVERAGE |
} else if (ManagerExploit.EXPLOIT_UPLOAD.equals(keyLabel)) { |
| 390 |
1
1. createPayload : removed call to com/jsql/view/swing/manager/ManagerExploit::handleUploadExploit → NO_COVERAGE |
ManagerExploit.handleUploadExploit(pathExploitFixed, urlShell, fileToUpload, vendor, pathNetshare, exploitMethod); |
| 391 | } | |
| 392 | } | |
| 393 | ||
| 394 | private static void handleUdfExploit(Vendor vendor, String pathNetshare, ExploitMode exploitMethod) throws JSqlException { | |
| 395 |
1
1. handleUdfExploit : negated conditional → NO_COVERAGE |
if (vendor == MediatorHelper.model().getMediatorVendor().getMysql()) { |
| 396 |
1
1. handleUdfExploit : removed call to com/jsql/model/accessible/vendor/ExploitMysql::createUdf → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitMysql().createUdf(pathNetshare, exploitMethod); |
| 397 |
1
1. handleUdfExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getPostgres()) { |
| 398 |
1
1. handleUdfExploit : removed call to com/jsql/model/accessible/vendor/ExploitPostgres::createUdf → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitPostgres().createUdf(null); |
| 399 |
1
1. handleUdfExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getSqlite()) { |
| 400 |
1
1. handleUdfExploit : removed call to com/jsql/model/accessible/vendor/ExploitSqlite::createUdf → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitSqlite().createUdf(); |
| 401 |
1
1. handleUdfExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getH2()) { |
| 402 |
1
1. handleUdfExploit : removed call to com/jsql/model/accessible/vendor/ExploitH2::createUdf → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitH2().createUdf(); |
| 403 | } | |
| 404 | } | |
| 405 | ||
| 406 | private static void handleWebExploit(String pathExploit, String urlShell, Vendor vendor, String pathNetshare, ExploitMode exploitMethod) throws JSqlException { | |
| 407 |
1
1. handleWebExploit : negated conditional → NO_COVERAGE |
if (vendor == MediatorHelper.model().getMediatorVendor().getMysql()) { |
| 408 | MediatorHelper.model().getResourceAccess().getExploitMysql().createWeb(pathExploit, urlShell, pathNetshare, exploitMethod); | |
| 409 |
1
1. handleWebExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getPostgres()) { |
| 410 | MediatorHelper.model().getResourceAccess().getExploitPostgres().createWeb(pathExploit, urlShell); | |
| 411 |
1
1. handleWebExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getSqlite()) { |
| 412 | MediatorHelper.model().getResourceAccess().getExploitSqlite().createWeb(pathExploit, urlShell); | |
| 413 |
1
1. handleWebExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getHsqldb()) { |
| 414 | MediatorHelper.model().getResourceAccess().getExploitHsqldb().createWeb(pathExploit, urlShell); | |
| 415 |
1
1. handleWebExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getH2()) { |
| 416 | MediatorHelper.model().getResourceAccess().getExploitH2().createWeb(pathExploit, urlShell); | |
| 417 |
1
1. handleWebExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getDerby()) { |
| 418 | MediatorHelper.model().getResourceAccess().getExploitDerby().createWeb(pathExploit, urlShell); | |
| 419 | } | |
| 420 | } | |
| 421 | ||
| 422 | private void handleSqlExploit(String pathExploit, String urlShell, Vendor vendor, String pathNetshare, ExploitMode exploitMethod) throws JSqlException { | |
| 423 | String login = this.username.get().getText(); | |
| 424 | String pass = this.password.get().getText(); | |
| 425 |
1
1. handleSqlExploit : negated conditional → NO_COVERAGE |
if (vendor == MediatorHelper.model().getMediatorVendor().getMysql()) { |
| 426 | MediatorHelper.model().getResourceAccess().getExploitMysql().createSql(pathExploit, urlShell, pathNetshare, exploitMethod, login, pass); | |
| 427 |
1
1. handleSqlExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getPostgres()) { |
| 428 | MediatorHelper.model().getResourceAccess().getExploitPostgres().createSql(pathExploit, urlShell, login, pass); | |
| 429 | } | |
| 430 | } | |
| 431 | ||
| 432 | private static void handleUploadExploit(String pathExploit, String urlShell, File fileToUpload, Vendor vendor, String pathNetshare, ExploitMode exploitMethod) throws JSqlException { | |
| 433 |
1
1. handleUploadExploit : negated conditional → NO_COVERAGE |
if (vendor == MediatorHelper.model().getMediatorVendor().getMysql()) { |
| 434 |
1
1. handleUploadExploit : removed call to com/jsql/model/accessible/vendor/ExploitMysql::createUpload → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitMysql().createUpload(pathExploit, urlShell, pathNetshare, exploitMethod, fileToUpload); |
| 435 |
1
1. handleUploadExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getPostgres()) { |
| 436 |
1
1. handleUploadExploit : removed call to com/jsql/model/accessible/vendor/ExploitPostgres::createUpload → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitPostgres().createUpload(pathExploit, urlShell, fileToUpload); |
| 437 |
1
1. handleUploadExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getSqlite()) { |
| 438 |
1
1. handleUploadExploit : removed call to com/jsql/model/accessible/vendor/ExploitSqlite::createUpload → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitSqlite().createUpload(pathExploit, urlShell, fileToUpload); |
| 439 |
1
1. handleUploadExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getHsqldb()) { |
| 440 |
1
1. handleUploadExploit : removed call to com/jsql/model/accessible/vendor/ExploitHsqldb::createUpload → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitHsqldb().createUpload(pathExploit, urlShell, fileToUpload); |
| 441 |
1
1. handleUploadExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getH2()) { |
| 442 |
1
1. handleUploadExploit : removed call to com/jsql/model/accessible/vendor/ExploitH2::createUpload → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitH2().createUpload(pathExploit, urlShell, fileToUpload); |
| 443 |
1
1. handleUploadExploit : negated conditional → NO_COVERAGE |
} else if (vendor == MediatorHelper.model().getMediatorVendor().getDerby()) { |
| 444 |
1
1. handleUploadExploit : removed call to com/jsql/model/accessible/vendor/ExploitDerby::createUpload → NO_COVERAGE |
MediatorHelper.model().getResourceAccess().getExploitDerby().createUpload(pathExploit, urlShell, fileToUpload); |
| 445 | } | |
| 446 | } | |
| 447 | } | |
Mutations | ||
| 86 |
1.1 |
|
| 90 |
1.1 |
|
| 91 |
1.1 |
|
| 92 |
1.1 |
|
| 94 |
1.1 |
|
| 95 |
1.1 |
|
| 96 |
1.1 |
|
| 99 |
1.1 |
|
| 102 |
1.1 |
|
| 106 |
1.1 |
|
| 108 |
1.1 |
|
| 114 |
1.1 |
|
| 116 |
1.1 |
|
| 117 |
1.1 |
|
| 120 |
1.1 |
|
| 124 |
1.1 |
|
| 127 |
1.1 |
|
| 131 |
1.1 |
|
| 132 |
1.1 |
|
| 133 |
1.1 |
|
| 137 |
1.1 2.2 |
|
| 139 |
1.1 |
|
| 140 |
1.1 |
|
| 141 |
1.1 |
|
| 142 |
1.1 |
|
| 144 |
1.1 |
|
| 145 |
1.1 |
|
| 147 |
1.1 |
|
| 148 |
1.1 |
|
| 166 |
1.1 |
|
| 193 |
1.1 |
|
| 197 |
1.1 |
|
| 198 |
1.1 2.2 |
|
| 200 |
1.1 |
|
| 201 |
1.1 |
|
| 202 |
1.1 |
|
| 204 |
1.1 |
|
| 210 |
1.1 |
|
| 211 |
1.1 2.2 |
|
| 216 |
1.1 2.2 |
|
| 218 |
1.1 |
|
| 219 |
1.1 |
|
| 220 |
1.1 |
|
| 221 |
1.1 |
|
| 222 |
1.1 |
|
| 223 |
1.1 |
|
| 226 |
1.1 |
|
| 241 |
1.1 |
|
| 245 |
1.1 |
|
| 248 |
1.1 |
|
| 249 |
1.1 |
|
| 252 |
1.1 |
|
| 256 |
1.1 |
|
| 257 |
1.1 2.2 |
|
| 262 |
1.1 |
|
| 268 |
1.1 |
|
| 272 |
1.1 |
|
| 278 |
1.1 |
|
| 279 |
1.1 |
|
| 280 |
1.1 |
|
| 281 |
1.1 |
|
| 283 |
1.1 |
|
| 285 |
1.1 |
|
| 288 |
1.1 |
|
| 292 |
1.1 |
|
| 293 |
1.1 |
|
| 294 |
1.1 |
|
| 296 |
1.1 |
|
| 299 |
1.1 |
|
| 304 |
1.1 2.2 |
|
| 305 |
1.1 |
|
| 310 |
1.1 |
|
| 313 |
1.1 |
|
| 318 |
1.1 |
|
| 321 |
1.1 |
|
| 326 |
1.1 |
|
| 334 |
1.1 |
|
| 335 |
1.1 |
|
| 340 |
1.1 |
|
| 341 |
1.1 |
|
| 348 |
1.1 |
|
| 349 |
1.1 |
|
| 352 |
1.1 |
|
| 357 |
1.1 |
|
| 359 |
1.1 |
|
| 360 |
1.1 |
|
| 371 |
1.1 2.2 |
|
| 375 |
1.1 2.2 |
|
| 383 |
1.1 |
|
| 384 |
1.1 |
|
| 385 |
1.1 |
|
| 386 |
1.1 |
|
| 387 |
1.1 |
|
| 388 |
1.1 |
|
| 389 |
1.1 |
|
| 390 |
1.1 |
|
| 395 |
1.1 |
|
| 396 |
1.1 |
|
| 397 |
1.1 |
|
| 398 |
1.1 |
|
| 399 |
1.1 |
|
| 400 |
1.1 |
|
| 401 |
1.1 |
|
| 402 |
1.1 |
|
| 407 |
1.1 |
|
| 409 |
1.1 |
|
| 411 |
1.1 |
|
| 413 |
1.1 |
|
| 415 |
1.1 |
|
| 417 |
1.1 |
|
| 425 |
1.1 |
|
| 427 |
1.1 |
|
| 433 |
1.1 |
|
| 434 |
1.1 |
|
| 435 |
1.1 |
|
| 436 |
1.1 |
|
| 437 |
1.1 |
|
| 438 |
1.1 |
|
| 439 |
1.1 |
|
| 440 |
1.1 |
|
| 441 |
1.1 |
|
| 442 |
1.1 |
|
| 443 |
1.1 |
|
| 444 |
1.1 |