Code Monkey home page Code Monkey logo

fastjson_jndi_poc's Introduction

Alibaba Fastjson 远程代码执行漏洞 JNDI POC

调试步骤:

  1. Exploit.java编译后的class文件放入resources\static目录
  2. 运行FastjsonJndiPocApplication、启动web环境,暴露http://127.0.0.1/Exploit.class
  3. 运行JNDIServer
  4. 运行SomeFastjsonAppExploit.java构造函数中的恶意代码将执行

前3步由攻击者在远程搭建、第4步为Fastjson正常使用流程,恶意代码将会在受害者本地执行。

影响:fastjson在1.2.24以及之前版本

官方通告:https://github.com/alibaba/fastjson/wiki/security_update_20170315

相关资料

基于JdbcRowSetImpl的Fastjson RCE PoC构造与分析 (影响版本1.2.24以及之前版本)

fastjson 远程反序列化poc的构造和分析 (影响版本1.2.22-1.2.24)

Fastjson Unserialize Vulnerability Write Up

fastjson 漏洞调试利用记录

fastjson_jndi_poc's People

Contributors

earayu avatar

Stargazers

 avatar  avatar tinmin avatar V1nci_lazy avatar JinLongDesigner avatar Li Ray avatar Chocolate avatar  avatar jackpot avatar  avatar 111111111111 avatar William Majanja avatar Scott Judson avatar  avatar  avatar xuewenke avatar  avatar  avatar r0fus0d avatar  avatar  avatar jax777 avatar 令狐冲 avatar  avatar  avatar Damien avatar  avatar Mr.Pder avatar python_study avatar z3r0yu avatar Wing avatar Fortune_C00kie avatar  avatar  avatar  avatar  avatar  avatar xiaowei avatar

Watchers

James Cloos avatar

fastjson_jndi_poc's Issues

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.