fastjson-local-echo

fastjson-local-echo

基于dbcp的fastjson rce 回显

参考

• http://blog.nsfocus.net/fastjson-basicdatasource-attack-chain-0521/
• https://kingx.me/Exploit-FastJson-Without-Reverse-Connect.html
• https://www.leavesongs.com/PENETRATION/where-is-bcel-classloader.html
• http://scz.617.cn:8/web/202005121629.txt

适用场景

• fastjson <= 1.2.24
• 1.2.33 <= fastjson <= 1.2.47
• jdk <= 8u251
• 存在 tomcat-dbcp

首先将SpringEcho.java 编译生成 SpringEcho.class 文件，然后用BCELEncode 对class 文件进行bcel编码

• fastjson <= 1.2.24 poc

…

• 1.2.33 <= fastjson <= 1.2.47 poc

…