FASTJSON反序列化复现

最新推荐文章于 2025-03-24 22:45:05 发布

台球小王子

最新推荐文章于 2025-03-24 22:45:05 发布

阅读量1.4k

点赞数 57

CC 4.0 BY-SA版权

文章标签：网络 github

本文链接：https://blog.csdn.net/weixin_71604403/article/details/136404241

本文档详细介绍了如何复现FASTJSON的反序列化漏洞。首先，环境搭建包括在Kali Linux上配置源、安装Docker和Docker-compose。接着，通过Vulhub启动靶场环境，下载并利用marshalsec进行RMI和LDAP的漏洞复现，包括构造特定的Java类文件并执行命令，最后提到了一些工具和资源用于FASTJSON的漏洞检测。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1.环境搭建
一台kali（靶机）
一台win（攻击机）
kali换源

# 官方源
# deb http://http.kali.org/kali kali-rolling main non-free contrib
# deb-src http://http.kali.org/kali kali-rolling main non-free contrib
#根据需要自己选一个，中科大的还可以
#中科大
deb http://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
deb-src http://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
#阿里云
#deb http://mirrors.aliyun.com/kali kali-rolling main non-free contrib
#deb-src http://mirrors.aliyun.com/kali kali-rolling main non-free contrib
#清华大学
#deb http://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free
#deb-src https://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free
#浙大
#deb http://mirrors.zju.edu.cn/kali kali-rolling main contrib non-free
#deb-src http://mirrors.zju.edu.cn/kali kali-rolling main contrib non-free
#东软大学
#deb http://mirrors.neusoft.edu.cn/kali kali-rolling/main non-free contrib
#deb-src http://mirrors.neusoft.edu.cn/kali kali-rolling/main non-free contrib
#重庆大学
#deb http://http.kali.org/kali kali-rolling main non-free contrib
#deb-src http://http.kali.org/kali kali-rolling main non-free contrib