This project is for security research only. It is forbidden to use this project to launch illegal attacks. The user is responsible for any consequences.
This is a personal project for reproducing and publishing vulnerabilities that I find interesting or that have a significant impact. There isn't much technical depth to it — consider it a personal technical notebook.
fastjson
This module mainly records some fastjson exploitation gadgets, though many gadgets are not documented.
package: com.threedr3am.bug.fastjson.rce
- com.threedr3am.bug.fastjson.rce.FastjsonSerialize(TemplatesImpl) Exploitation conditions: fastjson <= 1.2.24 + Feature.SupportNonPublicField
- com.threedr3am.bug.fastjson.rce.NoNeedAutoTypePoc Exploitation conditions: fastjson < 1.2.48, no configuration required, default configuration works for universal RCE
- com.threedr3am.bug.fastjson.rce.HikariConfigPoc(HikariConfig) Exploitation conditions: fastjson <= 1.2.59 RCE, requires AutoType enabled
- com.threedr3am.bug.fastjson.rce.CommonsProxyPoc(SessionBeanProvider) Exploitation conditions: fastjson <= 1.2.61 RCE, requires AutoType enabled
- com.threedr3am.bug.fastjson.rce.JndiConverterPoc(JndiConverter) Exploitation conditions: fastjson <= 1.2.62 RCE, requires AutoType enabled
- com.threedr3am.bug.fastjson.rce.HadoopHikariPoc(HikariConfig) Exploitation conditions: fastjson <= 1.2.62 RCE, requires AutoType enabled
- com.threedr3am.bug.fastjson.rce.IbatisSqlmapPoc(JtaTransactionConfig) Exploitation conditions: fastjson <= 1.2.62 RCE, requires AutoType enabled
- com.threedr3am.bug.fastjson.rce.ShiroPoc(shiro-core) Exploitation conditions: fastjson <= 1.2.66 RCE, requires AutoType enabled
...several omitted
package: com.threedr3am.bug.fastjson.ssrf
- com.threedr3am.bug.fastjson.ssrf.ApacheCxfSSRFPoc(WadlGenerator) Exploitation conditions: fastjson <= 1.2.66 SSRF, requires AutoType enabled
- com.threedr3am.bug.fastjson.ssrf.ApacheCxfSSRFPoc2(SchemaHandler) Exploitation conditions: fastjson <= 1.2.66 SSRF, requires AutoType enabled
- com.threedr3am.bug.fastjson.ssrf.CommonsJellySSRFPoc(Embedded) Exploitation conditions: fastjson <= 1.2.66 SSRF, requires AutoType enabled
- com.threedr3am.bug.fastjson.ssrf.JREJeditorPaneSSRFPoc(JEditorPane) Exploitation conditions: fastjson <= 1.2.66 SSRF, requires AutoType enabled
...several omitted
DNS domain resolution-related
package: com.threedr3am.bug.fastjson.dns
package: com.threedr3am.bug.fastjson.dos
package: com.threedr3am.bug.fastjson.leak
jackson
package: com.threedr3am.bug.jackson.rce
- com.threedr3am.bug.jackson.rce.AnterosPoc
- com.threedr3am.bug.jackson.rce.EhcacheJndi
- com.threedr3am.bug.jackson.rce.H2Rce
- com.threedr3am.bug.jackson.rce.HadoopHikariConfigPoc
- com.threedr3am.bug.jackson.rce.HikariConfigPoc
- com.threedr3am.bug.jackson.rce.IbatisSqlmapPoc
- com.threedr3am.bug.jackson.rce.JndiConverterPoc
- com.threedr3am.bug.jackson.rce.LogbackJndi
...several omitted
SSRF
package: com.threedr3am.bug.jackson.ssrf
...several omitted
dubbo
This module mainly records dubbo-related vulnerability exploitation and security hardening.
- com.threedr3am.bug.dubbo.RomePoc Exploitation conditions: rome dependency present
- com.threedr3am.bug.dubbo.ResinPoc Exploitation conditions: com.caucho:quercus dependency present
- com.threedr3am.bug.dubbo.XBeanPoc Exploitation conditions: org.apache.xbean:xbean-naming dependency present
- com.threedr3am.bug.dubbo.SpringAbstractBeanFactoryPointcutAdvisorPoc Exploitation conditions: org.springframework:spring-aop dependency present
dubbo-hessian2-safe-reinforcement
dubbo hessian2 security hardening demo, using a blacklist approach to block certain gadgets
padding-oracle-cbc
Experimental code records for implementing padding-oracle-cbc attacks in Java
- com.threedr3am.bug.paddingoraclecbc.PaddingOracle
padding oracle Java implementation (multi-block ciphertext implementation)
- com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC
padding oracle cbc Java implementation (single-block <= 16bytes ciphertext implementation)
- com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBC2
padding oracle cbc Java implementation (multi-block ciphertext implementation)
- com.threedr3am.bug.paddingoraclecbc.PaddingOracleCBCForShiro
shiro padding oracle cbc Java implementation
xxe
Reproductions of XXE caused by various XML parsing components, along with their fix code records
commons-collections
Random stuff I wrote years ago while learning about deserialization
security-manager
Experimental code for bypassing the Java security manager
rmi
rmi-related services and their exploitation, etc.
tomcat
tomcat-related vulnerabilities
ajp-bug
tomcat ajp protocol-related vulnerabilities
- com.threedr3am.bug.tomcat.ajp Arbitrary file read and JSP rendering RCE CVE-2020-1938
cas
cas-related vulnerabilities
- cas-4.1.x~4.1.6 deserialization vulnerability (using default key)
- cas-4.1.7~4.2.x deserialization vulnerability (requires knowing the encryption key and signing key)
spring
Experimental code records for reproducing some Spring vulnerabilities
- spring-actuator(jolokia、snake-yaml、h2-hikariCP、eureka)
- spring-cloud-config-server(CVE-2019-3799)
- spring-cloud-config-server(CVE-2020-5405)
- spring-cloud-config-server(CVE-2020-5410)
- spring-session-data-redis RCE
apache-poi
Records related to apache-poi excel parsing vulnerabilities
feature
Some attack data characteristics; the original idea was to see whether regexes etc. could detect them all
java-compile
Implementation code for Java dynamic compilation and bytecode manipulation
nexus
Reproduction records of some maven nexus RCE and Auth Bypass vulnerabilities
ShardingSphere-UI
Some vulnerability records for ShardingSphere-UI
- CVE-2020-1947 (YAML deserialization RCE vulnerability)
shiro
Records of recently discovered shiro authentication bypass vulnerabilities
- bypass shiro <= 1.4.1
- bypass shiro <= 1.5.2 (CVE-2020-1957)
- bypass shiro <= 1.5.3 (CVE-2020-11989)
