README

May 10, 2019 ยท View on GitHub

Java Serializer in Ruby using Metamodel

Also:

  • Discovery of available gadget classes (blind + remote)
  • JRMP/RMI Client
  • JMX/RMI Scanning (related: metasploit modules available)

Currently ported payloads:

  • Commons Collections (very portable variant)
  • Commons Beanutils
  • C3P0
  • Groovy
  • Hibernate Validator
  • Jython
  • ROME
  • Spring JTA
  • Hibernate ORM
  • Rhino
  • net.sf.JSON
  • Beanshell

Pros:

  • in many cases generates smaller payloads
  • no need to carry around possibly hundreds of megabytes of libraries/maven respositories (and possibly malicious code)
  • metasploit integration
  • directly inject meterpreter through serialized payloads
  • addresses some other issues with practical use of ysoserial, including
    • proper shell commandsline handling
    • better support for payload variants
    • parametrization

See test*.rb for some usage examples