From 55800d1e3aa8db8cf48a03fb7fe661459c82a1a1 Mon Sep 17 00:00:00 2001 From: Boy Baukema Date: Thu, 10 Aug 2017 11:10:39 +0200 Subject: [PATCH] Update README.md to reflect additional payloads --- README.md | 46 +++++++++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 7a33b9f..e696b1c 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # ysoserial - -[![Join the chat at https://gitter.im/frohoff/ysoserial](https://badges.gitter.im/frohoff/ysoserial.svg)](https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) + +[![Join the chat at https://gitter.im/frohoff/ysoserial](https://badges.gitter.im/frohoff/ysoserial.svg)](https://gitter.im/frohoff/ysoserial?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. @@ -31,19 +31,39 @@ are not responsible or liable for misuse of the software. Use responsibly. ## Usage ```shell -$ java -jar target/ysoserial-0.0.4-all.jar +$ java -jar ysoserial-master-v0.0.4-g35bce8f-67.jar Y SO SERIAL? Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]' Available payload types: BeanShell1 [org.beanshell:bsh:2.0b5] - CommonsBeanutilsCollectionsLogging1 [commons-beanutils:commons-beanutils:1.9.2, commons-collections:commons-collections:3.1, commons-logging:commons-logging:1.2] + C3P0 [com.mchange:c3p0:0.9.5.2, com.mchange:mchange-commons-java:0.2.11] + Clojure [org.clojure:clojure:1.8.0] + CommonsBeanutils1 [commons-beanutils:commons-beanutils:1.9.2, commons-collections:commons-collections:3.1, commons-logging:commons-logging:1.2] CommonsCollections1 [commons-collections:commons-collections:3.1] CommonsCollections2 [org.apache.commons:commons-collections4:4.0] CommonsCollections3 [commons-collections:commons-collections:3.1] CommonsCollections4 [org.apache.commons:commons-collections4:4.0] + CommonsCollections5 [commons-collections:commons-collections:3.1] + CommonsCollections6 [commons-collections:commons-collections:3.1] + FileUpload1 [commons-fileupload:commons-fileupload:1.3.1, commons-io:commons-io:2.4] Groovy1 [org.codehaus.groovy:groovy:2.3.9] + Hibernate1 [] + Hibernate2 [] + JBossInterceptors1 [javassist:javassist:3.12.1.GA, org.jboss.interceptor:jboss-interceptor-core:2.0.0.Final, javax.enterprise:cdi-api:1.0-SP1, javax.interceptor:javax.interceptor-api:3.1, org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final, org.slf4j:slf4j-api:1.7.21] + JRMPClient [] + JRMPListener [] + JSON1 [net.sf.json-lib:json-lib:jar:jdk15:2.4, org.springframework:spring-aop:4.1.4.RELEASE, aopalliance:aopalliance:1.0, commons-logging:commons-logging:1.2, commons-lang:commons-lang:2.6, net.sf.ezmorph:ezmorph:1.0.6, commons-beanutils:commons-beanutils:1.9.2, org.springframework:spring-core:4.1.4.RELEASE, commons-collections:commons-collections:3.1] + JavassistWeld1 [javassist:javassist:3.12.1.GA, org.jboss.weld:weld-core:1.1.33.Final, javax.enterprise:cdi-api:1.0-SP1, javax.interceptor:javax.interceptor-api:3.1, org.jboss.interceptor:jboss-interceptor-spi:2.0.0.Final, org.slf4j:slf4j-api:1.7.21] Jdk7u21 [] + Jython1 [org.python:jython-standalone:2.5.2] + MozillaRhino1 [rhino:js:1.7R2] + Myfaces1 [] + Myfaces2 [] + ROME [rome:rome:1.0] Spring1 [org.springframework:spring-core:4.1.4.RELEASE, org.springframework:spring-beans:4.1.4.RELEASE] + Spring2 [org.springframework:spring-core:4.1.4.RELEASE, org.springframework:spring-aop:4.1.4.RELEASE, aopalliance:aopalliance:1.0, commons-logging:commons-logging:1.2] + URLDNS [] + Wicket1 [wicket-util:wicket-util:6.23] ``` ## Examples @@ -66,15 +86,15 @@ $ java -cp ysoserial-0.0.4-all.jar ysoserial.exploit.RMIRegistryExploit myhost 1 ## Installation -1. Download the latest jar from [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) . - -Note that GitHub-hosted releases were removed in compliance with the [GitHub Community Guidelines](https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed) - -## Building - -Requires Java 1.7+ and Maven 3.x+ - -```mvn clean package -DskipTests``` +1. Download the latest jar from [JitPack](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) [![Download Latest Snapshot](https://img.shields.io/badge/download-master--SNAPSHOT-green.svg)](https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar) . + +Note that GitHub-hosted releases were removed in compliance with the [GitHub Community Guidelines](https://help.github.com/articles/github-community-guidelines/#what-is-not-allowed) + +## Building + +Requires Java 1.7+ and Maven 3.x+ + +```mvn clean package -DskipTests``` ## Code Status