-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix find_ysoserial_offsets.rb and incorrect serialVersionUID patching #13079
Conversation
This reverts commit eaf8554.
end | ||
|
||
# XXX: This hardcoded value may change! | ||
bytes.sub!("\xe3\xa1\x88\xea\x73\x22\xa4\x48", serial_version_uid) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This won't work if the CommonsBeanutils1
payload in data/ysoserial_payloads.json
is updated, nor will it work for other payloads in that file. I was mistaken about the frequency and distribution of serialVersionUID
.
) | ||
|
||
# XXX: Patch in expected serialVersionUID | ||
serialized_payload[140, 8] = "\xcf\x8e\x01\x82\xfe\x4e\xf1\x7e" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should still work if the offset doesn't change after updating the CommonsBeanutils1
payload in data/ysoserial_payloads.json
. However, the updated payload seems to be breaking for me regardless, so I'm not updating the file in this PR. We will have to address that later.
Retested with the |
Release NotesThis fixes a bug in the tool workflow which generates the data files for YSoSerial Java payloads. |
I did not update
data/ysoserial_payloads.json
because it seems to break theCommonsBeanutils1
payload used in exploit/windows/http/desktopcentral_deserialization. We will have to address that in a later PR.Fixes #11125 and #13071. See also: #11359.