Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/docs/metasploit-framework.wiki/Generating-ysoserial-Java-serialized-objects.md
Views: 11766
Instead of embedding static Java serialized objects, Metasploit offers ysoserial-generated binaries with built-in randomization. The benefits of using the Metasploit library include quicker module development, easier-to-read code, and future-proof Java serialized objects.
To use the ysoserial libraries, let's look at an example from the shiro_rememberme_v124_deserialize module:
Example code
In this example:
(L11) The module includes the
Msf::Exploit::JavaDeserializationmixin.This exposes the necessary methods.
(L79) Then it uses the
generate_java_deserialization_for_payloadmethod to create a serialized Java object based on theCommonsCollections2YSoSerial payload that will execute the Metasploit payload.Note that the Metasploit
payloadobject is passed as-is, without any conversion.
Once the serialized object is generated and stored as java_payload, it's then sent to the target in an exploit-specific manner.
Methods
#generate_java_deserialization_for_payload(name, payload)
This method will generate a serialized Java object that when loaded will execute the specified Metasploit payload. The payload will be converted to an operating system command using one of the supported techniques contained within this method and then passed to #generate_java_deserialization_for_command.
name - The payload name parameter must be one of the supported payloads stored in the
ysoserialcache. As of this writing, the list includes:BeanShelll1,Clogure,CommonsBeanutils1,CommonsCollections2,CommonsCollections3,CommonsCollections4,CommonsCollections5,CommonsCollections6,Groovy1,Hibernate1,JBossInterceptors1,JRMPClient,JSON1,JavassistWeld1,Jdk7u21,MozillaRhino1,Myfaces1,ROME,Spring1,Spring2, andVaadin1. Whileysoserialincludes additional payloads that are not listed above, they are unsupported by the library due to the need for complex inputs. Should there be use cases for additional payloads, please consider opening an issue and submitting a pull request to add support.payload - The payload object to execute on the remote system. This is the native Metasploit payload object and it will be automatically converted to an operating system command using a technique suitable for the target platform and architecture. For example, x86 Windows payloads will be converted using a Powershell command. Not all platforms and architecture combinations are supported. Unsupported combinations will result in a
RuntimeErrorbeing raised which will need to be handled by the module developer.
#generate_java_deserialization_for_command(name, shell, command)
This method will generate a serialized Java object that when loaded will execute the specific operating system command using the specified shell. Invocation of the command through the shell effectively bypasses constraints on the characters within the operating system command.
name - The payload name parameter. This has the same significance as the name parameter for the
#generate_java_deserialization_for_payloadmethod.shell - The shell to use for invoking the command. This value must be one of the following:
bash - A modified version that will invoke the command using the
bashexecutablecmd - A modified version that will invoke the command using the Windows
cmd.exeexecutable.powershell - A modified version that will invoke the command using the Windows
powershell.exeexecutable.
command - The operating system command to execute upon successful deserialization of the generated object.
Regenerating the ysoserial_payload JSON file (MAINTAINERS ONLY)
Neither module developers nor users need to concern themselves with the following.
On occasion, Metasploit maintainers may want to re-run the script generation to incorporate new Java serialized objects from the ysoserial tool.
To avoid invoking Java (and all its dependencies) at runtime, the serialized objects are generated and cached within a JSON file. The JSON file can be refreshed using a standalone Ruby script, which comes prepackaged with a Docker image that handles downloading ysoserial and necessary dependencies. The script, Dockerimage and a high-level runme.sh script is stored within tools/payloads/ysoserial. An example run looks like:
At completion, the data/ysoserial_payloads.json file is overwritten and the 22 dynamic payloads are ready for use within the framework. Afterward, the developer should follow the standard git procedures to add and commit the new JSON file before generating a pull request and landing the updated JSON into the framework's master branch.