forked from njfox/Java-Deserialization-Exploit
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Updated README with general information
- Loading branch information
njfox
committed
Nov 17, 2015
1 parent
9135c51
commit 007fba9
Showing
1 changed file
with
32 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
# Java Deserialization Exploit | ||
|
||
A proof-of-concept tool which weaponizes frohoff's original ysoserial code to gain a remote shell. | ||
|
||
## Description | ||
|
||
This tool builds upon the proof-of-concept ysoserial by Chris Frohoff (https://github.com/frohoff/ysoserial) and exploits | ||
the vulnerability, using Metasploit Framework tools to generate a malicious binary and an embedded web server to transfer | ||
the payload to the victim. A slightly modified version of ysoserial is used to download and execute the binary on the | ||
victim's side. | ||
|
||
__Note:__ This tool is still in an early stage of development, and many features have not yet been implemented. Only the | ||
JBoss platform is currently exploitable. | ||
|
||
## Disclaimer | ||
|
||
This software has been created purely for the purposes of academic research and | ||
for the development of effective defensive techniques, and is not intended to be | ||
used to attack systems except where explicitly authorized. Project maintainers | ||
are not responsible or liable for misuse of the software. Use responsibly. | ||
|
||
## Usage | ||
|
||
Coming soon. | ||
|
||
## Examples | ||
|
||
Coming soon. | ||
|
||
## Installation | ||
|
||
1. Download the latest jar from the "releases" section. |