Skip to content

Commit

Permalink
Updated README with general information
Browse files Browse the repository at this point in the history
  • Loading branch information
njfox committed Nov 17, 2015
1 parent 9135c51 commit 007fba9
Showing 1 changed file with 32 additions and 0 deletions.
32 changes: 32 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# Java Deserialization Exploit

A proof-of-concept tool which weaponizes frohoff's original ysoserial code to gain a remote shell.

## Description

This tool builds upon the proof-of-concept ysoserial by Chris Frohoff (https://github.com/frohoff/ysoserial) and exploits
the vulnerability, using Metasploit Framework tools to generate a malicious binary and an embedded web server to transfer
the payload to the victim. A slightly modified version of ysoserial is used to download and execute the binary on the
victim's side.

__Note:__ This tool is still in an early stage of development, and many features have not yet been implemented. Only the
JBoss platform is currently exploitable.

## Disclaimer

This software has been created purely for the purposes of academic research and
for the development of effective defensive techniques, and is not intended to be
used to attack systems except where explicitly authorized. Project maintainers
are not responsible or liable for misuse of the software. Use responsibly.

## Usage

Coming soon.

## Examples

Coming soon.

## Installation

1. Download the latest jar from the "releases" section.

0 comments on commit 007fba9

Please sign in to comment.