ysoserial

ysoserial is a proof-of-concept security tool for generating serialized Java payloads that exploit unsafe object deserialization. It was originally released as part of the AppSecCali 2015 talk 'Marshalling Pickles: how deserializing objects will ruin your day', with initial gadget chains for Apache Commons Collections (3.x and 4.x), Spring Beans/Core (4.x) and Groovy (2.3.x), and was later extended with chains for JRE 1.7u21 and many other libraries. The main driver program takes a user-specified command, wraps it in a user-specified gadget chain — a property-oriented programming sequence assembled from classes found in common Java libraries — and serializes the resulting objects to stdout. When an application that has the required gadgets on its classpath unsafely deserializes this data, the chain is automatically invoked and the command is executed on the application host. The project stresses that the vulnerability lies in the application performing unsafe deserialization, not in the mere presence of gadget libraries on the classpath. The tool ships with more than thirty payload types contributed by numerous researchers. These include seven CommonsCollections variants spanning commons-collections 3.x and commons-collections4 4.x, plus chains for CommonsBeanutils, Spring (two variants), Groovy, Hibernate (two variants), C3P0, BeanShell, Jython, Clojure, Mozilla Rhino (two variants), ROME, JSON-lib, MyFaces (two variants), Click, FileUpload, Vaadin, Wicket, Javassist/Weld, JBoss interceptors, AspectJWeaver, Jdk7u21, URLDNS (which lists no dependencies), and JRMPClient/JRMPListener. A bundled helper, ysoserial.exploit.RMIRegistryExploit, is shown in the examples for delivering a payload to an RMI registry. Usage is a single command, for example: java -jar ysoserial.jar CommonsCollections1 calc.exe. The generated payload can be piped directly to a target or saved to a file, as demonstrated with netcat in the README. Prebuilt jars are available from GitHub releases, and the project can be built from source with Java 1.7+ and Maven 3.x+ using 'mvn clean package -DskipTests'. The maintainers explicitly state that the software was created purely for academic research and the development of effective defensive techniques, and that it is not intended to be used to attack systems except where explicitly authorized; users are asked to use it responsibly. Related projects referenced in the README include marshalsec (a sibling project covering other Java deserialization formats and libraries), ysoserial.net (the .NET equivalent), and the Java-Deserialization-Cheat-Sheet, which collects related vulnerabilities, tools and write-ups.