Chetan Conikee conikeec

curl -sL https://gist.github.com/denji/9731967/raw/jetbrains-uninstall.sh | bash -s

curl -sL https://gist.github.com/denji/9731967/raw/jetbrains-backup.sh | bash -s

	class Utils
	{
	// Function to serialize an object and write it to a file

	public static void SerializeToFile(Object obj, String filename)
	{
	try
	{
	FileOutputStream file = new FileOutputStream(filename);
	ObjectOutputStream out = new ObjectOutputStream(file);

	// Vulnerable class

	class LogFile implements Serializable
	{
	public String filename;
	public String filecontent;

	// Function called during deserialization

	private void readObject(ObjectInputStream in)

	String name;
	String filename = "file.bin";

	try
	{
	FileInputStream file = new FileInputStream(filename);
	ObjectInputStream out = new ObjectInputStream(file);

	// Serialization of the "name" (String) object
	// Will be written to "file.bin"

	import java.io.*;

	public class Serial
	{
	public static void main(String[] args)
	{
	String name = "Ser";
	String filename = "file.bin";

	try


	cd jackspoilt

	# create the exploit by editing ./master/exploit/Exploit.java
	# current version adds errros to log and spawns a calculator on OSX
	# (For Linux based OS please revise the line to specify an exploit of your choice)

	# compile ./master/exploit/Exploit.java

	mvn exec:java -D"exec.mainClass"="EncodeExploit"


	# spin up a shell prompt

	git clone https://github.com/conikeec/jackspoilt.git
	cd jackspoilt

	# compile and package
	mvn clean package

	# verify if gadgets are avaliable to exploit (refer blog)

	/**
	* Set of well-known "nasty classes", deserialization of which is considered dangerous
	* and should (and is) prevented by default.
	*
	* @since 2.8.9
	*/
	protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
	static {
	Set<String> s = new HashSet<>();
	// Courtesy of [https://github.com/kantega/notsoserial]:

	protected void checkIllegalTypes(DeserializationContext ctxt, JavaType type, BeanDescription beanDesc)
	throws JsonMappingException
	{
	// There are certain nasty classes that could cause problems, mostly
	// via default typing -- catch them here.
	Class<?> raw = type.getRawClass();
	String name = raw.getSimpleName();

	if ("TemplatesImpl".equals(name)) { // [databind#1599]
	if (raw.getName().startsWith("com.sun.org.apache.xalan")) {