webPromedium

Lab 169 — GridPulse — Insecure Deserialization via Configuration Import

hackadvisor

Task: Java/Spring Boot industrial monitoring platform with config import/export feature that base64-decodes user input and passes it to ObjectInputStream.readObject() without class filtering. Solution: craft CommonsCollections6 gadget chain with Runtime.exec(String[]) for bash -c command execution, exfiltrate /flag.txt via bash /dev/tcp to interaction server.

$ ls tags/ techniques/
rcejavainsecure_deserializationdecoy_flagspring_bootconfig_importcommons_collectionsgadget_chainysoserialoob_exfiltrationdev_tcpobjectinputstream
decoy_flag_avoidancejava_objectinputstream_deserializationcommons_collections_6_gadget_chainruntime_exec_string_array_for_complex_commandsoob_data_exfiltration_via_bash_dev_tcpcustom_ysoserial_payload_generation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups