webProhard
Lab 170 — PulseGuard — SnakeYAML Deserialization to H2 JDBC OOB Exfiltration
hackadvisor
Task: Spring Boot 3.2 monitoring platform with YAML import/export using SnakeYAML unsafe constructor. Solution: Exploit SnakeYAML !! tag to instantiate H2 JdbcConnection with INIT SQL that reads /root/flag.txt via FILE_READ, converts BLOB to VARCHAR via CSVWRITE/CSVREAD roundtrip, and exfiltrates via H2 CSVREAD HTTP GET to interaction server.
$ ls tags/ techniques/
file_readjavadeserializationdecoy_flagspring_booth2_databaseoob_exfiltrationsnakeyamljdbcyaml_importcsvreadcsvwrite
snakeyaml_unsafe_constructor_exploitationh2_jdbc_init_sql_executionh2_file_read_to_blobcsvwrite_csvread_blob_to_varchar_roundtriph2_csvread_http_oob_exfiltrationh2_runscript_from_filemulti_statement_init_chaining
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 172 — PulseGuard — Insecure Deserialization via JSON.NET TypeNameHandling— hackadvisor
- [web][Pro]Lab 138 — PulseGuard — SpEL Injection via Whitelabel Error Page— hackadvisor
- [web][Pro]Lab 233 — PulseAPI — Regex Auth Bypass via Query String Injection— hackadvisor
- [web][Pro]Lab 364 — PulseRelay — Path Traversal to RCE via Plugin Upload— hackadvisor
- [web][Pro]Lab 127 — PulseMetric — Insecure Deserialization via Pickle in Agent Report API— hackadvisor