Skip to content

Commit 5d35db7

Browse files
breenmachinebreenmachine
committed
Added files
1 parent ce0e8a6 commit 5d35db7

6 files changed

Lines changed: 140 additions & 0 deletions

File tree

‎DecodeObject.java‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
import java.util.Base64;
2+
import java.io.InputStream;
3+
import java.io.ByteArrayInputStream;
4+
import java.io.ObjectInputStream;
5+
import java.io.OptionalDataException;
6+
import java.io.StreamCorruptedException;
7+
import java.util.Arrays;
8+
9+
public class DecodeObject{
10+
public static void main(String args[]) throws Exception{
11+
int skip=0;
12+
int remainder = 0;
13+
String b64 = args[0];
14+
byte[] bytes = Base64.getDecoder().decode(b64);
15+
ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
16+
int origSize = bis.available();
17+
System.out.println("Data Length: "+origSize);
18+
Object o = null;
19+
while(o == null){
20+
try{
21+
bis.reset();
22+
bis.skip(skip);
23+
ObjectInputStream ois = new ObjectInputStream(bis);
24+
o = ois.readObject();
25+
26+
System.out.println("Object found...");
27+
System.out.println(o.getClass().getName());
28+
System.out.println("Bytes skipped: "+skip);
29+
System.out.println("Bytes left: "+bis.available());
30+
skip = origSize - bis.available();
31+
}
32+
catch (StreamCorruptedException ode){
33+
skip = skip+1;
34+
bis.skip(1);
35+
}
36+
catch (OptionalDataException ode){
37+
bis.skip(1);
38+
skip = skip+1;
39+
}
40+
catch (ClassNotFoundException cnf)
41+
{
42+
System.out.println("Object found..."+cnf.getMessage());
43+
System.out.println("Bytes skipped: "+skip);
44+
System.out.println("Bytes left: "+bis.available());
45+
skip = origSize - bis.available();
46+
}
47+
}
48+
}
49+
}

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
# JavaUnserializeExploits
2+
Python scripts and HTTP request referenced in the blog post What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability at http://foxglovesecurity.com

‎jboss-jmxinvoker-exploit.request‎

1.56 KB
Binary file not shown.

0 commit comments

Comments
 (0)