New Exploit Technique In Java Deserialization Attack
summary
An analysis of 10,000+ libraries uncovers two practical exploit vectors: a URLConnection path that causes Java to leak NTLM creds and enables an HTTP-to-SMB NTLM relay leading to remote code execution via Windows relay, and a JDBC-URI parameter abuse that forces deserialization through JDBC URI autoDeserialize interceptor parameters to trigger getObject and RCE. Demos and custom fuzzing confirm the chains work, many new gadget chains are easy to find, and full exploits achieve file upload and backdoor execution.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:28Java Deserialization Serialization
- 9:57Well-Known Defense Solution
- 13:41Flaws in Defense Solutions
- 15:21URL Connection
- 24:33Java DataBase Connectivity
- 31:31Attack Scenarios
- 36:49New gadget for Java Deserialization
- 38:11JSON Attack
- 39:43Recommendations
related talks
48mA Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
56mThe Anatomy of Java Vulnerabilities
35mHow To Find The Next Great Deserialization CVE
49mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
23mMight As Well JUMP: Exploit Development For Java Serialization
26mStranger Danger: Your Attack Surface Just Got Bigger
46mThe Anatomy of Java Vulnerabilities