Might As Well JUMP: Exploit Development For Java Serialization
summary
Demonstrates a working 0day exploit chain against an Apache MyFaces app on current Tomcat that builds a Python payload, encrypts it with DES-ECB encryption, calculates HMAC-SHA1, base64-encodes and sends a viewstate that yields remote code execution (demo produces a root reverse shell). Shows a separate binary patch technique using a debugger/IDA to assemble a direct jump — a one-line ASM patch — to bypass activation checks, and relies on standard tools (Python, Burp/Fiddler, IDA) for replication.
AI-written summary · about
chapters (7)
- 0:00Introduction to exploits
- 1:03Reverse engineering activation logic
- 3:14Jumping over activation checks
- 10:38Preventing application cracking
- 12:06Exploiting Java serialization
- 16:26Building the payload
- 22:19Preventing Java serialization flaws
related talks
40m[In]secure Deserialization, And How [Not] To Do It
43mLive hacking: Breaking into your Java web app
51mNew Exploit Technique In Java Deserialization Attack
01h 06mLive hacking: Breaking into your Java web app
56mThe Anatomy of Java Vulnerabilities
34mDeserialization: what, how and why [not]
35mHow To Find The Next Great Deserialization CVE
50mStranger Danger: Your Java Attack Surface Just Got Bigger