帆软channel反序列化gadget挖掘及绕过

baozongwi's blog，Currently exploring Java security and internal network penetration, with CTFs as a hobby.关注

0x00 TL;DR 手头是官方默认安装的 jar，不是现场包。入口还是那条远程设计： POST /webroot/decision/remote/design/channel HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; …

添加评论
点赞收藏
点踩分享查看原文
评论
?
参与讨论