mbechler/marshalsec
Marshalsec
Marshalsec is a toolkit designed for generating malicious serialized Java objects to achieve remote code execution during the unmarshalling process. It functions as a Java deserialization exploit tool and a framework for triggering Java Naming and Directory Interface lookups to remote servers.
The project provides a JNDI redirector service that intercepts lookups and points targets toward a remote codebase. It includes utilities for crafting payloads that force Java applications to download and execute arbitrary classes from a remote URL.
The toolset covers security analysis activities including Java deserialization testing, JNDI injection exploitation, and remote code execution research. It generates serialized objects designed to execute arbitrary system commands or trigger external naming service lookups.
Features
- Deserialization Exploits - Provides a toolkit for generating exploits that trigger arbitrary code execution via manipulated serialized data objects.
- JNDI Injection Exploitation - Generates payloads to trigger remote code execution by forcing Java applications to perform external JNDI lookups.
- Deserialization Vulnerability Testing - Tests applications for insecure deserialization by generating malicious serialized objects.
- JNDI Injection Frameworks - Ships a set of tools for creating payloads that trigger Java Naming and Directory Interface lookups.
- JNDI Injection Payloads - Embeds naming service lookups into serialized objects to force targets to fetch remote resources.
- JNDI Redirector Services - Runs a listener service that intercepts lookup requests and points targets toward a remote bytecode provider.
- Gadget Chain Construction - Implements the process of linking class methods to create executable operation sequences during deserialization.
- Deserialization Payloads - Constructs maliciously crafted serialized objects to trigger remote code execution during the deserialization process.
- Remote Code Execution Research - Researches how libraries can be chained together to trigger unintended behavior and RCE on target systems.
- Remote Payload Stagers - Implements mechanisms that retrieve execution modules from remote servers during the deserialization process.
- Remote Classloading Payload Generators - Provides a utility for crafting payloads that force Java applications to download and execute arbitrary classes from a remote URL.
- System Command Execution Payloads - Generates serialized payloads designed to trigger arbitrary system command execution via gadget chains.
- Injection Payloads - Produces crafted strings designed to test for injection vulnerabilities via JNDI lookups.
- Java Security Research Frameworks - Provides a framework for automating the discovery and testing of security vulnerabilities in Java applications.
- JVM Bytecode Hosting - Provides infrastructure to host malicious Java bytecode for remote execution on target JVMs.
- Deserialization Exploits - Tool for researching and exploiting Java deserialization.
- Deserialization Tools - Tool for Java deserialization via LDAP/RMI services.
