Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Java deserialization → ysoserial → RCE

An endpoint deserializes a Java object from user-controlled bytes. ysoserial produces a gadget chain whose readObject() reaches Runtime.exec().

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: Java app with a deserialization sink — viewstate, REST endpoint that accepts a serialized blob, RMI port, JMX, or a custom protocol. Classpath includes a gadget-providing library (Commons-Collections, Spring, etc.).

§ Steps

  1. 01
    Reverse shell + reconCredential Access
    T1003.001— LSASS Memory
  2. 02
    Code execution as the Java userExecution
    T1059— Command and Scripting Interpreter
  3. 03
    Send payload to the sinkExecution
    W-DESER-JAVA— Deserialization — Java (ysoserial)
  4. 04
    Build ysoserial payload (CommonsCollections5)Execution
    W-DESER-JAVA— Deserialization — Java (ysoserial)
  5. 05
    Confirm with a benign gadgetExecution
    W-DESER-JAVA— Deserialization — Java (ysoserial)

    URLDNS gadget — DNS callback.

  6. 06
    Identify deserialization sinkReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting

    Magic bytes 0xACED, viewstate, JNDI calls.

§ References

§ Frequently asked

What is the "Java deserialization → ysoserial → RCE" attack path?
An endpoint deserializes a Java object from user-controlled bytes. ysoserial produces a gadget chain whose readObject() reaches Runtime.exec(). It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Reverse shell + recon (T1003.001) — a credential access primitive. Assumed environment: Java app with a deserialization sink — viewstate, REST endpoint that accepts a serialized blob, RMI port, JMX, or a custom protocol.
What is the final impact of this kill-chain?
The final step lands on Identify deserialization sink (W-RECON-FINGERPRINT), which falls under Reconnaissance. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers