xmlrpc common deserialization vulnerability

This is an Exploit App I made when solving the DocumentViewer challenge (CVE-2021-40724) from MobileHackingLab. It will download a libdocviewe_pro.so library from your local machine unto the vulnerable app's internal storage, load it upon relaunch and achieve an RCE.

An unfinished RCE framework for Netty & Bukkit applications

spring-cloud-function SpEL RCE复现环境Config files for my GitHub profile.

JNDI-Injection-Exploit 是一个用于生成可用 JNDI 链接并提供后台服务的工具，支持启动 RMI 服务器、LDAP 服务器和 HTTP 服务器。其 RMI 和 LDAP 服务基于 marshalsec，并进行修改以与 HTTP 服务联动。

两年多以前，Chris Frohoff 和 Gabriel Lawrence 发表了关于 Java 对象反序列化漏洞的研究，这一研究最终导致 Java 历史上最大的一波远程代码执行漏洞的爆发。 后续研究表明，这些漏洞不仅限于 Java 序列化或 XStream 这样的机制，还可以应用于其他机制。

Educational Minecraft plugin demonstrating the dangers of installing unverified plugins.

Security Research and PoC

Little recap of the log4j2 remote code execution (CVE-2021-44228)

RCE using Minecraft Mod

Selection of ways to remove JndiLookup in now obsolete Minecraft versions, or versions that still have log4j < 2.10 and is unable to use `-Dlog4j2.formatMsgNoLookups=true`

POC

Apache Log4j2 RCE( CVE-2021-44228)验证环境

Insecure Java Deserialization Lab

POC for Infamous Log4j CVE-2021-44228

Analysis of the Jackson Databind CVE's

CVE-2020-7200: HPE Systems Insight Manager (SIM) RCE PoC

Java General Vulnerable Web Application

Minecraft server test remote code execution by calling log4j in chat (CVE-2021-44228)

Possible RCE Solution when performing file upload based on Jakarta Multipart parser (Filter Approach)