Thick Client Penetration Testing Tutorials - Part 3 ( Java Deserialization Exploit to RCE)
Thick Client Penetration Testing – 3 (Java Deserialization Exploit: Remote Code Execution) Welcome Readers, in the previous two blogs, we have learnt about the various test cases as well as setting up traffic for thick clients using interception proxy. Among the plethora of test cases out here, one particularly interesting is about “ Remote Code Execution on thick clients”. For this particular RCE, among one of the thick clients I was testing, it was based on Java Application. While researching possible exploits, I noticed that there are custom deserialization methods in Apache commons-collections which has a particular “reflection logic” . This can be particularly exploited which can lead to remote command injection as well as lethal arbitrary code execution. All applications which are java based and perform serialization/ deserialization with untrusted data to deserialize having “commons-collections” in its classpath can be exploited to run arbitrary code! For starters, let’s cover