[EnumJavaLibs]_ Remote Java classpath enumerator

[RedTimmy Security <redazione () segfault it>]

Hi,
we have just released EnumJavaLibs to perform java classes enumeration against java services.

To discover a deserialization vulnerability is often easy. When source code is available, it comes down to finding 
calls to readObject() and finding a way for user input to reach that function. In case we don’t have source code 
available, we can spot serialized objects on the wire by looking for binary blobs or base64 encoded objects (recognized 
by ‘rO0..’). The hard part comes with exploitation. Sure you can throw all exploits from ysoserial at it and hope for 
the best, but if it doesn’t work there are not much other things you can try.

The big piece of information which is missing at this point, is information about the classpath of the remote 
application. If we know what libraries are loaded, we might be able to construct a gadget chain (or adjust the existing 
ysoserial exploit to match the version of the library on the remote application, for example). That’s where the idea of 
EnumJavaLibs came from: just let it deserialize arbitrary objects from different (popular) 3rd party java libraries. 
More specifically:

- Create a local database of the most common Java libraries
- For each of these libraries, find a class that is serializable
- Create an instance of this object, serialize it, and send it to the remote application
- If we get a ClassNotFoundException back, we know the library is not on the classpath

At Redtimmy Sec we have released the code of this project on GitHub, together with a tool that can build a database of 
libraries (JavaClassDB.py). 

You can download the pre-compiled version from: 
https://github.com/redtimmy/EnumJavaLibs/raw/master/bin/EnumJavaLibs.jar.

The source code is instead over here -> https://github.com/redtimmy/EnumJavaLibs

A wider description of how the tool works in our blog -> 
https://www.redtimmy.com/uncategorized/remote-java-classpath-enumeration-with-enumjavalibs/

Regards