pwntester / jre8u20_rce_gadget

JRE8u20_RCE_Gadget

Pure JRE 8 RCE Deserialization gadget

Based on Chris Frohoff and Wouter Coekaerts ideas:

• https://gist.github.com/frohoff/24af7913611f8406eaf3
• http://wouter.coekaerts.be/2015/annotationinvocationhandler

jre8u20_rce_gadget's Issues

JDK8u20 deserialization problem

Hello，pwntest.
I am a Chinese student. I recently learned about JDK8u20 deserialization and read your exploit code. I have a question. I hope you can answer it in your busy schedule.
You construct map in the code as ("f5a5a608", "f5a5a608"), so I think that before the patch() function, the value of map in the generated bytecode file is the handler value of the key value string"f5a5a608", but It is the handler value of the LinkedHashset object. Why is this happening?
I learned the knowledge of serialized bytecode again and repeatedly analyzed your code and comments, but still can't get the answer. Can you help me?