Found an open directory hosting a Fastjson deserialization exploit chain targeting JDK 8 + Tomcat 9, with C3P0 gadget exploitation and a memory-resident IceShell backdoor. All components feeding a single RCE pipeline.
The Fastjson track starts with class caching. The actor sends a preliminary request to load WrapperConnectionPoolDataSource into the application's classloader, ensuring the gadget is available. Python scripts automate this two-step process with WAF bypass detection - monitoring response times to distinguish WAF blocks from successful RCE.
The C3P0 gadget chain is the core vector. Payload generation uses TemplatesImpl wrapped inside BadAttributeValueExpException and JSONArray, stored in a HashMap. The serialized object is hex-encoded and embedded in user_OverridesAsString. Fastjson deserialization triggers the chain, executing attacker-supplied bytecode.
Three payload variants:
Evil.java: Proof-of-concept reverse shell to VPS 1.94.187.246:4444
IceShell.java: Memory-resident filter backdoor at /shell, supports GET command execution and POST encrypted class loading with AES-128
Payload generators: Compile IceShell into C3P0-friendly hex format with WAF bypass variants
Staging VPS (1.94.187.246) has complete JDK 8 + Tomcat 9.0.80 environment with Fastjson 1.2.47. Python scripts orchestrate the entire pipeline - upload, compile, generate payloads.
OPSEC failures: FOFA API credentials hardcoded in cleartext. SOCKS5 proxy hardcoded. AES key static and exposed. Multiple redundant payload variations indicate trial-and-error testing.
Additional finding: The er-fixed/ directory contains ysoserial, marshalsec, JNDI-Injection-Exploit, and Tomcat versions 9.0.31 through 9.0.83 - systematic compatibility testing across multiple versions.
The exploit targets /login on 10.23.144.1:8080. Successful exploitation installs a persistent memory shell at /shell?cmd=whoami with encrypted class loading. Entire chain executes without writing to disk - pure memory exploitation from Fastjson deserialization through backdoor installation.
http://1.94.187.246/
The Fastjson track starts with class caching. The actor sends a preliminary request to load WrapperConnectionPoolDataSource into the application's classloader, ensuring the gadget is available. Python scripts automate this two-step process with WAF bypass detection - monitoring response times to distinguish WAF blocks from successful RCE.
The C3P0 gadget chain is the core vector. Payload generation uses TemplatesImpl wrapped inside BadAttributeValueExpException and JSONArray, stored in a HashMap. The serialized object is hex-encoded and embedded in user_OverridesAsString. Fastjson deserialization triggers the chain, executing attacker-supplied bytecode.
Three payload variants:
Evil.java: Proof-of-concept reverse shell to VPS 1.94.187.246:4444
IceShell.java: Memory-resident filter backdoor at /shell, supports GET command execution and POST encrypted class loading with AES-128
Payload generators: Compile IceShell into C3P0-friendly hex format with WAF bypass variants
Staging VPS (1.94.187.246) has complete JDK 8 + Tomcat 9.0.80 environment with Fastjson 1.2.47. Python scripts orchestrate the entire pipeline - upload, compile, generate payloads.
OPSEC failures: FOFA API credentials hardcoded in cleartext. SOCKS5 proxy hardcoded. AES key static and exposed. Multiple redundant payload variations indicate trial-and-error testing.
Additional finding: The er-fixed/ directory contains ysoserial, marshalsec, JNDI-Injection-Exploit, and Tomcat versions 9.0.31 through 9.0.83 - systematic compatibility testing across multiple versions.
The exploit targets /login on 10.23.144.1:8080. Successful exploitation installs a persistent memory shell at /shell?cmd=whoami with encrypted class loading. Entire chain executes without writing to disk - pure memory exploitation from Fastjson deserialization through backdoor installation.
http://1.94.187.246/