Closed br-sn closed 1 year ago
这个堆栈是正常的,payload 已经触发了,RdnEntry 用到的是 compreTo -> equals
Interesting - my payload didn't fire though. Any suggestions on how to get it to fire based on that stack trace?
Thank you for your response.
ysomap payload(SpringPartiallyComparableAdvisorHolder) bullet(SpringJndiBullet1) > show options
[+] [2023-05-23 08:15:08] print current session settings!
[2023-05-23 08:15:08] Current Payload: SpringPartiallyComparableAdvisorHolder
[2023-05-23 08:15:08] Current SerializeType: hessian
[2023-05-23 08:15:08] Current Serializer Encoder: null
[2023-05-23 08:15:08] Current Serializer Output Type: file
[2023-05-23 08:15:08] Current Serializer serialVersionUID: null
[2023-05-23 08:15:08] Current Bullet: SpringJndiBullet1
if I use hessian2 as the serializerType I get the following error:
javax.servlet.ServletException: com.caucho.hessian.io.HessianProtocolException: expected hessian method ('m') at 0x43 (C)
com.caucho.hessian.server.HessianServlet.service(HessianServlet.java:404)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
</pre><p><b>Root Cause</b></p><pre>com.caucho.hessian.io.HessianProtocolException: expected hessian method ('m') at 0x43 (C)
com.caucho.hessian.io.Hessian2Input.error(Hessian2Input.java:2705)
com.caucho.hessian.io.Hessian2Input.readMethod(Hessian2Input.java:265)
com.caucho.hessian.server.HessianSkeleton.invoke(HessianSkeleton.java:136)
com.caucho.hessian.server.HessianSkeleton.invoke(HessianSkeleton.java:109)
com.caucho.hessian.server.HessianServlet.service(HessianServlet.java:396)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
我看堆栈错误应该是hessian2的类型,再试一次下面的流程
将sofa-hessian改为caucho-hessian
需要在 jdk8 的环境下打包
When using several of the Hessian deserialisation payloads against a hessian endpoint, the tomcat server responds with the following stack trace: