Points: 500

Tags: java old_tech servlet deserialize 

Poll rating:


ActionRatingAuthor team
Read writeup
You need to authenticate and join a team to post writeups TalaatHarbJan. 11, 2021, 10:17 a.m.

No solves,
If anyone knows the solution for this please post it.
I went the route of looking for a deserialization gadget, something to do with Calendar objects in this old java version but I wasn't able to pull it off

TalaatHarbJan. 12, 2021, 12:08 a.m.

Looks like, the included libraries actually have a a deseralization gadget, pretty late to notice that.