ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress, so no complete API document and contribution guide.

ZKar provides:

• A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required
• From the Java serialization protocol to a Go struct
• A Go library that can manipulate the Java serialization data
• WIP: ysoserial implement in Go
• WIP: Java class bytecodes parser, viewer and manipulation
• WIP: An implementation of RMI/LDAP in Go

Installing

Using ZKar is easy. use go get to install the ZKar along with the library and its dependencies:

go get -u github.com/phith0n/zkar

Next, use github.com/phith0n/zkar/* in your application:

package main
import (
	"fmt"
	"github.com/phith0n/zkar/serz"
	"io/ioutil"
	"log"
)
func main() {
	data, _ := ioutil.ReadFile("./testcases/ysoserial/CommonsCollections6.ser")
	serialization, err := serz.FromBytes(data)
	if err != nil {
		log.Fatal("parse error")
	}
	fmt.Println(serialization.ToString())
}

Command line utility tool

ZKar also provides a command line utility tool that you can use it directly:

$ go run main.go
NAME:
   zkar - A Java serz tool
USAGE:
   main [global options] command [command options] [arguments...]
COMMANDS:
   generate  generate Java serz attack payloads
   dump      parse the Java serz streams and dump the struct
   help, h   Shows a list of commands or help for one command
GLOBAL OPTIONS:
   --help, -h  show help (default: false)

For example, you are able to dump the payload CommonsBeanutils3 from ysoserial like:

$ go run main.go dump -f "$(pwd)/testcases/ysoserial/CommonsBeanutils3.ser"

Tests

ZKar is a well-tested tool that passed all ysoserial generated gadgets parsing and rebuilding tests. It means that gadget generating by ysoserial can be parsed by ZKar, and parsed struts can be converted back into bytes string which is equal to the original one.

JDK/JRE 8u20 gadget is not supported now, I am current working on it.

TODO

• Java bytecodes parser and generator
• JDK/JRE 8u20 Gadget supporting
• Serialization payloads generator
• An implementation of RMI/LDAP in Go

License

ZKar is released under the MIT license. See LICENSE

See Also

• SerializationDumper: A tool to dump and rebuild Java serialization streams and Java RMI packet contents in a more human readable form.
• ysoserial: A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
• Java-Deserialization-Cheat-Sheet: The cheat sheet about Java Deserialization vulnerabilities