diff --git a/Generating-`ysoserial`-Java-serialized-objects.md b/Generating-`ysoserial`-Java-serialized-objects.md index a829dd736c..30e7f3f4d0 100644 --- a/Generating-`ysoserial`-Java-serialized-objects.md +++ b/Generating-`ysoserial`-Java-serialized-objects.md @@ -1,6 +1,6 @@ Instead of embedding static Java serialized objects, Metasploit offers ysoserial-generated binaries with built-in randomization. The benefits of using the Metasploit library include quicker module development, easier-to-read code, and future-proof Java serialized objects. -To use the ysoserial libraries, let's look at an example from the [`shiro_rememberme_v124_deserialize`][2] module: +To use the ysoserial libraries, let's look at an example from the [shiro_rememberme_v124_deserialize][2] module: ## Example code @@ -50,9 +50,6 @@ This method will generate a serialized Java object that when loaded will execute **Neither module developers nor users need to concern themselves with the following.** -
-Click to expand - On occasion, Metasploit maintainers may want to re-run the script generation to incorporate new Java serialized objects from the ysoserial tool. To avoid invoking Java (and all its dependencies) at runtime, the serialized objects are generated and cached within a JSON file. The JSON file can be refreshed using a standalone Ruby script, which comes prepackaged with a Docker image that handles downloading `ysoserial` and necessary dependencies. The script, `Dockerimage` and a high-level `runme.sh` script is stored within `tools/payloads/ysoserial`. An example run looks like: @@ -170,7 +167,6 @@ DONE! Successfully generated 0 static payloads and 22 dynamic payloads. Skippe ``` At completion, the `data/ysoserial_payloads.json` file is overwritten and the 22 dynamic payloads are ready for use within the framework. Afterward, the developer should follow the standard `git` procedures to `add` and `commit` the new JSON file before generating a pull request and landing the updated JSON into the framework's `master` branch. -
[1]: https://github.com/pimps/ysoserial-modified/blob/e71f70dbc5e8c27d72873014ac5cb7766f4b5b94/src/main/java/ysoserial/payloads/util/CmdExecuteHelper.java#L11-L30 [2]: https://github.com/rapid7/metasploit-framework/blob/d580e7d12218fbf62b190a0c0c6d25f43b8aa5be/modules/exploits/multi/http/shiro_rememberme_v124_deserialize.rb \ No newline at end of file diff --git a/dev/Setting-Up-a-Metasploit-Development-Environment.md b/dev/Setting-Up-a-Metasploit-Development-Environment.md index 74fdafe0a7..93807ba62a 100644 --- a/dev/Setting-Up-a-Metasploit-Development-Environment.md +++ b/dev/Setting-Up-a-Metasploit-Development-Environment.md @@ -105,7 +105,7 @@ Congratulations! You have now set up a development environment and the latest ve ## Optional: Set up the REST API and PostgreSQL database -
The following optional section describes how to manually install PostgreSQL and set up the Metasploit database. Alternatively, use our Omnibus installer which handles this more reliably. Click to expand. +The following optional section describes how to manually install PostgreSQL and set up the Metasploit database. Alternatively, use our Omnibus installer which handles this more reliably. Click to expand. 1. Confirm that the PostgreSQL server and client are installed: @@ -133,11 +133,9 @@ $ ./msfconsole -qx "db_status; exit" Congratulations! You have now set up the [Metasploit Web Service (REST API)][msf-web-service] and the backend database. -
- ## Optional: Tips to speed up common workflows -
The following section is optional but may improve your efficiency. Click to expand. +The following section is optional but may improve your efficiency. Click to expand. - Making sure you're in the right directory to run `msfconsole` can become tedious, so consider using the following Bash alias: @@ -187,8 +185,6 @@ rake spec ``` You should see over 9000 tests run, mostly resulting in green dots, a few in yellow stars, and no red errors. - -
# Great! Now what?