Lord of Cereal

Java serialization tool for creating encrypted and HMAC protected payloads.

"For times when the server doesn't want to eat the cereal we are feeding it."

Overview:

This tool is meant for situations when the encryption and/or HMAC secret from the web.xml file is leaked from the server (through LFI or other means). The secret can be used in this tool so that payloads are encrypted and HMAC protected and then sent to the server for execution.

Encryption method:

• DES
• (Coming soon: AES)

Digest method:

• HMAC-SHA1
• (More to come soon)

Payload formatting options:

• Powershell
• Bash
• (Python/Perl coming soon!)

Sample command:

python Lord_of_Cereal.py -u "http://192.168.1.10:8080/sub.faces" -e DES -s s3cr3tk3y -p commons3 -t javax.faces.ViewState -c "ping 192.168.10.8" -f powershell

To do (tool still a work in progress):

• Add support for other encryption methods
• Add support for other HMAC digest methods
• Add separate option for when the encryption secret and HMAC secret differ
• Add switches for Java payload types
• Add Python and Perl support as payload options