HTTP Server

Before using this module, you need to enable the corresponding port in the control panel.

Fastjson Groovy RCE

Using an HTTP Server and opening the corresponding HTTP port, select OtherPayload.

In the cascading selector, check GroovyJarConvert. This Gadget will process the bytecode into the Groovy Jar Payload format, which is a Jar package. Then, it will be hosted on an HTTP Server on an HTTP port. After clicking "Generate", an HTTP link will be generated, which can then be used in the Fastjson Groovy payload.

reference: https://github.com/Lonely-night/fastjsonVul

PostgreSQL JDBC Attack

PostgreSQL (CVE-2022-21724) in conjunction with SpringBean allows for remote loading of XML files, bytecode execution, and output echoing.