A Java web application that parses request bodies with Fastjson 1.2.24, vulnerable to deserialization through @type: a JSON body can name a class such as JdbcRowSetImpl, whose setters make a JNDI lookup to the player's RMI or LDAP server.
Not startedDockercommit 21a9621x86_64 · aarch64Secret
Exploit the Fastjson 1.2.24 autoType deserialization to get a shell on the server.
The brief for this lab lives in its repository.