No security manager: RMI class loader disabled about ysoserial HOT 4 CLOSED

It sounds like the classes required by the CommonsCollection1 chain (or others) are probably not on the classpath in this case.

A decent way to investigate, assuming you have console access on this host, is to get the full classpath of that JVM/process: figure out which process is listening on that port (i.e. netstat -nlp | grep 22099), then check the full command line for -cp -classpath params (i.e. ps aux | grep $pid), and if necessary, see what files the process has open (i.e. lsof -p $pid | grep jar).

Unfortunately the above will only tell you what the entire collective process has loaded, and not what the specific child ClassLoader in question has loaded, which can be different. RMI Registries generally inherit the ClassLoader of the code that creates them with a call to LocateRegistry.html.createRegistry(int).

Do you know what Java version is being used? Have you tried the Jdk7u21 chain?

In the future I'd suggest asking questions like this in the Gitter chat. I'll probably close this shortly.

-Chris

from ysoserial.

Closing. Please follow-up in the GItter chat if there are further questions.

from ysoserial.

I have also encountered this problem, want to know how to solve upstairs

from ysoserial.

7u21

from ysoserial.