Could not find or load main class com.codewhitesec.coldfusionpwn.ColdFusionPwner

[bokanrb]

Cant get this payload to work.

/home/user/Desktop/app/ColdFusionPwn root@parrot:/home/user/Desktop/app/ColdFusionPwn# java -cp ColdFusionPwn.jar:ysoserial.jar com.codewhitesec.coldfusionpwn.ColdFusionPwner -e CommonsBeanutils1 'touch /tmp/success' poc.ser Error: Could not find or load main class com.codewhitesec.coldfusionpwn.ColdFusionPwner

Always get this error message

`There are 2 choices for the alternative java (providing /usr/bin/java).

Selection Path Priority Status

0 /usr/lib/jvm/java-11-openjdk-amd64/bin/java 1111 auto mode
1 /usr/lib/jvm/java-11-openjdk-amd64/bin/java 1111 manual mode

• 2 /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java 1081 manual mode

Press to keep the current choice[*], or type selection number:
root@parrot:/home/seginfo/Desktop/levolog/ColdFusionPwn# update-alternatives --config javac
There are 2 choices for the alternative javac (providing /usr/bin/javac).

Selection Path Priority Status

0 /usr/lib/jvm/java-11-openjdk-amd64/bin/javac 1111 auto mode
1 /usr/lib/jvm/java-11-openjdk-amd64/bin/javac 1111 manual mode

• 2 /usr/lib/jvm/java-8-openjdk-amd64/bin/javac 1081 manual mode`

[datenschrott]

Are your classes located in the actual classpath you're defining? ColdFusionPwn.jar and ysoserial.jar?

[bokanrb]

Yep.

This are the files on folder ColdFusionPwn
LICENSE pom.xml ysoserial-master-SNAPSHOT.jar README.md src ysoserial.jar

Then I run
java -cp ColdFusionPwn.jar:ysoserial.jar com.codewhitesec.coldfusionpwn.ColdFusionPwner -e CommonsBeanutils1 'touch /tmp/success' poc.ser

Got the error:
java -cp ColdFusionPwn.jar:ysoserial.jar com.codewhitesec.coldfusionpwn.ColdFusionPwner -e CommonsBeanutils1 'touch /tmp/success' poc.ser

[datenschrott]

Appearently, the ColdFusionPwn.jar is missing in your listing.

Try downloading https://github.com/codewhitesec/ColdFusionPwn/releases/download/0.0.1/ColdFusionPwn-0.0.1-SNAPSHOT-all.jar, put it into the same directory and then include it in the classpath, i.e.
java -cp ColdFusionPwn-0.0.1-SNAPSHOT-all.jar:ysoserial-master-SNAPSHOT.jar com.codewhitesec.coldfusionpwn.ColdFusionPwner -e CommonsBeanutils1 'touch /tmp/success' poc.ser

[bokanrb]

Thanks!! it worked