diff --git a/activemq/CVE-2015-5254/README.md b/activemq/CVE-2015-5254/README.md index 205d313be5..b8eb242de8 100644 --- a/activemq/CVE-2015-5254/README.md +++ b/activemq/CVE-2015-5254/README.md @@ -28,7 +28,7 @@ The exploit process is as follows: 2. send payload to port 61616 3. Access the web management page and read the serialization messages, then u can trigger vulnerability. -To exploit this environment we will use [jmet](https://github.com/matthiaskaiser/jmet) (Java Message Exploitation Tool). First download the jar file of jmet, and create an external folder in the same directory (otherwise it may occur the error that the folder does not exist). +To exploit this environment we will use [jmet](https://github.com/matthiaskaiser/jmet) (Java Message Exploitation Tool). First download the jar file of jmet, and create folder called **external** in the same directory (otherwise it may occur the error that the folder does not exist). the jmet is to use ysoserial to generate Payload and send it (the jar comes with ysoserial, we don't no need to download it again), so we need to choose one that can be used in ysoserial as the gadget, such as ROME.