| name | jndi_exploit |
| description | JNDI injection server to deliver deserialization payloads via LDAP/RMI. Acts as the callback server for fastjson, log4shell, and WebLogic JNDI exploits. |
| metadata | {"openclaw":{"emoji":"🌐","requires":{"bins":["java"],"env":[]},"primaryEnv":null}} |
jndi_exploit
Spins up a malicious JNDI server (LDAP + RMI) to serve deserialization payloads when a vulnerable application performs a JNDI lookup.
Target Framework
Used as a helper alongside any JNDI-injectable vulnerability: Fastjson, Log4Shell (CVE-2021-44228), WebLogic IIOP, Spring JMX, etc.
Usage
Provide params.cmd (command to execute on the victim) and optionally params.listen_port. The skill starts the JNDI server, returns the LDAP/RMI URL for use in the trigger payload.
Parameters
| Param | Type | Required | Description |
|---|
| cmd | string | yes | OS command to execute on the victim host |
| listen_host | string | no | Attacker-reachable IP/hostname (auto-detect) |
| listen_port | int | no | LDAP listen port (default: 1389) |
| rmi_port | int | no | RMI listen port (default: 1099) |
| timeout | int | no | Server lifetime in seconds (default: 60) |
Notes
Both LDAP and RMI modes are supported; LDAP is preferred for modern JDKs with trustURLCodebase restrictions bypassed via deserialization gadgets.
