Is there any gadget which can be exploded in constructor? about marshalsec

[mbechler]

If you mean a no argument constructor, then no, I don't think so. With these you don't have any controllable inputs, so I guess this would be rare and limited to cases where these do something really stupid(tm), e.g. calling System.exit(), deleting some files, or maybe setting some security relevant system property.

[mbechler]

Seeing this again makes me realize that I forgot to mention java.rmi.server.UnicastRemoteObject.UnicastRemoteObject()
If the target technology allows to call a protected default constructor, this will open a RMI listener which you might to exploit further on a random port.