Basically: get the server to instantiate an object of arbitrary class, pick an RMI object, exploit the resulting RMI server with #ysoserial.