Java RMI Registry Interfaces Enumeration - Metasploit


This page contains detailed information about how to use the auxiliary/gather/java_rmi_registry metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Java RMI Registry Interfaces Enumeration
Module: auxiliary/gather/java_rmi_registry
Source code: modules/auxiliary/gather/java_rmi_registry.rb
Disclosure date: -
Last modification time: 2017-07-24 06:26:21 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 1099
List of CVEs: -

This module gathers information from an RMI endpoint running an RMI registry interface. It enumerates the names bound in a registry and looks up each remote reference.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/gather/java_rmi_registry
msf auxiliary(java_rmi_registry) > show targets
    ... a list of targets ...
msf auxiliary(java_rmi_registry) > set TARGET target-id
msf auxiliary(java_rmi_registry) > show options
    ... show and set options ...
msf auxiliary(java_rmi_registry) > exploit

Required Options

  • RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Go back to menu.

Msfconsole Usage

Here is how the gather/java_rmi_registry auxiliary module looks in the msfconsole:

msf6 > use auxiliary/gather/java_rmi_registry

msf6 auxiliary(gather/java_rmi_registry) > show info

       Name: Java RMI Registry Interfaces Enumeration
     Module: auxiliary/gather/java_rmi_registry
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  juan vazquez <[email protected]>

Check supported:
  No

Basic options:
  Name    Current Setting  Required  Description
  ----    ---------------  --------  -----------
  RHOSTS                   yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT   1099             yes       The target port (TCP)

Description:
  This module gathers information from an RMI endpoint running an RMI 
  registry interface. It enumerates the names bound in a registry and 
  looks up each remote reference.

References:
  http://docs.oracle.com/javase/8/docs/platform/rmi/spec/rmiTOC.html

Module Options

This is a complete list of options available in the gather/java_rmi_registry auxiliary module:

msf6 auxiliary(gather/java_rmi_registry) > show options

Module options (auxiliary/gather/java_rmi_registry):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT   1099             yes       The target port (TCP)

Advanced Options

Here is a complete list of advanced options supported by the gather/java_rmi_registry auxiliary module:

msf6 auxiliary(gather/java_rmi_registry) > show advanced

Module advanced options (auxiliary/gather/java_rmi_registry):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   CHOST                                no        The local client address
   CPORT                                no        The local client port
   ConnectTimeout      10               yes       Maximum number of seconds to establish a TCP connection
   Proxies                              no        A proxy chain of format type:host:port[,type:host:port][...]
   RmiReadLoopTimeout  1                yes       Maximum number of seconds to wait for data between read iterations
   SSL                 false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                            no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode       PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion          Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   VERBOSE             false            no        Enable detailed status messages
   WORKSPACE                            no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the gather/java_rmi_registry module can do:

msf6 auxiliary(gather/java_rmi_registry) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the gather/java_rmi_registry auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(gather/java_rmi_registry) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Failed to negotiate RMI protocol

Here is a relevant code snippet related to the "Failed to negotiate RMI protocol" error message:

36:	    connect
37:	
38:	    send_header
39:	    ack = recv_protocol_ack
40:	    if ack.nil?
41:	      print_error("Failed to negotiate RMI protocol")
42:	      disconnect
43:	      return
44:	    end
45:	
46:	    print_status("Listing names in the Registry...")

List raised exception <E.MESSAGE>

Here is a relevant code snippet related to the "List raised exception <E.MESSAGE>" error message:

46:	    print_status("Listing names in the Registry...")
47:	
48:	    begin
49:	      names = send_registry_list
50:	    rescue ::Rex::Proto::Rmi::Exception => e
51:	      print_error("List raised exception #{e.message}")
52:	      return
53:	    end
54:	
55:	    if names.nil?
56:	      print_error("Failed to list names")

Failed to list names

Here is a relevant code snippet related to the "Failed to list names" error message:

51:	      print_error("List raised exception #{e.message}")
52:	      return
53:	    end
54:	
55:	    if names.nil?
56:	      print_error("Failed to list names")
57:	      return
58:	    end
59:	
60:	    if names.empty?
61:	      print_error("Names not found in the Registry")

Names not found in the Registry

Here is a relevant code snippet related to the "Names not found in the Registry" error message:

56:	      print_error("Failed to list names")
57:	      return
58:	    end
59:	
60:	    if names.empty?
61:	      print_error("Names not found in the Registry")
62:	      return
63:	    end
64:	
65:	    print_good("#{names.length} names found in the Registry")
66:

Lookup of <NAME> raised exception <E.MESSAGE>

Here is a relevant code snippet related to the "Lookup of <NAME> raised exception <E.MESSAGE>" error message:

67:	    names.each do |name|
68:	
69:	      begin
70:	        remote_reference = send_registry_lookup(name: name)
71:	      rescue ::Rex::Proto::Rmi::Exception => e
72:	        print_error("Lookup of #{name} raised exception #{e.message}")
73:	        next
74:	      end
75:	
76:	      if remote_reference.nil?
77:	        print_error("Failed to lookup #{name}")

Failed to lookup <NAME>

Here is a relevant code snippet related to the "Failed to lookup <NAME>" error message:

72:	        print_error("Lookup of #{name} raised exception #{e.message}")
73:	        next
74:	      end
75:	
76:	      if remote_reference.nil?
77:	        print_error("Failed to lookup #{name}")
78:	        next
79:	      end
80:	
81:	      print_good("Name #{name} (#{remote_reference[:object]}) found on #{remote_reference[:address]}:#{remote_reference[:port]}")
82:	      report_service(

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • juan vazquez

Version

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.