# Remote Method Guesser | Tool For Java RMI Enumeration And Bruteforce Of Remote Methods **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, hacking\ **Created:** [March 11, 2021, 12:08pm UTC](https://onehack.st/t/remote-method-guesser-tool-for-java-rmi-enumeration-and-bruteforce-of-remote-methods/174989 "2021-03-11T12:08:23Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [March 11, 2021, 12:08pm UTC](https://onehack.st/t/remote-method-guesser-tool-for-java-rmi-enumeration-and-bruteforce-of-remote-methods/174989/1 "2021-03-11T12:08:23Z")
### Remote Method Guesser _remote-method-guesser_ (_rmg_) is a command line utility written in _Java_ and can be used to identify security vulnerabilities on _Java RMI_ endpoints. Currently, the following operations are supported: - List available _bound names_ and their corresponding interface class names - List codebase locations (if exposed by the remote server) - Check for known vulnerabilities (enabled class loader, missing _JEP290_, localhost bypass) - Identify existing remote methods by using a _bruteforce_ (wordlist) approach - Call remote methods with _ysoserial gadgets_ within the arguments - Call remote methods with a client specified codebase (remote class loading attack) - Perform _DGC_ and _registry_ calls with _ysoserial_ gadgets or a client specified codebase - Perform _bind_, _unbind_ and _rebind_ operations against a registry - Extend ysoserial gadgets with [An Trinhs registry bypass](https://mogwailabs.de/de/blog/2020/02/an-trinhs-rmi-registry-bypass/) - Enumerate the unmarshalling behavior of `java.lang.String` - Create Java code dynamically to invoke remote methods manually During remote method guessing, deserialization and codebase attacks, the argument types of remote method calls are confused to prevent method invocation on the server side. This technique is not unique to _remote-method-guesser_ and was used first (to the best of my knowledge) by [Jake Miller](https://twitter.com/theBumbleSec) in the [rmiscout](https://github.com/BishopFox/rmiscout) project. [![](https://github.com/qtc-de/remote-method-guesser/workflows/master%20maven%20CI/badge.svg?branch=master)](https://github.com/qtc-de/remote-method-guesser/workflows/master%20maven%20CI/badge.svg?branch=master) [![](https://github.com/qtc-de/remote-method-guesser/workflows/develop%20maven%20CI/badge.svg?branch=develop)](https://github.com/qtc-de/remote-method-guesser/workflows/develop%20maven%20CI/badge.svg?branch=develop) [![](https://github.com/qtc-de/remote-method-guesser/workflows/example%20server%20-%20master/badge.svg?branch=master)](https://github.com/qtc-de/remote-method-guesser/workflows/example%20server%20-%20master/badge.svg?branch=master) [![](https://github.com/qtc-de/remote-method-guesser/workflows/example%20server%20-%20develop/badge.svg?branch=develop)](https://github.com/qtc-de/remote-method-guesser/workflows/example%20server%20-%20develop/badge.svg?branch=develop) [![Remote Method Guesser Example](https://camo.githubusercontent.com/82294195ec663c3e3458bbd18012dcab1595ec05e625c7ec15810679cfdd7fce/68747470733a2f2f746e6569747a656c2e65752f37333230316139323837386330616261376333343139623734303361623630342f726d672d6578616d706c652e676966)](https://camo.githubusercontent.com/82294195ec663c3e3458bbd18012dcab1595ec05e625c7ec15810679cfdd7fce/68747470733a2f2f746e6569747a656c2e65752f37333230316139323837386330616261376333343139623734303361623630342f726d672d6578616d706c652e676966) ### Installation _rmg_ is a _maven_ project and installation should be straight forward. With [maven](https://maven.apache.org/) installed, just execute the following commands to create an executable `.jar` file: ```auto $ git clone https://github.com/qtc-de/remote-method-guesser $ cd remote-method-guesser $ mvn package ``` _rmg_ also supports autocompletion for _bash_. To take advantage of autocompletion, you need to have the [completion-helpers](https://github.com/qtc-de/completion-helpers) project installed. If setup correctly, just copying the [completion script](https://github.com/qtc-de/remote-method-guesser/blob/master/resources/bash_completion.d/rmg) to your `~/.bash_completion.d` folder enables autocompletion. ```auto $ cp resources/bash_completion.d/rmg ~/bash_completion.d/ ``` ### Supported Operations In the following, short examples for each available operation are presented. For a more detailed description you should read the [documentation folder](https://github.com/qtc-de/remote-method-guesser/blob/master/docs). All presented examples are based on the [rmg-example-server](https://github.com/qtc-de/remote-method-guesser/packages/414459) which is also contained within this project. You can also modify and rebuild the example server yourself, by using the sources within the [docker folder](https://github.com/qtc-de/remote-method-guesser/blob/master/.docker). ```auto [qtc@kali ~]$ rmg --help usage: rmg [options] rmg v3.1.0 - Identify common misconfigurations on Java RMI endpoints. Positional Arguments: ip IP address of the target port Port of the RMI registry action One of the possible actions listed below Possible Actions: act Performs Activator based deserialization attacks bind Binds an object to the registry thats points to listener codebase Perform remote class loading attacks dgc Perform DGC based deserialization attacks enum Enumerate bound names, classes, SecurityManger and JEP290 guess Guess methods on bound names listen Open ysoserials JRMP listener method Perform method based deserialization attacks rebind Rebinds boundname as object that points to listener reg Perform registry based deserialization attacks unbind Removes the specified bound name from the registry Optional Arguments: --argument-position select argument position for deserialization attacks --bound-name guess only on the specified bound name --config path to a configuration file --create-samples create sample classes for identified methods --dgc-method method to use during dgc operations (clean|dirty) --follow follow redirects to different servers --force-legacy treat all classes as legacy stubs --help display help message --localhost-bypass attempt localhost bypass for registry operations (CVE-2019-2684) --no-color disable colored output --no-legacy disable automatic legacy stub detection --reg-method method to use during registry operations (bind|lookup|unbind|rebind) --sample-folder folder used for sample generation --signature function signature or one of (dgc|reg|act) --ssl use SSL for the rmi-registry connection --stack-trace display stack traces for caught exceptions --template-folder location of the template folder --threads maximum number of threads (default: 5) --trusted disable bound name filtering --update update wordlist file with method hashes --wordlist-file wordlist file to use for method guessing --wordlist-folder location of the wordlist folder --yso location of ysoserial.jar for deserialization attacks --zero-arg allow guessing on void functions (dangerous) ``` #### Enumeration (enum) The `enum` action performs several checks on the specified _RMI registry_ endpoint. It provides a list of all available bound names, displays the servers codebase (if existent), checks for missing _JEP290_ and [some other common vulnerabilities](https://github.com/qtc-de/remote-method-guesser/blob/master/docs/actions#enum). `enum` is the default action of _remote-method-guesser_ and can either be invoked by only specifying the port and IP address of a target or by specifying `enum` as action explicitly. ```auto [qtc@kali ~]$ rmg --ssl 172.18.0.2 1090 [+] RMI registry bound names: [+] [+] - plain-server [+] --> de.qtc.rmg.server.interfaces.IPlainServer (unknown class) [+] - ssl-server [+] --> de.qtc.rmg.server.interfaces.ISslServer (unknown class) [+] - secure-server [+] --> de.qtc.rmg.server.interfaces.ISecureServer (unknown class) [+] [+] RMI server codebase enumeration: [+] [+] - http://iinsecure.dev/well-hidden-development-folder/ [+] --> de.qtc.rmg.server.interfaces.ISslServer [+] --> de.qtc.rmg.server.interfaces.IPlainServer [+] --> javax.rmi.ssl.SslRMIClientSocketFactory [+] --> de.qtc.rmg.server.interfaces.ISecureServer [+] [+] RMI server String unmarshalling enumeration: [+] [+] - Caught MalformedURLException during lookup call. [+] --> The type java.lang.String is unmarshalled via readObject(). [+] Configuration Status: Outdated [+] [+] RMI server useCodebaseOnly enumeration: [+] [+] - Caught MalformedURLException during lookup call. [+] --> The server attempted to parse the provided codebase (useCodebaseOnly=false). [+] Configuration Status: Non Default [+] [+] RMI registry localhost bypass enumeration (CVE-2019-2684): [+] [+] - Caught NotBoundException during unbind call (unbind was accepeted). [+] Vulnerability Status: Vulnerable [+] [+] RMI DGC enumeration: [+] [+] - Security Manager rejected access to the class loader. [+] --> The DGC uses most likely a separate security policy. [+] Configuration Status: Current Default [+] [+] RMI server JEP290 enumeration: [+] [+] - DGC rejected deserialization of java.util.HashMap (JEP290 is installed). [+] Vulnerability Status: Non Vulnerable [+] [+] RMI registry JEP290 bypass enmeration: [+] [+] - Caught IllegalArgumentException after sending An Trinh gadget. [+] Vulnerability Status: Vulnerable [+] [+] RMI ActivationSystem enumeration: [+] [+] - Caught NoSuchObjectException during activate call (activator not present). [+] Configuration Status: Current Default ``` #### Bind Operations (bind|rebind|unbind) By using the `bind`, `rebind` or `unbind` action, it is possible to modify the available _bound names_ within the _RMI registry_. This is especially useful for verifying `CVE-2019-2684`, which bypasses the localhost restrictions and enables remote users to perform bind operations. Whereas the `unbind` action only requires the _bound name_ that should be removed, the `bind` and `rebind` operations also require a _RemoteObject_ that should be bound. _remote-method-guesser_ always uses `javax.management.remote.rmi.RMIServerImpl_Stub` for this purpose, which is the _RemoteObject_ used by _jmx_. You need also to specify the address of the corresponding _TCP endpoint_ (address where clients should connect to, when they attempt to use your bound object). Continue reading… ## GitHub: [https://github.com/qtc-de/remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)