Offensive Tools
RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution.
RMIScout enables wordlist and bruteforce attacks against exposed Java RMI interfaces to safely guess method signatures without invocation. It supports multiple Java RMI protocols, method invocation, and exploitation.
About RMIScout
Features Overview
- Supports multiple types of Java RMI servers:
- RMI-JRMP (AKA plain RMI; usually port 1099): Remote object registry service (rmiregistry)
- RMI Activation Stubs via rmid
- RMI-IIOP: Java CORBA programming model (orbd; usually port 1050)
- IIOP requires JRE 1.8 to use. Due to deprecation in later runtimes.
- RMI-SSL
- Automatically switches between RMI, RMI-SSL, Activation stubs.
- Automatically performs localhost bypass techniques (e.g., registries bound to @127.0.0.1:XXXX, but still externally exposed via XXXX)
- Multiple modes of operation
- wordlist mode: Test for remote methods using a wordlist of signatures (see included lists/prototypes.txt)
- bruteforce mode: Given a wordlist of method names generate signatures with various parameter types, # of params, and return types.
- exploit mode: Use ysoserial to exploit remote methods with non-primitive parameters.
- Requires rmiscout to be run with JRE 1.8 for ysoserial to work properly.
- probe mode: Use GadgetProbe to identify classes in the remote classpath
- invoke mode: Directly invoke remote methods by specifying a method signature and parameter values from the command line (primitives, arrays, and Strings only).
- list mode: List available registries on remote server.
Lead Researcher
Jake Miller
Jake Miller (OSCE, OSCP) is a Bishop Fox alumnus and former lead researcher. While at Bishop Fox, Jake was responsible for overseeing firm-wide research initiatives. He also produced award-winning research in addition to several popular hacking tools like RMIScout and GitGot.
Twitter: @theBumbleSec
GitHub: the-bumble
RMIScout Research
Related Resources
Jun 05, 2020
RMIScout: New Hacking Tool Brute-Forces Java RMI Servers for Vulnerabilities
May 26, 2020
RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution
By Jake Miller
Dec 08, 2020
Lessons Learned on Brute-forcing RMI-IIOP With RMIScout
By Jake Miller