Java RMI - RMI-IIOP - Port 1098/1099/1050
Become VeryLazyTech member! 🎁
Follow us on:
✖ Twitter @VeryLazyTech.
👾 Github @VeryLazyTech.
📜 Medium @VeryLazyTech.
📺 YouTube @VeryLazyTech.
📩 Telegram @VeryLazyTech.
🕵️♂️ My Site @VeryLazyTech.
Visit our shop for e-books and courses. 📚
Basic info
Java Remote Method Invocation (RMI) is a distributed application framework that allows methods to be invoked remotely across JVMs. Although widely used in legacy enterprise systems, Java RMI is often overlooked in penetration testing engagements, despite being highly vulnerable when misconfigured. This comprehensive guide details every step of Java RMI penetration testing — from discovery and enumeration to advanced exploitation, code execution, and real-world post-exploitation scenarios.
Understanding Java RMI and Its Attack Surface
Java RMI allows invocation of methods on remote objects as if they were local. It typically operates over TCP and uses the JRMP (Java Remote Method Protocol). The default port is 1099, although RMI objects can be registered on other ports, or within a multi-port registry architecture.
Key components:
RMI Registry: A naming service for remote objects.
Remote Object Stubs: Act as client-side proxies.
Skeletons: Server-side constructs to dispatch calls (deprecated in modern Java).
Enumertion
remote-method-guesser is a Java RMI vulnerability scanner that is capable of identifying common RMI vulnerabilities automatically. Whenever you identify an RMI endpoint, you should give it a try:
The output of the enumeration action is explained in more detail in the documentation pages of the project. Depending on the outcome, you should try to verify identified vulnerabilities.
The ObjID values displayed by remote-method-guesser can be used to determine the uptime of the service. This may allows to identify other vulnerabilities:
Bruteforcing Remote Methods
Even when no vulnerabilities have been identified during enumeration, the available RMI services could still expose dangerous functions. Furthermore, despite RMI communication to RMI default components is protected by deserialization filters, when talking to custom RMI services, such filters are usually not in place. Knowing valid method signatures on RMI services is therefore valuable.
Unfortunately, Java RMI does not support enumerating methods on remote objects. That being said, it is possible to bruteforce method signatures with tools like remote-method-guesser or rmiscout:
Identified methods can be called like this:
Or you can perform deserialization attacks like this:
Known Interfaces
remote-method-guesser marks classes or interfaces as known if they are listed in the tool's internal database of known RMI services. In these cases you can use the known action to get more information on the corresponding RMI service:
Learn & practice For the Bug Bounty
Last updated
Was this helpful?