Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'rex/java/serialization'
7

8
class MetasploitModule < Msf::Auxiliary
9
  include Msf::Exploit::Remote::Java::Rmi::Client
10
  include Msf::Auxiliary::Scanner
11
  include Msf::Auxiliary::Report
12

13
  def initialize
14
    super(
15
      'Name'        => 'Java JMX Server Insecure Endpoint Code Execution Scanner',
16
      'Description' => 'Detect Java JMX endpoints',
17
      'Author'     => ['rocktheboat'],
18
      'License'     => MSF_LICENSE,
19
      'References'     =>
20
        [
21
          ['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'],
22
          ['URL', 'https://www.optiv.com/blog/exploiting-jmx-rmi'],
23
          ['CVE', '2015-2342']
24
        ],
25
      'Platform'       => 'java',
26
      'DisclosureDate' => 'May 22 2013'
27
    )
28

29
    register_options(
30
      [
31
        Opt::RPORT(1099)
32
      ])
33
  end
34

35
  def run_host(target_host)
36
    mbean_server = { "address" => rhost, "port" => rport }
37

38
    connect
39
    print_status("Sending RMI header...")
40
    unless is_rmi?
41
      print_status("#{rhost}:#{rport} Java JMX RMI not detected")
42
      disconnect
43
      return
44
    end
45

46
    mbean_server = discover_endpoint
47
    disconnect
48

49
    if mbean_server.nil?
50
      print_status("#{rhost}:#{rport} Java JMX MBean not detected")
51
      return
52
    end
53

54
    connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
55

56
    unless is_rmi?
57
      print_status("#{rhost}:#{rport} Java JMX RMI not detected")
58
      disconnect
59
      return
60
    end
61

62
    jmx_endpoint = handshake(mbean_server)
63
    disconnect
64

65
    if jmx_endpoint == false
66
      print_status("#{mbean_server[:address]}:#{mbean_server[:port]} Java JMX MBean authentication required")
67
      return
68
    elsif jmx_endpoint.nil?
69
      print_status("#{mbean_server[:address]}:#{mbean_server[:port]} Java JMX MBean status unknown")
70
      return
71
    end
72

73
    print_good("Handshake with JMX MBean server on #{jmx_endpoint[:address]}:#{jmx_endpoint[:port]}")
74
    svc = report_service(:host => rhost, :port => rport, :name => "java-rmi", :info => "JMX MBean server accessible")
75
    report_vuln(
76
      :host         => rhost,
77
      :service      => svc,
78
      :name         => self.name,
79
      :info         => "Module #{self.fullname} confirmed RCE via JMX RMI service",
80
      :refs         => self.references
81
    )
82
  end
83

84
  def is_rmi?
85
    send_header
86
    ack = recv_protocol_ack
87
    if ack.nil?
88
      return false
89
    end
90

91
    true
92
  end
93

94
  def discover_endpoint
95
    rmi_classes_and_interfaces = [
96
      'javax.management.remote.rmi.RMIConnectionImpl',
97
      'javax.management.remote.rmi.RMIConnectionImpl_Stub',
98
      'javax.management.remote.rmi.RMIConnector',
99
      'javax.management.remote.rmi.RMIConnectorServer',
100
      'javax.management.remote.rmi.RMIIIOPServerImpl',
101
      'javax.management.remote.rmi.RMIJRMPServerImpl',
102
      'javax.management.remote.rmi.RMIServerImpl',
103
      'javax.management.remote.rmi.RMIServerImpl_Stub',
104
      'javax.management.remote.rmi.RMIConnection',
105
      'javax.management.remote.rmi.RMIServer'
106
    ]
107

108
    ref = send_registry_lookup(name: "jmxrmi")
109
    return nil if ref.nil?
110

111
    unless rmi_classes_and_interfaces.include? ref[:object]
112
      vprint_error("JMXRMI discovery returned unexpected object #{ref[:object]}")
113
      return nil
114
    end
115

116
    ref
117
  end
118

119
  def handshake(mbean)
120
    opts = {
121
      object_number: mbean[:object_number],
122
      uid_number: mbean[:uid].number,
123
      uid_time: mbean[:uid].time,
124
      uid_count: mbean[:uid].count
125
    }
126
    send_new_client(opts)
127
  rescue ::Rex::Proto::Rmi::Exception => e
128
    vprint_error("JMXRMI discovery raised an exception of type #{e.message}")
129
    if e.message == 'java.lang.SecurityException'
130
      return false
131
    end
132
    return nil
133
  end
134
end
135

136