Module: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server

Includes:
Builder, Parser
Included in:
Msf::Exploit::Remote::Java::Rmi::Client::Jmx
Defined in:
lib/msf/core/exploit/remote/java/rmi/client/jmx/server.rb,
lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser.rb,
lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder.rb

Defined Under Namespace

Modules: Builder, Parser

Instance Method Summary collapse

Methods included from Parser

#parse_jmx_new_client_endpoint

Methods included from Builder

#build_jmx_new_client, #build_jmx_new_client_args

Instance Method Details

#send_new_client(opts = {}) ⇒ Hash, NilClass

Sends a call to the JMXRMI endpoint to retrieve an MBean instance. Simulates a call to the Java javax/management/remote/rmi/RMIServer_Stub#newClient() method.

Parameters:

  • opts (Hash) (defaults to: {})

Options Hash (opts):

  • :sock (Rex::Socket::Tcp)

Returns:

  • (Hash, NilClass) —

    The connection information if success, nil otherwise

Raises:

See Also:

  • Registry::Builder.build_jmx_new_client


24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/msf/core/exploit/remote/java/rmi/client/jmx/server.rb', line 24

def send_new_client(opts = {})
  send_call(
    sock: opts[:sock] || sock,
    call: build_jmx_new_client(opts)
  )

  return_value = recv_return(
    sock: opts[:sock] || sock
  )

  if return_value.nil?
    return nil
  end

  if return_value.is_exception?
    raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name
  end

  remote_object = return_value.get_class_name

  unless remote_object && remote_object == 'javax.management.remote.rmi.RMIConnectionImpl_Stub'
    return nil
  end

  reference = parse_jmx_new_client_endpoint(return_value)

  reference
end