Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ERROR] RMI Activation Server detected. Re-run with --activation-server #12

Open
dinosn opened this issue Apr 18, 2021 · 0 comments
Open

Comments

@dinosn
Copy link

dinosn commented Apr 18, 2021

Hi, whilst trying to run the latest release I'm constantly receiving the following error

[ERROR] RMI Activation Server detected. Re-run with --activation-server

[ rmiscout]# rmiscout wordlist -i lists/prototypes.txt server port --activation-server
[INFO] No registry specified. Attempting operation on all available registries...
[ERROR] RMI Activation Server detected. Re-run with --activation-server

Barmie will detect the endpoints:

RMI Registry at server:port
Objects exposed: 3
Object 1
  Name: ABCD/7676/jmxrmi
  Endpoint: server:port1
  Classes: 3
    Class 1
      Classname: javax.management.remote.rmi.RMIServerImpl_Stub
    Class 2
      Classname: java.rmi.server.RemoteStub
    Class 3
      Classname: java.rmi.server.RemoteObject
Object 2
  Name: management/rmi-jmx-connector
  Endpoint: server:port2
  Classes: 3
    Class 4
      Classname: javax.management.remote.rmi.RMIServerImpl_Stub
    Class 5
      Classname: java.rmi.server.RemoteStub
    Class 6
      Classname: java.rmi.server.RemoteObject
Object 3
  Name: jmxrmi
  Endpoint: server:port3
  Classes: 3
    Class 7
      Classname: javax.management.remote.rmi.RMIServerImpl_Stub
    Class 8
      Classname: java.rmi.server.RemoteStub
    Class 9
      Classname: java.rmi.server.RemoteObject

2 potential attacks identified (+++ = more reliable)
[--+] JMX Deserialization
[---] Java RMI registry illegal bind deserialization

0 deserialization gadgets found on leaked CLASSPATH
[~] Gadgets may still be present despite CLASSPATH not being leaked

Successfully scanned 1 target(s) for objects exposed via RMI.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant