> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/enumeration/port-1098-1099-pentesting-java-rmi.md).

# Port 1098/1099- Pentesting Java RMI

### Enumeration

```bash
msf> use auxiliary/scanner/misc/java_rmi_server
msf> use auxiliary/gather/java_rmi_registry
nmap -sV --script "rmi-dumpregistry or rmi-vuln-classloader" -p <PORT> <IP>
```

### Remote Method Guesser

```bash
# remote-method-guesser
# https://github.com/qtc-de/remote-method-guesser

java -jar rmg-3.0.0-jar-with-dependencies.jar 192.168.1.11 1098 enum
```

### Exploitation

<https://github.com/BishopFox/rmiscout> to explore and try to find RCE vulnerabilities.\
<https://github.com/NickstaDB/BaRMIe> to enumerate and attack

```
$ java -jar BaRMIe.jar -enum 192.168.1.11 1098
$ java -jar BaRMIe.jar -attack 192.168.1.11 1098
```

<https://github.com/siberas/sjet> allows an easy exploitation of insecure configured JMX services (I tried and It gave me `Error: Can't connect to remote service` let me know if you know how to fix this issue).