// Simple JMX scanner extracting data (IP:Port) from RMI Registry and verifying RCE (using MLet) exploitability without credentials.
// Version: 0.1
// Sample use of: https://rabobank.jobs/en/techblog/security-risk-infrastructure/jmx-the-best-buddy-of-every-red-teamer-marcin-wolak/
// Author: Marcin Wolak
// LinkedIn: https://www.linkedin.com/in/marcinwolak/
// Medium: https://marcin-wolak.medium.com/
// Github: https://github.com/marcin-wolak/
// Tested successfuly against JMX enabled on Java x64:
// Java(TM) SE Runtime Environment (build 1.7.0_80-b15) on Windows 10
// Java(TM) SE Runtime Environment (build 1.8.0_202-b08) on Windows 10
// Java(TM) SE Runtime Environment (build 9.0.4+11) on Windows 10
// OpenJDK Runtime Environment (build 11.0.17+8-post-Ubuntu-1ubuntu222.04)
// OpenJDK Runtime Environment (build 17.0.5+8-Debian-2)

import java.net.*;
import java.io.InputStream;
import java.io.OutputStream;
import java.lang.System;
import java.util.*;
import java.io.DataInputStream;
import java.io.ByteArrayInputStream;

import org.apache.commons.cli.CommandLine;
import org.apache.commons.cli.Option;
import org.apache.commons.cli.Options;
import org.apache.commons.cli.OptionBuilder;
import org.apache.commons.cli.CommandLineParser;
import org.apache.commons.cli.DefaultParser;
import org.apache.commons.cli.ParseException;
import org.apache.commons.cli.HelpFormatter;


public class SimpleRmiDiscoverer {

// IP Address of the RMI Registry to query (CMD Parameter)
private String regIP;
// TCP Port of the RMI Registry to query (CMD Parameter)
private int regPort;
// Ignore endpoint from RMI Registry to verify exploitability without credentials. Use instead IP of the registry itself and dynamic TCP port from the registry dump (CMD Parameter)
private boolean ignoreEndpoint;
// Extract Host:Port from the RMI Registry without checking RCE exploitability without credentials (CMD Parameter)
private boolean dumpOnly;

// IP Address and TCP port for the endpoint exposed via RMI Registry
private String endPIP;
private int endPPort;

// Sockets for communication with RMI Registry and exposed endpoint
private Socket regS;
private Socket endPS;

//Streams for communication via above sockets
private InputStream in, inEndP;
private OutputStream out, outEndP;

// RMI Handshake data
private byte[] hShake1 ={0x4A,0x52,0x4D,0x49,0x00,0x02,0x4B};
private byte[] hShake2 ={0x00,0x09,0x31,0x32,0x37,0x2E,0x30,0x2E,0x30,0x2E,0x31,0x00,0x00,0x00,0x00};

// Calling Obj
private byte[] hObj ={0x50,(byte)0xac,(byte)0xed,0x00,0x05,0x77,0x22,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x44,0x15,0x4d,(byte)0xc9,(byte)0xd4,(byte)0xe6,0x3b,(byte)0xdf,0x74,0x00,0x06,0x6a,0x6d,0x78,0x72,0x6d,0x69};


//Pattern to find in dumped registry (UnicastRef)
private byte[] ucRef = {0x55,0x6e,0x69,0x63,0x61,0x73,0x74,0x52,0x65,0x66};

//Pattern to find in exception dump (Credentials required)
private byte[] credReq = {(byte)0x43,(byte)0x72,(byte)0x65,(byte)0x64,(byte)0x65,(byte)0x6e,(byte)0x74,(byte)0x69,(byte)0x61,(byte)0x6c,(byte)0x73,(byte)0x20,(byte)0x72,(byte)0x65,(byte)0x71,(byte)0x75,(byte)0x69,(byte)0x72,(byte)0x65,(byte)0x64};

// Calling Obj (after modification) on the dynamic port  
private byte[] hDObj ={(byte)0x50,(byte)0xac,(byte)0xed,(byte)0x00,(byte)0x05,(byte)0x77,(byte)0x22,(byte)0x6d,(byte)0xf9,(byte)0xa5,(byte)0x39,(byte)0xb4,(byte)0xfa,(byte)0x06,(byte)0xc3,(byte)0xea,(byte)0x8e,(byte)0xa7,(byte)0x0e,(byte)0x00,(byte)0x00,(byte)0x01,(byte)0x85,(byte)0x06,(byte)0x13,(byte)0xa1,(byte)0x4d,(byte)0x80,(byte)0x01,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xff,(byte)0xf0,(byte)0xe0,(byte)0x74,(byte)0xea,(byte)0xad,(byte)0x0c,(byte)0xae,(byte)0xa8,(byte)0x70};

private String endpIP;
private short enpPort;

//javax.management.remote.rmi.RMIServerImpl_Stub object details collected from RMI registry:
private byte[] rmiStub;
int rmiStubLength;
int eIPlength;
byte [] eIP;
byte [] ePort;

// Constructor. Parameter dumps determines if only dynamic endpoint should be extracted from RMI Registry without checking if JMX is username/password protected
// Ignore detrmines if the IP of endpoint extracted from registry should be ignored and the IP of RMI Registry used instead
public SimpleRmiDiscoverer(String rIP, int rPort, boolean ignore, boolean dump) {
    regPort = rPort;
    regIP = rIP;
    rmiStub = new byte[4096];
    ignoreEndpoint = ignore;
                dumpOnly = dump;
}

// findArray taken from: https://stackoverflow.com/questions/3940194/find-an-array-inside-another-larger-array
    public int findArray(byte[] largeArray, byte[] subArray) {

        /* If any of the arrays is empty then not found */
        if (largeArray.length == 0 || subArray.length == 0) {
            return -1;
        }

        /* If subarray is larger than large array then not found */
        if (subArray.length > largeArray.length) {
            return -1;
        }

        for (int i = 0; i < largeArray.length; i++) {
            /* Check if the next element of large array is the same as the first element of subarray */
            if (largeArray[i] == subArray[0]) {

                boolean subArrayFound = true;
                for (int j = 0; j < subArray.length; j++) {
                    /* If outside of large array or elements not equal then leave the loop */
                    if (largeArray.length <= i+j || subArray[j] != largeArray[i+j]) {
                        subArrayFound = false;
                        break;
                    }
                }

                /* Sub array found - return its index */
                if (subArrayFound) {
                    return i;
                }

            }
        }

        /* Return default value */
        return -1;
    }

// Connecting to RMI Registry using IP/TCP pair from CLI 
private int connectRegistry()
{
  try {
    //System.out.println("IP: " + regIP);
    regS = new Socket(regIP, regPort);
    in = this.regS.getInputStream();
          out = this.regS.getOutputStream();
  }
  catch (Exception e) {
    System.out.println("[!] Cannot connect to RMI Registry.");
    //e.printStackTrace();
    return 0;
        }
        return 1;
}

// RMI handshake. Common function for handshaking with RMI Registry as well as the endpoint extracted from it 
private int rmiHandShake(InputStream inP, OutputStream outP)
{
  byte [] buffer = new byte[4096];
  try {
    outP.write(hShake1, 0, hShake1.length);
    int count = inP.read(buffer);
    if(count==0)
    {
      System.out.println("[!] Handshake failed, no date received. Likely not RMI.");
      return -1;
    }
    else
    {
      if(buffer[0]!=0x4E)
      {
         System.out.println("[!] Handshake failed, bad response. Likely not RMI.");
      return -2;
      }
      outP.write(hShake2, 0, hShake2.length);
    }
  }
  catch (Exception e) {
    System.out.println("[!] Handshake failed, Error in RMI Communication.");
              //e.printStackTrace();
              return 0;
        }
  return 1;
}

// Invoking RMIServerImpl_Stub over RMI Registry
private int invokeObject()
{
  try {
    out.write(hObj, 0, hObj.length);
    int rmiStubLength = in.read(rmiStub);
    if(rmiStubLength==0)
    {
      System.out.println("[-] RMIServerImpl_Stub invocation against RMI Registry failed, no response!");
      return -1;
    }
    //String s = new String(rmiStub);
    //System.out.println(s);
    //Findinf "UnicastRef" in the response from RMI Registry:
    int unipos = findArray(rmiStub, ucRef);
    if(unipos<1)
    {
     System.out.println("[-] RMIServerImpl_Stub invocation against RMI Registry failed, Malformed registry dump.");
     return -2;
    }
    //else
    // System.out.println("\nThe position is: " + unipos);
    eIPlength = (int) rmiStub[unipos+11];
    //System.out.println("\nLength of eIP is: " + eIPlength);
    eIP = Arrays.copyOfRange(rmiStub,unipos+12,unipos+12+eIPlength);
    endPIP = new String(eIP);
    //System.out.println("\nThe eIP is: " + endPIP);
    ePort = Arrays.copyOfRange(rmiStub,unipos+12+eIPlength,unipos+16+eIPlength);
    DataInputStream inputStream = new DataInputStream(new ByteArrayInputStream(ePort));
    endPPort = inputStream.readInt();
    //System.out.println(endPPort);
    //System.out.println("\nThe ePort is: " + Integer.valueOf(new String(ePort)));
  }
  catch (Exception e) {
    System.out.println("[-] RMIServerImpl_Stub invocation against RMI Registry failed, Other Error.");
              // e.printStackTrace();
              return 0;
        }
  return 1;
}

// Connecting to the endpoint extracted from RMI registry or (when ignore option active) to RMI Registry IP and TCP port extracted from this Registry.
private int connectEndPoint(boolean ignoreEndPoint)
{
  try {
    //System.out.println("End Point IP: " + endPIP);
    //System.out.println("End Point Port: " + endPPort);
    System.out.println("[+] Connecting to the dynamic Endpoint ... ");
    if(!ignoreEndPoint){
      endPS = new Socket(endPIP, endPPort);
    }
    else
    {
      System.out.println("[+] Ignoring the endpoint exposed on: " + endPIP);
      System.out.println("[+] Connecting instead to: " + regIP + " on TCP Port:" + Integer.toString(endPPort));
      endPS = new Socket(regIP, endPPort);
    }
    inEndP = this.endPS.getInputStream();
          outEndP = this.endPS.getOutputStream();
  }
  catch (Exception e) {
            // e.printStackTrace();
            System.out.println("[-] Connection to the dynamic Endpoint failed!");
            return 0;
        }
        System.out.println("[+] Dynamic Endpoint connected successfuly!");
        return 1;
}

// Invoking RMIServerImpl_Stub over the endpoint extracted from RMI registry or (when ignore option active) over RMI Registry IP and TCP port extracted from this Registry.
private int invokeDObject()
{
  int unipos = findArray(rmiStub, ucRef);
  System.arraycopy(rmiStub, unipos + 16 + endPIP.length(), hDObj, 7, 8);
  System.arraycopy(rmiStub, 8, hDObj, 15, 4);
  System.arraycopy(rmiStub, 16, hDObj, 23, 4);
  byte [] buffer = new byte[4096];
  try {
    outEndP.write(hDObj, 0, hDObj.length);
    int dStubLength = inEndP.read(buffer);
    if(dStubLength==0)
    {
      System.out.println("[-] Invoking RMIServerImpl_Stub on the dynamic Endpoint failed, no response.");
      return -1;
    }
    String s = new String(buffer);
    if(s.contains("Credentials required")){
      System.out.println("[-] Dynamic Enpoint requires credentials (username and password).");
    }
    else if(s.contains("UnicastRef")){
      System.out.println("[+] Dynamic Enpoint is VULNERABLE to RCE, NO username and password required.");
    }
    else {
      System.out.println("[-] Unknown outcome from invoking RMIServerImpl_Stub on the dynamic Endpoint. See below:");
      System.out.println(s);
    }
  }
  catch (Exception e) {
    e.printStackTrace();
              return 0;
        }
  return 1;
}

private void closeSocket(Socket inSock){
    
    try{
          inSock.close();}
          catch (Exception e) {
                //e.printStackTrace();
              }

}

public static void main(String[] args) throws Exception{

  boolean ignore=false;
  boolean donly=false;
  String IP = "";
  long Port = 1099;
  Options options = new Options();
  options.addOption("h", "help", false, "Prints help for the tool.");
  options.addOption("i", "ignore", false, "Uses RMI registry IP for methods invocations. Ignores endpoint from the Registry dump.");
  options.addOption("d", "dumponly", false, "Extracting endpoint <host:port> from RMI Registry without checking exploitabilty, which is by default checked.");
  options.addOption(OptionBuilder.withLongOpt("host").withDescription("IP of RMI Registry to query.").hasArg().withArgName("RMI HOST IP ").isRequired().create("H"));
  options.addOption(OptionBuilder.withLongOpt("port").withDescription("TCP port of RMI Registry to query.").hasArg().withArgName("RMI HOST TCP PORT ").isRequired().create("P"));
  //options.addOption("H", "--host", false, "IP of RMI Registry to query.");
  //options.addOption("P", "--port", false, "TCP port of RMI Registry.");
  CommandLineParser parser = new DefaultParser();
  
  String header = "SimpleRmiDiscoverer extracts JMX host:port endpoint from RMI registry and checks if is exploitable without credentials using MLet.\n\n";
        String footer = "\nPlease check my Blog for more details: https://marcin-wolak.medium.com/";

   HelpFormatter formatter = new HelpFormatter();
   
  
  try {
        CommandLine cmd = parser.parse(options, args);
        if (cmd.hasOption("h")) {
        formatter.printHelp("SimpleRmiDiscoverer", header, options, footer, true);
        System.exit(0);
      }
      if (cmd.hasOption("i")) {
        ignore = true;
      }
      if (cmd.hasOption("d")) {
        donly = true;
      }
      if (cmd.hasOption("H")) {
        IP = cmd.getOptionValue("H");
      }
      if (cmd.hasOption("P")) {
        try {
          Port = Long.valueOf(cmd.getOptionValue("P")); }
        catch (Exception e){
          System.out.println(e.getMessage());
          System.out.println("[!] Parameter -P --port must be a number between 1 and 65535!\n\n");
          formatter.printHelp("SimpleRmiDiscoverer", header, options, footer, true);
          System.exit(1);
        }
        if(Port<0 || Port>65535){
          System.out.println("[!] Parameter -P --port out of range!\n\n");
          formatter.printHelp("SimpleRmiDiscoverer", header, options, footer, true);
          System.exit(0);
        }
        
      }
      
    } catch (ParseException e){
      System.out.println(e.getMessage());
      formatter.printHelp("SimpleRmiDiscoverer", header, options, footer, true);
      System.exit(1);
    
  }

  System.out.println("[+] Approached RMI Registry IP: " + IP);
  System.out.println("[+] Approached RMI Registry TCP Port: " + Port);
  
  SimpleRmiDiscoverer sRD = new SimpleRmiDiscoverer(IP, (int) Port, ignore, donly);
  sRD.start();
    }
    
public int start() {
        // can now access non-static fields
        int isConnected = connectRegistry();
        if(isConnected == 0){
          System.out.println("[-] Aborting Connection to RMI Registry! Quiting!");
          closeSocket(regS);
          return -1;
        }
        int isHShaked = rmiHandShake(in,out);
        if(isHShaked != 1){
          System.out.println("[-] Aborting handShaking with RMI Registry! Quiting!");
          closeSocket(regS);
          return -2;
        }
        int isInvoked = invokeObject();
        if(isInvoked != 1){
          System.out.println("[-] Object Calling Error, RMI Registry! Quiting");
          closeSocket(regS);
          return -2;
        }
        
        System.out.println("[+] RMI Registry contacted successfuly!");
        System.out.println("[+] Extracted Endpoint Name / IP Address: " + endPIP);
        System.out.println("[+] Extracted Endpoint Dynamic TCP Port: " + endPPort);
        
        closeSocket(regS);
        
        if(dumpOnly)
        {
          System.out.println("[+] RMI Registry Dump Completed Successfuly!");
          System.exit(0);
        }
        
        int isEConnected = connectEndPoint(ignoreEndpoint);
        if(isEConnected != 1){
          System.out.println("[-] Aborting!");
          closeSocket(endPS);
          return -3;
        }
        isHShaked = rmiHandShake(inEndP, outEndP);
        if(isHShaked != 1){
          System.out.println("[-] Cannot handShake with the dynamic Endpoint!");
          closeSocket(endPS);
          return -2;
        }
        int isDInvoked = invokeDObject();
        if(isDInvoked != 1){
          System.out.println("[-] Cannot Invoke RMIServerImpl_Stub on the dynamic Endpoint!");
          closeSocket(endPS);
          return -4;
        }
        closeSocket(endPS);
        return 1;
    }
    
}