1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
|
local nmap = require "nmap"
local rmi = require "rmi"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
description = [[
Connects to a remote RMI registry and attempts to dump all of its
objects.
First it tries to determine the names of all objects bound in the
registry, and then it tries to determine information about the
objects, such as the the class names of the superclasses and
interfaces. This may, depending on what the registry is used for, give
valuable information about the service. E.g, if the app uses JMX (Java
Management eXtensions), you should see an object called "jmxconnector"
on it.
It also gives information about where the objects are located, (marked
with @<ip>:port in the output).
Some apps give away the classpath, which this scripts catches in
so-called "Custom data".
]]
---
-- @usage nmap --script rmi-dumpregistry -p 1098 <host>
-- @output
-- PORT STATE SERVICE REASON
-- 1099/tcp open java-rmi syn-ack
-- | rmi-dumpregistry:
-- | jmxrmi
-- | javax.management.remote.rmi.RMIServerImpl_Stub
-- | @127.0.1.1:40353
-- | extends
-- | java.rmi.server.RemoteStub
-- | extends
-- |_ java.rmi.server.RemoteObject
--
-- @output
-- PORT STATE SERVICE REASON
-- 1099/tcp open java-rmi syn-ack
-- | rmi-dumpregistry:
-- | cfassembler/default
-- | coldfusion.flex.rmi.DataServicesCFProxyServer_Stub
-- | @192.168.0.3:1271
-- | extends
-- | java.rmi.server.RemoteStub
-- | extends
-- | java.rmi.server.RemoteObject
-- | Custom data
-- | Classpath
-- | file:/C:/CFusionMX7/runtime/../lib/ant-launcher.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ant.jar
-- | file:/C:/CFusionMX7/runtime/../lib/axis.jar
-- | file:/C:/CFusionMX7/runtime/../lib/backport-util-concurrent.jar
-- | file:/C:/CFusionMX7/runtime/../lib/bcel.jar
-- | file:/C:/CFusionMX7/runtime/../lib/cdo.jar
-- | file:/C:/CFusionMX7/runtime/../lib/cdohost.jar
-- | file:/C:/CFusionMX7/runtime/../lib/cf4was.jar
-- | file:/C:/CFusionMX7/runtime/../lib/cf4was_ae.jar
-- | file:/C:/CFusionMX7/runtime/../lib/cfmx-ssl.jar
-- | file:/C:/CFusionMX7/runtime/../lib/cfusion.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-beanutils-1.5.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-collections-2.1.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-digester-1.3.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-digester-1.7.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-discovery-0.2.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-discovery.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-logging-1.0.2.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-logging-api-1.0.2.jar
-- | file:/C:/CFusionMX7/runtime/../lib/commons-net-1.2.2.jar
-- | file:/C:/CFusionMX7/runtime/../lib/crystal.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flashgateway.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flashremoting_update.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flex-assemblerservice.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flex-messaging-common.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flex-messaging-opt.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flex-messaging-req.jar
-- | file:/C:/CFusionMX7/runtime/../lib/flex-messaging.jar
-- | file:/C:/CFusionMX7/runtime/../lib/httpclient.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ib61patch.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ib6addonpatch.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ib6core.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ib6swing.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ib6util.jar
-- | file:/C:/CFusionMX7/runtime/../lib/im.jar
-- | file:/C:/CFusionMX7/runtime/../lib/iText.jar
-- | file:/C:/CFusionMX7/runtime/../lib/iTextAsian.jar
-- | file:/C:/CFusionMX7/runtime/../lib/izmado.jar
-- | file:/C:/CFusionMX7/runtime/../lib/jakarta-oro-2.0.6.jar
-- | file:/C:/CFusionMX7/runtime/../lib/java2wsdl.jar
-- | file:/C:/CFusionMX7/runtime/../lib/jaxrpc.jar
-- | file:/C:/CFusionMX7/runtime/../lib/jdom.jar
-- | file:/C:/CFusionMX7/runtime/../lib/jeb.jar
-- | file:/C:/CFusionMX7/runtime/../lib/jintegra.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ldap.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ldapbp.jar
-- | file:/C:/CFusionMX7/runtime/../lib/log4j.jar
-- | file:/C:/CFusionMX7/runtime/../lib/macromedia_drivers.jar
-- | file:/C:/CFusionMX7/runtime/../lib/mail.jar
-- | file:/C:/CFusionMX7/runtime/../lib/msapps.jar
-- | file:/C:/CFusionMX7/runtime/../lib/pbclient42RE.jar
-- | file:/C:/CFusionMX7/runtime/../lib/pbembedded42RE.jar
-- | file:/C:/CFusionMX7/runtime/../lib/pbserver42RE.jar
-- | file:/C:/CFusionMX7/runtime/../lib/pbtools42RE.jar
-- | file:/C:/CFusionMX7/runtime/../lib/poi-2.5.1-final-20040804.jar
-- | file:/C:/CFusionMX7/runtime/../lib/poi-contrib-2.5.1-final-20040804.jar
-- | file:/C:/CFusionMX7/runtime/../lib/ri_generic.jar
-- | file:/C:/CFusionMX7/runtime/../lib/saaj.jar
-- | file:/C:/CFusionMX7/runtime/../lib/smack.jar
-- | file:/C:/CFusionMX7/runtime/../lib/smpp.jar
-- | file:/C:/CFusionMX7/runtime/../lib/STComm.jar
-- | file:/C:/CFusionMX7/runtime/../lib/tools.jar
-- | file:/C:/CFusionMX7/runtime/../lib/tt-bytecode.jar
-- | file:/C:/CFusionMX7/runtime/../lib/vadmin.jar
-- | file:/C:/CFusionMX7/runtime/../lib/verity.jar
-- | file:/C:/CFusionMX7/runtime/../lib/vparametric.jar
-- | file:/C:/CFusionMX7/runtime/../lib/vsearch.jar
-- | file:/C:/CFusionMX7/runtime/../lib/wc50.jar
-- | file:/C:/CFusionMX7/runtime/../lib/webchartsJava2D.jar
-- | file:/C:/CFusionMX7/runtime/../lib/wsdl2java.jar
-- | file:/C:/CFusionMX7/runtime/../lib/wsdl4j-1.5.1.jar
-- | file:/C:/CFusionMX7/runtime/../lib/wsdl4j.jar
-- | file:/C:/CFusionMX7/runtime/../lib/xalan.jar
-- | file:/C:/CFusionMX7/runtime/../lib/xercesImpl.jar
-- | file:/C:/CFusionMX7/runtime/../lib/xml-apis.jar
-- | file:/C:/CFusionMX7/runtime/../lib/
-- | file:/C:/CFusionMX7/runtime/../gateway/lib/examples.jar
-- | file:/C:/CFusionMX7/runtime/../gateway/lib/
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/batik-awt-util.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/batik-css.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/batik-ext.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/batik-transcoder.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/batik-util.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/commons-discovery.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/commons-logging.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/concurrent.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/flex.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/jakarta-oro-2.0.7.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/jcert.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/jnet.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/jsse.jar
-- | file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/oscache.jar
-- |_ file:/C:/CFusionMX7/runtime/../wwwroot/WEB-INF/cfform/jars/
--
--
--@version 0.5
author = "Martin Holst Swende"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}
portrule = shortport.port_or_service({1098, 1099, 1090, 8901, 8902, 8903}, {"java-rmi", "rmiregistry"})
-- Some lazy shortcuts
local function dbg(str,...)
stdnse.debug3("RMI-DUMPREG:"..str, ...)
end
local function dbg_err(str, ... )
stdnse.debug1("RMI-DUMPREG-ERR:"..str, ...)
end
-- Function to split a string
local function split(str, sep)
local sep, fields = sep or "; ", {}
local pattern = string.format("([^%s]+)", sep)
str:gsub(pattern, function(c) fields[#fields+1] = c end)
return fields
end
--This is a customData formatter. In some cases, the RMI library finds 'custom data' which belongs to an object.
-- This data is not handled correctly, instead, the data is dumped in the objects customData field (which is a table with strings)
-- The RMI library does not do anything more than that - however, here in the land of rmi-dumpregistry land, we may have
-- more knowledge about how to interpret that data.
-- In the wild, coldfusion.flex.rmi.DataServicesCFProxyServer_Stub e.g discloses the classpath in this variable. This method looks at
-- the contents of the custom data. if it looks like a class path, we display it as such. This method is passed to the toTable() method
-- of the returned RMI object.
-- @return title, data
function customDataFormatter(className, customData)
if customData == nil then return nil end
if #customData == 0 then return nil end
local retData = {}
for k,v in ipairs(customData) do
if v:find("file:/") == 1 then
-- This is a classpath
local cp = split(v, "; ") -- Splits into table
table.insert(retData, "Classpath")
table.insert(retData, cp)
else
table.insert(retData[v])
end
end
return "Custom data", retData
end
function action(host,port, args)
local registry = rmi.Registry:new( host, port )
local status, j_array = registry:list()
local output = {}
if not status then
table.insert(output, ("Registry listing failed (%s)"):format(tostring(j_array)))
return stdnse.format_output(false, output)
end
-- It's definitely RMI!
port.version.name = 'java-rmi'
port.version.product = 'Java RMI Registry'
nmap.set_port_version(host,port)
-- Monkey patch the java-class in rmi, to set our own custom data formatter
-- for classpaths
rmi.JavaClass.customDataFormatter = customDataFormatter
-- We expect an array of strings to be the return data
local data = j_array:getValues()
for i,name in ipairs( data ) do
--print(data)
table.insert(output, name)
dbg("Querying object %s", name)
local status, j_object = registry:lookup(name)
if status then
table.insert(output, j_object:toTable())
end
end
return stdnse.format_output(true, output)
end
|
