Skip to content
HackIndex logo

HackIndex

Java RMI with rmg (Remote Method Guesser)

3 min read Apr 4, 2026

JMX (Java Management Extensions) exposes Java application internals through MBeans — managed objects that provide attributes and operations for monitoring and control. When JMX runs over RMI without authentication, any client can connect, list all MBeans, read runtime attributes, and invoke management operations. jmxterm is an interactive CLI client that handles this cleanly. Get the JMX endpoint port from rmg lookup before connecting.

Install jmxterm

┌──(kali㉿kali)-[~]
└─$ wget https://github.com/jiaqi/jmxterm/releases/latest/download/jmxterm-uber.jar -O /opt/jmxterm.jar
┌──(kali㉿kali)-[~]
└─$ alias jmxterm='java -jar /opt/jmxterm.jar'
Explain command
https://github.com/jiaqi/jmxterm/releases/latest/download/jmxterm-uber.jar URL of the jmxterm uber JAR to download from GitHub releases.
-O /opt/jmxterm.jar Save downloaded file to specified path instead of default filename.
java -jar /opt/jmxterm.jar Command aliased to 'jmxterm' for launching the jmxterm JAR.

Build JMX Service URL and Connect

The standard JMX-over-RMI URL uses the registry port for JNDI lookup. If rmg showed a different endpoint port, use that in the URL instead:

┌──(kali㉿kali)-[~]
└─$ java -jar /opt/jmxterm.jar 
Welcome to JMX terminal. Type "help" for available commands.
open service:jmx:rmi:///jndi/rmi://10.10.10.50:1099/jmxrmi
┌──(kali㉿kali)-[~]
└─$ # Non-interactive one-liner for scripting
┌──(kali㉿kali)-[~]
└─$ echo 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans\nquit' | java -jar /opt/jmxterm.jar
Explain command
$TARGET_IP:1099 Target host and RMI registry port for JMX connection.
-jar /opt/jmxterm.jar Executes the specified JAR file as the main application.

A successful connection without a password prompt confirms unauthenticated JMX access. Move to unauthenticated access assessment. An auth error confirms JMX is present but gated — note the exact URL for credential testing later.

List Domains and MBeans

Inside jmxterm after connecting:

domains
beans
┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\ndomains\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null 
#domains
java.lang
java.util.logging
com.sun.management
Catalina
Users
Explain command
-e Enable interpretation of backslash escape sequences in the string.
$TARGET_IP:1099 Placeholder for target IP and JMX RMI registry port 1099.
-jar Instructs the JVM to execute the specified JAR file as the main program.
2>/dev/null Redirects stderr to /dev/null to suppress error output.

Domain names reveal the application stack immediately. Catalina means Tomcat is running. Users domain often appears in application servers with user management MBeans. com.sun.management exposes JVM internals including the DiagnosticCommand MBean which enables OS command execution.

Read JVM Runtime Attributes

Confirm access and extract JVM information from the java.lang domain:

bean java.lang:type=Runtime
get Name
get VmVendor
get VmVersion
get ClassPath
get SystemProperties
┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbean java.lang:type=Runtime\nget Name\nget VmVersion\nget ClassPath\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null 
#Name = 1234@target-server
#VmVersion = 11.0.8
#ClassPath = /opt/tomcat/bin/bootstrap.jar:/opt/tomcat/bin/tomcat-juli.jar
Explain command
-e Enable interpretation of backslash escape sequences in echo.
$TARGET_IP:1099 Placeholder for target host and JMX RMI registry port.
-jar Execute the specified JAR file as the main Java application.
/opt/jmxterm.jar Path to the JMXterm interactive JMX client JAR.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.

The PID in the Name attribute, the JVM version, and classpath all help identify the exact application and confirm code execution context. Classpath entries reveal install paths useful for file read targeting.

Check for DiagnosticCommand MBean

The DiagnosticCommand MBean is the highest-value finding — it exposes a vmCommand operation that can execute JVM diagnostic commands and sometimes arbitrary OS commands:

bean com.sun.management:type=DiagnosticCommand
info
┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans -d com.sun.management\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null 
com.sun.management:type=DiagnosticCommand
com.sun.management:type=HotSpotDiagnostic
Explain command
-e Enable interpretation of backslash escape sequences in the string.
$TARGET_IP:1099 Target host and RMI registry port for the JMX RMI connection.
-jar Execute the specified JAR file as the main Java application.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.

References