# Java RMI with rmg (Remote Method Guesser)

- **URL:** https://hackindex.io/services/java-rmi-jmx/enumeration/java-rmi-with-rmg-remote-method-guesser
- **Path:** Java RMI / JMX > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-04-04

## rmg RMI Enumeration

JMX (Java Management Extensions) exposes Java application internals through MBeans: managed objects that provide attributes and operations for monitoring and control. When JMX runs over RMI without authentication, any client can connect, list all MBeans, read runtime attributes, and invoke management operations. jmxterm is an interactive CLI client that handles this cleanly. Get the JMX endpoint port from [rmg lookup](https://hackindex.io/services/java-rmi-jmx/enumeration/java-rmi-with-rmg-remote-method-guesser) before connecting.

- Install jmxterm
- Build JMX Service URL and Connect
- List Domains and MBeans
- Read JVM Runtime Attributes
- Check for DiagnosticCommand MBean

## Install jmxterm

```bash
wget https://github.com/jiaqi/jmxterm/releases/latest/download/jmxterm-uber.jar -O /opt/jmxterm.jar
alias jmxterm='java -jar /opt/jmxterm.jar'
```

## Build JMX Service URL and Connect

The standard JMX-over-RMI URL uses the registry port for JNDI lookup. If rmg showed a different endpoint port, use that in the URL instead:

```bash
java -jar /opt/jmxterm.jar
# Welcome to JMX terminal. Type "help" for available commands.
```

```
open service:jmx:rmi:///jndi/rmi://10.10.10.50:1099/jmxrmi
```

```bash
# Non-interactive one-liner for scripting
echo 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans\nquit' | java -jar /opt/jmxterm.jar
```

A successful connection without a password prompt confirms unauthenticated JMX access. Move to [unauthenticated access assessment](https://hackindex.io/services/java-rmi-jmx/vulnerability-discovery/jmx-unauthenticated-access). An auth error confirms JMX is present but gated: note the exact URL for credential testing later.

## List Domains and MBeans

Inside jmxterm after connecting:

```
domains
beans
```

```bash
echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\ndomains\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null
# #domains
# java.lang
# java.util.logging
# com.sun.management
# Catalina
# Users
```

Domain names reveal the application stack immediately. `Catalina` means Tomcat is running. `Users` domain often appears in application servers with user management MBeans. `com.sun.management` exposes JVM internals including the DiagnosticCommand MBean which enables OS command execution.

## Read JVM Runtime Attributes

Confirm access and extract JVM information from the java.lang domain:

```
bean java.lang:type=Runtime
get Name
get VmVendor
get VmVersion
get ClassPath
get SystemProperties
```

```bash
echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbean java.lang:type=Runtime\nget Name\nget VmVersion\nget ClassPath\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null
# #Name = 1234@target-server
# #VmVersion = 11.0.8
# #ClassPath = /opt/tomcat/bin/bootstrap.jar:/opt/tomcat/bin/tomcat-juli.jar
```

The PID in the Name attribute, the JVM version, and classpath all help identify the exact application and confirm code execution context. Classpath entries reveal install paths useful for file read targeting.

## Check for DiagnosticCommand MBean

The DiagnosticCommand MBean is the highest-value finding: it exposes a `vmCommand` operation that can execute JVM diagnostic commands and sometimes arbitrary OS commands:

```
bean com.sun.management:type=DiagnosticCommand
info
```

```bash
echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans -d com.sun.management\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null
# com.sun.management:type=DiagnosticCommand
# com.sun.management:type=HotSpotDiagnostic
```

## References

- [jmxterm](https://github.com/jiaqi/jmxterm) - Interactive CLI JMX client: open, domains, beans, get commands