Skip to content
HackIndex logo

HackIndex

JMX Enumeration with jmxterm (JMX over RMI)

3 min read Apr 4, 2026

remote-method-guesser (rmg) is a more capable RMI client than the nmap NSE scripts — it handles endpoint redirection, lists bindings with type detail, and can follow a registry reference to the actual RMI server port when they differ. This matters because firewalls often expose the registry port (1099) but block the actual RMI endpoint port that objects redirect to. Use rmg when nmap output is incomplete or empty despite the port being open.

Install rmg

┌──(kali㉿kali)-[~]
└─$ wget https://github.com/qtc-de/remote-method-guesser/releases/latest/download/rmg.jar -O /opt/rmg.jar
┌──(kali㉿kali)-[~]
└─$ alias rmg='java -jar /opt/rmg.jar'
Explain command
https://github.com/qtc-de/remote-method-guesser/releases/latest/download/rmg.jar URL of the remote-method-guesser JAR file to download.
-O /opt/rmg.jar Save downloaded file to the specified output path.
-jar /opt/rmg.jar Tells the JVM to execute the specified JAR file.

List Registry Bindings

┌──(kali㉿kali)-[~]
└─$ rmg enum $TARGET_IP 1099 
[+] RMI registry bound names:
[+]   jmxrmi
[+]     Implementing classes:
[+]       javax.management.remote.rmi.RMIServer
[+]     Endpoint: 10.10.10.50:45231
[+]   HelloService
[+]     Implementing classes:
[+]       com.example.HelloService
[+]     Endpoint: 10.10.10.50:45232
Explain command
$TARGET_IP Target host IP address to connect to.
1099 Target RMI registry port number (default RMI port).

rmg shows the actual endpoint port each binding redirects to. In this example jmxrmi points to port 45231 — this is the port jmxterm needs for the JMX service URL, not the registry port 1099. Confirm that port is reachable before building the URL.

Follow Redirection — Check Endpoint Reachability

┌──(kali㉿kali)-[~]
└─$ rmg lookup $TARGET_IP 1099 jmxrmi 
[+] Bound name jmxrmi is bound to: 10.10.10.50:45231
[+] Endpoint is reachable
Explain command
$TARGET_IP Target host IP address to connect to.
1099 RMI registry port to query on the target host.
jmxrmi RMI registry name/binding to look up on the registry.
┌──(kali㉿kali)-[~]
└─$ nc -zv $TARGET_IP 45231 && echo 'endpoint reachable' || echo 'endpoint blocked' 
Connection to 10.10.10.50 45231 port [tcp/*] succeeded!
endpoint reachable
Explain command
-z Zero-I/O mode; scan without sending data, used for port scanning.
-v Verbose mode; prints connection status and diagnostic info.
$TARGET_IP 45231 Target host and port number to test connectivity against.

Endpoint blocked means you have partial exposure — the registry is reachable but the actual RMI server port is firewalled. You need a pivot or port forward to exploit this further. Endpoint reachable means you can proceed directly to JMX enumeration.

Scan Common RMI/JMX Ports

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 1099,8686,9010,9999,1100,4444,7001,7002 $TARGET_IP --open 
1099/tcp open  rmiregistry Java RMI
8686/tcp open  rmiregistry Java RMI
Explain command
-sV Probe open ports to determine service/version info.
-p 1099,8686,9010,9999,1100,4444,7001,7002 Scan only these specific ports (common RMI/JMX/WebLogic ports).
$TARGET_IP Placeholder for the target host IP address.
--open Show only ports with open state in the results.
┌──(kali㉿kali)-[~]
└─$ rmg enum $TARGET_IP 8686
Explain command
$TARGET_IP Target host IP address to connect to.
8686 Target port number where the RMI registry is listening.

References