# JMX Enumeration with jmxterm (JMX over RMI)

- **URL:** https://hackindex.io/services/java-rmi-jmx/enumeration/jmx-enumeration-with-jmxterm-jmx-over-rmi
- **Path:** Java RMI / JMX > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-04-04

remote-method-guesser (rmg) is a more capable RMI client than the nmap NSE scripts: it handles endpoint redirection, lists bindings with type detail, and can follow a registry reference to the actual RMI server port when they differ. This matters because firewalls often expose the registry port (1099) but block the actual RMI endpoint port that objects redirect to. Use rmg when nmap output is incomplete or empty despite the port being open.

- Install rmg
- List Registry Bindings
- Follow Redirection: Check Endpoint Reachability
- Scan Common RMI/JMX Ports

## Install rmg

```bash
wget https://github.com/qtc-de/remote-method-guesser/releases/latest/download/rmg.jar -O /opt/rmg.jar
alias rmg='java -jar /opt/rmg.jar'
```

## List Registry Bindings

```bash
rmg enum $TARGET_IP 1099
# [+] RMI registry bound names:
# [+]   jmxrmi
# [+]     Implementing classes:
# [+]       javax.management.remote.rmi.RMIServer
# [+]     Endpoint: 10.10.10.50:45231
# [+]   HelloService
# [+]     Implementing classes:
# [+]       com.example.HelloService
# [+]     Endpoint: 10.10.10.50:45232
```

rmg shows the actual endpoint port each binding redirects to. In this example jmxrmi points to port 45231: this is the port jmxterm needs for the JMX service URL, not the registry port 1099. Confirm that port is reachable before building the URL.

## Follow Redirection: Check Endpoint Reachability

```bash
rmg lookup $TARGET_IP 1099 jmxrmi
# [+] Bound name jmxrmi is bound to: 10.10.10.50:45231
# [+] Endpoint is reachable
```

```bash
nc -zv $TARGET_IP 45231 && echo 'endpoint reachable' || echo 'endpoint blocked'
# Connection to 10.10.10.50 45231 port [tcp/*] succeeded!
# endpoint reachable
```

Endpoint blocked means you have partial exposure: the registry is reachable but the actual RMI server port is firewalled. You need a pivot or port forward to exploit this further. Endpoint reachable means you can proceed directly to [JMX enumeration](https://hackindex.io/services/java-rmi-jmx/enumeration/jmx-enumeration-with-jmxterm-jmx-over-rmi).

## Scan Common RMI/JMX Ports

```bash
nmap -sV -p 1099,8686,9010,9999,1100,4444,7001,7002 $TARGET_IP --open
# 1099/tcp open  rmiregistry Java RMI
# 8686/tcp open  rmiregistry Java RMI
```

```bash
rmg enum $TARGET_IP 8686
```

> [!WARNING]
> rmg has vulnerability scanning and exploitation capabilities beyond registry enumeration. Keep usage to enum and lookup commands when operating under OSCP or other exam constraints.

## References

- [remote-method-guesser (rmg)](https://github.com/qtc-de/remote-method-guesser) - RMI enumeration, lookup, and endpoint reachability checking