BishopFox / rmiscout

RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities
https://labs.bishopfox.com/tech-blog/rmiscout
MIT License
420 stars 60 forks source link

Build the project manually #2

Closed alt3kx closed 4 years ago

alt3kx commented 4 years ago

1. # export JAVA_TOOL_OPTIONS="-Dhttps.protocols=TLSv1.2" <-- to fix the HTTPS issues 2. rmiscout# ./gradlew shadowJar <-- to be checked the following errors Picked up JAVA_TOOL_OPTIONS: -Dhttps.protocols=TLSv1.2

FAILURE: Build failed with an exception.

Deprecated Gradle features were used in this build, making it incompatible with Gradle 5.0. Use '--warning-mode all' to show the individual deprecation warnings. See https://docs.gradle.org/4.10.3/userguide/command_line_interface.html#sec:command_line_warnings

BUILD FAILED in 0s

the-bumble commented 4 years ago

Hi alt3kx,

Hmmm... I'm not able to reproduce this one (I tried a variety of JDK versions). It appears the JDK configuration you are using is not enabling TLSv1.2 by default or has been modified. As best I understand, it's been the default for a while (https://blogs.oracle.com/java-platform-group/jdk-8-will-use-tls-12-as-default). See: https://github.com/gradle/gradle/issues/5940. It looks like beta/EA JDK builds set odd defaults.

Alternatively, here is a basic working Docker image:

FROM openjdk:8
COPY . /rmiscout
WORKDIR /rmiscout
RUN ./gradlew shadowJar
ENTRYPOINT ["./rmiscout.sh"]
CMD ["-h"]

Let me know if you think it's a bug with rmiscout gradle configuration or a JDK configuration issue.

Thank you!

the-bumble commented 4 years ago

Closing this issue as it appears to be a local JDK configuration issue. Thanks for the report!