search

BishopFox / rmiscout

RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling vulnerabilities
https://labs.bishopfox.com/tech-blog/rmiscout
MIT License
420 stars 60 forks source link

[ERROR] Dummy parameter names are required for method signature (e.g., -s 'boolean login(java.lang.String a, java.lang.String b)') #5

Closed punishell closed 4 years ago

punishell commented 4 years ago

New version throw an Exception:

kali@kali:~/tools/rmiscout$ ./rmiscout.sh wordlist -i lists/prototypes.txt 127.0.0.1 1099 Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true [INFO] Adding missing dummy parameter names to signature [INFO] Auto-corrected signature: java.lang.Boolean[] wrapperBooleanArrayTest(java.lang.Boolean[] v a)

[ERROR] Dummy parameter names are required for method signature (e.g., -s 'boolean login(java.lang.String a, java.lang.String b)')

Full Stacktrace:

javassist.CannotCompileException: [source error] syntax error near "ean[] v a) throws ja" at javassist.CtNewMethod.make(CtNewMethod.java:79) at javassist.CtNewMethod.make(CtNewMethod.java:45) at com.bishopfox.rmiscout.RMIConnector.generateStubs(RMIConnector.java:197) at com.bishopfox.rmiscout.RMIConnector.(RMIConnector.java:124) at com.bishopfox.rmiscout.RMIScout.process(RMIScout.java:198) at com.bishopfox.rmiscout.RMIScout.main(RMIScout.java:136) Caused by: compile error: syntax error near "ean[] v a) throws ja" at javassist.compiler.Parser.parseFormalParam(Parser.java:210) at javassist.compiler.Parser.parseMethod1(Parser.java:114) at javassist.compiler.Parser.parseMember1(Parser.java:65) at javassist.compiler.Javac.compile(Javac.java:90) at javassist.CtNewMethod.make(CtNewMethod.java:74) ... 5 more

the-bumble commented 4 years ago

Hi Punishell!

Pull from latest, that should be working now. I added a new signature auto-correct feature that had a bad regexp. Let me know if that push works for you.

Thank you!

Jake

punishell commented 4 years ago

working now thanks :)