BaRMIe

BaRMIe BaRMIe es una herramienta para enumerar y atacar servicios Java RMI Remote Method Invocation. Los servicios RMI a menudo exponen funcionalidades peligrosas sin controles de seguridad adecuados; sin embargo, los servicios RMI tienden a pasar desapercibidos durante las evaluaciones de...

Apache James Deserialization RCE(CVE-2017-12628)

Analysis of CVE-2017-12628 This morning I spotted a tweet mentioning an “Apache James 3.0.1 JMX Server Deserialization” vulnerability, CVE-2017-12628, which caught my eye because I wrote a generic JMX deserialization exploit which is included in my RMI attack tool BaRMIe. A quick search for more...

Java RMI Enumeration & Attack Tool: BaRMIe

BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testing tools...