RMI-JMX 存在弱口令漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://comate.baidu.com/zh/page/6u32irbq5tm
• https://www.cnblogs.com/0x28/p/15685164.html
• https://nosec.org/m/share/2544.html
• https://github.com/rambleZzz/jmxbfGUI
• https://www.anquanke.com/post/id/85442
• https://m0d9.me/2020/06/01/JMX%E7%B3%BB%E5%88%97%EF%BC%9A%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%EF%BC%88%E4%B8%89%EF%BC%89/
• https://developer.aliyun.com/article/1289175
• https://agent.csdn.net/683fb7e4606a8318e85af27b.html
• https://qinguan.github.io/2018/08/13/rmi-deserialization-vulnerability/
• https://blog.0kami.cn/blog/2020/java-jmx-rmi-20200310/
• https://cloud.tencent.com/developer/article/2472080
• https://rivers.chaitin.cn/blog/cq94eap0lnechd243590
• https://www.cnblogs.com/hetianlab/p/18310050
• https://su18.org/post/rmi-attack/
• https://blog.csdn.net/xxsiyao/article/details/118732687
• https://stackoverflow.com/questions/60537915/how-to-fix-java-jmx-rmi-accessible-without-credentials
• https://www.acunetix.com/vulnerabilities/web/java-management-extensions-jmx-rmi-service-detected/
• https://mogwailabs.de/en/blog/2019/04/attacking-rmi-based-jmx-services/

Related Vulnerabilities

• RMI-JMX 未授权访问漏洞
• RMI-JMX 弱口令漏洞