Bastien Faure via dev
2018-10-05 09:04:43 UTC
Hi there,
I always wondered about how Java and RMI services worked. Since I got a
little bit more interested in them, I noticed that there might be a
confusion on nmap side about the service naming. Let's take an example:
PORTÂ Â Â Â STATE SERVICEÂ Â Â Â VERSION
9000/tcp open rmiregistry Java RMI
9001/tcp open java-rmi   Java RMI Registry
| rmi-dumpregistry:
|Â Â jmxrmi
|Â Â Â Â javax.management.remote.rmi.RMIServerImpl_Stub
|Â Â Â Â @172.16.1.103:9000
|Â Â Â Â extends
|Â Â Â Â Â Â java.rmi.server.RemoteStub
|Â Â Â Â Â Â extends
|_Â Â Â Â Â Â Â java.rmi.server.RemoteObject
Port 9001 is a port that I configured as the registry, which is the
place where remote users can find stubs to retrieve. Here my registry
only contains one stub at port 9000.
So basically, may the service names be reversed ? For me the rmiregistry
should be at port 9001, not the opposite. Also, the rmi-dumpregistry
script was run on java-rmi, which comfort my position :D
Do you agree with that ?
Thanks !
I always wondered about how Java and RMI services worked. Since I got a
little bit more interested in them, I noticed that there might be a
confusion on nmap side about the service naming. Let's take an example:
PORTÂ Â Â Â STATE SERVICEÂ Â Â Â VERSION
9000/tcp open rmiregistry Java RMI
9001/tcp open java-rmi   Java RMI Registry
| rmi-dumpregistry:
|Â Â jmxrmi
|Â Â Â Â javax.management.remote.rmi.RMIServerImpl_Stub
|Â Â Â Â @172.16.1.103:9000
|Â Â Â Â extends
|Â Â Â Â Â Â java.rmi.server.RemoteStub
|Â Â Â Â Â Â extends
|_Â Â Â Â Â Â Â java.rmi.server.RemoteObject
Port 9001 is a port that I configured as the registry, which is the
place where remote users can find stubs to retrieve. Here my registry
only contains one stub at port 9000.
So basically, may the service names be reversed ? For me the rmiregistry
should be at port 9001, not the opposite. Also, the rmi-dumpregistry
script was run on java-rmi, which comfort my position :D
Do you agree with that ?
Thanks !
--
Bastien Faure
*Security Associate*
(602) 570-6027
_www.bishopfox.com_ <http://www.bishopfox.com/>
Bastien Faure
*Security Associate*
(602) 570-6027
_www.bishopfox.com_ <http://www.bishopfox.com/>