Module: Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder

Included in:
Msf::Exploit::Remote::Java::Rmi::Client::Registry
Defined in:
lib/msf/core/exploit/remote/java/rmi/client/registry/builder.rb

Instance Method Summary collapse

Instance Method Details

#build_registry_list(opts = {}) ⇒ Rex::Proto::Rmi::Model::Call

Builds an RMI call to java/rmi/registry/RegistryImpl_Stub#list() used to enumerate the names bound in a registry

Parameters:

  • opts (Hash) (defaults to: {})

Returns:

See Also:

  • Builder.build_call


45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'lib/msf/core/exploit/remote/java/rmi/client/registry/builder.rb', line 45

def build_registry_list(opts = {})
  object_number = opts[:object_number] || 0
  uid_number = opts[:uid_number] || 0
  uid_time = opts[:uid_time] || 0
  uid_count = opts[:uid_count] || 0

  call = build_call(
    object_number: object_number,
    uid_number: uid_number,
    uid_time: uid_time,
    uid_count: uid_count,
    operation: 1, # java.lang.String list()[]
    hash: registry_interface_hash,
    arguments: []
  )

  call
end

#build_registry_lookup(opts = {}) ⇒ Rex::Proto::Rmi::Model::Call

Builds an RMI call to java/rmi/registry/RegistryImpl_Stub#lookup() used to retrieve the remote reference bound to a name.

Parameters:

  • opts (Hash) (defaults to: {})

Options Hash (opts):

  • :name (String) —

    the name to lookup

Returns:

See Also:

  • Builder.build_call


19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/msf/core/exploit/remote/java/rmi/client/registry/builder.rb', line 19

def build_registry_lookup(opts = {})
  object_number = opts[:object_number] || 0
  uid_number = opts[:uid_number] || 0
  uid_time = opts[:uid_time] || 0
  uid_count = opts[:uid_count] || 0
  name = opts[:name] || ''

  call = build_call(
    object_number: object_number,
    uid_number: uid_number,
    uid_time: uid_time,
    uid_count: uid_count,
    operation: 2, # java.rmi.Remote lookup(java.lang.String)
    hash: registry_interface_hash,
    arguments: [Rex::Java::Serialization::Model::Utf.new(nil, name)]
  )

  call
end