{"uuid": "dce22f63-678f-426c-882b-5328ab002845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-3427", "type": "seen", "source": "https://t.me/hacking_Attack/17397", "content": "IntroductionJMX stands for Java Management Extensions and can be used to monitor and configure the Java Virtual Machine  from remote. Applications like tomcat or JBoss are often installed together with a JMX instance, which  enables server administrators to monitor and manage the corresponding application.  JMX uses so called MBeans for monitoring and configuration tasks. The JMX agent (sever, port) is basically  just an interface, that handles remote connections and supports methods to communicate with the underlying  MBean objects. The actual functionality is then implemented in the MBean itself and the JMX agent only relays  input and output to the MBean object.  By default, JMX endpoints support a MBean with name MLet. This MBean can be used to deploy new MBeans on the  JMX agent. The codebase for these new MBean objects can be obtained over the network e.g. in form of a  HTTP request. Using the MLet feature, attackers with access to a JMX agent can easily deploy their own  malicious MBean objects and compromise the underlying application server.  Beanshooter is a Proof-of-Concept tool, that can be used to identify vulnerable endpoints. It works for unauthenticated JMX  endpoints as well as for authenticated ones (assumed you have valid credentials and sufficient permissions). Furthermore,  it can be used to test other vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) like insecure Java Deserialization or CVE-2016-3427. Also connections  using the JMXMP protocol are supported.  \nInstallation\n  Beanshooter is a Maven project. This makes the installation a straight forward process and no manual installation of libraries  should be required. First of all, make sure that you have maven installed on your system:  $ sudo apt install maven      # Debian\n$ pacman -s maven             # Arch  Then, clone the beanshooter project in a location of your choice and run mvn package inside of the projects folder.  -------------------  [INFO] Building beanshooter 2.0.0  [INFO] --------------------------------[ jar ]---------------------------------  [...]  \">[qtc@kali opt]$ git clone https://github.com/qtc-de/beanshooter\n[qtc@kali opt]$ cd beanshooter\n[qtc@kali beanshooter]$ mvn package\n[INFO] Scanning for projects...\n[INFO] \n[INFO] -------------------< de.qtc.Beanshooter:beanshooter >-------------------\n[INFO] Building beanshooter 2.0.0\n[INFO] --------------------------------[ jar ]---------------------------------\n[...]  Since the main purpose of beanshooter is the deployment of MBean objects, you need also a corresponding MBean.  Theoretically you can deploy any MBean that fulfills the MBean specifications. However, this project does also provide a reference  implementation, the tonka-bean (https://github.com/qtc-de/beanshooter/blob/master/tonka-bean). The tonka-bean is a separate maven project and you can compile it in the same way as  you compiled beanshooter:  ---------------------  [INFO] Building tonka-bean 1.0.0  [INFO] --------------------------------[ jar ]---------------------------------  [INFO]  [...]  \">[qtc@kali beanshooter]$ cd tonka-bean/\n[qtc@kali tonka-bean]$ mvn package\n[INFO] Scanning for projects...\n[INFO]\n[INFO] --------------------< de.qtc.TonkaBean:tonka-bean >---------------------\n[INFO] Building tonka-bean 1.0.0\n[INFO] --------------------------------[ jar ]---------------------------------\n[INFO]\n[...]  After maven has finished, you should find the executable .jar files in the target folders of the corresponding projects.  Notice, that beanshooter needs to know where the tonka-bean.jar file is located. If you have placed beanshooter  inside of your /opt folder, this should work automatically. Otherwise, you need to specify the path by using a  configuration file or the corresponding command line options.  [qtc@kali opt]$ ls -l beanshooter/target/beanshooter.jar \n-rw-r--r-- 1 qtc qtc 314856 Sep 16 07:55 beanshooter/target/beanshooter.jar\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.627662Z"}