BaRMIe - Poking Java’s Back Door

Explore Java's Remote Method Invocation (RMI) security vulnerabilities in this 42-minute conference talk from 44CON 2017. Delve into the prevalence of RMI, common security mistakes, potential exploits, and methods for securing RMI services. Learn about BaRMIe, a tool developed for RMI service enumeration and exploitation, and discover vulnerabilities within Java itself. Gain insights into RMI registry services, implementation, security concerns, and insecure usage. Witness demonstrations of RMI enumeration, exploitation techniques, and full RMI proxying. Understand the implications of deserialization attacks and their impact on popular software like Apache JMeter and Adobe ColdFusion.

Intro
A Story of Pwn
A Brief Introduction to RMI
The RMI Registry Service
Implementing RMI
RMI Security
Insecure Use of RMI
RMI Enumeration
Knocking on Java's Back Door
Apache JMeter
Temis Remote Admin Server
RMI: What's the Problem?
Deserialization
Adobe ColdFusion
Demo Time!
Full RMI Proxy
Proxying RMI
Poking Java's Back Door
Conclusion
Questions?