nickstadb / barmie Goto Github PK
View Code? Open in Web Editor NEWJava RMI enumeration and attack tool.
License: MIT License
barmie's People
Contributors
Stargazers
Watchers
Forkers
cys3c pentestingtools idkwim ricterz av1080p h1d3r magnologan jiubadao cjjduck theralfbrown minkione 5up3rc heisehberg awesome-security tuian hax0rg1rl zh3feng gcxtx m41doror bbghunter rkornmeyer tom4t0 cyri1s wmswu selfevo h4ck0ne jumbo-wjb lucifaer chaos-cl zhangymjlu seabreg yaohf c002 ylgaaaaa explorer1092 serpmelon fnzer0 30579096 security-geeks cristian357r4 manjula-aw 5cr1p70633k peges secoba freeide yaoxiaodai imulmul 0x6b7966 raystyle welk1n lubyruffy 0c0c0f mygit2014 5l1v3r1 mmg1 thelostworldfree sec99 fzxcp3 blackstarkk roxas-tan greg-wu wdahlenburg gelosecurity spwn3r49sd3r00 hartl3y94 nosorry monopole-zh timb-machine-mirrors 3453-315h okaayfine mild0wl ba7jcm yyhuni badguy0827 hack-umbrella avaudioplayer steward007 m3m0ryl3akpalac3 zinhart dayouzi1 koushui yyyxq248 despratesparten neiroline jonnyzar dingxiao77 ajunlonglive spy0x7 crj0b ououover iq-scm werwolfz cxzero checkdock akaneiroobarmie's Issues
Exception in thread "main" java.util.NoSuchElementException
Java 7 (OpenJDK)
$ barmie --help
Exception in thread "main" java.lang.UnsupportedClassVersionError: nb/barmie/BaRMIe : Unsupported major.minor version 52.0
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:808)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:443)
at java.net.URLClassLoader.access$100(URLClassLoader.java:65)
at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at java.net.URLClassLoader$1.run(URLClassLoader.java:349)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:348)
at java.lang.ClassLoader.loadClass(ClassLoader.java:430)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:326)
at java.lang.ClassLoader.loadClass(ClassLoader.java:363)
at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:482)
Java 8+ (OpenJDK)
Tested with version 8, 11 and 17.
$ barmie --help
▄▄▄▄ ▄▄▄ ██▀███ ███▄ ▄███▓ ██▓▓█████
▓█████▄ ▒████▄ ▓██ ▒ ██▒▓██▒▀█▀ ██▒▓██▒▓█ ▀
▒██▒ ▄██▒██ ▀█▄ ▓██ ░▄█ ▒▓██ ▓██░▒██▒▒███
▒██░█▀ ░██▄▄▄▄██ ▒██▀▀█▄ ▒██ ▒██ ░██░▒▓█ ▄
░▓█ ▀█▓ ▓█ ▓██▒░██▓ ▒██▒▒██▒ ░██▒░██░░▒████▒
░▒▓███▀▒ ▒▒ ▓▒█░░ ▒▓ ░▒▓░░ ▒░ ░ ░░▓ ░░ ▒░ ░
▒░▒ ░ ▒ ▒▒ ░ ░▒ ░ ▒░░ ░ ░ ▒ ░ ░ ░ ░
░ ░ ░ ▒ ░░ ░ ░ ░ ▒ ░ ░
░ ░ ░ ░ ░ ░ ░ ░
░ v1.0
Java RMI enumeration tool.
Written by Nicky Bloor (@NickstaDB)
Warning: BaRMIe was written to aid security professionals in identifying the
insecure use of RMI services on systems which the user has prior
permission to attack. BaRMIe must be used in accordance with all
relevant laws. Failure to do so could lead to your prosecution.
The developers assume no liability and are not responsible for any
misuse or damage caused by this program.
Exception in thread "main" java.util.NoSuchElementException
at java.util.LinkedList.removeFirst(LinkedList.java:270)
at java.util.LinkedList.pop(LinkedList.java:801)
at nb.barmie.util.ProgramOptions.parseCommandLineArgs(ProgramOptions.java:104)
at nb.barmie.util.ProgramOptions.<init>(ProgramOptions.java:70)
at nb.barmie.BaRMIe.main(BaRMIe.java:54)
can not work: java -jar BaRMIe_v1.01.jar -attack --threads 16 --targets 1099.txt
can not work
java -jar BaRMIe_v1.01.jar -attack --threads 16 --targets 1099.txt
run ok:
java -jar BaRMIe_v1.01.jar -attack --targets 1099.txt
HACKING.md
"More documentation on attacking RMI and producing attacks for BaRMIe will be made available in the near future."
Some additional documentation regarding extending this tool would be really useful both for custom targets and upstream improvements. Some topics from the top of my head:
- Generating headers/footers with ysoserial - As far as I can tell, the modules don't contain the full serialized stream (magic
AC EDheader is missing for example) - How to make deser payloads compatible with
fixReferences() - High-level code organization
Inventory notification
Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory.
https://inventory.rawsec.ml/tools.html#BaRMIe
What is Rawsec's CyberSecurity Inventory?
An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.
More details about features here.
Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.
Why should you care about being inventoried?
Mainly because this is giving visibility to your tool and improve its referencing.
Badges
The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.
Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that 
Want to thank us?
If you want to thank us, you can help make our open project better known by tweeting about it! For example:
So what?
That's all, this message is just to notify you if you care. Else you can close this issue.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.