SSL Support for RMIRegistryExploit

[TorgeH]

Hi,

trying to PoC-Exploit a setup like the one explained here:
https://blogs.oracle.com/jmxetc/entry/jmx_connecting_through_firewalls_using
(ssl enhanced RMI over single port), I'm stumbling upon the same error message as the first commenter.
Would it be possible to add ssl-support to RMIRegistryExploit?

[frohoff]

The exploit code would need to create the registry client with something like this, and probably customize the SSLContext to trust the cert(s) in question:

SSLContext sc = SSLContext.getInstance("TLS");
// probably need to customize trust for self-signed certs here
SSLSocketFactory sf = sc.getSocketFactory();
RMIClientSocketFactory csf = new MySslRMIClientSocketFactory(sf);
Registry registry = LocateRegistry.getRegistry("myserver", 1234, csf);

It should be easier to build-in support for this when we finish #23.

[TorgeH]

Thanks for your observations and pointers.
I will try to tinker with these a bit.

[frohoff]

Renamed and tagged as enhancement

[frohoff]

This will probably have to wait for #23.

[frohoff]

This was fixed in #81