Exploiting Java RMI services in 2019

Abstract

Java RMI based services were one of the major victims of the “Java Deserialization Apocalypse” in 2015. Oracle mitigated the problem by introducing multiple filters, however, under certain conditions, a attacker might still be able to exploit these services and gain RCE on the target.

Outline

1. Intro
2. Basics - RMI and Serialization 101 (to provide the necessary background that everybody needs to understand the rest)
3. Exploiting RMI services on outdated systems (Showing how easy it is to gain RCE on a vulnerable RMI service if mitigations were not applied)
4. JEP 290: Introduction to the mitigations provided by Oracle: How they work and at which level they apply.
5. Ways how attacker might be able to bypass these mitigations
6. Conclusions (offense a defense side)