jmxbf - JMXレジストリへのアクセスが設定された弱いアカウントをテストするためのブルートフォースプログラム
NCC Group Plc - http://www.nccgroup.com/ によりオープンソースとして公開
Daniele Costa により開発、daniele [dot] costa [at] nccgroup [dot] trust
http://www.github.com/nccgroup/jmxbf
AGPLの下で公開、詳細はLICENSEを参照
$>Usage:
java -jar jmxbf.jar
-h,--host <arg> The JMX server IP address.
-p,--port <arg> The JMX server listening port.
-pf,--passwords-file <arg> File including the passwords, one per line.
-uf,--usernames-file <arg> File including the usernames, one per line.
Example:
$>java jar jmxbf.jar h 192.168.20.1 p 1099 uf usernames.txt pf passwords.txt
以下に出力例をいくつか示します:
$>java jar jmxbf.jar h 192.168.20.1 p 1099 uf usernames.txt pf passwords.txt
Auth failed!!!
Auth failed!!!
Auth failed!!!
. . .
Auth failed!!!
Auth failed!!!
###SUCCESS### - We got a valid connection for: control:supersecretpwd
Found some valid credentials - continuing brute force
....
###SUCCESS### - We got a valid connection for: monitor:monitor
Found some valid credentials - continuing brute force
Auth failed!!!
Auth failed!!!
Auth failed!!!
Auth failed!!!
. . .
Auth failed!!!
Auth failed!!!
Auth failed!!!
The following valid credentials were found:
control:supersecretpwd
monitor:monitor