$ java -jar BaRMIe.jar
  ▄▄▄▄    ▄▄▄       ██▀███   ███▄ ▄███▓ ██▓▓█████
 ▓█████▄ ▒████▄    ▓██ ▒ ██▒▓██▒▀█▀ ██▒▓██▒▓█   ▀
 ▒██▒ ▄██▒██  ▀█▄  ▓██ ░▄█ ▒▓██    ▓██░▒██▒▒███
 ▒██░█▀  ░██▄▄▄▄██ ▒██▀▀█▄  ▒██    ▒██ ░██░▒▓█  ▄
 ░▓█  ▀█▓ ▓█   ▓██▒░██▓ ▒██▒▒██▒   ░██▒░██░░▒████▒
 ░▒▓███▀▒ ▒▒   ▓▒█░░ ▒▓ ░▒▓░░ ▒░   ░  ░░▓  ░░ ▒░ ░
 ▒░▒   ░   ▒   ▒▒ ░  ░▒ ░ ▒░░  ░      ░ ▒ ░ ░ ░  ░
  ░    ░   ░   ▒     ░░   ░ ░      ░    ▒ ░   ░
  ░            ░  ░   ░            ░    ░     ░  ░
       ░                                     v1.0
             Java RMI enumeration tool.
               Written by Nicky Bloor (@NickstaDB)

Warning: BaRMIe was written to aid security professionals in identifying the
         insecure use of RMI services on systems which the user has prior
         permission to attack. BaRMIe must be used in accordance with all
         relevant laws. Failure to do so could lead to your prosecution.
         The developers assume no liability and are not responsible for any
         misuse or damage caused by this program.

Usage:
  BaRMIe -enum [options] [host] [port]
    Enumerate RMI services on the given endpoint(s).
    Note: if -enum is not specified, this is the default mode.
  BaRMIe -attack [options] [host] [port]
    Enumerate and attack the given target(s).
Options:
  --threads  The number of threads to use for enumeration (default 10).
  --timeout  The timeout for blocking socket operations (default 5,000ms).
  --targets  A file containing targets to scan.
             The file should contain a single host or space-separated
             host and port pair per line.
             Alternatively, all nmap output formats are supported, BaRMIe will
             parse nmap output for port 1099, 'rmiregistry', or 'Java RMI'
             services to target.
             Note: [host] [port] not supported when --targets is used.
Reliability:
    A +/- system is used to indicate attack reliability as follows:
      [+  ]: Indicates an application-specific attack
      [-  ]: Indicates a JRE attack
      [ + ]: Attack insecure methods (such as 'writeFile' without auth)
      [ - ]: Attack Java deserialization (i.e. Object parameters)
      [  +]: Does not require non-default dependencies
      [  -]: Non-default dependencies are required

//Get a reference to the remote RMI registry service
Registry reg = LocateRegistry.getRegistry(targetHost, targetPort);

//Get a reference to the target RMI object
Foo bar = (Foo)reg.lookup(objectName);

//Call the remote executeCommand() method
bar.executeCommand(cmd);

public void setOption(String name, Object value);
public void addAll(List values);

public void setName(String name);
public Long add(Integer i1, Integer i2);
public void sum(int[] values);