java.lang.ClassNotFoundException: com.sun.corba.se.spi.logging.LogWrapperBase about rmiscout

[the-bumble]

Hi @executionByFork,

Happy to help!

The warnings are happening because RMIScout dependencies require JRE 8 (e.g., CORBA and ysoserial) so functionality is limited on newer JREs. For more details, see the troubleshooting section: https://github.com/BishopFox/rmiscout#troubleshooting

I've seen a few false positives for RMI from nmap (e.g., JNDI services). Would you mind sharing the results of the nmap rmi-dumpregistry script?

nmap --script rmi-dumpregistry <host> -p <port> -Pn

Thank you!

Jake

[executionByFork]

Hm, it seems the nmap script returns no output when used on that host and port (besides port info). The nmap script does return output when used on another host, which has RMI over the typical port 1099. So, I think this may actually be a false positive RMI finding from nmap.

Just to clarify, this nmap script always returns information when the service on the given port is RMI, right? So if no information is returned from the script, it can be assumed that the service is not RMI? Or are there instances you are aware of in which this script will return no output for an actual RMI port?

[the-bumble]

Yes, my guess is that it is likely a false positive RMI finding from NMAP. It's possible there may be a string literal "RMI" in the server response that is causing a false positive.

It's possible that it's a proprietary protocol and does not use JRMP/IIOP. Here was a previous instance of such a finding: #9 (comment)

I hope that helps!

Jake