Issue on release 4.x

[dinosn]

Hi ! I have the following issue on the 4.x releases,

(root💀icestorm)-[~/tools/rmi/remote-method-guesser]# java -jar ../rmg-4.2.2-jar-with-dependencies.jar enum host0 1098  
[-] Caught unexpected java.lang.ClassCastException during lookup operation.
[-] Please report this to improve rmg :)
[-] StackTrace:
java.lang.ClassCastException: class sun.rmi.server.ActivatableRef cannot be cast to class sun.rmi.server.UnicastRef (sun.rmi.server.ActivatableRef and sun.rmi.server.UnicastRef are in module java.rmi of loader 'bootstrap')
        at de.qtc.rmg.utils.RemoteObjectWrapper.<init>(RemoteObjectWrapper.java:80)
        at de.qtc.rmg.networking.RMIRegistryEndpoint.lookup(RMIRegistryEndpoint.java:142)
        at de.qtc.rmg.operations.Dispatcher.obtainBoundObjects(Dispatcher.java:91)
        at de.qtc.rmg.operations.Dispatcher.dispatchEnum(Dispatcher.java:484)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at de.qtc.rmg.operations.Operation.invoke(Operation.java:319)
        at de.qtc.rmg.Starter.main(Starter.java:26)
[-] Cannot continue from here.
                                                                                                                                                                                                                                                                                         
(root💀icestorm)-[~/tools/rmi/remote-method-guesser]# java -version                                                                                                                                                                                                                  1 ⨯
openjdk version "11.0.14" 2022-01-18
OpenJDK Runtime Environment (build 11.0.14+9-post-Debian-1)
OpenJDK 64-Bit Server VM (build 11.0.14+9-post-Debian-1, mixed mode, sharing)

The same command using 3.2.2 or any of the other 3.x version will work without problem.

[qtc-de]

Hi dinosn 👋

thanks for reporting 👍

I know where the problem is, but the solution isn't obvious. There are some design decisions involved that need to be clarified first. Your problem is related to the action system, which is a deprecated feature of Java RMI. remote-method-guesser v4.x.x attempts to inspect the destination of bound names that are registered in the registry. rmg basically asks the registry where to find the object and the registry returns a remote reference. This reference is then inspected by using reflection.

In your case, the registry does not return a registry right away, but an activatable reference. As far as I understand it, this is a reference that points to an activator (another RMI service, comparable to the registry or the DGC) and that contains an ID that indicates the underlying object type. With this reference you can now ask the activator to activate the corresponding object, and this results in the final reference for the actual remote object.

The advantage is that remote objects do not need to be available all the time, but can be bound and exposed on demand. The design decision is now how rmg should handle this. Should it inspect the reference and only report that it's activatable or should it activate it to report the actual target? The best solution is probably making automatic activation optional. But I'm not sure yet.

However, as already mentioned, the activation features were removed in 2021 and are no longer supported. That being said, I'm still interested to implement support for your case. I will check how to build a test system and start working on it soon. Do you have your system still available for testing new release candidates? This would be great 😄

Best
Tobias

[qtc-de]

remote-method-guesser v4.3.0 was just released and addresses this issue. ActivatableRef should now be handled correctly. The example-server includes now an Activation System to verify this. When launching the enum action against an RMI registry that is part of an Activation System, the output looks like this:

[qtc@devbox ~]$ rmg enum 172.17.0.2 1098
[+] RMI registry bound names:
[+]
[+] 	- activation-test
[+] 		--> de.qtc.rmg.server.activation.IActivationService (unknown class)
[+] 		    Activator: iinsecure.dev:1098  ActivationID: 6fd4e3c:180ac45a068:-7ff1
[+] 	- activation-test2
[+] 		--> de.qtc.rmg.server.activation.IActivationService2 (unknown class)
[+] 		    Activator: iinsecure.dev:1098  ActivationID: 6fd4e3c:180ac45a068:-7fee
[+] 	- plain-server
[+] 		--> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
[+] 		    Endpoint: iinsecure.dev:41867  TLS: no  ObjID: [6fd4e3c:180ac45a068:-7fec, 969949632761859811]
[+] 	- java.rmi.activation.ActivationSystem
[+] 		--> sun.rmi.server.Activation$ActivationSystemImpl_Stub (known class: RMI Activation System)
[+] 		    Endpoint: iinsecure.dev:1098  TLS: no  ObjID: [0:0:0, 4]

So instead of showing information on the associated remote object (that may does not already exist in the case of ActivatbaleRef, as it needs to be activated first), remote-method-guesser shows information on the associated Activator. By using the --activate option during the enum action, you can instruct remote-method-guesser to activate objects during the enumeration. In this case, information on the associated remote object is also displayed:

[qtc@devbox ~]$ rmg enum 172.17.0.2 1098 --activate
[+] RMI registry bound names:
[+]
[+] 	- activation-test
[+] 		--> de.qtc.rmg.server.activation.IActivationService (unknown class)
[+] 		    Activator: iinsecure.dev:1098  ActivationID: 6fd4e3c:180ac45a068:-7ff1
[+] 		    Endpoint: iinsecure.dev:37597  TLS: no  ObjID: [1c74dc89:180ac521427:-7ffb, 3078273701606404425]
[+] 	- activation-test2
[+] 		--> de.qtc.rmg.server.activation.IActivationService2 (unknown class)
[+] 		    Activator: iinsecure.dev:1098  ActivationID: 6fd4e3c:180ac45a068:-7fee
[+] 		    Endpoint: iinsecure.dev:35721  TLS: yes  ObjID: [1c74dc89:180ac521427:-7ff8, 6235870260204364974]
[+] 	- plain-server
[+] 		--> de.qtc.rmg.server.interfaces.IPlainServer (unknown class)
[+] 		    Endpoint: iinsecure.dev:41867  TLS: no  ObjID: [6fd4e3c:180ac45a068:-7fec, 969949632761859811]
[+] 	- java.rmi.activation.ActivationSystem
[+] 		--> sun.rmi.server.Activation$ActivationSystemImpl_Stub (known class: RMI Activation System)
[+] 		    Endpoint: iinsecure.dev:1098  TLS: no  ObjID: [0:0:0, 4]

Currently, ActivatableRef support is only working for Java installations that still have classes for the activation system present. Support for versions without activation system related classes will be added in future.

Best,
Tobias