Fix java_jmx_server exploit

[tranca]

Add test case when discovering RMI endpoint as the previous one was not complete

During a security assessment I encountered a problem with the "java_jmx_server" exploit. After looking at the code I found that the property "javax.management.remote.rmi.RMIServerImpl_Stub" was different than the object that I had: "javax.management.remote.rmi.RMIServer". After adding this test case, the exploit worked.

Here are some additional information about the environment :

• Virtual Machine: IBM J9 VM version 2.6
• Operating System: AIX 7.1
• Java: Version 7 - 64bits

[jmartin-tech]

@tranca, can you provide any more details about the stack you used this against. I don't see much harm in expanding the check, but it would be valuable to have an example environment we can target to test against.

Something like OS version, JVM version, and maybe the web server framework used would be enough for us to generate our own vulnerable server.

[busterb]

It looks like we could just add all of the classes in javax.management.remote.rmi that implement RMIServer.

[tranca]

@jmartin-r7 I updated my PR with the additional information you requested !
@busterb Great idea, I added all the classes I found on "https://docs.oracle.com/javase/7/docs/api/javax/management/remote/rmi/package-summary.html", but I also added the RMI interfaces since this was the problem I encountered

[busterb]

Right on @tranca that looks a lot nicer.

[busterb]

Release Notes

The exploits/multi/misc/java_jmx_server module now works in more environments.