marshalsec.jndi.RMIRefServer closed connection, but client got stuck about marshalsec

[mbechler]

Is the exploited target also using the same Java version? This is the relevant version, not the one you run the server with. Also add a trailing slash to the classpath URL, otherwise this will try to load a JAR file at that location.

[CaledoniaProject]

Yes, same version running on the same host. Attached jstack on the rmiClient: jstack.txt

[mbechler]

Ah, I did not closely look at the client code the first time. Directly performing a Registry lookup will not trigger resolving the Reference, only if you do the lookup through JNDI. E.g. something like `new InitialContext().lookup("rmi://127.0.0.1/test"). Also no need
to a add .class to the fragment when starting RMIRefServer, that should just be the classname.

[CaledoniaProject]

Indeed. I've created another java app and confirmed it. Thanks!