Also, damn, nice use of the SocketFactory to override the host that the exploit connects to. RMI objects can be bound to "localhost" or internal IP addresses or hostnames, but they can often be accessed externally by redirecting RMI's connection to the external interface.