POC详情: a55610e107a6393db18911efda63a62c29d04dba

来源
关联漏洞
标题: Apache ActiveMQ 代码问题漏洞 (CVE-2023-46604)
描述:Apache ActiveMQ是美国阿帕奇(Apache)基金会的一套开源的消息中间件,它支持Java消息服务、集群、Spring Framework等。 Apache ActiveMQ 5.15.16之前、5.16.7之前、5.17.6之前或5.18.3之前版本存在代码问题漏洞,该漏洞源于允许具有代理网络访问权限的远程攻击者通过操纵 OpenWire 协议中的序列化类类型来运行任意 shell 命令。
描述
Repository to exploit CVE-2023-46604 reported for ActiveMQ
介绍
# Active MQ CVE-2023-46604 exploit

This repository is a guide with examples on how to exploit the [CVE-2023-46604](https://activemq.apache.org/news/cve-2023-46604)

The exploit takes advantage of the usage of reflection for instantiating Exception classes through a malicious command
that instead of being a valid command, it sends as the exception class a Spring class to load beans and as the
string constructor parameter an URL from where to download an XML file with the Spring Bean definitions.

This Spring Bean is in fact a `java.lang.ProcessBuilder` which will run any bash command with the same user permissions as the
one that is running the Java Active MQ client or server.

## Running the exploit

### Client exploit
_I wish I could make the HTTP connection in Python code, but as far as I've seen, the Spring Bean loader for some reason makes two HTTP calls and I'm more familiar with multithreaded programming in Java than in Python_

This exploit is for an ActiveMQ client making a connection to a broker server, which in turn is a malicious server that will make this client vulnerable to remote code execution.

The exploit is split into two processes:
- Python script: this script handles the connection of the ActiveMQ client to return the Spring Bean definition
- Java process: the Java process contains two Threads: the client connection and an HTTP server that returns the Spring XML Bean definition.

This has been tested with Python 3.6 and Java 17

Compile the Java project:
1. `cd activemq-exploit`
2. `mvn clean package`

3. Go back to the root project with `cd ..`, and run `python scripts/client_exploit.py`

On another terminal, run the Java code:

4. `cd activemq-exploit`
5. `java -jar target/activemq-exploit-1.0-SNAPSHOT.jar`

### Server exploit

The server exploit connects to an ActiveMQ server broker and sends the malicious commands.
This was only used with ActiveMQ Artemis 2.18 and unable to exploit the vulnerability
because Artemis is not packaged with Spring, and the only known exploit
_for remote code execution_ is through a Spring class to load Spring Beans.

However, the Python script in `scripts/server_exploit.py` does the same as the client exploit, only connecting to a server.
It lacks authentication, so maybe adaptation of the Open Wire handshake is needed.
文件快照

[4.0K] /data/pocs/a55610e107a6393db18911efda63a62c29d04dba ├── [4.0K] activemq-exploit │   ├── [4.0K] pom.xml │   └── [4.0K] src │   └── [4.0K] main │   ├── [4.0K] java │   │   ├── [4.0K] http │   │   │   └── [3.4K] HttpServer.java │   │   ├── [4.0K] victim │   │   │   └── [2.0K] ActiveMQClient.java │   │   └── [4.0K] vulnerability │   │   └── [1.6K] Vulnerability.java │   └── [4.0K] resources │   └── [ 638] exploit.xml ├── [2.3K] README.md └── [4.0K] scripts ├── [5.8K] client_exploit.py └── [5.6K] server_exploit.py 9 directories, 8 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。