Skip to content

Broker — Attack Chain (COMPLETE)

Full Path: Nmap → Web (ActiveMQ console, admin:admin) → ActiveMQ 5.15.15 identified → CVE-2023-46604 (OpenWire RCE, port 61616) → Reverse Shell (activemq) → sudo -l → (ALL) NOPASSWD: /usr/sbin/nginx → Custom config serves filesystem as root → User Flag + Root Flag

Branch Points

1. How to access the web app?

  • Chosen: Default creds admin:admin on HTTP Basic Auth → ActiveMQ web console

2. How to get a shell?

  • Chosen: CVE-2023-46604 — OpenWire deserialization RCE via port 61616. Used SaumyajeetDas exploit repo with msfvenom ELF reverse shell
  • Not tried: Metasploit module (exploit/multi/misc/apache_activemq_rce_cve_2023_46604)
  • Rabbit holes: Jetty vulns, Spring4Shell, TRACE method — none applicable

3. activemq → root (privilege escalation)

  • Chosen: sudo /usr/sbin/nginx -c /tmp/evil.conf — custom config with user root; and root /; serves entire filesystem on port 9001. Curled both flags from attacker machine.
  • Alternative not tried: Enable dav_methods PUT in config to write SSH key to /root/.ssh/authorized_keys for a proper root shell